npm - @wildo-ai/saas-models - Versions diffs - 1.1.2 → 1.1.4 - Mend

@wildo-ai/saas-models 1.1.2 → 1.1.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (645) hide show

package/dist/esm/requests/manual-controllers-routes-urls.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"manual-controllers-routes-urls.js","sourceRoot":"","sources":["../../../../src/requests/manual-controllers-routes-urls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,SAAS,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,sCAAsC,CAAC,UAAkB;IACvE,OAAO,+BAA+B,CAAC,4BAA4B,EAAE,UAAU,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,oCAAoC,CAAC,YAAoB;IACvE,OAAO,+BAA+B,CAAC,0BAA0B,EAAE,YAAY,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,+BAA+B,CAAC,gBAAwB,EAAE,IAAY;IAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,OAAO,gBAAgB,gBAAgB,GAAG,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,UAAU,EAAE,EAAE,CAAC;AAC9H,CAAC;AAED,MAAM,CAAN,IAAY,wBAgNX;AAhND,WAAY,wBAAwB;IAClC,6EAAiD,CAAA;IAEjD,2DAA+B,CAAA;IAC/B,qFAAyD,CAAA;IACzD,mEAAuC,CAAA;IACvC,qEAAyC,CAAA;IACzC,2EAA+C,CAAA;IAC/C,yEAA6C,CAAA;IAC7C,kFAAkF;IAClF,2FAA+D,CAAA;IAC/D,2FAA+D,CAAA;IAC/D,uEAA2C,CAAA;IAC3C;;;;OAIG;IACH,yEAA6C,CAAA;IAC7C,wFAAwF;IACxF,iFAAqD,CAAA;IACrD;;;;OAIG;IACH,qFAAyD,CAAA;IACzD,2FAA2F;IAC3F,uEAA2C,CAAA;IAC3C,gGAAgG;IAChG,iFAAqD,CAAA;IACrD;;;;OAIG;IACH,6EAAiD,CAAA;IACjD,iFAAiF;IACjF,+EAAmD,CAAA;IACnD,sDAAsD;IACtD,2EAA+C,CAAA;IAC/C;;;;;OAKG;IACH,qFAAyD,CAAA;IACzD;;;;;;;;OAQG;IACH,qGAAyE,CAAA;IACzE;;;;;OAKG;IACH,+EAAmD,CAAA;IACnD;;;;;;OAMG;IACH,uFAA2D,CAAA;IAC3D,uDAA2B,CAAA;IAC3B,2HAA2H;IAC3H,+DAAmC,CAAA;IACnC,uFAA2D,CAAA;IAC3D,yFAA6D,CAAA;IAC7D,2DAA+B,CAAA;IAC/B,6EAAiD,CAAA;IACjD,8EAA8E;IAC9E,gFAAgF;IAChF,8EAA8E;IAC9E,yEAA6C,CAAA;IAC7C,6EAAiD,CAAA;IACjD,qFAAqF;IACrF,2FAA2F;IAC3F,iFAAqD,CAAA;IACrD,mFAAuD,CAAA;IACvD,mFAAuD,CAAA;IACvD,mEAAuC,CAAA;IACvC,qEAAyC,CAAA;IAEzC,4BAA4B;IAC5B,+EAAmD,CAAA;IACnD,mFAAuD,CAAA;IAEvD,uBAAuB;IACvB,uEAA2C,CAAA;IAC3C,qFAAyD,CAAA;IACzD,yEAA6C,CAAA;IAE7C,qCAAqC;IACrC,2FAA+D,CAAA;IAC/D,yFAA6D,CAAA;IAC7D,mFAAuD,CAAA;IACvD,iFAAqD,CAAA;IACrD,mEAAuC,CAAA;IACvC,uEAA2C,CAAA;IAC3C,uEAA2C,CAAA;IAE3C,wBAAwB;IACxB,yEAA6C,CAAA;IAC7C,6EAAiD,CAAA;IAEjD,qBAAqB;IACrB,mEAAuC,CAAA;IACvC,uEAA2C,CAAA;IAE3C,gCAAgC;IAChC,6EAAiD,CAAA;IACjD,mFAAuD,CAAA;IAEvD,iCAAiC;IACjC,iFAAqD,CAAA;IAErD,wDAAwD;IACxD,yFAA6D,CAAA;IAE7D,0CAA0C;IAC1C,uFAA2D,CAAA;IAC3D,+FAAmE,CAAA;IACnE,2FAA+D,CAAA;IAC/D,uFAA2D,CAAA;IAC3D,+FAAmE,CAAA;IAEnE,2BAA2B;IAC3B,yEAA6C,CAAA;IAC7C,mEAAuC,CAAA;IACvC,2EAA+C,CAAA;IAC/C,mEAAuC,CAAA;IACvC,iFAAqD,CAAA;IACrD,qFAAyD,CAAA;IACzD,uDAA2B,CAAA;IAC3B,4GAA4G;IAC5G,uFAA2D,CAAA;IAE3D,uBAAuB;IACvB,+DAAmC,CAAA;IACnC,2DAA+B,CAAA;IAC/B,qEAAyC,CAAA;IACzC,2DAA+B,CAAA;IAC/B,kPAAkP;IAClP,uEAA2C,CAAA;IAE3C,+DAAmC,CAAA;IAEnC,uDAA2B,CAAA;IAE3B,iEAAqC,CAAA;IACrC,qFAAyD,CAAA;IAEzD,6EAAiD,CAAA;IACjD,mEAAuC,CAAA;IAEvC,yEAAyE;IACzE,qFAAyD,CAAA;IACzD,qEAAqE;IACrE,yEAA6C,CAAA;IAE7C,+DAA+D;IAC/D;;;;;OAKG;IACH,6DAAiC,CAAA;IACjC;;;;OAIG;IACH,mDAAuB,CAAA;IAEvB,6EAA6E;IAC7E;;;;;;;;;OASG;IACH,yDAA6B,CAAA;IAC7B;;;;;;;;;OASG;IACH,+FAAmE,CAAA;AACrE,CAAC,EAhNW,wBAAwB,KAAxB,wBAAwB,QAgNnC;AAED,MAAM,CAAC,MAAM,6BAA6B,GAA6C;IACrF,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,qBAAqB;IAExE,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,gBAAgB;IAC1D,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,6BAA6B;IACpF,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAClE,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE,qBAAqB;IACpE,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE,qCAAqC;IACvF,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,oCAAoC;IACrF,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,iDAAiD;IAC3G,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,8CAA8C;IACxG,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,sBAAsB;IACtE,qEAAqE;IACrE,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,cAAc;IAC/D,wGAAwG;IACxG,kGAAkG;IAClG,oGAAoG;IACpG,gGAAgG;IAChG,qGAAqG;IACrG,oGAAoG;IACpG,6EAA6E;IAC7E,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,mCAAmC;IACxF,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,yCAAyC;IAChG,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,aAAa;IAC7D,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,kBAAkB;IACvE,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,2BAA2B;IAC9E,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,EAAE,iBAAiB;IACrE,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE,eAAe;IACjE,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,oBAAoB;IAC3E,CAAC,wBAAwB,CAAC,kCAAkC,CAAC,EAAE,4BAA4B;IAC3F,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,EAAE,iBAAiB;IACrE,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,8BAA8B;IACtF,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,cAAc;IACtD,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE,kBAAkB;IAC9D,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,8BAA8B;IACtF,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,+BAA+B;IACxF,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,gBAAgB;IAC1D,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,yBAAyB;IAC5E,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,uBAAuB;IACxE,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,yBAAyB;IAC5E,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,wBAAwB;IAC7E,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,0BAA0B;IAChF,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,0BAA0B;IAChF,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAClE,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE,0BAA0B;IAEzE,wBAAwB;IACxB,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,uBAAuB;IACxE,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,yBAAyB;IAE5E,qBAAqB;IACrB,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAClE,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,sBAAsB;IAEtE,gCAAgC;IAChC,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,yBAAyB;IAC5E,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,4BAA4B;IAElF,iCAAiC;IACjC,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,2BAA2B;IAEhF,gCAAgC;IAChC,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,+BAA+B;IAExF,0CAA0C;IAC1C,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,2CAA2C;IACnG,CAAC,wBAAwB,CAAC,+BAA+B,CAAC,EAAE,gEAAgE;IAC5H,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,gCAAgC;IAC1F,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,2DAA2D;IACnH,CAAC,wBAAwB,CAAC,+BAA+B,CAAC,EAAE,gFAAgF;IAE5I,2BAA2B;IAC3B,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,uBAAuB;IACxE,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAClE,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE,wBAAwB;IAC1E,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAClE,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,sBAAsB;IAC3E,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,8BAA8B;IACrF,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,cAAc;IACtD,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,8BAA8B;IAEtF,uBAAuB;IACvB,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE,gCAAgC;IAC5E,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,gBAAgB;IAC1D,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE,yCAAyC;IACxF,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,gBAAgB;IAC1D,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,mBAAmB;IAEnE,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE,cAAc;IAE1D,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,wBAAwB;IAEhE,4BAA4B;IAC5B,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,EAAE,0BAA0B;IAC9E,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,4BAA4B;IAElF,uBAAuB;IACvB,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,sBAAsB;IACtE,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,6BAA6B;IACpF,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,uBAAuB;IAExE,qCAAqC;IACrC,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,gCAAgC;IAC1F,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,+BAA+B;IACxF,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,oCAAoC;IAC1F,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,mCAAmC;IACxF,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAClE,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,sBAAsB;IACtE,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,sBAAsB;IAEtE,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,EAAE,mBAAmB;IAChE,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,6BAA6B;IAEpF,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,yBAAyB;IAC5E,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAElE,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,6BAA6B;IACpF,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,uBAAuB;IAExE,wCAAwC;IACxC,sFAAsF;IACtF,qFAAqF;IACrF,oEAAoE;IACpE,CAAC,wBAAwB,CAAC,cAAc,CAAC,EAAE,kCAAkC;IAC7E,CAAC,wBAAwB,CAAC,SAAS,CAAC,EAAE,MAAM;IAE5C,8CAA8C;IAC9C,4FAA4F;IAC5F,iFAAiF;IACjF,4EAA4E;IAC5E,CAAC,wBAAwB,CAAC,YAAY,CAAC,EAAE,MAAM;IAC/C,CAAC,wBAAwB,CAAC,+BAA+B,CAAC,EAAE,uCAAuC;CACpG,CAAC;AAEF,wDAAwD;AACxD,+CAA+C;AAC/C,6DAA6D;AAC7D,wDAAwD;AAExD,MAAM,CAAN,IAAY,kBAIX;AAJD,WAAY,kBAAkB;IAC5B,yDAAmC,CAAA;IACnC,2DAAqC,CAAA;IACrC,iDAA2B,CAAA;AAC7B,CAAC,EAJW,kBAAkB,KAAlB,kBAAkB,QAI7B;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAuC;IACpE,CAAC,kBAAkB,CAAC,eAAe,CAAC,EAAE,SAAS;IAC/C,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,eAAe;IACtD,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE,cAAc;CACjD,CAAC","sourcesContent":["/*\n Manual Controllers Routes URLs\n * Centralized URL declarations for custom/manual controllers\n * Shared between backend and frontend to avoid string duplication.\n \n Notes:\n * - These URLs are mounted under {@link MAIN_API_BASE_PATH}\n * - Keep only path segments here (no `MAIN_API_BASE_PATH` prefix) — the\n * prefix is prepended once at each boundary (backend mount / frontend client)\n /\n\n/\n Main API base path — the mount prefix under which the entire main\n * controllers registry is served (every resource route AND every\n * {@link MANUAL_CONTROLLER_ROUTES_URLS} entry).\n \n This is the SINGLE SOURCE OF TRUTH for the prefix. It is consumed by:\n * - the backend HTTP server mount (`app.use(MAIN_API_BASE_PATH, mainRouter)`),\n * - the frontend HTTP client when building absolute API URLs\n * (`${MAIN_API_BASE_PATH}${MANUAL_CONTROLLER_ROUTES_URLS[...]}`),\n * - the refresh-token cookie `Path` scope, which MUST path-match the served\n * auth routes (`${MAIN_API_BASE_PATH}/auth/`) or the browser drops it.\n \n * Why a shared symbol and not a literal: previously `/api/v1` was a literal\n * duplicated across the mount and the client. The absence of a shared symbol\n * let the refresh-token cookie `Path` be authored against the bare route\n * segment (`/auth`, omitting this prefix), so the browser stored the cookie\n * but never sent it to `/api/v1/auth/token/refresh` — silently breaking token\n * refresh for every session (forced logout on first refresh). Deriving every\n * prefix consumer from this constant closes that drift class.\n \n NOT under this prefix: the root-level engine routes in\n * {@link ENGINE_ROOT_ROUTES} (health/time probes), mounted at the app root.\n /\nexport const MAIN_API_BASE_PATH = '/api/v1';\n\n/\n Where RFC 8414 authorization-server metadata must be served for an issuer that carries a PATH.\n \n The rule is counter-intuitive and is the reason this exists as a named derivation rather than a\n * string built at the call site: the well-known segment goes BETWEEN the host and the issuer path,\n * not after it.\n \n \"If the issuer identifier value contains a path component, any terminating \"/\" MUST be removed\n * before inserting \"/.well-known/\" and the well-known URI suffix between the host component and\n * the path component.\"\n \n with the RFC's own worked example resolving issuer `https://example.com/issuer1` to\n * `GET /.well-known/oauth-authorization-server/issuer1`.\n * spec-cite: RFC 8414 § 3 (Obtaining Authorization Server Metadata), fetched 2026-08-11.\n \n OIDC Discovery uses the OPPOSITE construction — issuer + `/.well-known/openid-configuration` — so\n * the two cannot share one path and a server that serves only the OIDC shape fails RFC 8414 discovery\n * while looking correct. That is exactly what happened here: a real MCP client split our issuer at the\n * host boundary as the RFC instructs, asked for `/.well-known/oauth-authorization-server/api/v1`,\n * received the SPA shell, and abandoned authorization without ever opening a browser.\n \n @param issuerPath the issuer's path component (e.g. {@link MAIN_API_BASE_PATH}); a bare `/` or an\n * empty string yields the origin-root location, which is the path-less issuer case.\n /\nexport function rfc8414AuthorizationServerMetadataPath(issuerPath: string): string {\n return wellKnownPathBeforeResourcePath('oauth-authorization-server', issuerPath);\n}\n\n/\n Where RFC 9728 protected-resource metadata must be served for a resource identifier that carries a\n * PATH — the same insertion rule as {@link rfc8414AuthorizationServerMetadataPath}, for the other\n * document.\n \n \"The protected resource's well-known URI is created by inserting\n * /.well-known/oauth-protected-resource between the host component and the path component (if any)\n * of the resource identifier.\"\n * spec-cite: RFC 9728 § 3 (Protected Resource Metadata Request), fetched 2026-08-12.\n \n This is a SECOND discovery route, not a replacement for the one the challenge names. RFC 9728 § 5.1\n * lets a client take `resource_metadata` straight from the `WWW-Authenticate` header, and MCP tells\n * clients to do exactly that — which is why serving only the header's location worked with a real\n * client and is a defensible posture. It is nevertheless not the whole contract: a client that derives\n * the location from the resource identifier, as this section permits, previously received the SPA\n * shell. Both locations now serve one document.\n \n Note the asymmetry with RFC 8414, because it explains why that one was a live outage and this one\n * was latent: an authorization server publishes no equivalent pointer, so derivation is a client's\n * ONLY route to AS metadata.\n \n @param resourcePath the resource identifier's path component (e.g. `/api/v1/mcp`); a bare `/` or an\n * empty string yields the origin-root location, which is the path-less case.\n /\nexport function rfc9728ProtectedResourceMetadataPath(resourcePath: string): string {\n return wellKnownPathBeforeResourcePath('oauth-protected-resource', resourcePath);\n}\n\n/\n The construction RFC 8414 § 3 and RFC 9728 § 3 both specify: strip any terminating `/`, then insert\n * the well-known segment BETWEEN the host and the path.\n \n Shared deliberately rather than written twice. The rule is counter-intuitive enough that it was\n * already implemented wrongly once here, and a second hand-rolled copy is how the two documents would\n * come to disagree about a rule they take verbatim from each other.\n /\nfunction wellKnownPathBeforeResourcePath(wellKnownSegment: string, path: string): string {\n const normalized = path.replace(/\\/+$/, '');\n return `/.well-known/${wellKnownSegment}${normalized.startsWith('/') \|\| normalized === '' ? normalized : `/${normalized}`}`;\n}\n\nexport enum ManualControllerRouteKey {\n APPLICATION_CONFIG_GET = 'APPLICATION_CONFIG_GET',\n\n AUTH_IDENTIFY = 'AUTH_IDENTIFY',\n AUTH_AUTHENTICATE_PASSWORD = 'AUTH_AUTHENTICATE_PASSWORD',\n AUTH_AUTHENTICATE = 'AUTH_AUTHENTICATE',\n AUTH_TOKEN_REFRESH = 'AUTH_TOKEN_REFRESH',\n AUTH_OAUTH2_AUTHORIZE = 'AUTH_OAUTH2_AUTHORIZE',\n AUTH_OAUTH2_CALLBACK = 'AUTH_OAUTH2_CALLBACK',\n /* Enterprise SSO: initiate OAuth2 flow for an org's OIDC connection (Step 15) /\n AUTH_ENTERPRISE_SSO_AUTHORIZE = 'AUTH_ENTERPRISE_SSO_AUTHORIZE',\n AUTH_APP_ENTERPRISE_AUTHORIZE = 'AUTH_APP_ENTERPRISE_AUTHORIZE',\n AUTH_TOKEN_EXCHANGE = 'AUTH_TOKEN_EXCHANGE',\n /\n OAuth 2.0 Authorization Server token endpoint (Wildo-AS-PROVIDER, distinct from the\n * RP-side `/auth/` routes). Serves `grant_type=client_credentials` now; the OIDC branch\n adds `authorization_code`. Served at `${MAIN_API_BASE_PATH}/oauth/token`.