@wildo-ai/saas-models 1.1.3 → 1.1.5

package/dist/esm/requests/manual-controllers-routes-urls.d.ts

@@ -119,7 +119,69 @@ export declare enum ManualControllerRouteKey {
      * Admissibility is a RECORDED DECISION per provider, never derived from a vendor's API surface, so
      * this route reports a decision rather than computing one.
      */
+    /**
+     * Finish an authorization the vendor has just approved — the half the CALLBACK cannot do.
+     *
+     * The callback is reached by a top-level navigation from the vendor's origin, so it carries no
+     * `Authorization` header and never can: a header is set by script on a fetch, and a redirect is
+     * not a fetch. The application's only auth cookie is `SameSite=Strict` on `Path=/api/v1/auth`, so
+     * it is not sent there either. The callback therefore cannot know WHO is finishing the flow, and
+     * for a while it asked anyway — every consent answered `401 UNAUTHENTICATED` and the person saw a
+     * JSON body, with the attempt already consumed so they could not even retry.
+     *
+     * Splitting it puts the authenticated act back on a FETCH, where a bearer token exists. The
+     * callback hands `state` and `code` to the frontend and authenticates nobody; the frontend, which
+     * holds the token, posts them here. Nothing about the guarantee is relaxed — this route consumes
+     * the attempt atomically, re-checks that the finisher is the initiator, and only then exchanges.
+     *
+     * Rejected: binding the attempt to a browser with a second `SameSite=Lax` cookie. It is the
+     * ordinary OAuth-client pattern and it would work, but this application authenticates its API with
+     * bearer tokens and nothing else, and a second auth-bearing cookie is an architectural addition
+     * whose `SameSite` behaviour then has to be reasoned about separately for every deployment shape.
+     */
+    PROVIDER_CONNECTION_COMPLETE = "PROVIDER_CONNECTION_COMPLETE",
     PROVIDER_CONNECTION_CATALOGUE = "PROVIDER_CONNECTION_CATALOGUE",
+    /**
+     * Store a credential somebody TYPED, for a vendor with no authorization flow.
+     *
+     * The sibling of {@link PROVIDER_CONNECTION_START}, and a separate route because the acts differ
+     * completely: one hands back a URL and ends in a redirect from a vendor, this one takes values and
+     * ends in a stored row. Sharing a route would mean a body whose meaning depends on a provider's
+     * contract, which is how a caller ends up sending an access token where a client id belongs.
+     *
+     * It exists on the BACKEND rather than being a generic resource create because this is where
+     * "nothing is typed by hand" stops being a screen's good manners and becomes enforceable: the route
+     * refuses any slug the provider did not declare as identifying an account.
+     */
+    PROVIDER_CONNECTION_STORE_CREDENTIAL = "PROVIDER_CONNECTION_STORE_CREDENTIAL",
+    /**
+     * A short-lived access token for the CALLER's own connected account, handed to the browser (#394 P4).
+     *
+     * The one shape of credential a browser may ever be handed, and the reason it is a route of its
+     * own: a vendor's picker (Drive's, for one) authorizes as the signed-in user and cannot render
+     * without that user's token — so the token is in the browser during picking whether the selected
+     * bytes are later fetched by the backend or not. Everything else about the grant stays server-side:
+     * the refresh token never crosses, the row is resolved as the caller and nobody else, and every
+     * hand-out is a recorded USE of the credential, which is what makes revocation and erasure mean
+     * something for a token that has left the process.
+     */
+    PROVIDER_CONNECTION_ACCESS_TOKEN = "PROVIDER_CONNECTION_ACCESS_TOKEN",
+    /**
+     * A signed-in person's browser triggers ONE declared provider operation, executed on the backend (#367).
+     *
+     * The credential stays on the server: the browser names the provider, the operation and whose account
+     * to spend, and receives the operation's parsed output. Reachable only for operations the application
+     * declared in `providers.browserOperations` — everything else is refused, and every refusal is audited.
+     */
+    PROVIDER_OPERATION_EXECUTE = "PROVIDER_OPERATION_EXECUTE",
+    /**
+     * The CHOICES for one input of a declared provider operation (#333) — a workspace, a project — listed by
+     * running the input's declared options operation through the same connection.
+     *
+     * Admitted only when BOTH the operation and its options operation are declared browser-reachable for
+     * the named connection; a refusal is audited exactly as the execute door's is.
+     */
+    PROVIDER_OPERATION_INPUT_OPTIONS = "PROVIDER_OPERATION_INPUT_OPTIONS",
     /** Enterprise SSO: initiate OAuth2 flow for an org's OIDC connection (Step 15) */
     AUTH_ENTERPRISE_SSO_AUTHORIZE = "AUTH_ENTERPRISE_SSO_AUTHORIZE",
     AUTH_APP_ENTERPRISE_AUTHORIZE = "AUTH_APP_ENTERPRISE_AUTHORIZE",
@@ -232,6 +294,7 @@ export declare enum ManualControllerRouteKey {
     AUTH_PHONE_VERIFY_CONFIRM = "AUTH_PHONE_VERIFY_CONFIRM",
     AUTH_RESEND_VERIFICATION = "AUTH_RESEND_VERIFICATION",
     AUTH_COMPLETE_ORG_ONBOARDING = "AUTH_COMPLETE_ORG_ONBOARDING",
+    AUTH_COMPLETE_PROFILE_ONBOARDING = "AUTH_COMPLETE_PROFILE_ONBOARDING",
     AUTH_ONE_OFF_SESSION_CREATE = "AUTH_ONE_OFF_SESSION_CREATE",
     AUTH_ONE_OFF_SESSION_CREATE_ORG = "AUTH_ONE_OFF_SESSION_CREATE_ORG",
     AUTH_ONE_OFF_SESSION_EXCHANGE = "AUTH_ONE_OFF_SESSION_EXCHANGE",
@@ -243,15 +306,32 @@ export declare enum ManualControllerRouteKey {
     AUTH_METHODS_MINE = "AUTH_METHODS_MINE",
     AUTH_IDENTITY_LINKS_LIST = "AUTH_IDENTITY_LINKS_LIST",
     AUTH_IDENTITY_LINKS_UNLINK = "AUTH_IDENTITY_LINKS_UNLINK",
+    /** Which governed documents the signed-in person owes an acceptance of (#1258). */
+    GOVERNED_DOCUMENT_ACCEPTANCES_OWED = "GOVERNED_DOCUMENT_ACCEPTANCES_OWED",
+    /** Record the signed-in person's acceptance of in-force governed-document releases (#1258). */
+    GOVERNED_DOCUMENT_ACCEPTANCES_ACCEPT = "GOVERNED_DOCUMENT_ACCEPTANCES_ACCEPT",
+    /**
+     * Record that a governed document (e.g. the privacy notice) was DELIVERED to the signed-in caller
+     * (#1258 Step 5 / R11). The anonymous half of the same fact is `ANONYMOUS_USERS.record_notice_delivered`
+     * — two doors because the two callers have different security characteristics, one recorder underneath.
