@wildo-ai/saas-models 1.0.1 → 1.1.0

package/dist/esm/requests/manual-controllers-routes-urls.js

@@ -4,9 +4,100 @@
  * Shared between backend and frontend to avoid string duplication.
  *
  * Notes:
- * - These URLs are mounted under the main API base path (e.g. /api/v1)
- * - Keep only path segments here (no /api/v1 prefix)
+ * - These URLs are mounted under {@link MAIN_API_BASE_PATH}
+ * - Keep only path segments here (no `MAIN_API_BASE_PATH` prefix) — the
+ *   prefix is prepended once at each boundary (backend mount / frontend client)
  */
+/**
+ * Main API base path — the mount prefix under which the entire main
+ * controllers registry is served (every resource route AND every
+ * {@link MANUAL_CONTROLLER_ROUTES_URLS} entry).
+ *
+ * This is the SINGLE SOURCE OF TRUTH for the prefix. It is consumed by:
+ *  - the backend HTTP server mount (`app.use(MAIN_API_BASE_PATH, mainRouter)`),
+ *  - the frontend HTTP client when building absolute API URLs
+ *    (`${MAIN_API_BASE_PATH}${MANUAL_CONTROLLER_ROUTES_URLS[...]}`),
+ *  - the refresh-token cookie `Path` scope, which MUST path-match the served
+ *    auth routes (`${MAIN_API_BASE_PATH}/auth/*`) or the browser drops it.
+ *
+ * Why a shared symbol and not a literal: previously `/api/v1` was a literal
+ * duplicated across the mount and the client. The absence of a shared symbol
+ * let the refresh-token cookie `Path` be authored against the bare route
+ * segment (`/auth`, omitting this prefix), so the browser stored the cookie
+ * but never sent it to `/api/v1/auth/token/refresh` — silently breaking token
+ * refresh for every session (forced logout on first refresh). Deriving every
+ * prefix consumer from this constant closes that drift class.
+ *
+ * NOT under this prefix: the root-level engine routes in
+ * {@link ENGINE_ROOT_ROUTES} (health/time probes), mounted at the app root.
+ */
+export const MAIN_API_BASE_PATH = '/api/v1';
+/**
+ * Where RFC 8414 authorization-server metadata must be served for an issuer that carries a PATH.
+ *
+ * The rule is counter-intuitive and is the reason this exists as a named derivation rather than a
+ * string built at the call site: the well-known segment goes BETWEEN the host and the issuer path,
+ * not after it.
+ *
+ *   "If the issuer identifier value contains a path component, any terminating "/" MUST be removed
+ *    before inserting "/.well-known/" and the well-known URI suffix between the host component and
+ *    the path component."
+ *
+ * with the RFC's own worked example resolving issuer `https://example.com/issuer1` to
+ * `GET /.well-known/oauth-authorization-server/issuer1`.
+ * spec-cite: RFC 8414 § 3 (Obtaining Authorization Server Metadata), fetched 2026-08-11.
+ *
+ * OIDC Discovery uses the OPPOSITE construction — issuer + `/.well-known/openid-configuration` — so
+ * the two cannot share one path and a server that serves only the OIDC shape fails RFC 8414 discovery
+ * while looking correct. That is exactly what happened here: a real MCP client split our issuer at the
+ * host boundary as the RFC instructs, asked for `/.well-known/oauth-authorization-server/api/v1`,
+ * received the SPA shell, and abandoned authorization without ever opening a browser.
+ *
+ * @param issuerPath the issuer's path component (e.g. {@link MAIN_API_BASE_PATH}); a bare `/` or an
+ *                   empty string yields the origin-root location, which is the path-less issuer case.
+ */
+export function rfc8414AuthorizationServerMetadataPath(issuerPath) {
+    return wellKnownPathBeforeResourcePath('oauth-authorization-server', issuerPath);
+}
+/**
+ * Where RFC 9728 protected-resource metadata must be served for a resource identifier that carries a
+ * PATH — the same insertion rule as {@link rfc8414AuthorizationServerMetadataPath}, for the other
+ * document.
+ *
+ *   "The protected resource's well-known URI is created by inserting
+ *    /.well-known/oauth-protected-resource between the host component and the path component (if any)
+ *    of the resource identifier."
+ * spec-cite: RFC 9728 § 3 (Protected Resource Metadata Request), fetched 2026-08-12.
+ *
+ * This is a SECOND discovery route, not a replacement for the one the challenge names. RFC 9728 § 5.1
+ * lets a client take `resource_metadata` straight from the `WWW-Authenticate` header, and MCP tells
+ * clients to do exactly that — which is why serving only the header's location worked with a real
+ * client and is a defensible posture. It is nevertheless not the whole contract: a client that derives
+ * the location from the resource identifier, as this section permits, previously received the SPA
+ * shell. Both locations now serve one document.
+ *
+ * Note the asymmetry with RFC 8414, because it explains why that one was a live outage and this one
+ * was latent: an authorization server publishes no equivalent pointer, so derivation is a client's
+ * ONLY route to AS metadata.
+ *
+ * @param resourcePath the resource identifier's path component (e.g. `/api/v1/mcp`); a bare `/` or an
+ *                     empty string yields the origin-root location, which is the path-less case.
+ */
+export function rfc9728ProtectedResourceMetadataPath(resourcePath) {
+    return wellKnownPathBeforeResourcePath('oauth-protected-resource', resourcePath);
+}
+/**
+ * The construction RFC 8414 § 3 and RFC 9728 § 3 both specify: strip any terminating `/`, then insert
+ * the well-known segment BETWEEN the host and the path.
+ *
+ * Shared deliberately rather than written twice. The rule is counter-intuitive enough that it was
+ * already implemented wrongly once here, and a second hand-rolled copy is how the two documents would
+ * come to disagree about a rule they take verbatim from each other.
+ */
+function wellKnownPathBeforeResourcePath(wellKnownSegment, path) {
+    const normalized = path.replace(/\/+$/, '');
+    return `/.well-known/${wellKnownSegment}${normalized.startsWith('/') || normalized === '' ? normalized : `/${normalized}`}`;
+}
 export var ManualControllerRouteKey;
 (function (ManualControllerRouteKey) {
     ManualControllerRouteKey["APPLICATION_CONFIG_GET"] = "APPLICATION_CONFIG_GET";
@@ -20,16 +111,85 @@ export var ManualControllerRouteKey;
     ManualControllerRouteKey["AUTH_ENTERPRISE_SSO_AUTHORIZE"] = "AUTH_ENTERPRISE_SSO_AUTHORIZE";
     ManualControllerRouteKey["AUTH_APP_ENTERPRISE_AUTHORIZE"] = "AUTH_APP_ENTERPRISE_AUTHORIZE";
     ManualControllerRouteKey["AUTH_TOKEN_EXCHANGE"] = "AUTH_TOKEN_EXCHANGE";
+    /**
+     * OAuth 2.0 Authorization Server token endpoint (Wildo-AS-PROVIDER, distinct from the
+     * RP-side `/auth/*` routes). Serves `grant_type=client_credentials` now; the OIDC branch
+     * adds `authorization_code`. Served at `${MAIN_API_BASE_PATH}/oauth/token`.
+     */
+    ManualControllerRouteKey["OAUTH_PROVIDER_TOKEN"] = "OAUTH_PROVIDER_TOKEN";
+    /** OIDC discovery document (served at `${issuer}/.well-known/openid-configuration`). */
+    ManualControllerRouteKey["OAUTH_PROVIDER_DISCOVERY"] = "OAUTH_PROVIDER_DISCOVERY";
+    /**
+     * RFC 8414 Authorization Server Metadata (`${issuer}/.well-known/oauth-authorization-server`) —
+     * the SAME document as {@link OAUTH_PROVIDER_DISCOVERY}, served at the OAuth-2 well-known path that
+     * many OAuth/MCP clients probe FIRST (before the OIDC path). Aliases the discovery handler.
+     */
+    ManualControllerRouteKey["OAUTH_PROVIDER_AS_METADATA"] = "OAUTH_PROVIDER_AS_METADATA";
+    /** JSON Web Key Set for verifying Wildo-issued tokens (the discovery doc's `jwks_uri`). */
+    ManualControllerRouteKey["OAUTH_PROVIDER_JWKS"] = "OAUTH_PROVIDER_JWKS";
+    /** OIDC authorization endpoint (authorization_code flow — the caller lands here to consent). */
+    ManualControllerRouteKey["OAUTH_PROVIDER_AUTHORIZE"] = "OAUTH_PROVIDER_AUTHORIZE";
+    /**
+     * OIDC interactive-consent decision endpoint. When the authorize endpoint returned
+     * `consent_required` for a `requiresConsent` client, the user's approve/deny decision is POSTed
+     * here with the single-use consent-request token; APPROVE mints the authorization code.
+     */
+    ManualControllerRouteKey["OAUTH_PROVIDER_CONSENT"] = "OAUTH_PROVIDER_CONSENT";
+    /** OIDC UserInfo endpoint (bearer access token → the user's standard claims). */
+    ManualControllerRouteKey["OAUTH_PROVIDER_USERINFO"] = "OAUTH_PROVIDER_USERINFO";
+    /** OAuth 2.0 token revocation endpoint (RFC 7009). */
+    ManualControllerRouteKey["OAUTH_PROVIDER_REVOKE"] = "OAUTH_PROVIDER_REVOKE";
+    /**
+     * OIDC RP-Initiated Logout 1.0 `end_session_endpoint` (revocation-C). A relying party redirects the
+     * End-User here (with an `id_token_hint`) to terminate their Wildo OP login session — the exact
+     * session the delegation was authorized from, keyed on the id_token's `sid`. Distinct from
+     * {@link OAUTH_PROVIDER_REVOKE}: revoke kills a TOKEN (RFC 7009); end_session ends a SESSION.
+     */
+    ManualControllerRouteKey["OAUTH_PROVIDER_END_SESSION"] = "OAUTH_PROVIDER_END_SESSION";
+    /**
+     * OIDC RP-Initiated Logout 1.0 §6 confirmation decision (revocation-C). The `POST` the frontend
+     * `/oauth/logout-confirm` prompt calls to actually terminate the session, presenting the single-use
+     * `OIDC_LOGOUT_CONFIRMATION` token minted by {@link OAUTH_PROVIDER_END_SESSION}. Token-authorized
+     * (no Bearer — the End-User may be unauthenticated in the SPA, having arrived via an RP redirect);
+     * returns `{ redirect_to }` (always the same-origin signed-out page `/oauth/logged-out`; the SPA
+     * navigates there). Only reached for NON-trusted logouts — a trusted RP logout terminates + redirects
+     * inline without a prompt (the Keycloak-style posture).
+     */
+    ManualControllerRouteKey["OAUTH_PROVIDER_END_SESSION_CONFIRM"] = "OAUTH_PROVIDER_END_SESSION_CONFIRM";
+    /**
+     * RFC 7591 dynamic client registration. Registered UNCONDITIONALLY so the route always exists;
+     * the handler answers 404 unless the application opted in via `auth.dynamicClientRegistration`.
+     * Registering it conditionally would make the route table depend on config, which is far harder
+     * to reason about than one handler that refuses.