\n /\n OAUTH_PROVIDER_TOKEN = 'OAUTH_PROVIDER_TOKEN',\n /* OIDC discovery document (served at `${issuer}/.well-known/openid-configuration`). /\n OAUTH_PROVIDER_DISCOVERY = 'OAUTH_PROVIDER_DISCOVERY',\n /\n RFC 8414 Authorization Server Metadata (`${issuer}/.well-known/oauth-authorization-server`) —\n * the SAME document as {@link OAUTH_PROVIDER_DISCOVERY}, served at the OAuth-2 well-known path that\n * many OAuth/MCP clients probe FIRST (before the OIDC path). Aliases the discovery handler.\n /\n OAUTH_PROVIDER_AS_METADATA = 'OAUTH_PROVIDER_AS_METADATA',\n /* JSON Web Key Set for verifying Wildo-issued tokens (the discovery doc's `jwks_uri`). /\n OAUTH_PROVIDER_JWKS = 'OAUTH_PROVIDER_JWKS',\n /* OIDC authorization endpoint (authorization_code flow — the caller lands here to consent). /\n OAUTH_PROVIDER_AUTHORIZE = 'OAUTH_PROVIDER_AUTHORIZE',\n /\n OIDC interactive-consent decision endpoint. When the authorize endpoint returned\n * `consent_required` for a `requiresConsent` client, the user's approve/deny decision is POSTed\n * here with the single-use consent-request token; APPROVE mints the authorization code.\n /\n OAUTH_PROVIDER_CONSENT = 'OAUTH_PROVIDER_CONSENT',\n /* OIDC UserInfo endpoint (bearer access token → the user's standard claims). /\n OAUTH_PROVIDER_USERINFO = 'OAUTH_PROVIDER_USERINFO',\n /* OAuth 2.0 token revocation endpoint (RFC 7009). /\n OAUTH_PROVIDER_REVOKE = 'OAUTH_PROVIDER_REVOKE',\n /\n OIDC RP-Initiated Logout 1.0 `end_session_endpoint` (revocation-C). A relying party redirects the\n * End-User here (with an `id_token_hint`) to terminate their Wildo OP login session — the exact\n * session the delegation was authorized from, keyed on the id_token's `sid`. Distinct from\n * {@link OAUTH_PROVIDER_REVOKE}: revoke kills a TOKEN (RFC 7009); end_session ends a SESSION.\n /\n OAUTH_PROVIDER_END_SESSION = 'OAUTH_PROVIDER_END_SESSION',\n /\n OIDC RP-Initiated Logout 1.0 §6 confirmation decision (revocation-C). The `POST` the frontend\n * `/oauth/logout-confirm` prompt calls to actually terminate the session, presenting the single-use\n * `OIDC_LOGOUT_CONFIRMATION` token minted by {@link OAUTH_PROVIDER_END_SESSION}. Token-authorized\n * (no Bearer — the End-User may be unauthenticated in the SPA, having arrived via an RP redirect);\n * returns `{ redirect_to }` (always the same-origin signed-out page `/oauth/logged-out`; the SPA\n * navigates there). Only reached for NON-trusted logouts — a trusted RP logout terminates + redirects\n * inline without a prompt (the Keycloak-style posture).\n /\n OAUTH_PROVIDER_END_SESSION_CONFIRM = 'OAUTH_PROVIDER_END_SESSION_CONFIRM',\n /\n RFC 7591 dynamic client registration. Registered UNCONDITIONALLY so the route always exists;\n * the handler answers 404 unless the application opted in via `auth.dynamicClientRegistration`.\n * Registering it conditionally would make the route table depend on config, which is far harder\n * to reason about than one handler that refuses.\n /\n OAUTH_PROVIDER_REGISTER = 'OAUTH_PROVIDER_REGISTER',\n /\n Cross-frontend session handoff (cross-app-jwt-propagation Step 2).\n * Authenticated user requests a one-time AUTH_CODE_EXCHANGE token bound to a\n * target frontend, then redirects the browser to the target's\n * /auth/exchange page with the code. Bearer-only; CORS auto-allowed for every\n * declared frontendService via the existing deriveCorsOrigins() seam.\n /\n AUTH_CROSS_FRONTEND_HANDOFF = 'AUTH_CROSS_FRONTEND_HANDOFF',\n AUTH_LOGOUT = 'AUTH_LOGOUT',\n /* Sign-out-everywhere: fences the whole user — all access + refresh tokens, every device — via the invalidation fence. /\n AUTH_LOGOUT_ALL = 'AUTH_LOGOUT_ALL',\n AUTH_PASSWORD_RESET_REQUEST = 'AUTH_PASSWORD_RESET_REQUEST',\n AUTH_PASSWORD_RESET_COMPLETE = 'AUTH_PASSWORD_RESET_COMPLETE',\n AUTH_REGISTER = 'AUTH_REGISTER',\n AUTH_ACCEPT_INVITATION = 'AUTH_ACCEPT_INVITATION',\n // Public token-keyed invitation-accept DISCOVERY (non-consuming): returns the\n // invited org's available auth methods + SSO/SCIM management mode so the accept\n // screen can render the right chooser. Read-only; does NOT consume the token.\n AUTH_INVITATION_INFO = 'AUTH_INVITATION_INFO',\n AUTH_REJECT_INVITATION = 'AUTH_REJECT_INVITATION',\n // In-app authenticated invitation management (Approach P) — a signed-in user acts on\n // THEIR OWN pending invitations (authorized by email-ownership), no token, no new session.\n AUTH_LIST_MY_INVITATIONS = 'AUTH_LIST_MY_INVITATIONS',\n AUTH_ACCEPT_MY_INVITATION = 'AUTH_ACCEPT_MY_INVITATION',\n AUTH_REJECT_MY_INVITATION = 'AUTH_REJECT_MY_INVITATION',\n AUTH_VERIFY_EMAIL = 'AUTH_VERIFY_EMAIL',\n AUTH_SESSION_STATE = 'AUTH_SESSION_STATE',\n\n // MFA — Email OTP (Step 10)\n AUTH_MFA_EMAIL_OTP_SEND = 'AUTH_MFA_EMAIL_OTP_SEND',\n AUTH_MFA_EMAIL_OTP_VERIFY = 'AUTH_MFA_EMAIL_OTP_VERIFY',\n\n // MFA — TOTP (Step 11)\n AUTH_MFA_TOTP_SETUP = 'AUTH_MFA_TOTP_SETUP',\n AUTH_MFA_TOTP_VERIFY_SETUP = 'AUTH_MFA_TOTP_VERIFY_SETUP',\n AUTH_MFA_TOTP_VERIFY = 'AUTH_MFA_TOTP_VERIFY',\n\n // WebAuthn/Passkey Routes (Phase G1)\n AUTH_PASSKEY_REGISTER_OPTIONS = 'AUTH_PASSKEY_REGISTER_OPTIONS',\n AUTH_PASSKEY_REGISTER_VERIFY = 'AUTH_PASSKEY_REGISTER_VERIFY',\n AUTH_PASSKEY_AUTH_OPTIONS = 'AUTH_PASSKEY_AUTH_OPTIONS',\n AUTH_PASSKEY_AUTH_VERIFY = 'AUTH_PASSKEY_AUTH_VERIFY',\n AUTH_PASSKEY_LIST = 'AUTH_PASSKEY_LIST',\n AUTH_PASSKEY_REMOVE = 'AUTH_PASSKEY_REMOVE',\n AUTH_PASSKEY_RENAME = 'AUTH_PASSKEY_RENAME',\n\n // Magic Link (Phase G2)\n AUTH_MAGIC_LINK_SEND = 'AUTH_MAGIC_LINK_SEND',\n AUTH_MAGIC_LINK_VERIFY = 'AUTH_MAGIC_LINK_VERIFY',\n\n // SMS OTP (Phase G2)\n AUTH_SMS_OTP_SEND = 'AUTH_SMS_OTP_SEND',\n AUTH_SMS_OTP_VERIFY = 'AUTH_SMS_OTP_VERIFY',\n\n // Phone Verification (Phase G2)\n AUTH_PHONE_VERIFY_SEND = 'AUTH_PHONE_VERIFY_SEND',\n AUTH_PHONE_VERIFY_CONFIRM = 'AUTH_PHONE_VERIFY_CONFIRM',\n\n // Resend Verification Email (F5)\n AUTH_RESEND_VERIFICATION = 'AUTH_RESEND_VERIFICATION',\n\n // W5.7: Complete org onboarding (deferred org creation)\n AUTH_COMPLETE_ORG_ONBOARDING = 'AUTH_COMPLETE_ORG_ONBOARDING',\n\n // W7.3b: One-off session token management\n AUTH_ONE_OFF_SESSION_CREATE = 'AUTH_ONE_OFF_SESSION_CREATE',\n AUTH_ONE_OFF_SESSION_CREATE_ORG = 'AUTH_ONE_OFF_SESSION_CREATE_ORG',\n AUTH_ONE_OFF_SESSION_EXCHANGE = 'AUTH_ONE_OFF_SESSION_EXCHANGE',\n AUTH_ONE_OFF_SESSION_REVOKE = 'AUTH_ONE_OFF_SESSION_REVOKE',\n AUTH_ONE_OFF_SESSION_REVOKE_ORG = 'AUTH_ONE_OFF_SESSION_REVOKE_ORG',\n\n // Method Management (#13f)\n AUTH_PASSWORD_CHANGE = 'AUTH_PASSWORD_CHANGE',\n AUTH_PASSWORD_SET = 'AUTH_PASSWORD_SET',\n AUTH_MFA_TOTP_DISABLE = 'AUTH_MFA_TOTP_DISABLE',\n AUTH_METHODS_MINE = 'AUTH_METHODS_MINE',\n AUTH_IDENTITY_LINKS_LIST = 'AUTH_IDENTITY_LINKS_LIST',\n AUTH_IDENTITY_LINKS_UNLINK = 'AUTH_IDENTITY_LINKS_UNLINK',\n AUTH_REAUTH = 'AUTH_REAUTH',\n /* Challenge leg of a PASSKEY step-up: WebAuthn is challenge-response, so re-auth needs two round-trips. /\n AUTH_REAUTH_PASSKEY_OPTIONS = 'AUTH_REAUTH_PASSKEY_OPTIONS',\n\n // SAML Routes (AUTH-2)\n AUTH_SAML_LOGIN = 'AUTH_SAML_LOGIN',\n AUTH_SAML_ACS = 'AUTH_SAML_ACS',\n AUTH_SAML_METADATA = 'AUTH_SAML_METADATA',\n AUTH_SAML_SLO = 'AUTH_SAML_SLO',\n /* SP-INITIATED SLO kickoff: the app asks the backend to log the caller out of their SAML session and (when the IdP supports it) redirect to the IdP's SLO endpoint. Distinct from AUTH_SAML_SLO, which is the INBOUND endpoint the IdP calls. /\n AUTH_SAML_SP_LOGOUT = 'AUTH_SAML_SP_LOGOUT',\n\n I18N_GET_LABELS = 'I18N_GET_LABELS',\n\n CHARTS_DATA = 'CHARTS_DATA',\n\n ANALYTICS_EVENTS = 'ANALYTICS_EVENTS',\n ANALYTICS_MOMENTS_ACHIEVED = 'ANALYTICS_MOMENTS_ACHIEVED',\n\n PROGRESSION_MILESTONES = 'PROGRESSION_MILESTONES',\n FEATURES_RESOLVED = 'FEATURES_RESOLVED',\n\n /* Frontend-visible flow/actor systems (metadata + renderable graph). /\n FLOWS_ACTORS_FRONTEND_INFO = 'FLOWS_ACTORS_FRONTEND_INFO',\n /* The caller's own conversation history for a flow/actor system. /\n FLOWS_ACTORS_HISTORY = 'FLOWS_ACTORS_HISTORY',\n\n // === A2A (external actor exposure — Agent2Agent protocol) ===\n /\n A2A agent card (public, CORS-open metadata) advertising this app's exposed\n * actor systems as A2A skills + the security schemes a caller must satisfy.\n * Analogous to the OIDC discovery doc; the served path can be reverse-proxy\n * aliased to a root `/.well-known/agent-card.json`.\n /\n A2A_AGENT_CARD = 'A2A_AGENT_CARD',\n /\n A2A JSON-RPC task/message endpoint (`message/send`, `message/stream` via SSE).\n * Its absolute URL is the agent card's `url` AND the agent's canonical\n * audience — an inbound access token MUST carry this as its `aud` (RFC 8707 / D7).\n /\n A2A_TASKS = 'A2A_TASKS',\n\n // === MCP (Model Context Protocol server — resource operations as tools) ===\n /\n MCP JSON-RPC 2.0 endpoint (Streamable-HTTP transport): `initialize`, `tools/list`,\n * `tools/call`. A `tools/call` is Bearer-credentialed by a machine OR user-delegated access token\n * that is resource-server-bound to the MCP audience — NOT the generic API audience, which this\n * surface rejects since the 2026-07-29 strict flip (RFC 8707 / D7) — validated at auth time; the\n * server re-runs `authorizeInController` before dispatch (fail-closed).\n \n Also the base for the R-2 NAMED server instances: `POST /mcp/:instanceRef` serves a declared\n * instance with its own audience (`…/mcp/<ref>`) and curated catalog.\n /\n MCP_ENDPOINT = 'MCP_ENDPOINT',\n /\n MCP OAuth 2.0 Protected Resource Metadata (RFC 9728): advertises this MCP server's\n * `resource` identifier + the `authorization_servers` (the app's own OIDC provider) an MCP\n * client uses to obtain a token. Public, CORS-open metadata (like the OIDC discovery doc).\n \n Mounted TWICE: at the API root for the DEFAULT server, and appended to each named instance\n * (`/mcp/:instanceRef` + this route) so every instance advertises its OWN audience. A 401 at either\n * surface points its `WWW-Authenticate: resource_metadata=` at the matching one — the only discovery\n * route a client has, since this path is non-standard (it is not the RFC's origin-root form).\n /\n MCP_PROTECTED_RESOURCE_METADATA = 'MCP_PROTECTED_RESOURCE_METADATA',\n}\n\nexport const MANUAL_CONTROLLER_ROUTES_URLS: Record<ManualControllerRouteKey, string> = {\n [ManualControllerRouteKey.APPLICATION_CONFIG_GET]: '/application-config',\n\n [ManualControllerRouteKey.AUTH_IDENTIFY]: '/auth/identify',\n [ManualControllerRouteKey.AUTH_AUTHENTICATE_PASSWORD]: '/auth/authenticate/password',\n [ManualControllerRouteKey.AUTH_AUTHENTICATE]: '/auth/authenticate',\n [ManualControllerRouteKey.AUTH_TOKEN_REFRESH]: '/auth/token/refresh',\n [ManualControllerRouteKey.AUTH_OAUTH2_AUTHORIZE]: '/auth/oauth2/authorize/:providerRef',\n [ManualControllerRouteKey.AUTH_OAUTH2_CALLBACK]: '/auth/oauth2/callback/:providerRef',\n [ManualControllerRouteKey.AUTH_ENTERPRISE_SSO_AUTHORIZE]: '/auth/enterprise/authorize/:orgId/:connectionId',\n [ManualControllerRouteKey.AUTH_APP_ENTERPRISE_AUTHORIZE]: '/auth/app-enterprise/authorize/:connectionId',\n [ManualControllerRouteKey.AUTH_TOKEN_EXCHANGE]: '/auth/token/exchange',\n // OAuth 2.0 Authorization Server token endpoint (Wildo-as-provider).\n [ManualControllerRouteKey.OAUTH_PROVIDER_TOKEN]: '/oauth/token',\n // OIDC discovery + JWKS. Served under the API mount, so with issuer `${publicUrl}${MAIN_API_BASE_PATH}`\n // a client's `${issuer}/.well-known/openid-configuration` resolves here. That is correct for OIDC\n // Discovery (issuer + suffix) and NOT for RFC 8414, which places the well-known segment BETWEEN the\n // host and the issuer path — see {@link rfc8414AuthorizationServerMetadataPath}, which the HTTP\n // server mounts as a second location for the SAME document. (This used to say a root-level alias was\n // \"a reverse-proxy concern\"; leaving it to ingress meant every deployment that did not add the rule\n // silently failed RFC 8414 discovery, so the server now serves it directly.)\n [ManualControllerRouteKey.OAUTH_PROVIDER_DISCOVERY]: '/.well-known/openid-configuration',\n [ManualControllerRouteKey.OAUTH_PROVIDER_AS_METADATA]: '/.well-known/oauth-authorization-server',\n [ManualControllerRouteKey.OAUTH_PROVIDER_JWKS]: '/oauth/jwks',\n [ManualControllerRouteKey.OAUTH_PROVIDER_AUTHORIZE]: '/oauth/authorize',\n [ManualControllerRouteKey.OAUTH_PROVIDER_CONSENT]: '/oauth/authorize/decision',\n [ManualControllerRouteKey.OAUTH_PROVIDER_USERINFO]: '/oauth/userinfo',\n [ManualControllerRouteKey.OAUTH_PROVIDER_REVOKE]: '/oauth/revoke',\n [ManualControllerRouteKey.OAUTH_PROVIDER_END_SESSION]: '/oauth/end-session',\n [ManualControllerRouteKey.OAUTH_PROVIDER_END_SESSION_CONFIRM]: '/oauth/end-session/confirm',\n [ManualControllerRouteKey.OAUTH_PROVIDER_REGISTER]: '/oauth/register',\n [ManualControllerRouteKey.AUTH_CROSS_FRONTEND_HANDOFF]: '/auth/cross-frontend-handoff',\n [ManualControllerRouteKey.AUTH_LOGOUT]: '/auth/logout',\n [ManualControllerRouteKey.AUTH_LOGOUT_ALL]: '/auth/logout-all',\n [ManualControllerRouteKey.AUTH_PASSWORD_RESET_REQUEST]: '/auth/password-reset/request',\n [ManualControllerRouteKey.AUTH_PASSWORD_RESET_COMPLETE]: '/auth/password-reset/complete',\n [ManualControllerRouteKey.AUTH_REGISTER]: '/auth/register',\n [ManualControllerRouteKey.AUTH_ACCEPT_INVITATION]: '/auth/invitation/accept',\n [ManualControllerRouteKey.AUTH_INVITATION_INFO]: '/auth/invitation/info',\n [ManualControllerRouteKey.AUTH_REJECT_INVITATION]: '/auth/invitation/reject',\n [ManualControllerRouteKey.AUTH_LIST_MY_INVITATIONS]: '/auth/invitations/mine',\n [ManualControllerRouteKey.AUTH_ACCEPT_MY_INVITATION]: '/auth/invitations/accept',\n [ManualControllerRouteKey.AUTH_REJECT_MY_INVITATION]: '/auth/invitations/reject',\n [ManualControllerRouteKey.AUTH_VERIFY_EMAIL]: '/auth/verify-email',\n [ManualControllerRouteKey.AUTH_SESSION_STATE]: '/auth/session/:sessionId',\n\n // Magic Link (Phase G2)\n [ManualControllerRouteKey.AUTH_MAGIC_LINK_SEND]: '/auth/magic-link/send',\n [ManualControllerRouteKey.AUTH_MAGIC_LINK_VERIFY]: '/auth/magic-link/verify',\n\n // SMS OTP (Phase G2)\n [ManualControllerRouteKey.AUTH_SMS_OTP_SEND]: '/auth/sms-otp/send',\n [ManualControllerRouteKey.AUTH_SMS_OTP_VERIFY]: '/auth/sms-otp/verify',\n\n // Phone Verification (Phase G2)\n [ManualControllerRouteKey.AUTH_PHONE_VERIFY_SEND]: '/auth/phone/verify/send',\n [ManualControllerRouteKey.AUTH_PHONE_VERIFY_CONFIRM]: '/auth/phone/verify/confirm',\n\n // Resend Verification Email (F5)\n [ManualControllerRouteKey.AUTH_RESEND_VERIFICATION]: '/auth/resend-verification',\n\n // W5.7: Complete org onboarding\n [ManualControllerRouteKey.AUTH_COMPLETE_ORG_ONBOARDING]: '/auth/onboarding/complete-org',\n\n // W7.3b: One-off session token management\n [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_CREATE]: '/apps/:applicationId/auth/one-off-session',\n [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_CREATE_ORG]: '/orgs/:organizationId/apps/:applicationId/auth/one-off-session',\n [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_EXCHANGE]: '/auth/one-off-session/exchange',\n [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_REVOKE]: '/apps/:applicationId/auth/one-off-session/:tokenId/revoke',\n [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_REVOKE_ORG]: '/orgs/:organizationId/apps/:applicationId/auth/one-off-session/:tokenId/revoke',\n\n // Method Management (#13f)\n [ManualControllerRouteKey.AUTH_PASSWORD_CHANGE]: '/auth/password/change',\n [ManualControllerRouteKey.AUTH_PASSWORD_SET]: '/auth/password/set',\n [ManualControllerRouteKey.AUTH_MFA_TOTP_DISABLE]: '/auth/mfa/totp/disable',\n [ManualControllerRouteKey.AUTH_METHODS_MINE]: '/auth/methods/mine',\n [ManualControllerRouteKey.AUTH_IDENTITY_LINKS_LIST]: '/auth/identity-links',\n [ManualControllerRouteKey.AUTH_IDENTITY_LINKS_UNLINK]: '/auth/identity-links/:linkId',\n [ManualControllerRouteKey.AUTH_REAUTH]: '/auth/reauth',\n [ManualControllerRouteKey.AUTH_REAUTH_PASSKEY_OPTIONS]: '/auth/reauth/passkey/options',\n\n // SAML Routes (AUTH-2)\n [ManualControllerRouteKey.AUTH_SAML_LOGIN]: '/auth/saml/login/:connectionId',\n [ManualControllerRouteKey.AUTH_SAML_ACS]: '/auth/saml/acs',\n [ManualControllerRouteKey.AUTH_SAML_METADATA]: '/auth/saml/metadata/:scopeType/:scopeId',\n [ManualControllerRouteKey.AUTH_SAML_SLO]: '/auth/saml/slo',\n [ManualControllerRouteKey.AUTH_SAML_SP_LOGOUT]: '/auth/saml/logout',\n\n [ManualControllerRouteKey.I18N_GET_LABELS]: '/i18n/labels',\n\n [ManualControllerRouteKey.CHARTS_DATA]: '/charts/:chartRef/data',\n\n // MFA — Email OTP (Step 10)\n [ManualControllerRouteKey.AUTH_MFA_EMAIL_OTP_SEND]: '/auth/mfa/email-otp/send',\n [ManualControllerRouteKey.AUTH_MFA_EMAIL_OTP_VERIFY]: '/auth/mfa/email-otp/verify',\n\n // MFA — TOTP (Step 11)\n [ManualControllerRouteKey.AUTH_MFA_TOTP_SETUP]: '/auth/mfa/totp/setup',\n [ManualControllerRouteKey.AUTH_MFA_TOTP_VERIFY_SETUP]: '/auth/mfa/totp/verify-setup',\n [ManualControllerRouteKey.AUTH_MFA_TOTP_VERIFY]: '/auth/mfa/totp/verify',\n\n // WebAuthn/Passkey Routes (Phase G1)\n [ManualControllerRouteKey.AUTH_PASSKEY_REGISTER_OPTIONS]: '/auth/passkey/register/options',\n [ManualControllerRouteKey.AUTH_PASSKEY_REGISTER_VERIFY]: '/auth/passkey/register/verify',\n [ManualControllerRouteKey.AUTH_PASSKEY_AUTH_OPTIONS]: '/auth/passkey/authenticate/options',\n [ManualControllerRouteKey.AUTH_PASSKEY_AUTH_VERIFY]: '/auth/passkey/authenticate/verify',\n [ManualControllerRouteKey.AUTH_PASSKEY_LIST]: '/auth/passkey/list',\n [ManualControllerRouteKey.AUTH_PASSKEY_REMOVE]: '/auth/passkey/remove',\n [ManualControllerRouteKey.AUTH_PASSKEY_RENAME]: '/auth/passkey/rename',\n\n [ManualControllerRouteKey.ANALYTICS_EVENTS]: '/analytics/events',\n [ManualControllerRouteKey.ANALYTICS_MOMENTS_ACHIEVED]: '/analytics/moments/achieved',\n\n [ManualControllerRouteKey.PROGRESSION_MILESTONES]: '/progression/milestones',\n [ManualControllerRouteKey.FEATURES_RESOLVED]: '/features/resolved',\n\n [ManualControllerRouteKey.FLOWS_ACTORS_FRONTEND_INFO]: '/flows-actors/frontend-info',\n [ManualControllerRouteKey.FLOWS_ACTORS_HISTORY]: '/flows-actors/history',\n\n // === A2A (external actor exposure) ===\n // Card served under the API mount, so with issuer `${publicUrl}${MAIN_API_BASE_PATH}`\n // a caller's `${issuer}/a2a/.well-known/agent-card.json` resolves here (a root-level\n // `/.well-known/agent-card.json` alias is a reverse-proxy concern).