@wildo-ai/saas-models 1.1.3 → 1.1.5

package/dist/esm/requests/manual-controllers-routes-urls.js.map

@@ -1 +1 @@
-{"version":3,"file":"manual-controllers-routes-urls.js","sourceRoot":"","sources":["../../../../src/requests/manual-controllers-routes-urls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,SAAS,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,sCAAsC,CAAC,UAAkB;IACvE,OAAO,+BAA+B,CAAC,4BAA4B,EAAE,UAAU,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,oCAAoC,CAAC,YAAoB;IACvE,OAAO,+BAA+B,CAAC,0BAA0B,EAAE,YAAY,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,+BAA+B,CAAC,gBAAwB,EAAE,IAAY;IAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,OAAO,gBAAgB,gBAAgB,GAAG,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,UAAU,EAAE,EAAE,CAAC;AAC9H,CAAC;AAED,MAAM,CAAN,IAAY,wBAqRX;AArRD,WAAY,wBAAwB;IAClC,6EAAiD,CAAA;IAEjD,2DAA+B,CAAA;IAC/B,qFAAyD,CAAA;IACzD,mEAAuC,CAAA;IACvC,qEAAyC,CAAA;IACzC,2EAA+C,CAAA;IAC/C,yEAA6C,CAAA;IAE7C;;;;;;;OAOG;IACH,mFAAuD,CAAA;IACvD;;;;;;;OAOG;IACH,yFAA6D,CAAA;IAC7D;;;;;;;;;;OAUG;IACH,2FAA+D,CAAA;IAC/D,kFAAkF;IAClF,2FAA+D,CAAA;IAC/D,2FAA+D,CAAA;IAC/D,uEAA2C,CAAA;IAC3C;;;;OAIG;IACH,yEAA6C,CAAA;IAC7C,wFAAwF;IACxF,iFAAqD,CAAA;IACrD;;;;OAIG;IACH,qFAAyD,CAAA;IACzD,2FAA2F;IAC3F,uEAA2C,CAAA;IAC3C,gGAAgG;IAChG,iFAAqD,CAAA;IACrD;;;;OAIG;IACH,6EAAiD,CAAA;IACjD,iFAAiF;IACjF,+EAAmD,CAAA;IACnD,sDAAsD;IACtD,2EAA+C,CAAA;IAC/C;;;;;OAKG;IACH,qFAAyD,CAAA;IACzD;;;;;;;;OAQG;IACH,qGAAyE,CAAA;IACzE;;;;;OAKG;IACH,+EAAmD,CAAA;IACnD;;;;;;;;;;;;OAYG;IACH,6FAAiE,CAAA;IACjE;;;;;;OAMG;IACH,uFAA2D,CAAA;IAC3D,uDAA2B,CAAA;IAC3B,2HAA2H;IAC3H,+DAAmC,CAAA;IACnC,uFAA2D,CAAA;IAC3D,yFAA6D,CAAA;IAC7D,2DAA+B,CAAA;IAC/B,6EAAiD,CAAA;IACjD,8EAA8E;IAC9E,gFAAgF;IAChF,8EAA8E;IAC9E,yEAA6C,CAAA;IAC7C,6EAAiD,CAAA;IACjD,qFAAqF;IACrF,2FAA2F;IAC3F,iFAAqD,CAAA;IACrD,mFAAuD,CAAA;IACvD,mFAAuD,CAAA;IACvD,mEAAuC,CAAA;IACvC,qEAAyC,CAAA;IAEzC,4BAA4B;IAC5B,+EAAmD,CAAA;IACnD,mFAAuD,CAAA;IAEvD,uBAAuB;IACvB,uEAA2C,CAAA;IAC3C,qFAAyD,CAAA;IACzD,yEAA6C,CAAA;IAE7C,qCAAqC;IACrC,2FAA+D,CAAA;IAC/D,yFAA6D,CAAA;IAC7D,mFAAuD,CAAA;IACvD,iFAAqD,CAAA;IACrD,mEAAuC,CAAA;IACvC,uEAA2C,CAAA;IAC3C,uEAA2C,CAAA;IAE3C,wBAAwB;IACxB,yEAA6C,CAAA;IAC7C,6EAAiD,CAAA;IAEjD,qBAAqB;IACrB,mEAAuC,CAAA;IACvC,uEAA2C,CAAA;IAE3C,gCAAgC;IAChC,6EAAiD,CAAA;IACjD,mFAAuD,CAAA;IAEvD,iCAAiC;IACjC,iFAAqD,CAAA;IAErD,wDAAwD;IACxD,yFAA6D,CAAA;IAE7D,0CAA0C;IAC1C,uFAA2D,CAAA;IAC3D,+FAAmE,CAAA;IACnE,2FAA+D,CAAA;IAC/D,uFAA2D,CAAA;IAC3D,+FAAmE,CAAA;IAEnE,2BAA2B;IAC3B,yEAA6C,CAAA;IAC7C,mEAAuC,CAAA;IACvC,2EAA+C,CAAA;IAC/C,mEAAuC,CAAA;IACvC,iFAAqD,CAAA;IACrD,qFAAyD,CAAA;IACzD,uDAA2B,CAAA;IAC3B,4GAA4G;IAC5G,uFAA2D,CAAA;IAE3D,uBAAuB;IACvB,+DAAmC,CAAA;IACnC,2DAA+B,CAAA;IAC/B,qEAAyC,CAAA;IACzC,2DAA+B,CAAA;IAC/B,kPAAkP;IAClP,uEAA2C,CAAA;IAE3C;;;;;;;;OAQG;IACH,gGAAgG;IAChG,mFAAuD,CAAA;IACvD,8EAA8E;IAC9E,mFAAuD,CAAA;IACvD;;;;OAIG;IACH,qDAAyB,CAAA;IACzB,yEAAyE;IACzE,6DAAiC,CAAA;IACjC,wDAAwD;IACxD,uDAA2B,CAAA;IAE3B,+DAAmC,CAAA;IAEnC,uDAA2B,CAAA;IAE3B,iEAAqC,CAAA;IACrC,qFAAyD,CAAA;IAEzD,6EAAiD,CAAA;IACjD,mEAAuC,CAAA;IAEvC,yEAAyE;IACzE,qFAAyD,CAAA;IACzD,qEAAqE;IACrE,yEAA6C,CAAA;IAE7C,+DAA+D;IAC/D;;;;;OAKG;IACH,6DAAiC,CAAA;IACjC;;;;OAIG;IACH,mDAAuB,CAAA;IAEvB,6EAA6E;IAC7E;;;;;;;;;OASG;IACH,yDAA6B,CAAA;IAC7B;;;;;;;;;OASG;IACH,+FAAmE,CAAA;AACrE,CAAC,EArRW,wBAAwB,KAAxB,wBAAwB,QAqRnC;AAED,MAAM,CAAC,MAAM,6BAA6B,GAA6C;IACrF,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,qBAAqB;IAExE,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,gBAAgB;IAC1D,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,6BAA6B;IACpF,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAClE,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE,qBAAqB;IACpE,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE,qCAAqC;IACvF,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,oCAAoC;IAErF,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,iCAAiC;IACvF,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,uBAAuB;IAChF,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,cAAc;IACxE,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,iDAAiD;IAC3G,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,8CAA8C;IACxG,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,sBAAsB;IACtE,qEAAqE;IACrE,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,cAAc;IAC/D,wGAAwG;IACxG,kGAAkG;IAClG,oGAAoG;IACpG,gGAAgG;IAChG,qGAAqG;IACrG,oGAAoG;IACpG,6EAA6E;IAC7E,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,mCAAmC;IACxF,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,yCAAyC;IAChG,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,aAAa;IAC7D,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,kBAAkB;IACvE,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,2BAA2B;IAC9E,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,EAAE,iBAAiB;IACrE,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE,eAAe;IACjE,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,oBAAoB;IAC3E,CAAC,wBAAwB,CAAC,kCAAkC,CAAC,EAAE,4BAA4B;IAC3F,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,EAAE,iBAAiB;IACrE,CAAC,wBAAwB,CAAC,8BAA8B,CAAC,EAAE,2BAA2B;IACtF,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,8BAA8B;IACtF,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,cAAc;IACtD,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE,kBAAkB;IAC9D,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,8BAA8B;IACtF,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,+BAA+B;IACxF,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,gBAAgB;IAC1D,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,yBAAyB;IAC5E,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,uBAAuB;IACxE,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,yBAAyB;IAC5E,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,wBAAwB;IAC7E,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,0BAA0B;IAChF,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,0BAA0B;IAChF,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAClE,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE,0BAA0B;IAEzE,wBAAwB;IACxB,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,uBAAuB;IACxE,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,yBAAyB;IAE5E,qBAAqB;IACrB,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAClE,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,sBAAsB;IAEtE,gCAAgC;IAChC,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,yBAAyB;IAC5E,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,4BAA4B;IAElF,iCAAiC;IACjC,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,2BAA2B;IAEhF,gCAAgC;IAChC,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,+BAA+B;IAExF,0CAA0C;IAC1C,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,2CAA2C;IACnG,CAAC,wBAAwB,CAAC,+BAA+B,CAAC,EAAE,gEAAgE;IAC5H,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,gCAAgC;IAC1F,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,2DAA2D;IACnH,CAAC,wBAAwB,CAAC,+BAA+B,CAAC,EAAE,gFAAgF;IAE5I,2BAA2B;IAC3B,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,uBAAuB;IACxE,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAClE,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE,wBAAwB;IAC1E,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAClE,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,sBAAsB;IAC3E,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,8BAA8B;IACrF,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,cAAc;IACtD,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,8BAA8B;IAEtF,uBAAuB;IACvB,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE,gCAAgC;IAC5E,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,gBAAgB;IAC1D,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE,yCAAyC;IACxF,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,gBAAgB;IAC1D,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,mBAAmB;IAEnE,mGAAmG;IACnG,+FAA+F;IAC/F,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,6BAA6B;IACnF,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,+BAA+B;IACrF,CAAC,wBAAwB,CAAC,UAAU,CAAC,EAAE,gBAAgB;IACvD,CAAC,wBAAwB,CAAC,cAAc,CAAC,EAAE,yBAAyB;IACpE,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,sBAAsB;IAE9D,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE,cAAc;IAE1D,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,wBAAwB;IAEhE,4BAA4B;IAC5B,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,EAAE,0BAA0B;IAC9E,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,4BAA4B;IAElF,uBAAuB;IACvB,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,sBAAsB;IACtE,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,6BAA6B;IACpF,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,uBAAuB;IAExE,qCAAqC;IACrC,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,gCAAgC;IAC1F,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,+BAA+B;IACxF,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,oCAAoC;IAC1F,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,mCAAmC;IACxF,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAClE,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,sBAAsB;IACtE,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,sBAAsB;IAEtE,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,EAAE,mBAAmB;IAChE,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,6BAA6B;IAEpF,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,yBAAyB;IAC5E,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAElE,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,6BAA6B;IACpF,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,uBAAuB;IAExE,wCAAwC;IACxC,sFAAsF;IACtF,qFAAqF;IACrF,oEAAoE;IACpE,CAAC,wBAAwB,CAAC,cAAc,CAAC,EAAE,kCAAkC;IAC7E,CAAC,wBAAwB,CAAC,SAAS,CAAC,EAAE,MAAM;IAE5C,8CAA8C;IAC9C,4FAA4F;IAC5F,iFAAiF;IACjF,4EAA4E;IAC5E,CAAC,wBAAwB,CAAC,YAAY,CAAC,EAAE,MAAM;IAC/C,CAAC,wBAAwB,CAAC,+BAA+B,CAAC,EAAE,uCAAuC;CACpG,CAAC;AAEF,wDAAwD;AACxD,+CAA+C;AAC/C,6DAA6D;AAC7D,wDAAwD;AAExD,MAAM,CAAN,IAAY,kBAIX;AAJD,WAAY,kBAAkB;IAC5B,yDAAmC,CAAA;IACnC,2DAAqC,CAAA;IACrC,iDAA2B,CAAA;AAC7B,CAAC,EAJW,kBAAkB,KAAlB,kBAAkB,QAI7B;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAuC;IACpE,CAAC,kBAAkB,CAAC,eAAe,CAAC,EAAE,SAAS;IAC/C,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,eAAe;IACtD,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE,cAAc;CACjD,CAAC","sourcesContent":["/**\n * Manual Controllers Routes URLs\n * Centralized URL declarations for custom/manual controllers\n * Shared between backend and frontend to avoid string duplication.\n *\n * Notes:\n * - These URLs are mounted under {@link MAIN_API_BASE_PATH}\n * - Keep only path segments here (no `MAIN_API_BASE_PATH` prefix) — the\n *   prefix is prepended once at each boundary (backend mount / frontend client)\n */\n\n/**\n * Main API base path — the mount prefix under which the entire main\n * controllers registry is served (every resource route AND every\n * {@link MANUAL_CONTROLLER_ROUTES_URLS} entry).\n *\n * This is the SINGLE SOURCE OF TRUTH for the prefix. It is consumed by:\n *  - the backend HTTP server mount (`app.use(MAIN_API_BASE_PATH, mainRouter)`),\n *  - the frontend HTTP client when building absolute API URLs\n *    (`${MAIN_API_BASE_PATH}${MANUAL_CONTROLLER_ROUTES_URLS[...]