npm - @wildo-ai/saas-models - Versions diffs - 1.1.2 → 1.1.4 - Mend

@wildo-ai/saas-models 1.1.2 → 1.1.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (645) hide show

package/dist/esm/requests/manual-controllers-routes-documentation.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"manual-controllers-routes-documentation.js","sourceRoot":"","sources":["../../../src/requests/manual-controllers-routes-documentation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAE5E;;;;;;;;;;;GAWG;AACH,MAAM,CAAN,IAAY,0BAaX;AAbD,WAAY,0BAA0B;IACpC,gGAAgG;IAChG,+DAAiC,CAAA;IACjC,wGAAwG;IACxG,oEAAsC,CAAA;IACtC,2GAA2G;IAC3G,sEAAwC,CAAA;IACxC,uFAAuF;IACvF,kEAAoC,CAAA;IACpC,yEAAyE;IACzE,4DAA8B,CAAA;IAC9B,kFAAkF;IAClF,wEAA0C,CAAA;AAC5C,CAAC,EAbW,0BAA0B,KAA1B,0BAA0B,QAarC;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,mCASX;AATD,WAAY,mCAAmC;IAC7C,2GAA2G;IAC3G,wDAAiB,CAAA;IACjB,kEAAkE;IAClE,8EAAuC,CAAA;IACvC,0EAA0E;IAC1E,sEAA+B,CAAA;IAC/B,kFAAkF;IAClF,gGAAyD,CAAA;AAC3D,CAAC,EATW,mCAAmC,KAAnC,mCAAmC,QAS9C;AAED,oEAAoE;AACpE,MAAM,CAAN,IAAY,gCAGX;AAHD,WAAY,gCAAgC;IAC1C,2DAAuB,CAAA;IACvB,yDAAqB,CAAA;AACvB,CAAC,EAHW,gCAAgC,KAAhC,gCAAgC,QAG3C;AA0CD,sFAAsF;AACtF,SAAS,EAAE,CAAC,OAAe;IACzB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,IAAI,GAAG,0BAA0B,CAAC,cAAc,CAAC;AACvD,MAAM,GAAG,GAAG,0BAA0B,CAAC,iBAAiB,CAAC;AACzD,MAAM,WAAW,GAAG,0BAA0B,CAAC,kBAAkB,CAAC;AAClE,MAAM,MAAM,GAAG,0BAA0B,CAAC,gBAAgB,CAAC;AAC3D,MAAM,KAAK,GAAG,0BAA0B,CAAC,aAAa,CAAC;AACvD,MAAM,OAAO,GAAG,0BAA0B,CAAC,mBAAmB,CAAC;AAE/D,MAAM,MAAM,GAAG,mCAAmC,CAAC,MAAM,CAAC;AAC1D,MAAM,MAAM,GAAG,mCAAmC,CAAC,aAAa,CAAC;AAEjE,MAAM,aAAa,GAAG,oEAAoE,CAAC;AAC3F,MAAM,iBAAiB,GAAG,+CAA+C,CAAC;AAE1E,gGAAgG;AAChG,MAAM,CAAC,MAAM,0CAA0C,GAA+C;IACpG,CAAC,0BAA0B,CAAC,cAAc,CAAC,EACzC,yHAAyH;UACvH,oHAAoH;UACpH,yHAAyH;UACzH,oGAAoG;IACxG,CAAC,0BAA0B,CAAC,iBAAiB,CAAC,EAC5C,oHAAoH;UAClH,oHAAoH;UACpH,uHAAuH;UACvH,6FAA6F;IACjG,CAAC,0BAA0B,CAAC,kBAAkB,CAAC,EAC7C,uHAAuH;UACrH,+CAA+C;IACnD,CAAC,0BAA0B,CAAC,gBAAgB,CAAC,EAC3C,sHAAsH;UACpH,gFAAgF;IACpF,CAAC,0BAA0B,CAAC,aAAa,CAAC,EACxC,wHAAwH;UACtH,wDAAwD;IAC5D,CAAC,0BAA0B,CAAC,mBAAmB,CAAC,EAC9C,qHAAqH;UACnH,kEAAkE;CACvE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAyE;IACzH,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE;QACjD,WAAW,EAAE,gCAAgC,CAAC,QAAQ;QACtD,cAAc,EACZ,kHAAkH;cAChH,qHAAqH;cACrH,iHAAiH;KACtH;IAED,gGAAgG;IAChG,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE;QACxC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,yEAAyE;QAClF,WAAW,EACT,uHAAuH;cACrH,mHAAmH;cACnH,sHAAsH;cACtH,4CAA4C;QAChD,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,aAAa;QACpC,aAAa,EAAE,EAAE,CAAC,kFAAkF,CAAC;KACtG;IACD,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE;QACrD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,8BAA8B;QACvC,WAAW,EACT,uHAAuH;cACrH,wHAAwH;cACxH,kHAAkH;cAClH,uEAAuE;QAC3E,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,aAAa;QACpC,aAAa,EAAE,EAAE,CAAC,6EAA6E,CAAC;KACjG;IACD,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE;QAC5C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,8BAA8B;QACvC,WAAW,EACT,0HAA0H;cACxH,sHAAsH;cACtH,yEAAyE;QAC7E,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,aAAa;QACpC,aAAa,EAAE,EAAE,CAAC,yEAAyE,CAAC;KAC7F;IACD,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE;QAC7C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,yBAAyB;QAClC,WAAW,EACT,wHAAwH;cACtH,uHAAuH;cACvH,qEAAqE;QACzE,cAAc,EAAE,MAAM;QACtB,qBAAqB,EACnB,8GAA8G;QAChH,aAAa,EAAE,EAAE,CAAC,kEAAkE,CAAC;KACtF;IACD,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE;QAC7C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,yDAAyD;QAClE,WAAW,EACT,uHAAuH;cACrH,2EAA2E;QAC/E,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,uEAAuE;QAC9F,aAAa,EAAE,EAAE,CAAC,yDAAyD,CAAC;KAC7E;IACD,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE;QACtC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,0BAA0B;QACnC,WAAW,EACT,2HAA2H;cACzH,iGAAiG;QACrG,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,+DAA+D,CAAC;KACnF;IACD,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE;QAC1C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,qBAAqB;QAC9B,WAAW,EACT,wHAAwH;cACtH,oHAAoH;cACpH,6CAA6C;QACjD,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,+CAA+C,CAAC;KACnE;IACD,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE;QACxC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,wBAAwB;QACjC,WAAW,EACT,yHAAyH;cACvH,mHAAmH;cACnH,qDAAqD;QACzD,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,aAAa;QACpC,aAAa,EAAE,EAAE,CAAC,yDAAyD,CAAC;KAC7E;IACD,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE;QAC5C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,yBAAyB;QAClC,WAAW,EACT,qHAAqH;cACnH,mGAAmG;QACvG,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,2EAA2E;QAClG,aAAa,EAAE,EAAE,CAAC,oDAAoD,CAAC;KACxE;IACD,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE;QACnD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,+BAA+B;QACxC,WAAW,EACT,wHAAwH;cACtH,8EAA8E;QAClF,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,aAAa;QACpC,aAAa,EAAE,EAAE,CAAC,sFAAsF,CAAC;KAC1G;IACD,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE;QACtD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,0BAA0B;QACnC,WAAW,EACT,yHAAyH;cACvH,kEAAkE;QACtE,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,aAAa;QACpC,aAAa,EAAE,EAAE,CAAC,4EAA4E,CAAC;KAChG;IACD,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE;QACvD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,2BAA2B;QACpC,WAAW,EACT,mHAAmH;cACjH,wEAAwE;QAC5E,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,0EAA0E;QACjG,aAAa,EAAE,EAAE,CAAC,gEAAgE,CAAC;KACpF;IACD,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE;QACvD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,kCAAkC;QAC3C,WAAW,EACT,0HAA0H;cACxH,oFAAoF;QACxF,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,uDAAuD,CAAC;KAC3E;IAED,gGAAgG;IAChG,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE;QAC/C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,uHAAuH;cACrH,uHAAuH;cACvH,cAAc;QAClB,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,wEAAwE;QAC/F,aAAa,EAAE,EAAE,CAAC,uDAAuD,CAAC;KAC3E;IACD,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE;QACjD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,qCAAqC;QAC9C,WAAW,EACT,uHAAuH;cACrH,qHAAqH;cACrH,8CAA8C;QAClD,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,6EAA6E;QACpG,aAAa,EAAE,EAAE,CAAC,oDAAoD,CAAC;KACxE;IACD,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE;QACjD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,qCAAqC;QAC9C,WAAW,EAAE,+FAA+F;QAC5G,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,gFAAgF;QACvG,aAAa,EAAE,EAAE,CAAC,6BAA6B,CAAC;KACjD;IACD,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE;QACnD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,6BAA6B;QACtC,WAAW,EACT,mHAAmH;cACjH,sFAAsF;QAC1F,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,oCAAoC,CAAC;KACxD;IACD,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE;QACpD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,8BAA8B;QACvC,WAAW,EACT,wHAAwH;cACtH,iDAAiD;QACrD,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,kEAAkE,CAAC;KACtF;IACD,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE;QACpD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,8BAA8B;QACvC,WAAW,EAAE,gFAAgF;QAC7F,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,6BAA6B,CAAC;KACjD;IAED,gGAAgG;IAChG,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,EAAE;QAClD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,6BAA6B;QACtC,WAAW,EAAE,kGAAkG;QAC/G,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,8EAA8E;QACrG,aAAa,EAAE,EAAE,CAAC,uBAAuB,CAAC;KAC3C;IACD,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE;QACpD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,+BAA+B;QACxC,WAAW,EACT,wHAAwH;QAC1H,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,oEAAoE;QAC3F,aAAa,EAAE,EAAE,CAAC,qEAAqE,CAAC;KACzF;IACD,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE;QAC9C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,sBAAsB;QAC/B,WAAW,EACT,oHAAoH;cAClH,0GAA0G;QAC9G,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,qDAAqD,CAAC;KACzE;IACD,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE;QACrD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,wBAAwB;QACjC,WAAW,EACT,wHAAwH;cACtH,uGAAuG;QAC3G,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,8BAA8B,CAAC;KAClD;IACD,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE;QAC/C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,oBAAoB;QAC7B,WAAW,EACT,uHAAuH;cACrH,4DAA4D;QAChE,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,oEAAoE;QAC3F,aAAa,EAAE,EAAE,CAAC,qEAAqE,CAAC;KACzF;IACD,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE;QAChD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,cAAc;QACvB,WAAW,EACT,oHAAoH;cAClH,4DAA4D;QAChE,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,6DAA6D;QACpF,aAAa,EAAE,EAAE,CAAC,6BAA6B,CAAC;KACjD;IACD,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE;QAC5C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,2BAA2B;QACpC,WAAW,EACT,uHAAuH;cACrH,sEAAsE;QAC1E,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,8EAA8E;QACrG,aAAa,EAAE,EAAE,CAAC,uBAAuB,CAAC;KAC3C;IACD,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE;QAC9C,WAAW,EAAE,gCAAgC,CAAC,QAAQ;QACtD,cAAc,EACZ,sGAAsG;cACpG,qHAAqH;cACrH,qHAAqH;KAC1H;IACD,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE;QACjD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,sHAAsH;cACpH,2CAA2C;QAC/C,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,qCAAqC,CAAC;KACzD;IACD,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE;QACpD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,mCAAmC;QAC5C,WAAW,EAAE,wFAAwF;QACrG,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,yBAAyB,CAAC;KAC7C;IACD,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE;QAC/C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,mBAAmB;QAC5B,WAAW,EACT,uHAAuH;cACrH,+BAA+B;QACnC,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,aAAa;QACpC,aAAa,EAAE,EAAE,CAAC,gFAAgF,CAAC;KACpG;IACD,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE;QACjD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,qBAAqB;QAC9B,WAAW,EAAE,mGAAmG;QAChH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,wDAAwD;QAC/E,aAAa,EAAE,EAAE,CAAC,4CAA4C,CAAC;KAChE;IAED,gGAAgG;IAChG,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE;QACxD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,4BAA4B;QACrC,WAAW,EACT,sGAAsG;cACpG,uHAAuH;QAC3H,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,4CAA4C,CAAC;KAChE;IACD,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE;QACvD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,+BAA+B;QACxC,WAAW,EAAE,2GAA2G;QACxH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,4BAA4B,CAAC;KAChD;IACD,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE;QACpD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,8BAA8B;QACvC,WAAW,EACT,wFAAwF;cACtF,+DAA+D;QACnE,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,aAAa;QACpC,aAAa,EAAE,EAAE,CAAC,2CAA2C,CAAC;KAC/D;IACD,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE;QACnD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,iCAAiC;QAC1C,WAAW,EAAE,oGAAoG;QACjH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,qDAAqD;QAC5E,aAAa,EAAE,EAAE,CAAC,4CAA4C,CAAC;KAChE;IACD,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE;QAC5C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,kBAAkB;QAC3B,WAAW,EAAE,8GAA8G;QAC3H,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,oCAAoC,CAAC;KACxD;IACD,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE;QAC9C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,kBAAkB;QAC3B,WAAW,EACT,yGAAyG;cACvG,0BAA0B;QAC9B,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,6DAA6D;QACpF,aAAa,EAAE,EAAE,CAAC,yBAAyB,CAAC;KAC7C;IACD,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE;QAC9C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,kBAAkB;QAC3B,WAAW,EAAE,mGAAmG;QAChH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,kCAAkC,CAAC;KACtD;IAED,gGAAgG;IAChG,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE;QAC5C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,yCAAyC;QAClD,WAAW,EACT,iHAAiH;cAC/G,sHAAsH;cACtH,uBAAuB;QAC3B,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,iCAAiC,CAAC;KACrD;IACD,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE;QAC/C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,oBAAoB;QAC7B,WAAW,EACT,wHAAwH;cACtH,qBAAqB;QACzB,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,6DAA6D,CAAC;KACjF;IACD,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE;QAC5C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,uBAAuB;QAChC,WAAW,EACT,qHAAqH;cACnH,oGAAoG;QACxG,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,6DAA6D;QACpF,aAAa,EAAE,EAAE,CAAC,mCAAmC,CAAC;KACvD;IACD,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE;QACnD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,2BAA2B;QACpC,WAAW,EAAE,2GAA2G;QACxH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,kCAAkC,CAAC;KACtD;IACD,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE;QACrD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QAC5B,OAAO,EAAE,oBAAoB;QAC7B,WAAW,EACT,wHAAwH;cACtH,2BAA2B;QAC/B,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,6DAA6D;QACpF,aAAa,EAAE,EAAE,CAAC,2BAA2B,CAAC;KAC/C;IACD,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE;QACtC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,2CAA2C;QACpD,WAAW,EACT,yHAAyH;cACvH,6FAA6F;QACjG,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,6BAA6B,CAAC;KACjD;IACD,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE;QACtD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,yBAAyB;QAClC,WAAW,EACT,wHAAwH;cACtH,0GAA0G;QAC9G,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,2CAA2C,CAAC;KAC/D;IAED,gGAAgG;IAChG,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE;QAChD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,wBAAwB;QACjC,WAAW,EACT,uHAAuH;cACrH,oHAAoH;cACpH,iBAAiB;QACrB,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,aAAa;QACpC,aAAa,EAAE,EAAE,CAAC,gDAAgD,CAAC;KACpE;IACD,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE;QAC/C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC;QAC1C,OAAO,EAAE,yBAAyB;QAClC,WAAW,EACT,qHAAqH;cACnH,gHAAgH;cAChH,kHAAkH;QACtH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,0FAA0F;QACjH,aAAa,EAAE,EAAE,CAAC,gEAAgE,CAAC;KACpF;IACD,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE;QAC9C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,qCAAqC;QAC9C,WAAW,EACT,mHAAmH;cACjH,6FAA6F;QACjG,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,kDAAkD;QACzE,aAAa,EAAE,EAAE,CAAC,4CAA4C,CAAC;KAChE;IACD,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE;QACxD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,mCAAmC;QAC5C,WAAW,EACT,mHAAmH;cACjH,8EAA8E;QAClF,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,aAAa;QACpC,aAAa,EAAE,EAAE,CAAC,qDAAqD,CAAC;KACzE;IACD,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE;QACxD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,uCAAuC;QAChD,WAAW,EACT,wHAAwH;cACtH,8DAA8D;QAClE,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,aAAa;QACpC,aAAa,EAAE,EAAE,CAAC,qDAAqD,CAAC;KACzE;IACD,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE;QAC1C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,sBAAsB;QAC/B,WAAW,EACT,uHAAuH;cACrH,yBAAyB;QAC7B,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,aAAa;QACpC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,qDAAqD,EAAE;KAC/F;IACD,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE;QACxC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,iCAAiC;QAC1C,WAAW,EACT,wHAAwH;cACtH,oHAAoH;cACpH,6BAA6B;QACjC,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,wDAAwD;QAC/E,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,2EAA2E,EAAE;KACrH;IACD,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE;QAC7C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,qHAAqH;cACnH,oHAAoH;cACpH,kCAAkC;QACtC,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,+DAA+D;QACtF,aAAa,EAAE,EAAE,CAAC,iCAAiC,CAAC;KACrD;IACD,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE;QACxC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC;QAC1C,OAAO,EAAE,6BAA6B;QACtC,WAAW,EACT,wHAAwH;cACtH,oHAAoH;cACpH,yBAAyB;QAC7B,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,6DAA6D;QACpF,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,iDAAiD,EAAE;KAC3F;IACD,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE;QAC9C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,qBAAqB;QAC9B,WAAW,EACT,yHAAyH;cACvH,uHAAuH;cACvH,QAAQ;QACZ,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,wFAAwF,CAAC;KAC5G;IAED,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,EAAE;QAC3C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,qHAAqH;cACnH,uHAAuH;cACvH,0EAA0E;QAC9E,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,kGAAkG,CAAC;KACtH;IAED,gGAAgG;IAChG,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE;QACtD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,oCAAoC;QAC7C,WAAW,EACT,yHAAyH;cACvH,6FAA6F;QACjG,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,+CAA+C,CAAC;KACnE;IACD,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE;QACtD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,8BAA8B;QACvC,WAAW,EACT,uHAAuH;cACrH,oHAAoH;cACpH,yDAAyD;QAC7D,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,sDAAsD,EAAE;KAChG;IACD,CAAC,wBAAwB,CAAC,+BAA+B,CAAC,EAAE;QAC1D,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,qDAAqD;QAC9D,WAAW,EACT,uHAAuH;cACrH,cAAc;QAClB,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,sDAAsD,EAAE;KAChG;IACD,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE;QACxD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,kCAAkC;QAC3C,WAAW,EAAE,kHAAkH;QAC/H,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,gDAAgD;QACvE,aAAa,EAAE,EAAE,CAAC,0CAA0C,CAAC;KAC9D;IACD,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE;QACtD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,yHAAyH;cACvH,4BAA4B;QAChC,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,uCAAuC,CAAC;KAC3D;IACD,CAAC,wBAAwB,CAAC,+BAA+B,CAAC,EAAE;QAC1D,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,uDAAuD;QAChE,WAAW,EAAE,iFAAiF;QAC9F,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,uCAAuC,CAAC;KAC3D;IAED,gGAAgG;IAChG,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE;QACnD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,mCAAmC;QAC5C,WAAW,EACT,mHAAmH;cACjH,qHAAqH;cACrH,iHAAiH;cACjH,uDAAuD;QAC3D,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iFAAiF;QACxG,aAAa,EAAE,EAAE,CAAC,iCAAiC,CAAC;KACrD;IACD,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE;QACrD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,yCAAyC;QAClD,WAAW,EACT,sHAAsH;cACpH,iHAAiH;cACjH,qHAAqH;cACrH,8CAA8C;QAClD,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iFAAiF;QACxG,aAAa,EAAE,EAAE,CAAC,iCAAiC,CAAC;KACrD;IACD,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE;QAC9C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,kBAAkB;QAC3B,WAAW,EACT,yHAAyH;cACvH,qHAAqH;cACrH,4BAA4B;QAChC,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,wCAAwC;QAC/D,aAAa,EAAE,EAAE,CAAC,cAAc,CAAC;KAClC;IACD,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE;QACnD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,wBAAwB;QACjC,WAAW,EACT,qHAAqH;cACnH,oHAAoH;cACpH,4DAA4D;QAChE,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,gFAAgF;QACvG,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,0EAA0E,EAAE;KACpH;IACD,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE;QACjD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,2BAA2B;QACpC,WAAW,EACT,8GAA8G;cAC5G,kFAAkF;QACtF,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,8EAA8E;QACrG,aAAa,EAAE,EAAE,CAAC,gFAAgF,CAAC;KACpG;IACD,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE;QAC/C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,gBAAgB;QACzB,WAAW,EACT,uHAAuH;cACrH,sHAAsH;cACtH,yEAAyE;QAC7E,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,4EAA4E;QACnG,aAAa,EAAE,EAAE,CAAC,iDAAiD,CAAC;KACrE;IACD,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,EAAE;QAClD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,mBAAmB;QAC5B,WAAW,EAAE,qGAAqG;QAClH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,gDAAgD;QACvE,aAAa,EAAE,EAAE,CAAC,wBAAwB,CAAC;KAC5C;IACD,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE;QAChD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,gBAAgB;QACzB,WAAW,EACT,oHAAoH;cAClH,wDAAwD;QAC5D,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,4EAA4E;QACnG,aAAa,EAAE,EAAE,CAAC,kFAAkF,CAAC;KACtG;IACD,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE;QACrD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,sBAAsB;QAC/B,WAAW,EACT,wHAAwH;cACtH,qHAAqH;cACrH,sFAAsF;QAC1F,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,4DAA4D;QACnF,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,0EAA0E,EAAE;KACpH;IACD,CAAC,wBAAwB,CAAC,kCAAkC,CAAC,EAAE;QAC7D,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,mHAAmH;cACjH,gHAAgH;cAChH,8CAA8C;QAClD,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,2EAA2E;QAClG,aAAa,EAAE,EAAE,CAAC,sDAAsD,CAAC;KAC1E;IACD,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,EAAE;QAClD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,+BAA+B;QACxC,WAAW,EACT,0HAA0H;cACxH,gHAAgH;cAChH,mFAAmF;QACvF,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,kEAAkE;QACzF,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,6EAA6E,EAAE;KACvH;IACD,CAAC,wBAAwB,CAAC,8BAA8B,CAAC,EAAE;QACzD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC;QAC5D,OAAO,EAAE,wCAAwC;QACjD,WAAW,EACT,sHAAsH;cACpH,qHAAqH;cACrH,oEAAoE;QACxE,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,4FAA4F;QACnH,aAAa,EAAE,EAAE,CAAC,sEAAsE,CAAC;KAC1F;IAED,gGAAgG;IAChG,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE;QACpD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,wCAAwC;QACjD,WAAW,EACT,sHAAsH;cACpH,oHAAoH;cACpH,2GAA2G;QAC/G,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,gDAAgD,CAAC;KACpE;IACD,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE;QACvD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,iCAAiC;QAC1C,WAAW,EACT,yFAAyF;cACvF,qHAAqH;cACrH,gHAAgH;cAChH,kHAAkH;cAClH,uHAAuH;QAC3H,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,gGAAgG;QACvH,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,qFAAqF,EAAE;KAC/H;IACD,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE;QACvD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,+CAA+C;QACxD,WAAW,EACT,2HAA2H;cACzH,qHAAqH;cACrH,mHAAmH;cACnH,2GAA2G;QAC/G,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,6DAA6D,CAAC;KACjF;IACD,CAAC,wBAAwB,CAAC,oCAAoC,CAAC,EAAE;QAC/D,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,yCAAyC;QAClD,WAAW,EACT,gHAAgH;cAC9G,gHAAgH;cAChH,8GAA8G;cAC9G,kFAAkF;QACtF,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,mDAAmD,CAAC;KACvE;IACD,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE;QACxD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,uBAAuB;QAChC,WAAW,EACT,qHAAqH;cACnH,+GAA+G;cAC/G,oHAAoH;cACpH,uEAAuE;QAC3E,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,mEAAmE,CAAC;KACvF;IAED,CAAC,wBAAwB,CAAC,gCAAgC,CAAC,EAAE;QAC3D,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,2DAA2D;QACpE,WAAW,EACT,wHAAwH;cACtH,qHAAqH;cACrH,+GAA+G;cAC/G,4GAA4G;cAC5G,kHAAkH;cAClH,mDAAmD;QACvD,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,mFAAmF,CAAC;KACvG;IAED,gGAAgG;IAChG,CAAC,wBAAwB,CAAC,YAAY,CAAC,EAAE;QACvC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC;QAC7D,OAAO,EAAE,iCAAiC;QAC1C,WAAW,EACT,sHAAsH;cACpH,uHAAuH;cACvH,iHAAiH;cACjH,mHAAmH;cACnH,mHAAmH;cACnH,qHAAqH;QACzH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,8EAA8E;QACrG,aAAa,EAAE,EAAE,CAAC,uDAAuD,CAAC;KAC3E;IACD,CAAC,wBAAwB,CAAC,+BAA+B,CAAC,EAAE;QAC1D,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,oDAAoD;QAC7D,WAAW,EACT,wHAAwH;cACtH,sHAAsH;cACtH,gHAAgH;cAChH,uCAAuC;QAC3C,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,kFAAkF;QACzG,aAAa,EAAE,EAAE,CAAC,2CAA2C,CAAC;KAC/D;IACD,CAAC,wBAAwB,CAAC,cAAc,CAAC,EAAE;QACzC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,YAAY;QACrB,WAAW,EACT,sHAAsH;cACpH,qHAAqH;cACrH,QAAQ;QACZ,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,8EAA8E;QACrG,aAAa,EAAE,EAAE,CAAC,iBAAiB,CAAC;KACrC;IACD,CAAC,wBAAwB,CAAC,SAAS,CAAC,EAAE;QACpC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,2BAA2B;QACpC,WAAW,EACT,sHAAsH;cACpH,oHAAoH;cACpH,mHAAmH;QACvH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,8DAA8D;QACrF,aAAa,EAAE,EAAE,CAAC,yEAAyE,CAAC;KAC7F;IAED,gGAAgG;IAChG,CAAC,wBAAwB,CAAC,UAAU,CAAC,EAAE;QACrC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC;QAC5C,OAAO,EAAE,kCAAkC;QAC3C,WAAW,EACT,sHAAsH;cACpH,wHAAwH;cACxH,2EAA2E;QAC/E,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,sEAAsE;QAC7F,aAAa,EAAE,EAAE,CAAC,yDAAyD,CAAC;KAC7E;IACD,CAAC,wBAAwB,CAAC,cAAc,CAAC,EAAE;QACzC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,sHAAsH;cACpH,yCAAyC;QAC7C,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,8BAA8B,CAAC;KAClD;IACD,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE;QACtC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,uCAAuC;QAChD,WAAW,EACT,wHAAwH;cACtH,mDAAmD;QACvD,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,qCAAqC,EAAE;KAC/E;IACD,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE;QACpD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,oCAAoC;QAC7C,WAAW,EACT,yHAAyH;cACvH,4DAA4D;QAChE,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,4EAA4E;QACnG,aAAa,EAAE,EAAE,CAAC,8CAA8C,CAAC;KAClE;IACD,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE;QACpD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QAC5B,OAAO,EAAE,wBAAwB;QACjC,WAAW,EACT,uHAAuH;cACrH,kGAAkG;QACtG,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,kCAAkC,CAAC;KACtD;IAED,gGAAgG;IAChG,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE;QAC1C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,wBAAwB;QACjC,WAAW,EACT,wHAAwH;cACtH,gGAAgG;QACpG,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,gEAAgE;QACvF,aAAa,EAAE,EAAE,CAAC,4CAA4C,CAAC;KAChE;IACD,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE;QAC5C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,sCAAsC;QAC/C,WAAW,EACT,wHAAwH;cACtH,qHAAqH;cACrH,WAAW;QACf,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,qCAAqC,CAAC;KACzD;IACD,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE;QACtC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,wCAAwC;QACjD,WAAW,EACT,wHAAwH;cACtH,qHAAqH;cACrH,+CAA+C;QACnD,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,2BAA2B,CAAC;KAC/C;IACD,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE;QACrD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,qDAAqD;QAC9D,WAAW,EACT,oHAAoH;cAClH,kDAAkD;QACtD,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,qCAAqC,CAAC;KACzD;IACD,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE;QAC/C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC;QAC5C,OAAO,EAAE,uCAAuC;QAChD,WAAW,EACT,0HAA0H;cACxH,sEAAsE;QAC1E,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,kEAAkE,CAAC;KACtF;IACD,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,EAAE;QAC3C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,iCAAiC;QAC1C,WAAW,EACT,sHAAsH;cACpH,uCAAuC;QAC3C,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,yBAAyB,CAAC;KAC7C;IACD,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE;QACrD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC;QAC1C,OAAO,EAAE,yCAAyC;QAClD,WAAW,EACT,qHAAqH;cACnH,6CAA6C;QACjD,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,wEAAwE,CAAC;KAC5F;IACD,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE;QACjD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,0CAA0C;QACnD,WAAW,EACT,uHAAuH;cACrH,kDAAkD;QACtD,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,0BAA0B,CAAC;KAC9C;CACF,CAAC","sourcesContent":["/**\n * What each manually mounted controller route IS, for consumer documentation.\n *\n * ## Why this file exists\n *\n * A Wildo application serves two disjoint families of HTTP routes. The RESOURCE REGISTRY builds one\n * family from the resource configurations, and every mechanism downstream — the OpenAPI generator,\n * the API-reference renderer, the link index — projects that family and only that family. The other\n * family is mounted by hand, controller by controller, from\n * {@link MANUAL_CONTROLLER_ROUTES_URLS}: sign-in, token refresh, MFA, passkeys, SAML, the OAuth 2.0\n * authorization-server endpoints, the MCP and A2A doors, file transfer, i18n labels, charts.\n *\n * Nothing projected the second family, so it appeared in NO generated API reference. Measured\n * 2026-09-09 on the four committed documents of the two dogfood applications — 439, 576, 146 and 160\n * paths — every one of which contained **zero** paths under `/auth`. The reference told an integrator\n * that operations accept a bearer token and never told them which endpoint issues one; worse, four\n * operation-header descriptions in the same document say a step-up token is \"obtained from\n * `POST /api/v1/auth/reauth`\", a path that document does not publish.\n *\n * ## Why the facts live HERE and not at the mount site\n *\n * The route's VERB and its one-line purpose are already written at each `logRouteRegistration(...)`\n * call — 203 of them — inside `@wildo-ai/saas-backend-lib`. That package is the backend runtime, and\n * the documentation projector runs inside the companion's introspection subprocess, which loads the\n * application's SHARED library and never the backend. So the mount site cannot be the source: it is\n * not reachable from where the answer is needed.\n *\n * This catalog is therefore the shared, statically-loadable source, and it is **total over\n * {@link ManualControllerRouteKey}** by construction. A route key added tomorrow does not compile\n * until somebody says what it is and whether it may be published — which is the whole point: an\n * undocumented route should be a build failure, not a silent hole in a customer-facing reference.\n *\n * ## What is deliberately NOT here\n *\n * No request or response JSON Schema. The request bodies are Zod schemas declared inside the backend\n * controllers, unreachable from this package; hand-copying them here would create a second copy of a\n * contract with nothing checking the two agree — the exact drift this repository refuses elsewhere.\n * Each entry therefore names its payload in PROSE and authors its success status, which is honest\n * about what is known. Wiring the real schemas is a later, larger change that has to move them into a\n * shared module first.\n */\n\nimport { HttpMethod } from './http-requests.shared';\nimport { ManualControllerRouteKey } from './manual-controllers-routes-urls';\n\n/**\n * The API-reference grouping a manual route belongs to — the OpenAPI `tag` it is published under.\n *\n * Deliberately NOT one group per controller. A reader groups by what they are trying to DO, and the\n * controller split is an implementation fact: sign-in lives in one controller and password change in\n * another, and both are \"authentication\" to the person reading.\n *\n * The values must not collide with any resource identifier, because the generator turns a tag name\n * into `technical-documentation:resource/<name>` and two tags claiming one ref would make the\n * renderer's conservation check refuse the document. Resource identifiers are the resource TYPES\n * (`users`, `organizations`, `oauthConsentGrants`, …); none of these names is one.\n */\nexport enum ManualControllerRouteGroup {\n /** Signing in, staying signed in, signing out, and everything that proves who the caller is. */\n AUTHENTICATION = 'authentication',\n /** This application acting as an OAuth 2.0 / OpenID Connect authorization server for other software. */\n IDENTITY_PROVIDER = 'identityProvider',\n /** Connecting a third-party account so this application can act as it. The opposite arrow from sign-in. */\n CONNECTED_ACCOUNTS = 'connectedAccounts',\n /** The doors an autonomous agent knocks on: Model Context Protocol and Agent2Agent. */\n AGENT_INTERFACES = 'agentInterfaces',\n /** Transferring a stored file by its own id, wherever it is attached. */\n FILE_TRANSFER = 'fileTransfer',\n /** Reads a client makes to work out what this application currently offers it. */\n APPLICATION_RUNTIME = 'applicationRuntime',\n}\n\n/**\n * What a caller must present. Mirrors the documentation vocabulary the resource projector already\n * resolves from role bindings, so both families of routes describe access the same way.\n */\nexport enum ManualControllerRouteAuthentication {\n /** No credential. The request itself carries whatever authorization it needs (a single-use token, say). */\n PUBLIC = 'public',\n /** An anonymous-session token in the anonymous-session header. */\n ANONYMOUS_SESSION = 'anonymous_session',\n /** A bearer access token, or an API key where the surface accepts one. */\n AUTHENTICATED = 'authenticated',\n /** Either an anonymous session or a full credential; the endpoint serves both. */\n ANONYMOUS_OR_AUTHENTICATED = 'anonymous_or_authenticated',\n}\n\n/** Whether a route reaches the generated consumer API reference. */\nexport enum ManualControllerRoutePublication {\n PUBLISHED = 'published',\n WITHHELD = 'withheld',\n}\n\n/** A route that is published: everything the projector needs to emit an OpenAPI operation. */\nexport interface PublishedManualControllerRouteDocumentation {\n readonly publication: ManualControllerRoutePublication.PUBLISHED;\n readonly group: ManualControllerRouteGroup;\n /**\n * The methods actually mounted for this path, measured from the controllers rather than assumed.