+     */
+    GOVERNED_DOCUMENT_NOTICE_DELIVERED = "GOVERNED_DOCUMENT_NOTICE_DELIVERED",
     AUTH_REAUTH = "AUTH_REAUTH",
     /** Challenge leg of a PASSKEY step-up: WebAuthn is challenge-response, so re-auth needs two round-trips. */
     AUTH_REAUTH_PASSKEY_OPTIONS = "AUTH_REAUTH_PASSKEY_OPTIONS",
+    /** Which factors can re-prove the signed-in person for a given `ReAuthenticationPurpose` (#1417). */
+    AUTH_REAUTH_METHODS = "AUTH_REAUTH_METHODS",
+    /** Start re-authenticating through one of the signed-in person's own linked identity providers (#1441). */
+    AUTH_REAUTH_FEDERATED_AUTHORIZE = "AUTH_REAUTH_FEDERATED_AUTHORIZE",
+    /** Redeem the one-time code a federated re-authentication returned, for its proof (#1441). */
+    AUTH_REAUTH_FEDERATED_EXCHANGE = "AUTH_REAUTH_FEDERATED_EXCHANGE",
     AUTH_SAML_LOGIN = "AUTH_SAML_LOGIN",
     AUTH_SAML_ACS = "AUTH_SAML_ACS",
     AUTH_SAML_METADATA = "AUTH_SAML_METADATA",
     AUTH_SAML_SLO = "AUTH_SAML_SLO",
     /** SP-INITIATED SLO kickoff: the app asks the backend to log the caller out of their SAML session and (when the IdP supports it) redirect to the IdP's SLO endpoint. Distinct from AUTH_SAML_SLO, which is the INBOUND endpoint the IdP calls. */
     AUTH_SAML_SP_LOGOUT = "AUTH_SAML_SP_LOGOUT",
+    AUTH_OIDC_LOGOUT = "AUTH_OIDC_LOGOUT",
     /**
      * Direct file transfer, distinct from the resource registry's own file routes.
      *
@@ -275,8 +355,62 @@ export declare enum ManualControllerRouteKey {
     FILES_METADATA = "FILES_METADATA",
     /** Mint a time-limited share link for a stored file. */
     FILES_SHARE = "FILES_SHARE",
+    /**
+     * Revoke EVERY live share link of a stored file — "stop sharing this file". Its own address rather than a
+     * second verb on {@link FILES_SHARE}: minting answers 201 with a link, revoking answers 200 with a count,
+     * and `/shares` names the collection being emptied.
+     */
+    FILES_SHARES_REVOKE = "FILES_SHARES_REVOKE",
     I18N_GET_LABELS = "I18N_GET_LABELS",
     CHARTS_DATA = "CHARTS_DATA",
+    /**
+     * The application's SUBJECT-ERASURE LANE, summarized — counts only, never a row (#269).
+     *
+     * An evidence reader must be able to say what the erasure lane DID: how many requests arrived, who
+     * raised each, how many were withdrawn, how many completed or failed, and whether the completed ones
+     * carry the outcome they promise. Every read variant on an application's erasure-request resource is
+     * subject-scoped by design — correctly, since the lane is the subject's own door — so before this route
+     * existed the lane could be read one subject at a time, as that subject, and as a whole not at all.
+     *
+     * It is a route rather than a resource verb because the ANSWER is an aggregate. Adding an
+     * application-wide LIST would hand an evidence reader every data subject who ever asked to be erased,
+     * in order to count them — the shape #1244 retired. This endpoint runs the count where the rows live
+     * and returns no identifier, no row and no free text.
+     *
+     * Derived, not authored: the resource, the fields and the two operations come from the application's
+     * own `subjectErasureLane` declaration (#1209), so an application that declares a lane gets this
+     * answer without writing an operation, and an application that declares none gets an explicit
+     * "not applicable" rather than a silence indistinguishable from a lane with no activity.
+     */
+    SUBJECT_ERASURE_LANE_EVIDENCE = "SUBJECT_ERASURE_LANE_EVIDENCE",
+    /**
+     * Every physical model-provider call in a window, as counts: which providers and models, how the
+     * calls ended, what they consumed, and how many records are incomplete. The door onto
+     * `providerCallRecords` for `evidence-requirement:outbound-call-record` C2; it returns no row.
+     */
+    PROVIDER_CALL_EVIDENCE = "PROVIDER_CALL_EVIDENCE",
+    /**
+     * Where the usage rows stand with respect to the provider flush, as counts: pending, reported,
+     * unreportable by reason, and the contradictions `evidence-requirement:usage-flush-run-record` C3
+     * forbids. It returns no row.
+     */
+    USAGE_FLUSH_EVIDENCE = "USAGE_FLUSH_EVIDENCE",
+    /**
+     * Did a SCHEDULED run actually happen as often as it was supposed to (#1029)?