}`),\n *  - the refresh-token cookie `Path` scope, which MUST path-match the served\n *    auth routes (`${MAIN_API_BASE_PATH}/auth/*`) or the browser drops it.\n *\n * Why a shared symbol and not a literal: previously `/api/v1` was a literal\n * duplicated across the mount and the client. The absence of a shared symbol\n * let the refresh-token cookie `Path` be authored against the bare route\n * segment (`/auth`, omitting this prefix), so the browser stored the cookie\n * but never sent it to `/api/v1/auth/token/refresh` — silently breaking token\n * refresh for every session (forced logout on first refresh). Deriving every\n * prefix consumer from this constant closes that drift class.\n *\n * NOT under this prefix: the root-level engine routes in\n * {@link ENGINE_ROOT_ROUTES} (health/time probes), mounted at the app root.\n */\nexport const MAIN_API_BASE_PATH = '/api/v1';\n\n/**\n * Where RFC 8414 authorization-server metadata must be served for an issuer that carries a PATH.\n *\n * The rule is counter-intuitive and is the reason this exists as a named derivation rather than a\n * string built at the call site: the well-known segment goes BETWEEN the host and the issuer path,\n * not after it.\n *\n *   \"If the issuer identifier value contains a path component, any terminating \"/\" MUST be removed\n *    before inserting \"/.well-known/\" and the well-known URI suffix between the host component and\n *    the path component.\"\n *\n * with the RFC's own worked example resolving issuer `https://example.com/issuer1` to\n * `GET /.well-known/oauth-authorization-server/issuer1`.\n * spec-cite: RFC 8414 § 3 (Obtaining Authorization Server Metadata), fetched 2026-08-11.\n *\n * OIDC Discovery uses the OPPOSITE construction — issuer + `/.well-known/openid-configuration` — so\n * the two cannot share one path and a server that serves only the OIDC shape fails RFC 8414 discovery\n * while looking correct. That is exactly what happened here: a real MCP client split our issuer at the\n * host boundary as the RFC instructs, asked for `/.well-known/oauth-authorization-server/api/v1`,\n * received the SPA shell, and abandoned authorization without ever opening a browser.\n *\n * @param issuerPath the issuer's path component (e.g. {@link MAIN_API_BASE_PATH}); a bare `/` or an\n *                   empty string yields the origin-root location, which is the path-less issuer case.\n */\nexport function rfc8414AuthorizationServerMetadataPath(issuerPath: string): string {\n  return wellKnownPathBeforeResourcePath('oauth-authorization-server', issuerPath);\n}\n\n/**\n * Where RFC 9728 protected-resource metadata must be served for a resource identifier that carries a\n * PATH — the same insertion rule as {@link rfc8414AuthorizationServerMetadataPath}, for the other\n * document.\n *\n *   \"The protected resource's well-known URI is created by inserting\n *    /.well-known/oauth-protected-resource between the host component and the path component (if any)\n *    of the resource identifier.\"\n * spec-cite: RFC 9728 § 3 (Protected Resource Metadata Request), fetched 2026-08-12.\n *\n * This is a SECOND discovery route, not a replacement for the one the challenge names. RFC 9728 § 5.1\n * lets a client take `resource_metadata` straight from the `WWW-Authenticate` header, and MCP tells\n * clients to do exactly that — which is why serving only the header's location worked with a real\n * client and is a defensible posture. It is nevertheless not the whole contract: a client that derives\n * the location from the resource identifier, as this section permits, previously received the SPA\n * shell. Both locations now serve one document.\n *\n * Note the asymmetry with RFC 8414, because it explains why that one was a live outage and this one\n * was latent: an authorization server publishes no equivalent pointer, so derivation is a client's\n * ONLY route to AS metadata.\n *\n * @param resourcePath the resource identifier's path component (e.g. `/api/v1/mcp`); a bare `/` or an\n *                     empty string yields the origin-root location, which is the path-less case.\n */\nexport function rfc9728ProtectedResourceMetadataPath(resourcePath: string): string {\n  return wellKnownPathBeforeResourcePath('oauth-protected-resource', resourcePath);\n}\n\n/**\n * The construction RFC 8414 § 3 and RFC 9728 § 3 both specify: strip any terminating `/`, then insert\n * the well-known segment BETWEEN the host and the path.\n *\n * Shared deliberately rather than written twice. The rule is counter-intuitive enough that it was\n * already implemented wrongly once here, and a second hand-rolled copy is how the two documents would\n * come to disagree about a rule they take verbatim from each other.\n */\nfunction wellKnownPathBeforeResourcePath(wellKnownSegment: string, path: string): string {\n  const normalized = path.replace(/\\/+$/, '');\n  return `/.well-known/${wellKnownSegment}${normalized.startsWith('/') || normalized === '' ? normalized : `/${normalized}`}`;\n}\n\nexport enum ManualControllerRouteKey {\n  APPLICATION_CONFIG_GET = 'APPLICATION_CONFIG_GET',\n\n  AUTH_IDENTIFY = 'AUTH_IDENTIFY',\n  AUTH_AUTHENTICATE_PASSWORD = 'AUTH_AUTHENTICATE_PASSWORD',\n  AUTH_AUTHENTICATE = 'AUTH_AUTHENTICATE',\n  AUTH_TOKEN_REFRESH = 'AUTH_TOKEN_REFRESH',\n  AUTH_OAUTH2_AUTHORIZE = 'AUTH_OAUTH2_AUTHORIZE',\n  AUTH_OAUTH2_CALLBACK = 'AUTH_OAUTH2_CALLBACK',\n\n  /**\n   * OUTBOUND connections — this application acting as somebody toward a third party.\n   *\n   * Easy to confuse with {@link AUTH_OAUTH2_AUTHORIZE} above and the exact opposite direction: that\n   * pair signs a person INTO this application using a vendor as the identity provider, this pair\n   * connects a vendor account so this application can act as that account. Same protocol, opposite\n   * arrow, and nothing is shared between them but the RFC.\n   */\n  PROVIDER_CONNECTION_START = 'PROVIDER_CONNECTION_START',\n  /**\n   * The single redirect URI for EVERY provider, keyed by `state` rather than by a path segment.\n   *\n   * One URI, deliberately. A redirect URI must be registered at the vendor before it is accepted, so\n   * a per-provider path would mean registering 129 distinct URIs — by hand, per deployment, per\n   * environment. The `state` already has to be unguessable and single-use for CSRF, and it already\n   * identifies the attempt, so it identifies the provider too at no extra cost.\n   */\n  PROVIDER_CONNECTION_CALLBACK = 'PROVIDER_CONNECTION_CALLBACK',\n  /**\n   * What this caller may connect, and under which owner scopes.\n   *\n   * Without it a settings screen cannot offer Connect at all: the credential LIST answers what a\n   * person HAS connected, and nothing answers what they COULD. The two are different questions and\n   * the empty answer to the first — the state everybody starts in — is exactly when the second one\n   * matters.\n   *\n   * Admissibility is a RECORDED DECISION per provider, never derived from a vendor's API surface, so\n   * this route reports a decision rather than computing one.\n   */\n  PROVIDER_CONNECTION_CATALOGUE = 'PROVIDER_CONNECTION_CATALOGUE',\n  /** Enterprise SSO: initiate OAuth2 flow for an org's OIDC connection (Step 15) */\n  AUTH_ENTERPRISE_SSO_AUTHORIZE = 'AUTH_ENTERPRISE_SSO_AUTHORIZE',\n  AUTH_APP_ENTERPRISE_AUTHORIZE = 'AUTH_APP_ENTERPRISE_AUTHORIZE',\n  AUTH_TOKEN_EXCHANGE = 'AUTH_TOKEN_EXCHANGE',\n  /**\n   * OAuth 2.0 Authorization Server token endpoint (Wildo-AS-PROVIDER, distinct from the\n   * RP-side `/auth/*` routes). Serves `grant_type=client_credentials` now; the OIDC branch\n   * adds `authorization_code`. Served at `${MAIN_API_BASE_PATH}/oauth/token`.\n   */\n  OAUTH_PROVIDER_TOKEN = 'OAUTH_PROVIDER_TOKEN',\n  /** OIDC discovery document (served at `${issuer}/.well-known/openid-configuration`). */\n  OAUTH_PROVIDER_DISCOVERY = 'OAUTH_PROVIDER_DISCOVERY',\n  /**\n   * RFC 8414 Authorization Server Metadata (`${issuer}/.well-known/oauth-authorization-server`) —\n   * the SAME document as {@link OAUTH_PROVIDER_DISCOVERY}, served at the OAuth-2 well-known path that\n   * many OAuth/MCP clients probe FIRST (before the OIDC path). Aliases the discovery handler.\n   */\n  OAUTH_PROVIDER_AS_METADATA = 'OAUTH_PROVIDER_AS_METADATA',\n  /** JSON Web Key Set for verifying Wildo-issued tokens (the discovery doc's `jwks_uri`). */\n  OAUTH_PROVIDER_JWKS = 'OAUTH_PROVIDER_JWKS',\n  /** OIDC authorization endpoint (authorization_code flow — the caller lands here to consent). */\n  OAUTH_PROVIDER_AUTHORIZE = 'OAUTH_PROVIDER_AUTHORIZE',\n  /**\n   * OIDC interactive-consent decision endpoint. When the authorize endpoint returned\n   * `consent_required` for a `requiresConsent` client, the user's approve/deny decision is POSTed\n   * here with the single-use consent-request token; APPROVE mints the authorization code.\n   */\n  OAUTH_PROVIDER_CONSENT = 'OAUTH_PROVIDER_CONSENT',\n  /** OIDC UserInfo endpoint (bearer access token → the user's standard claims). */\n  OAUTH_PROVIDER_USERINFO = 'OAUTH_PROVIDER_USERINFO',\n  /** OAuth 2.0 token revocation endpoint (RFC 7009). */\n  OAUTH_PROVIDER_REVOKE = 'OAUTH_PROVIDER_REVOKE',\n  /**\n   * OIDC RP-Initiated Logout 1.0 `end_session_endpoint` (revocation-C). A relying party redirects the\n   * End-User here (with an `id_token_hint`) to terminate their Wildo OP login session — the exact\n   * session the delegation was authorized from, keyed on the id_token's `sid`. Distinct from\n   * {@link OAUTH_PROVIDER_REVOKE}: revoke kills a TOKEN (RFC 7009); end_session ends a SESSION.\n   */\n  OAUTH_PROVIDER_END_SESSION = 'OAUTH_PROVIDER_END_SESSION',\n  /**\n   * OIDC RP-Initiated Logout 1.0 §6 confirmation decision (revocation-C). The `POST` the frontend\n   * `/oauth/logout-confirm` prompt calls to actually terminate the session, presenting the single-use\n   * `OIDC_LOGOUT_CONFIRMATION` token minted by {@link OAUTH_PROVIDER_END_SESSION}. Token-authorized\n   * (no Bearer — the End-User may be unauthenticated in the SPA, having arrived via an RP redirect);\n   * returns `{ redirect_to }` (always the same-origin signed-out page `/oauth/logged-out`; the SPA\n   * navigates there). Only reached for NON-trusted logouts — a trusted RP logout terminates + redirects\n   * inline without a prompt (the Keycloak-style posture).\n   */\n  OAUTH_PROVIDER_END_SESSION_CONFIRM = 'OAUTH_PROVIDER_END_SESSION_CONFIRM',\n  /**\n   * RFC 7591 dynamic client registration. Registered UNCONDITIONALLY so the route always exists;\n   * the handler answers 404 unless the application opted in via `auth.dynamicClientRegistration`.\n   * Registering it conditionally would make the route table depend on config, which is far harder\n   * to reason about than one handler that refuses.