\n [ManualControllerRouteKey.A2A_AGENT_CARD]: '/a2a/.well-known/agent-card.json',\n [ManualControllerRouteKey.A2A_TASKS]: '/a2a',\n\n // === MCP (Model Context Protocol server) ===\n // JSON-RPC endpoint + RFC 9728 protected-resource metadata, served under the API mount. The\n // metadata's `resource` is `${publicUrl}${MAIN_API_BASE_PATH}/mcp`; a root-level\n // `/.well-known/oauth-protected-resource` alias is a reverse-proxy concern.\n [ManualControllerRouteKey.MCP_ENDPOINT]: '/mcp',\n [ManualControllerRouteKey.MCP_PROTECTED_RESOURCE_METADATA]: '/.well-known/oauth-protected-resource',\n};\n\n// =====================================================\n// Root-level engine routes (NOT under /api/v1)\n// These are mounted at the Express app root (e.g. /health/)\n// =====================================================\n\nexport enum EngineRootRouteKey {\n HEALTH_LIVENESS = 'HEALTH_LIVENESS',\n HEALTH_READINESS = 'HEALTH_READINESS',\n HEALTH_TIME = 'HEALTH_TIME',\n}\n\nexport const ENGINE_ROOT_ROUTES: Record<EngineRootRouteKey, string> = {\n [EngineRootRouteKey.HEALTH_LIVENESS]: '/health',\n [EngineRootRouteKey.HEALTH_READINESS]: '/health/ready',\n [EngineRootRouteKey.HEALTH_TIME]: '/health/time',\n};\n"]}
1	+ {"version":3,"file":"manual-controllers-routes-urls.js","sourceRoot":"","sources":["../../../src/requests/manual-controllers-routes-urls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,SAAS,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,sCAAsC,CAAC,UAAkB;IACvE,OAAO,+BAA+B,CAAC,4BAA4B,EAAE,UAAU,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,oCAAoC,CAAC,YAAoB;IACvE,OAAO,+BAA+B,CAAC,0BAA0B,EAAE,YAAY,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,+BAA+B,CAAC,gBAAwB,EAAE,IAAY;IAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,OAAO,gBAAgB,gBAAgB,GAAG,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,UAAU,EAAE,EAAE,CAAC;AAC9H,CAAC;AAED,MAAM,CAAN,IAAY,wBAoUX;AApUD,WAAY,wBAAwB;IAClC,6EAAiD,CAAA;IAEjD,2DAA+B,CAAA;IAC/B,qFAAyD,CAAA;IACzD,mEAAuC,CAAA;IACvC,qEAAyC,CAAA;IACzC,2EAA+C,CAAA;IAC/C,yEAA6C,CAAA;IAE7C;;;;;;;OAOG;IACH,mFAAuD,CAAA;IACvD;;;;;;;OAOG;IACH,yFAA6D,CAAA;IAC7D;;;;;;;;;;OAUG;IACH;;;;;;;;;;;;;;;;;;;OAmBG;IACH,yFAA6D,CAAA;IAC7D,2FAA+D,CAAA;IAC/D;;;;;;;;;;;OAWG;IACH,yGAA6E,CAAA;IAC7E;;;;;;;;;;OAUG;IACH,iGAAqE,CAAA;IACrE,kFAAkF;IAClF,2FAA+D,CAAA;IAC/D,2FAA+D,CAAA;IAC/D,uEAA2C,CAAA;IAC3C;;;;OAIG;IACH,yEAA6C,CAAA;IAC7C,wFAAwF;IACxF,iFAAqD,CAAA;IACrD;;;;OAIG;IACH,qFAAyD,CAAA;IACzD,2FAA2F;IAC3F,uEAA2C,CAAA;IAC3C,gGAAgG;IAChG,iFAAqD,CAAA;IACrD;;;;OAIG;IACH,6EAAiD,CAAA;IACjD,iFAAiF;IACjF,+EAAmD,CAAA;IACnD,sDAAsD;IACtD,2EAA+C,CAAA;IAC/C;;;;;OAKG;IACH,qFAAyD,CAAA;IACzD;;;;;;;;OAQG;IACH,qGAAyE,CAAA;IACzE;;;;;OAKG;IACH,+EAAmD,CAAA;IACnD;;;;;;;;;;;;OAYG;IACH,6FAAiE,CAAA;IACjE;;;;;;OAMG;IACH,uFAA2D,CAAA;IAC3D,uDAA2B,CAAA;IAC3B,2HAA2H;IAC3H,+DAAmC,CAAA;IACnC,uFAA2D,CAAA;IAC3D,yFAA6D,CAAA;IAC7D,2DAA+B,CAAA;IAC/B,6EAAiD,CAAA;IACjD,8EAA8E;IAC9E,gFAAgF;IAChF,8EAA8E;IAC9E,yEAA6C,CAAA;IAC7C,6EAAiD,CAAA;IACjD,qFAAqF;IACrF,2FAA2F;IAC3F,iFAAqD,CAAA;IACrD,mFAAuD,CAAA;IACvD,mFAAuD,CAAA;IACvD,mEAAuC,CAAA;IACvC,qEAAyC,CAAA;IAEzC,4BAA4B;IAC5B,+EAAmD,CAAA;IACnD,mFAAuD,CAAA;IAEvD,uBAAuB;IACvB,uEAA2C,CAAA;IAC3C,qFAAyD,CAAA;IACzD,yEAA6C,CAAA;IAE7C,qCAAqC;IACrC,2FAA+D,CAAA;IAC/D,yFAA6D,CAAA;IAC7D,mFAAuD,CAAA;IACvD,iFAAqD,CAAA;IACrD,mEAAuC,CAAA;IACvC,uEAA2C,CAAA;IAC3C,uEAA2C,CAAA;IAE3C,wBAAwB;IACxB,yEAA6C,CAAA;IAC7C,6EAAiD,CAAA;IAEjD,qBAAqB;IACrB,mEAAuC,CAAA;IACvC,uEAA2C,CAAA;IAE3C,gCAAgC;IAChC,6EAAiD,CAAA;IACjD,mFAAuD,CAAA;IAEvD,iCAAiC;IACjC,iFAAqD,CAAA;IAErD,wDAAwD;IACxD,yFAA6D,CAAA;IAE7D,0CAA0C;IAC1C,uFAA2D,CAAA;IAC3D,+FAAmE,CAAA;IACnE,2FAA+D,CAAA;IAC/D,uFAA2D,CAAA;IAC3D,+FAAmE,CAAA;IAEnE,2BAA2B;IAC3B,yEAA6C,CAAA;IAC7C,mEAAuC,CAAA;IACvC,2EAA+C,CAAA;IAC/C,mEAAuC,CAAA;IACvC,iFAAqD,CAAA;IACrD,qFAAyD,CAAA;IACzD,uDAA2B,CAAA;IAC3B,4GAA4G;IAC5G,uFAA2D,CAAA;IAE3D,uBAAuB;IACvB,+DAAmC,CAAA;IACnC,2DAA+B,CAAA;IAC/B,qEAAyC,CAAA;IACzC,2DAA+B,CAAA;IAC/B,kPAAkP;IAClP,uEAA2C,CAAA;IAC3C,iEAAqC,CAAA;IAErC;;;;;;;;OAQG;IACH,gGAAgG;IAChG,mFAAuD,CAAA;IACvD,8EAA8E;IAC9E,mFAAuD,CAAA;IACvD;;;;OAIG;IACH,qDAAyB,CAAA;IACzB,yEAAyE;IACzE,6DAAiC,CAAA;IACjC,wDAAwD;IACxD,uDAA2B,CAAA;IAE3B,+DAAmC,CAAA;IAEnC,uDAA2B,CAAA;IAE3B,iEAAqC,CAAA;IACrC,qFAAyD,CAAA;IAEzD,6EAAiD,CAAA;IACjD,mEAAuC,CAAA;IAEvC,yEAAyE;IACzE,qFAAyD,CAAA;IACzD,qEAAqE;IACrE,yEAA6C,CAAA;IAE7C,+DAA+D;IAC/D;;;;;OAKG;IACH,6DAAiC,CAAA;IACjC;;;;OAIG;IACH,mDAAuB,CAAA;IAEvB,6EAA6E;IAC7E;;;;;;;;;OASG;IACH,yDAA6B,CAAA;IAC7B;;;;;;;;;OASG;IACH,+FAAmE,CAAA;AACrE,CAAC,EApUW,wBAAwB,KAAxB,wBAAwB,QAoUnC;AAED,MAAM,CAAC,MAAM,6BAA6B,GAA6C;IACrF,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,qBAAqB;IAExE,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,gBAAgB;IAC1D,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,6BAA6B;IACpF,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAClE,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE,qBAAqB;IACpE,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE,qCAAqC;IACvF,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,oCAAoC;IAErF,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,iCAAiC;IACvF,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,uBAAuB;IAChF,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,uBAAuB;IAChF,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,cAAc;IACxE,CAAC,wBAAwB,CAAC,oCAAoC,CAAC,EAAE,sCAAsC;IACvG,CAAC,wBAAwB,CAAC,gCAAgC,CAAC,EAAE,wCAAwC;IACrG,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,iDAAiD;IAC3G,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,8CAA8C;IACxG,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,sBAAsB;IACtE,qEAAqE;IACrE,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,cAAc;IAC/D,wGAAwG;IACxG,kGAAkG;IAClG,oGAAoG;IACpG,gGAAgG;IAChG,qGAAqG;IACrG,oGAAoG;IACpG,6EAA6E;IAC7E,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,mCAAmC;IACxF,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,yCAAyC;IAChG,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,aAAa;IAC7D,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,kBAAkB;IACvE,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,2BAA2B;IAC9E,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,EAAE,iBAAiB;IACrE,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE,eAAe;IACjE,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,oBAAoB;IAC3E,CAAC,wBAAwB,CAAC,kCAAkC,CAAC,EAAE,4BAA4B;IAC3F,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,EAAE,iBAAiB;IACrE,CAAC,wBAAwB,CAAC,8BAA8B,CAAC,EAAE,2BAA2B;IACtF,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,8BAA8B;IACtF,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,cAAc;IACtD,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE,kBAAkB;IAC9D,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,8BAA8B;IACtF,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,+BAA+B;IACxF,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,gBAAgB;IAC1D,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,yBAAyB;IAC5E,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,uBAAuB;IACxE,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,yBAAyB;IAC5E,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,wBAAwB;IAC7E,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,0BAA0B;IAChF,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,0BAA0B;IAChF,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAClE,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE,0BAA0B;IAEzE,wBAAwB;IACxB,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,uBAAuB;IACxE,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,yBAAyB;IAE5E,qBAAqB;IACrB,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAClE,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,sBAAsB;IAEtE,gCAAgC;IAChC,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,yBAAyB;IAC5E,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,4BAA4B;IAElF,iCAAiC;IACjC,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,2BAA2B;IAEhF,gCAAgC;IAChC,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,+BAA+B;IAExF,0CAA0C;IAC1C,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,2CAA2C;IACnG,CAAC,wBAAwB,CAAC,+BAA+B,CAAC,EAAE,gEAAgE;IAC5H,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,gCAAgC;IAC1F,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,2DAA2D;IACnH,CAAC,wBAAwB,CAAC,+BAA+B,CAAC,EAAE,gFAAgF;IAE5I,2BAA2B;IAC3B,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,uBAAuB;IACxE,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAClE,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE,wBAAwB;IAC1E,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAClE,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,sBAAsB;IAC3E,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,8BAA8B;IACrF,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,cAAc;IACtD,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,8BAA8B;IAEtF,uBAAuB;IACvB,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE,gCAAgC;IAC5E,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,gBAAgB;IAC1D,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE,yCAAyC;IACxF,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,gBAAgB;IAC1D,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,mBAAmB;IACnE,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,EAAE,mBAAmB;IAEhE,mGAAmG;IACnG,+FAA+F;IAC/F,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,6BAA6B;IACnF,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,+BAA+B;IACrF,CAAC,wBAAwB,CAAC,UAAU,CAAC,EAAE,gBAAgB;IACvD,CAAC,wBAAwB,CAAC,cAAc,CAAC,EAAE,yBAAyB;IACpE,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,sBAAsB;IAE9D,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE,cAAc;IAE1D,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,wBAAwB;IAEhE,4BAA4B;IAC5B,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,EAAE,0BAA0B;IAC9E,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,4BAA4B;IAElF,uBAAuB;IACvB,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,sBAAsB;IACtE,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,6BAA6B;IACpF,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,uBAAuB;IAExE,qCAAqC;IACrC,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,gCAAgC;IAC1F,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,+BAA+B;IACxF,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,oCAAoC;IAC1F,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,mCAAmC;IACxF,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAClE,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,sBAAsB;IACtE,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,sBAAsB;IAEtE,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,EAAE,mBAAmB;IAChE,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,6BAA6B;IAEpF,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,yBAAyB;IAC5E,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAElE,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,6BAA6B;IACpF,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,uBAAuB;IAExE,wCAAwC;IACxC,sFAAsF;IACtF,qFAAqF;IACrF,oEAAoE;IACpE,CAAC,wBAAwB,CAAC,cAAc,CAAC,EAAE,kCAAkC;IAC7E,CAAC,wBAAwB,CAAC,SAAS,CAAC,EAAE,MAAM;IAE5C,8CAA8C;IAC9C,4FAA4F;IAC5F,iFAAiF;IACjF,4EAA4E;IAC5E,CAAC,wBAAwB,CAAC,YAAY,CAAC,EAAE,MAAM;IAC/C,CAAC,wBAAwB,CAAC,+BAA+B,CAAC,EAAE,uCAAuC;CACpG,CAAC;AAEF,wDAAwD;AACxD,+CAA+C;AAC/C,6DAA6D;AAC7D,wDAAwD;AAExD,MAAM,CAAN,IAAY,kBAIX;AAJD,WAAY,kBAAkB;IAC5B,yDAAmC,CAAA;IACnC,2DAAqC,CAAA;IACrC,iDAA2B,CAAA;AAC7B,CAAC,EAJW,kBAAkB,KAAlB,kBAAkB,QAI7B;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAuC;IACpE,CAAC,kBAAkB,CAAC,eAAe,CAAC,EAAE,SAAS;IAC/C,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,eAAe;IACtD,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE,cAAc;CACjD,CAAC","sourcesContent":["/*\n Manual Controllers Routes URLs\n * Centralized URL declarations for custom/manual controllers\n * Shared between backend and frontend to avoid string duplication.\n \n Notes:\n * - These URLs are mounted under {@link MAIN_API_BASE_PATH}\n * - Keep only path segments here (no `MAIN_API_BASE_PATH` prefix) — the\n * prefix is prepended once at each boundary (backend mount / frontend client)\n /\n\n/\n Main API base path — the mount prefix under which the entire main\n * controllers registry is served (every resource route AND every\n * {@link MANUAL_CONTROLLER_ROUTES_URLS} entry).\n \n This is the SINGLE SOURCE OF TRUTH for the prefix. It is consumed by:\n * - the backend HTTP server mount (`app.use(MAIN_API_BASE_PATH, mainRouter)`),\n * - the frontend HTTP client when building absolute API URLs\n * (`${MAIN_API_BASE_PATH}${MANUAL_CONTROLLER_ROUTES_URLS[...]}`),\n * - the refresh-token cookie `Path` scope, which MUST path-match the served\n * auth routes (`${MAIN_API_BASE_PATH}/auth/`) or the browser drops it.\n \n * Why a shared symbol and not a literal: previously `/api/v1` was a literal\n * duplicated across the mount and the client. The absence of a shared symbol\n * let the refresh-token cookie `Path` be authored against the bare route\n * segment (`/auth`, omitting this prefix), so the browser stored the cookie\n * but never sent it to `/api/v1/auth/token/refresh` — silently breaking token\n * refresh for every session (forced logout on first refresh). Deriving every\n * prefix consumer from this constant closes that drift class.\n \n NOT under this prefix: the root-level engine routes in\n * {@link ENGINE_ROOT_ROUTES} (health/time probes), mounted at the app root.\n /\nexport const MAIN_API_BASE_PATH = '/api/v1';\n\n/\n Where RFC 8414 authorization-server metadata must be served for an issuer that carries a PATH.\n \n The rule is counter-intuitive and is the reason this exists as a named derivation rather than a\n * string built at the call site: the well-known segment goes BETWEEN the host and the issuer path,\n * not after it.\n \n \"If the issuer identifier value contains a path component, any terminating \"/\" MUST be removed\n * before inserting \"/.well-known/\" and the well-known URI suffix between the host component and\n * the path component.\"\n \n with the RFC's own worked example resolving issuer `https://example.com/issuer1` to\n * `GET /.well-known/oauth-authorization-server/issuer1`.