\n * One key can carry several (`/oauth/register/{clientId}` is GET, PUT and DELETE; RFC 7592 defines\n * ONE endpoint whose method selects the operation), and each becomes its own OpenAPI operation.\n */\n readonly methods: readonly HttpMethod[];\n /** Short action label. Becomes the OpenAPI `summary`; the generator caps it at 200 characters. */\n readonly summary: string;\n /** What the endpoint does, what it expects, and what a caller does with the answer. Capped at 2000. */\n readonly description: string;\n readonly authentication: ManualControllerRouteAuthentication;\n /** One sentence naming the credential. Capped at 500. */\n readonly authenticationSummary: string;\n /**\n * The success status and what it means. Authored because no response schema is projected: without\n * it the generator would emit a bare `204 No Content`, which is wrong for almost every route here.\n */\n readonly successStatus: { readonly code: string; readonly meaning: string };\n}\n\n/**\n * A route that is NOT published, and why.\n *\n * The reason is a required field rather than a comment on purpose. Withholding a route from a\n * customer-facing reference is a decision, and a decision with no recorded reason is indistinguishable\n * from an oversight — which is how this whole family came to be missing in the first place.\n */\nexport interface WithheldManualControllerRouteDocumentation {\n readonly publication: ManualControllerRoutePublication.WITHHELD;\n readonly withheldReason: string;\n}\n\nexport type ManualControllerRouteDocumentation =\n | PublishedManualControllerRouteDocumentation\n | WithheldManualControllerRouteDocumentation;\n\n/** Shorthand for the common `200` success row, so the entries below stay readable. */\nfunction ok(meaning: string): { code: string; meaning: string } {\n return { code: '200', meaning };\n}\n\nconst AUTH = ManualControllerRouteGroup.AUTHENTICATION;\nconst IDP = ManualControllerRouteGroup.IDENTITY_PROVIDER;\nconst CONNECTIONS = ManualControllerRouteGroup.CONNECTED_ACCOUNTS;\nconst AGENTS = ManualControllerRouteGroup.AGENT_INTERFACES;\nconst FILES = ManualControllerRouteGroup.FILE_TRANSFER;\nconst RUNTIME = ManualControllerRouteGroup.APPLICATION_RUNTIME;\n\nconst PUBLIC = ManualControllerRouteAuthentication.PUBLIC;\nconst BEARER = ManualControllerRouteAuthentication.AUTHENTICATED;\n\nconst NO_CREDENTIAL = 'No credential. This endpoint is reachable before a caller has one.';\nconst BEARER_CREDENTIAL = 'A bearer access token identifying the caller.';\n\n/** Prose group descriptions, emitted as each published group's OpenAPI `tags[].description`. */\nexport const MANUAL_CONTROLLER_ROUTE_GROUP_DESCRIPTIONS: Record<ManualControllerRouteGroup, string> = {\n [ManualControllerRouteGroup.AUTHENTICATION]:\n 'Obtaining a credential, keeping it, and giving it up. Start at **Identify a caller** to learn which methods an account '\n + 'can use, then call the method you chose; a successful call returns the access token every other operation in this '\n + 'reference accepts as `Authorization: Bearer <token>`. These endpoints are mounted by the framework rather than derived '\n + 'from a resource, so their payloads are described in prose here rather than carrying a JSON Schema.',\n [ManualControllerRouteGroup.IDENTITY_PROVIDER]:\n 'This application acting as an OAuth 2.0 authorization server and OpenID Connect provider for OTHER software — the '\n + 'endpoints a client, an MCP client or an agent uses to obtain a token bound to this application. Distinct from the '\n + 'authentication endpoints, which sign a person in TO this application. Payloads follow the cited RFCs; this reference '\n + 'publishes the addresses and the contract summary rather than re-stating the specifications.',\n [ManualControllerRouteGroup.CONNECTED_ACCOUNTS]:\n 'Connecting a third-party account so this application can act as that account. The opposite direction from signing in '\n + 'with a vendor: same protocol, opposite arrow.',\n [ManualControllerRouteGroup.AGENT_INTERFACES]:\n 'The endpoints autonomous software talks to: the Model Context Protocol server and the Agent2Agent surface, plus the '\n + 'public metadata each advertises so a client can discover where to get a token.',\n [ManualControllerRouteGroup.FILE_TRANSFER]:\n 'Transferring a stored file by its own id. Distinct from a resource\\'s own `…/{id}/files/{field}` routes, which upload '\n + 'and replace the file bound to one field of one record.',\n [ManualControllerRouteGroup.APPLICATION_RUNTIME]:\n 'Reads a client makes to work out what this application currently offers it — resolved features, translated labels, '\n + 'chart data, conversational history, product-analytics ingestion.',\n};\n\n/**\n * Every manually mounted route, keyed by the route it is mounted at.\n *\n * TOTAL over {@link ManualControllerRouteKey}: the `Record` type makes a new route key a compile\n * error until it is described here. That is the mechanism that keeps this catalog honest — a\n * hand-kept list of \"the ones we remembered\" is precisely what rots.\n */\nexport const MANUAL_CONTROLLER_ROUTE_DOCUMENTATION: Record<ManualControllerRouteKey, ManualControllerRouteDocumentation> = {\n [ManualControllerRouteKey.APPLICATION_CONFIG_GET]: {\n publication: ManualControllerRoutePublication.WITHHELD,\n withheldReason:\n 'Bootstrap contract between this application\\'s backend and its OWN frontend bundles. The response is keyed by a '\n + '`frontendServiceName` query parameter and its shape follows whatever that frontend is configured to need, so it is '\n + 'not a stable surface for an integrator and publishing it would invite calls that break when a frontend changes.',\n },\n\n // ─── Signing in ──────────────────────────────────────────────────────────────────────────────\n [ManualControllerRouteKey.AUTH_IDENTIFY]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Identify a caller and list the authentication methods available to them',\n description:\n 'The first step of every sign-in. Post the identifier a person signs in with (their email address, typically) and the '\n + 'answer says which authentication methods that account can use — password, passkey, magic link, one-time code, an '\n + 'enterprise connection — so the caller can present the right one next. Deliberately does not say whether the account '\n + 'exists in terms an attacker can enumerate.',\n authentication: PUBLIC,\n authenticationSummary: NO_CREDENTIAL,\n successStatus: ok('The methods this caller may authenticate with, and what each of them needs next.'),\n },\n [ManualControllerRouteKey.AUTH_AUTHENTICATE_PASSWORD]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Authenticate with a password',\n description:\n 'Sign in with an identifier and a password. On success the response carries the access token every other operation in '\n + 'this reference accepts as `Authorization: Bearer <token>`, and the refresh token is set as an HTTP-only cookie scoped '\n + 'to the authentication routes. When the account requires a second factor the answer says so and names the factor '\n + 'instead of issuing a token; complete it at the matching MFA endpoint.',\n authentication: PUBLIC,\n authenticationSummary: NO_CREDENTIAL,\n successStatus: ok('An access token and the caller\\'s session, or the second factor still owed.'),\n },\n [ManualControllerRouteKey.AUTH_AUTHENTICATE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Authenticate with any method',\n description:\n 'The universal sign-in endpoint: name the method and supply its proof, and the answer is the same shape whichever method '\n + 'was used. Prefer this over the per-method endpoints when the client renders whatever **Identify a caller** offered, '\n + 'because one code path then serves every method the application enables.',\n authentication: PUBLIC,\n authenticationSummary: NO_CREDENTIAL,\n successStatus: ok('An access token and the caller\\'s session, or the next step still owed.'),\n },\n [ManualControllerRouteKey.AUTH_TOKEN_REFRESH]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Refresh an access token',\n description:\n 'Exchange the refresh token for a new access token. Deliberately NOT behind bearer authentication — the caller reaches '\n + 'this endpoint precisely because their access token has expired. Browsers send the refresh token automatically in its '\n + 'HTTP-only cookie, which is why the request needs no body from them.',\n authentication: PUBLIC,\n authenticationSummary:\n 'No bearer token. The refresh token itself is the credential, sent in its HTTP-only cookie or in the request.',\n successStatus: ok('A fresh access token, and a rotated refresh token in its cookie.'),\n },\n [ManualControllerRouteKey.AUTH_SESSION_STATE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET],\n summary: 'Read the state of an in-progress authentication session',\n description:\n 'Where a multi-step sign-in has got to: which factors are satisfied, which are still owed, and whether the session is '\n + 'still live. Addressed by the session identifier a previous step returned.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The session identifier is the thing being asked about.',\n successStatus: ok('The session\\'s current step and what it still requires.'),\n },\n [ManualControllerRouteKey.AUTH_LOGOUT]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Sign out of this session',\n description:\n 'Ends the caller\\'s current session and clears the refresh-token cookie. The cookie is cleared even when no refresh token '\n + 'was presented, because clearing is the user-visible act and a stale cookie must not survive it.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The session is ended and the refresh-token cookie is cleared.'),\n },\n [ManualControllerRouteKey.AUTH_LOGOUT_ALL]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Sign out everywhere',\n description:\n 'Invalidates every access and refresh token this user holds, on every device, by moving the user\\'s invalidation fence '\n + 'forward. Use it after a password change or a suspected compromise; unlike **Sign out of this session** it reaches '\n + 'sessions the caller is not currently using.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('Every session this user holds is now invalid.'),\n },\n [ManualControllerRouteKey.AUTH_REGISTER]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Register a new account',\n description:\n 'Creates an account from the sign-up details the application asks for. Whether the new account can sign in immediately, '\n + 'must verify its email address first, or must complete organization onboarding depends on how this application is '\n + 'configured; the answer says which of those applies.',\n authentication: PUBLIC,\n authenticationSummary: NO_CREDENTIAL,\n successStatus: ok('The account, and what it must do before it can sign in.'),\n },\n [ManualControllerRouteKey.AUTH_VERIFY_EMAIL]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Verify an email address',\n description:\n 'Consumes the single-use token from a verification email and marks the address verified, which is what activates an '\n + 'account that was waiting on it. The token is single-use: a second call with the same token fails.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The single-use token in the request is what authorizes it.',\n successStatus: ok('The address is verified and the account is active.'),\n },\n [ManualControllerRouteKey.AUTH_RESEND_VERIFICATION]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Resend the verification email',\n description:\n 'Sends the verification email again for an address that has not been verified. Answers the same way whether or not the '\n + 'address belongs to an account, so it cannot be used to discover who has one.',\n authentication: PUBLIC,\n authenticationSummary: NO_CREDENTIAL,\n successStatus: ok('The request was accepted; a message is sent if the address is awaiting verification.'),\n },\n [ManualControllerRouteKey.AUTH_PASSWORD_RESET_REQUEST]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Request a password reset',\n description:\n 'Starts a password reset by emailing a single-use link to the address supplied. Answers identically whether or not that '\n + 'address has an account, so it cannot be used to enumerate users.',\n authentication: PUBLIC,\n authenticationSummary: NO_CREDENTIAL,\n successStatus: ok('The request was accepted; a message is sent if the address has an account.'),\n },\n [ManualControllerRouteKey.AUTH_PASSWORD_RESET_COMPLETE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Complete a password reset',\n description:\n 'Sets the new password, presenting the single-use token from the reset email. The token is consumed, and existing '\n + 'sessions are invalidated so a stolen session cannot outlive the reset.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The single-use reset token is what authorizes the change.',\n successStatus: ok('The password is changed and previous sessions are invalidated.'),\n },\n [ManualControllerRouteKey.AUTH_COMPLETE_ORG_ONBOARDING]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Complete organization onboarding',\n description:\n 'For applications that defer organization creation past sign-up: creates the caller\\'s organization and finishes putting '\n + 'them into it. Only meaningful for an account the register step left in that state.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The organization exists and the caller belongs to it.'),\n },\n\n // ─── Invitations ─────────────────────────────────────────────────────────────────────────────\n [ManualControllerRouteKey.AUTH_INVITATION_INFO]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET],\n summary: 'Read what an invitation offers',\n description:\n 'Given an invitation token, returns the inviting organization and the authentication methods it allows, so the accept '\n + 'screen can offer the right choice. Read-only: it does NOT consume the token, so it is safe to call before the person '\n + 'has decided.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The invitation token is what identifies the invitation.',\n successStatus: ok('The inviting organization and the methods it accepts.'),\n },\n [ManualControllerRouteKey.AUTH_ACCEPT_INVITATION]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Accept an invitation with its token',\n description:\n 'Consumes an invitation token, joins the invited organization and signs the person in. For somebody arriving from the '\n + 'invitation email with no session. A signed-in user acting on their own pending invitations uses **Accept one of my '\n + 'invitations** instead, which needs no token.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The single-use invitation token is what authorizes the join.',\n successStatus: ok('Membership is created and the caller is signed in.'),\n },\n [ManualControllerRouteKey.AUTH_REJECT_INVITATION]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Reject an invitation with its token',\n description: 'Consumes an invitation token and declines it. No account is created and no session is issued.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The single-use invitation token is what authorizes the refusal.',\n successStatus: ok('The invitation is declined.'),\n },\n [ManualControllerRouteKey.AUTH_LIST_MY_INVITATIONS]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET],\n summary: 'List my pending invitations',\n description:\n 'Every pending invitation addressed to the signed-in caller\\'s own email address. Authorized by ownership of that '\n + 'address rather than by a token, so it works in-app without anybody opening an email.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The caller\\'s pending invitations.'),\n },\n [ManualControllerRouteKey.AUTH_ACCEPT_MY_INVITATION]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Accept one of my invitations',\n description:\n 'Joins an organization that invited the signed-in caller\\'s own email address. No invitation token and no new session: '\n + 'the caller keeps the session they already have.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('Membership is created; the caller\\'s existing session continues.'),\n },\n [ManualControllerRouteKey.AUTH_REJECT_MY_INVITATION]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Reject one of my invitations',\n description: 'Declines an invitation addressed to the signed-in caller\\'s own email address.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The invitation is declined.'),\n },\n\n // ─── Multi-factor authentication ─────────────────────────────────────────────────────────────\n [ManualControllerRouteKey.AUTH_MFA_EMAIL_OTP_SEND]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Send an email one-time code',\n description: 'Emails a one-time code for the authentication session that is waiting on an email second factor.