\n   */\n  OAUTH_PROVIDER_REGISTER = 'OAUTH_PROVIDER_REGISTER',\n  /**\n   * RFC 7592 client configuration endpoint — a dynamically registered client reads, updates or\n   * deletes its OWN registration, authenticating with the registration access token it was issued\n   * at registration.\n   *\n   * One key for three verbs (GET / PUT / DELETE) because RFC 7592 §2 defines ONE endpoint whose\n   * method selects the operation; splitting it into three keys would invent a distinction the\n   * specification does not make and put the same URL in the table three times.\n   *\n   * Registered unconditionally, like `/oauth/register`, and gated by the same\n   * `auth.dynamicClientRegistration` opt-in in the handler — a route table that depends on config is\n   * harder to reason about than a handler that refuses.\n   */\n  OAUTH_PROVIDER_REGISTER_CLIENT = 'OAUTH_PROVIDER_REGISTER_CLIENT',\n  /**\n   * Cross-frontend session handoff (cross-app-jwt-propagation Step 2).\n   * Authenticated user requests a one-time AUTH_CODE_EXCHANGE token bound to a\n   * target frontend, then redirects the browser to the target's\n   * /auth/exchange page with the code. Bearer-only; CORS auto-allowed for every\n   * declared frontendService via the existing deriveCorsOrigins() seam.\n   */\n  AUTH_CROSS_FRONTEND_HANDOFF = 'AUTH_CROSS_FRONTEND_HANDOFF',\n  AUTH_LOGOUT = 'AUTH_LOGOUT',\n  /** Sign-out-everywhere: fences the whole user — all access + refresh tokens, every device — via the invalidation fence. */\n  AUTH_LOGOUT_ALL = 'AUTH_LOGOUT_ALL',\n  AUTH_PASSWORD_RESET_REQUEST = 'AUTH_PASSWORD_RESET_REQUEST',\n  AUTH_PASSWORD_RESET_COMPLETE = 'AUTH_PASSWORD_RESET_COMPLETE',\n  AUTH_REGISTER = 'AUTH_REGISTER',\n  AUTH_ACCEPT_INVITATION = 'AUTH_ACCEPT_INVITATION',\n  // Public token-keyed invitation-accept DISCOVERY (non-consuming): returns the\n  // invited org's available auth methods + SSO/SCIM management mode so the accept\n  // screen can render the right chooser. Read-only; does NOT consume the token.\n  AUTH_INVITATION_INFO = 'AUTH_INVITATION_INFO',\n  AUTH_REJECT_INVITATION = 'AUTH_REJECT_INVITATION',\n  // In-app authenticated invitation management (Approach P) — a signed-in user acts on\n  // THEIR OWN pending invitations (authorized by email-ownership), no token, no new session.\n  AUTH_LIST_MY_INVITATIONS = 'AUTH_LIST_MY_INVITATIONS',\n  AUTH_ACCEPT_MY_INVITATION = 'AUTH_ACCEPT_MY_INVITATION',\n  AUTH_REJECT_MY_INVITATION = 'AUTH_REJECT_MY_INVITATION',\n  AUTH_VERIFY_EMAIL = 'AUTH_VERIFY_EMAIL',\n  AUTH_SESSION_STATE = 'AUTH_SESSION_STATE',\n\n  // MFA — Email OTP (Step 10)\n  AUTH_MFA_EMAIL_OTP_SEND = 'AUTH_MFA_EMAIL_OTP_SEND',\n  AUTH_MFA_EMAIL_OTP_VERIFY = 'AUTH_MFA_EMAIL_OTP_VERIFY',\n\n  // MFA — TOTP (Step 11)\n  AUTH_MFA_TOTP_SETUP = 'AUTH_MFA_TOTP_SETUP',\n  AUTH_MFA_TOTP_VERIFY_SETUP = 'AUTH_MFA_TOTP_VERIFY_SETUP',\n  AUTH_MFA_TOTP_VERIFY = 'AUTH_MFA_TOTP_VERIFY',\n\n  // WebAuthn/Passkey Routes (Phase G1)\n  AUTH_PASSKEY_REGISTER_OPTIONS = 'AUTH_PASSKEY_REGISTER_OPTIONS',\n  AUTH_PASSKEY_REGISTER_VERIFY = 'AUTH_PASSKEY_REGISTER_VERIFY',\n  AUTH_PASSKEY_AUTH_OPTIONS = 'AUTH_PASSKEY_AUTH_OPTIONS',\n  AUTH_PASSKEY_AUTH_VERIFY = 'AUTH_PASSKEY_AUTH_VERIFY',\n  AUTH_PASSKEY_LIST = 'AUTH_PASSKEY_LIST',\n  AUTH_PASSKEY_REMOVE = 'AUTH_PASSKEY_REMOVE',\n  AUTH_PASSKEY_RENAME = 'AUTH_PASSKEY_RENAME',\n\n  // Magic Link (Phase G2)\n  AUTH_MAGIC_LINK_SEND = 'AUTH_MAGIC_LINK_SEND',\n  AUTH_MAGIC_LINK_VERIFY = 'AUTH_MAGIC_LINK_VERIFY',\n\n  // SMS OTP (Phase G2)\n  AUTH_SMS_OTP_SEND = 'AUTH_SMS_OTP_SEND',\n  AUTH_SMS_OTP_VERIFY = 'AUTH_SMS_OTP_VERIFY',\n\n  // Phone Verification (Phase G2)\n  AUTH_PHONE_VERIFY_SEND = 'AUTH_PHONE_VERIFY_SEND',\n  AUTH_PHONE_VERIFY_CONFIRM = 'AUTH_PHONE_VERIFY_CONFIRM',\n\n  // Resend Verification Email (F5)\n  AUTH_RESEND_VERIFICATION = 'AUTH_RESEND_VERIFICATION',\n\n  // W5.7: Complete org onboarding (deferred org creation)\n  AUTH_COMPLETE_ORG_ONBOARDING = 'AUTH_COMPLETE_ORG_ONBOARDING',\n\n  // W7.3b: One-off session token management\n  AUTH_ONE_OFF_SESSION_CREATE = 'AUTH_ONE_OFF_SESSION_CREATE',\n  AUTH_ONE_OFF_SESSION_CREATE_ORG = 'AUTH_ONE_OFF_SESSION_CREATE_ORG',\n  AUTH_ONE_OFF_SESSION_EXCHANGE = 'AUTH_ONE_OFF_SESSION_EXCHANGE',\n  AUTH_ONE_OFF_SESSION_REVOKE = 'AUTH_ONE_OFF_SESSION_REVOKE',\n  AUTH_ONE_OFF_SESSION_REVOKE_ORG = 'AUTH_ONE_OFF_SESSION_REVOKE_ORG',\n\n  // Method Management (#13f)\n  AUTH_PASSWORD_CHANGE = 'AUTH_PASSWORD_CHANGE',\n  AUTH_PASSWORD_SET = 'AUTH_PASSWORD_SET',\n  AUTH_MFA_TOTP_DISABLE = 'AUTH_MFA_TOTP_DISABLE',\n  AUTH_METHODS_MINE = 'AUTH_METHODS_MINE',\n  AUTH_IDENTITY_LINKS_LIST = 'AUTH_IDENTITY_LINKS_LIST',\n  AUTH_IDENTITY_LINKS_UNLINK = 'AUTH_IDENTITY_LINKS_UNLINK',\n  AUTH_REAUTH = 'AUTH_REAUTH',\n  /** Challenge leg of a PASSKEY step-up: WebAuthn is challenge-response, so re-auth needs two round-trips. */\n  AUTH_REAUTH_PASSKEY_OPTIONS = 'AUTH_REAUTH_PASSKEY_OPTIONS',\n\n  // SAML Routes (AUTH-2)\n  AUTH_SAML_LOGIN = 'AUTH_SAML_LOGIN',\n  AUTH_SAML_ACS = 'AUTH_SAML_ACS',\n  AUTH_SAML_METADATA = 'AUTH_SAML_METADATA',\n  AUTH_SAML_SLO = 'AUTH_SAML_SLO',\n  /** SP-INITIATED SLO kickoff: the app asks the backend to log the caller out of their SAML session and (when the IdP supports it) redirect to the IdP's SLO endpoint. Distinct from AUTH_SAML_SLO, which is the INBOUND endpoint the IdP calls. */\n  AUTH_SAML_SP_LOGOUT = 'AUTH_SAML_SP_LOGOUT',\n\n  /**\n   * Direct file transfer, distinct from the resource registry's own file routes.\n   *\n   * A resource's `/…/{id}/files/{field}` routes upload and replace the file BOUND TO A FIELD; these\n   * five address a stored file by its own id, wherever it is attached. They lived as literal path\n   * strings inside the file controller until 2026-09-09, which is exactly the duplication this\n   * registry exists to remove — and it also kept them out of every mechanism keyed on this\n   * vocabulary, the generated API reference included.\n   */\n  /** Public, token-authenticated status read for an upload grant. The token IS the credential. */\n  FILES_UPLOAD_GRANT_STATUS = 'FILES_UPLOAD_GRANT_STATUS',\n  /** Revoke an upload grant, addressed by its id — never by the token value. */\n  FILES_UPLOAD_GRANT_REVOKE = 'FILES_UPLOAD_GRANT_REVOKE',\n  /**\n   * One stored file addressed by id. ONE key for two verbs (GET downloads it, DELETE removes it)\n   * because Express matches one path and the method selects the operation — the same reasoning as\n   * {@link OAUTH_PROVIDER_REGISTER_CLIENT}. Splitting it would put one URL in the table twice.\n   */\n  FILES_ITEM = 'FILES_ITEM',\n  /** The stored file's metadata record, without transferring its bytes. */\n  FILES_METADATA = 'FILES_METADATA',\n  /** Mint a time-limited share link for a stored file. */\n  FILES_SHARE = 'FILES_SHARE',\n\n  I18N_GET_LABELS = 'I18N_GET_LABELS',\n\n  CHARTS_DATA = 'CHARTS_DATA',\n\n  ANALYTICS_EVENTS = 'ANALYTICS_EVENTS',\n  ANALYTICS_MOMENTS_ACHIEVED = 'ANALYTICS_MOMENTS_ACHIEVED',\n\n  PROGRESSION_MILESTONES = 'PROGRESSION_MILESTONES',\n  FEATURES_RESOLVED = 'FEATURES_RESOLVED',\n\n  /** Frontend-visible flow/actor systems (metadata + renderable graph). */\n  FLOWS_ACTORS_FRONTEND_INFO = 'FLOWS_ACTORS_FRONTEND_INFO',\n  /** The caller's own conversation history for a flow/actor system. */\n  FLOWS_ACTORS_HISTORY = 'FLOWS_ACTORS_HISTORY',\n\n  // === A2A (external actor exposure — Agent2Agent protocol) ===\n  /**\n   * A2A agent card (public, CORS-open metadata) advertising this app's exposed\n   * actor systems as A2A skills + the security schemes a caller must satisfy.\n   * Analogous to the OIDC discovery doc; the served path can be reverse-proxy\n   * aliased to a root `/.well-known/agent-card.json`.\n   */\n  A2A_AGENT_CARD = 'A2A_AGENT_CARD',\n  /**\n   * A2A JSON-RPC task/message endpoint (`message/send`, `message/stream` via SSE).\n   * Its absolute URL is the agent card's `url` AND the agent's canonical\n   * audience — an inbound access token MUST carry this as its `aud` (RFC 8707 / D7).\n   */\n  A2A_TASKS = 'A2A_TASKS',\n\n  // === MCP (Model Context Protocol server — resource operations as tools) ===\n  /**\n   * MCP JSON-RPC 2.0 endpoint (Streamable-HTTP transport): `initialize`, `tools/list`,\n   * `tools/call`. A `tools/call` is Bearer-credentialed by a machine OR user-delegated access token\n   * that is resource-server-bound to the MCP audience — NOT the generic API audience, which this\n   * surface rejects since the 2026-07-29 strict flip (RFC 8707 / D7) — validated at auth time; the\n   * server re-runs `authorizeInController` before dispatch (fail-closed).\n   *\n   * Also the base for the R-2 NAMED server instances: `POST /mcp/:instanceRef` serves a declared\n   * instance with its own audience (`…/mcp/<ref>`) and curated catalog.\n   */\n  MCP_ENDPOINT = 'MCP_ENDPOINT',\n  /**\n   * MCP OAuth 2.0 Protected Resource Metadata (RFC 9728): advertises this MCP server's\n   * `resource` identifier + the `authorization_servers` (the app's own OIDC provider) an MCP\n   * client uses to obtain a token. Public, CORS-open metadata (like the OIDC discovery doc).\n   *\n   * Mounted TWICE: at the API root for the DEFAULT server, and appended to each named instance\n   * (`/mcp/:instanceRef` + this route) so every instance advertises its OWN audience. A 401 at either\n   * surface points its `WWW-Authenticate: resource_metadata=` at the matching one — the only discovery\n   * route a client has, since this path is non-standard (it is not the RFC's origin-root form).\n   */\n  MCP_PROTECTED_RESOURCE_METADATA = 'MCP_PROTECTED_RESOURCE_METADATA',\n}\n\nexport const MANUAL_CONTROLLER_ROUTES_URLS: Record<ManualControllerRouteKey, string> = {\n  [ManualControllerRouteKey.APPLICATION_CONFIG_GET]: '/application-config',\n\n  [ManualControllerRouteKey.AUTH_IDENTIFY]: '/auth/identify',\n  [ManualControllerRouteKey.AUTH_AUTHENTICATE_PASSWORD]: '/auth/authenticate/password',\n  [ManualControllerRouteKey.AUTH_AUTHENTICATE]: '/auth/authenticate',\n  [ManualControllerRouteKey.AUTH_TOKEN_REFRESH]: '/auth/token/refresh',\n  [ManualControllerRouteKey.AUTH_OAUTH2_AUTHORIZE]: '/auth/oauth2/authorize/:providerRef',\n  [ManualControllerRouteKey.AUTH_OAUTH2_CALLBACK]: '/auth/oauth2/callback/:providerRef',\n\n  [ManualControllerRouteKey.PROVIDER_CONNECTION_START]: '/connections/:providerRef/start',\n  [ManualControllerRouteKey.PROVIDER_CONNECTION_CALLBACK]: '/connections/callback',\n  [ManualControllerRouteKey.PROVIDER_CONNECTION_CATALOGUE]: '/connections',\n  [ManualControllerRouteKey.AUTH_ENTERPRISE_SSO_AUTHORIZE]: '/auth/enterprise/authorize/:orgId/:connectionId',\n  [ManualControllerRouteKey.AUTH_APP_ENTERPRISE_AUTHORIZE]: '/auth/app-enterprise/authorize/:connectionId',\n  [ManualControllerRouteKey.AUTH_TOKEN_EXCHANGE]: '/auth/token/exchange',\n  // OAuth 2.0 Authorization Server token endpoint (Wildo-as-provider).