+     */
+    ManualControllerRouteKey["OAUTH_PROVIDER_REGISTER"] = "OAUTH_PROVIDER_REGISTER";
+    /**
+     * Cross-frontend session handoff (cross-app-jwt-propagation Step 2).
+     * Authenticated user requests a one-time AUTH_CODE_EXCHANGE token bound to a
+     * target frontend, then redirects the browser to the target's
+     * /auth/exchange page with the code. Bearer-only; CORS auto-allowed for every
+     * declared frontendService via the existing deriveCorsOrigins() seam.
+     */
+    ManualControllerRouteKey["AUTH_CROSS_FRONTEND_HANDOFF"] = "AUTH_CROSS_FRONTEND_HANDOFF";
     ManualControllerRouteKey["AUTH_LOGOUT"] = "AUTH_LOGOUT";
+    /** Sign-out-everywhere: fences the whole user — all access + refresh tokens, every device — via the invalidation fence. */
+    ManualControllerRouteKey["AUTH_LOGOUT_ALL"] = "AUTH_LOGOUT_ALL";
     ManualControllerRouteKey["AUTH_PASSWORD_RESET_REQUEST"] = "AUTH_PASSWORD_RESET_REQUEST";
     ManualControllerRouteKey["AUTH_PASSWORD_RESET_COMPLETE"] = "AUTH_PASSWORD_RESET_COMPLETE";
     ManualControllerRouteKey["AUTH_REGISTER"] = "AUTH_REGISTER";
     ManualControllerRouteKey["AUTH_ACCEPT_INVITATION"] = "AUTH_ACCEPT_INVITATION";
+    // Public token-keyed invitation-accept DISCOVERY (non-consuming): returns the
+    // invited org's available auth methods + SSO/SCIM management mode so the accept
+    // screen can render the right chooser. Read-only; does NOT consume the token.
+    ManualControllerRouteKey["AUTH_INVITATION_INFO"] = "AUTH_INVITATION_INFO";
     ManualControllerRouteKey["AUTH_REJECT_INVITATION"] = "AUTH_REJECT_INVITATION";
+    // In-app authenticated invitation management (Approach P) — a signed-in user acts on
+    // THEIR OWN pending invitations (authorized by email-ownership), no token, no new session.
+    ManualControllerRouteKey["AUTH_LIST_MY_INVITATIONS"] = "AUTH_LIST_MY_INVITATIONS";
+    ManualControllerRouteKey["AUTH_ACCEPT_MY_INVITATION"] = "AUTH_ACCEPT_MY_INVITATION";
+    ManualControllerRouteKey["AUTH_REJECT_MY_INVITATION"] = "AUTH_REJECT_MY_INVITATION";
     ManualControllerRouteKey["AUTH_VERIFY_EMAIL"] = "AUTH_VERIFY_EMAIL";
     ManualControllerRouteKey["AUTH_SESSION_STATE"] = "AUTH_SESSION_STATE";
-    /** [Capacitor] Exchange native Apple/Google SDK identity token for Wildo JWT (F2) */
-    ManualControllerRouteKey["AUTH_NATIVE_TOKEN_EXCHANGE"] = "AUTH_NATIVE_TOKEN_EXCHANGE";
     // MFA — Email OTP (Step 10)
     ManualControllerRouteKey["AUTH_MFA_EMAIL_OTP_SEND"] = "AUTH_MFA_EMAIL_OTP_SEND";
     ManualControllerRouteKey["AUTH_MFA_EMAIL_OTP_VERIFY"] = "AUTH_MFA_EMAIL_OTP_VERIFY";
@@ -62,6 +222,8 @@ export var ManualControllerRouteKey;
     ManualControllerRouteKey["AUTH_ONE_OFF_SESSION_CREATE"] = "AUTH_ONE_OFF_SESSION_CREATE";
     ManualControllerRouteKey["AUTH_ONE_OFF_SESSION_CREATE_ORG"] = "AUTH_ONE_OFF_SESSION_CREATE_ORG";
     ManualControllerRouteKey["AUTH_ONE_OFF_SESSION_EXCHANGE"] = "AUTH_ONE_OFF_SESSION_EXCHANGE";
+    ManualControllerRouteKey["AUTH_ONE_OFF_SESSION_REVOKE"] = "AUTH_ONE_OFF_SESSION_REVOKE";
+    ManualControllerRouteKey["AUTH_ONE_OFF_SESSION_REVOKE_ORG"] = "AUTH_ONE_OFF_SESSION_REVOKE_ORG";
     // Method Management (#13f)
     ManualControllerRouteKey["AUTH_PASSWORD_CHANGE"] = "AUTH_PASSWORD_CHANGE";
     ManualControllerRouteKey["AUTH_PASSWORD_SET"] = "AUTH_PASSWORD_SET";
@@ -70,17 +232,62 @@ export var ManualControllerRouteKey;
     ManualControllerRouteKey["AUTH_IDENTITY_LINKS_LIST"] = "AUTH_IDENTITY_LINKS_LIST";
     ManualControllerRouteKey["AUTH_IDENTITY_LINKS_UNLINK"] = "AUTH_IDENTITY_LINKS_UNLINK";
     ManualControllerRouteKey["AUTH_REAUTH"] = "AUTH_REAUTH";
+    /** Challenge leg of a PASSKEY step-up: WebAuthn is challenge-response, so re-auth needs two round-trips. */
+    ManualControllerRouteKey["AUTH_REAUTH_PASSKEY_OPTIONS"] = "AUTH_REAUTH_PASSKEY_OPTIONS";
     // SAML Routes (AUTH-2)
     ManualControllerRouteKey["AUTH_SAML_LOGIN"] = "AUTH_SAML_LOGIN";
     ManualControllerRouteKey["AUTH_SAML_ACS"] = "AUTH_SAML_ACS";
     ManualControllerRouteKey["AUTH_SAML_METADATA"] = "AUTH_SAML_METADATA";
     ManualControllerRouteKey["AUTH_SAML_SLO"] = "AUTH_SAML_SLO";
+    /** SP-INITIATED SLO kickoff: the app asks the backend to log the caller out of their SAML session and (when the IdP supports it) redirect to the IdP's SLO endpoint. Distinct from AUTH_SAML_SLO, which is the INBOUND endpoint the IdP calls. */
+    ManualControllerRouteKey["AUTH_SAML_SP_LOGOUT"] = "AUTH_SAML_SP_LOGOUT";
     ManualControllerRouteKey["I18N_GET_LABELS"] = "I18N_GET_LABELS";
     ManualControllerRouteKey["CHARTS_DATA"] = "CHARTS_DATA";
     ManualControllerRouteKey["ANALYTICS_EVENTS"] = "ANALYTICS_EVENTS";
     ManualControllerRouteKey["ANALYTICS_MOMENTS_ACHIEVED"] = "ANALYTICS_MOMENTS_ACHIEVED";
     ManualControllerRouteKey["PROGRESSION_MILESTONES"] = "PROGRESSION_MILESTONES";
     ManualControllerRouteKey["FEATURES_RESOLVED"] = "FEATURES_RESOLVED";
+    /** Frontend-visible flow/actor systems (metadata + renderable graph). */
+    ManualControllerRouteKey["FLOWS_ACTORS_FRONTEND_INFO"] = "FLOWS_ACTORS_FRONTEND_INFO";
+    /** The caller's own conversation history for a flow/actor system. */
+    ManualControllerRouteKey["FLOWS_ACTORS_HISTORY"] = "FLOWS_ACTORS_HISTORY";
+    // === A2A (external actor exposure — Agent2Agent protocol) ===
+    /**
+     * A2A agent card (public, CORS-open metadata) advertising this app's exposed
+     * actor systems as A2A skills + the security schemes a caller must satisfy.
+     * Analogous to the OIDC discovery doc; the served path can be reverse-proxy
+     * aliased to a root `/.well-known/agent-card.json`.
+     */
+    ManualControllerRouteKey["A2A_AGENT_CARD"] = "A2A_AGENT_CARD";
+    /**
+     * A2A JSON-RPC task/message endpoint (`message/send`, `message/stream` via SSE).
+     * Its absolute URL is the agent card's `url` AND the agent's canonical
+     * audience — an inbound access token MUST carry this as its `aud` (RFC 8707 / D7).
+     */
+    ManualControllerRouteKey["A2A_TASKS"] = "A2A_TASKS";
+    // === MCP (Model Context Protocol server — resource operations as tools) ===
+    /**
+     * MCP JSON-RPC 2.0 endpoint (Streamable-HTTP transport): `initialize`, `tools/list`,
+     * `tools/call`. A `tools/call` is Bearer-credentialed by a machine OR user-delegated access token
+     * that is resource-server-bound to the MCP audience — NOT the generic API audience, which this
+     * surface rejects since the 2026-07-29 strict flip (RFC 8707 / D7) — validated at auth time; the
+     * server re-runs `authorizeInController` before dispatch (fail-closed).
+     *
+     * Also the base for the R-2 NAMED server instances: `POST /mcp/:instanceRef` serves a declared
+     * instance with its own audience (`…/mcp/<ref>`) and curated catalog.
+     */
+    ManualControllerRouteKey["MCP_ENDPOINT"] = "MCP_ENDPOINT";
+    /**
+     * MCP OAuth 2.0 Protected Resource Metadata (RFC 9728): advertises this MCP server's
+     * `resource` identifier + the `authorization_servers` (the app's own OIDC provider) an MCP
+     * client uses to obtain a token. Public, CORS-open metadata (like the OIDC discovery doc).
+     *
+     * Mounted TWICE: at the API root for the DEFAULT server, and appended to each named instance
+     * (`/mcp/:instanceRef` + this route) so every instance advertises its OWN audience. A 401 at either
+     * surface points its `WWW-Authenticate: resource_metadata=` at the matching one — the only discovery
+     * route a client has, since this path is non-standard (it is not the RFC's origin-root form).
+     */
+    ManualControllerRouteKey["MCP_PROTECTED_RESOURCE_METADATA"] = "MCP_PROTECTED_RESOURCE_METADATA";
 })(ManualControllerRouteKey || (ManualControllerRouteKey = {}));
 export const MANUAL_CONTROLLER_ROUTES_URLS = {
     [ManualControllerRouteKey.APPLICATION_CONFIG_GET]: '/application-config',
@@ -93,15 +300,39 @@ export const MANUAL_CONTROLLER_ROUTES_URLS = {
     [ManualControllerRouteKey.AUTH_ENTERPRISE_SSO_AUTHORIZE]: '/auth/enterprise/authorize/:orgId/:connectionId',
     [ManualControllerRouteKey.AUTH_APP_ENTERPRISE_AUTHORIZE]: '/auth/app-enterprise/authorize/:connectionId',
     [ManualControllerRouteKey.AUTH_TOKEN_EXCHANGE]: '/auth/token/exchange',
+    // OAuth 2.0 Authorization Server token endpoint (Wildo-as-provider).
+    [ManualControllerRouteKey.OAUTH_PROVIDER_TOKEN]: '/oauth/token',
+    // OIDC discovery + JWKS. Served under the API mount, so with issuer `${publicUrl}${MAIN_API_BASE_PATH}`
+    // a client's `${issuer}/.well-known/openid-configuration` resolves here. That is correct for OIDC
+    // Discovery (issuer + suffix) and NOT for RFC 8414, which places the well-known segment BETWEEN the
+    // host and the issuer path — see {@link rfc8414AuthorizationServerMetadataPath}, which the HTTP
+    // server mounts as a second location for the SAME document. (This used to say a root-level alias was
+    // "a reverse-proxy concern"; leaving it to ingress meant every deployment that did not add the rule
+    // silently failed RFC 8414 discovery, so the server now serves it directly.)