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The in-progress authentication session identifies the caller.',\n successStatus: ok('A code has been sent.'),\n },\n [ManualControllerRouteKey.AUTH_MFA_EMAIL_OTP_VERIFY]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Verify an email one-time code',\n description:\n 'Presents the emailed code. When it is the last factor owed, the answer carries the access token and completes sign-in.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The code and the in-progress session are the proof.',\n successStatus: ok('The factor is satisfied; an access token when nothing else is owed.'),\n },\n [ManualControllerRouteKey.AUTH_MFA_TOTP_SETUP]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Begin TOTP enrolment',\n description:\n 'Starts enrolling an authenticator app: returns the shared secret and its provisioning URI to render as a QR code. '\n + 'Enrolment is not finished until **Confirm TOTP enrolment** proves the caller can produce a code from it.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The secret and provisioning URI to show the caller.'),\n },\n [ManualControllerRouteKey.AUTH_MFA_TOTP_VERIFY_SETUP]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Confirm TOTP enrolment',\n description:\n 'Completes enrolment by presenting a code generated from the secret just issued. Only after this does TOTP count as an '\n + 'available method — enrolling without confirming would lock the caller out of their own second factor.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('TOTP is enrolled and usable.'),\n },\n [ManualControllerRouteKey.AUTH_MFA_TOTP_VERIFY]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Verify a TOTP code',\n description:\n 'Presents a code from the enrolled authenticator app for an authentication session waiting on that factor. When it is '\n + 'the last factor owed, the answer carries the access token.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The code and the in-progress session are the proof.',\n successStatus: ok('The factor is satisfied; an access token when nothing else is owed.'),\n },\n [ManualControllerRouteKey.AUTH_MFA_TOTP_DISABLE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Disable TOTP',\n description:\n 'Removes the enrolled authenticator app. Removing a second factor is a sensitive operation, so it requires a fresh '\n + 're-authentication proof obtained from **Re-authenticate**.',\n authentication: BEARER,\n authenticationSummary: 'A bearer access token plus a fresh re-authentication token.',\n successStatus: ok('TOTP is no longer enrolled.'),\n },\n [ManualControllerRouteKey.AUTH_SMS_OTP_SEND]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Send an SMS one-time code',\n description:\n 'Texts a one-time code to the account\\'s verified phone number. Present the code at **Authenticate with any method**, '\n + 'naming the SMS method — this family has no separate verify endpoint.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The in-progress authentication session identifies the caller.',\n successStatus: ok('A code has been sent.'),\n },\n [ManualControllerRouteKey.AUTH_SMS_OTP_VERIFY]: {\n publication: ManualControllerRoutePublication.WITHHELD,\n withheldReason:\n 'Declared in the route registry and mounted by NO controller — measured 2026-09-09 by scanning every '\n + '`this.router.<verb>(…)` call in the engine, where this is the only registry key with no mount. Publishing it would '\n + 'document an address that answers 404. Verification of an SMS code goes through the universal authenticate endpoint.',\n },\n [ManualControllerRouteKey.AUTH_PHONE_VERIFY_SEND]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Send a phone-verification code',\n description:\n 'Texts a code to prove the caller controls a phone number they are adding. Distinct from the SMS second factor: this '\n + 'establishes the number, that one uses it.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('A code has been sent to the number.'),\n },\n [ManualControllerRouteKey.AUTH_PHONE_VERIFY_CONFIRM]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Confirm a phone-verification code',\n description: 'Presents the texted code and marks the phone number verified on the caller\\'s account.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The number is verified.'),\n },\n [ManualControllerRouteKey.AUTH_MAGIC_LINK_SEND]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Send a magic link',\n description:\n 'Emails a single-use sign-in link. Answers identically whether or not the address has an active account, so it cannot '\n + 'be used to discover who does.',\n authentication: PUBLIC,\n authenticationSummary: NO_CREDENTIAL,\n successStatus: ok('The request was accepted; a link is sent if the address has an active account.'),\n },\n [ManualControllerRouteKey.AUTH_MAGIC_LINK_VERIFY]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Verify a magic link',\n description: 'Consumes the token from a magic link and signs the caller in. Single-use: a replayed token fails.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The single-use link token is the proof.',\n successStatus: ok('An access token and the caller\\'s session.'),\n },\n\n // ─── Passkeys (WebAuthn) ─────────────────────────────────────────────────────────────────────\n [ManualControllerRouteKey.AUTH_PASSKEY_REGISTER_OPTIONS]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Begin passkey registration',\n description:\n 'Returns the WebAuthn creation options — challenge, relying party, excluded credentials — to hand to '\n + '`navigator.credentials.create()`. WebAuthn is challenge-response, which is why registering a passkey takes two calls.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('WebAuthn creation options for the browser.'),\n },\n [ManualControllerRouteKey.AUTH_PASSKEY_REGISTER_VERIFY]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Complete passkey registration',\n description: 'Presents the attestation the authenticator produced and stores the passkey against the caller\\'s account.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The passkey is registered.'),\n },\n [ManualControllerRouteKey.AUTH_PASSKEY_AUTH_OPTIONS]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Begin passkey authentication',\n description:\n 'Returns the WebAuthn request options — challenge and allowed credentials — to hand to '\n + '`navigator.credentials.get()` when signing in with a passkey.',\n authentication: PUBLIC,\n authenticationSummary: NO_CREDENTIAL,\n successStatus: ok('WebAuthn request options for the browser.'),\n },\n [ManualControllerRouteKey.AUTH_PASSKEY_AUTH_VERIFY]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Complete passkey authentication',\n description: 'Presents the assertion the authenticator produced; on success the answer carries the access token.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The WebAuthn assertion is the proof.',\n successStatus: ok('An access token and the caller\\'s session.'),\n },\n [ManualControllerRouteKey.AUTH_PASSKEY_LIST]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET],\n summary: 'List my passkeys',\n description: 'Every passkey registered on the caller\\'s account, with the name and last-used time to show in a manager UI.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The caller\\'s registered passkeys.'),\n },\n [ManualControllerRouteKey.AUTH_PASSKEY_REMOVE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Remove a passkey',\n description:\n 'Deletes one registered passkey. Removing an authentication method is sensitive, so it requires a fresh '\n + 're-authentication proof.',\n authentication: BEARER,\n authenticationSummary: 'A bearer access token plus a fresh re-authentication token.',\n successStatus: ok('The passkey is removed.'),\n },\n [ManualControllerRouteKey.AUTH_PASSKEY_RENAME]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Rename a passkey',\n description: 'Changes the label a passkey is shown under. Cosmetic: it does not affect what the passkey can do.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The passkey\\'s label is changed.'),\n },\n\n // ─── Managing my authentication methods ──────────────────────────────────────────────────────\n [ManualControllerRouteKey.AUTH_METHODS_MINE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET],\n summary: 'List my enrolled authentication methods',\n description:\n 'Which methods the signed-in caller has actually enrolled — password, TOTP, passkeys, linked identities — for a '\n + '\"security settings\" screen. Distinct from **Identify a caller**, which answers the same question before sign-in and '\n + 'says less on purpose.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The caller\\'s enrolled methods.'),\n },\n [ManualControllerRouteKey.AUTH_PASSWORD_CHANGE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Change my password',\n description:\n 'Replaces the caller\\'s password, presenting the current one. Refresh tokens are invalidated, so other sessions cannot '\n + 'outlive the change.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The password is changed and other sessions are invalidated.'),\n },\n [ManualControllerRouteKey.AUTH_PASSWORD_SET]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Set my first password',\n description:\n 'Adds a password to an account that has never had one — somebody who signed up through a vendor identity or a magic '\n + 'link. There is no current password to present, so a fresh re-authentication proof takes its place.',\n authentication: BEARER,\n authenticationSummary: 'A bearer access token plus a fresh re-authentication token.',\n successStatus: ok('A password is set on the account.'),\n },\n [ManualControllerRouteKey.AUTH_IDENTITY_LINKS_LIST]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET],\n summary: 'List my linked identities',\n description: 'The external identity providers linked to the caller\\'s account, and which one each sign-in came through.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The caller\\'s linked identities.'),\n },\n [ManualControllerRouteKey.AUTH_IDENTITY_LINKS_UNLINK]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.DELETE],\n summary: 'Unlink an identity',\n description:\n 'Removes one linked external identity. Refused when it is the caller\\'s only way in, so unlinking cannot lock somebody '\n + 'out of their own account.',\n authentication: BEARER,\n authenticationSummary: 'A bearer access token plus a fresh re-authentication token.',\n successStatus: ok('The identity is unlinked.'),\n },\n [ManualControllerRouteKey.AUTH_REAUTH]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Re-authenticate for a sensitive operation',\n description:\n 'Proves the person at the keyboard is still the account holder, and returns the single-use step-up token that sensitive '\n + 'operations require in their step-up header. This is the endpoint those operations point at.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('A single-use step-up token.'),\n },\n [ManualControllerRouteKey.AUTH_REAUTH_PASSKEY_OPTIONS]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Begin a passkey step-up',\n description:\n 'The challenge leg of re-authenticating with a passkey. WebAuthn is challenge-response, so a passkey step-up needs two '\n + 'round-trips: take these options to the authenticator, then present the assertion at **Re-authenticate**.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('WebAuthn request options for the step-up.'),\n },\n\n // ─── Signing in through somebody else's identity provider ────────────────────────────────────\n [ManualControllerRouteKey.AUTH_OAUTH2_AUTHORIZE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET],\n summary: 'Start a social sign-in',\n description:\n 'Returns the vendor authorization URL to send the browser to, for the named provider. The client navigates there; the '\n + 'vendor sends the person back to the callback below. Returns a URL rather than redirecting, so the client controls '\n + 'the navigation.',\n authentication: PUBLIC,\n authenticationSummary: NO_CREDENTIAL,\n successStatus: ok('The provider authorization URL to navigate to.'),\n },\n [ManualControllerRouteKey.AUTH_OAUTH2_CALLBACK]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET, HttpMethod.POST],\n summary: 'Social sign-in callback',\n description:\n 'Where the identity provider sends the browser back. **You do not call this** — it is the redirect URI you register '\n + 'with the vendor, published here so you can configure it. Accepts POST as well as GET because some vendors use '\n + '`response_mode=form_post`. It completes the sign-in and hands the client a one-time code to exchange for tokens.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The provider\\'s authorization code and the state parameter are the proof.',\n successStatus: ok('The caller is redirected onward with a one-time exchange code.'),\n },\n [ManualControllerRouteKey.AUTH_TOKEN_EXCHANGE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Exchange a one-time code for tokens',\n description:\n 'Turns the single-use code a redirect flow handed back into the access token and session. Single-use: the code is '\n + 'consumed, so it cannot be replayed if it leaks into a browser history or a referrer header.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The single-use code is the proof.',\n successStatus: ok('An access token and the caller\\'s session.'),\n },\n [ManualControllerRouteKey.AUTH_ENTERPRISE_SSO_AUTHORIZE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET],\n summary: 'Start an organization SSO sign-in',\n description:\n 'Begins sign-in through one organization\\'s own OpenID Connect connection, addressed by that organization and the '\n + 'connection it configured. Answers with the authorization URL to navigate to.',\n authentication: PUBLIC,\n authenticationSummary: NO_CREDENTIAL,\n successStatus: ok('The connection\\'s authorization URL to navigate to.'),\n },\n [ManualControllerRouteKey.AUTH_APP_ENTERPRISE_AUTHORIZE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET],\n summary: 'Start an application-wide SSO sign-in',\n description:\n 'The same as the organization flow, for a connection the APPLICATION owns rather than one tenant — the shape used when '\n + 'every user signs in through one corporate identity provider.',\n authentication: PUBLIC,\n authenticationSummary: NO_CREDENTIAL,\n successStatus: ok('The connection\\'s authorization URL to navigate to.'),\n },\n [ManualControllerRouteKey.AUTH_SAML_LOGIN]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET],\n summary: 'Start a SAML sign-in',\n description:\n 'Service-provider-initiated SAML: builds the authentication request for the named connection and sends the browser to '\n + 'that identity provider.',\n authentication: PUBLIC,\n authenticationSummary: NO_CREDENTIAL,\n successStatus: { code: '302', meaning: 'The browser is redirected to the identity provider.' },\n },\n [ManualControllerRouteKey.AUTH_SAML_ACS]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'SAML assertion consumer service',\n description:\n 'Where a SAML identity provider posts its assertion. **You do not call this** — it is the ACS URL you configure in the '\n + 'identity provider, published here so an administrator can find it. The assertion\\'s signature is validated before '\n + 'anything in it is believed.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The signed SAML assertion is the proof.',\n successStatus: { code: '302', meaning: 'The assertion is accepted and the browser continues into the application.' },\n },\n [ManualControllerRouteKey.AUTH_SAML_METADATA]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET],\n summary: 'SAML service-provider metadata',\n description:\n 'The SAML metadata document for one scope — entity id, ACS URL, certificates — to upload into an identity provider. '\n + 'Addressed by the scope kind and its identifier, because an application-wide connection and a per-organization one '\n + 'are different service providers.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. Service-provider metadata is public by design.',\n successStatus: ok('The SAML metadata XML document.'),\n },\n [ManualControllerRouteKey.AUTH_SAML_SLO]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET, HttpMethod.POST],\n summary: 'SAML single-logout endpoint',\n description:\n 'Where an identity provider sends logout requests and responses. **Inbound** — the identity provider calls it. Accepts '\n + 'GET for the redirect binding and POST for the POST binding. To START a logout from this application, use **End my '\n + 'SAML session** instead.