\n  [ManualControllerRouteKey.OAUTH_PROVIDER_TOKEN]: '/oauth/token',\n  // OIDC discovery + JWKS. Served under the API mount, so with issuer `${publicUrl}${MAIN_API_BASE_PATH}`\n  // a client's `${issuer}/.well-known/openid-configuration` resolves here. That is correct for OIDC\n  // Discovery (issuer + suffix) and NOT for RFC 8414, which places the well-known segment BETWEEN the\n  // host and the issuer path — see {@link rfc8414AuthorizationServerMetadataPath}, which the HTTP\n  // server mounts as a second location for the SAME document. (This used to say a root-level alias was\n  // \"a reverse-proxy concern\"; leaving it to ingress meant every deployment that did not add the rule\n  // silently failed RFC 8414 discovery, so the server now serves it directly.)\n  [ManualControllerRouteKey.OAUTH_PROVIDER_DISCOVERY]: '/.well-known/openid-configuration',\n  [ManualControllerRouteKey.OAUTH_PROVIDER_AS_METADATA]: '/.well-known/oauth-authorization-server',\n  [ManualControllerRouteKey.OAUTH_PROVIDER_JWKS]: '/oauth/jwks',\n  [ManualControllerRouteKey.OAUTH_PROVIDER_AUTHORIZE]: '/oauth/authorize',\n  [ManualControllerRouteKey.OAUTH_PROVIDER_CONSENT]: '/oauth/authorize/decision',\n  [ManualControllerRouteKey.OAUTH_PROVIDER_USERINFO]: '/oauth/userinfo',\n  [ManualControllerRouteKey.OAUTH_PROVIDER_REVOKE]: '/oauth/revoke',\n  [ManualControllerRouteKey.OAUTH_PROVIDER_END_SESSION]: '/oauth/end-session',\n  [ManualControllerRouteKey.OAUTH_PROVIDER_END_SESSION_CONFIRM]: '/oauth/end-session/confirm',\n  [ManualControllerRouteKey.OAUTH_PROVIDER_REGISTER]: '/oauth/register',\n  [ManualControllerRouteKey.OAUTH_PROVIDER_REGISTER_CLIENT]: '/oauth/register/:clientId',\n  [ManualControllerRouteKey.AUTH_CROSS_FRONTEND_HANDOFF]: '/auth/cross-frontend-handoff',\n  [ManualControllerRouteKey.AUTH_LOGOUT]: '/auth/logout',\n  [ManualControllerRouteKey.AUTH_LOGOUT_ALL]: '/auth/logout-all',\n  [ManualControllerRouteKey.AUTH_PASSWORD_RESET_REQUEST]: '/auth/password-reset/request',\n  [ManualControllerRouteKey.AUTH_PASSWORD_RESET_COMPLETE]: '/auth/password-reset/complete',\n  [ManualControllerRouteKey.AUTH_REGISTER]: '/auth/register',\n  [ManualControllerRouteKey.AUTH_ACCEPT_INVITATION]: '/auth/invitation/accept',\n  [ManualControllerRouteKey.AUTH_INVITATION_INFO]: '/auth/invitation/info',\n  [ManualControllerRouteKey.AUTH_REJECT_INVITATION]: '/auth/invitation/reject',\n  [ManualControllerRouteKey.AUTH_LIST_MY_INVITATIONS]: '/auth/invitations/mine',\n  [ManualControllerRouteKey.AUTH_ACCEPT_MY_INVITATION]: '/auth/invitations/accept',\n  [ManualControllerRouteKey.AUTH_REJECT_MY_INVITATION]: '/auth/invitations/reject',\n  [ManualControllerRouteKey.AUTH_VERIFY_EMAIL]: '/auth/verify-email',\n  [ManualControllerRouteKey.AUTH_SESSION_STATE]: '/auth/session/:sessionId',\n\n  // Magic Link (Phase G2)\n  [ManualControllerRouteKey.AUTH_MAGIC_LINK_SEND]: '/auth/magic-link/send',\n  [ManualControllerRouteKey.AUTH_MAGIC_LINK_VERIFY]: '/auth/magic-link/verify',\n\n  // SMS OTP (Phase G2)\n  [ManualControllerRouteKey.AUTH_SMS_OTP_SEND]: '/auth/sms-otp/send',\n  [ManualControllerRouteKey.AUTH_SMS_OTP_VERIFY]: '/auth/sms-otp/verify',\n\n  // Phone Verification (Phase G2)\n  [ManualControllerRouteKey.AUTH_PHONE_VERIFY_SEND]: '/auth/phone/verify/send',\n  [ManualControllerRouteKey.AUTH_PHONE_VERIFY_CONFIRM]: '/auth/phone/verify/confirm',\n\n  // Resend Verification Email (F5)\n  [ManualControllerRouteKey.AUTH_RESEND_VERIFICATION]: '/auth/resend-verification',\n\n  // W5.7: Complete org onboarding\n  [ManualControllerRouteKey.AUTH_COMPLETE_ORG_ONBOARDING]: '/auth/onboarding/complete-org',\n\n  // W7.3b: One-off session token management\n  [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_CREATE]: '/apps/:applicationId/auth/one-off-session',\n  [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_CREATE_ORG]: '/orgs/:organizationId/apps/:applicationId/auth/one-off-session',\n  [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_EXCHANGE]: '/auth/one-off-session/exchange',\n  [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_REVOKE]: '/apps/:applicationId/auth/one-off-session/:tokenId/revoke',\n  [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_REVOKE_ORG]: '/orgs/:organizationId/apps/:applicationId/auth/one-off-session/:tokenId/revoke',\n\n  // Method Management (#13f)\n  [ManualControllerRouteKey.AUTH_PASSWORD_CHANGE]: '/auth/password/change',\n  [ManualControllerRouteKey.AUTH_PASSWORD_SET]: '/auth/password/set',\n  [ManualControllerRouteKey.AUTH_MFA_TOTP_DISABLE]: '/auth/mfa/totp/disable',\n  [ManualControllerRouteKey.AUTH_METHODS_MINE]: '/auth/methods/mine',\n  [ManualControllerRouteKey.AUTH_IDENTITY_LINKS_LIST]: '/auth/identity-links',\n  [ManualControllerRouteKey.AUTH_IDENTITY_LINKS_UNLINK]: '/auth/identity-links/:linkId',\n  [ManualControllerRouteKey.AUTH_REAUTH]: '/auth/reauth',\n  [ManualControllerRouteKey.AUTH_REAUTH_PASSKEY_OPTIONS]: '/auth/reauth/passkey/options',\n\n  // SAML Routes (AUTH-2)\n  [ManualControllerRouteKey.AUTH_SAML_LOGIN]: '/auth/saml/login/:connectionId',\n  [ManualControllerRouteKey.AUTH_SAML_ACS]: '/auth/saml/acs',\n  [ManualControllerRouteKey.AUTH_SAML_METADATA]: '/auth/saml/metadata/:scopeType/:scopeId',\n  [ManualControllerRouteKey.AUTH_SAML_SLO]: '/auth/saml/slo',\n  [ManualControllerRouteKey.AUTH_SAML_SP_LOGOUT]: '/auth/saml/logout',\n\n  // Direct file transfer. `upload-grants` MUST stay ahead of the `:fileId` family at the mount site,\n  // or Express reads `upload-grants` as a file id — the controller registers them in that order.\n  [ManualControllerRouteKey.FILES_UPLOAD_GRANT_STATUS]: '/files/upload-grants/:token',\n  [ManualControllerRouteKey.FILES_UPLOAD_GRANT_REVOKE]: '/files/upload-grants/:grantId',\n  [ManualControllerRouteKey.FILES_ITEM]: '/files/:fileId',\n  [ManualControllerRouteKey.FILES_METADATA]: '/files/:fileId/metadata',\n  [ManualControllerRouteKey.FILES_SHARE]: '/files/:fileId/share',\n\n  [ManualControllerRouteKey.I18N_GET_LABELS]: '/i18n/labels',\n\n  [ManualControllerRouteKey.CHARTS_DATA]: '/charts/:chartRef/data',\n\n  // MFA — Email OTP (Step 10)\n  [ManualControllerRouteKey.AUTH_MFA_EMAIL_OTP_SEND]: '/auth/mfa/email-otp/send',\n  [ManualControllerRouteKey.AUTH_MFA_EMAIL_OTP_VERIFY]: '/auth/mfa/email-otp/verify',\n\n  // MFA — TOTP (Step 11)\n  [ManualControllerRouteKey.AUTH_MFA_TOTP_SETUP]: '/auth/mfa/totp/setup',\n  [ManualControllerRouteKey.AUTH_MFA_TOTP_VERIFY_SETUP]: '/auth/mfa/totp/verify-setup',\n  [ManualControllerRouteKey.AUTH_MFA_TOTP_VERIFY]: '/auth/mfa/totp/verify',\n\n  // WebAuthn/Passkey Routes (Phase G1)\n  [ManualControllerRouteKey.AUTH_PASSKEY_REGISTER_OPTIONS]: '/auth/passkey/register/options',\n  [ManualControllerRouteKey.AUTH_PASSKEY_REGISTER_VERIFY]: '/auth/passkey/register/verify',\n  [ManualControllerRouteKey.AUTH_PASSKEY_AUTH_OPTIONS]: '/auth/passkey/authenticate/options',\n  [ManualControllerRouteKey.AUTH_PASSKEY_AUTH_VERIFY]: '/auth/passkey/authenticate/verify',\n  [ManualControllerRouteKey.AUTH_PASSKEY_LIST]: '/auth/passkey/list',\n  [ManualControllerRouteKey.AUTH_PASSKEY_REMOVE]: '/auth/passkey/remove',\n  [ManualControllerRouteKey.AUTH_PASSKEY_RENAME]: '/auth/passkey/rename',\n\n  [ManualControllerRouteKey.ANALYTICS_EVENTS]: '/analytics/events',\n  [ManualControllerRouteKey.ANALYTICS_MOMENTS_ACHIEVED]: '/analytics/moments/achieved',\n\n  [ManualControllerRouteKey.PROGRESSION_MILESTONES]: '/progression/milestones',\n  [ManualControllerRouteKey.FEATURES_RESOLVED]: '/features/resolved',\n\n  [ManualControllerRouteKey.FLOWS_ACTORS_FRONTEND_INFO]: '/flows-actors/frontend-info',\n  [ManualControllerRouteKey.FLOWS_ACTORS_HISTORY]: '/flows-actors/history',\n\n  // === A2A (external actor exposure) ===\n  // Card served under the API mount, so with issuer `${publicUrl}${MAIN_API_BASE_PATH}`\n  // a caller's `${issuer}/a2a/.well-known/agent-card.json` resolves here (a root-level\n  // `/.well-known/agent-card.json` alias is a reverse-proxy concern).\n  [ManualControllerRouteKey.A2A_AGENT_CARD]: '/a2a/.well-known/agent-card.json',\n  [ManualControllerRouteKey.A2A_TASKS]: '/a2a',\n\n  // === MCP (Model Context Protocol server) ===\n  // JSON-RPC endpoint + RFC 9728 protected-resource metadata, served under the API mount. The\n  // metadata's `resource` is `${publicUrl}${MAIN_API_BASE_PATH}/mcp`; a root-level\n  // `/.well-known/oauth-protected-resource` alias is a reverse-proxy concern.\n  [ManualControllerRouteKey.MCP_ENDPOINT]: '/mcp',\n  [ManualControllerRouteKey.MCP_PROTECTED_RESOURCE_METADATA]: '/.well-known/oauth-protected-resource',\n};\n\n// =====================================================\n// Root-level engine routes (NOT under /api/v1)\n// These are mounted at the Express app root (e.g. /health/*)\n// =====================================================\n\nexport enum EngineRootRouteKey {\n  HEALTH_LIVENESS = 'HEALTH_LIVENESS',\n  HEALTH_READINESS = 'HEALTH_READINESS',\n  HEALTH_TIME = 'HEALTH_TIME',\n}\n\nexport const ENGINE_ROOT_ROUTES: Record<EngineRootRouteKey, string> = {\n  [EngineRootRouteKey.HEALTH_LIVENESS]: '/health',\n  [EngineRootRouteKey.HEALTH_READINESS]: '/health/ready',\n  [EngineRootRouteKey.HEALTH_TIME]: '/health/time',\n};\n"]}
+{"version":3,"file":"manual-controllers-routes-urls.js","sourceRoot":"","sources":["../../../../src/requests/manual-controllers-routes-urls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,SAAS,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,sCAAsC,CAAC,UAAkB;IACvE,OAAO,+BAA+B,CAAC,4BAA4B,EAAE,UAAU,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,oCAAoC,CAAC,YAAoB;IACvE,OAAO,+BAA+B,CAAC,0BAA0B,EAAE,YAAY,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,+BAA+B,CAAC,gBAAwB,EAAE,IAAY;IAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,OAAO,gBAAgB,gBAAgB,GAAG,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,UAAU,EAAE,EAAE,CAAC;AAC9H,CAAC;AAED,MAAM,CAAN,IAAY,wBA4ZX;AA5ZD,WAAY,wBAAwB;IAClC,6EAAiD,CAAA;IAEjD,2DAA+B,CAAA;IAC/B,qFAAyD,CAAA;IACzD,mEAAuC,CAAA;IACvC,qEAAyC,CAAA;IACzC,2EAA+C,CAAA;IAC/C,yEAA6C,CAAA;IAE7C;;;;;;;OAOG;IACH,mFAAuD,CAAA;IACvD;;;;;;;OAOG;IACH,yFAA6D,CAAA;IAC7D;;;;;;;;;;OAUG;IACH;;;;;;;;;;;;;;;;;;;OAmBG;IACH,yFAA6D,CAAA;IAC7D,2FAA+D,CAAA;IAC/D;;;;;;;;;;;OAWG;IACH,yGAA6E,CAAA;IAC7E;;;;;;;;;;OAUG;IACH,iGAAqE,CAAA;IACrE;;;;;;OAMG;IACH,qFAAyD,CAAA;IACzD;;;;;;OAMG;IACH,iGAAqE,CAAA;IACrE,kFAAkF;IAClF,2FAA+D,CAAA;IAC/D,2FAA+D,CAAA;IAC/D,uEAA2C,CAAA;IAC3C;;;;OAIG;IACH,yEAA6C,CAAA;IAC7C,wFAAwF;IACxF,iFAAqD,CAAA;IACrD;;;;OAIG;IACH,qFAAyD,CAAA;IACzD,2FAA2F;IAC3F,uEAA2C,CAAA;IAC3C,gGAAgG;IAChG,iFAAqD,CAAA;IACrD;;;;OAIG;IACH,6EAAiD,CAAA;IACjD,iFAAiF;IACjF,+EAAmD,CAAA;IACnD,sDAAsD;IACtD,2EAA+C,CAAA;IAC/C;;;;;OAKG;IACH,qFAAyD,CAAA;IACzD;;;;;;;;OAQG;IACH,qGAAyE,CAAA;IACzE;;;;;OAKG;IACH,+EAAmD,CAAA;IACnD;;;;;;;;;;;;OAYG;IACH,6FAAiE,CAAA;IACjE;;;;;;OAMG;IACH,uFAA2D,CAAA;IAC3D,uDAA2B,CAAA;IAC3B,2HAA2H;IAC3H,+DAAmC,CAAA;IACnC,uFAA2D,CAAA;IAC3D,yFAA6D,CAAA;IAC7D,2DAA+B,CAAA;IAC/B,6EAAiD,CAAA;IACjD,8EAA8E;IAC9E,gFAAgF;IAChF,8EAA8E;IAC9E,yEAA6C,CAAA;IAC7C,6EAAiD,CAAA;IACjD,qFAAqF;IACrF,2FAA2F;IAC3F,iFAAqD,CAAA;IACrD,mFAAuD,CAAA;IACvD,mFAAuD,CAAA;IACvD,mEAAuC,CAAA;IACvC,qEAAyC,CAAA;IAEzC,4BAA4B;IAC5B,+EAAmD,CAAA;IACnD,mFAAuD,CAAA;IAEvD,uBAAuB;IACvB,uEAA2C,CAAA;IAC3C,qFAAyD,CAAA;IACzD,yEAA6C,CAAA;IAE7C,qCAAqC;