+    [ManualControllerRouteKey.OAUTH_PROVIDER_DISCOVERY]: '/.well-known/openid-configuration',
+    [ManualControllerRouteKey.OAUTH_PROVIDER_AS_METADATA]: '/.well-known/oauth-authorization-server',
+    [ManualControllerRouteKey.OAUTH_PROVIDER_JWKS]: '/oauth/jwks',
+    [ManualControllerRouteKey.OAUTH_PROVIDER_AUTHORIZE]: '/oauth/authorize',
+    [ManualControllerRouteKey.OAUTH_PROVIDER_CONSENT]: '/oauth/authorize/decision',
+    [ManualControllerRouteKey.OAUTH_PROVIDER_USERINFO]: '/oauth/userinfo',
+    [ManualControllerRouteKey.OAUTH_PROVIDER_REVOKE]: '/oauth/revoke',
+    [ManualControllerRouteKey.OAUTH_PROVIDER_END_SESSION]: '/oauth/end-session',
+    [ManualControllerRouteKey.OAUTH_PROVIDER_END_SESSION_CONFIRM]: '/oauth/end-session/confirm',
+    [ManualControllerRouteKey.OAUTH_PROVIDER_REGISTER]: '/oauth/register',
+    [ManualControllerRouteKey.AUTH_CROSS_FRONTEND_HANDOFF]: '/auth/cross-frontend-handoff',
     [ManualControllerRouteKey.AUTH_LOGOUT]: '/auth/logout',
+    [ManualControllerRouteKey.AUTH_LOGOUT_ALL]: '/auth/logout-all',
     [ManualControllerRouteKey.AUTH_PASSWORD_RESET_REQUEST]: '/auth/password-reset/request',
     [ManualControllerRouteKey.AUTH_PASSWORD_RESET_COMPLETE]: '/auth/password-reset/complete',
     [ManualControllerRouteKey.AUTH_REGISTER]: '/auth/register',
     [ManualControllerRouteKey.AUTH_ACCEPT_INVITATION]: '/auth/invitation/accept',
+    [ManualControllerRouteKey.AUTH_INVITATION_INFO]: '/auth/invitation/info',
     [ManualControllerRouteKey.AUTH_REJECT_INVITATION]: '/auth/invitation/reject',
+    [ManualControllerRouteKey.AUTH_LIST_MY_INVITATIONS]: '/auth/invitations/mine',
+    [ManualControllerRouteKey.AUTH_ACCEPT_MY_INVITATION]: '/auth/invitations/accept',
+    [ManualControllerRouteKey.AUTH_REJECT_MY_INVITATION]: '/auth/invitations/reject',
     [ManualControllerRouteKey.AUTH_VERIFY_EMAIL]: '/auth/verify-email',
     [ManualControllerRouteKey.AUTH_SESSION_STATE]: '/auth/session/:sessionId',
-    [ManualControllerRouteKey.AUTH_NATIVE_TOKEN_EXCHANGE]: '/auth/native-token/exchange',
     // Magic Link (Phase G2)
     [ManualControllerRouteKey.AUTH_MAGIC_LINK_SEND]: '/auth/magic-link/send',
     [ManualControllerRouteKey.AUTH_MAGIC_LINK_VERIFY]: '/auth/magic-link/verify',
@@ -119,6 +350,8 @@ export const MANUAL_CONTROLLER_ROUTES_URLS = {
     [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_CREATE]: '/apps/:applicationId/auth/one-off-session',
     [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_CREATE_ORG]: '/orgs/:organizationId/apps/:applicationId/auth/one-off-session',
     [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_EXCHANGE]: '/auth/one-off-session/exchange',
+    [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_REVOKE]: '/apps/:applicationId/auth/one-off-session/:tokenId/revoke',
+    [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_REVOKE_ORG]: '/orgs/:organizationId/apps/:applicationId/auth/one-off-session/:tokenId/revoke',
     // Method Management (#13f)
     [ManualControllerRouteKey.AUTH_PASSWORD_CHANGE]: '/auth/password/change',
     [ManualControllerRouteKey.AUTH_PASSWORD_SET]: '/auth/password/set',
@@ -127,11 +360,13 @@ export const MANUAL_CONTROLLER_ROUTES_URLS = {
     [ManualControllerRouteKey.AUTH_IDENTITY_LINKS_LIST]: '/auth/identity-links',
     [ManualControllerRouteKey.AUTH_IDENTITY_LINKS_UNLINK]: '/auth/identity-links/:linkId',
     [ManualControllerRouteKey.AUTH_REAUTH]: '/auth/reauth',
+    [ManualControllerRouteKey.AUTH_REAUTH_PASSKEY_OPTIONS]: '/auth/reauth/passkey/options',
     // SAML Routes (AUTH-2)
     [ManualControllerRouteKey.AUTH_SAML_LOGIN]: '/auth/saml/login/:connectionId',
     [ManualControllerRouteKey.AUTH_SAML_ACS]: '/auth/saml/acs',
     [ManualControllerRouteKey.AUTH_SAML_METADATA]: '/auth/saml/metadata/:scopeType/:scopeId',
     [ManualControllerRouteKey.AUTH_SAML_SLO]: '/auth/saml/slo',
+    [ManualControllerRouteKey.AUTH_SAML_SP_LOGOUT]: '/auth/saml/logout',
     [ManualControllerRouteKey.I18N_GET_LABELS]: '/i18n/labels',
     [ManualControllerRouteKey.CHARTS_DATA]: '/charts/:chartRef/data',
     // MFA — Email OTP (Step 10)
@@ -153,6 +388,20 @@ export const MANUAL_CONTROLLER_ROUTES_URLS = {
     [ManualControllerRouteKey.ANALYTICS_MOMENTS_ACHIEVED]: '/analytics/moments/achieved',
     [ManualControllerRouteKey.PROGRESSION_MILESTONES]: '/progression/milestones',
     [ManualControllerRouteKey.FEATURES_RESOLVED]: '/features/resolved',
+    [ManualControllerRouteKey.FLOWS_ACTORS_FRONTEND_INFO]: '/flows-actors/frontend-info',
+    [ManualControllerRouteKey.FLOWS_ACTORS_HISTORY]: '/flows-actors/history',
+    // === A2A (external actor exposure) ===
+    // Card served under the API mount, so with issuer `${publicUrl}${MAIN_API_BASE_PATH}`
+    // a caller's `${issuer}/a2a/.well-known/agent-card.json` resolves here (a root-level
+    // `/.well-known/agent-card.json` alias is a reverse-proxy concern).
+    [ManualControllerRouteKey.A2A_AGENT_CARD]: '/a2a/.well-known/agent-card.json',
+    [ManualControllerRouteKey.A2A_TASKS]: '/a2a',
+    // === MCP (Model Context Protocol server) ===
+    // JSON-RPC endpoint + RFC 9728 protected-resource metadata, served under the API mount. The
+    // metadata's `resource` is `${publicUrl}${MAIN_API_BASE_PATH}/mcp`; a root-level
+    // `/.well-known/oauth-protected-resource` alias is a reverse-proxy concern.
+    [ManualControllerRouteKey.MCP_ENDPOINT]: '/mcp',
+    [ManualControllerRouteKey.MCP_PROTECTED_RESOURCE_METADATA]: '/.well-known/oauth-protected-resource',
 };
 // =====================================================
 // Root-level engine routes (NOT under /api/v1)
@@ -169,4 +418,4 @@ export const ENGINE_ROOT_ROUTES = {
     [EngineRootRouteKey.HEALTH_READINESS]: '/health/ready',
     [EngineRootRouteKey.HEALTH_TIME]: '/health/time',
 };
-//# sourceMappingURL=manual-controllers-routes-urls.js.map
+//# sourceMappingURL=manual-controllers-routes-urls.js.map

package/dist/esm/requests/manual-controllers-routes-urls.js.map

@@ -1 +1 @@
-{"version":3,"file":"manual-controllers-routes-urls.js","sourceRoot":"","sources":["../../../src/requests/manual-controllers-routes-urls.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,CAAN,IAAY,wBAyFX;AAzFD,WAAY,wBAAwB;IAClC,6EAAiD,CAAA;IAEjD,2DAA+B,CAAA;IAC/B,qFAAyD,CAAA;IACzD,mEAAuC,CAAA;IACvC,qEAAyC,CAAA;IACzC,2EAA+C,CAAA;IAC/C,yEAA6C,CAAA;IAC7C,kFAAkF;IAClF,2FAA+D,CAAA;IAC/D,2FAA+D,CAAA;IAC/D,uEAA2C,CAAA;IAC3C,uDAA2B,CAAA;IAC3B,uFAA2D,CAAA;IAC3D,yFAA6D,CAAA;IAC7D,2DAA+B,CAAA;IAC/B,6EAAiD,CAAA;IACjD,6EAAiD,CAAA;IACjD,mEAAuC,CAAA;IACvC,qEAAyC,CAAA;IACzC,qFAAqF;IACrF,qFAAyD,CAAA;IAEzD,4BAA4B;IAC5B,+EAAmD,CAAA;IACnD,mFAAuD,CAAA;IAEvD,uBAAuB;IACvB,uEAA2C,CAAA;IAC3C,qFAAyD,CAAA;IACzD,yEAA6C,CAAA;IAE7C,qCAAqC;IACrC,2FAA+D,CAAA;IAC/D,yFAA6D,CAAA;IAC7D,mFAAuD,CAAA;IACvD,iFAAqD,CAAA;IACrD,mEAAuC,CAAA;IACvC,uEAA2C,CAAA;IAC3C,uEAA2C,CAAA;IAE3C,wBAAwB;IACxB,yEAA6C,CAAA;IAC7C,6EAAiD,CAAA;IAEjD,qBAAqB;IACrB,mEAAuC,CAAA;IACvC,uEAA2C,CAAA;IAE3C,gCAAgC;IAChC,6EAAiD,CAAA;IACjD,mFAAuD,CAAA;IAEvD,iCAAiC;IACjC,iFAAqD,CAAA;IAErD,wDAAwD;IACxD,yFAA6D,CAAA;IAE7D,0CAA0C;IAC1C,uFAA2D,CAAA;IAC3D,+FAAmE,CAAA;IACnE,2FAA+D,CAAA;IAE/D,2BAA2B;IAC3B,yEAA6C,CAAA;IAC7C,mEAAuC,CAAA;IACvC,2EAA+C,CAAA;IAC/C,mEAAuC,CAAA;IACvC,iFAAqD,CAAA;IACrD,qFAAyD,CAAA;IACzD,uDAA2B,CAAA;IAE3B,uBAAuB;IACvB,+DAAmC,CAAA;IACnC,2DAA+B,CAAA;IAC/B,qEAAyC,CAAA;IACzC,2DAA+B,CAAA;IAE/B,+DAAmC,CAAA;IAEnC,uDAA2B,CAAA;IAE3B,iEAAqC,CAAA;IACrC,qFAAyD,CAAA;IAEzD,6EAAiD,CAAA;IACjD,mEAAuC,CAAA;AACzC,CAAC,EAzFW,wBAAwB,KAAxB,wBAAwB,QAyFnC;AAED,MAAM,CAAC,MAAM,6BAA6B,GAA6C;IACrF,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,qBAAqB;IAExE,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,gBAAgB;IAC1D,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,6BAA6B;IACpF,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAClE,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE,qBAAqB;IACpE,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE,qCAAqC;IACvF,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,oCAAoC;IACrF,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,iDAAiD;IAC3G,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,8CAA8C;IACxG,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,sBAAsB;IACtE,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,cAAc;IACtD,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,8BAA8B;IACtF,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,+BAA+B;IACxF,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,gBAAgB;IAC1D,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,yBAAyB;IAC5E,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,yBAAyB;IAC5E,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAClE,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE,0BAA0B;IACzE,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,6BAA6B;IAEpF,wBAAwB;IACxB,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,uBAAuB;IACxE,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,yBAAyB;IAE5E,qBAAqB;IACrB,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAClE,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,sBAAsB;IAEtE,gCAAgC;IAChC,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,yBAAyB;IAC5E,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,4BAA4B;IAElF,iCAAiC;IACjC,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,2BAA2B;IAEhF,gCAAgC;IAChC,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,+BAA+B;IAExF,0CAA0C;IAC1C,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,2CAA2C;IACnG,CAAC,wBAAwB,CAAC,+BAA+B,CAAC,EAAE,gEAAgE;IAC5H,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,gCAAgC;IAE1F,2BAA2B;IAC3B,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,uBAAuB;IACxE,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAClE,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE,wBAAwB;IAC1E,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAClE,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,sBAAsB;IAC3E,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,8BAA8B;IACrF,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,cAAc;IAEtD,uBAAuB;IACvB,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE,gCAAgC;IAC5E,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,gBAAgB;IAC1D,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE,yCAAyC;IACxF,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,gBAAgB;IAE1D,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE,cAAc;IAE1D,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,wBAAwB;IAEhE,4BAA4B;IAC5B,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,EAAE,0BAA0B;IAC9E,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,4BAA4B;IAElF,uBAAuB;IACvB,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,sBAAsB;IACtE,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,6BAA6B;IACpF,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,uBAAuB;IAExE,qCAAqC;IACrC,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,gCAAgC;IAC1F,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,+BAA+B;IACxF,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,oCAAoC;IAC1F,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,mCAAmC;IACxF,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAClE,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,sBAAsB;IACtE,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,sBAAsB;IAEtE,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,EAAE,mBAAmB;IAChE,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,6BAA6B;IAEpF,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,yBAAyB;IAC5E,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;CACnE,CAAC;AAEF,wDAAwD;AACxD,+CAA+C;AAC/C,6DAA6D;AAC7D,wDAAwD;AAExD,MAAM,CAAN,IAAY,kBAIX;AAJD,WAAY,kBAAkB;IAC5B,yDAAmC,CAAA;IACnC,2DAAqC,CAAA;IACrC,iDAA2B,CAAA;AAC7B,CAAC,EAJW,kBAAkB,KAAlB,kBAAkB,QAI7B;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAuC;IACpE,CAAC,kBAAkB,CAAC,eAAe,CAAC,EAAE,SAAS;IAC/C,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,eAAe;IACtD,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE,cAAc;CACjD,CAAC"}
+{"version":3,"file":"manual-controllers-routes-urls.js","sourceRoot":"","sources":["../../../../src/requests/manual-controllers-routes-urls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,SAAS,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,sCAAsC,CAAC,UAAkB;IACvE,OAAO,+BAA+B,CAAC,4BAA4B,EAAE,UAAU,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,oCAAoC,CAAC,YAAoB;IACvE,OAAO,+BAA+B,CAAC,0BAA0B,EAAE,YAAY,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,+BAA+B,CAAC,gBAAwB,EAAE,IAAY;IAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,OAAO,gBAAgB,gBAAgB,GAAG,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,UAAU,EAAE,EAAE,CAAC;AAC9H,CAAC;AAED,MAAM,CAAN,IAAY,wBAgNX;AAhND,WAAY,wBAAwB;IAClC,6EAAiD,CAAA;IAEjD,2DAA+B,CAAA;IAC/B,qFAAyD,CAAA;IACzD,mEAAuC,CAAA;IACvC,qEAAyC,CAAA;IACzC,2EAA+C,CAAA;IAC/C,yEAA6C,CAAA;IAC7C,kFAAkF;IAClF,2FAA+D,CAAA;IAC/D,2FAA+D,CAAA;IAC/D,uEAA2C,CAAA;IAC3C;;;;OAIG;IACH,yEAA6C,CAAA;IAC7C,wFAAwF;IACxF,iFAAqD,CAAA;IACrD;;;;OAIG;IACH,qFAAyD,CAAA;IACzD,2FAA2F;IAC3F,uEAA2C,CAAA;IAC3C,gGAAgG;IAChG,iFAAqD,CAAA;IACrD;;;;OAIG;IACH,6EAAiD,CAAA;IACjD,iFAAiF;IACjF,+EAAmD,CAAA;IACnD,sDAAsD;IACtD,2EAA+C,CAAA;IAC/C;;;;;OAKG;IACH,qFAAyD,CAAA;IACzD;;;;;;;;OAQG;IACH,qGAAyE,CAAA;IACzE;;;;;OAKG;IACH,+EAAmD,CAAA;IACnD;;;;;;OAMG;IACH,uFAA2D,CAAA;IAC3D,uDAA2B,CAAA;IAC3B,2HAA2H;IAC3H,+DAAmC,CAAA;IACnC,uFAA2D,CAAA;IAC3D,yFAA6D,CAAA;IAC7D,2DAA+B,CAAA;IAC/B,6EAAiD,CAAA;IACjD,8EAA8E;IAC9E,gFAAgF;IAChF,8EAA8E;IAC9E,yEAA6C,CAAA;IAC7C,6EAAiD,CAAA;IACjD,qFAAqF;IACrF,2FAA2F;IAC3F,iFAAqD,CAAA;IACrD,mFAAuD,CAAA;IACvD,mFAAuD,CAAA;IACvD,mEAAuC,CAAA;IACvC,qEAAyC,CAAA;IAEzC,4BAA4B;IAC5B,+EAAmD,CAAA;IACnD,mFAAuD,CAAA;IAEvD,uBAAuB;IACvB,uEAA2C,CAAA;IAC3C,qFAAyD,CAAA;IACzD,yEAA6C,CAAA;IAE7C,qCAAqC;IACrC,2FAA+D,CAAA;IAC/D,yFAA6D,CAAA;IAC7D,mFAAuD,CAAA;IACvD,iFAAqD,CAAA;IACrD,mEAAuC,CAAA;IACvC,uEAA2C,CAAA;IAC3C,uEAA2C,CAAA;IAE3C,wBAAwB;IACxB,yEAA6C,CAAA;IAC7C,6EAAiD,CAAA;IAEjD,qBAAqB;IACrB,mEAAuC,CAAA;IACvC,uEAA2C,CAAA;IAE3C,gCAAgC;IAChC,6EAAiD,CAAA;IACjD,mFAAuD,CAAA;IAEvD,iCAAiC;IACjC,iFAAqD,CAAA;IAErD,wDAAwD;IACxD,yFAA6D,CAAA;IAE7D,0CAA0C;IAC1C,uFAA2D,CAAA;IAC3D,+FAAmE,CAAA;IACnE,2FAA+D,CAAA;IAC/D,uFAA2D,CAAA;IAC3D,+FAAmE,CAAA;IAEnE,2BAA2B;IAC3B,yEAA6C,CAAA;IAC7C,mEAAuC,CAAA;IACvC,2EAA+C,CAAA;IAC/C,mEAAuC,CAAA;IACvC,iFAAqD,CAAA;IACrD,qFAAyD,CAAA;IACzD,uDAA2B,CAAA;IAC3B,4GAA4G;IAC5G,uFAA2D,CAAA;IAE3D,uBAAuB;IACvB,+DAAmC,CAAA;IACnC,2DAA+B,CAAA;IAC/B,qEAAyC,CAAA;IACzC,2DAA+B,CAAA;IAC/B,kPAAkP;IAClP,uEAA2C,CAAA;IAE3C,+DAAmC,CAAA;IAEnC,uDAA2B,CAAA;IAE3B,iEAAqC,CAAA;IACrC,qFAAyD,CAAA;IAEzD,6EAAiD,CAAA;IACjD,mEAAuC,CAAA;IAEvC,yEAAyE;IACzE,qFAAyD,CAAA;IACzD,qEAAqE;IACrE,yEAA6C,CAAA;IAE7C,+DAA+D;IAC/D;;;;;OAKG;IACH,6DAAiC,CAAA;IACjC;;;;OAIG;IACH,mDAAuB,CAAA;IAEvB,6EAA6E;IAC7E;;;;;;;;;OASG;IACH,yDAA6B,CAAA;IAC7B;;;;;;;;;OASG;IACH,+FAAmE,CAAA;AACrE,CAAC,EAhNW,wBAAwB,KAAxB,wBAAwB,QAgNnC;AAED,MAAM,CAAC,MAAM,6BAA6B,GAA6C;IACrF,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,qBAAqB;IAExE,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,gBAAgB;IAC1D,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,6BAA6B;IACpF,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAClE,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE,qBAAqB;IACpE,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE,qCAAqC;IACvF,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,oCAAoC;IACrF,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,iDAAiD;IAC3G,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,8CAA8C;IACxG,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,sBAAsB;IACtE,qEAAqE;IACrE,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,cAAc;IAC/D,wGAAwG;IACxG,kGAAkG;IAClG,oGAAoG;IACpG,gGAAgG;IAChG,qGAAqG;IACrG,oGAAoG;IACpG,6EAA6E;IAC7E,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,mCAAmC;IACxF,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,yCAAyC;IAChG,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,aAAa;IAC7D,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,kBAAkB;IACvE,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,2BAA2B;IAC9E,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,EAAE,iBAAiB;IACrE,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE,eAAe;IACjE,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,oBAAoB;IAC3E,CAAC,wBAAwB,CAAC,kCAAkC,CAAC,EAAE,4BAA4B;IAC3F,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,EAAE,iBAAiB;IACrE,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,8BAA8B;IACtF,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,cAAc;IACtD,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE,kBAAkB;IAC9D,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,8BAA8B;IACtF,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,+BAA+B;IACxF,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,gBAAgB;IAC1D,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,yBAAyB;IAC5E,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,uBAAuB;IACxE,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,yBAAyB;IAC5E,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,wBAAwB;IAC7E,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,0BAA0B;IAChF,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,0BAA0B;IAChF,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAClE,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE,0BAA0B;IAEzE,wBAAwB;IACxB,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,uBAAuB;IACxE,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,yBAAyB;IAE5E,qBAAqB;IACrB,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAClE,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,sBAAsB;IAEtE,gCAAgC;IAChC,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,yBAAyB;IAC5E,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,4BAA4B;IAElF,iCAAiC;IACjC,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,2BAA2B;IAEhF,gCAAgC;IAChC,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,+BAA+B;IAExF,0CAA0C;IAC1C,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,2CAA2C;IACnG,CAAC,wBAAwB,CAAC,+BAA+B,CAAC,EAAE,gEAAgE;IAC5H,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,gCAAgC;IAC1F,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,2DAA2D;IACnH,CAAC,wBAAwB,CAAC,+BAA+B,CAAC,EAAE,gFAAgF;IAE5I,2BAA2B;IAC3B,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,uBAAuB;IACxE,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAClE,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE,wBAAwB;IAC1E,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAClE,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,sBAAsB;IAC3E,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,8BAA8B;IACrF,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,cAAc;IACtD,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,8BAA8B;IAEtF,uBAAuB;IACvB,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE,gCAAgC;IAC5E,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,gBAAgB;IAC1D,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE,yCAAyC;IACxF,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,gBAAgB;IAC1D,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,mBAAmB;IAEnE,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE,cAAc;IAE1D,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,wBAAwB;IAEhE,4BAA4B;IAC5B,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,EAAE,0BAA0B;IAC9E,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,4BAA4B;IAElF,uBAAuB;IACvB,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,sBAAsB;IACtE,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,6BAA6B;IACpF,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,uBAAuB;IAExE,qCAAqC;IACrC,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,gCAAgC;IAC1F,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,+BAA+B;IACxF,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,oCAAoC;IAC1F,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,mCAAmC;IACxF,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAClE,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,sBAAsB;IACtE,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,sBAAsB;IAEtE,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,EAAE,mBAAmB;IAChE,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,6BAA6B;IAEpF,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,yBAAyB;IAC5E,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAElE,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,6BAA6B;IACpF,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,uBAAuB;IAExE,wCAAwC;IACxC,sFAAsF;IACtF,qFAAqF;IACrF,oEAAoE;IACpE,CAAC,wBAAwB,CAAC,cAAc,CAAC,EAAE,kCAAkC;IAC7E,CAAC,wBAAwB,CAAC,SAAS,CAAC,EAAE,MAAM;IAE5C,8CAA8C;IAC9C,4FAA4F;IAC5F,iFAAiF;IACjF,4EAA4E;IAC5E,CAAC,wBAAwB,CAAC,YAAY,CAAC,EAAE,MAAM;IAC/C,CAAC,wBAAwB,CAAC,+BAA+B,CAAC,EAAE,uCAAuC;CACpG,CAAC;AAEF,wDAAwD;AACxD,+CAA+C;AAC/C,6DAA6D;AAC7D,wDAAwD;AAExD,MAAM,CAAN,IAAY,kBAIX;AAJD,WAAY,kBAAkB;IAC5B,yDAAmC,CAAA;IACnC,2DAAqC,CAAA;IACrC,iDAA2B,CAAA;AAC7B,CAAC,EAJW,kBAAkB,KAAlB,kBAAkB,QAI7B;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAuC;IACpE,CAAC,kBAAkB,CAAC,eAAe,CAAC,EAAE,SAAS;IAC/C,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,eAAe;IACtD,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE,cAAc;CACjD,CAAC","sourcesContent":["/**\n * Manual Controllers Routes URLs\n * Centralized URL declarations for custom/manual controllers\n * Shared between backend and frontend to avoid string duplication.\n *\n * Notes:\n * - These URLs are mounted under {@link MAIN_API_BASE_PATH}\n * - Keep only path segments here (no `MAIN_API_BASE_PATH` prefix) — the\n *   prefix is prepended once at each boundary (backend mount / frontend client)\n */\n\n/**\n * Main API base path — the mount prefix under which the entire main\n * controllers registry is served (every resource route AND every\n * {@link MANUAL_CONTROLLER_ROUTES_URLS} entry).\n *\n * This is the SINGLE SOURCE OF TRUTH for the prefix. It is consumed by:\n *  - the backend HTTP server mount (`app.use(MAIN_API_BASE_PATH, mainRouter)`),\n *  - the frontend HTTP client when building absolute API URLs\n *    (`${MAIN_API_BASE_PATH}${MANUAL_CONTROLLER_ROUTES_URLS[...]}`),\n *  - the refresh-token cookie `Path` scope, which MUST path-match the served\n *    auth routes (`${MAIN_API_BASE_PATH}/auth/*`) or the browser drops it.\n *\n * Why a shared symbol and not a literal: previously `/api/v1` was a literal\n * duplicated across the mount and the client. The absence of a shared symbol\n * let the refresh-token cookie `Path` be authored against the bare route\n * segment (`/auth`, omitting this prefix), so the browser stored the cookie\n * but never sent it to `/api/v1/auth/token/refresh` — silently breaking token\n * refresh for every session (forced logout on first refresh). Deriving every\n * prefix consumer from this constant closes that drift class.\n *\n * NOT under this prefix: the root-level engine routes in\n * {@link ENGINE_ROOT_ROUTES} (health/time probes), mounted at the app root.\n */\nexport const MAIN_API_BASE_PATH = '/api/v1';\n\n/**\n * Where RFC 8414 authorization-server metadata must be served for an issuer that carries a PATH.\n *\n * The rule is counter-intuitive and is the reason this exists as a named derivation rather than a\n * string built at the call site: the well-known segment goes BETWEEN the host and the issuer path,\n * not after it.\n *\n *   \"If the issuer identifier value contains a path component, any terminating \"/\" MUST be removed\n *    before inserting \"/.well-known/\" and the well-known URI suffix between the host component and\n *    the path component.\"\n *\n * with the RFC's own worked example resolving issuer `https://example.com/issuer1` to\n * `GET /.well-known/oauth-authorization-server/issuer1`.\n * spec-cite: RFC 8414 § 3 (Obtaining Authorization Server Metadata), fetched 2026-08-11.\n *\n * OIDC Discovery uses the OPPOSITE construction — issuer + `/.well-known/openid-configuration` — so\n * the two cannot share one path and a server that serves only the OIDC shape fails RFC 8414 discovery\n * while looking correct. That is exactly what happened here: a real MCP client split our issuer at the\n * host boundary as the RFC instructs, asked for `/.well-known/oauth-authorization-server/api/v1`,\n * received the SPA shell, and abandoned authorization without ever opening a browser.\n *\n * @param issuerPath the issuer's path component (e.g. {@link MAIN_API_BASE_PATH}); a bare `/` or an\n *                   empty string yields the origin-root location, which is the path-less issuer case.\n */\nexport function rfc8414AuthorizationServerMetadataPath(issuerPath: string): string {\n  return wellKnownPathBeforeResourcePath('oauth-authorization-server', issuerPath);\n}\n\n/**\n * Where RFC 9728 protected-resource metadata must be served for a resource identifier that carries a\n * PATH — the same insertion rule as {@link rfc8414AuthorizationServerMetadataPath}, for the other\n * document.\n *\n *   \"The protected resource's well-known URI is created by inserting\n *    /.well-known/oauth-protected-resource between the host component and the path component (if any)\n *    of the resource identifier.\"\n * spec-cite: RFC 9728 § 3 (Protected Resource Metadata Request), fetched 2026-08-12.\n *\n * This is a SECOND discovery route, not a replacement for the one the challenge names. RFC 9728 § 5.1\n * lets a client take `resource_metadata` straight from the `WWW-Authenticate` header, and MCP tells\n * clients to do exactly that — which is why serving only the header's location worked with a real\n * client and is a defensible posture. It is nevertheless not the whole contract: a client that derives\n * the location from the resource identifier, as this section permits, previously received the SPA\n * shell. Both locations now serve one document.\n *\n * Note the asymmetry with RFC 8414, because it explains why that one was a live outage and this one\n * was latent: an authorization server publishes no equivalent pointer, so derivation is a client's\n * ONLY route to AS metadata.\n *\n * @param resourcePath the resource identifier's path component (e.g. `/api/v1/mcp`); a bare `/` or an\n *                     empty string yields the origin-root location, which is the path-less case.\n */\nexport function rfc9728ProtectedResourceMetadataPath(resourcePath: string): string {\n  return wellKnownPathBeforeResourcePath('oauth-protected-resource', resourcePath);\n}\n\n/**\n * The construction RFC 8414 § 3 and RFC 9728 § 3 both specify: strip any terminating `/`, then insert\n * the well-known segment BETWEEN the host and the path.\n *\n * Shared deliberately rather than written twice. The rule is counter-intuitive enough that it was\n * already implemented wrongly once here, and a second hand-rolled copy is how the two documents would\n * come to disagree about a rule they take verbatim from each other.