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The signed SAML logout message is the proof.',\n successStatus: { code: '302', meaning: 'The session is ended and the browser continues.' },\n },\n [ManualControllerRouteKey.AUTH_SAML_SP_LOGOUT]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'End my SAML session',\n description:\n 'Service-provider-initiated single logout: ends the caller\\'s session here and, when the identity provider supports it, '\n + 'hands back where to redirect so the identity-provider session ends too. The outbound counterpart of the SLO endpoint '\n + 'above.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The session is ended, with the identity provider\\'s logout location when there is one.'),\n },\n\n [ManualControllerRouteKey.AUTH_OIDC_LOGOUT]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'End my enterprise OIDC session',\n description:\n 'Ends the caller\\'s session here and, when the connection is configured for it, hands back where to redirect so the '\n + 'identity-provider session ends too. Without this a person who signs out is still signed in at their provider, so the '\n + 'next sign-in is silent. The OIDC counterpart of **End my SAML session**.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The session is ended, with the identity provider\\'s logout location when the connection has one.'),\n },\n\n // ─── Sessions that cross a boundary ──────────────────────────────────────────────────────────\n [ManualControllerRouteKey.AUTH_CROSS_FRONTEND_HANDOFF]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Hand a session to another frontend',\n description:\n 'Issues a one-time code bound to a named frontend of this application, so a signed-in person can be moved to it without '\n + 'signing in again. The target exchanges the code at **Exchange a one-time code for tokens**.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('A one-time code bound to the target frontend.'),\n },\n [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_CREATE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Mint a one-off session token',\n description:\n 'Creates a single-purpose token that grants a named user a bounded session in an application — for a deep link into a '\n + 'specific screen, or a machine acting on somebody\\'s behalf for one task. The lifetime, the number of uses and the '\n + 'moment of consumption are all stated when it is minted.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: { code: '201', meaning: 'The one-off token and the terms it was minted under.' },\n },\n [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_CREATE_ORG]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Mint a one-off session token within an organization',\n description:\n 'The same as minting a one-off session token, addressed within one organization so the resulting session is scoped to '\n + 'that tenant.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: { code: '201', meaning: 'The one-off token and the terms it was minted under.' },\n },\n [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_EXCHANGE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Exchange a one-off session token',\n description: 'Turns a one-off session token into the session it was minted for. The token is consumed on the terms it carries.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The one-off token is the proof.',\n successStatus: ok('An access token and the bounded session.'),\n },\n [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_REVOKE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Revoke a one-off session token',\n description:\n 'Cancels a minted one-off token before it is used, addressed by its id — never by its value, so revoking never requires '\n + 'handling the secret again.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The token can no longer be exchanged.'),\n },\n [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_REVOKE_ORG]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Revoke a one-off session token within an organization',\n description: 'The same revocation, addressed within the organization the token was minted in.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The token can no longer be exchanged.'),\n },\n\n // ─── This application as an OAuth 2.0 / OpenID Connect provider ──────────────────────────────\n [ManualControllerRouteKey.OAUTH_PROVIDER_DISCOVERY]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: IDP,\n methods: [HttpMethod.GET],\n summary: 'OpenID Connect discovery document',\n description:\n 'The provider metadata an OpenID Connect client reads first: the issuer, every endpoint below, the signing keys\\' '\n + 'location and the grants supported. OIDC Discovery locates it by appending the well-known path to the issuer, which '\n + 'is why it sits under the API mount. The same document is served at the RFC 8414 location as well, because that '\n + 'specification builds the address the other way round.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. Provider metadata is public and cross-origin readable by design.',\n successStatus: ok('The provider metadata document.'),\n },\n [ManualControllerRouteKey.OAUTH_PROVIDER_AS_METADATA]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: IDP,\n methods: [HttpMethod.GET],\n summary: 'OAuth 2.0 authorization-server metadata',\n description:\n 'The SAME document as the OpenID Connect discovery document, at the address RFC 8414 clients derive — many OAuth and '\n + 'MCP clients probe this one first. It is a second location, not a second contract. Note that the framework also '\n + 'serves it above the API mount, with the well-known segment inserted between the host and the issuer path, which is '\n + 'the construction the RFC actually specifies.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. Provider metadata is public and cross-origin readable by design.',\n successStatus: ok('The provider metadata document.'),\n },\n [ManualControllerRouteKey.OAUTH_PROVIDER_JWKS]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: IDP,\n methods: [HttpMethod.GET],\n summary: 'JSON Web Key Set',\n description:\n 'The public keys that verify tokens this application issues — the `jwks_uri` the discovery document points at. Fetch it '\n + 'rather than pinning a key: keys rotate, and a client that caches the set and re-fetches on an unknown key id keeps '\n + 'working across a rotation.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. Public keys are public.',\n successStatus: ok('The key set.'),\n },\n [ManualControllerRouteKey.OAUTH_PROVIDER_AUTHORIZE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: IDP,\n methods: [HttpMethod.GET],\n summary: 'Authorization endpoint',\n description:\n 'Where a client sends a person to approve delegated access, for the authorization-code flow. When the client is one '\n + 'that requires explicit consent and none has been given, the answer says consent is required rather than issuing a '\n + 'code; the decision is then posted to the consent endpoint.',\n authentication: PUBLIC,\n authenticationSummary: 'No client credential. The person\\'s own session establishes who is consenting.',\n successStatus: { code: '302', meaning: 'The browser is redirected back to the client with an authorization code.' },\n },\n [ManualControllerRouteKey.OAUTH_PROVIDER_CONSENT]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: IDP,\n methods: [HttpMethod.POST],\n summary: 'Record a consent decision',\n description:\n 'The approve-or-deny answer to a consent prompt the authorization endpoint raised, presenting the single-use '\n + 'consent-request token it issued. Approving is what mints the authorization code.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The single-use consent-request token authorizes the decision.',\n successStatus: ok('The decision is recorded, with the authorization code when it was an approval.'),\n },\n [ManualControllerRouteKey.OAUTH_PROVIDER_TOKEN]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: IDP,\n methods: [HttpMethod.POST],\n summary: 'Token endpoint',\n description:\n 'Where a client obtains an access token: `client_credentials` for software acting as itself, `authorization_code` for '\n + 'software acting on a person\\'s behalf. Request the audience you intend to call — a token minted for the general API '\n + 'is not accepted at the Model Context Protocol surface, and the reverse.',\n authentication: PUBLIC,\n authenticationSummary: 'No bearer token. The client authenticates with its own client credentials.',\n successStatus: ok('An access token, its lifetime and its audience.'),\n },\n [ManualControllerRouteKey.OAUTH_PROVIDER_USERINFO]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: IDP,\n methods: [HttpMethod.GET],\n summary: 'UserInfo endpoint',\n description: 'The standard OpenID Connect claims for the person a delegated access token was issued on behalf of.',\n authentication: BEARER,\n authenticationSummary: 'A bearer access token issued by this provider.',\n successStatus: ok('The subject\\'s claims.'),\n },\n [ManualControllerRouteKey.OAUTH_PROVIDER_REVOKE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: IDP,\n methods: [HttpMethod.POST],\n summary: 'Revoke a token',\n description:\n 'RFC 7009 revocation: the presented token stops working. Kills a TOKEN — to end the login SESSION a delegation was '\n + 'authorized from, use the end-session endpoint instead.',\n authentication: PUBLIC,\n authenticationSummary: 'No bearer token. The client authenticates with its own client credentials.',\n successStatus: ok('The token is revoked. Answers the same way for a token that was already invalid.'),\n },\n [ManualControllerRouteKey.OAUTH_PROVIDER_END_SESSION]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: IDP,\n methods: [HttpMethod.GET],\n summary: 'End-session endpoint',\n description:\n 'OpenID Connect RP-Initiated Logout: a relying party sends the person here, with an id-token hint, to end the provider '\n + 'session their delegation was authorized from. A trusted relying party is logged out and redirected inline; anybody '\n + 'else is shown a confirmation prompt, whose answer goes to the confirmation endpoint.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The id-token hint names the session to end.',\n successStatus: { code: '302', meaning: 'The session is ended, or the browser is sent to the confirmation prompt.' },\n },\n [ManualControllerRouteKey.OAUTH_PROVIDER_END_SESSION_CONFIRM]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: IDP,\n methods: [HttpMethod.POST],\n summary: 'Confirm an end-session request',\n description:\n 'The person\\'s answer to the logout confirmation prompt, presenting the single-use token the end-session endpoint '\n + 'minted. Deliberately not bearer-authenticated: somebody arriving from a relying party\\'s redirect may have no '\n + 'session in this application\\'s own frontend.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The single-use confirmation token authorizes the decision.',\n successStatus: ok('Where to send the browser once the session is ended.'),\n },\n [ManualControllerRouteKey.OAUTH_PROVIDER_REGISTER]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: IDP,\n methods: [HttpMethod.POST],\n summary: 'Register a client dynamically',\n description:\n 'RFC 7591 dynamic client registration: software registers itself and receives its client credentials plus a registration '\n + 'access token for managing that registration afterwards. The route always exists; it answers `404` unless this '\n + 'application has opted into dynamic registration, so a client can probe it safely.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential, when the application allows dynamic registration.',\n successStatus: { code: '201', meaning: 'The registration, its client credentials and its registration access token.' },\n },\n [ManualControllerRouteKey.OAUTH_PROVIDER_REGISTER_CLIENT]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: IDP,\n methods: [HttpMethod.GET, HttpMethod.PUT, HttpMethod.DELETE],\n summary: 'Manage a dynamically registered client',\n description:\n 'RFC 7592 client configuration: a dynamically registered client reads, replaces or deletes its OWN registration. One '\n + 'address, three methods, because the specification defines one endpoint whose method selects the operation. Answers '\n + '`404` unless this application has opted into dynamic registration.',\n authentication: BEARER,\n authenticationSummary: 'The registration access token issued when the client registered — not a user access token.',\n successStatus: ok('The registration, after the requested read, replacement or deletion.'),\n },\n\n // ─── Connecting a third-party account ────────────────────────────────────────────────────────\n [ManualControllerRouteKey.PROVIDER_CONNECTION_START]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: CONNECTIONS,\n methods: [HttpMethod.POST],\n summary: 'Start connecting a third-party account',\n description:\n 'Begins an outbound connection to the named provider so this application can later act as the connected account. The '\n + 'opposite direction from social sign-in, which uses a vendor to identify a person. An application that declares no '\n + 'connectable provider answers with a \"not connectable\" error rather than a missing route, which names why.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The provider authorization URL to navigate to.'),\n },\n [ManualControllerRouteKey.PROVIDER_CONNECTION_CALLBACK]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: CONNECTIONS,\n methods: [HttpMethod.GET],\n summary: 'Third-party connection callback',\n description:\n 'Where a provider returns after the person authorizes the connection. **You do not call '\n + 'this** — it is the redirect URI to register with the vendor. ONE address serves every provider, keyed by the state '\n + 'parameter, because a redirect URI must be registered before it is accepted and a path per provider would mean '\n + 'registering one per vendor, per environment, by hand. It authenticates nobody and exchanges nothing: a redirect '\n + 'carries no bearer token, so it hands the approval back to the application, which finishes it as the signed-in person.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The single-use state parameter identifies the attempt and defends against CSRF.',\n successStatus: { code: '302', meaning: 'The browser continues into the application, carrying the approval for it to finish.' },\n },\n [ManualControllerRouteKey.PROVIDER_CONNECTION_COMPLETE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: CONNECTIONS,\n methods: [HttpMethod.POST],\n summary: 'Finish a connection the provider has approved',\n description:\n 'Exchanges an approval the vendor just granted for a stored grant. The application calls this on the person\\u2019s behalf '\n + 'when they return from the vendor; the callback cannot, because a redirect carries no credential and so cannot tell '\n + 'who is finishing the flow. The attempt is consumed here, once and atomically, and is only completed for the same '\n + 'person who began it \\u2014 so an approval somebody else obtained cannot be redeemed against their target.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The connection outcome, and the provider it was stored for.'),\n },\n [ManualControllerRouteKey.PROVIDER_CONNECTION_STORE_CREDENTIAL]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: CONNECTIONS,\n methods: [HttpMethod.POST],\n summary: 'Store a typed credential for a provider',\n description:\n 'For a vendor whose credential is TYPED rather than granted. Takes one value per slot the provider declares as '\n + 'identifying an account, and refuses any name the provider did not declare — so a caller cannot invent a slot, '\n + 'and cannot write an account token into the slot holding the application\\u2019s own registration. Values are '\n + 'sealed by the write door; the request is the only place they exist in plaintext.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The stored credential ids, one per slot supplied.'),\n },\n [ManualControllerRouteKey.PROVIDER_CONNECTION_CATALOGUE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: CONNECTIONS,\n methods: [HttpMethod.GET],\n summary: 'What can be connected',\n description:\n 'Lists the providers this application declares as connectable, with the owner scopes each one admits and whether it '\n + 'carries an authorization flow. Answers the question the stored-credential list cannot: a person with nothing '\n + 'connected has an empty list and no way to learn what they might connect. Admissibility is a recorded decision per '\n + 'provider, so this reports a decision rather than inspecting a vendor.