+     *
+     * `assessScheduledEvidenceCoverage` answers it and calls itself "a trusted backend measurement
+     * seam, not an authorization endpoint" — which says the DOOR must carry the gating, not that there
+     * should be no door. Without one the assessment had no caller at all outside its own tests: the
+     * job-execution and payload stores are REPOSITORY_ONLY, so nothing outside the backend process
+     * could reach it, and every PERFORMED clause resting on run history stayed unanswerable.
+     *
+     * POST because the caller supplies the historical SCHEDULE BASIS, which is a body. That is the
+     * seam's own contract — *"an explicitly supplied historical schedule basis… callers must retain its
+     * authorityRefs with the report"* — and the basis is derived from git by
+     * `scripts/assurance/derive-schedule-segments.mjs`, so what the caller sends is reproducible from
+     * commits rather than typed.
+     */
+    SCHEDULED_EVIDENCE_COVERAGE = "SCHEDULED_EVIDENCE_COVERAGE",
     ANALYTICS_EVENTS = "ANALYTICS_EVENTS",
     ANALYTICS_MOMENTS_ACHIEVED = "ANALYTICS_MOMENTS_ACHIEVED",
     PROGRESSION_MILESTONES = "PROGRESSION_MILESTONES",

package/dist/esm/requests/manual-controllers-routes-urls.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manual-controllers-routes-urls.d.ts","sourceRoot":"","sources":["../../../../src/requests/manual-controllers-routes-urls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,kBAAkB,YAAY,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,sCAAsC,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,oCAAoC,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEjF;AAeD,oBAAY,wBAAwB;IAClC,sBAAsB,2BAA2B;IAEjD,aAAa,kBAAkB;IAC/B,0BAA0B,+BAA+B;IACzD,iBAAiB,sBAAsB;IACvC,kBAAkB,uBAAuB;IACzC,qBAAqB,0BAA0B;IAC/C,oBAAoB,yBAAyB;IAE7C;;;;;;;OAOG;IACH,yBAAyB,8BAA8B;IACvD;;;;;;;OAOG;IACH,4BAA4B,iCAAiC;IAC7D;;;;;;;;;;OAUG;IACH,6BAA6B,kCAAkC;IAC/D,kFAAkF;IAClF,6BAA6B,kCAAkC;IAC/D,6BAA6B,kCAAkC;IAC/D,mBAAmB,wBAAwB;IAC3C;;;;OAIG;IACH,oBAAoB,yBAAyB;IAC7C,wFAAwF;IACxF,wBAAwB,6BAA6B;IACrD;;;;OAIG;IACH,0BAA0B,+BAA+B;IACzD,2FAA2F;IAC3F,mBAAmB,wBAAwB;IAC3C,gGAAgG;IAChG,wBAAwB,6BAA6B;IACrD;;;;OAIG;IACH,sBAAsB,2BAA2B;IACjD,iFAAiF;IACjF,uBAAuB,4BAA4B;IACnD,sDAAsD;IACtD,qBAAqB,0BAA0B;IAC/C;;;;;OAKG;IACH,0BAA0B,+BAA+B;IACzD;;;;;;;;OAQG;IACH,kCAAkC,uCAAuC;IACzE;;;;;OAKG;IACH,uBAAuB,4BAA4B;IACnD;;;;;;;;;;;;OAYG;IACH,8BAA8B,mCAAmC;IACjE;;;;;;OAMG;IACH,2BAA2B,gCAAgC;IAC3D,WAAW,gBAAgB;IAC3B,2HAA2H;IAC3H,eAAe,oBAAoB;IACnC,2BAA2B,gCAAgC;IAC3D,4BAA4B,iCAAiC;IAC7D,aAAa,kBAAkB;IAC/B,sBAAsB,2BAA2B;IAIjD,oBAAoB,yBAAyB;IAC7C,sBAAsB,2BAA2B;IAGjD,wBAAwB,6BAA6B;IACrD,yBAAyB,8BAA8B;IACvD,yBAAyB,8BAA8B;IACvD,iBAAiB,sBAAsB;IACvC,kBAAkB,uBAAuB;IAGzC,uBAAuB,4BAA4B;IACnD,yBAAyB,8BAA8B;IAGvD,mBAAmB,wBAAwB;IAC3C,0BAA0B,+BAA+B;IACzD,oBAAoB,yBAAyB;IAG7C,6BAA6B,kCAAkC;IAC/D,4BAA4B,iCAAiC;IAC7D,yBAAyB,8BAA8B;IACvD,wBAAwB,6BAA6B;IACrD,iBAAiB,sBAAsB;IACvC,mBAAmB,wBAAwB;IAC3C,mBAAmB,wBAAwB;IAG3C,oBAAoB,yBAAyB;IAC7C,sBAAsB,2BAA2B;IAGjD,iBAAiB,sBAAsB;IACvC,mBAAmB,wBAAwB;IAG3C,sBAAsB,2BAA2B;IACjD,yBAAyB,8BAA8B;IAGvD,wBAAwB,6BAA6B;IAGrD,4BAA4B,iCAAiC;IAG7D,2BAA2B,gCAAgC;IAC3D,+BAA+B,oCAAoC;IACnE,6BAA6B,kCAAkC;IAC/D,2BAA2B,gCAAgC;IAC3D,+BAA+B,oCAAoC;IAGnE,oBAAoB,yBAAyB;IAC7C,iBAAiB,sBAAsB;IACvC,qBAAqB,0BAA0B;IAC/C,iBAAiB,sBAAsB;IACvC,wBAAwB,6BAA6B;IACrD,0BAA0B,+BAA+B;IACzD,WAAW,gBAAgB;IAC3B,4GAA4G;IAC5G,2BAA2B,gCAAgC;IAG3D,eAAe,oBAAoB;IACnC,aAAa,kBAAkB;IAC/B,kBAAkB,uBAAuB;IACzC,aAAa,kBAAkB;IAC/B,kPAAkP;IAClP,mBAAmB,wBAAwB;IAE3C;;;;;;;;OAQG;IACH,gGAAgG;IAChG,yBAAyB,8BAA8B;IACvD,8EAA8E;IAC9E,yBAAyB,8BAA8B;IACvD;;;;OAIG;IACH,UAAU,eAAe;IACzB,yEAAyE;IACzE,cAAc,mBAAmB