\n * spec-cite: RFC 8414 § 3 (Obtaining Authorization Server Metadata), fetched 2026-08-11.\n \n OIDC Discovery uses the OPPOSITE construction — issuer + `/.well-known/openid-configuration` — so\n * the two cannot share one path and a server that serves only the OIDC shape fails RFC 8414 discovery\n * while looking correct. That is exactly what happened here: a real MCP client split our issuer at the\n * host boundary as the RFC instructs, asked for `/.well-known/oauth-authorization-server/api/v1`,\n * received the SPA shell, and abandoned authorization without ever opening a browser.\n \n @param issuerPath the issuer's path component (e.g. {@link MAIN_API_BASE_PATH}); a bare `/` or an\n * empty string yields the origin-root location, which is the path-less issuer case.\n /\nexport function rfc8414AuthorizationServerMetadataPath(issuerPath: string): string {\n return wellKnownPathBeforeResourcePath('oauth-authorization-server', issuerPath);\n}\n\n/\n Where RFC 9728 protected-resource metadata must be served for a resource identifier that carries a\n * PATH — the same insertion rule as {@link rfc8414AuthorizationServerMetadataPath}, for the other\n * document.\n \n \"The protected resource's well-known URI is created by inserting\n * /.well-known/oauth-protected-resource between the host component and the path component (if any)\n * of the resource identifier.\"\n * spec-cite: RFC 9728 § 3 (Protected Resource Metadata Request), fetched 2026-08-12.\n \n This is a SECOND discovery route, not a replacement for the one the challenge names. RFC 9728 § 5.1\n * lets a client take `resource_metadata` straight from the `WWW-Authenticate` header, and MCP tells\n * clients to do exactly that — which is why serving only the header's location worked with a real\n * client and is a defensible posture. It is nevertheless not the whole contract: a client that derives\n * the location from the resource identifier, as this section permits, previously received the SPA\n * shell. Both locations now serve one document.\n \n Note the asymmetry with RFC 8414, because it explains why that one was a live outage and this one\n * was latent: an authorization server publishes no equivalent pointer, so derivation is a client's\n * ONLY route to AS metadata.\n \n @param resourcePath the resource identifier's path component (e.g. `/api/v1/mcp`); a bare `/` or an\n * empty string yields the origin-root location, which is the path-less case.\n /\nexport function rfc9728ProtectedResourceMetadataPath(resourcePath: string): string {\n return wellKnownPathBeforeResourcePath('oauth-protected-resource', resourcePath);\n}\n\n/\n The construction RFC 8414 § 3 and RFC 9728 § 3 both specify: strip any terminating `/`, then insert\n * the well-known segment BETWEEN the host and the path.\n \n Shared deliberately rather than written twice. The rule is counter-intuitive enough that it was\n * already implemented wrongly once here, and a second hand-rolled copy is how the two documents would\n * come to disagree about a rule they take verbatim from each other.\n /\nfunction wellKnownPathBeforeResourcePath(wellKnownSegment: string, path: string): string {\n const normalized = path.replace(/\\/+$/, '');\n return `/.well-known/${wellKnownSegment}${normalized.startsWith('/') \|\| normalized === '' ? normalized : `/${normalized}`}`;\n}\n\nexport enum ManualControllerRouteKey {\n APPLICATION_CONFIG_GET = 'APPLICATION_CONFIG_GET',\n\n AUTH_IDENTIFY = 'AUTH_IDENTIFY',\n AUTH_AUTHENTICATE_PASSWORD = 'AUTH_AUTHENTICATE_PASSWORD',\n AUTH_AUTHENTICATE = 'AUTH_AUTHENTICATE',\n AUTH_TOKEN_REFRESH = 'AUTH_TOKEN_REFRESH',\n AUTH_OAUTH2_AUTHORIZE = 'AUTH_OAUTH2_AUTHORIZE',\n AUTH_OAUTH2_CALLBACK = 'AUTH_OAUTH2_CALLBACK',\n\n /\n OUTBOUND connections — this application acting as somebody toward a third party.\n \n Easy to confuse with {@link AUTH_OAUTH2_AUTHORIZE} above and the exact opposite direction: that\n * pair signs a person INTO this application using a vendor as the identity provider, this pair\n * connects a vendor account so this application can act as that account. Same protocol, opposite\n * arrow, and nothing is shared between them but the RFC.\n /\n PROVIDER_CONNECTION_START = 'PROVIDER_CONNECTION_START',\n /\n The single redirect URI for EVERY provider, keyed by `state` rather than by a path segment.\n \n One URI, deliberately. A redirect URI must be registered at the vendor before it is accepted, so\n * a per-provider path would mean registering 129 distinct URIs — by hand, per deployment, per\n * environment. The `state` already has to be unguessable and single-use for CSRF, and it already\n * identifies the attempt, so it identifies the provider too at no extra cost.\n /\n PROVIDER_CONNECTION_CALLBACK = 'PROVIDER_CONNECTION_CALLBACK',\n /\n What this caller may connect, and under which owner scopes.\n \n Without it a settings screen cannot offer Connect at all: the credential LIST answers what a\n * person HAS connected, and nothing answers what they COULD. The two are different questions and\n * the empty answer to the first — the state everybody starts in — is exactly when the second one\n * matters.\n \n Admissibility is a RECORDED DECISION per provider, never derived from a vendor's API surface, so\n * this route reports a decision rather than computing one.\n /\n /\n Finish an authorization the vendor has just approved — the half the CALLBACK cannot do.\n \n The callback is reached by a top-level navigation from the vendor's origin, so it carries no\n * `Authorization` header and never can: a header is set by script on a fetch, and a redirect is\n * not a fetch. The application's only auth cookie is `SameSite=Strict` on `Path=/api/v1/auth`, so\n * it is not sent there either. The callback therefore cannot know WHO is finishing the flow, and\n * for a while it asked anyway — every consent answered `401 UNAUTHENTICATED` and the person saw a\n * JSON body, with the attempt already consumed so they could not even retry.\n \n Splitting it puts the authenticated act back on a FETCH, where a bearer token exists. The\n * callback hands `state` and `code` to the frontend and authenticates nobody; the frontend, which\n * holds the token, posts them here. Nothing about the guarantee is relaxed — this route consumes\n * the attempt atomically, re-checks that the finisher is the initiator, and only then exchanges.\n \n Rejected: binding the attempt to a browser with a second `SameSite=Lax` cookie. It is the\n * ordinary OAuth-client pattern and it would work, but this application authenticates its API with\n * bearer tokens and nothing else, and a second auth-bearing cookie is an architectural addition\n * whose `SameSite` behaviour then has to be reasoned about separately for every deployment shape.\n /\n PROVIDER_CONNECTION_COMPLETE = 'PROVIDER_CONNECTION_COMPLETE',\n PROVIDER_CONNECTION_CATALOGUE = 'PROVIDER_CONNECTION_CATALOGUE',\n /\n Store a credential somebody TYPED, for a vendor with no authorization flow.\n \n The sibling of {@link PROVIDER_CONNECTION_START}, and a separate route because the acts differ\n * completely: one hands back a URL and ends in a redirect from a vendor, this one takes values and\n * ends in a stored row. Sharing a route would mean a body whose meaning depends on a provider's\n * contract, which is how a caller ends up sending an access token where a client id belongs.\n \n It exists on the BACKEND rather than being a generic resource create because this is where\n * \"nothing is typed by hand\" stops being a screen's good manners and becomes enforceable: the route\n * refuses any slug the provider did not declare as identifying an account.\n /\n PROVIDER_CONNECTION_STORE_CREDENTIAL = 'PROVIDER_CONNECTION_STORE_CREDENTIAL',\n /\n A short-lived access token for the CALLER's own connected account, handed to the browser (#394 P4).\n \n The one shape of credential a browser may ever be handed, and the reason it is a route of its\n * own: a vendor's picker (Drive's, for one) authorizes as the signed-in user and cannot render\n * without that user's token — so the token is in the browser during picking whether the selected\n * bytes are later fetched by the backend or not. Everything else about the grant stays server-side:\n * the refresh token never crosses, the row is resolved as the caller and nobody else, and every\n * hand-out is a recorded USE of the credential, which is what makes revocation and erasure mean\n * something for a token that has left the process.\n /\n PROVIDER_CONNECTION_ACCESS_TOKEN = 'PROVIDER_CONNECTION_ACCESS_TOKEN',\n /* Enterprise SSO: initiate OAuth2 flow for an org's OIDC connection (Step 15) /\n AUTH_ENTERPRISE_SSO_AUTHORIZE = 'AUTH_ENTERPRISE_SSO_AUTHORIZE',\n AUTH_APP_ENTERPRISE_AUTHORIZE = 'AUTH_APP_ENTERPRISE_AUTHORIZE',\n AUTH_TOKEN_EXCHANGE = 'AUTH_TOKEN_EXCHANGE',\n /\n OAuth 2.0 Authorization Server token endpoint (Wildo-AS-PROVIDER, distinct from the\n * RP-side `/auth/` routes). Serves `grant_type=client_credentials` now; the OIDC branch\n adds `authorization_code`. Served at `${MAIN_API_BASE_PATH}/oauth/token`.\n /\n OAUTH_PROVIDER_TOKEN = 'OAUTH_PROVIDER_TOKEN',\n /* OIDC discovery document (served at `${issuer}/.well-known/openid-configuration`). /\n OAUTH_PROVIDER_DISCOVERY = 'OAUTH_PROVIDER_DISCOVERY',\n /\n RFC 8414 Authorization Server Metadata (`${issuer}/.well-known/oauth-authorization-server`) —\n * the SAME document as {@link OAUTH_PROVIDER_DISCOVERY}, served at the OAuth-2 well-known path that\n * many OAuth/MCP clients probe FIRST (before the OIDC path). Aliases the discovery handler.\n /\n OAUTH_PROVIDER_AS_METADATA = 'OAUTH_PROVIDER_AS_METADATA',\n /* JSON Web Key Set for verifying Wildo-issued tokens (the discovery doc's `jwks_uri`). /\n OAUTH_PROVIDER_JWKS = 'OAUTH_PROVIDER_JWKS',\n /* OIDC authorization endpoint (authorization_code flow — the caller lands here to consent). /\n OAUTH_PROVIDER_AUTHORIZE = 'OAUTH_PROVIDER_AUTHORIZE',\n /\n OIDC interactive-consent decision endpoint. When the authorize endpoint returned\n * `consent_required` for a `requiresConsent` client, the user's approve/deny decision is POSTed\n * here with the single-use consent-request token; APPROVE mints the authorization code.\n /\n OAUTH_PROVIDER_CONSENT = 'OAUTH_PROVIDER_CONSENT',\n /* OIDC UserInfo endpoint (bearer access token → the user's standard claims). /\n OAUTH_PROVIDER_USERINFO = 'OAUTH_PROVIDER_USERINFO',\n /* OAuth 2.0 token revocation endpoint (RFC 7009). /\n OAUTH_PROVIDER_REVOKE = 'OAUTH_PROVIDER_REVOKE',\n /\n OIDC RP-Initiated Logout 1.0 `end_session_endpoint` (revocation-C). A relying party redirects the\n * End-User here (with an `id_token_hint`) to terminate their Wildo OP login session — the exact\n * session the delegation was authorized from, keyed on the id_token's `sid`. Distinct from\n * {@link OAUTH_PROVIDER_REVOKE}: revoke kills a TOKEN (RFC 7009); end_session ends a SESSION.\n /\n OAUTH_PROVIDER_END_SESSION = 'OAUTH_PROVIDER_END_SESSION',\n /\n OIDC RP-Initiated Logout 1.0 §6 confirmation decision (revocation-C). The `POST` the frontend\n * `/oauth/logout-confirm` prompt calls to actually terminate the session, presenting the single-use\n * `OIDC_LOGOUT_CONFIRMATION` token minted by {@link OAUTH_PROVIDER_END_SESSION}. Token-authorized\n * (no Bearer — the End-User may be unauthenticated in the SPA, having arrived via an RP redirect);\n * returns `{ redirect_to }` (always the same-origin signed-out page `/oauth/logged-out`; the SPA\n * navigates there). Only reached for NON-trusted logouts — a trusted RP logout terminates + redirects\n * inline without a prompt (the Keycloak-style posture).\n /\n OAUTH_PROVIDER_END_SESSION_CONFIRM = 'OAUTH_PROVIDER_END_SESSION_CONFIRM',\n /\n RFC 7591 dynamic client registration. Registered UNCONDITIONALLY so the route always exists;\n * the handler answers 404 unless the application opted in via `auth.dynamicClientRegistration`.\n * Registering it conditionally would make the route table depend on config, which is far harder\n * to reason about than one handler that refuses.\n /\n OAUTH_PROVIDER_REGISTER = 'OAUTH_PROVIDER_REGISTER',\n /\n RFC 7592 client configuration endpoint — a dynamically registered client reads, updates or\n * deletes its OWN registration, authenticating with the registration access token it was issued\n * at registration.\n \n One key for three verbs (GET / PUT / DELETE) because RFC 7592 §2 defines ONE endpoint whose\n * method selects the operation; splitting it into three keys would invent a distinction the\n * specification does not make and put the same URL in the table three times.\n \n Registered unconditionally, like `/oauth/register`, and gated by the same\n * `auth.dynamicClientRegistration` opt-in in the handler — a route table that depends on config is\n * harder to reason about than a handler that refuses.\n /\n OAUTH_PROVIDER_REGISTER_CLIENT = 'OAUTH_PROVIDER_REGISTER_CLIENT',\n /\n Cross-frontend session handoff (cross-app-jwt-propagation Step 2).\n * Authenticated user requests a one-time AUTH_CODE_EXCHANGE token bound to a\n * target frontend, then redirects the browser to the target's\n * /auth/exchange page with the code. Bearer-only; CORS auto-allowed for every\n * declared frontendService via the existing deriveCorsOrigins() seam.\n /\n AUTH_CROSS_FRONTEND_HANDOFF = 'AUTH_CROSS_FRONTEND_HANDOFF',\n AUTH_LOGOUT = 'AUTH_LOGOUT',\n /* Sign-out-everywhere: fences the whole user — all access + refresh tokens, every device — via the invalidation fence. /\n AUTH_LOGOUT_ALL = 'AUTH_LOGOUT_ALL',\n AUTH_PASSWORD_RESET_REQUEST = 'AUTH_PASSWORD_RESET_REQUEST',\n AUTH_PASSWORD_RESET_COMPLETE = 'AUTH_PASSWORD_RESET_COMPLETE',\n AUTH_REGISTER = 'AUTH_REGISTER',\n AUTH_ACCEPT_INVITATION = 'AUTH_ACCEPT_INVITATION',\n // Public token-keyed invitation-accept DISCOVERY (non-consuming): returns the\n // invited org's available auth methods + SSO/SCIM management mode so the accept\n // screen can render the right chooser. Read-only; does NOT consume the token.\n AUTH_INVITATION_INFO = 'AUTH_INVITATION_INFO',\n AUTH_REJECT_INVITATION = 'AUTH_REJECT_INVITATION',\n // In-app authenticated invitation management (Approach P) — a signed-in user acts on\n // THEIR OWN pending invitations (authorized by email-ownership), no token, no new session.\n AUTH_LIST_MY_INVITATIONS = 'AUTH_LIST_MY_INVITATIONS',\n AUTH_ACCEPT_MY_INVITATION = 'AUTH_ACCEPT_MY_INVITATION',\n AUTH_REJECT_MY_INVITATION = 'AUTH_REJECT_MY_INVITATION',\n AUTH_VERIFY_EMAIL = 'AUTH_VERIFY_EMAIL',\n AUTH_SESSION_STATE = 'AUTH_SESSION_STATE',\n\n // MFA — Email OTP (Step 10)\n AUTH_MFA_EMAIL_OTP_SEND = 'AUTH_MFA_EMAIL_OTP_SEND',\n AUTH_MFA_EMAIL_OTP_VERIFY = 'AUTH_MFA_EMAIL_OTP_VERIFY',\n\n // MFA — TOTP (Step 11)\n AUTH_MFA_TOTP_SETUP = 'AUTH_MFA_TOTP_SETUP',\n AUTH_MFA_TOTP_VERIFY_SETUP = 'AUTH_MFA_TOTP_VERIFY_SETUP',\n AUTH_MFA_TOTP_VERIFY = 'AUTH_MFA_TOTP_VERIFY',\n\n // WebAuthn/Passkey Routes (Phase G1)\n AUTH_PASSKEY_REGISTER_OPTIONS = 'AUTH_PASSKEY_REGISTER_OPTIONS',\n AUTH_PASSKEY_REGISTER_VERIFY = 'AUTH_PASSKEY_REGISTER_VERIFY',\n AUTH_PASSKEY_AUTH_OPTIONS = 'AUTH_PASSKEY_AUTH_OPTIONS',\n AUTH_PASSKEY_AUTH_VERIFY = 'AUTH_PASSKEY_AUTH_VERIFY',\n AUTH_PASSKEY_LIST = 'AUTH_PASSKEY_LIST',\n AUTH_PASSKEY_REMOVE = 'AUTH_PASSKEY_REMOVE',\n AUTH_PASSKEY_RENAME = 'AUTH_PASSKEY_RENAME',\n\n // Magic Link (Phase G2)\n AUTH_MAGIC_LINK_SEND = 'AUTH_MAGIC_LINK_SEND',\n AUTH_MAGIC_LINK_VERIFY = 'AUTH_MAGIC_LINK_VERIFY',\n\n // SMS OTP (Phase G2)\n AUTH_SMS_OTP_SEND = 'AUTH_SMS_OTP_SEND',\n AUTH_SMS_OTP_VERIFY = 'AUTH_SMS_OTP_VERIFY',\n\n // Phone Verification (Phase G2)\n AUTH_PHONE_VERIFY_SEND = 'AUTH_PHONE_VERIFY_SEND',\n AUTH_PHONE_VERIFY_CONFIRM = 'AUTH_PHONE_VERIFY_CONFIRM',\n\n // Resend Verification Email (F5)\n AUTH_RESEND_VERIFICATION = 'AUTH_RESEND_VERIFICATION',\n\n // W5.7: Complete org onboarding (deferred org creation)\n AUTH_COMPLETE_ORG_ONBOARDING = 'AUTH_COMPLETE_ORG_ONBOARDING',\n\n // W7.3b: One-off session token management\n AUTH_ONE_OFF_SESSION_CREATE = 'AUTH_ONE_OFF_SESSION_CREATE',\n AUTH_ONE_OFF_SESSION_CREATE_ORG = 'AUTH_ONE_OFF_SESSION_CREATE_ORG',\n AUTH_ONE_OFF_SESSION_EXCHANGE = 'AUTH_ONE_OFF_SESSION_EXCHANGE',\n AUTH_ONE_OFF_SESSION_REVOKE = 'AUTH_ONE_OFF_SESSION_REVOKE',\n AUTH_ONE_OFF_SESSION_REVOKE_ORG = 'AUTH_ONE_OFF_SESSION_REVOKE_ORG',\n\n // Method Management (#13f)\n AUTH_PASSWORD_CHANGE = 'AUTH_PASSWORD_CHANGE',\n AUTH_PASSWORD_SET = 'AUTH_PASSWORD_SET',\n AUTH_MFA_TOTP_DISABLE = 'AUTH_MFA_TOTP_DISABLE',\n AUTH_METHODS_MINE = 'AUTH_METHODS_MINE',\n AUTH_IDENTITY_LINKS_LIST = 'AUTH_IDENTITY_LINKS_LIST',\n AUTH_IDENTITY_LINKS_UNLINK = 'AUTH_IDENTITY_LINKS_UNLINK',\n AUTH_REAUTH = 'AUTH_REAUTH',\n /* Challenge leg of a PASSKEY step-up: WebAuthn is challenge-response, so re-auth needs two round-trips. /\n AUTH_REAUTH_PASSKEY_OPTIONS = 'AUTH_REAUTH_PASSKEY_OPTIONS',\n\n // SAML Routes (AUTH-2)\n AUTH_SAML_LOGIN = 'AUTH_SAML_LOGIN',\n AUTH_SAML_ACS = 'AUTH_SAML_ACS',\n AUTH_SAML_METADATA = 'AUTH_SAML_METADATA',\n AUTH_SAML_SLO = 'AUTH_SAML_SLO',\n /* SP-INITIATED SLO kickoff: the app asks the backend to log the caller out of their SAML session and (when the IdP supports it) redirect to the IdP's SLO endpoint. Distinct from AUTH_SAML_SLO, which is the INBOUND endpoint the IdP calls. /\n AUTH_SAML_SP_LOGOUT = 'AUTH_SAML_SP_LOGOUT',\n AUTH_OIDC_LOGOUT = 'AUTH_OIDC_LOGOUT',\n\n /\n Direct file transfer, distinct from the resource registry's own file routes.