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The connectable providers, each with its admissible owner scopes.'),\n },\n\n [ManualControllerRouteKey.PROVIDER_CONNECTION_ACCESS_TOKEN]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: CONNECTIONS,\n methods: [HttpMethod.GET],\n summary: 'A short-lived access token for your own connected account',\n description:\n 'Resolves the caller\\u2019s OWN grant for a provider and returns its access token, renewed if the vendor\\u2019s expiry '\n + 'has passed \\u2014 the one credential a browser may be handed, because a vendor\\u2019s own picker authorizes as the '\n + 'signed-in user and cannot open without it. Never the refresh token; never another owner\\u2019s account. Each '\n + 'hand-out is recorded as a USE of the credential, so revoking or erasing the connection is visible against '\n + 'every token that left the process. Answers 404 when nothing is connected, so a surface can offer the connection '\n + 'rather than open a picker on nobody\\u2019s files.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The access token, with its expiry and granted scopes when the vendor stated them.'),\n },\n\n // ─── Agent interfaces ────────────────────────────────────────────────────────────────────────\n [ManualControllerRouteKey.MCP_ENDPOINT]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AGENTS,\n methods: [HttpMethod.POST, HttpMethod.GET, HttpMethod.DELETE],\n summary: 'Model Context Protocol endpoint',\n description:\n 'The JSON-RPC 2.0 endpoint an MCP client talks to over the Streamable HTTP transport: `initialize`, `tools/list` and '\n + '`tools/call`. Only POST does work. GET and DELETE answer `405` with `Allow: POST` on purpose — this server offers no '\n + 'server-initiated stream and has no protocol-level sessions to end, and a bare `404` would make an older client '\n + 'conclude there is no MCP endpoint here and fall back to a retired transport. A call must present an access token '\n + 'bound to this surface\\'s own audience; a token minted for the general API is refused. Named server instances are '\n + 'served under this path with the instance reference appended, each with its own audience and its own tool catalogue.',\n authentication: BEARER,\n authenticationSummary: 'A bearer access token whose audience is this Model Context Protocol surface.',\n successStatus: ok('The JSON-RPC response for the method that was called.'),\n },\n [ManualControllerRouteKey.MCP_PROTECTED_RESOURCE_METADATA]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AGENTS,\n methods: [HttpMethod.GET],\n summary: 'Model Context Protocol protected-resource metadata',\n description:\n 'RFC 9728 metadata: the resource identifier this surface expects a token to be bound to, and the authorization servers '\n + 'that can issue one. An MCP client that receives `401` reads the location from the challenge header and fetches this '\n + 'to learn where to get a token. Each named server instance publishes its own copy under its own path, so every '\n + 'instance advertises its own audience.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. Discovery metadata is public and cross-origin readable by design.',\n successStatus: ok('The protected-resource metadata document.'),\n },\n [ManualControllerRouteKey.A2A_AGENT_CARD]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AGENTS,\n methods: [HttpMethod.GET],\n summary: 'Agent card',\n description:\n 'The Agent2Agent card describing what this application exposes as agent skills, the task endpoint\\'s address and the '\n + 'security schemes a caller must satisfy. Public metadata, like a discovery document: fetch it before addressing the '\n + 'agent.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The agent card is public and cross-origin readable by design.',\n successStatus: ok('The agent card.'),\n },\n [ManualControllerRouteKey.A2A_TASKS]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AGENTS,\n methods: [HttpMethod.POST],\n summary: 'Agent2Agent task endpoint',\n description:\n 'The JSON-RPC endpoint that accepts agent messages and tasks, streaming over server-sent events when the caller asks '\n + 'for it. Its absolute URL is the card\\'s advertised address AND the agent\\'s canonical audience: an inbound access '\n + 'token must be bound to it. Named agent instances are served under this path with the instance reference appended.',\n authentication: BEARER,\n authenticationSummary: 'A bearer access token whose audience is this agent endpoint.',\n successStatus: ok('The JSON-RPC response, or an event stream when streaming was requested.'),\n },\n\n // ─── File transfer ───────────────────────────────────────────────────────────────────────────\n [ManualControllerRouteKey.FILES_ITEM]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: FILES,\n methods: [HttpMethod.GET, HttpMethod.DELETE],\n summary: 'Download or delete a stored file',\n description:\n 'GET streams the file\\'s bytes; DELETE removes it. One address, two methods. A file is downloadable only in a status '\n + 'that permits it — one still being scanned, or quarantined, is refused rather than served. Distinct from a resource\\'s '\n + 'own file routes, which address the file bound to one field of one record.',\n authentication: BEARER,\n authenticationSummary: 'A bearer access token, or the consumable token a share link carries.',\n successStatus: ok('The file\\'s bytes, or confirmation that it was deleted.'),\n },\n [ManualControllerRouteKey.FILES_METADATA]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: FILES,\n methods: [HttpMethod.GET],\n summary: 'Read a stored file\\'s metadata',\n description:\n 'Name, size, content type and status, without transferring the bytes. Metadata is withheld for statuses where saying '\n + 'anything about the file would be wrong.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The file\\'s metadata record.'),\n },\n [ManualControllerRouteKey.FILES_SHARE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: FILES,\n methods: [HttpMethod.POST],\n summary: 'Create a share link for a stored file',\n description:\n 'Mints a time-limited link that lets somebody without an account download this one file. The link carries a consumable '\n + 'token whose lifetime is stated when it is minted.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: { code: '201', meaning: 'The share link and when it expires.' },\n },\n [ManualControllerRouteKey.FILES_UPLOAD_GRANT_STATUS]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: FILES,\n methods: [HttpMethod.GET],\n summary: 'Read the status of an upload grant',\n description:\n 'Where an upload grant has got to, addressed by the grant token itself. Public because the token IS the credential: the '\n + 'page somebody drops a file onto has no session of its own.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The grant token in the address is what authorizes the read.',\n successStatus: ok('The grant\\'s state and what it still allows.'),\n },\n [ManualControllerRouteKey.FILES_UPLOAD_GRANT_REVOKE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: FILES,\n methods: [HttpMethod.DELETE],\n summary: 'Revoke an upload grant',\n description:\n 'Cancels an upload grant before it is used. Addressed by the grant\\'s id, never by its token value, so revoking never '\n + 'requires handling the secret. Only the grant\\'s minter, or a super-administrator, may revoke it.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The grant can no longer be used.'),\n },\n\n // ─── What this application currently offers ──────────────────────────────────────────────────\n [ManualControllerRouteKey.I18N_GET_LABELS]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.GET],\n summary: 'Read translated labels',\n description:\n 'The label bundle for a locale — every piece of display text this application has authored. A client renders from this '\n + 'rather than inventing text from field names; a label that is missing is meant to look missing.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. Labels are needed before anybody has signed in.',\n successStatus: ok('The label bundle for the requested locale.'),\n },\n [ManualControllerRouteKey.FEATURES_RESOLVED]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.GET],\n summary: 'Read the caller\\'s resolved features',\n description:\n 'Which features are actually on for this caller, after the application\\'s declarations, their organization\\'s plan and '\n + 'any per-caller overrides have all been applied. This is the resolved answer — do not re-derive it client-side from '\n + 'the plan.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The caller\\'s resolved feature set.'),\n },\n [ManualControllerRouteKey.CHARTS_DATA]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.POST],\n summary: 'Run a declared chart and read its data',\n description:\n 'Executes one chart the application has declared, addressed by its reference, and returns the series it produced. POST '\n + 'because the filters, ranges and groupings a chart accepts are a body, not a query string. Only declared charts can '\n + 'be run: this is not a general query endpoint.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The chart\\'s data series.'),\n },\n [ManualControllerRouteKey.FLOWS_ACTORS_FRONTEND_INFO]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.GET],\n summary: 'Read the flow and actor systems a client may render',\n description:\n 'The metadata and renderable graph for every flow or actor system this application exposes to its frontends — what '\n + 'exists, what it is called, and how it is shaped.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The visible flow and actor systems.'),\n },\n [ManualControllerRouteKey.FLOWS_ACTORS_HISTORY]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.GET, HttpMethod.DELETE],\n summary: 'Read or clear my conversation history',\n description:\n 'GET returns the caller\\'s OWN conversation history with a flow or actor system; DELETE clears a conversation. Scoped to '\n + 'the caller: it is never a window onto somebody else\\'s conversation.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The caller\\'s conversation, or confirmation that it was cleared.'),\n },\n [ManualControllerRouteKey.ANALYTICS_EVENTS]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.POST],\n summary: 'Record product-analytics events',\n description:\n 'Ingests a batch of product-analytics events. Mounted only when this application enables product analytics; where it '\n + 'does not, the address does not exist.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The batch was accepted.'),\n },\n [ManualControllerRouteKey.ANALYTICS_MOMENTS_ACHIEVED]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.GET, HttpMethod.POST],\n summary: 'Read or record achieved product moments',\n description:\n 'GET lists the declared moments this caller has reached; POST records that they have reached one. Mounted only when '\n + 'this application enables product analytics.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The caller\\'s achieved moments, or confirmation that one was recorded.'),\n },\n [ManualControllerRouteKey.PROGRESSION_MILESTONES]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.GET],\n summary: 'Read the declared progression milestones',\n description:\n 'The milestone definitions this application has declared, for a client rendering onboarding or progress. Mounted only '\n + 'when this application enables product analytics.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The declared milestones.'),\n },\n};\n"]}

package/dist/esm/requests/manual-controllers-routes-urls.d.ts CHANGED Viewed

@@ -90,6 +90,82 @@ export declare enum ManualControllerRouteKey {
     AUTH_TOKEN_REFRESH = "AUTH_TOKEN_REFRESH",
     AUTH_OAUTH2_AUTHORIZE = "AUTH_OAUTH2_AUTHORIZE",
     AUTH_OAUTH2_CALLBACK = "AUTH_OAUTH2_CALLBACK",
+    /**
+     * OUTBOUND connections — this application acting as somebody toward a third party.
+     *
+     * Easy to confuse with {@link AUTH_OAUTH2_AUTHORIZE} above and the exact opposite direction: that
+     * pair signs a person INTO this application using a vendor as the identity provider, this pair
+     * connects a vendor account so this application can act as that account. Same protocol, opposite
+     * arrow, and nothing is shared between them but the RFC.
+     */
+    PROVIDER_CONNECTION_START = "PROVIDER_CONNECTION_START",
+    /**
+     * The single redirect URI for EVERY provider, keyed by `state` rather than by a path segment.
+     *
+     * One URI, deliberately. A redirect URI must be registered at the vendor before it is accepted, so
+     * a per-provider path would mean registering 129 distinct URIs — by hand, per deployment, per
+     * environment. The `state` already has to be unguessable and single-use for CSRF, and it already
+     * identifies the attempt, so it identifies the provider too at no extra cost.
+     */
+    PROVIDER_CONNECTION_CALLBACK = "PROVIDER_CONNECTION_CALLBACK",
+    /**
+     * What this caller may connect, and under which owner scopes.
+     *
+     * Without it a settings screen cannot offer Connect at all: the credential LIST answers what a
+     * person HAS connected, and nothing answers what they COULD. The two are different questions and
+     * the empty answer to the first — the state everybody starts in — is exactly when the second one
+     * matters.
+     *
+     * Admissibility is a RECORDED DECISION per provider, never derived from a vendor's API surface, so
+     * this route reports a decision rather than computing one.
+     */
+    /**
+     * Finish an authorization the vendor has just approved — the half the CALLBACK cannot do.
+     *
+     * The callback is reached by a top-level navigation from the vendor's origin, so it carries no
+     * `Authorization` header and never can: a header is set by script on a fetch, and a redirect is
+     * not a fetch. The application's only auth cookie is `SameSite=Strict` on `Path=/api/v1/auth`, so
+     * it is not sent there either. The callback therefore cannot know WHO is finishing the flow, and
+     * for a while it asked anyway — every consent answered `401 UNAUTHENTICATED` and the person saw a
+     * JSON body, with the attempt already consumed so they could not even retry.
+     *
+     * Splitting it puts the authenticated act back on a FETCH, where a bearer token exists. The
+     * callback hands `state` and `code` to the frontend and authenticates nobody; the frontend, which
+     * holds the token, posts them here. Nothing about the guarantee is relaxed — this route consumes
+     * the attempt atomically, re-checks that the finisher is the initiator, and only then exchanges.
+     *
+     * Rejected: binding the attempt to a browser with a second `SameSite=Lax` cookie. It is the
+     * ordinary OAuth-client pattern and it would work, but this application authenticates its API with
+     * bearer tokens and nothing else, and a second auth-bearing cookie is an architectural addition
+     * whose `SameSite` behaviour then has to be reasoned about separately for every deployment shape.
+     */
+    PROVIDER_CONNECTION_COMPLETE = "PROVIDER_CONNECTION_COMPLETE",
+    PROVIDER_CONNECTION_CATALOGUE = "PROVIDER_CONNECTION_CATALOGUE",
+    /**
+     * Store a credential somebody TYPED, for a vendor with no authorization flow.
+     *
+     * The sibling of {@link PROVIDER_CONNECTION_START}, and a separate route because the acts differ
+     * completely: one hands back a URL and ends in a redirect from a vendor, this one takes values and
+     * ends in a stored row. Sharing a route would mean a body whose meaning depends on a provider's
+     * contract, which is how a caller ends up sending an access token where a client id belongs.
+     *
+     * It exists on the BACKEND rather than being a generic resource create because this is where
+     * "nothing is typed by hand" stops being a screen's good manners and becomes enforceable: the route
+     * refuses any slug the provider did not declare as identifying an account.
+     */
+    PROVIDER_CONNECTION_STORE_CREDENTIAL = "PROVIDER_CONNECTION_STORE_CREDENTIAL",
+    /**
+     * A short-lived access token for the CALLER's own connected account, handed to the browser (#394 P4).
+     *
+     * The one shape of credential a browser may ever be handed, and the reason it is a route of its
+     * own: a vendor's picker (Drive's, for one) authorizes as the signed-in user and cannot render
+     * without that user's token — so the token is in the browser during picking whether the selected
+     * bytes are later fetched by the backend or not. Everything else about the grant stays server-side:
+     * the refresh token never crosses, the row is resolved as the caller and nobody else, and every
+     * hand-out is a recorded USE of the credential, which is what makes revocation and erasure mean
+     * something for a token that has left the process.