IACrC,2FAA+D,CAAA;IAC/D,yFAA6D,CAAA;IAC7D,mFAAuD,CAAA;IACvD,iFAAqD,CAAA;IACrD,mEAAuC,CAAA;IACvC,uEAA2C,CAAA;IAC3C,uEAA2C,CAAA;IAE3C,wBAAwB;IACxB,yEAA6C,CAAA;IAC7C,6EAAiD,CAAA;IAEjD,qBAAqB;IACrB,mEAAuC,CAAA;IACvC,uEAA2C,CAAA;IAE3C,gCAAgC;IAChC,6EAAiD,CAAA;IACjD,mFAAuD,CAAA;IAEvD,iCAAiC;IACjC,iFAAqD,CAAA;IAErD,wDAAwD;IACxD,yFAA6D,CAAA;IAC7D,6FAA6F;IAC7F,iGAAqE,CAAA;IAErE,0CAA0C;IAC1C,uFAA2D,CAAA;IAC3D,+FAAmE,CAAA;IACnE,2FAA+D,CAAA;IAC/D,uFAA2D,CAAA;IAC3D,+FAAmE,CAAA;IAEnE,2BAA2B;IAC3B,yEAA6C,CAAA;IAC7C,mEAAuC,CAAA;IACvC,2EAA+C,CAAA;IAC/C,mEAAuC,CAAA;IACvC,iFAAqD,CAAA;IACrD,qFAAyD,CAAA;IACzD,mFAAmF;IACnF,qGAAyE,CAAA;IACzE,+FAA+F;IAC/F,yGAA6E,CAAA;IAC7E;;;;OAIG;IACH,qGAAyE,CAAA;IACzE,uDAA2B,CAAA;IAC3B,4GAA4G;IAC5G,uFAA2D,CAAA;IAC3D,qGAAqG;IACrG,uEAA2C,CAAA;IAC3C,2GAA2G;IAC3G,+FAAmE,CAAA;IACnE,8FAA8F;IAC9F,6FAAiE,CAAA;IAEjE,uBAAuB;IACvB,+DAAmC,CAAA;IACnC,2DAA+B,CAAA;IAC/B,qEAAyC,CAAA;IACzC,2DAA+B,CAAA;IAC/B,kPAAkP;IAClP,uEAA2C,CAAA;IAC3C,iEAAqC,CAAA;IAErC;;;;;;;;OAQG;IACH,gGAAgG;IAChG,mFAAuD,CAAA;IACvD,8EAA8E;IAC9E,mFAAuD,CAAA;IACvD;;;;OAIG;IACH,qDAAyB,CAAA;IACzB,yEAAyE;IACzE,6DAAiC,CAAA;IACjC,wDAAwD;IACxD,uDAA2B,CAAA;IAC3B;;;;OAIG;IACH,uEAA2C,CAAA;IAE3C,+DAAmC,CAAA;IAEnC,uDAA2B,CAAA;IAC3B;;;;;;;;;;;;;;;;;;OAkBG;IACH,2FAA+D,CAAA;IAC/D;;;;OAIG;IACH,6EAAiD,CAAA;IACjD;;;;OAIG;IACH,yEAA6C,CAAA;IAC7C;;;;;;;;;;;;;;OAcG;IACH,uFAA2D,CAAA;IAE3D,iEAAqC,CAAA;IACrC,qFAAyD,CAAA;IAEzD,6EAAiD,CAAA;IACjD,mEAAuC,CAAA;IAEvC,yEAAyE;IACzE,qFAAyD,CAAA;IACzD,qEAAqE;IACrE,yEAA6C,CAAA;IAE7C,+DAA+D;IAC/D;;;;;OAKG;IACH,6DAAiC,CAAA;IACjC;;;;OAIG;IACH,mDAAuB,CAAA;IAEvB,6EAA6E;IAC7E;;;;;;;;;OASG;IACH,yDAA6B,CAAA;IAC7B;;;;;;;;;OASG;IACH,+FAAmE,CAAA;AACrE,CAAC,EA5ZW,wBAAwB,KAAxB,wBAAwB,QA4ZnC;AAED,MAAM,CAAC,MAAM,6BAA6B,GAA6C;IACrF,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,qBAAqB;IAExE,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,gBAAgB;IAC1D,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,6BAA6B;IACpF,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAClE,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE,qBAAqB;IACpE,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE,qCAAqC;IACvF,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,oCAAoC;IAErF,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,iCAAiC;IACvF,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,uBAAuB;IAChF,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,uBAAuB;IAChF,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,cAAc;IACxE,CAAC,wBAAwB,CAAC,oCAAoC,CAAC,EAAE,sCAAsC;IACvG,CAAC,wBAAwB,CAAC,gCAAgC,CAAC,EAAE,wCAAwC;IACrG,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,gDAAgD;IACvG,CAAC,wBAAwB,CAAC,gCAAgC,CAAC,EAAE,0EAA0E;IACvI,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,iDAAiD;IAC3G,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,8CAA8C;IACxG,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,sBAAsB;IACtE,qEAAqE;IACrE,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,cAAc;IAC/D,wGAAwG;IACxG,kGAAkG;IAClG,oGAAoG;IACpG,gGAAgG;IAChG,qGAAqG;IACrG,oGAAoG;IACpG,6EAA6E;IAC7E,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,mCAAmC;IACxF,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,yCAAyC;IAChG,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,aAAa;IAC7D,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,kBAAkB;IACvE,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,2BAA2B;IAC9E,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,EAAE,iBAAiB;IACrE,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE,eAAe;IACjE,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,oBAAoB;IAC3E,CAAC,wBAAwB,CAAC,kCAAkC,CAAC,EAAE,4BAA4B;IAC3F,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,EAAE,iBAAiB;IACrE,CAAC,wBAAwB,CAAC,8BAA8B,CAAC,EAAE,2BAA2B;IACtF,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,8BAA8B;IACtF,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,cAAc;IACtD,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE,kBAAkB;IAC9D,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,8BAA8B;IACtF,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,+BAA+B;IACxF,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,gBAAgB;IAC1D,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,yBAAyB;IAC5E,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,uBAAuB;IACxE,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,yBAAyB;IAC5E,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,wBAAwB;IAC7E,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,0BAA0B;IAChF,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,0BAA0B;IAChF,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAClE,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE,0BAA0B;IAEzE,wBAAwB;IACxB,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,uBAAuB;IACxE,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,yBAAyB;IAE5E,qBAAqB;IACrB,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAClE,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,sBAAsB;IAEtE,gCAAgC;IAChC,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,yBAAyB;IAC5E,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,4BAA4B;IAElF,iCAAiC;IACjC,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,2BAA2B;IAEhF,gCAAgC;IAChC,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,+BAA+B;IACxF,CAAC,wBAAwB,CAAC,gCAAgC,CAAC,EAAE,mCAAmC;IAEhG,0CAA0C;IAC1C,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,2CAA2C;IACnG,CAAC,wBAAwB,CAAC,+BAA+B,CAAC,EAAE,gEAAgE;IAC5H,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,gCAAgC;IAC1F,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,2DAA2D;IACnH,CAAC,wBAAwB,CAAC,+BAA+B,CAAC,EAAE,gFAAgF;IAE5I,2BAA2B;IAC3B,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,uBAAuB;IACxE,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAClE,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE,wBAAwB;IAC1E,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAClE,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,sBAAsB;IAC3E,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,8BAA8B;IACrF,CAAC,wBAAwB,CAAC,kCAAkC,CAAC,EAAE,sCAAsC;IACrG,CAAC,wBAAwB,CAAC,oCAAoC,CAAC,EAAE,iCAAiC;IAClG,CAAC,wBAAwB,CAAC,kCAAkC,CAAC,EAAE,sCAAsC;IACrG,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,cAAc;IACtD,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,8BAA8B;IACtF,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,sBAAsB;IACtE,CAAC,wBAAwB,CAAC,+BAA+B,CAAC,EAAE,kCAAkC;IAC9F,CAAC,wBAAwB,CAAC,8BAA8B,CAAC,EAAE,iCAAiC;IAE5F,uBAAuB;IACvB,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE,gCAAgC;IAC5E,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,gBAAgB;IAC1D,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE,yCAAyC;IACxF,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,gBAAgB;IAC1D,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,mBAAmB;IACnE,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,EAAE,mBAAmB;IAEhE,mGAAmG;IACnG,+FAA+F;IAC/F,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,6BAA6B;IACnF,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,+BAA+B;IACrF,CAAC,wBAAwB,CAAC,UAAU,CAAC,EAAE,gBAAgB;IACvD,CAAC,wBAAwB,CAAC,cAAc,CAAC,EAAE,yBAAyB;IACpE,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,sBAAsB;IAC9D,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,uBAAuB;IAEvE,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE,cAAc;IAE1D,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,wBAAwB;IAChE,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,0CAA0C;IACpG,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,mCAAmC;IACtF,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,iCAAiC;IAClF,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,wCAAwC;IAEhG,4BAA4B;IAC5B,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,EAAE,0BAA0B;IAC9E,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,4BAA4B;IAElF,uBAAuB;IACvB,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,sBAAsB;IACtE,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,6BAA6B;IACpF,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,uBAAuB;IAExE,qCAAqC;IACrC,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,gCAAgC;IAC1F,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,+BAA+B;IACxF,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,oCAAoC;IAC1F,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,mCAAmC;IACxF,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAClE,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,sBAAsB;IACtE,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,sBAAsB;IAEtE,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,EAAE,mBAAmB;IAChE,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,6BAA6B;IAEpF,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,yBAAyB;IAC5E,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,oBAAoB;IAElE,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,6BAA6B;IACpF,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,uBAAuB;IAExE,wCAAwC;IACxC,sFAAsF;IACtF,qFAAqF;IACrF,oEAAoE;IACpE,CAAC,wBAAwB,CAAC,cAAc,CAAC,EAAE,kCAAkC;IAC7E,CAAC,wBAAwB,CAAC,SAAS,CAAC,EAAE,MAAM;IAE5C,8CAA8C;IAC9C,4FAA4F;IAC5F,iFAAiF;IACjF,4EAA4E;IAC5E,CAAC,wBAAwB,CAAC,YAAY,CAAC,EAAE,MAAM;IAC/C,CAAC,wBAAwB,CAAC,+BAA+B,CAAC,EAAE,uCAAuC;CACpG,CAAC;AAEF,wDAAwD;AACxD,+CAA+C;AAC/C,6DAA6D;AAC7D,wDAAwD;AAExD,MAAM,CAAN,IAAY,kBAIX;AAJD,WAAY,kBAAkB;IAC5B,yDAAmC,CAAA;IACnC,2DAAqC,CAAA;IACrC,iDAA2B,CAAA;AAC7B,CAAC,EAJW,kBAAkB,KAAlB,kBAAkB,QAI7B;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAuC;IACpE,CAAC,kBAAkB,CAAC,eAAe,CAAC,EAAE,SAAS;IAC/C,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,eAAe;IACtD,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE,cAAc;CACjD,CAAC","sourcesContent":["/**\n * Manual Controllers Routes URLs\n * Centralized URL declarations for custom/manual controllers\n * Shared between backend and frontend to avoid string duplication.\n *\n * Notes:\n * - These URLs are mounted under {@link MAIN_API_BASE_PATH}\n * - Keep only path segments here (no `MAIN_API_BASE_PATH` prefix) — the\n *   prefix is prepended once at each boundary (backend mount / frontend client)\n */\n\n/**\n * Main API base path — the mount prefix under which the entire main\n * controllers registry is served (every resource route AND every\n * {@link MANUAL_CONTROLLER_ROUTES_URLS} entry).\n *\n * This is the SINGLE SOURCE OF TRUTH for the prefix. It is consumed by:\n *  - the backend HTTP server mount (`app.use(MAIN_API_BASE_PATH, mainRouter)`),\n *  - the frontend HTTP client when building absolute API URLs\n *    (`${MAIN_API_BASE_PATH}${MANUAL_CONTROLLER_ROUTES_URLS[...]}`),\n *  - the refresh-token cookie `Path` scope, which MUST path-match the served\n *    auth routes (`${MAIN_API_BASE_PATH}/auth/*`) or the browser drops it.\n *\n * Why a shared symbol and not a literal: previously `/api/v1` was a literal\n * duplicated across the mount and the client. The absence of a shared symbol\n * let the refresh-token cookie `Path` be authored against the bare route\n * segment (`/auth`, omitting this prefix), so the browser stored the cookie\n * but never sent it to `/api/v1/auth/token/refresh` — silently breaking token\n * refresh for every session (forced logout on first refresh). Deriving every\n * prefix consumer from this constant closes that drift class.