\n */\nfunction wellKnownPathBeforeResourcePath(wellKnownSegment: string, path: string): string {\n  const normalized = path.replace(/\\/+$/, '');\n  return `/.well-known/${wellKnownSegment}${normalized.startsWith('/') || normalized === '' ? normalized : `/${normalized}`}`;\n}\n\nexport enum ManualControllerRouteKey {\n  APPLICATION_CONFIG_GET = 'APPLICATION_CONFIG_GET',\n\n  AUTH_IDENTIFY = 'AUTH_IDENTIFY',\n  AUTH_AUTHENTICATE_PASSWORD = 'AUTH_AUTHENTICATE_PASSWORD',\n  AUTH_AUTHENTICATE = 'AUTH_AUTHENTICATE',\n  AUTH_TOKEN_REFRESH = 'AUTH_TOKEN_REFRESH',\n  AUTH_OAUTH2_AUTHORIZE = 'AUTH_OAUTH2_AUTHORIZE',\n  AUTH_OAUTH2_CALLBACK = 'AUTH_OAUTH2_CALLBACK',\n  /** Enterprise SSO: initiate OAuth2 flow for an org's OIDC connection (Step 15) */\n  AUTH_ENTERPRISE_SSO_AUTHORIZE = 'AUTH_ENTERPRISE_SSO_AUTHORIZE',\n  AUTH_APP_ENTERPRISE_AUTHORIZE = 'AUTH_APP_ENTERPRISE_AUTHORIZE',\n  AUTH_TOKEN_EXCHANGE = 'AUTH_TOKEN_EXCHANGE',\n  /**\n   * OAuth 2.0 Authorization Server token endpoint (Wildo-AS-PROVIDER, distinct from the\n   * RP-side `/auth/*` routes). Serves `grant_type=client_credentials` now; the OIDC branch\n   * adds `authorization_code`. Served at `${MAIN_API_BASE_PATH}/oauth/token`.\n   */\n  OAUTH_PROVIDER_TOKEN = 'OAUTH_PROVIDER_TOKEN',\n  /** OIDC discovery document (served at `${issuer}/.well-known/openid-configuration`). */\n  OAUTH_PROVIDER_DISCOVERY = 'OAUTH_PROVIDER_DISCOVERY',\n  /**\n   * RFC 8414 Authorization Server Metadata (`${issuer}/.well-known/oauth-authorization-server`) —\n   * the SAME document as {@link OAUTH_PROVIDER_DISCOVERY}, served at the OAuth-2 well-known path that\n   * many OAuth/MCP clients probe FIRST (before the OIDC path). Aliases the discovery handler.\n   */\n  OAUTH_PROVIDER_AS_METADATA = 'OAUTH_PROVIDER_AS_METADATA',\n  /** JSON Web Key Set for verifying Wildo-issued tokens (the discovery doc's `jwks_uri`). */\n  OAUTH_PROVIDER_JWKS = 'OAUTH_PROVIDER_JWKS',\n  /** OIDC authorization endpoint (authorization_code flow — the caller lands here to consent). */\n  OAUTH_PROVIDER_AUTHORIZE = 'OAUTH_PROVIDER_AUTHORIZE',\n  /**\n   * OIDC interactive-consent decision endpoint. When the authorize endpoint returned\n   * `consent_required` for a `requiresConsent` client, the user's approve/deny decision is POSTed\n   * here with the single-use consent-request token; APPROVE mints the authorization code.\n   */\n  OAUTH_PROVIDER_CONSENT = 'OAUTH_PROVIDER_CONSENT',\n  /** OIDC UserInfo endpoint (bearer access token → the user's standard claims). */\n  OAUTH_PROVIDER_USERINFO = 'OAUTH_PROVIDER_USERINFO',\n  /** OAuth 2.0 token revocation endpoint (RFC 7009). */\n  OAUTH_PROVIDER_REVOKE = 'OAUTH_PROVIDER_REVOKE',\n  /**\n   * OIDC RP-Initiated Logout 1.0 `end_session_endpoint` (revocation-C). A relying party redirects the\n   * End-User here (with an `id_token_hint`) to terminate their Wildo OP login session — the exact\n   * session the delegation was authorized from, keyed on the id_token's `sid`. Distinct from\n   * {@link OAUTH_PROVIDER_REVOKE}: revoke kills a TOKEN (RFC 7009); end_session ends a SESSION.\n   */\n  OAUTH_PROVIDER_END_SESSION = 'OAUTH_PROVIDER_END_SESSION',\n  /**\n   * OIDC RP-Initiated Logout 1.0 §6 confirmation decision (revocation-C). The `POST` the frontend\n   * `/oauth/logout-confirm` prompt calls to actually terminate the session, presenting the single-use\n   * `OIDC_LOGOUT_CONFIRMATION` token minted by {@link OAUTH_PROVIDER_END_SESSION}. Token-authorized\n   * (no Bearer — the End-User may be unauthenticated in the SPA, having arrived via an RP redirect);\n   * returns `{ redirect_to }` (always the same-origin signed-out page `/oauth/logged-out`; the SPA\n   * navigates there). Only reached for NON-trusted logouts — a trusted RP logout terminates + redirects\n   * inline without a prompt (the Keycloak-style posture).\n   */\n  OAUTH_PROVIDER_END_SESSION_CONFIRM = 'OAUTH_PROVIDER_END_SESSION_CONFIRM',\n  /**\n   * RFC 7591 dynamic client registration. Registered UNCONDITIONALLY so the route always exists;\n   * the handler answers 404 unless the application opted in via `auth.dynamicClientRegistration`.\n   * Registering it conditionally would make the route table depend on config, which is far harder\n   * to reason about than one handler that refuses.\n   */\n  OAUTH_PROVIDER_REGISTER = 'OAUTH_PROVIDER_REGISTER',\n  /**\n   * Cross-frontend session handoff (cross-app-jwt-propagation Step 2).\n   * Authenticated user requests a one-time AUTH_CODE_EXCHANGE token bound to a\n   * target frontend, then redirects the browser to the target's\n   * /auth/exchange page with the code. Bearer-only; CORS auto-allowed for every\n   * declared frontendService via the existing deriveCorsOrigins() seam.\n   */\n  AUTH_CROSS_FRONTEND_HANDOFF = 'AUTH_CROSS_FRONTEND_HANDOFF',\n  AUTH_LOGOUT = 'AUTH_LOGOUT',\n  /** Sign-out-everywhere: fences the whole user — all access + refresh tokens, every device — via the invalidation fence. */\n  AUTH_LOGOUT_ALL = 'AUTH_LOGOUT_ALL',\n  AUTH_PASSWORD_RESET_REQUEST = 'AUTH_PASSWORD_RESET_REQUEST',\n  AUTH_PASSWORD_RESET_COMPLETE = 'AUTH_PASSWORD_RESET_COMPLETE',\n  AUTH_REGISTER = 'AUTH_REGISTER',\n  AUTH_ACCEPT_INVITATION = 'AUTH_ACCEPT_INVITATION',\n  // Public token-keyed invitation-accept DISCOVERY (non-consuming): returns the\n  // invited org's available auth methods + SSO/SCIM management mode so the accept\n  // screen can render the right chooser. Read-only; does NOT consume the token.\n  AUTH_INVITATION_INFO = 'AUTH_INVITATION_INFO',\n  AUTH_REJECT_INVITATION = 'AUTH_REJECT_INVITATION',\n  // In-app authenticated invitation management (Approach P) — a signed-in user acts on\n  // THEIR OWN pending invitations (authorized by email-ownership), no token, no new session.\n  AUTH_LIST_MY_INVITATIONS = 'AUTH_LIST_MY_INVITATIONS',\n  AUTH_ACCEPT_MY_INVITATION = 'AUTH_ACCEPT_MY_INVITATION',\n  AUTH_REJECT_MY_INVITATION = 'AUTH_REJECT_MY_INVITATION',\n  AUTH_VERIFY_EMAIL = 'AUTH_VERIFY_EMAIL',\n  AUTH_SESSION_STATE = 'AUTH_SESSION_STATE',\n\n  // MFA — Email OTP (Step 10)\n  AUTH_MFA_EMAIL_OTP_SEND = 'AUTH_MFA_EMAIL_OTP_SEND',\n  AUTH_MFA_EMAIL_OTP_VERIFY = 'AUTH_MFA_EMAIL_OTP_VERIFY',\n\n  // MFA — TOTP (Step 11)\n  AUTH_MFA_TOTP_SETUP = 'AUTH_MFA_TOTP_SETUP',\n  AUTH_MFA_TOTP_VERIFY_SETUP = 'AUTH_MFA_TOTP_VERIFY_SETUP',\n  AUTH_MFA_TOTP_VERIFY = 'AUTH_MFA_TOTP_VERIFY',\n\n  // WebAuthn/Passkey Routes (Phase G1)\n  AUTH_PASSKEY_REGISTER_OPTIONS = 'AUTH_PASSKEY_REGISTER_OPTIONS',\n  AUTH_PASSKEY_REGISTER_VERIFY = 'AUTH_PASSKEY_REGISTER_VERIFY',\n  AUTH_PASSKEY_AUTH_OPTIONS = 'AUTH_PASSKEY_AUTH_OPTIONS',\n  AUTH_PASSKEY_AUTH_VERIFY = 'AUTH_PASSKEY_AUTH_VERIFY',\n  AUTH_PASSKEY_LIST = 'AUTH_PASSKEY_LIST',\n  AUTH_PASSKEY_REMOVE = 'AUTH_PASSKEY_REMOVE',\n  AUTH_PASSKEY_RENAME = 'AUTH_PASSKEY_RENAME',\n\n  // Magic Link (Phase G2)\n  AUTH_MAGIC_LINK_SEND = 'AUTH_MAGIC_LINK_SEND',\n  AUTH_MAGIC_LINK_VERIFY = 'AUTH_MAGIC_LINK_VERIFY',\n\n  // SMS OTP (Phase G2)\n  AUTH_SMS_OTP_SEND = 'AUTH_SMS_OTP_SEND',\n  AUTH_SMS_OTP_VERIFY = 'AUTH_SMS_OTP_VERIFY',\n\n  // Phone Verification (Phase G2)\n  AUTH_PHONE_VERIFY_SEND = 'AUTH_PHONE_VERIFY_SEND',\n  AUTH_PHONE_VERIFY_CONFIRM = 'AUTH_PHONE_VERIFY_CONFIRM',\n\n  // Resend Verification Email (F5)\n  AUTH_RESEND_VERIFICATION = 'AUTH_RESEND_VERIFICATION',\n\n  // W5.7: Complete org onboarding (deferred org creation)\n  AUTH_COMPLETE_ORG_ONBOARDING = 'AUTH_COMPLETE_ORG_ONBOARDING',\n\n  // W7.3b: One-off session token management\n  AUTH_ONE_OFF_SESSION_CREATE = 'AUTH_ONE_OFF_SESSION_CREATE',\n  AUTH_ONE_OFF_SESSION_CREATE_ORG = 'AUTH_ONE_OFF_SESSION_CREATE_ORG',\n  AUTH_ONE_OFF_SESSION_EXCHANGE = 'AUTH_ONE_OFF_SESSION_EXCHANGE',\n  AUTH_ONE_OFF_SESSION_REVOKE = 'AUTH_ONE_OFF_SESSION_REVOKE',\n  AUTH_ONE_OFF_SESSION_REVOKE_ORG = 'AUTH_ONE_OFF_SESSION_REVOKE_ORG',\n\n  // Method Management (#13f)\n  AUTH_PASSWORD_CHANGE = 'AUTH_PASSWORD_CHANGE',\n  AUTH_PASSWORD_SET = 'AUTH_PASSWORD_SET',\n  AUTH_MFA_TOTP_DISABLE = 'AUTH_MFA_TOTP_DISABLE',\n  AUTH_METHODS_MINE = 'AUTH_METHODS_MINE',\n  AUTH_IDENTITY_LINKS_LIST = 'AUTH_IDENTITY_LINKS_LIST',\n  AUTH_IDENTITY_LINKS_UNLINK = 'AUTH_IDENTITY_LINKS_UNLINK',\n  AUTH_REAUTH = 'AUTH_REAUTH',\n  /** Challenge leg of a PASSKEY step-up: WebAuthn is challenge-response, so re-auth needs two round-trips. */\n  AUTH_REAUTH_PASSKEY_OPTIONS = 'AUTH_REAUTH_PASSKEY_OPTIONS',\n\n  // SAML Routes (AUTH-2)\n  AUTH_SAML_LOGIN = 'AUTH_SAML_LOGIN',\n  AUTH_SAML_ACS = 'AUTH_SAML_ACS',\n  AUTH_SAML_METADATA = 'AUTH_SAML_METADATA',\n  AUTH_SAML_SLO = 'AUTH_SAML_SLO',\n  /** SP-INITIATED SLO kickoff: the app asks the backend to log the caller out of their SAML session and (when the IdP supports it) redirect to the IdP's SLO endpoint. Distinct from AUTH_SAML_SLO, which is the INBOUND endpoint the IdP calls. */\n  AUTH_SAML_SP_LOGOUT = 'AUTH_SAML_SP_LOGOUT',\n\n  I18N_GET_LABELS = 'I18N_GET_LABELS',\n\n  CHARTS_DATA = 'CHARTS_DATA',\n\n  ANALYTICS_EVENTS = 'ANALYTICS_EVENTS',\n  ANALYTICS_MOMENTS_ACHIEVED = 'ANALYTICS_MOMENTS_ACHIEVED',\n\n  PROGRESSION_MILESTONES = 'PROGRESSION_MILESTONES',\n  FEATURES_RESOLVED = 'FEATURES_RESOLVED',\n\n  /** Frontend-visible flow/actor systems (metadata + renderable graph). */\n  FLOWS_ACTORS_FRONTEND_INFO = 'FLOWS_ACTORS_FRONTEND_INFO',\n  /** The caller's own conversation history for a flow/actor system. */\n  FLOWS_ACTORS_HISTORY = 'FLOWS_ACTORS_HISTORY',\n\n  // === A2A (external actor exposure — Agent2Agent protocol) ===\n  /**\n   * A2A agent card (public, CORS-open metadata) advertising this app's exposed\n   * actor systems as A2A skills + the security schemes a caller must satisfy.