+     */
+    PROVIDER_CONNECTION_ACCESS_TOKEN = "PROVIDER_CONNECTION_ACCESS_TOKEN",
     /** Enterprise SSO: initiate OAuth2 flow for an org's OIDC connection (Step 15) */
     AUTH_ENTERPRISE_SSO_AUTHORIZE = "AUTH_ENTERPRISE_SSO_AUTHORIZE",
     AUTH_APP_ENTERPRISE_AUTHORIZE = "AUTH_APP_ENTERPRISE_AUTHORIZE",
@@ -146,6 +222,20 @@ export declare enum ManualControllerRouteKey {
      * to reason about than one handler that refuses.
      */
     OAUTH_PROVIDER_REGISTER = "OAUTH_PROVIDER_REGISTER",
+    /**
+     * RFC 7592 client configuration endpoint — a dynamically registered client reads, updates or
+     * deletes its OWN registration, authenticating with the registration access token it was issued
+     * at registration.
+     *
+     * One key for three verbs (GET / PUT / DELETE) because RFC 7592 §2 defines ONE endpoint whose
+     * method selects the operation; splitting it into three keys would invent a distinction the
+     * specification does not make and put the same URL in the table three times.
+     *
+     * Registered unconditionally, like `/oauth/register`, and gated by the same
+     * `auth.dynamicClientRegistration` opt-in in the handler — a route table that depends on config is
+     * harder to reason about than a handler that refuses.
+     */
+    OAUTH_PROVIDER_REGISTER_CLIENT = "OAUTH_PROVIDER_REGISTER_CLIENT",
     /**
      * Cross-frontend session handoff (cross-app-jwt-propagation Step 2).
      * Authenticated user requests a one-time AUTH_CODE_EXCHANGE token bound to a
@@ -208,6 +298,30 @@ export declare enum ManualControllerRouteKey {
     AUTH_SAML_SLO = "AUTH_SAML_SLO",
     /** SP-INITIATED SLO kickoff: the app asks the backend to log the caller out of their SAML session and (when the IdP supports it) redirect to the IdP's SLO endpoint. Distinct from AUTH_SAML_SLO, which is the INBOUND endpoint the IdP calls. */
     AUTH_SAML_SP_LOGOUT = "AUTH_SAML_SP_LOGOUT",
+    AUTH_OIDC_LOGOUT = "AUTH_OIDC_LOGOUT",
+    /**
+     * Direct file transfer, distinct from the resource registry's own file routes.
+     *
+     * A resource's `/…/{id}/files/{field}` routes upload and replace the file BOUND TO A FIELD; these
+     * five address a stored file by its own id, wherever it is attached. They lived as literal path
+     * strings inside the file controller until 2026-09-09, which is exactly the duplication this
+     * registry exists to remove — and it also kept them out of every mechanism keyed on this
+     * vocabulary, the generated API reference included.
+     */
+    /** Public, token-authenticated status read for an upload grant. The token IS the credential. */
+    FILES_UPLOAD_GRANT_STATUS = "FILES_UPLOAD_GRANT_STATUS",
+    /** Revoke an upload grant, addressed by its id — never by the token value. */
+    FILES_UPLOAD_GRANT_REVOKE = "FILES_UPLOAD_GRANT_REVOKE",
+    /**
+     * One stored file addressed by id. ONE key for two verbs (GET downloads it, DELETE removes it)
+     * because Express matches one path and the method selects the operation — the same reasoning as
+     * {@link OAUTH_PROVIDER_REGISTER_CLIENT}. Splitting it would put one URL in the table twice.
+     */
+    FILES_ITEM = "FILES_ITEM",
+    /** The stored file's metadata record, without transferring its bytes. */
+    FILES_METADATA = "FILES_METADATA",
+    /** Mint a time-limited share link for a stored file. */
+    FILES_SHARE = "FILES_SHARE",
     I18N_GET_LABELS = "I18N_GET_LABELS",
     CHARTS_DATA = "CHARTS_DATA",
     ANALYTICS_EVENTS = "ANALYTICS_EVENTS",

package/dist/esm/requests/manual-controllers-routes-urls.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"manual-controllers-routes-urls.d.ts","sourceRoot":"","sources":["~~../../../../~~src/requests/manual-controllers-routes-urls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,kBAAkB,YAAY,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,sCAAsC,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,oCAAoC,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEjF;AAeD,oBAAY,wBAAwB;IAClC,sBAAsB,2BAA2B;IAEjD,aAAa,kBAAkB;IAC/B,0BAA0B,+BAA+B;IACzD,iBAAiB,sBAAsB;IACvC,kBAAkB,uBAAuB;IACzC,qBAAqB,0BAA0B;IAC/C,oBAAoB,yBAAyB;~~IAC7C~~,kFAAkF;IAClF,6BAA6B,kCAAkC;IAC/D,6BAA6B,kCAAkC;IAC/D,mBAAmB,wBAAwB;IAC3C;;;;OAIG;IACH,oBAAoB,yBAAyB;IAC7C,wFAAwF;IACxF,wBAAwB,6BAA6B;IACrD;;;;OAIG;IACH,0BAA0B,+BAA+B;IACzD,2FAA2F;IAC3F,mBAAmB,wBAAwB;IAC3C,gGAAgG;IAChG,wBAAwB,6BAA6B;IACrD;;;;OAIG;IACH,sBAAsB,2BAA2B;IACjD,iFAAiF;IACjF,uBAAuB,4BAA4B;IACnD,sDAAsD;IACtD,qBAAqB,0BAA0B;IAC/C;;;;;OAKG;IACH,0BAA0B,+BAA+B;IACzD;;;;;;;;OAQG;IACH,kCAAkC,uCAAuC;IACzE;;;;;OAKG;IACH,uBAAuB,4BAA4B;IACnD;;;;;;OAMG;IACH,2BAA2B,gCAAgC;IAC3D,WAAW,gBAAgB;IAC3B,2HAA2H;IAC3H,eAAe,oBAAoB;IACnC,2BAA2B,gCAAgC;IAC3D,4BAA4B,iCAAiC;IAC7D,aAAa,kBAAkB;IAC/B,sBAAsB,2BAA2B;IAIjD,oBAAoB,yBAAyB;IAC7C,sBAAsB,2BAA2B;IAGjD,wBAAwB,6BAA6B;IACrD,yBAAyB,8BAA8B;IACvD,yBAAyB,8BAA8B;IACvD,iBAAiB,sBAAsB;IACvC,kBAAkB,uBAAuB;IAGzC,uBAAuB,4BAA4B;IACnD,yBAAyB,8BAA8B;IAGvD,mBAAmB,wBAAwB;IAC3C,0BAA0B,+BAA+B;IACzD,oBAAoB,yBAAyB;IAG7C,6BAA6B,kCAAkC;IAC/D,4BAA4B,iCAAiC;IAC7D,yBAAyB,8BAA8B;IACvD,wBAAwB,6BAA6B;IACrD,iBAAiB,sBAAsB;IACvC,mBAAmB,wBAAwB;IAC3C,mBAAmB,wBAAwB;IAG3C,oBAAoB,yBAAyB;IAC7C,sBAAsB,2BAA2B;IAGjD,iBAAiB,sBAAsB;IACvC,mBAAmB,wBAAwB;IAG3C,sBAAsB,2BAA2B;IACjD,yBAAyB,8BAA8B;IAGvD,wBAAwB,6BAA6B;IAGrD,4BAA4B,iCAAiC;IAG7D,2BAA2B,gCAAgC;IAC3D,+BAA+B,oCAAoC;IACnE,6BAA6B,kCAAkC;IAC/D,2BAA2B,gCAAgC;IAC3D,+BAA+B,oCAAoC;IAGnE,oBAAoB,yBAAyB;IAC7C,iBAAiB,sBAAsB;IACvC,qBAAqB,0BAA0B;IAC/C,iBAAiB,sBAAsB;IACvC,wBAAwB,6BAA6B;IACrD,0BAA0B,+BAA+B;IACzD,WAAW,gBAAgB;IAC3B,4GAA4G;IAC5G,2BAA2B,gCAAgC;IAG3D,eAAe,oBAAoB;IACnC,aAAa,kBAAkB;IAC/B,kBAAkB,uBAAuB;IACzC,aAAa,kBAAkB;IAC/B,kPAAkP;IAClP,mBAAmB,wBAAwB;~~IAE3C~~,eAAe,oBAAoB;IAEnC,WAAW,gBAAgB;IAE3B,gBAAgB,qBAAqB;IACrC,0BAA0B,+BAA+B;IAEzD,sBAAsB,2BAA2B;IACjD,iBAAiB,sBAAsB;IAEvC,yEAAyE;IACzE,0BAA0B,+BAA+B;IACzD,qEAAqE;IACrE,oBAAoB,yBAAyB;IAG7C;;;;;OAKG;IACH,cAAc,mBAAmB;IACjC;;;;OAIG;IACH,SAAS,cAAc;IAGvB;;;;;;;;;OASG;IACH,YAAY,iBAAiB;IAC7B;;;;;;;;;OASG;IACH,+BAA+B,oCAAoC;CACpE;AAED,eAAO,MAAM,6BAA6B,EAAE,MAAM,CAAC,wBAAwB,EAAE,MAAM,~~CAoIlF~~,CAAC;AAOF,oBAAY,kBAAkB;IAC5B,eAAe,oBAAoB;IACnC,gBAAgB,qBAAqB;IACrC,WAAW,gBAAgB;CAC5B;AAED,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAIjE,CAAC"}
1	+ {"version":3,"file":"manual-controllers-routes-urls.d.ts","sourceRoot":"","sources":["../../../src/requests/manual-controllers-routes-urls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,kBAAkB,YAAY,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,sCAAsC,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,oCAAoC,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEjF;AAeD,oBAAY,wBAAwB;IAClC,sBAAsB,2BAA2B;IAEjD,aAAa,kBAAkB;IAC/B,0BAA0B,+BAA+B;IACzD,iBAAiB,sBAAsB;IACvC,kBAAkB,uBAAuB;IACzC,qBAAqB,0BAA0B;IAC/C,oBAAoB,yBAAyB;IAE7C;;;;;;;OAOG;IACH,yBAAyB,8BAA8B;IACvD;;;;;;;OAOG;IACH,4BAA4B,iCAAiC;IAC7D;;;;;;;;;;OAUG;IACH;;;;;;;;;;;;;;;;;;;OAmBG;IACH,4BAA4B,iCAAiC;IAC7D,6BAA6B,kCAAkC;IAC/D;;;;;;;;;;;OAWG;IACH,oCAAoC,yCAAyC;IAC7E;;;;;;;;;;OAUG;IACH,gCAAgC,qCAAqC;IACrE,kFAAkF;IAClF,6BAA6B,kCAAkC;IAC/D,6BAA6B,kCAAkC;IAC/D,mBAAmB,wBAAwB;IAC3C;;;;OAIG;IACH,oBAAoB,yBAAyB;IAC7C,wFAAwF;IACxF,wBAAwB,6BAA6B;IACrD;;;;OAIG;IACH,0BAA0B,+BAA+B;IACzD,2FAA2F;IAC3F,mBAAmB,wBAAwB;IAC3C,gGAAgG;IAChG,wBAAwB,6BAA6B;IACrD;;;;OAIG;IACH,sBAAsB,2BAA2B;IACjD,iFAAiF;IACjF,uBAAuB,4BAA4B;IACnD,sDAAsD;IACtD,qBAAqB,0BAA0B;IAC/C;;;;;OAKG;IACH,0BAA0B,+BAA+B;IACzD;;;;;;;;OAQG;IACH,kCAAkC,uCAAuC;IACzE;;;;;OAKG;IACH,uBAAuB,4BAA4B;IACnD;;;;;;;;;;;;OAYG;IACH,8BAA8B,mCAAmC;IACjE;;;;;;OAMG;IACH,2BAA2B,gCAAgC;IAC3D,WAAW,gBAAgB;IAC3B,2HAA2H;IAC3H,eAAe,oBAAoB;IACnC,2BAA2B,gCAAgC;IAC3D,4BAA4B,iCAAiC;IAC7D,aAAa,kBAAkB;IAC/B,sBAAsB,2BAA2B;IAIjD,oBAAoB,yBAAyB;IAC7C,sBAAsB,2BAA2B;IAGjD,wBAAwB,6BAA6B;IACrD,yBAAyB,8BAA8B;IACvD,yBAAyB,8BAA8B;IACvD,iBAAiB,sBAAsB;IACvC,kBAAkB,uBAAuB;IAGzC,uBAAuB,4BAA4B;IACnD,yBAAyB,8BAA8B;IAGvD,mBAAmB,wBAAwB;IAC3C,0BAA0B,+BAA+B;IACzD,oBAAoB,yBAAyB;IAG7C,6BAA6B,kCAAkC;IAC/D,4BAA4B,iCAAiC;IAC7D,yBAAyB,8BAA8B;IACvD,wBAAwB,6BAA6B;IACrD,iBAAiB,sBAAsB;IACvC,mBAAmB,wBAAwB;IAC3C,mBAAmB,wBAAwB;IAG3C,oBAAoB,yBAAyB;IAC7C,sBAAsB,2BAA2B;IAGjD,iBAAiB,sBAAsB;IACvC,mBAAmB,wBAAwB;IAG3C,sBAAsB,2BAA2B;IACjD,yBAAyB,8BAA8B;IAGvD,wBAAwB,6BAA6B;IAGrD,4BAA4B,iCAAiC;IAG7D,2BAA2B,gCAAgC;IAC3D,+BAA+B,oCAAoC;IACnE,6BAA6B,kCAAkC;IAC/D,2BAA2B,gCAAgC;IAC3D,+BAA+B,oCAAoC;IAGnE,oBAAoB,yBAAyB;IAC7C,iBAAiB,sBAAsB;IACvC,qBAAqB,0BAA0B;IAC/C,iBAAiB,sBAAsB;IACvC,wBAAwB,6BAA6B;IACrD,0BAA0B,+BAA+B;IACzD,WAAW,gBAAgB;IAC3B,4GAA4G;IAC5G,2BAA2B,gCAAgC;IAG3D,eAAe,oBAAoB;IACnC,aAAa,kBAAkB;IAC/B,kBAAkB,uBAAuB;IACzC,aAAa,kBAAkB;IAC/B,kPAAkP;IAClP,mBAAmB,wBAAwB;IAC3C,gBAAgB,qBAAqB;IAErC;;;;;;;;OAQG;IACH,gGAAgG;IAChG,yBAAyB,8BAA8B;IACvD,8EAA8E;IAC9E,yBAAyB,8BAA8B;IACvD;;;;OAIG;IACH,UAAU,eAAe;IACzB,yEAAyE;IACzE,cAAc,mBAAmB;IACjC,wDAAwD;IACxD,WAAW,gBAAgB;IAE3B,eAAe,oBAAoB;IAEnC,WAAW,gBAAgB;IAE3B,gBAAgB,qBAAqB;IACrC,0BAA0B,+BAA+B;IAEzD,sBAAsB,2BAA2B;IACjD,iBAAiB,sBAAsB;IAEvC,yEAAyE;IACzE,0BAA0B,+BAA+B;IACzD,qEAAqE;IACrE,oBAAoB,yBAAyB;IAG7C;;;;;OAKG;IACH,cAAc,mBAAmB;IACjC;;;;OAIG;IACH,SAAS,cAAc;IAGvB;;;;;;;;;OASG;IACH,YAAY,iBAAiB;IAC7B;;;;;;;;;OASG;IACH,+BAA+B,oCAAoC;CACpE;AAED,eAAO,MAAM,6BAA6B,EAAE,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAqJlF,CAAC;AAOF,oBAAY,kBAAkB;IAC5B,eAAe,oBAAoB;IACnC,gBAAgB,qBAAqB;IACrC,WAAW,gBAAgB;CAC5B;AAED,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAIjE,CAAC"}

package/dist/esm/requests/manual-controllers-routes-urls.js CHANGED Viewed

@@ -107,6 +107,82 @@ export var ManualControllerRouteKey;
     ManualControllerRouteKey["AUTH_TOKEN_REFRESH"] = "AUTH_TOKEN_REFRESH";
     ManualControllerRouteKey["AUTH_OAUTH2_AUTHORIZE"] = "AUTH_OAUTH2_AUTHORIZE";
     ManualControllerRouteKey["AUTH_OAUTH2_CALLBACK"] = "AUTH_OAUTH2_CALLBACK";
+    /**
+     * OUTBOUND connections — this application acting as somebody toward a third party.