\n *\n * NOT under this prefix: the root-level engine routes in\n * {@link ENGINE_ROOT_ROUTES} (health/time probes), mounted at the app root.\n */\nexport const MAIN_API_BASE_PATH = '/api/v1';\n\n/**\n * Where RFC 8414 authorization-server metadata must be served for an issuer that carries a PATH.\n *\n * The rule is counter-intuitive and is the reason this exists as a named derivation rather than a\n * string built at the call site: the well-known segment goes BETWEEN the host and the issuer path,\n * not after it.\n *\n *   \"If the issuer identifier value contains a path component, any terminating \"/\" MUST be removed\n *    before inserting \"/.well-known/\" and the well-known URI suffix between the host component and\n *    the path component.\"\n *\n * with the RFC's own worked example resolving issuer `https://example.com/issuer1` to\n * `GET /.well-known/oauth-authorization-server/issuer1`.\n * spec-cite: RFC 8414 § 3 (Obtaining Authorization Server Metadata), fetched 2026-08-11.\n *\n * OIDC Discovery uses the OPPOSITE construction — issuer + `/.well-known/openid-configuration` — so\n * the two cannot share one path and a server that serves only the OIDC shape fails RFC 8414 discovery\n * while looking correct. That is exactly what happened here: a real MCP client split our issuer at the\n * host boundary as the RFC instructs, asked for `/.well-known/oauth-authorization-server/api/v1`,\n * received the SPA shell, and abandoned authorization without ever opening a browser.\n *\n * @param issuerPath the issuer's path component (e.g. {@link MAIN_API_BASE_PATH}); a bare `/` or an\n *                   empty string yields the origin-root location, which is the path-less issuer case.\n */\nexport function rfc8414AuthorizationServerMetadataPath(issuerPath: string): string {\n  return wellKnownPathBeforeResourcePath('oauth-authorization-server', issuerPath);\n}\n\n/**\n * Where RFC 9728 protected-resource metadata must be served for a resource identifier that carries a\n * PATH — the same insertion rule as {@link rfc8414AuthorizationServerMetadataPath}, for the other\n * document.\n *\n *   \"The protected resource's well-known URI is created by inserting\n *    /.well-known/oauth-protected-resource between the host component and the path component (if any)\n *    of the resource identifier.\"\n * spec-cite: RFC 9728 § 3 (Protected Resource Metadata Request), fetched 2026-08-12.\n *\n * This is a SECOND discovery route, not a replacement for the one the challenge names. RFC 9728 § 5.1\n * lets a client take `resource_metadata` straight from the `WWW-Authenticate` header, and MCP tells\n * clients to do exactly that — which is why serving only the header's location worked with a real\n * client and is a defensible posture. It is nevertheless not the whole contract: a client that derives\n * the location from the resource identifier, as this section permits, previously received the SPA\n * shell. Both locations now serve one document.\n *\n * Note the asymmetry with RFC 8414, because it explains why that one was a live outage and this one\n * was latent: an authorization server publishes no equivalent pointer, so derivation is a client's\n * ONLY route to AS metadata.\n *\n * @param resourcePath the resource identifier's path component (e.g. `/api/v1/mcp`); a bare `/` or an\n *                     empty string yields the origin-root location, which is the path-less case.\n */\nexport function rfc9728ProtectedResourceMetadataPath(resourcePath: string): string {\n  return wellKnownPathBeforeResourcePath('oauth-protected-resource', resourcePath);\n}\n\n/**\n * The construction RFC 8414 § 3 and RFC 9728 § 3 both specify: strip any terminating `/`, then insert\n * the well-known segment BETWEEN the host and the path.\n *\n * Shared deliberately rather than written twice. The rule is counter-intuitive enough that it was\n * already implemented wrongly once here, and a second hand-rolled copy is how the two documents would\n * come to disagree about a rule they take verbatim from each other.\n */\nfunction wellKnownPathBeforeResourcePath(wellKnownSegment: string, path: string): string {\n  const normalized = path.replace(/\\/+$/, '');\n  return `/.well-known/${wellKnownSegment}${normalized.startsWith('/') || normalized === '' ? normalized : `/${normalized}`}`;\n}\n\nexport enum ManualControllerRouteKey {\n  APPLICATION_CONFIG_GET = 'APPLICATION_CONFIG_GET',\n\n  AUTH_IDENTIFY = 'AUTH_IDENTIFY',\n  AUTH_AUTHENTICATE_PASSWORD = 'AUTH_AUTHENTICATE_PASSWORD',\n  AUTH_AUTHENTICATE = 'AUTH_AUTHENTICATE',\n  AUTH_TOKEN_REFRESH = 'AUTH_TOKEN_REFRESH',\n  AUTH_OAUTH2_AUTHORIZE = 'AUTH_OAUTH2_AUTHORIZE',\n  AUTH_OAUTH2_CALLBACK = 'AUTH_OAUTH2_CALLBACK',\n\n  /**\n   * OUTBOUND connections — this application acting as somebody toward a third party.\n   *\n   * Easy to confuse with {@link AUTH_OAUTH2_AUTHORIZE} above and the exact opposite direction: that\n   * pair signs a person INTO this application using a vendor as the identity provider, this pair\n   * connects a vendor account so this application can act as that account. Same protocol, opposite\n   * arrow, and nothing is shared between them but the RFC.\n   */\n  PROVIDER_CONNECTION_START = 'PROVIDER_CONNECTION_START',\n  /**\n   * The single redirect URI for EVERY provider, keyed by `state` rather than by a path segment.\n   *\n   * One URI, deliberately. A redirect URI must be registered at the vendor before it is accepted, so\n   * a per-provider path would mean registering 129 distinct URIs — by hand, per deployment, per\n   * environment. The `state` already has to be unguessable and single-use for CSRF, and it already\n   * identifies the attempt, so it identifies the provider too at no extra cost.\n   */\n  PROVIDER_CONNECTION_CALLBACK = 'PROVIDER_CONNECTION_CALLBACK',\n  /**\n   * What this caller may connect, and under which owner scopes.\n   *\n   * Without it a settings screen cannot offer Connect at all: the credential LIST answers what a\n   * person HAS connected, and nothing answers what they COULD. The two are different questions and\n   * the empty answer to the first — the state everybody starts in — is exactly when the second one\n   * matters.\n   *\n   * Admissibility is a RECORDED DECISION per provider, never derived from a vendor's API surface, so\n   * this route reports a decision rather than computing one.\n   */\n  /**\n   * Finish an authorization the vendor has just approved — the half the CALLBACK cannot do.\n   *\n   * The callback is reached by a top-level navigation from the vendor's origin, so it carries no\n   * `Authorization` header and never can: a header is set by script on a fetch, and a redirect is\n   * not a fetch. The application's only auth cookie is `SameSite=Strict` on `Path=/api/v1/auth`, so\n   * it is not sent there either. The callback therefore cannot know WHO is finishing the flow, and\n   * for a while it asked anyway — every consent answered `401 UNAUTHENTICATED` and the person saw a\n   * JSON body, with the attempt already consumed so they could not even retry.\n   *\n   * Splitting it puts the authenticated act back on a FETCH, where a bearer token exists. The\n   * callback hands `state` and `code` to the frontend and authenticates nobody; the frontend, which\n   * holds the token, posts them here. Nothing about the guarantee is relaxed — this route consumes\n   * the attempt atomically, re-checks that the finisher is the initiator, and only then exchanges.\n   *\n   * Rejected: binding the attempt to a browser with a second `SameSite=Lax` cookie. It is the\n   * ordinary OAuth-client pattern and it would work, but this application authenticates its API with\n   * bearer tokens and nothing else, and a second auth-bearing cookie is an architectural addition\n   * whose `SameSite` behaviour then has to be reasoned about separately for every deployment shape.\n   */\n  PROVIDER_CONNECTION_COMPLETE = 'PROVIDER_CONNECTION_COMPLETE',\n  PROVIDER_CONNECTION_CATALOGUE = 'PROVIDER_CONNECTION_CATALOGUE',\n  /**\n   * Store a credential somebody TYPED, for a vendor with no authorization flow.\n   *\n   * The sibling of {@link PROVIDER_CONNECTION_START}, and a separate route because the acts differ\n   * completely: one hands back a URL and ends in a redirect from a vendor, this one takes values and\n   * ends in a stored row. Sharing a route would mean a body whose meaning depends on a provider's\n   * contract, which is how a caller ends up sending an access token where a client id belongs.\n   *\n   * It exists on the BACKEND rather than being a generic resource create because this is where\n   * \"nothing is typed by hand\" stops being a screen's good manners and becomes enforceable: the route\n   * refuses any slug the provider did not declare as identifying an account.\n   */\n  PROVIDER_CONNECTION_STORE_CREDENTIAL = 'PROVIDER_CONNECTION_STORE_CREDENTIAL',\n  /**\n   * A short-lived access token for the CALLER's own connected account, handed to the browser (#394 P4).\n   *\n   * The one shape of credential a browser may ever be handed, and the reason it is a route of its\n   * own: a vendor's picker (Drive's, for one) authorizes as the signed-in user and cannot render\n   * without that user's token — so the token is in the browser during picking whether the selected\n   * bytes are later fetched by the backend or not. Everything else about the grant stays server-side:\n   * the refresh token never crosses, the row is resolved as the caller and nobody else, and every\n   * hand-out is a recorded USE of the credential, which is what makes revocation and erasure mean\n   * something for a token that has left the process.\n   */\n  PROVIDER_CONNECTION_ACCESS_TOKEN = 'PROVIDER_CONNECTION_ACCESS_TOKEN',\n  /**\n   * A signed-in person's browser triggers ONE declared provider operation, executed on the backend (#367).\n   *\n   * The credential stays on the server: the browser names the provider, the operation and whose account\n   * to spend, and receives the operation's parsed output. Reachable only for operations the application\n   * declared in `providers.browserOperations` — everything else is refused, and every refusal is audited.\n   */\n  PROVIDER_OPERATION_EXECUTE = 'PROVIDER_OPERATION_EXECUTE',\n  /**\n   * The CHOICES for one input of a declared provider operation (#333) — a workspace, a project — listed by\n   * running the input's declared options operation through the same connection.\n   *\n   * Admitted only when BOTH the operation and its options operation are declared browser-reachable for\n   * the named connection; a refusal is audited exactly as the execute door's is.