;IACjC,wDAAwD;IACxD,WAAW,gBAAgB;IAE3B,eAAe,oBAAoB;IAEnC,WAAW,gBAAgB;IAE3B,gBAAgB,qBAAqB;IACrC,0BAA0B,+BAA+B;IAEzD,sBAAsB,2BAA2B;IACjD,iBAAiB,sBAAsB;IAEvC,yEAAyE;IACzE,0BAA0B,+BAA+B;IACzD,qEAAqE;IACrE,oBAAoB,yBAAyB;IAG7C;;;;;OAKG;IACH,cAAc,mBAAmB;IACjC;;;;OAIG;IACH,SAAS,cAAc;IAGvB;;;;;;;;;OASG;IACH,YAAY,iBAAiB;IAC7B;;;;;;;;;OASG;IACH,+BAA+B,oCAAoC;CACpE;AAED,eAAO,MAAM,6BAA6B,EAAE,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAiJlF,CAAC;AAOF,oBAAY,kBAAkB;IAC5B,eAAe,oBAAoB;IACnC,gBAAgB,qBAAqB;IACrC,WAAW,gBAAgB;CAC5B;AAED,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAIjE,CAAC"}
+{"version":3,"file":"manual-controllers-routes-urls.d.ts","sourceRoot":"","sources":["../../../../src/requests/manual-controllers-routes-urls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,kBAAkB,YAAY,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,sCAAsC,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,oCAAoC,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEjF;AAeD,oBAAY,wBAAwB;IAClC,sBAAsB,2BAA2B;IAEjD,aAAa,kBAAkB;IAC/B,0BAA0B,+BAA+B;IACzD,iBAAiB,sBAAsB;IACvC,kBAAkB,uBAAuB;IACzC,qBAAqB,0BAA0B;IAC/C,oBAAoB,yBAAyB;IAE7C;;;;;;;OAOG;IACH,yBAAyB,8BAA8B;IACvD;;;;;;;OAOG;IACH,4BAA4B,iCAAiC;IAC7D;;;;;;;;;;OAUG;IACH;;;;;;;;;;;;;;;;;;;OAmBG;IACH,4BAA4B,iCAAiC;IAC7D,6BAA6B,kCAAkC;IAC/D;;;;;;;;;;;OAWG;IACH,oCAAoC,yCAAyC;IAC7E;;;;;;;;;;OAUG;IACH,gCAAgC,qCAAqC;IACrE;;;;;;OAMG;IACH,0BAA0B,+BAA+B;IACzD;;;;;;OAMG;IACH,gCAAgC,qCAAqC;IACrE,kFAAkF;IAClF,6BAA6B,kCAAkC;IAC/D,6BAA6B,kCAAkC;IAC/D,mBAAmB,wBAAwB;IAC3C;;;;OAIG;IACH,oBAAoB,yBAAyB;IAC7C,wFAAwF;IACxF,wBAAwB,6BAA6B;IACrD;;;;OAIG;IACH,0BAA0B,+BAA+B;IACzD,2FAA2F;IAC3F,mBAAmB,wBAAwB;IAC3C,gGAAgG;IAChG,wBAAwB,6BAA6B;IACrD;;;;OAIG;IACH,sBAAsB,2BAA2B;IACjD,iFAAiF;IACjF,uBAAuB,4BAA4B;IACnD,sDAAsD;IACtD,qBAAqB,0BAA0B;IAC/C;;;;;OAKG;IACH,0BAA0B,+BAA+B;IACzD;;;;;;;;OAQG;IACH,kCAAkC,uCAAuC;IACzE;;;;;OAKG;IACH,uBAAuB,4BAA4B;IACnD;;;;;;;;;;;;OAYG;IACH,8BAA8B,mCAAmC;IACjE;;;;;;OAMG;IACH,2BAA2B,gCAAgC;IAC3D,WAAW,gBAAgB;IAC3B,2HAA2H;IAC3H,eAAe,oBAAoB;IACnC,2BAA2B,gCAAgC;IAC3D,4BAA4B,iCAAiC;IAC7D,aAAa,kBAAkB;IAC/B,sBAAsB,2BAA2B;IAIjD,oBAAoB,yBAAyB;IAC7C,sBAAsB,2BAA2B;IAGjD,wBAAwB,6BAA6B;IACrD,yBAAyB,8BAA8B;IACvD,yBAAyB,8BAA8B;IACvD,iBAAiB,sBAAsB;IACvC,kBAAkB,uBAAuB;IAGzC,uBAAuB,4BAA4B;IACnD,yBAAyB,8BAA8B;IAGvD,mBAAmB,wBAAwB;IAC3C,0BAA0B,+BAA+B;IACzD,oBAAoB,yBAAyB;IAG7C,6BAA6B,kCAAkC;IAC/D,4BAA4B,iCAAiC;IAC7D,yBAAyB,8BAA8B;IACvD,wBAAwB,6BAA6B;IACrD,iBAAiB,sBAAsB;IACvC,mBAAmB,wBAAwB;IAC3C,mBAAmB,wBAAwB;IAG3C,oBAAoB,yBAAyB;IAC7C,sBAAsB,2BAA2B;IAGjD,iBAAiB,sBAAsB;IACvC,mBAAmB,wBAAwB;IAG3C,sBAAsB,2BAA2B;IACjD,yBAAyB,8BAA8B;IAGvD,wBAAwB,6BAA6B;IAGrD,4BAA4B,iCAAiC;IAE7D,gCAAgC,qCAAqC;IAGrE,2BAA2B,gCAAgC;IAC3D,+BAA+B,oCAAoC;IACnE,6BAA6B,kCAAkC;IAC/D,2BAA2B,gCAAgC;IAC3D,+BAA+B,oCAAoC;IAGnE,oBAAoB,yBAAyB;IAC7C,iBAAiB,sBAAsB;IACvC,qBAAqB,0BAA0B;IAC/C,iBAAiB,sBAAsB;IACvC,wBAAwB,6BAA6B;IACrD,0BAA0B,+BAA+B;IACzD,mFAAmF;IACnF,kCAAkC,uCAAuC;IACzE,+FAA+F;IAC/F,oCAAoC,yCAAyC;IAC7E;;;;OAIG;IACH,kCAAkC,uCAAuC;IACzE,WAAW,gBAAgB;IAC3B,4GAA4G;IAC5G,2BAA2B,gCAAgC;IAC3D,qGAAqG;IACrG,mBAAmB,wBAAwB;IAC3C,2GAA2G;IAC3G,+BAA+B,oCAAoC;IACnE,8FAA8F;IAC9F,8BAA8B,mCAAmC;IAGjE,eAAe,oBAAoB;IACnC,aAAa,kBAAkB;IAC/B,kBAAkB,uBAAuB;IACzC,aAAa,kBAAkB;IAC/B,kPAAkP;IAClP,mBAAmB,wBAAwB;IAC3C,gBAAgB,qBAAqB;IAErC;;;;;;;;OAQG;IACH,gGAAgG;IAChG,yBAAyB,8BAA8B;IACvD,8EAA8E;IAC9E,yBAAyB,8BAA8B;IACvD;;;;OAIG;IACH,UAAU,eAAe;IACzB,yEAAyE;IACzE,cAAc,mBAAmB;IACjC,wDAAwD;IACxD,WAAW,gBAAgB;IAC3B;;;;OAIG;IACH,mBAAmB,wBAAwB;IAE3C,eAAe,oBAAoB;IAEnC,WAAW,gBAAgB;IAC3B;;;;;;;;;;;;;;;;;;OAkBG;IACH,6BAA6B,kCAAkC;IAC/D;;;;OAIG;IACH,sBAAsB,2BAA2B;IACjD;;;;OAIG;IACH,oBAAoB,yBAAyB;IAC7C;;;;;;;;;;;;;;OAcG;IACH,2BAA2B,gCAAgC;IAE3D,gBAAgB,qBAAqB;IACrC,0BAA0B,+BAA+B;IAEzD,sBAAsB,2BAA2B;IACjD,iBAAiB,sBAAsB;IAEvC,yEAAyE;IACzE,0BAA0B,+BAA+B;IACzD,qEAAqE;IACrE,oBAAoB,yBAAyB;IAG7C;;;;;OAKG;IACH,cAAc,mBAAmB;IACjC;;;;OAIG;IACH,SAAS,cAAc;IAGvB;;;;;;;;;OASG;IACH,YAAY,iBAAiB;IAC7B;;;;;;;;;OASG;IACH,+BAA+B,oCAAoC;CACpE;AAED,eAAO,MAAM,6BAA6B,EAAE,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAmKlF,CAAC;AAOF,oBAAY,kBAAkB;IAC5B,eAAe,oBAAoB;IACnC,gBAAgB,qBAAqB;IACrC,WAAW,gBAAgB;CAC5B;AAED,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAIjE,CAAC"}

package/dist/esm/requests/manual-controllers-routes-urls.js

@@ -136,7 +136,69 @@ export var ManualControllerRouteKey;
      * Admissibility is a RECORDED DECISION per provider, never derived from a vendor's API surface, so
      * this route reports a decision rather than computing one.
      */
+    /**
+     * Finish an authorization the vendor has just approved — the half the CALLBACK cannot do.
+     *
+     * The callback is reached by a top-level navigation from the vendor's origin, so it carries no
+     * `Authorization` header and never can: a header is set by script on a fetch, and a redirect is
+     * not a fetch. The application's only auth cookie is `SameSite=Strict` on `Path=/api/v1/auth`, so
+     * it is not sent there either. The callback therefore cannot know WHO is finishing the flow, and
+     * for a while it asked anyway — every consent answered `401 UNAUTHENTICATED` and the person saw a
+     * JSON body, with the attempt already consumed so they could not even retry.
+     *
+     * Splitting it puts the authenticated act back on a FETCH, where a bearer token exists. The
+     * callback hands `state` and `code` to the frontend and authenticates nobody; the frontend, which
+     * holds the token, posts them here. Nothing about the guarantee is relaxed — this route consumes
+     * the attempt atomically, re-checks that the finisher is the initiator, and only then exchanges.
+     *
+     * Rejected: binding the attempt to a browser with a second `SameSite=Lax` cookie. It is the
+     * ordinary OAuth-client pattern and it would work, but this application authenticates its API with
+     * bearer tokens and nothing else, and a second auth-bearing cookie is an architectural addition
+     * whose `SameSite` behaviour then has to be reasoned about separately for every deployment shape.
+     */
+    ManualControllerRouteKey["PROVIDER_CONNECTION_COMPLETE"] = "PROVIDER_CONNECTION_COMPLETE";
     ManualControllerRouteKey["PROVIDER_CONNECTION_CATALOGUE"] = "PROVIDER_CONNECTION_CATALOGUE";
+    /**
+     * Store a credential somebody TYPED, for a vendor with no authorization flow.
+     *
+     * The sibling of {@link PROVIDER_CONNECTION_START}, and a separate route because the acts differ
+     * completely: one hands back a URL and ends in a redirect from a vendor, this one takes values and
+     * ends in a stored row. Sharing a route would mean a body whose meaning depends on a provider's
+     * contract, which is how a caller ends up sending an access token where a client id belongs.
+     *
+     * It exists on the BACKEND rather than being a generic resource create because this is where
+     * "nothing is typed by hand" stops being a screen's good manners and becomes enforceable: the route
+     * refuses any slug the provider did not declare as identifying an account.
+     */
+    ManualControllerRouteKey["PROVIDER_CONNECTION_STORE_CREDENTIAL"] = "PROVIDER_CONNECTION_STORE_CREDENTIAL";
+    /**
+     * A short-lived access token for the CALLER's own connected account, handed to the browser (#394 P4).