\n \n A resource's `/…/{id}/files/{field}` routes upload and replace the file BOUND TO A FIELD; these\n * five address a stored file by its own id, wherever it is attached. They lived as literal path\n * strings inside the file controller until 2026-09-09, which is exactly the duplication this\n * registry exists to remove — and it also kept them out of every mechanism keyed on this\n * vocabulary, the generated API reference included.\n /\n /* Public, token-authenticated status read for an upload grant. The token IS the credential. /\n FILES_UPLOAD_GRANT_STATUS = 'FILES_UPLOAD_GRANT_STATUS',\n /* Revoke an upload grant, addressed by its id — never by the token value. /\n FILES_UPLOAD_GRANT_REVOKE = 'FILES_UPLOAD_GRANT_REVOKE',\n /\n One stored file addressed by id. ONE key for two verbs (GET downloads it, DELETE removes it)\n * because Express matches one path and the method selects the operation — the same reasoning as\n * {@link OAUTH_PROVIDER_REGISTER_CLIENT}. Splitting it would put one URL in the table twice.\n /\n FILES_ITEM = 'FILES_ITEM',\n /* The stored file's metadata record, without transferring its bytes. /\n FILES_METADATA = 'FILES_METADATA',\n /* Mint a time-limited share link for a stored file. /\n FILES_SHARE = 'FILES_SHARE',\n\n I18N_GET_LABELS = 'I18N_GET_LABELS',\n\n CHARTS_DATA = 'CHARTS_DATA',\n\n ANALYTICS_EVENTS = 'ANALYTICS_EVENTS',\n ANALYTICS_MOMENTS_ACHIEVED = 'ANALYTICS_MOMENTS_ACHIEVED',\n\n PROGRESSION_MILESTONES = 'PROGRESSION_MILESTONES',\n FEATURES_RESOLVED = 'FEATURES_RESOLVED',\n\n /* Frontend-visible flow/actor systems (metadata + renderable graph). /\n FLOWS_ACTORS_FRONTEND_INFO = 'FLOWS_ACTORS_FRONTEND_INFO',\n /* The caller's own conversation history for a flow/actor system. /\n FLOWS_ACTORS_HISTORY = 'FLOWS_ACTORS_HISTORY',\n\n // === A2A (external actor exposure — Agent2Agent protocol) ===\n /\n A2A agent card (public, CORS-open metadata) advertising this app's exposed\n * actor systems as A2A skills + the security schemes a caller must satisfy.\n * Analogous to the OIDC discovery doc; the served path can be reverse-proxy\n * aliased to a root `/.well-known/agent-card.json`.\n /\n A2A_AGENT_CARD = 'A2A_AGENT_CARD',\n /\n A2A JSON-RPC task/message endpoint (`message/send`, `message/stream` via SSE).\n * Its absolute URL is the agent card's `url` AND the agent's canonical\n * audience — an inbound access token MUST carry this as its `aud` (RFC 8707 / D7).\n /\n A2A_TASKS = 'A2A_TASKS',\n\n // === MCP (Model Context Protocol server — resource operations as tools) ===\n /\n MCP JSON-RPC 2.0 endpoint (Streamable-HTTP transport): `initialize`, `tools/list`,\n * `tools/call`. A `tools/call` is Bearer-credentialed by a machine OR user-delegated access token\n * that is resource-server-bound to the MCP audience — NOT the generic API audience, which this\n * surface rejects since the 2026-07-29 strict flip (RFC 8707 / D7) — validated at auth time; the\n * server re-runs `authorizeInController` before dispatch (fail-closed).\n \n Also the base for the R-2 NAMED server instances: `POST /mcp/:instanceRef` serves a declared\n * instance with its own audience (`…/mcp/<ref>`) and curated catalog.\n /\n MCP_ENDPOINT = 'MCP_ENDPOINT',\n /\n MCP OAuth 2.0 Protected Resource Metadata (RFC 9728): advertises this MCP server's\n * `resource` identifier + the `authorization_servers` (the app's own OIDC provider) an MCP\n * client uses to obtain a token. Public, CORS-open metadata (like the OIDC discovery doc).\n \n Mounted TWICE: at the API root for the DEFAULT server, and appended to each named instance\n * (`/mcp/:instanceRef` + this route) so every instance advertises its OWN audience. A 401 at either\n * surface points its `WWW-Authenticate: resource_metadata=` at the matching one — the only discovery\n * route a client has, since this path is non-standard (it is not the RFC's origin-root form).\n /\n MCP_PROTECTED_RESOURCE_METADATA = 'MCP_PROTECTED_RESOURCE_METADATA',\n}\n\nexport const MANUAL_CONTROLLER_ROUTES_URLS: Record<ManualControllerRouteKey, string> = {\n [ManualControllerRouteKey.APPLICATION_CONFIG_GET]: '/application-config',\n\n [ManualControllerRouteKey.AUTH_IDENTIFY]: '/auth/identify',\n [ManualControllerRouteKey.AUTH_AUTHENTICATE_PASSWORD]: '/auth/authenticate/password',\n [ManualControllerRouteKey.AUTH_AUTHENTICATE]: '/auth/authenticate',\n [ManualControllerRouteKey.AUTH_TOKEN_REFRESH]: '/auth/token/refresh',\n [ManualControllerRouteKey.AUTH_OAUTH2_AUTHORIZE]: '/auth/oauth2/authorize/:providerRef',\n [ManualControllerRouteKey.AUTH_OAUTH2_CALLBACK]: '/auth/oauth2/callback/:providerRef',\n\n [ManualControllerRouteKey.PROVIDER_CONNECTION_START]: '/connections/:providerRef/start',\n [ManualControllerRouteKey.PROVIDER_CONNECTION_CALLBACK]: '/connections/callback',\n [ManualControllerRouteKey.PROVIDER_CONNECTION_COMPLETE]: '/connections/complete',\n [ManualControllerRouteKey.PROVIDER_CONNECTION_CATALOGUE]: '/connections',\n [ManualControllerRouteKey.PROVIDER_CONNECTION_STORE_CREDENTIAL]: '/connections/:providerRef/credential',\n [ManualControllerRouteKey.PROVIDER_CONNECTION_ACCESS_TOKEN]: '/connections/:providerRef/access-token',\n [ManualControllerRouteKey.AUTH_ENTERPRISE_SSO_AUTHORIZE]: '/auth/enterprise/authorize/:orgId/:connectionId',\n [ManualControllerRouteKey.AUTH_APP_ENTERPRISE_AUTHORIZE]: '/auth/app-enterprise/authorize/:connectionId',\n [ManualControllerRouteKey.AUTH_TOKEN_EXCHANGE]: '/auth/token/exchange',\n // OAuth 2.0 Authorization Server token endpoint (Wildo-as-provider).\n [ManualControllerRouteKey.OAUTH_PROVIDER_TOKEN]: '/oauth/token',\n // OIDC discovery + JWKS. Served under the API mount, so with issuer `${publicUrl}${MAIN_API_BASE_PATH}`\n // a client's `${issuer}/.well-known/openid-configuration` resolves here. That is correct for OIDC\n // Discovery (issuer + suffix) and NOT for RFC 8414, which places the well-known segment BETWEEN the\n // host and the issuer path — see {@link rfc8414AuthorizationServerMetadataPath}, which the HTTP\n // server mounts as a second location for the SAME document. (This used to say a root-level alias was\n // \"a reverse-proxy concern\"; leaving it to ingress meant every deployment that did not add the rule\n // silently failed RFC 8414 discovery, so the server now serves it directly.)\n [ManualControllerRouteKey.OAUTH_PROVIDER_DISCOVERY]: '/.well-known/openid-configuration',\n [ManualControllerRouteKey.OAUTH_PROVIDER_AS_METADATA]: '/.well-known/oauth-authorization-server',\n [ManualControllerRouteKey.OAUTH_PROVIDER_JWKS]: '/oauth/jwks',\n [ManualControllerRouteKey.OAUTH_PROVIDER_AUTHORIZE]: '/oauth/authorize',\n [ManualControllerRouteKey.OAUTH_PROVIDER_CONSENT]: '/oauth/authorize/decision',\n [ManualControllerRouteKey.OAUTH_PROVIDER_USERINFO]: '/oauth/userinfo',\n [ManualControllerRouteKey.OAUTH_PROVIDER_REVOKE]: '/oauth/revoke',\n [ManualControllerRouteKey.OAUTH_PROVIDER_END_SESSION]: '/oauth/end-session',\n [ManualControllerRouteKey.OAUTH_PROVIDER_END_SESSION_CONFIRM]: '/oauth/end-session/confirm',\n [ManualControllerRouteKey.OAUTH_PROVIDER_REGISTER]: '/oauth/register',\n [ManualControllerRouteKey.OAUTH_PROVIDER_REGISTER_CLIENT]: '/oauth/register/:clientId',\n [ManualControllerRouteKey.AUTH_CROSS_FRONTEND_HANDOFF]: '/auth/cross-frontend-handoff',\n [ManualControllerRouteKey.AUTH_LOGOUT]: '/auth/logout',\n [ManualControllerRouteKey.AUTH_LOGOUT_ALL]: '/auth/logout-all',\n [ManualControllerRouteKey.AUTH_PASSWORD_RESET_REQUEST]: '/auth/password-reset/request',\n [ManualControllerRouteKey.AUTH_PASSWORD_RESET_COMPLETE]: '/auth/password-reset/complete',\n [ManualControllerRouteKey.AUTH_REGISTER]: '/auth/register',\n [ManualControllerRouteKey.AUTH_ACCEPT_INVITATION]: '/auth/invitation/accept',\n [ManualControllerRouteKey.AUTH_INVITATION_INFO]: '/auth/invitation/info',\n [ManualControllerRouteKey.AUTH_REJECT_INVITATION]: '/auth/invitation/reject',\n [ManualControllerRouteKey.AUTH_LIST_MY_INVITATIONS]: '/auth/invitations/mine',\n [ManualControllerRouteKey.AUTH_ACCEPT_MY_INVITATION]: '/auth/invitations/accept',\n [ManualControllerRouteKey.AUTH_REJECT_MY_INVITATION]: '/auth/invitations/reject',\n [ManualControllerRouteKey.AUTH_VERIFY_EMAIL]: '/auth/verify-email',\n [ManualControllerRouteKey.AUTH_SESSION_STATE]: '/auth/session/:sessionId',\n\n // Magic Link (Phase G2)\n [ManualControllerRouteKey.AUTH_MAGIC_LINK_SEND]: '/auth/magic-link/send',\n [ManualControllerRouteKey.AUTH_MAGIC_LINK_VERIFY]: '/auth/magic-link/verify',\n\n // SMS OTP (Phase G2)\n [ManualControllerRouteKey.AUTH_SMS_OTP_SEND]: '/auth/sms-otp/send',\n [ManualControllerRouteKey.AUTH_SMS_OTP_VERIFY]: '/auth/sms-otp/verify',\n\n // Phone Verification (Phase G2)\n [ManualControllerRouteKey.AUTH_PHONE_VERIFY_SEND]: '/auth/phone/verify/send',\n [ManualControllerRouteKey.AUTH_PHONE_VERIFY_CONFIRM]: '/auth/phone/verify/confirm',\n\n // Resend Verification Email (F5)\n [ManualControllerRouteKey.AUTH_RESEND_VERIFICATION]: '/auth/resend-verification',\n\n // W5.7: Complete org onboarding\n [ManualControllerRouteKey.AUTH_COMPLETE_ORG_ONBOARDING]: '/auth/onboarding/complete-org',\n\n // W7.3b: One-off session token management\n [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_CREATE]: '/apps/:applicationId/auth/one-off-session',\n [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_CREATE_ORG]: '/orgs/:organizationId/apps/:applicationId/auth/one-off-session',\n [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_EXCHANGE]: '/auth/one-off-session/exchange',\n [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_REVOKE]: '/apps/:applicationId/auth/one-off-session/:tokenId/revoke',\n [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_REVOKE_ORG]: '/orgs/:organizationId/apps/:applicationId/auth/one-off-session/:tokenId/revoke',\n\n // Method Management (#13f)\n [ManualControllerRouteKey.AUTH_PASSWORD_CHANGE]: '/auth/password/change',\n [ManualControllerRouteKey.AUTH_PASSWORD_SET]: '/auth/password/set',\n [ManualControllerRouteKey.AUTH_MFA_TOTP_DISABLE]: '/auth/mfa/totp/disable',\n [ManualControllerRouteKey.AUTH_METHODS_MINE]: '/auth/methods/mine',\n [ManualControllerRouteKey.AUTH_IDENTITY_LINKS_LIST]: '/auth/identity-links',\n [ManualControllerRouteKey.AUTH_IDENTITY_LINKS_UNLINK]: '/auth/identity-links/:linkId',\n [ManualControllerRouteKey.AUTH_REAUTH]: '/auth/reauth',\n [ManualControllerRouteKey.AUTH_REAUTH_PASSKEY_OPTIONS]: '/auth/reauth/passkey/options',\n\n // SAML Routes (AUTH-2)\n [ManualControllerRouteKey.AUTH_SAML_LOGIN]: '/auth/saml/login/:connectionId',\n [ManualControllerRouteKey.AUTH_SAML_ACS]: '/auth/saml/acs',\n [ManualControllerRouteKey.AUTH_SAML_METADATA]: '/auth/saml/metadata/:scopeType/:scopeId',\n [ManualControllerRouteKey.AUTH_SAML_SLO]: '/auth/saml/slo',\n [ManualControllerRouteKey.AUTH_SAML_SP_LOGOUT]: '/auth/saml/logout',\n [ManualControllerRouteKey.AUTH_OIDC_LOGOUT]: '/auth/oidc/logout',\n\n // Direct file transfer. `upload-grants` MUST stay ahead of the `:fileId` family at the mount site,\n // or Express reads `upload-grants` as a file id — the controller registers them in that order.\n [ManualControllerRouteKey.FILES_UPLOAD_GRANT_STATUS]: '/files/upload-grants/:token',\n [ManualControllerRouteKey.FILES_UPLOAD_GRANT_REVOKE]: '/files/upload-grants/:grantId',\n [ManualControllerRouteKey.FILES_ITEM]: '/files/:fileId',\n [ManualControllerRouteKey.FILES_METADATA]: '/files/:fileId/metadata',\n [ManualControllerRouteKey.FILES_SHARE]: '/files/:fileId/share',\n\n [ManualControllerRouteKey.I18N_GET_LABELS]: '/i18n/labels',\n\n [ManualControllerRouteKey.CHARTS_DATA]: '/charts/:chartRef/data',\n\n // MFA — Email OTP (Step 10)\n [ManualControllerRouteKey.AUTH_MFA_EMAIL_OTP_SEND]: '/auth/mfa/email-otp/send',\n [ManualControllerRouteKey.AUTH_MFA_EMAIL_OTP_VERIFY]: '/auth/mfa/email-otp/verify',\n\n // MFA — TOTP (Step 11)\n [ManualControllerRouteKey.AUTH_MFA_TOTP_SETUP]: '/auth/mfa/totp/setup',\n [ManualControllerRouteKey.AUTH_MFA_TOTP_VERIFY_SETUP]: '/auth/mfa/totp/verify-setup',\n [ManualControllerRouteKey.AUTH_MFA_TOTP_VERIFY]: '/auth/mfa/totp/verify',\n\n // WebAuthn/Passkey Routes (Phase G1)\n [ManualControllerRouteKey.AUTH_PASSKEY_REGISTER_OPTIONS]: '/auth/passkey/register/options',\n [ManualControllerRouteKey.AUTH_PASSKEY_REGISTER_VERIFY]: '/auth/passkey/register/verify',\n [ManualControllerRouteKey.AUTH_PASSKEY_AUTH_OPTIONS]: '/auth/passkey/authenticate/options',\n [ManualControllerRouteKey.AUTH_PASSKEY_AUTH_VERIFY]: '/auth/passkey/authenticate/verify',\n [ManualControllerRouteKey.AUTH_PASSKEY_LIST]: '/auth/passkey/list',\n [ManualControllerRouteKey.AUTH_PASSKEY_REMOVE]: '/auth/passkey/remove',\n [ManualControllerRouteKey.AUTH_PASSKEY_RENAME]: '/auth/passkey/rename',\n\n [ManualControllerRouteKey.ANALYTICS_EVENTS]: '/analytics/events',\n [ManualControllerRouteKey.ANALYTICS_MOMENTS_ACHIEVED]: '/analytics/moments/achieved',\n\n [ManualControllerRouteKey.PROGRESSION_MILESTONES]: '/progression/milestones',\n [ManualControllerRouteKey.FEATURES_RESOLVED]: '/features/resolved',\n\n [ManualControllerRouteKey.FLOWS_ACTORS_FRONTEND_INFO]: '/flows-actors/frontend-info',\n [ManualControllerRouteKey.FLOWS_ACTORS_HISTORY]: '/flows-actors/history',\n\n // === A2A (external actor exposure) ===\n // Card served under the API mount, so with issuer `${publicUrl}${MAIN_API_BASE_PATH}`\n // a caller's `${issuer}/a2a/.well-known/agent-card.json` resolves here (a root-level\n // `/.well-known/agent-card.json` alias is a reverse-proxy concern).\n [ManualControllerRouteKey.A2A_AGENT_CARD]: '/a2a/.well-known/agent-card.json',\n [ManualControllerRouteKey.A2A_TASKS]: '/a2a',\n\n // === MCP (Model Context Protocol server) ===\n // JSON-RPC endpoint + RFC 9728 protected-resource metadata, served under the API mount. The\n // metadata's `resource` is `${publicUrl}${MAIN_API_BASE_PATH}/mcp`; a root-level\n // `/.well-known/oauth-protected-resource` alias is a reverse-proxy concern.\n [ManualControllerRouteKey.MCP_ENDPOINT]: '/mcp',\n [ManualControllerRouteKey.MCP_PROTECTED_RESOURCE_METADATA]: '/.well-known/oauth-protected-resource',\n};\n\n// =====================================================\n// Root-level engine routes (NOT under /api/v1)\n// These are mounted at the Express app root (e.g. /health/)\n// =====================================================\n\nexport enum EngineRootRouteKey {\n HEALTH_LIVENESS = 'HEALTH_LIVENESS',\n HEALTH_READINESS = 'HEALTH_READINESS',\n HEALTH_TIME = 'HEALTH_TIME',\n}\n\nexport const ENGINE_ROOT_ROUTES: Record<EngineRootRouteKey, string> = {\n [EngineRootRouteKey.HEALTH_LIVENESS]: '/health',\n [EngineRootRouteKey.HEALTH_READINESS]: '/health/ready',\n [EngineRootRouteKey.HEALTH_TIME]: '/health/time',\n};\n"]}

package/dist/esm/requests/rate-limits.shared.schemas.d.ts CHANGED Viewed

@@ -40,12 +40,22 @@ export declare enum RequestType {
  *   first; `customWindows` exists for the cases where those would be
  *   semantically wrong, NOT as a convenience for arbitrary tuning.