\n   */\n  PROVIDER_OPERATION_INPUT_OPTIONS = 'PROVIDER_OPERATION_INPUT_OPTIONS',\n  /** Enterprise SSO: initiate OAuth2 flow for an org's OIDC connection (Step 15) */\n  AUTH_ENTERPRISE_SSO_AUTHORIZE = 'AUTH_ENTERPRISE_SSO_AUTHORIZE',\n  AUTH_APP_ENTERPRISE_AUTHORIZE = 'AUTH_APP_ENTERPRISE_AUTHORIZE',\n  AUTH_TOKEN_EXCHANGE = 'AUTH_TOKEN_EXCHANGE',\n  /**\n   * OAuth 2.0 Authorization Server token endpoint (Wildo-AS-PROVIDER, distinct from the\n   * RP-side `/auth/*` routes). Serves `grant_type=client_credentials` now; the OIDC branch\n   * adds `authorization_code`. Served at `${MAIN_API_BASE_PATH}/oauth/token`.\n   */\n  OAUTH_PROVIDER_TOKEN = 'OAUTH_PROVIDER_TOKEN',\n  /** OIDC discovery document (served at `${issuer}/.well-known/openid-configuration`). */\n  OAUTH_PROVIDER_DISCOVERY = 'OAUTH_PROVIDER_DISCOVERY',\n  /**\n   * RFC 8414 Authorization Server Metadata (`${issuer}/.well-known/oauth-authorization-server`) —\n   * the SAME document as {@link OAUTH_PROVIDER_DISCOVERY}, served at the OAuth-2 well-known path that\n   * many OAuth/MCP clients probe FIRST (before the OIDC path). Aliases the discovery handler.\n   */\n  OAUTH_PROVIDER_AS_METADATA = 'OAUTH_PROVIDER_AS_METADATA',\n  /** JSON Web Key Set for verifying Wildo-issued tokens (the discovery doc's `jwks_uri`). */\n  OAUTH_PROVIDER_JWKS = 'OAUTH_PROVIDER_JWKS',\n  /** OIDC authorization endpoint (authorization_code flow — the caller lands here to consent). */\n  OAUTH_PROVIDER_AUTHORIZE = 'OAUTH_PROVIDER_AUTHORIZE',\n  /**\n   * OIDC interactive-consent decision endpoint. When the authorize endpoint returned\n   * `consent_required` for a `requiresConsent` client, the user's approve/deny decision is POSTed\n   * here with the single-use consent-request token; APPROVE mints the authorization code.\n   */\n  OAUTH_PROVIDER_CONSENT = 'OAUTH_PROVIDER_CONSENT',\n  /** OIDC UserInfo endpoint (bearer access token → the user's standard claims). */\n  OAUTH_PROVIDER_USERINFO = 'OAUTH_PROVIDER_USERINFO',\n  /** OAuth 2.0 token revocation endpoint (RFC 7009). */\n  OAUTH_PROVIDER_REVOKE = 'OAUTH_PROVIDER_REVOKE',\n  /**\n   * OIDC RP-Initiated Logout 1.0 `end_session_endpoint` (revocation-C). A relying party redirects the\n   * End-User here (with an `id_token_hint`) to terminate their Wildo OP login session — the exact\n   * session the delegation was authorized from, keyed on the id_token's `sid`. Distinct from\n   * {@link OAUTH_PROVIDER_REVOKE}: revoke kills a TOKEN (RFC 7009); end_session ends a SESSION.\n   */\n  OAUTH_PROVIDER_END_SESSION = 'OAUTH_PROVIDER_END_SESSION',\n  /**\n   * OIDC RP-Initiated Logout 1.0 §6 confirmation decision (revocation-C). The `POST` the frontend\n   * `/oauth/logout-confirm` prompt calls to actually terminate the session, presenting the single-use\n   * `OIDC_LOGOUT_CONFIRMATION` token minted by {@link OAUTH_PROVIDER_END_SESSION}. Token-authorized\n   * (no Bearer — the End-User may be unauthenticated in the SPA, having arrived via an RP redirect);\n   * returns `{ redirect_to }` (always the same-origin signed-out page `/oauth/logged-out`; the SPA\n   * navigates there). Only reached for NON-trusted logouts — a trusted RP logout terminates + redirects\n   * inline without a prompt (the Keycloak-style posture).\n   */\n  OAUTH_PROVIDER_END_SESSION_CONFIRM = 'OAUTH_PROVIDER_END_SESSION_CONFIRM',\n  /**\n   * RFC 7591 dynamic client registration. Registered UNCONDITIONALLY so the route always exists;\n   * the handler answers 404 unless the application opted in via `auth.dynamicClientRegistration`.\n   * Registering it conditionally would make the route table depend on config, which is far harder\n   * to reason about than one handler that refuses.\n   */\n  OAUTH_PROVIDER_REGISTER = 'OAUTH_PROVIDER_REGISTER',\n  /**\n   * RFC 7592 client configuration endpoint — a dynamically registered client reads, updates or\n   * deletes its OWN registration, authenticating with the registration access token it was issued\n   * at registration.\n   *\n   * One key for three verbs (GET / PUT / DELETE) because RFC 7592 §2 defines ONE endpoint whose\n   * method selects the operation; splitting it into three keys would invent a distinction the\n   * specification does not make and put the same URL in the table three times.\n   *\n   * Registered unconditionally, like `/oauth/register`, and gated by the same\n   * `auth.dynamicClientRegistration` opt-in in the handler — a route table that depends on config is\n   * harder to reason about than a handler that refuses.\n   */\n  OAUTH_PROVIDER_REGISTER_CLIENT = 'OAUTH_PROVIDER_REGISTER_CLIENT',\n  /**\n   * Cross-frontend session handoff (cross-app-jwt-propagation Step 2).\n   * Authenticated user requests a one-time AUTH_CODE_EXCHANGE token bound to a\n   * target frontend, then redirects the browser to the target's\n   * /auth/exchange page with the code. Bearer-only; CORS auto-allowed for every\n   * declared frontendService via the existing deriveCorsOrigins() seam.\n   */\n  AUTH_CROSS_FRONTEND_HANDOFF = 'AUTH_CROSS_FRONTEND_HANDOFF',\n  AUTH_LOGOUT = 'AUTH_LOGOUT',\n  /** Sign-out-everywhere: fences the whole user — all access + refresh tokens, every device — via the invalidation fence. */\n  AUTH_LOGOUT_ALL = 'AUTH_LOGOUT_ALL',\n  AUTH_PASSWORD_RESET_REQUEST = 'AUTH_PASSWORD_RESET_REQUEST',\n  AUTH_PASSWORD_RESET_COMPLETE = 'AUTH_PASSWORD_RESET_COMPLETE',\n  AUTH_REGISTER = 'AUTH_REGISTER',\n  AUTH_ACCEPT_INVITATION = 'AUTH_ACCEPT_INVITATION',\n  // Public token-keyed invitation-accept DISCOVERY (non-consuming): returns the\n  // invited org's available auth methods + SSO/SCIM management mode so the accept\n  // screen can render the right chooser. Read-only; does NOT consume the token.\n  AUTH_INVITATION_INFO = 'AUTH_INVITATION_INFO',\n  AUTH_REJECT_INVITATION = 'AUTH_REJECT_INVITATION',\n  // In-app authenticated invitation management (Approach P) — a signed-in user acts on\n  // THEIR OWN pending invitations (authorized by email-ownership), no token, no new session.\n  AUTH_LIST_MY_INVITATIONS = 'AUTH_LIST_MY_INVITATIONS',\n  AUTH_ACCEPT_MY_INVITATION = 'AUTH_ACCEPT_MY_INVITATION',\n  AUTH_REJECT_MY_INVITATION = 'AUTH_REJECT_MY_INVITATION',\n  AUTH_VERIFY_EMAIL = 'AUTH_VERIFY_EMAIL',\n  AUTH_SESSION_STATE = 'AUTH_SESSION_STATE',\n\n  // MFA — Email OTP (Step 10)\n  AUTH_MFA_EMAIL_OTP_SEND = 'AUTH_MFA_EMAIL_OTP_SEND',\n  AUTH_MFA_EMAIL_OTP_VERIFY = 'AUTH_MFA_EMAIL_OTP_VERIFY',\n\n  // MFA — TOTP (Step 11)\n  AUTH_MFA_TOTP_SETUP = 'AUTH_MFA_TOTP_SETUP',\n  AUTH_MFA_TOTP_VERIFY_SETUP = 'AUTH_MFA_TOTP_VERIFY_SETUP',\n  AUTH_MFA_TOTP_VERIFY = 'AUTH_MFA_TOTP_VERIFY',\n\n  // WebAuthn/Passkey Routes (Phase G1)\n  AUTH_PASSKEY_REGISTER_OPTIONS = 'AUTH_PASSKEY_REGISTER_OPTIONS',\n  AUTH_PASSKEY_REGISTER_VERIFY = 'AUTH_PASSKEY_REGISTER_VERIFY',\n  AUTH_PASSKEY_AUTH_OPTIONS = 'AUTH_PASSKEY_AUTH_OPTIONS',\n  AUTH_PASSKEY_AUTH_VERIFY = 'AUTH_PASSKEY_AUTH_VERIFY',\n  AUTH_PASSKEY_LIST = 'AUTH_PASSKEY_LIST',\n  AUTH_PASSKEY_REMOVE = 'AUTH_PASSKEY_REMOVE',\n  AUTH_PASSKEY_RENAME = 'AUTH_PASSKEY_RENAME',\n\n  // Magic Link (Phase G2)\n  AUTH_MAGIC_LINK_SEND = 'AUTH_MAGIC_LINK_SEND',\n  AUTH_MAGIC_LINK_VERIFY = 'AUTH_MAGIC_LINK_VERIFY',\n\n  // SMS OTP (Phase G2)\n  AUTH_SMS_OTP_SEND = 'AUTH_SMS_OTP_SEND',\n  AUTH_SMS_OTP_VERIFY = 'AUTH_SMS_OTP_VERIFY',\n\n  // Phone Verification (Phase G2)\n  AUTH_PHONE_VERIFY_SEND = 'AUTH_PHONE_VERIFY_SEND',\n  AUTH_PHONE_VERIFY_CONFIRM = 'AUTH_PHONE_VERIFY_CONFIRM',\n\n  // Resend Verification Email (F5)\n  AUTH_RESEND_VERIFICATION = 'AUTH_RESEND_VERIFICATION',\n\n  // W5.7: Complete org onboarding (deferred org creation)\n  AUTH_COMPLETE_ORG_ONBOARDING = 'AUTH_COMPLETE_ORG_ONBOARDING',\n  // #1374: Complete the profile-names obligation (names collected after the address is proven)\n  AUTH_COMPLETE_PROFILE_ONBOARDING = 'AUTH_COMPLETE_PROFILE_ONBOARDING',\n\n  // W7.3b: One-off session token management\n  AUTH_ONE_OFF_SESSION_CREATE = 'AUTH_ONE_OFF_SESSION_CREATE',\n  AUTH_ONE_OFF_SESSION_CREATE_ORG = 'AUTH_ONE_OFF_SESSION_CREATE_ORG',\n  AUTH_ONE_OFF_SESSION_EXCHANGE = 'AUTH_ONE_OFF_SESSION_EXCHANGE',\n  AUTH_ONE_OFF_SESSION_REVOKE = 'AUTH_ONE_OFF_SESSION_REVOKE',\n  AUTH_ONE_OFF_SESSION_REVOKE_ORG = 'AUTH_ONE_OFF_SESSION_REVOKE_ORG',\n\n  // Method Management (#13f)\n  AUTH_PASSWORD_CHANGE = 'AUTH_PASSWORD_CHANGE',\n  AUTH_PASSWORD_SET = 'AUTH_PASSWORD_SET',\n  AUTH_MFA_TOTP_DISABLE = 'AUTH_MFA_TOTP_DISABLE',\n  AUTH_METHODS_MINE = 'AUTH_METHODS_MINE',\n  AUTH_IDENTITY_LINKS_LIST = 'AUTH_IDENTITY_LINKS_LIST',\n  AUTH_IDENTITY_LINKS_UNLINK = 'AUTH_IDENTITY_LINKS_UNLINK',\n  /** Which governed documents the signed-in person owes an acceptance of (#1258). */\n  GOVERNED_DOCUMENT_ACCEPTANCES_OWED = 'GOVERNED_DOCUMENT_ACCEPTANCES_OWED',\n  /** Record the signed-in person's acceptance of in-force governed-document releases (#1258). */\n  GOVERNED_DOCUMENT_ACCEPTANCES_ACCEPT = 'GOVERNED_DOCUMENT_ACCEPTANCES_ACCEPT',\n  /**\n   * Record that a governed document (e.g. the privacy notice) was DELIVERED to the signed-in caller\n   * (#1258 Step 5 / R11). The anonymous half of the same fact is `ANONYMOUS_USERS.record_notice_delivered`\n   * — two doors because the two callers have different security characteristics, one recorder underneath.\n   */\n  GOVERNED_DOCUMENT_NOTICE_DELIVERED = 'GOVERNED_DOCUMENT_NOTICE_DELIVERED',\n  AUTH_REAUTH = 'AUTH_REAUTH',\n  /** Challenge leg of a PASSKEY step-up: WebAuthn is challenge-response, so re-auth needs two round-trips. */\n  AUTH_REAUTH_PASSKEY_OPTIONS = 'AUTH_REAUTH_PASSKEY_OPTIONS',\n  /** Which factors can re-prove the signed-in person for a given `ReAuthenticationPurpose` (#1417). */\n  AUTH_REAUTH_METHODS = 'AUTH_REAUTH_METHODS',\n  /** Start re-authenticating through one of the signed-in person's own linked identity providers (#1441). */\n  AUTH_REAUTH_FEDERATED_AUTHORIZE = 'AUTH_REAUTH_FEDERATED_AUTHORIZE',\n  /** Redeem the one-time code a federated re-authentication returned, for its proof (#1441). */\n  AUTH_REAUTH_FEDERATED_EXCHANGE = 'AUTH_REAUTH_FEDERATED_EXCHANGE',\n\n  // SAML Routes (AUTH-2)\n  AUTH_SAML_LOGIN = 'AUTH_SAML_LOGIN',\n  AUTH_SAML_ACS = 'AUTH_SAML_ACS',\n  AUTH_SAML_METADATA = 'AUTH_SAML_METADATA',\n  AUTH_SAML_SLO = 'AUTH_SAML_SLO',\n  /** SP-INITIATED SLO kickoff: the app asks the backend to log the caller out of their SAML session and (when the IdP supports it) redirect to the IdP's SLO endpoint. Distinct from AUTH_SAML_SLO, which is the INBOUND endpoint the IdP calls. */\n  AUTH_SAML_SP_LOGOUT = 'AUTH_SAML_SP_LOGOUT',\n  AUTH_OIDC_LOGOUT = 'AUTH_OIDC_LOGOUT',\n\n  /**\n   * Direct file transfer, distinct from the resource registry's own file routes.\n   *\n   * A resource's `/…/{id}/files/{field}` routes upload and replace the file BOUND TO A FIELD; these\n   * five address a stored file by its own id, wherever it is attached. They lived as literal path\n   * strings inside the file controller until 2026-09-09, which is exactly the duplication this\n   * registry exists to remove — and it also kept them out of every mechanism keyed on this\n   * vocabulary, the generated API reference included.