+     *
+     * The one shape of credential a browser may ever be handed, and the reason it is a route of its
+     * own: a vendor's picker (Drive's, for one) authorizes as the signed-in user and cannot render
+     * without that user's token — so the token is in the browser during picking whether the selected
+     * bytes are later fetched by the backend or not. Everything else about the grant stays server-side:
+     * the refresh token never crosses, the row is resolved as the caller and nobody else, and every
+     * hand-out is a recorded USE of the credential, which is what makes revocation and erasure mean
+     * something for a token that has left the process.
+     */
+    ManualControllerRouteKey["PROVIDER_CONNECTION_ACCESS_TOKEN"] = "PROVIDER_CONNECTION_ACCESS_TOKEN";
+    /**
+     * A signed-in person's browser triggers ONE declared provider operation, executed on the backend (#367).
+     *
+     * The credential stays on the server: the browser names the provider, the operation and whose account
+     * to spend, and receives the operation's parsed output. Reachable only for operations the application
+     * declared in `providers.browserOperations` — everything else is refused, and every refusal is audited.
+     */
+    ManualControllerRouteKey["PROVIDER_OPERATION_EXECUTE"] = "PROVIDER_OPERATION_EXECUTE";
+    /**
+     * The CHOICES for one input of a declared provider operation (#333) — a workspace, a project — listed by
+     * running the input's declared options operation through the same connection.
+     *
+     * Admitted only when BOTH the operation and its options operation are declared browser-reachable for
+     * the named connection; a refusal is audited exactly as the execute door's is.
+     */
+    ManualControllerRouteKey["PROVIDER_OPERATION_INPUT_OPTIONS"] = "PROVIDER_OPERATION_INPUT_OPTIONS";
     /** Enterprise SSO: initiate OAuth2 flow for an org's OIDC connection (Step 15) */
     ManualControllerRouteKey["AUTH_ENTERPRISE_SSO_AUTHORIZE"] = "AUTH_ENTERPRISE_SSO_AUTHORIZE";
     ManualControllerRouteKey["AUTH_APP_ENTERPRISE_AUTHORIZE"] = "AUTH_APP_ENTERPRISE_AUTHORIZE";
@@ -262,6 +324,8 @@ export var ManualControllerRouteKey;
     ManualControllerRouteKey["AUTH_RESEND_VERIFICATION"] = "AUTH_RESEND_VERIFICATION";
     // W5.7: Complete org onboarding (deferred org creation)
     ManualControllerRouteKey["AUTH_COMPLETE_ORG_ONBOARDING"] = "AUTH_COMPLETE_ORG_ONBOARDING";
+    // #1374: Complete the profile-names obligation (names collected after the address is proven)
+    ManualControllerRouteKey["AUTH_COMPLETE_PROFILE_ONBOARDING"] = "AUTH_COMPLETE_PROFILE_ONBOARDING";
     // W7.3b: One-off session token management
     ManualControllerRouteKey["AUTH_ONE_OFF_SESSION_CREATE"] = "AUTH_ONE_OFF_SESSION_CREATE";
     ManualControllerRouteKey["AUTH_ONE_OFF_SESSION_CREATE_ORG"] = "AUTH_ONE_OFF_SESSION_CREATE_ORG";
@@ -275,9 +339,25 @@ export var ManualControllerRouteKey;
     ManualControllerRouteKey["AUTH_METHODS_MINE"] = "AUTH_METHODS_MINE";
     ManualControllerRouteKey["AUTH_IDENTITY_LINKS_LIST"] = "AUTH_IDENTITY_LINKS_LIST";
     ManualControllerRouteKey["AUTH_IDENTITY_LINKS_UNLINK"] = "AUTH_IDENTITY_LINKS_UNLINK";
+    /** Which governed documents the signed-in person owes an acceptance of (#1258). */
+    ManualControllerRouteKey["GOVERNED_DOCUMENT_ACCEPTANCES_OWED"] = "GOVERNED_DOCUMENT_ACCEPTANCES_OWED";
+    /** Record the signed-in person's acceptance of in-force governed-document releases (#1258). */
+    ManualControllerRouteKey["GOVERNED_DOCUMENT_ACCEPTANCES_ACCEPT"] = "GOVERNED_DOCUMENT_ACCEPTANCES_ACCEPT";
+    /**
+     * Record that a governed document (e.g. the privacy notice) was DELIVERED to the signed-in caller
+     * (#1258 Step 5 / R11). The anonymous half of the same fact is `ANONYMOUS_USERS.record_notice_delivered`
+     * — two doors because the two callers have different security characteristics, one recorder underneath.
+     */
+    ManualControllerRouteKey["GOVERNED_DOCUMENT_NOTICE_DELIVERED"] = "GOVERNED_DOCUMENT_NOTICE_DELIVERED";
     ManualControllerRouteKey["AUTH_REAUTH"] = "AUTH_REAUTH";
     /** Challenge leg of a PASSKEY step-up: WebAuthn is challenge-response, so re-auth needs two round-trips. */
     ManualControllerRouteKey["AUTH_REAUTH_PASSKEY_OPTIONS"] = "AUTH_REAUTH_PASSKEY_OPTIONS";
+    /** Which factors can re-prove the signed-in person for a given `ReAuthenticationPurpose` (#1417). */
+    ManualControllerRouteKey["AUTH_REAUTH_METHODS"] = "AUTH_REAUTH_METHODS";
+    /** Start re-authenticating through one of the signed-in person's own linked identity providers (#1441). */
+    ManualControllerRouteKey["AUTH_REAUTH_FEDERATED_AUTHORIZE"] = "AUTH_REAUTH_FEDERATED_AUTHORIZE";
+    /** Redeem the one-time code a federated re-authentication returned, for its proof (#1441). */
+    ManualControllerRouteKey["AUTH_REAUTH_FEDERATED_EXCHANGE"] = "AUTH_REAUTH_FEDERATED_EXCHANGE";
     // SAML Routes (AUTH-2)
     ManualControllerRouteKey["AUTH_SAML_LOGIN"] = "AUTH_SAML_LOGIN";
     ManualControllerRouteKey["AUTH_SAML_ACS"] = "AUTH_SAML_ACS";
@@ -285,6 +365,7 @@ export var ManualControllerRouteKey;
     ManualControllerRouteKey["AUTH_SAML_SLO"] = "AUTH_SAML_SLO";
     /** SP-INITIATED SLO kickoff: the app asks the backend to log the caller out of their SAML session and (when the IdP supports it) redirect to the IdP's SLO endpoint. Distinct from AUTH_SAML_SLO, which is the INBOUND endpoint the IdP calls. */
     ManualControllerRouteKey["AUTH_SAML_SP_LOGOUT"] = "AUTH_SAML_SP_LOGOUT";
+    ManualControllerRouteKey["AUTH_OIDC_LOGOUT"] = "AUTH_OIDC_LOGOUT";
     /**
      * Direct file transfer, distinct from the resource registry's own file routes.