+     *
+     * Easy to confuse with {@link AUTH_OAUTH2_AUTHORIZE} above and the exact opposite direction: that
+     * pair signs a person INTO this application using a vendor as the identity provider, this pair
+     * connects a vendor account so this application can act as that account. Same protocol, opposite
+     * arrow, and nothing is shared between them but the RFC.
+     */
+    ManualControllerRouteKey["PROVIDER_CONNECTION_START"] = "PROVIDER_CONNECTION_START";
+    /**
+     * The single redirect URI for EVERY provider, keyed by `state` rather than by a path segment.
+     *
+     * One URI, deliberately. A redirect URI must be registered at the vendor before it is accepted, so
+     * a per-provider path would mean registering 129 distinct URIs — by hand, per deployment, per
+     * environment. The `state` already has to be unguessable and single-use for CSRF, and it already
+     * identifies the attempt, so it identifies the provider too at no extra cost.
+     */
+    ManualControllerRouteKey["PROVIDER_CONNECTION_CALLBACK"] = "PROVIDER_CONNECTION_CALLBACK";
+    /**
+     * What this caller may connect, and under which owner scopes.
+     *
+     * Without it a settings screen cannot offer Connect at all: the credential LIST answers what a
+     * person HAS connected, and nothing answers what they COULD. The two are different questions and
+     * the empty answer to the first — the state everybody starts in — is exactly when the second one
+     * matters.
+     *
+     * Admissibility is a RECORDED DECISION per provider, never derived from a vendor's API surface, so
+     * this route reports a decision rather than computing one.
+     */
+    /**
+     * Finish an authorization the vendor has just approved — the half the CALLBACK cannot do.
+     *
+     * The callback is reached by a top-level navigation from the vendor's origin, so it carries no
+     * `Authorization` header and never can: a header is set by script on a fetch, and a redirect is
+     * not a fetch. The application's only auth cookie is `SameSite=Strict` on `Path=/api/v1/auth`, so
+     * it is not sent there either. The callback therefore cannot know WHO is finishing the flow, and
+     * for a while it asked anyway — every consent answered `401 UNAUTHENTICATED` and the person saw a
+     * JSON body, with the attempt already consumed so they could not even retry.
+     *
+     * Splitting it puts the authenticated act back on a FETCH, where a bearer token exists. The
+     * callback hands `state` and `code` to the frontend and authenticates nobody; the frontend, which
+     * holds the token, posts them here. Nothing about the guarantee is relaxed — this route consumes
+     * the attempt atomically, re-checks that the finisher is the initiator, and only then exchanges.
+     *
+     * Rejected: binding the attempt to a browser with a second `SameSite=Lax` cookie. It is the
+     * ordinary OAuth-client pattern and it would work, but this application authenticates its API with
+     * bearer tokens and nothing else, and a second auth-bearing cookie is an architectural addition
+     * whose `SameSite` behaviour then has to be reasoned about separately for every deployment shape.
+     */
+    ManualControllerRouteKey["PROVIDER_CONNECTION_COMPLETE"] = "PROVIDER_CONNECTION_COMPLETE";
+    ManualControllerRouteKey["PROVIDER_CONNECTION_CATALOGUE"] = "PROVIDER_CONNECTION_CATALOGUE";
+    /**
+     * Store a credential somebody TYPED, for a vendor with no authorization flow.
+     *
+     * The sibling of {@link PROVIDER_CONNECTION_START}, and a separate route because the acts differ
+     * completely: one hands back a URL and ends in a redirect from a vendor, this one takes values and
+     * ends in a stored row. Sharing a route would mean a body whose meaning depends on a provider's
+     * contract, which is how a caller ends up sending an access token where a client id belongs.
+     *
+     * It exists on the BACKEND rather than being a generic resource create because this is where
+     * "nothing is typed by hand" stops being a screen's good manners and becomes enforceable: the route
+     * refuses any slug the provider did not declare as identifying an account.
+     */
+    ManualControllerRouteKey["PROVIDER_CONNECTION_STORE_CREDENTIAL"] = "PROVIDER_CONNECTION_STORE_CREDENTIAL";
+    /**
+     * A short-lived access token for the CALLER's own connected account, handed to the browser (#394 P4).
+     *
+     * The one shape of credential a browser may ever be handed, and the reason it is a route of its
+     * own: a vendor's picker (Drive's, for one) authorizes as the signed-in user and cannot render
+     * without that user's token — so the token is in the browser during picking whether the selected
+     * bytes are later fetched by the backend or not. Everything else about the grant stays server-side:
+     * the refresh token never crosses, the row is resolved as the caller and nobody else, and every
+     * hand-out is a recorded USE of the credential, which is what makes revocation and erasure mean
+     * something for a token that has left the process.
+     */
+    ManualControllerRouteKey["PROVIDER_CONNECTION_ACCESS_TOKEN"] = "PROVIDER_CONNECTION_ACCESS_TOKEN";
     /** Enterprise SSO: initiate OAuth2 flow for an org's OIDC connection (Step 15) */
     ManualControllerRouteKey["AUTH_ENTERPRISE_SSO_AUTHORIZE"] = "AUTH_ENTERPRISE_SSO_AUTHORIZE";
     ManualControllerRouteKey["AUTH_APP_ENTERPRISE_AUTHORIZE"] = "AUTH_APP_ENTERPRISE_AUTHORIZE";
@@ -163,6 +239,20 @@ export var ManualControllerRouteKey;
      * to reason about than one handler that refuses.
      */
     ManualControllerRouteKey["OAUTH_PROVIDER_REGISTER"] = "OAUTH_PROVIDER_REGISTER";
+    /**
+     * RFC 7592 client configuration endpoint — a dynamically registered client reads, updates or
+     * deletes its OWN registration, authenticating with the registration access token it was issued
+     * at registration.
+     *
+     * One key for three verbs (GET / PUT / DELETE) because RFC 7592 §2 defines ONE endpoint whose
+     * method selects the operation; splitting it into three keys would invent a distinction the
+     * specification does not make and put the same URL in the table three times.
+     *
+     * Registered unconditionally, like `/oauth/register`, and gated by the same
+     * `auth.dynamicClientRegistration` opt-in in the handler — a route table that depends on config is
+     * harder to reason about than a handler that refuses.
+     */
+    ManualControllerRouteKey["OAUTH_PROVIDER_REGISTER_CLIENT"] = "OAUTH_PROVIDER_REGISTER_CLIENT";
     /**
      * Cross-frontend session handoff (cross-app-jwt-propagation Step 2).
      * Authenticated user requests a one-time AUTH_CODE_EXCHANGE token bound to a
@@ -241,6 +331,30 @@ export var ManualControllerRouteKey;
     ManualControllerRouteKey["AUTH_SAML_SLO"] = "AUTH_SAML_SLO";
     /** SP-INITIATED SLO kickoff: the app asks the backend to log the caller out of their SAML session and (when the IdP supports it) redirect to the IdP's SLO endpoint. Distinct from AUTH_SAML_SLO, which is the INBOUND endpoint the IdP calls. */
     ManualControllerRouteKey["AUTH_SAML_SP_LOGOUT"] = "AUTH_SAML_SP_LOGOUT";
+    ManualControllerRouteKey["AUTH_OIDC_LOGOUT"] = "AUTH_OIDC_LOGOUT";
+    /**
+     * Direct file transfer, distinct from the resource registry's own file routes.
+     *
+     * A resource's `/…/{id}/files/{field}` routes upload and replace the file BOUND TO A FIELD; these
+     * five address a stored file by its own id, wherever it is attached. They lived as literal path
+     * strings inside the file controller until 2026-09-09, which is exactly the duplication this
+     * registry exists to remove — and it also kept them out of every mechanism keyed on this
+     * vocabulary, the generated API reference included.
+     */
+    /** Public, token-authenticated status read for an upload grant. The token IS the credential. */
+    ManualControllerRouteKey["FILES_UPLOAD_GRANT_STATUS"] = "FILES_UPLOAD_GRANT_STATUS";
+    /** Revoke an upload grant, addressed by its id — never by the token value. */
+    ManualControllerRouteKey["FILES_UPLOAD_GRANT_REVOKE"] = "FILES_UPLOAD_GRANT_REVOKE";
+    /**
+     * One stored file addressed by id. ONE key for two verbs (GET downloads it, DELETE removes it)
+     * because Express matches one path and the method selects the operation — the same reasoning as
+     * {@link OAUTH_PROVIDER_REGISTER_CLIENT}. Splitting it would put one URL in the table twice.
+     */
+    ManualControllerRouteKey["FILES_ITEM"] = "FILES_ITEM";
+    /** The stored file's metadata record, without transferring its bytes. */
+    ManualControllerRouteKey["FILES_METADATA"] = "FILES_METADATA";
+    /** Mint a time-limited share link for a stored file. */
+    ManualControllerRouteKey["FILES_SHARE"] = "FILES_SHARE";
     ManualControllerRouteKey["I18N_GET_LABELS"] = "I18N_GET_LABELS";
     ManualControllerRouteKey["CHARTS_DATA"] = "CHARTS_DATA";
     ManualControllerRouteKey["ANALYTICS_EVENTS"] = "ANALYTICS_EVENTS";
@@ -297,6 +411,12 @@ export const MANUAL_CONTROLLER_ROUTES_URLS = {
     [ManualControllerRouteKey.AUTH_TOKEN_REFRESH]: '/auth/token/refresh',
     [ManualControllerRouteKey.AUTH_OAUTH2_AUTHORIZE]: '/auth/oauth2/authorize/:providerRef',
     [ManualControllerRouteKey.AUTH_OAUTH2_CALLBACK]: '/auth/oauth2/callback/:providerRef',
+    [ManualControllerRouteKey.PROVIDER_CONNECTION_START]: '/connections/:providerRef/start',
+    [ManualControllerRouteKey.PROVIDER_CONNECTION_CALLBACK]: '/connections/callback',
+    [ManualControllerRouteKey.PROVIDER_CONNECTION_COMPLETE]: '/connections/complete',
+    [ManualControllerRouteKey.PROVIDER_CONNECTION_CATALOGUE]: '/connections',
+    [ManualControllerRouteKey.PROVIDER_CONNECTION_STORE_CREDENTIAL]: '/connections/:providerRef/credential',
+    [ManualControllerRouteKey.PROVIDER_CONNECTION_ACCESS_TOKEN]: '/connections/:providerRef/access-token',
     [ManualControllerRouteKey.AUTH_ENTERPRISE_SSO_AUTHORIZE]: '/auth/enterprise/authorize/:orgId/:connectionId',
     [ManualControllerRouteKey.AUTH_APP_ENTERPRISE_AUTHORIZE]: '/auth/app-enterprise/authorize/:connectionId',
     [ManualControllerRouteKey.AUTH_TOKEN_EXCHANGE]: '/auth/token/exchange',
@@ -319,6 +439,7 @@ export const MANUAL_CONTROLLER_ROUTES_URLS = {
     [ManualControllerRouteKey.OAUTH_PROVIDER_END_SESSION]: '/oauth/end-session',
     [ManualControllerRouteKey.OAUTH_PROVIDER_END_SESSION_CONFIRM]: '/oauth/end-session/confirm',
     [ManualControllerRouteKey.OAUTH_PROVIDER_REGISTER]: '/oauth/register',
+    [ManualControllerRouteKey.OAUTH_PROVIDER_REGISTER_CLIENT]: '/oauth/register/:clientId',
     [ManualControllerRouteKey.AUTH_CROSS_FRONTEND_HANDOFF]: '/auth/cross-frontend-handoff',
     [ManualControllerRouteKey.AUTH_LOGOUT]: '/auth/logout',
     [ManualControllerRouteKey.AUTH_LOGOUT_ALL]: '/auth/logout-all',
@@ -367,6 +488,14 @@ export const MANUAL_CONTROLLER_ROUTES_URLS = {
     [ManualControllerRouteKey.AUTH_SAML_METADATA]: '/auth/saml/metadata/:scopeType/:scopeId',
     [ManualControllerRouteKey.AUTH_SAML_SLO]: '/auth/saml/slo',
     [ManualControllerRouteKey.AUTH_SAML_SP_LOGOUT]: '/auth/saml/logout',
+    [ManualControllerRouteKey.AUTH_OIDC_LOGOUT]: '/auth/oidc/logout',
+    // Direct file transfer. `upload-grants` MUST stay ahead of the `:fileId` family at the mount site,
+    // or Express reads `upload-grants` as a file id — the controller registers them in that order.
+    [ManualControllerRouteKey.FILES_UPLOAD_GRANT_STATUS]: '/files/upload-grants/:token',
+    [ManualControllerRouteKey.FILES_UPLOAD_GRANT_REVOKE]: '/files/upload-grants/:grantId',
+    [ManualControllerRouteKey.FILES_ITEM]: '/files/:fileId',
+    [ManualControllerRouteKey.FILES_METADATA]: '/files/:fileId/metadata',
+    [ManualControllerRouteKey.FILES_SHARE]: '/files/:fileId/share',
     [ManualControllerRouteKey.I18N_GET_LABELS]: '/i18n/labels',
     [ManualControllerRouteKey.CHARTS_DATA]: '/charts/:chartRef/data',
     // MFA — Email OTP (Step 10)