  *
- * Two consumption surfaces use this shape today:
+ * Three consumption surfaces use this shape today:
  * 1. **Resource operations** — `ResourceConfiguration_Operation_ApiCall.rateLimit?`
  *    on `API_CALL` / `API_CALL_WITH_CALLBACK` variants. Pre-flight enforced
  *    BEFORE execution-context creation, validation, and authorization. The
  *    bucket is always IP-keyed at this seam (authenticated identity is
  *    unknown by construction).
+ * 1b. **The SAME declaration, off HTTP.** An operation declaring a policy is
+ *    also enforced wherever an AGENT dispatches it — as an MCP tool
+ *    (`tools/call`) and as a Wildo function tool (`resourceReadTool` /
+ *    `resourceWriteTool`). Those planes bypass Express, so they enforce the
+ *    policy themselves and count the caller's CREDENTIAL rather than an IP:
+ *    there is no socket, and the credential is the closest reading of the
+ *    "per client" budget the IP expresses over HTTP. Each plane keeps its own
+ *    bucket, so one client's agent traffic never spends another client's
+ *    browser budget. Author the number once; it means the same thing on each
+ *    plane rather than being split between them.
  * 2. **Custom controllers** — `RateLimitBackendService.checkPolicy(req, res,
  *    policy, scopeKey, organizationId?, clientIdOverride?)` for hand-wired
  *    routes (auth, SCIM, marketing public endpoints). The bucket defaults

package/dist/esm/requests/rate-limits.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"rate-limits.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../~~src/requests/rate-limits.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,oBAAY,WAAW;IACrB,QAAQ,aAAa;IACrB,QAAQ,aAAa;IACrB,KAAK,UAAU;IACf,aAAa,kBAAkB;CAChC;AAED~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG~~;AACH,eAAO,MAAM,4BAA4B;;;;;;;;iBAQvC,CAAC;AACH,kEAAkE;AAElE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;iBAGrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC"}
1	+ {"version":3,"file":"rate-limits.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/requests/rate-limits.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,oBAAY,WAAW;IACrB,QAAQ,aAAa;IACrB,QAAQ,aAAa;IACrB,KAAK,UAAU;IACf,aAAa,kBAAkB;CAChC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;iBAQvC,CAAC;AACH,kEAAkE;AAElE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;iBAGrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC"}

package/dist/esm/requests/rate-limits.shared.schemas.js CHANGED Viewed

@@ -41,12 +41,22 @@ export var RequestType;
  *   first; `customWindows` exists for the cases where those would be
  *   semantically wrong, NOT as a convenience for arbitrary tuning.
  *
- * Two consumption surfaces use this shape today:
+ * Three consumption surfaces use this shape today:
  * 1. **Resource operations** — `ResourceConfiguration_Operation_ApiCall.rateLimit?`
  *    on `API_CALL` / `API_CALL_WITH_CALLBACK` variants. Pre-flight enforced
  *    BEFORE execution-context creation, validation, and authorization. The
  *    bucket is always IP-keyed at this seam (authenticated identity is
  *    unknown by construction).
+ * 1b. **The SAME declaration, off HTTP.** An operation declaring a policy is
+ *    also enforced wherever an AGENT dispatches it — as an MCP tool
+ *    (`tools/call`) and as a Wildo function tool (`resourceReadTool` /
+ *    `resourceWriteTool`). Those planes bypass Express, so they enforce the
+ *    policy themselves and count the caller's CREDENTIAL rather than an IP:
+ *    there is no socket, and the credential is the closest reading of the
+ *    "per client" budget the IP expresses over HTTP. Each plane keeps its own
+ *    bucket, so one client's agent traffic never spends another client's
+ *    browser budget. Author the number once; it means the same thing on each
+ *    plane rather than being split between them.
  * 2. **Custom controllers** — `RateLimitBackendService.checkPolicy(req, res,
  *    policy, scopeKey, organizationId?, clientIdOverride?)` for hand-wired
  *    routes (auth, SCIM, marketing public endpoints). The bucket defaults

package/dist/esm/requests/rate-limits.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"rate-limits.shared.schemas.js","sourceRoot":"","sources":["~~../../../../~~src/requests/rate-limits.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,CAAN,IAAY,WAKX;AALD,WAAY,WAAW;IACrB,oCAAqB,CAAA;IACrB,oCAAqB,CAAA;IACrB,8BAAe,CAAA;IACf,8CAA+B,CAAA;AACjC,CAAC,EALW,WAAW,KAAX,WAAW,QAKtB;AAED~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG~~;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,gDAAgD,CAAC,CAAC,QAAQ,EAAE;IACzG,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC,CAAC,QAAQ,EAAE;IACrG,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC,CAAC,QAAQ,EAAE;IACnG,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAC9B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,gDAAgD,CAAC;QAC9F,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;KACtF,CAAC,CAAC,CAAC,QAAQ,EAAE;CACf,CAAC,CAAC;AAKH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,4BAA4B,CAAC,MAAM,CAAC;IAC5E,GAAG,EAAG,CAAC,CAAC,MAAM,EAAE;IAChB,QAAQ,EAAG,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,2DAA2D;AAC3D,2EAA2E;AAC3E,2EAA2E;AAC3E,0EAA0E;AAC1E,yEAAyE;AACzE,8DAA8D;AAC9D,0EAA0E;AAC1E,0EAA0E;AAC1E,2EAA2E;AAC3E,yEAAyE;AACzE,wEAAwE;AACxE,uEAAuE;AACvE,sEAAsE;AACtE,mCAAmC","sourcesContent":["/*\n Request Context Types\n \n Types for request context including user authentication, organization membership,\n * and permission information used throughout the service layer\n /\nimport { z } from 'zod';\n\n\nexport enum RequestType {\n API_CALL = \"API_CALL\",\n CRON_JOB = \"CRON_JOB\",\n QUEUE = \"QUEUE\",\n INTERNAL_CALL = \"INTERNAL_CALL\"\n}\n\n/\n @wildo_source:part:start saas.models.rate-limit-configuration facet:layer:shared facet:family:rate-limit\n \n Canonical rate-limit declaration shape.\n \n Authoring semantics:\n \n - Every window is optional. `undefined` means \"no limit on this window\".\n * Authors typically declare one or two windows (e.g. `{ requestsPerMinute: 5,\n * requestsPerHour: 30 }` for a public anonymous endpoint).\n * - Multiple declared windows are AND-ed: a request is allowed only when\n * it passes every declared window. On 429 the response reports two\n * potentially DIFFERENT windows:\n * - `X-RateLimit-Limit` / `…-Remaining` / `…-Reset` — from the *tightest\n active window** (the one with the fewest remaining slots), so the\n * client sees the binding quota.\n * - `Retry-After` and `retryAfterSeconds` (in the error body) — from the\n * latest tripped window, because a retry cannot succeed until every\n * exceeded window has reset.\n * - `customWindows` is the escape hatch for the rare endpoint whose\n * business semantics genuinely do not fit a 60s / 3600s / 86400s grid. The\n * canonical example is the SMS phone-verify\n * family, which mandates a 5-minute (300s) per-phone-number throttle\n * tied to the OTP TTL — neither minute nor hour is correct, and rounding\n * would either let attackers through (round up) or DoS legitimate users\n * (round down). Authors should reach for `requestsPerMinute / Hour / Day`\n * first; `customWindows` exists for the cases where those would be\n * semantically wrong, NOT as a convenience for arbitrary tuning.\n \n ~~Two~~ consumption surfaces use this shape today:\n * 1. Resource operations — `ResourceConfiguration_Operation_ApiCall.rateLimit?`\n * on `API_CALL` / `API_CALL_WITH_CALLBACK` variants. Pre-flight enforced\n * BEFORE execution-context creation, validation, and authorization. The\n * bucket is always IP-keyed at this seam (authenticated identity is\n * unknown by construction).\n * 2. Custom controllers — `RateLimitBackendService.checkPolicy(req, res,\n * policy, scopeKey, organizationId?, clientIdOverride?)` for hand-wired\n * routes (auth, SCIM, marketing public endpoints). The bucket defaults\n * to IP-keyed; pass `clientIdOverride` (resolved subject identifier:\n * `token._id`, `userId`, normalized email, normalized phone) when the\n * caller has a stronger identity than IP — IP rotation must not let a\n * bad actor sidestep a per-subject quota.\n \n The global HTTP per-IP limiter (`RuntimeConfig.httpServerConfiguration.rateLimiting`)\n * remains the safety net for endpoints that declare no policy.\n \n @remarks Import from `@wildo-ai/saas-models`.\n /\nexport const RateLimitConfigurationSchema = z.object({\n requestsPerMinute: z.number().int().positive('Requests per minute must be a positive integer').optional(),\n requestsPerHour: z.number().int().positive('Requests per hour must be a positive integer').optional(),\n requestsPerDay: z.number().int().positive('Requests per day must be a positive integer').optional(),\n customWindows: z.array(z.object({\n requestsPerWindow: z.number().int().positive('Requests per window must be a positive integer'),\n windowSeconds: z.number().int().positive('Window seconds must be a positive integer')\n })).optional()\n});\n/* @wildo_source:part:end saas.models.rate-limit-configuration /\n\nexport type RateLimitConfiguration = z.infer<typeof RateLimitConfigurationSchema>;\n\n/\n API-key-bound rate-limit declaration (system 3 in the rate-limit\n * unification audit). The shape is the canonical `RateLimitConfiguration`\n * extended with `_id` + `apiKeyId` so it can be persisted and addressed\n * per-key. Wired onto `ApiKeyOrganizationContextSchema` /\n * `ApiKeyApplicationContextSchema` as the K-7 hook for future per-API-key\n * tier enforcement; not enforced inbound today (the `RateLimitBackendService`\n * pre-flight seam currently consumes the resource-operation `rateLimit?`\n * field, not the API-key context).\n /\nexport const ApiRequest_RateLimitSchema = RateLimitConfigurationSchema.extend({\n _id : z.string(),\n apiKeyId : z.string(),\n});\n\nexport type ApiRequest_RateLimit = z.infer<typeof ApiRequest_RateLimitSchema>;\n\n// Step 7 cleanup (rate-limit unification, 2026-04-20): the\n// `ApiRequest_RateLimitStatusSchema` declarative status-surface schema was\n// deleted here. It had ZERO consumers across the engine and was originally\n// authored for system 3 (the never-shipped per-API-key tier enforcement).\n// The status surface that replaced it in PR 1 of the unification work is\n// the `X-RateLimit-` HTTP headers + `Retry-After` emitted by\n// `RateLimitBackendService.checkPolicy` — an HTTP-native contract instead\n// of a body-shape contract, matching what RFC 6585 + RFC 7231 expect from\n// 429 responses. If K-7 (per-API-key tier enforcement) lands in the future\n// and needs a quota-status endpoint (e.g. `GET /me/api-keys/:id/quota`),\n// the status DTO should be co-located with that endpoint's controller —\n// the cross-cutting \"any rate limit anywhere\" status shape this schema\n// represented isn't a meaningful abstraction (every quota surface has\n// different windows + scope keys).\n"]}
1	+ {"version":3,"file":"rate-limits.shared.schemas.js","sourceRoot":"","sources":["../../../src/requests/rate-limits.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,CAAN,IAAY,WAKX;AALD,WAAY,WAAW;IACrB,oCAAqB,CAAA;IACrB,oCAAqB,CAAA;IACrB,8BAAe,CAAA;IACf,8CAA+B,CAAA;AACjC,CAAC,EALW,WAAW,KAAX,WAAW,QAKtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,gDAAgD,CAAC,CAAC,QAAQ,EAAE;IACzG,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC,CAAC,QAAQ,EAAE;IACrG,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC,CAAC,QAAQ,EAAE;IACnG,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAC9B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,gDAAgD,CAAC;QAC9F,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;KACtF,CAAC,CAAC,CAAC,QAAQ,EAAE;CACf,CAAC,CAAC;AAKH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,4BAA4B,CAAC,MAAM,CAAC;IAC5E,GAAG,EAAG,CAAC,CAAC,MAAM,EAAE;IAChB,QAAQ,EAAG,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,2DAA2D;AAC3D,2EAA2E;AAC3E,2EAA2E;AAC3E,0EAA0E;AAC1E,yEAAyE;AACzE,8DAA8D;AAC9D,0EAA0E;AAC1E,0EAA0E;AAC1E,2EAA2E;AAC3E,yEAAyE;AACzE,wEAAwE;AACxE,uEAAuE;AACvE,sEAAsE;AACtE,mCAAmC","sourcesContent":["/*\n Request Context Types\n \n Types for request context including user authentication, organization membership,\n * and permission information used throughout the service layer\n /\nimport { z } from 'zod';\n\n\nexport enum RequestType {\n API_CALL = \"API_CALL\",\n CRON_JOB = \"CRON_JOB\",\n QUEUE = \"QUEUE\",\n INTERNAL_CALL = \"INTERNAL_CALL\"\n}\n\n/\n @wildo_source:part:start saas.models.rate-limit-configuration facet:layer:shared facet:family:rate-limit\n \n Canonical rate-limit declaration shape.\n \n Authoring semantics:\n \n - Every window is optional. `undefined` means \"no limit on this window\".\n * Authors typically declare one or two windows (e.g. `{ requestsPerMinute: 5,\n * requestsPerHour: 30 }` for a public anonymous endpoint).\n * - Multiple declared windows are AND-ed: a request is allowed only when\n * it passes every declared window. On 429 the response reports two\n * potentially DIFFERENT windows:\n * - `X-RateLimit-Limit` / `…-Remaining` / `…-Reset` — from the *tightest\n active window** (the one with the fewest remaining slots), so the\n * client sees the binding quota.\n * - `Retry-After` and `retryAfterSeconds` (in the error body) — from the\n * latest tripped window, because a retry cannot succeed until every\n * exceeded window has reset.\n * - `customWindows` is the escape hatch for the rare endpoint whose\n * business semantics genuinely do not fit a 60s / 3600s / 86400s grid. The\n * canonical example is the SMS phone-verify\n * family, which mandates a 5-minute (300s) per-phone-number throttle\n * tied to the OTP TTL — neither minute nor hour is correct, and rounding\n * would either let attackers through (round up) or DoS legitimate users\n * (round down). Authors should reach for `requestsPerMinute / Hour / Day`\n * first; `customWindows` exists for the cases where those would be\n * semantically wrong, NOT as a convenience for arbitrary tuning.\n \n Three consumption surfaces use this shape today:\n * 1. Resource operations — `ResourceConfiguration_Operation_ApiCall.rateLimit?`\n * on `API_CALL` / `API_CALL_WITH_CALLBACK` variants. Pre-flight enforced\n * BEFORE execution-context creation, validation, and authorization. The\n * bucket is always IP-keyed at this seam (authenticated identity is\n * unknown by construction).\n * 1b. The SAME declaration, off HTTP. An operation declaring a policy is\n * also enforced wherever an AGENT dispatches it — as an MCP tool\n * (`tools/call`) and as a Wildo function tool (`resourceReadTool` /\n * `resourceWriteTool`). Those planes bypass Express, so they enforce the\n * policy themselves and count the caller's CREDENTIAL rather than an IP:\n * there is no socket, and the credential is the closest reading of the\n * \"per client\" budget the IP expresses over HTTP. Each plane keeps its own\n * bucket, so one client's agent traffic never spends another client's\n * browser budget. Author the number once; it means the same thing on each\n * plane rather than being split between them.\n * 2. Custom controllers — `RateLimitBackendService.checkPolicy(req, res,\n * policy, scopeKey, organizationId?, clientIdOverride?)` for hand-wired\n * routes (auth, SCIM, marketing public endpoints). The bucket defaults\n * to IP-keyed; pass `clientIdOverride` (resolved subject identifier:\n * `token._id`, `userId`, normalized email, normalized phone) when the\n * caller has a stronger identity than IP — IP rotation must not let a\n * bad actor sidestep a per-subject quota.\n \n The global HTTP per-IP limiter (`RuntimeConfig.httpServerConfiguration.rateLimiting`)\n * remains the safety net for endpoints that declare no policy.\n \n @remarks Import from `@wildo-ai/saas-models`.\n /\nexport const RateLimitConfigurationSchema = z.object({\n requestsPerMinute: z.number().int().positive('Requests per minute must be a positive integer').optional(),\n requestsPerHour: z.number().int().positive('Requests per hour must be a positive integer').optional(),\n requestsPerDay: z.number().int().positive('Requests per day must be a positive integer').optional(),\n customWindows: z.array(z.object({\n requestsPerWindow: z.number().int().positive('Requests per window must be a positive integer'),\n windowSeconds: z.number().int().positive('Window seconds must be a positive integer')\n })).optional()\n});\n/* @wildo_source:part:end saas.models.rate-limit-configuration /\n\nexport type RateLimitConfiguration = z.infer<typeof RateLimitConfigurationSchema>;\n\n/\n API-key-bound rate-limit declaration (system 3 in the rate-limit\n * unification audit). The shape is the canonical `RateLimitConfiguration`\n * extended with `_id` + `apiKeyId` so it can be persisted and addressed\n * per-key. Wired onto `ApiKeyOrganizationContextSchema` /\n * `ApiKeyApplicationContextSchema` as the K-7 hook for future per-API-key\n * tier enforcement; not enforced inbound today (the `RateLimitBackendService`\n * pre-flight seam currently consumes the resource-operation `rateLimit?`\n * field, not the API-key context).\n /\nexport const ApiRequest_RateLimitSchema = RateLimitConfigurationSchema.extend({\n _id : z.string(),\n apiKeyId : z.string(),\n});\n\nexport type ApiRequest_RateLimit = z.infer<typeof ApiRequest_RateLimitSchema>;\n\n// Step 7 cleanup (rate-limit unification, 2026-04-20): the\n// `ApiRequest_RateLimitStatusSchema` declarative status-surface schema was\n// deleted here. It had ZERO consumers across the engine and was originally\n// authored for system 3 (the never-shipped per-API-key tier enforcement).\n// The status surface that replaced it in PR 1 of the unification work is\n// the `X-RateLimit-` HTTP headers + `Retry-After` emitted by\n// `RateLimitBackendService.checkPolicy` — an HTTP-native contract instead\n// of a body-shape contract, matching what RFC 6585 + RFC 7231 expect from\n// 429 responses. If K-7 (per-API-key tier enforcement) lands in the future\n// and needs a quota-status endpoint (e.g. `GET /me/api-keys/:id/quota`),\n// the status DTO should be co-located with that endpoint's controller —\n// the cross-cutting \"any rate limit anywhere\" status shape this schema\n// represented isn't a meaningful abstraction (every quota surface has\n// different windows + scope keys).\n"]}