      *
@@ -308,8 +389,62 @@ export var ManualControllerRouteKey;
     ManualControllerRouteKey["FILES_METADATA"] = "FILES_METADATA";
     /** Mint a time-limited share link for a stored file. */
     ManualControllerRouteKey["FILES_SHARE"] = "FILES_SHARE";
+    /**
+     * Revoke EVERY live share link of a stored file — "stop sharing this file". Its own address rather than a
+     * second verb on {@link FILES_SHARE}: minting answers 201 with a link, revoking answers 200 with a count,
+     * and `/shares` names the collection being emptied.
+     */
+    ManualControllerRouteKey["FILES_SHARES_REVOKE"] = "FILES_SHARES_REVOKE";
     ManualControllerRouteKey["I18N_GET_LABELS"] = "I18N_GET_LABELS";
     ManualControllerRouteKey["CHARTS_DATA"] = "CHARTS_DATA";
+    /**
+     * The application's SUBJECT-ERASURE LANE, summarized — counts only, never a row (#269).
+     *
+     * An evidence reader must be able to say what the erasure lane DID: how many requests arrived, who
+     * raised each, how many were withdrawn, how many completed or failed, and whether the completed ones
+     * carry the outcome they promise. Every read variant on an application's erasure-request resource is
+     * subject-scoped by design — correctly, since the lane is the subject's own door — so before this route
+     * existed the lane could be read one subject at a time, as that subject, and as a whole not at all.
+     *
+     * It is a route rather than a resource verb because the ANSWER is an aggregate. Adding an
+     * application-wide LIST would hand an evidence reader every data subject who ever asked to be erased,
+     * in order to count them — the shape #1244 retired. This endpoint runs the count where the rows live
+     * and returns no identifier, no row and no free text.
+     *
+     * Derived, not authored: the resource, the fields and the two operations come from the application's
+     * own `subjectErasureLane` declaration (#1209), so an application that declares a lane gets this
+     * answer without writing an operation, and an application that declares none gets an explicit
+     * "not applicable" rather than a silence indistinguishable from a lane with no activity.
+     */
+    ManualControllerRouteKey["SUBJECT_ERASURE_LANE_EVIDENCE"] = "SUBJECT_ERASURE_LANE_EVIDENCE";
+    /**
+     * Every physical model-provider call in a window, as counts: which providers and models, how the
+     * calls ended, what they consumed, and how many records are incomplete. The door onto
+     * `providerCallRecords` for `evidence-requirement:outbound-call-record` C2; it returns no row.
+     */
+    ManualControllerRouteKey["PROVIDER_CALL_EVIDENCE"] = "PROVIDER_CALL_EVIDENCE";
+    /**
+     * Where the usage rows stand with respect to the provider flush, as counts: pending, reported,
+     * unreportable by reason, and the contradictions `evidence-requirement:usage-flush-run-record` C3
+     * forbids. It returns no row.
+     */
+    ManualControllerRouteKey["USAGE_FLUSH_EVIDENCE"] = "USAGE_FLUSH_EVIDENCE";
+    /**
+     * Did a SCHEDULED run actually happen as often as it was supposed to (#1029)?
+     *
+     * `assessScheduledEvidenceCoverage` answers it and calls itself "a trusted backend measurement
+     * seam, not an authorization endpoint" — which says the DOOR must carry the gating, not that there
+     * should be no door. Without one the assessment had no caller at all outside its own tests: the
+     * job-execution and payload stores are REPOSITORY_ONLY, so nothing outside the backend process
+     * could reach it, and every PERFORMED clause resting on run history stayed unanswerable.
+     *
+     * POST because the caller supplies the historical SCHEDULE BASIS, which is a body. That is the
+     * seam's own contract — *"an explicitly supplied historical schedule basis… callers must retain its
+     * authorityRefs with the report"* — and the basis is derived from git by
+     * `scripts/assurance/derive-schedule-segments.mjs`, so what the caller sends is reproducible from
+     * commits rather than typed.