\n   * Analogous to the OIDC discovery doc; the served path can be reverse-proxy\n   * aliased to a root `/.well-known/agent-card.json`.\n   */\n  A2A_AGENT_CARD = 'A2A_AGENT_CARD',\n  /**\n   * A2A JSON-RPC task/message endpoint (`message/send`, `message/stream` via SSE).\n   * Its absolute URL is the agent card's `url` AND the agent's canonical\n   * audience — an inbound access token MUST carry this as its `aud` (RFC 8707 / D7).\n   */\n  A2A_TASKS = 'A2A_TASKS',\n\n  // === MCP (Model Context Protocol server — resource operations as tools) ===\n  /**\n   * MCP JSON-RPC 2.0 endpoint (Streamable-HTTP transport): `initialize`, `tools/list`,\n   * `tools/call`. A `tools/call` is Bearer-credentialed by a machine OR user-delegated access token\n   * that is resource-server-bound to the MCP audience — NOT the generic API audience, which this\n   * surface rejects since the 2026-07-29 strict flip (RFC 8707 / D7) — validated at auth time; the\n   * server re-runs `authorizeInController` before dispatch (fail-closed).\n   *\n   * Also the base for the R-2 NAMED server instances: `POST /mcp/:instanceRef` serves a declared\n   * instance with its own audience (`…/mcp/<ref>`) and curated catalog.\n   */\n  MCP_ENDPOINT = 'MCP_ENDPOINT',\n  /**\n   * MCP OAuth 2.0 Protected Resource Metadata (RFC 9728): advertises this MCP server's\n   * `resource` identifier + the `authorization_servers` (the app's own OIDC provider) an MCP\n   * client uses to obtain a token. Public, CORS-open metadata (like the OIDC discovery doc).\n   *\n   * Mounted TWICE: at the API root for the DEFAULT server, and appended to each named instance\n   * (`/mcp/:instanceRef` + this route) so every instance advertises its OWN audience. A 401 at either\n   * surface points its `WWW-Authenticate: resource_metadata=` at the matching one — the only discovery\n   * route a client has, since this path is non-standard (it is not the RFC's origin-root form).\n   */\n  MCP_PROTECTED_RESOURCE_METADATA = 'MCP_PROTECTED_RESOURCE_METADATA',\n}\n\nexport const MANUAL_CONTROLLER_ROUTES_URLS: Record<ManualControllerRouteKey, string> = {\n  [ManualControllerRouteKey.APPLICATION_CONFIG_GET]: '/application-config',\n\n  [ManualControllerRouteKey.AUTH_IDENTIFY]: '/auth/identify',\n  [ManualControllerRouteKey.AUTH_AUTHENTICATE_PASSWORD]: '/auth/authenticate/password',\n  [ManualControllerRouteKey.AUTH_AUTHENTICATE]: '/auth/authenticate',\n  [ManualControllerRouteKey.AUTH_TOKEN_REFRESH]: '/auth/token/refresh',\n  [ManualControllerRouteKey.AUTH_OAUTH2_AUTHORIZE]: '/auth/oauth2/authorize/:providerRef',\n  [ManualControllerRouteKey.AUTH_OAUTH2_CALLBACK]: '/auth/oauth2/callback/:providerRef',\n  [ManualControllerRouteKey.AUTH_ENTERPRISE_SSO_AUTHORIZE]: '/auth/enterprise/authorize/:orgId/:connectionId',\n  [ManualControllerRouteKey.AUTH_APP_ENTERPRISE_AUTHORIZE]: '/auth/app-enterprise/authorize/:connectionId',\n  [ManualControllerRouteKey.AUTH_TOKEN_EXCHANGE]: '/auth/token/exchange',\n  // OAuth 2.0 Authorization Server token endpoint (Wildo-as-provider).\n  [ManualControllerRouteKey.OAUTH_PROVIDER_TOKEN]: '/oauth/token',\n  // OIDC discovery + JWKS. Served under the API mount, so with issuer `${publicUrl}${MAIN_API_BASE_PATH}`\n  // a client's `${issuer}/.well-known/openid-configuration` resolves here. That is correct for OIDC\n  // Discovery (issuer + suffix) and NOT for RFC 8414, which places the well-known segment BETWEEN the\n  // host and the issuer path — see {@link rfc8414AuthorizationServerMetadataPath}, which the HTTP\n  // server mounts as a second location for the SAME document. (This used to say a root-level alias was\n  // \"a reverse-proxy concern\"; leaving it to ingress meant every deployment that did not add the rule\n  // silently failed RFC 8414 discovery, so the server now serves it directly.)\n  [ManualControllerRouteKey.OAUTH_PROVIDER_DISCOVERY]: '/.well-known/openid-configuration',\n  [ManualControllerRouteKey.OAUTH_PROVIDER_AS_METADATA]: '/.well-known/oauth-authorization-server',\n  [ManualControllerRouteKey.OAUTH_PROVIDER_JWKS]: '/oauth/jwks',\n  [ManualControllerRouteKey.OAUTH_PROVIDER_AUTHORIZE]: '/oauth/authorize',\n  [ManualControllerRouteKey.OAUTH_PROVIDER_CONSENT]: '/oauth/authorize/decision',\n  [ManualControllerRouteKey.OAUTH_PROVIDER_USERINFO]: '/oauth/userinfo',\n  [ManualControllerRouteKey.OAUTH_PROVIDER_REVOKE]: '/oauth/revoke',\n  [ManualControllerRouteKey.OAUTH_PROVIDER_END_SESSION]: '/oauth/end-session',\n  [ManualControllerRouteKey.OAUTH_PROVIDER_END_SESSION_CONFIRM]: '/oauth/end-session/confirm',\n  [ManualControllerRouteKey.OAUTH_PROVIDER_REGISTER]: '/oauth/register',\n  [ManualControllerRouteKey.AUTH_CROSS_FRONTEND_HANDOFF]: '/auth/cross-frontend-handoff',\n  [ManualControllerRouteKey.AUTH_LOGOUT]: '/auth/logout',\n  [ManualControllerRouteKey.AUTH_LOGOUT_ALL]: '/auth/logout-all',\n  [ManualControllerRouteKey.AUTH_PASSWORD_RESET_REQUEST]: '/auth/password-reset/request',\n  [ManualControllerRouteKey.AUTH_PASSWORD_RESET_COMPLETE]: '/auth/password-reset/complete',\n  [ManualControllerRouteKey.AUTH_REGISTER]: '/auth/register',\n  [ManualControllerRouteKey.AUTH_ACCEPT_INVITATION]: '/auth/invitation/accept',\n  [ManualControllerRouteKey.AUTH_INVITATION_INFO]: '/auth/invitation/info',\n  [ManualControllerRouteKey.AUTH_REJECT_INVITATION]: '/auth/invitation/reject',\n  [ManualControllerRouteKey.AUTH_LIST_MY_INVITATIONS]: '/auth/invitations/mine',\n  [ManualControllerRouteKey.AUTH_ACCEPT_MY_INVITATION]: '/auth/invitations/accept',\n  [ManualControllerRouteKey.AUTH_REJECT_MY_INVITATION]: '/auth/invitations/reject',\n  [ManualControllerRouteKey.AUTH_VERIFY_EMAIL]: '/auth/verify-email',\n  [ManualControllerRouteKey.AUTH_SESSION_STATE]: '/auth/session/:sessionId',\n\n  // Magic Link (Phase G2)\n  [ManualControllerRouteKey.AUTH_MAGIC_LINK_SEND]: '/auth/magic-link/send',\n  [ManualControllerRouteKey.AUTH_MAGIC_LINK_VERIFY]: '/auth/magic-link/verify',\n\n  // SMS OTP (Phase G2)\n  [ManualControllerRouteKey.AUTH_SMS_OTP_SEND]: '/auth/sms-otp/send',\n  [ManualControllerRouteKey.AUTH_SMS_OTP_VERIFY]: '/auth/sms-otp/verify',\n\n  // Phone Verification (Phase G2)\n  [ManualControllerRouteKey.AUTH_PHONE_VERIFY_SEND]: '/auth/phone/verify/send',\n  [ManualControllerRouteKey.AUTH_PHONE_VERIFY_CONFIRM]: '/auth/phone/verify/confirm',\n\n  // Resend Verification Email (F5)\n  [ManualControllerRouteKey.AUTH_RESEND_VERIFICATION]: '/auth/resend-verification',\n\n  // W5.7: Complete org onboarding\n  [ManualControllerRouteKey.AUTH_COMPLETE_ORG_ONBOARDING]: '/auth/onboarding/complete-org',\n\n  // W7.3b: One-off session token management\n  [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_CREATE]: '/apps/:applicationId/auth/one-off-session',\n  [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_CREATE_ORG]: '/orgs/:organizationId/apps/:applicationId/auth/one-off-session',\n  [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_EXCHANGE]: '/auth/one-off-session/exchange',\n  [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_REVOKE]: '/apps/:applicationId/auth/one-off-session/:tokenId/revoke',\n  [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_REVOKE_ORG]: '/orgs/:organizationId/apps/:applicationId/auth/one-off-session/:tokenId/revoke',\n\n  // Method Management (#13f)\n  [ManualControllerRouteKey.AUTH_PASSWORD_CHANGE]: '/auth/password/change',\n  [ManualControllerRouteKey.AUTH_PASSWORD_SET]: '/auth/password/set',\n  [ManualControllerRouteKey.AUTH_MFA_TOTP_DISABLE]: '/auth/mfa/totp/disable',\n  [ManualControllerRouteKey.AUTH_METHODS_MINE]: '/auth/methods/mine',\n  [ManualControllerRouteKey.AUTH_IDENTITY_LINKS_LIST]: '/auth/identity-links',\n  [ManualControllerRouteKey.AUTH_IDENTITY_LINKS_UNLINK]: '/auth/identity-links/:linkId',\n  [ManualControllerRouteKey.AUTH_REAUTH]: '/auth/reauth',\n  [ManualControllerRouteKey.AUTH_REAUTH_PASSKEY_OPTIONS]: '/auth/reauth/passkey/options',\n\n  // SAML Routes (AUTH-2)\n  [ManualControllerRouteKey.AUTH_SAML_LOGIN]: '/auth/saml/login/:connectionId',\n  [ManualControllerRouteKey.AUTH_SAML_ACS]: '/auth/saml/acs',\n  [ManualControllerRouteKey.AUTH_SAML_METADATA]: '/auth/saml/metadata/:scopeType/:scopeId',\n  [ManualControllerRouteKey.AUTH_SAML_SLO]: '/auth/saml/slo',\n  [ManualControllerRouteKey.AUTH_SAML_SP_LOGOUT]: '/auth/saml/logout',\n\n  [ManualControllerRouteKey.I18N_GET_LABELS]: '/i18n/labels',\n\n  [ManualControllerRouteKey.CHARTS_DATA]: '/charts/:chartRef/data',\n\n  // MFA — Email OTP (Step 10)\n  [ManualControllerRouteKey.AUTH_MFA_EMAIL_OTP_SEND]: '/auth/mfa/email-otp/send',\n  [ManualControllerRouteKey.AUTH_MFA_EMAIL_OTP_VERIFY]: '/auth/mfa/email-otp/verify',\n\n  // MFA — TOTP (Step 11)\n  [ManualControllerRouteKey.AUTH_MFA_TOTP_SETUP]: '/auth/mfa/totp/setup',\n  [ManualControllerRouteKey.AUTH_MFA_TOTP_VERIFY_SETUP]: '/auth/mfa/totp/verify-setup',\n  [ManualControllerRouteKey.AUTH_MFA_TOTP_VERIFY]: '/auth/mfa/totp/verify',\n\n  // WebAuthn/Passkey Routes (Phase G1)\n  [ManualControllerRouteKey.AUTH_PASSKEY_REGISTER_OPTIONS]: '/auth/passkey/register/options',\n  [ManualControllerRouteKey.AUTH_PASSKEY_REGISTER_VERIFY]: '/auth/passkey/register/verify',\n  [ManualControllerRouteKey.AUTH_PASSKEY_AUTH_OPTIONS]: '/auth/passkey/authenticate/options',\n  [ManualControllerRouteKey.AUTH_PASSKEY_AUTH_VERIFY]: '/auth/passkey/authenticate/verify',\n  [ManualControllerRouteKey.AUTH_PASSKEY_LIST]: '/auth/passkey/list',\n  [ManualControllerRouteKey.AUTH_PASSKEY_REMOVE]: '/auth/passkey/remove',\n  [ManualControllerRouteKey.AUTH_PASSKEY_RENAME]: '/auth/passkey/rename',\n\n  [ManualControllerRouteKey.ANALYTICS_EVENTS]: '/analytics/events',\n  [ManualControllerRouteKey.ANALYTICS_MOMENTS_ACHIEVED]: '/analytics/moments/achieved',\n\n  [ManualControllerRouteKey.PROGRESSION_MILESTONES]: '/progression/milestones',\n  [ManualControllerRouteKey.FEATURES_RESOLVED]: '/features/resolved',\n\n  [ManualControllerRouteKey.FLOWS_ACTORS_FRONTEND_INFO]: '/flows-actors/frontend-info',\n  [ManualControllerRouteKey.FLOWS_ACTORS_HISTORY]: '/flows-actors/history',\n\n  // === A2A (external actor exposure) ===\n  // Card served under the API mount, so with issuer `${publicUrl}${MAIN_API_BASE_PATH}`\n  // a caller's `${issuer}/a2a/.well-known/agent-card.json` resolves here (a root-level\n  // `/.well-known/agent-card.json` alias is a reverse-proxy concern).