package/dist/esm/requests/websocket.shared.schemas.d.ts CHANGED Viewed

@@ -527,9 +527,9 @@ export declare const WS_ResourceEditingPayloadSchema: z.ZodObject<{
     initiatorUserId: z.ZodOptional<z.ZodString>;
     timestamp: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodDate, z.ZodString]>, z.ZodCoercedDate<string | Date>>>;
     reason: z.ZodOptional<z.ZodEnum<{
-        timeout: "timeout";
         manual: "manual";
         disconnect: "disconnect";
+        timeout: "timeout";
         auth_refresh: "auth_refresh";
         organization_switch: "organization_switch";
     }>>;
@@ -619,6 +619,29 @@ export declare const WS_FlowsActorsMessagePayloadSchema: z.ZodObject<{
     isFinal: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 export type WS_FlowsActorsMessagePayload = z.infer<typeof WS_FlowsActorsMessagePayloadSchema>;
+/**
+ * The approval announcement that is ACTUALLY sent, carried in the `data` bag of a
+ * `FLOWS_ACTORS_MESSAGE` of type `PROGRESS`.
+ *
+ * It is a named schema rather than a shape both ends open-code, because the `data` bag is
+ * `z.record(z.string(), z.unknown())` — so nothing typed the announcement, and the browser
+ * listened on `FLOWS_ACTORS_APPROVAL_REQUEST` instead, an event **nothing has ever emitted**.
+ * The result: `pendingApproval` was never set, no shipped screen could observe a paused turn,
+ * and `resourceServerInstanceRef` — which the server sends precisely so a decision can echo it —
+ * was discarded, leaving an approval raised on a NAMED agent instance unresumable (#528).
+ *
+ * Producer: `persistApprovalSuspension`. Consumer: `FlowsActorsContext`.
+ */
+export declare const WS_FlowsActorsApprovalAnnouncementDataSchema: z.ZodObject<{
+    approvalRequested: z.ZodLiteral<true>;
+    approvalId: z.ZodString;
+    toolName: z.ZodString;
+    toolArgs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    requestedAt: z.ZodString;
+    expiresAt: z.ZodOptional<z.ZodString>;
+    resourceServerInstanceRef: z.ZodString;
+}, z.core.$strip>;
+export type WS_FlowsActorsApprovalAnnouncementData = z.infer<typeof WS_FlowsActorsApprovalAnnouncementDataSchema>;
 /** Human approval request (server → client) */
 export declare const WS_FlowsActorsApprovalRequestPayloadSchema: z.ZodObject<{
     systemRef: z.ZodString;
@@ -643,6 +666,7 @@ export declare const WS_FlowsActorsApprovalResponsePayloadSchema: z.ZodObject<{
     approved: z.ZodBoolean;
     comment: z.ZodOptional<z.ZodString>;
     resourceServerInstanceRef: z.ZodOptional<z.ZodString>;
+    modifiedToolArgs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, z.core.$strip>;
 export type WS_FlowsActorsApprovalResponsePayload = z.infer<typeof WS_FlowsActorsApprovalResponsePayloadSchema>;
 /** Status update during execution (server → client) */
@@ -879,9 +903,9 @@ export declare const WebSocketEventSchemas: {
         initiatorUserId: z.ZodOptional<z.ZodString>;
         timestamp: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodDate, z.ZodString]>, z.ZodCoercedDate<string | Date>>>;
         reason: z.ZodOptional<z.ZodEnum<{
-            timeout: "timeout";
             manual: "manual";
             disconnect: "disconnect";
+            timeout: "timeout";
             auth_refresh: "auth_refresh";
             organization_switch: "organization_switch";
         }>>;
@@ -893,9 +917,9 @@ export declare const WebSocketEventSchemas: {
         initiatorUserId: z.ZodOptional<z.ZodString>;
         timestamp: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodDate, z.ZodString]>, z.ZodCoercedDate<string | Date>>>;
         reason: z.ZodOptional<z.ZodEnum<{
-            timeout: "timeout";
             manual: "manual";
             disconnect: "disconnect";
+            timeout: "timeout";
             auth_refresh: "auth_refresh";
             organization_switch: "organization_switch";
         }>>;
@@ -998,6 +1022,7 @@ export declare const WebSocketEventSchemas: {
         approved: z.ZodBoolean;
         comment: z.ZodOptional<z.ZodString>;
         resourceServerInstanceRef: z.ZodOptional<z.ZodString>;
+        modifiedToolArgs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     }, z.core.$strip>;
     readonly "flows-actors:status-update": z.ZodObject<{
         systemRef: z.ZodString;

package/dist/esm/requests/websocket.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"websocket.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/requests/websocket.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,8CAA8C,CAAC;AAExE,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,kDAAkD,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAE,MAAM,8CAA8C,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACjG,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AACxG,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,4CAA4C,CAAC;AAC5F,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAM7E;;;GAGG;AACH,oBAAY,kBAAkB;IAE5B,kBAAkB,uBAAuB;IACzC,oBAAoB,yBAAyB;IAC7C,mBAAmB,wBAAwB,CAAM,sBAAsB;IACvE,qBAAqB,0BAA0B,CAAE,sBAAsB;IAGvE,qBAAqB,0BAA0B;IAC/C,iBAAiB,sBAAsB,CAAG,4DAA4D;IACtG,YAAY,iBAAiB;IAC7B,SAAS,cAAc;IACvB,aAAa,kBAAkB;IAG/B,gBAAgB,qBAAqB;IACrC,gBAAgB,qBAAqB;IACrC,sBAAsB,2BAA2B;IACjD,oBAAoB,yBAAyB;IAC7C,wBAAwB,6BAA6B,CAAE,sBAAsB;IAC7E,sBAAsB,2BAA2B;IACjD,eAAe,oBAAoB;IACnC,iBAAiB,sBAAsB;IACvC,eAAe,oBAAoB;IACnC,qBAAqB,0BAA0B;IAG/C,kBAAkB,uBAAuB;IACzC,oBAAoB,yBAAyB;IAC7C,oBAAoB,yBAAyB;IAC7C,6BAA6B,kCAAkC;IAC/D,8BAA8B,mCAAmC;IACjE,0BAA0B,+BAA+B;IACzD,sBAAsB,2BAA2B;IACjD,kBAAkB,uBAAuB;IAGzC,sBAAsB,2BAA2B;IACjD,4BAA4B,iCAAiC;IAC7D,uBAAuB,4BAA4B;IACnD,qBAAqB,0BAA0B;IAC/C,2BAA2B,gCAAgC;IAC3D,wBAAwB,6BAA6B;IAGrD,yBAAyB,8BAA8B;IAGvD,sBAAsB,2BAA2B;IAGjD,kBAAkB,mCAAmC;IACrD;;;;;OAKG;IACH,mBAAmB,wBAAwB;IAG3C,uBAAuB,4BAA4B;IAGnD,YAAY,iBAAiB;IAC7B,mBAAmB,wBAAwB;IAC3C,sBAAsB,2BAA2B;IACjD,YAAY,iBAAiB;CAC9B;AAED;;;;;;;;;;;;;;;GAeG;AACH,oBAAY,gCAAgC;IAC1C,qBAAqB,0BAA0B;CAChD;AAED,oBAAY,cAAc;IACxB,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAED,eAAO,MAAM,oBAAoB,sEAAgD,CAAC;AAElF,oBAAY,+BAA+B;IACzC,kBAAkB,uBAAuB;IACzC,0BAA0B,+BAA+B;IACzD,uBAAuB,4BAA4B;CACpD;AAED,eAAO,MAAM,qCAAqC,mDAA0C,CAAC;AAE7F;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,kBAAkB,GAAG,UAAU,MAAM,EAAE,CAAC;AAMzE,eAAO,MAAM,gCAAgC,uCAAmC,CAAC;AACjF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAiC1F,kFAAkF;AAClF,eAAO,MAAM,iCAAiC;;;;;;;;;;;;mBAG5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,0CAA0C;AAC1C,eAAO,MAAM,kCAAkC;;;;;iBAM7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAM9F;;GAEG;AACH,oBAAY,iBAAiB;IAC3B,IAAI,SAAS;IACb,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,KAAK,UAAU;CAChB;AAED,eAAO,MAAM,uBAAuB,qCAA4B,CAAC;AAEjE,iEAAiE;AACjE,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;;;;iBA6B/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG,yBAAyB;AACzB,eAAO,MAAM,2BAA2B;;;;iBAItC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;GAEG;AACH,oBAAY,yBAAyB;IACnC,KAAK,UAAU;IACf,MAAM,WAAW;IACjB,IAAI,SAAS;CACd;AAED,eAAO,MAAM,+BAA+B,6CAAoC,CAAC;AAEjF;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;iBAiB3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAM1F,gDAAgD;AAChD,eAAO,MAAM,uCAAuC;;;;;;;;;;iBAOlD,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAMxG,sFAAsF;AACtF,eAAO,MAAM,4BAA4B,uJAIvC,CAAC;AAEH,0FAA0F;AAC1F,eAAO,MAAM,oCAAoC;;;;;;;;;;iBAQ/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAMlG,qFAAqF;AACrF,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;iBAqB5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;;;;;GAOG;AACH,eAAO,MAAM,kCAAkC;;;;;iBAS7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAM9F,2FAA2F;AAC3F,eAAO,MAAM,qCAAqC;;;;;;;iBAahD,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAMpG;;;;GAIG;AACH,eAAO,MAAM,oBAAoB;;;;iBAI/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,kBAAkB;;;;kBAA6C,CAAC;AAC7E,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAmC9D,yEAAyE;AACzE,eAAO,MAAM,2CAA2C;;;;;;;;;;;;;;;;;;;;;;;iBAEtD,CAAC;AACH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAEhH,4EAA4E;AAC5E,eAAO,MAAM,8CAA8C;;;;;;;;;;;;;;;;;;;;;;;iBAEzD,CAAC;AACH,MAAM,MAAM,wCAAwC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8CAA8C,CAAC,CAAC;AAEtH,eAAO,MAAM,0CAA0C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAGrD,CAAC;AACH,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAE9G,gFAAgF;AAChF,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;iBAc9C,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG,8FAA8F;AAC9F,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAI1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,iDAAiD;AACjD,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;iBAU1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,4EAA4E;AAC5E,eAAO,MAAM,iCAAiC;;;;;;;;;;iBAK5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;;GAIG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;iBAO1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,iCAAiC;AACjC,eAAO,MAAM,qCAAqC;;;;;iBAKhD,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG;;;;GAIG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;iBAc9C,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG,uCAAuC;AACvC,eAAO,MAAM,mCAAmC;;;iBAG9C,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAMhG,0CAA0C;AAC1C,eAAO,MAAM,wBAAwB;;;;iBAInC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,8CAA8C;AAC9C,eAAO,MAAM,2BAA2B;;;iBAGtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,+CAA+C;AAC/C,eAAO,MAAM,4BAA4B;;;kBAGtC,CAAC;AACJ,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAMlF,0DAA0D;AAC1D,eAAO,MAAM,gCAAgC;;;;;iBAK3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,8DAA8D;AAC9D,eAAO,MAAM,kCAAkC;;;;;iBAK7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,gDAAgD;AAChD,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;iBAmB7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,+CAA+C;AAC/C,eAAO,MAAM,0CAA0C;;;;;;;;;;;;;iBAQrD,CAAC;AAEH,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAE9G,gDAAgD;AAChD,eAAO,MAAM,2CAA2C;;;;;;;iBAkBtD,CAAC;AACH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAEhH,uDAAuD;AACvD,eAAO,MAAM,uCAAuC;;;;;;;iBAOlD,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG,4CAA4C;AAC5C,eAAO,MAAM,oCAAoC;;;;;;iBAM/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG,wCAAwC;AACxC,eAAO,MAAM,gCAAgC;;;;;;iBAM3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAM1F,eAAO,MAAM,2BAA2B;;iBAEtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,oCAAoC;;iBAE/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG,eAAO,MAAM,kCAAkC;;;iBAG7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,2BAA2B;;;;iBAItC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAMhF,eAAO,MAAM,4BAA4B;;;;iBAIvC,CAAC;AACD,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAMpF,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8DxB,CAAC;AAMX,MAAM,MAAM,sBAAsB,GAAG;IACnC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,2BAA2B,CAAC;IACrE,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,EAAE,2BAA2B,CAAC;IACvE,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,EAAE,4BAA4B,CAAC;IACvE,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;IAEzE,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,EAAE,8BAA8B,CAAC;IAC3E,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,EAAE,0BAA0B,CAAC;IACnE,CAAC,kBAAkB,CAAC,YAAY,CAAC,EAAE,qBAAqB,CAAC;IACzD,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,kBAAkB,CAAC;IACnD,CAAC,kBAAkB,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAC;IAE1D,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,yBAAyB,CAAC;IACjE,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,yBAAyB,CAAC;IACjE,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,EAAE,yBAAyB,CAAC;IACvE,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,EAAE,yBAAyB,CAAC;IACrE,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,EAAE,+BAA+B,CAAC;IAC/E,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,EAAE,+BAA+B,CAAC;IAC7E,CAAC,kBAAkB,CAAC,eAAe,CAAC,EAAE,2BAA2B,CAAC;IAClE,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,EAAE,2BAA2B,CAAC;IACpE,CAAC,kBAAkB,CAAC,eAAe,CAAC,EAAE,6BAA6B,CAAC;IACpE,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,EAAE,6BAA6B,CAAC;IAE1E,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC;IACpE,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,EAAE,4BAA4B,CAAC;IACxE,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,EAAE,4BAA4B,CAAC;IACxE,CAAC,kBAAkB,CAAC,6BAA6B,CAAC,EAAE,oCAAoC,CAAC;IACzF,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,EAAE,qCAAqC,CAAC;IAC3F,CAAC,kBAAkB,CAAC,0BAA0B,CAAC,EAAE,iCAAiC,CAAC;IACnF,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,EAAE,8BAA8B,CAAC;IAC5E,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC;IAEpE,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IACpE,CAAC,kBAAkB,CAAC,4BAA4B,CAAC,EAAE,sBAAsB,CAAC;IAC1E,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,EAAE,sBAAsB,CAAC;IACrE,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,EAAE,sBAAsB,CAAC;IACnE,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,EAAE,sBAAsB,CAAC;IACzE,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,EAAE,sBAAsB,CAAC;IAEtE,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,EAAE,iCAAiC,CAAC;IAElF,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,EAAE,8BAA8B,CAAC;IAE5E,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,2BAA2B,CAAC;IACrE,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,EAAE,4BAA4B,CAAC;IAEvE,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,EAAE,+BAA+B,CAAC;IAE9E,CAAC,kBAAkB,CAAC,YAAY,CAAC,EAAE,qBAAqB,CAAC;IACzD,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,EAAE,4BAA4B,CAAC;IACvE,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,EAAE,8BAA8B,CAAC;IAC5E,CAAC,kBAAkB,CAAC,YAAY,CAAC,EAAE,qBAAqB,CAAC;CAC1D,CAAC;AAMF;;;GAGG;AACH,oBAAY,mBAAmB;IAC7B,wCAAwC;IACxC,IAAI,SAAS;IACb,8CAA8C;IAC9C,YAAY,QAAQ;IACpB,+DAA+D;IAC/D,iBAAiB,SAAS;IAC1B,mDAAmD;IACnD,QAAQ,aAAa;IACrB,0DAA0D;IAC1D,QAAQ,aAAa;IACrB,4CAA4C;IAC5C,MAAM,WAAW;CAClB;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAExE;AAED;;GAEG;AACH,wBAAgB,6BAA6B,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE1F;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAEtF;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAElG;AAED;;;;;;;GAOG;AACH,oBAAY,oBAAoB;IAC9B;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,QAAQ;IACnB,gCAAgC;IAChC,IAAI,SAAS;IACb,kBAAkB;IAClB,YAAY,QAAQ;CACrB;AAED,qDAAqD;AACrD,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iCAAiC,CAC/C,0BAA0B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAClD,YAAY,EAAE,oBAAoB,GACjC,0BAA0B,EAAE,CAqD9B;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG;IACvD,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,CAUP;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOzE;AAMD;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,CAAC,SAAS,MAAM,OAAO,qBAAqB,EACnF,KAAK,EAAE,CAAC,EACR,OAAO,EAAE,OAAO,GACf,CAAC,SAAS,MAAM,sBAAsB,GAAG,sBAAsB,CAAC,CAAC,CAAC,GAAG,OAAO,CAG9E;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,CAAC,SAAS,MAAM,OAAO,qBAAqB,EACvF,KAAK,EAAE,CAAC,EACR,OAAO,EAAE,OAAO,GACf;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,CAAC,SAAS,MAAM,sBAAsB,GAAG,sBAAsB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAA;CAAE,CAO/I"}