+     */
+    ManualControllerRouteKey["SCHEDULED_EVIDENCE_COVERAGE"] = "SCHEDULED_EVIDENCE_COVERAGE";
     ManualControllerRouteKey["ANALYTICS_EVENTS"] = "ANALYTICS_EVENTS";
     ManualControllerRouteKey["ANALYTICS_MOMENTS_ACHIEVED"] = "ANALYTICS_MOMENTS_ACHIEVED";
     ManualControllerRouteKey["PROGRESSION_MILESTONES"] = "PROGRESSION_MILESTONES";
@@ -366,7 +501,12 @@ export const MANUAL_CONTROLLER_ROUTES_URLS = {
     [ManualControllerRouteKey.AUTH_OAUTH2_CALLBACK]: '/auth/oauth2/callback/:providerRef',
     [ManualControllerRouteKey.PROVIDER_CONNECTION_START]: '/connections/:providerRef/start',
     [ManualControllerRouteKey.PROVIDER_CONNECTION_CALLBACK]: '/connections/callback',
+    [ManualControllerRouteKey.PROVIDER_CONNECTION_COMPLETE]: '/connections/complete',
     [ManualControllerRouteKey.PROVIDER_CONNECTION_CATALOGUE]: '/connections',
+    [ManualControllerRouteKey.PROVIDER_CONNECTION_STORE_CREDENTIAL]: '/connections/:providerRef/credential',
+    [ManualControllerRouteKey.PROVIDER_CONNECTION_ACCESS_TOKEN]: '/connections/:providerRef/access-token',
+    [ManualControllerRouteKey.PROVIDER_OPERATION_EXECUTE]: '/provider-operations/:providerRef/:operationId',
+    [ManualControllerRouteKey.PROVIDER_OPERATION_INPUT_OPTIONS]: '/provider-operations/:providerRef/:operationId/input-options/:inputField',
     [ManualControllerRouteKey.AUTH_ENTERPRISE_SSO_AUTHORIZE]: '/auth/enterprise/authorize/:orgId/:connectionId',
     [ManualControllerRouteKey.AUTH_APP_ENTERPRISE_AUTHORIZE]: '/auth/app-enterprise/authorize/:connectionId',
     [ManualControllerRouteKey.AUTH_TOKEN_EXCHANGE]: '/auth/token/exchange',
@@ -417,6 +557,7 @@ export const MANUAL_CONTROLLER_ROUTES_URLS = {
     [ManualControllerRouteKey.AUTH_RESEND_VERIFICATION]: '/auth/resend-verification',
     // W5.7: Complete org onboarding
     [ManualControllerRouteKey.AUTH_COMPLETE_ORG_ONBOARDING]: '/auth/onboarding/complete-org',
+    [ManualControllerRouteKey.AUTH_COMPLETE_PROFILE_ONBOARDING]: '/auth/onboarding/complete-profile',
     // W7.3b: One-off session token management
     [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_CREATE]: '/apps/:applicationId/auth/one-off-session',
     [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_CREATE_ORG]: '/orgs/:organizationId/apps/:applicationId/auth/one-off-session',
@@ -430,14 +571,21 @@ export const MANUAL_CONTROLLER_ROUTES_URLS = {
     [ManualControllerRouteKey.AUTH_METHODS_MINE]: '/auth/methods/mine',
     [ManualControllerRouteKey.AUTH_IDENTITY_LINKS_LIST]: '/auth/identity-links',
     [ManualControllerRouteKey.AUTH_IDENTITY_LINKS_UNLINK]: '/auth/identity-links/:linkId',
+    [ManualControllerRouteKey.GOVERNED_DOCUMENT_ACCEPTANCES_OWED]: '/governed-documents/acceptances/owed',
+    [ManualControllerRouteKey.GOVERNED_DOCUMENT_ACCEPTANCES_ACCEPT]: '/governed-documents/acceptances',
+    [ManualControllerRouteKey.GOVERNED_DOCUMENT_NOTICE_DELIVERED]: '/governed-documents/notice-delivered',
     [ManualControllerRouteKey.AUTH_REAUTH]: '/auth/reauth',
     [ManualControllerRouteKey.AUTH_REAUTH_PASSKEY_OPTIONS]: '/auth/reauth/passkey/options',
+    [ManualControllerRouteKey.AUTH_REAUTH_METHODS]: '/auth/reauth/methods',
+    [ManualControllerRouteKey.AUTH_REAUTH_FEDERATED_AUTHORIZE]: '/auth/reauth/federated/authorize',
+    [ManualControllerRouteKey.AUTH_REAUTH_FEDERATED_EXCHANGE]: '/auth/reauth/federated/exchange',
     // SAML Routes (AUTH-2)
     [ManualControllerRouteKey.AUTH_SAML_LOGIN]: '/auth/saml/login/:connectionId',
     [ManualControllerRouteKey.AUTH_SAML_ACS]: '/auth/saml/acs',
     [ManualControllerRouteKey.AUTH_SAML_METADATA]: '/auth/saml/metadata/:scopeType/:scopeId',
     [ManualControllerRouteKey.AUTH_SAML_SLO]: '/auth/saml/slo',
     [ManualControllerRouteKey.AUTH_SAML_SP_LOGOUT]: '/auth/saml/logout',
+    [ManualControllerRouteKey.AUTH_OIDC_LOGOUT]: '/auth/oidc/logout',
     // Direct file transfer. `upload-grants` MUST stay ahead of the `:fileId` family at the mount site,
     // or Express reads `upload-grants` as a file id — the controller registers them in that order.
     [ManualControllerRouteKey.FILES_UPLOAD_GRANT_STATUS]: '/files/upload-grants/:token',
@@ -445,8 +593,13 @@ export const MANUAL_CONTROLLER_ROUTES_URLS = {
     [ManualControllerRouteKey.FILES_ITEM]: '/files/:fileId',
     [ManualControllerRouteKey.FILES_METADATA]: '/files/:fileId/metadata',
     [ManualControllerRouteKey.FILES_SHARE]: '/files/:fileId/share',
+    [ManualControllerRouteKey.FILES_SHARES_REVOKE]: '/files/:fileId/shares',
     [ManualControllerRouteKey.I18N_GET_LABELS]: '/i18n/labels',
     [ManualControllerRouteKey.CHARTS_DATA]: '/charts/:chartRef/data',
+    [ManualControllerRouteKey.SUBJECT_ERASURE_LANE_EVIDENCE]: '/assurance/subject-erasure-lane-evidence',
+    [ManualControllerRouteKey.PROVIDER_CALL_EVIDENCE]: '/assurance/provider-call-evidence',
+    [ManualControllerRouteKey.USAGE_FLUSH_EVIDENCE]: '/assurance/usage-flush-evidence',
+    [ManualControllerRouteKey.SCHEDULED_EVIDENCE_COVERAGE]: '/assurance/scheduled-evidence-coverage',
     // MFA — Email OTP (Step 10)
     [ManualControllerRouteKey.AUTH_MFA_EMAIL_OTP_SEND]: '/auth/mfa/email-otp/send',
     [ManualControllerRouteKey.AUTH_MFA_EMAIL_OTP_VERIFY]: '/auth/mfa/email-otp/verify',