\n  [ManualControllerRouteKey.A2A_AGENT_CARD]: '/a2a/.well-known/agent-card.json',\n  [ManualControllerRouteKey.A2A_TASKS]: '/a2a',\n\n  // === MCP (Model Context Protocol server) ===\n  // JSON-RPC endpoint + RFC 9728 protected-resource metadata, served under the API mount. The\n  // metadata's `resource` is `${publicUrl}${MAIN_API_BASE_PATH}/mcp`; a root-level\n  // `/.well-known/oauth-protected-resource` alias is a reverse-proxy concern.\n  [ManualControllerRouteKey.MCP_ENDPOINT]: '/mcp',\n  [ManualControllerRouteKey.MCP_PROTECTED_RESOURCE_METADATA]: '/.well-known/oauth-protected-resource',\n};\n\n// =====================================================\n// Root-level engine routes (NOT under /api/v1)\n// These are mounted at the Express app root (e.g. /health/*)\n// =====================================================\n\nexport enum EngineRootRouteKey {\n  HEALTH_LIVENESS = 'HEALTH_LIVENESS',\n  HEALTH_READINESS = 'HEALTH_READINESS',\n  HEALTH_TIME = 'HEALTH_TIME',\n}\n\nexport const ENGINE_ROOT_ROUTES: Record<EngineRootRouteKey, string> = {\n  [EngineRootRouteKey.HEALTH_LIVENESS]: '/health',\n  [EngineRootRouteKey.HEALTH_READINESS]: '/health/ready',\n  [EngineRootRouteKey.HEALTH_TIME]: '/health/time',\n};\n"]}

package/dist/esm/requests/rate-limits.shared.schemas.d.ts

@@ -11,34 +11,85 @@ export declare enum RequestType {
     QUEUE = "QUEUE",
     INTERNAL_CALL = "INTERNAL_CALL"
 }
+/**
+ * @wildo_source:part:start saas.models.rate-limit-configuration facet:layer:shared facet:family:rate-limit
+ *
+ * Canonical rate-limit declaration shape.
+ *
+ * Authoring semantics:
+ *
+ * - Every window is **optional**. `undefined` means "no limit on this window".
+ *   Authors typically declare one or two windows (e.g. `{ requestsPerMinute: 5,
+ *   requestsPerHour: 30 }` for a public anonymous endpoint).
+ * - Multiple declared windows are **AND-ed**: a request is allowed only when
+ *   it passes every declared window. On 429 the response reports two
+ *   potentially DIFFERENT windows:
+ *   - `X-RateLimit-Limit` / `…-Remaining` / `…-Reset` — from the **tightest
+ *     active window** (the one with the fewest remaining slots), so the
+ *     client sees the binding quota.
+ *   - `Retry-After` and `retryAfterSeconds` (in the error body) — from the
+ *     **latest tripped window**, because a retry cannot succeed until every
+ *     exceeded window has reset.
+ * - `customWindows` is the **escape hatch** for the rare endpoint whose
+ *   business semantics genuinely do not fit a 60s / 3600s / 86400s grid. The
+ *   canonical example is the SMS phone-verify
+ *   family, which mandates a 5-minute (300s) per-phone-number throttle
+ *   tied to the OTP TTL — neither minute nor hour is correct, and rounding
+ *   would either let attackers through (round up) or DoS legitimate users
+ *   (round down). Authors should reach for `requestsPerMinute / Hour / Day`
+ *   first; `customWindows` exists for the cases where those would be
+ *   semantically wrong, NOT as a convenience for arbitrary tuning.
+ *
+ * Two consumption surfaces use this shape today:
+ * 1. **Resource operations** — `ResourceConfiguration_Operation_ApiCall.rateLimit?`
+ *    on `API_CALL` / `API_CALL_WITH_CALLBACK` variants. Pre-flight enforced
+ *    BEFORE execution-context creation, validation, and authorization. The
+ *    bucket is always IP-keyed at this seam (authenticated identity is
+ *    unknown by construction).
+ * 2. **Custom controllers** — `RateLimitBackendService.checkPolicy(req, res,
+ *    policy, scopeKey, organizationId?, clientIdOverride?)` for hand-wired
+ *    routes (auth, SCIM, marketing public endpoints). The bucket defaults
+ *    to IP-keyed; pass `clientIdOverride` (resolved subject identifier:
+ *    `token._id`, `userId`, normalized email, normalized phone) when the
+ *    caller has a stronger identity than IP — IP rotation must not let a
+ *    bad actor sidestep a per-subject quota.
+ *
+ * The global HTTP per-IP limiter (`RuntimeConfig.httpServerConfiguration.rateLimiting`)
+ * remains the safety net for endpoints that declare no policy.
+ *
+ * @remarks Import from `@wildo-ai/saas-models`.
+ */
 export declare const RateLimitConfigurationSchema: z.ZodObject<{
-    requestsPerMinute: z.ZodNumber;
-    requestsPerHour: z.ZodNumber;
-    requestsPerDay: z.ZodNumber;
-    burstLimit: z.ZodNumber;
-}, z.core.$strip, core.$ZodObjectExtra>;
+    requestsPerMinute: z.ZodOptional<z.ZodNumber>;
+    requestsPerHour: z.ZodOptional<z.ZodNumber>;
+    requestsPerDay: z.ZodOptional<z.ZodNumber>;
+    customWindows: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        requestsPerWindow: z.ZodNumber;
+        windowSeconds: z.ZodNumber;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+/** @wildo_source:part:end saas.models.rate-limit-configuration */
 export type RateLimitConfiguration = z.infer<typeof RateLimitConfigurationSchema>;
+/**
+ * API-key-bound rate-limit declaration (system 3 in the rate-limit
+ * unification audit). The shape is the canonical `RateLimitConfiguration`
+ * extended with `_id` + `apiKeyId` so it can be persisted and addressed
+ * per-key. Wired onto `ApiKeyOrganizationContextSchema` /
+ * `ApiKeyApplicationContextSchema` as the K-7 hook for future per-API-key
+ * tier enforcement; not enforced inbound today (the `RateLimitBackendService`
+ * pre-flight seam currently consumes the resource-operation `rateLimit?`
+ * field, not the API-key context).
+ */
 export declare const ApiRequest_RateLimitSchema: z.ZodObject<{
-    requestsPerMinute: z.ZodNumber;
-    requestsPerHour: z.ZodNumber;
-    requestsPerDay: z.ZodNumber;
-    burstLimit: z.ZodNumber;
+    requestsPerMinute: z.ZodOptional<z.ZodNumber>;
+    requestsPerHour: z.ZodOptional<z.ZodNumber>;
+    requestsPerDay: z.ZodOptional<z.ZodNumber>;
+    customWindows: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        requestsPerWindow: z.ZodNumber;
+        windowSeconds: z.ZodNumber;
+    }, z.core.$strip>>>;
     _id: z.ZodString;
     apiKeyId: z.ZodString;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export type ApiRequest_RateLimit = z.infer<typeof ApiRequest_RateLimitSchema>;
-export declare const ApiRequest_RateLimitStatusSchema: z.ZodObject<{
-    remainingMinute: z.ZodNumber;
-    remainingHour: z.ZodNumber;
-    remainingDay: z.ZodNumber;
-    resetTime: z.ZodDate;
-    isBlocked: z.ZodBoolean;
-    windowStart: z.ZodDate;
-    requestCount: z.ZodObject<{
-        minute: z.ZodNumber;
-        hour: z.ZodNumber;
-        day: z.ZodNumber;
-    }, z.core.$strip, core.$ZodObjectExtra>;
-}, z.core.$strip, core.$ZodObjectExtra>;
-export type ApiRequest_RateLimitStatus = z.infer<typeof ApiRequest_RateLimitStatusSchema>;
 //# sourceMappingURL=rate-limits.shared.schemas.d.ts.map

package/dist/esm/requests/rate-limits.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limits.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/requests/rate-limits.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,oBAAY,WAAW;IACrB,QAAQ,aAAa;IACrB,QAAQ,aAAa;IACrB,KAAK,UAAU;IACf,aAAa,kBAAkB;CAChC;AAED,eAAO,MAAM,4BAA4B;;;;;uCAKvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,0BAA0B;;;;;;;uCAGrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;uCAY3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC"}
+{"version":3,"file":"rate-limits.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/requests/rate-limits.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,oBAAY,WAAW;IACrB,QAAQ,aAAa;IACrB,QAAQ,aAAa;IACrB,KAAK,UAAU;IACf,aAAa,kBAAkB;CAChC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;iBAQvC,CAAC;AACH,kEAAkE;AAElE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;iBAGrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC"}