1	+ {"version":3,"file":"websocket.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/requests/websocket.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,8CAA8C,CAAC;AAExE,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,kDAAkD,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAE,MAAM,8CAA8C,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACjG,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AACxG,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,4CAA4C,CAAC;AAC5F,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAM7E;;;GAGG;AACH,oBAAY,kBAAkB;IAE5B,kBAAkB,uBAAuB;IACzC,oBAAoB,yBAAyB;IAC7C,mBAAmB,wBAAwB,CAAM,sBAAsB;IACvE,qBAAqB,0BAA0B,CAAE,sBAAsB;IAGvE,qBAAqB,0BAA0B;IAC/C,iBAAiB,sBAAsB,CAAG,4DAA4D;IACtG,YAAY,iBAAiB;IAC7B,SAAS,cAAc;IACvB,aAAa,kBAAkB;IAG/B,gBAAgB,qBAAqB;IACrC,gBAAgB,qBAAqB;IACrC,sBAAsB,2BAA2B;IACjD,oBAAoB,yBAAyB;IAC7C,wBAAwB,6BAA6B,CAAE,sBAAsB;IAC7E,sBAAsB,2BAA2B;IACjD,eAAe,oBAAoB;IACnC,iBAAiB,sBAAsB;IACvC,eAAe,oBAAoB;IACnC,qBAAqB,0BAA0B;IAG/C,kBAAkB,uBAAuB;IACzC,oBAAoB,yBAAyB;IAC7C,oBAAoB,yBAAyB;IAC7C,6BAA6B,kCAAkC;IAC/D,8BAA8B,mCAAmC;IACjE,0BAA0B,+BAA+B;IACzD,sBAAsB,2BAA2B;IACjD,kBAAkB,uBAAuB;IAGzC,sBAAsB,2BAA2B;IACjD,4BAA4B,iCAAiC;IAC7D,uBAAuB,4BAA4B;IACnD,qBAAqB,0BAA0B;IAC/C,2BAA2B,gCAAgC;IAC3D,wBAAwB,6BAA6B;IAGrD,yBAAyB,8BAA8B;IAGvD,sBAAsB,2BAA2B;IAGjD,kBAAkB,mCAAmC;IACrD;;;;;OAKG;IACH,mBAAmB,wBAAwB;IAG3C,uBAAuB,4BAA4B;IAGnD,YAAY,iBAAiB;IAC7B,mBAAmB,wBAAwB;IAC3C,sBAAsB,2BAA2B;IACjD,YAAY,iBAAiB;CAC9B;AAED;;;;;;;;;;;;;;;GAeG;AACH,oBAAY,gCAAgC;IAC1C,qBAAqB,0BAA0B;CAChD;AAED,oBAAY,cAAc;IACxB,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAED,eAAO,MAAM,oBAAoB,sEAAgD,CAAC;AAElF,oBAAY,+BAA+B;IACzC,kBAAkB,uBAAuB;IACzC,0BAA0B,+BAA+B;IACzD,uBAAuB,4BAA4B;CACpD;AAED,eAAO,MAAM,qCAAqC,mDAA0C,CAAC;AAE7F;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,kBAAkB,GAAG,UAAU,MAAM,EAAE,CAAC;AAMzE,eAAO,MAAM,gCAAgC,uCAAmC,CAAC;AACjF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAiC1F,kFAAkF;AAClF,eAAO,MAAM,iCAAiC;;;;;;;;;;;;mBAG5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,0CAA0C;AAC1C,eAAO,MAAM,kCAAkC;;;;;iBAM7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAM9F;;GAEG;AACH,oBAAY,iBAAiB;IAC3B,IAAI,SAAS;IACb,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,KAAK,UAAU;CAChB;AAED,eAAO,MAAM,uBAAuB,qCAA4B,CAAC;AAEjE,iEAAiE;AACjE,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;;;;iBA6B/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG,yBAAyB;AACzB,eAAO,MAAM,2BAA2B;;;;iBAItC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;GAEG;AACH,oBAAY,yBAAyB;IACnC,KAAK,UAAU;IACf,MAAM,WAAW;IACjB,IAAI,SAAS;CACd;AAED,eAAO,MAAM,+BAA+B,6CAAoC,CAAC;AAEjF;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;iBAiB3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAM1F,gDAAgD;AAChD,eAAO,MAAM,uCAAuC;;;;;;;;;;iBAOlD,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAMxG,sFAAsF;AACtF,eAAO,MAAM,4BAA4B,uJAIvC,CAAC;AAEH,0FAA0F;AAC1F,eAAO,MAAM,oCAAoC;;;;;;;;;;iBAQ/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAMlG,qFAAqF;AACrF,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;iBAqB5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;;;;;GAOG;AACH,eAAO,MAAM,kCAAkC;;;;;iBAS7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAM9F,2FAA2F;AAC3F,eAAO,MAAM,qCAAqC;;;;;;;iBAahD,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAMpG;;;;GAIG;AACH,eAAO,MAAM,oBAAoB;;;;iBAI/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,kBAAkB;;;;kBAA6C,CAAC;AAC7E,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAmC9D,yEAAyE;AACzE,eAAO,MAAM,2CAA2C;;;;;;;;;;;;;;;;;;;;;;;iBAEtD,CAAC;AACH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAEhH,4EAA4E;AAC5E,eAAO,MAAM,8CAA8C;;;;;;;;;;;;;;;;;;;;;;;iBAEzD,CAAC;AACH,MAAM,MAAM,wCAAwC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8CAA8C,CAAC,CAAC;AAEtH,eAAO,MAAM,0CAA0C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAGrD,CAAC;AACH,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAE9G,gFAAgF;AAChF,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;iBAc9C,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG,8FAA8F;AAC9F,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAI1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,iDAAiD;AACjD,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;iBAU1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,4EAA4E;AAC5E,eAAO,MAAM,iCAAiC;;;;;;;;;;iBAK5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;;GAIG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;iBAO1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,iCAAiC;AACjC,eAAO,MAAM,qCAAqC;;;;;iBAKhD,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG;;;;GAIG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;iBAc9C,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG,uCAAuC;AACvC,eAAO,MAAM,mCAAmC;;;iBAG9C,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAMhG,0CAA0C;AAC1C,eAAO,MAAM,wBAAwB;;;;iBAInC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,8CAA8C;AAC9C,eAAO,MAAM,2BAA2B;;;iBAGtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,+CAA+C;AAC/C,eAAO,MAAM,4BAA4B;;;kBAGtC,CAAC;AACJ,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAMlF,0DAA0D;AAC1D,eAAO,MAAM,gCAAgC;;;;;iBAK3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,8DAA8D;AAC9D,eAAO,MAAM,kCAAkC;;;;;iBAK7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,gDAAgD;AAChD,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;iBAmB7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,4CAA4C;;;;;;;;iBAqBvD,CAAC;AACH,MAAM,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4CAA4C,CAAC,CAAC;AAElH,+CAA+C;AAC/C,eAAO,MAAM,0CAA0C;;;;;;;;;;;;;iBAQrD,CAAC;AAEH,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAE9G,gDAAgD;AAChD,eAAO,MAAM,2CAA2C;;;;;;;;iBAmCtD,CAAC;AACH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAEhH,uDAAuD;AACvD,eAAO,MAAM,uCAAuC;;;;;;;iBAOlD,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG,4CAA4C;AAC5C,eAAO,MAAM,oCAAoC;;;;;;iBAM/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG,wCAAwC;AACxC,eAAO,MAAM,gCAAgC;;;;;;iBAM3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAM1F,eAAO,MAAM,2BAA2B;;iBAEtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,oCAAoC;;iBAE/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG,eAAO,MAAM,kCAAkC;;;iBAG7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,2BAA2B;;;;iBAItC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAMhF,eAAO,MAAM,4BAA4B;;;;iBAIvC,CAAC;AACD,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAMpF,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8DxB,CAAC;AAMX,MAAM,MAAM,sBAAsB,GAAG;IACnC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,2BAA2B,CAAC;IACrE,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,EAAE,2BAA2B,CAAC;IACvE,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,EAAE,4BAA4B,CAAC;IACvE,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;IAEzE,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,EAAE,8BAA8B,CAAC;IAC3E,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,EAAE,0BAA0B,CAAC;IACnE,CAAC,kBAAkB,CAAC,YAAY,CAAC,EAAE,qBAAqB,CAAC;IACzD,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,kBAAkB,CAAC;IACnD,CAAC,kBAAkB,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAC;IAE1D,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,yBAAyB,CAAC;IACjE,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,yBAAyB,CAAC;IACjE,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,EAAE,yBAAyB,CAAC;IACvE,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,EAAE,yBAAyB,CAAC;IACrE,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,EAAE,+BAA+B,CAAC;IAC/E,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,EAAE,+BAA+B,CAAC;IAC7E,CAAC,kBAAkB,CAAC,eAAe,CAAC,EAAE,2BAA2B,CAAC;IAClE,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,EAAE,2BAA2B,CAAC;IACpE,CAAC,kBAAkB,CAAC,eAAe,CAAC,EAAE,6BAA6B,CAAC;IACpE,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,EAAE,6BAA6B,CAAC;IAE1E,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC;IACpE,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,EAAE,4BAA4B,CAAC;IACxE,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,EAAE,4BAA4B,CAAC;IACxE,CAAC,kBAAkB,CAAC,6BAA6B,CAAC,EAAE,oCAAoC,CAAC;IACzF,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,EAAE,qCAAqC,CAAC;IAC3F,CAAC,kBAAkB,CAAC,0BAA0B,CAAC,EAAE,iCAAiC,CAAC;IACnF,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,EAAE,8BAA8B,CAAC;IAC5E,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC;IAEpE,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IACpE,CAAC,kBAAkB,CAAC,4BAA4B,CAAC,EAAE,sBAAsB,CAAC;IAC1E,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,EAAE,sBAAsB,CAAC;IACrE,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,EAAE,sBAAsB,CAAC;IACnE,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,EAAE,sBAAsB,CAAC;IACzE,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,EAAE,sBAAsB,CAAC;IAEtE,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,EAAE,iCAAiC,CAAC;IAElF,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,EAAE,8BAA8B,CAAC;IAE5E,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,2BAA2B,CAAC;IACrE,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,EAAE,4BAA4B,CAAC;IAEvE,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,EAAE,+BAA+B,CAAC;IAE9E,CAAC,kBAAkB,CAAC,YAAY,CAAC,EAAE,qBAAqB,CAAC;IACzD,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,EAAE,4BAA4B,CAAC;IACvE,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,EAAE,8BAA8B,CAAC;IAC5E,CAAC,kBAAkB,CAAC,YAAY,CAAC,EAAE,qBAAqB,CAAC;CAC1D,CAAC;AAMF;;;GAGG;AACH,oBAAY,mBAAmB;IAC7B,wCAAwC;IACxC,IAAI,SAAS;IACb,8CAA8C;IAC9C,YAAY,QAAQ;IACpB,+DAA+D;IAC/D,iBAAiB,SAAS;IAC1B,mDAAmD;IACnD,QAAQ,aAAa;IACrB,0DAA0D;IAC1D,QAAQ,aAAa;IACrB,4CAA4C;IAC5C,MAAM,WAAW;CAClB;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAExE;AAED;;GAEG;AACH,wBAAgB,6BAA6B,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE1F;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAEtF;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAElG;AAED;;;;;;;GAOG;AACH,oBAAY,oBAAoB;IAC9B;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,QAAQ;IACnB,gCAAgC;IAChC,IAAI,SAAS;IACb,kBAAkB;IAClB,YAAY,QAAQ;CACrB;AAED,qDAAqD;AACrD,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iCAAiC,CAC/C,0BAA0B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAClD,YAAY,EAAE,oBAAoB,GACjC,0BAA0B,EAAE,CAqD9B;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG;IACvD,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,CAUP;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOzE;AAMD;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,CAAC,SAAS,MAAM,OAAO,qBAAqB,EACnF,KAAK,EAAE,CAAC,EACR,OAAO,EAAE,OAAO,GACf,CAAC,SAAS,MAAM,sBAAsB,GAAG,sBAAsB,CAAC,CAAC,CAAC,GAAG,OAAO,CAG9E;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,CAAC,SAAS,MAAM,OAAO,qBAAqB,EACvF,KAAK,EAAE,CAAC,EACR,OAAO,EAAE,OAAO,GACf;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,CAAC,SAAS,MAAM,sBAAsB,GAAG,sBAAsB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAA;CAAE,CAO/I"}

package/dist/esm/requests/websocket.shared.schemas.js CHANGED Viewed

@@ -526,6 +526,41 @@ export const WS_FlowsActorsMessagePayloadSchema = z.object({
     /** True on the terminal event of a streamed message (`content` is the full text). */
     isFinal: z.boolean().optional(),
 });
+/**
+ * The approval announcement that is ACTUALLY sent, carried in the `data` bag of a
+ * `FLOWS_ACTORS_MESSAGE` of type `PROGRESS`.
+ *
+ * It is a named schema rather than a shape both ends open-code, because the `data` bag is
+ * `z.record(z.string(), z.unknown())` — so nothing typed the announcement, and the browser
+ * listened on `FLOWS_ACTORS_APPROVAL_REQUEST` instead, an event **nothing has ever emitted**.
+ * The result: `pendingApproval` was never set, no shipped screen could observe a paused turn,
+ * and `resourceServerInstanceRef` — which the server sends precisely so a decision can echo it —
+ * was discarded, leaving an approval raised on a NAMED agent instance unresumable (#528).
+ *
+ * Producer: `persistApprovalSuspension`. Consumer: `FlowsActorsContext`.
+ */
+export const WS_FlowsActorsApprovalAnnouncementDataSchema = z.object({
+    /** Discriminator. The `data` bag carries other kinds of payload on other messages. */
+    approvalRequested: z.literal(true),
+    approvalId: z.string(),
+    /** The tool call being gated. */
+    toolName: z.string(),
+    /**
+     * The tool call's ARGUMENTS — the structured thing a person is actually being asked to approve.
+     * Loose here because the shape belongs to the tool, not to the transport; a surface that renders
+     * these gets their schema from the tool declaration.
+     */
+    toolArgs: z.record(z.string(), z.unknown()).optional(),
+    requestedAt: z.string(),
+    /** When the pause lapses. Written since #465; it reaches a client only through this block. */
+    expiresAt: z.string().optional(),
+    /**
+     * The isolation axis the DECISION must carry back, sent unconditionally — including when it is
+     * the default sentinel — so a client echoes one field rather than branching on whether the value
+     * is meaningful.
+     */
+    resourceServerInstanceRef: z.string(),
+});
 /** Human approval request (server → client) */
 export const WS_FlowsActorsApprovalRequestPayloadSchema = z.object({
     systemRef: z.string(),
@@ -555,6 +590,23 @@ export const WS_FlowsActorsApprovalResponsePayloadSchema = z.object({
      * echo; absent means default, which is the value those executions were written with.
      */
     resourceServerInstanceRef: z.string().optional(),
+    /**
+     * APPROVE-WITH-MODIFICATIONS (#566): the arguments the approver authored, replacing the ones the
+     * model proposed. Meaningful only when `approved` is true — a denial resumes so the model can
+     * respond, and there is no call to edit.
+     *
+     * Absent means "run the call as proposed", which is what every decision before this field meant
+     * and what the overwhelming majority of decisions will keep meaning. Present means the approver
+     * has become an AUTHOR of the call: the server re-validates the arguments against the tool's own
+     * `inputSchema`, rewrites the SDK message array it holds, re-signs the approval so the binding
+     * still describes the call that will actually run, and records on the audit trail that what
+     * executed was not what was proposed.
+     *
+     * `unknown` values rather than a shaped object, deliberately: the shape is the TOOL's, declared by
+     * whichever `FunctionTool` the agent named, and this schema cannot know it. Validation is the
+     * server's, against that tool — the browser's is a convenience, never the control.
+     */
+    modifiedToolArgs: z.record(z.string(), z.unknown()).optional(),
 });
 /** Status update during execution (server → client) */
 export const WS_FlowsActorsStatusUpdatePayloadSchema = z.object({