\n   */\n  /** Public, token-authenticated status read for an upload grant. The token IS the credential. */\n  FILES_UPLOAD_GRANT_STATUS = 'FILES_UPLOAD_GRANT_STATUS',\n  /** Revoke an upload grant, addressed by its id — never by the token value. */\n  FILES_UPLOAD_GRANT_REVOKE = 'FILES_UPLOAD_GRANT_REVOKE',\n  /**\n   * One stored file addressed by id. ONE key for two verbs (GET downloads it, DELETE removes it)\n   * because Express matches one path and the method selects the operation — the same reasoning as\n   * {@link OAUTH_PROVIDER_REGISTER_CLIENT}. Splitting it would put one URL in the table twice.\n   */\n  FILES_ITEM = 'FILES_ITEM',\n  /** The stored file's metadata record, without transferring its bytes. */\n  FILES_METADATA = 'FILES_METADATA',\n  /** Mint a time-limited share link for a stored file. */\n  FILES_SHARE = 'FILES_SHARE',\n  /**\n   * Revoke EVERY live share link of a stored file — \"stop sharing this file\". Its own address rather than a\n   * second verb on {@link FILES_SHARE}: minting answers 201 with a link, revoking answers 200 with a count,\n   * and `/shares` names the collection being emptied.\n   */\n  FILES_SHARES_REVOKE = 'FILES_SHARES_REVOKE',\n\n  I18N_GET_LABELS = 'I18N_GET_LABELS',\n\n  CHARTS_DATA = 'CHARTS_DATA',\n  /**\n   * The application's SUBJECT-ERASURE LANE, summarized — counts only, never a row (#269).\n   *\n   * An evidence reader must be able to say what the erasure lane DID: how many requests arrived, who\n   * raised each, how many were withdrawn, how many completed or failed, and whether the completed ones\n   * carry the outcome they promise. Every read variant on an application's erasure-request resource is\n   * subject-scoped by design — correctly, since the lane is the subject's own door — so before this route\n   * existed the lane could be read one subject at a time, as that subject, and as a whole not at all.\n   *\n   * It is a route rather than a resource verb because the ANSWER is an aggregate. Adding an\n   * application-wide LIST would hand an evidence reader every data subject who ever asked to be erased,\n   * in order to count them — the shape #1244 retired. This endpoint runs the count where the rows live\n   * and returns no identifier, no row and no free text.\n   *\n   * Derived, not authored: the resource, the fields and the two operations come from the application's\n   * own `subjectErasureLane` declaration (#1209), so an application that declares a lane gets this\n   * answer without writing an operation, and an application that declares none gets an explicit\n   * \"not applicable\" rather than a silence indistinguishable from a lane with no activity.\n   */\n  SUBJECT_ERASURE_LANE_EVIDENCE = 'SUBJECT_ERASURE_LANE_EVIDENCE',\n  /**\n   * Every physical model-provider call in a window, as counts: which providers and models, how the\n   * calls ended, what they consumed, and how many records are incomplete. The door onto\n   * `providerCallRecords` for `evidence-requirement:outbound-call-record` C2; it returns no row.\n   */\n  PROVIDER_CALL_EVIDENCE = 'PROVIDER_CALL_EVIDENCE',\n  /**\n   * Where the usage rows stand with respect to the provider flush, as counts: pending, reported,\n   * unreportable by reason, and the contradictions `evidence-requirement:usage-flush-run-record` C3\n   * forbids. It returns no row.\n   */\n  USAGE_FLUSH_EVIDENCE = 'USAGE_FLUSH_EVIDENCE',\n  /**\n   * Did a SCHEDULED run actually happen as often as it was supposed to (#1029)?\n   *\n   * `assessScheduledEvidenceCoverage` answers it and calls itself \"a trusted backend measurement\n   * seam, not an authorization endpoint\" — which says the DOOR must carry the gating, not that there\n   * should be no door. Without one the assessment had no caller at all outside its own tests: the\n   * job-execution and payload stores are REPOSITORY_ONLY, so nothing outside the backend process\n   * could reach it, and every PERFORMED clause resting on run history stayed unanswerable.\n   *\n   * POST because the caller supplies the historical SCHEDULE BASIS, which is a body. That is the\n   * seam's own contract — *\"an explicitly supplied historical schedule basis… callers must retain its\n   * authorityRefs with the report\"* — and the basis is derived from git by\n   * `scripts/assurance/derive-schedule-segments.mjs`, so what the caller sends is reproducible from\n   * commits rather than typed.\n   */\n  SCHEDULED_EVIDENCE_COVERAGE = 'SCHEDULED_EVIDENCE_COVERAGE',\n\n  ANALYTICS_EVENTS = 'ANALYTICS_EVENTS',\n  ANALYTICS_MOMENTS_ACHIEVED = 'ANALYTICS_MOMENTS_ACHIEVED',\n\n  PROGRESSION_MILESTONES = 'PROGRESSION_MILESTONES',\n  FEATURES_RESOLVED = 'FEATURES_RESOLVED',\n\n  /** Frontend-visible flow/actor systems (metadata + renderable graph). */\n  FLOWS_ACTORS_FRONTEND_INFO = 'FLOWS_ACTORS_FRONTEND_INFO',\n  /** The caller's own conversation history for a flow/actor system. */\n  FLOWS_ACTORS_HISTORY = 'FLOWS_ACTORS_HISTORY',\n\n  // === A2A (external actor exposure — Agent2Agent protocol) ===\n  /**\n   * A2A agent card (public, CORS-open metadata) advertising this app's exposed\n   * actor systems as A2A skills + the security schemes a caller must satisfy.\n   * Analogous to the OIDC discovery doc; the served path can be reverse-proxy\n   * aliased to a root `/.well-known/agent-card.json`.\n   */\n  A2A_AGENT_CARD = 'A2A_AGENT_CARD',\n  /**\n   * A2A JSON-RPC task/message endpoint (`message/send`, `message/stream` via SSE).\n   * Its absolute URL is the agent card's `url` AND the agent's canonical\n   * audience — an inbound access token MUST carry this as its `aud` (RFC 8707 / D7).\n   */\n  A2A_TASKS = 'A2A_TASKS',\n\n  // === MCP (Model Context Protocol server — resource operations as tools) ===\n  /**\n   * MCP JSON-RPC 2.0 endpoint (Streamable-HTTP transport): `initialize`, `tools/list`,\n   * `tools/call`. A `tools/call` is Bearer-credentialed by a machine OR user-delegated access token\n   * that is resource-server-bound to the MCP audience — NOT the generic API audience, which this\n   * surface rejects since the 2026-07-29 strict flip (RFC 8707 / D7) — validated at auth time; the\n   * server re-runs `authorizeInController` before dispatch (fail-closed).\n   *\n   * Also the base for the R-2 NAMED server instances: `POST /mcp/:instanceRef` serves a declared\n   * instance with its own audience (`…/mcp/<ref>`) and curated catalog.\n   */\n  MCP_ENDPOINT = 'MCP_ENDPOINT',\n  /**\n   * MCP OAuth 2.0 Protected Resource Metadata (RFC 9728): advertises this MCP server's\n   * `resource` identifier + the `authorization_servers` (the app's own OIDC provider) an MCP\n   * client uses to obtain a token. Public, CORS-open metadata (like the OIDC discovery doc).\n   *\n   * Mounted TWICE: at the API root for the DEFAULT server, and appended to each named instance\n   * (`/mcp/:instanceRef` + this route) so every instance advertises its OWN audience. A 401 at either\n   * surface points its `WWW-Authenticate: resource_metadata=` at the matching one — the only discovery\n   * route a client has, since this path is non-standard (it is not the RFC's origin-root form).\n   */\n  MCP_PROTECTED_RESOURCE_METADATA = 'MCP_PROTECTED_RESOURCE_METADATA',\n}\n\nexport const MANUAL_CONTROLLER_ROUTES_URLS: Record<ManualControllerRouteKey, string> = {\n  [ManualControllerRouteKey.APPLICATION_CONFIG_GET]: '/application-config',\n\n  [ManualControllerRouteKey.AUTH_IDENTIFY]: '/auth/identify',\n  [ManualControllerRouteKey.AUTH_AUTHENTICATE_PASSWORD]: '/auth/authenticate/password',\n  [ManualControllerRouteKey.AUTH_AUTHENTICATE]: '/auth/authenticate',\n  [ManualControllerRouteKey.AUTH_TOKEN_REFRESH]: '/auth/token/refresh',\n  [ManualControllerRouteKey.AUTH_OAUTH2_AUTHORIZE]: '/auth/oauth2/authorize/:providerRef',\n  [ManualControllerRouteKey.AUTH_OAUTH2_CALLBACK]: '/auth/oauth2/callback/:providerRef',\n\n  [ManualControllerRouteKey.PROVIDER_CONNECTION_START]: '/connections/:providerRef/start',\n  [ManualControllerRouteKey.PROVIDER_CONNECTION_CALLBACK]: '/connections/callback',\n  [ManualControllerRouteKey.PROVIDER_CONNECTION_COMPLETE]: '/connections/complete',\n  [ManualControllerRouteKey.PROVIDER_CONNECTION_CATALOGUE]: '/connections',\n  [ManualControllerRouteKey.PROVIDER_CONNECTION_STORE_CREDENTIAL]: '/connections/:providerRef/credential',\n  [ManualControllerRouteKey.PROVIDER_CONNECTION_ACCESS_TOKEN]: '/connections/:providerRef/access-token',\n  [ManualControllerRouteKey.PROVIDER_OPERATION_EXECUTE]: '/provider-operations/:providerRef/:operationId',\n  [ManualControllerRouteKey.PROVIDER_OPERATION_INPUT_OPTIONS]: '/provider-operations/:providerRef/:operationId/input-options/:inputField',\n  [ManualControllerRouteKey.AUTH_ENTERPRISE_SSO_AUTHORIZE]: '/auth/enterprise/authorize/:orgId/:connectionId',\n  [ManualControllerRouteKey.AUTH_APP_ENTERPRISE_AUTHORIZE]: '/auth/app-enterprise/authorize/:connectionId',\n  [ManualControllerRouteKey.AUTH_TOKEN_EXCHANGE]: '/auth/token/exchange',\n  // OAuth 2.0 Authorization Server token endpoint (Wildo-as-provider).\n  [ManualControllerRouteKey.OAUTH_PROVIDER_TOKEN]: '/oauth/token',\n  // OIDC discovery + JWKS. Served under the API mount, so with issuer `${publicUrl}${MAIN_API_BASE_PATH}`\n  // a client's `${issuer}/.well-known/openid-configuration` resolves here. That is correct for OIDC\n  // Discovery (issuer + suffix) and NOT for RFC 8414, which places the well-known segment BETWEEN the\n  // host and the issuer path — see {@link rfc8414AuthorizationServerMetadataPath}, which the HTTP\n  // server mounts as a second location for the SAME document. (This used to say a root-level alias was\n  // \"a reverse-proxy concern\"; leaving it to ingress meant every deployment that did not add the rule\n  // silently failed RFC 8414 discovery, so the server now serves it directly.)\n  [ManualControllerRouteKey.OAUTH_PROVIDER_DISCOVERY]: '/.well-known/openid-configuration',\n  [ManualControllerRouteKey.OAUTH_PROVIDER_AS_METADATA]: '/.well-known/oauth-authorization-server',\n  [ManualControllerRouteKey.OAUTH_PROVIDER_JWKS]: '/oauth/jwks',\n  [ManualControllerRouteKey.OAUTH_PROVIDER_AUTHORIZE]: '/oauth/authorize',\n  [ManualControllerRouteKey.OAUTH_PROVIDER_CONSENT]: '/oauth/authorize/decision',\n  [ManualControllerRouteKey.OAUTH_PROVIDER_USERINFO]: '/oauth/userinfo',\n  [ManualControllerRouteKey.OAUTH_PROVIDER_REVOKE]: '/oauth/revoke',\n  [ManualControllerRouteKey.OAUTH_PROVIDER_END_SESSION]: '/oauth/end-session',\n  [ManualControllerRouteKey.OAUTH_PROVIDER_END_SESSION_CONFIRM]: '/oauth/end-session/confirm',\n  [ManualControllerRouteKey.OAUTH_PROVIDER_REGISTER]: '/oauth/register',\n  [ManualControllerRouteKey.OAUTH_PROVIDER_REGISTER_CLIENT]: '/oauth/register/:clientId',\n  [ManualControllerRouteKey.AUTH_CROSS_FRONTEND_HANDOFF]: '/auth/cross-frontend-handoff',\n  [ManualControllerRouteKey.AUTH_LOGOUT]: '/auth/logout',\n  [ManualControllerRouteKey.AUTH_LOGOUT_ALL]: '/auth/logout-all',\n  [ManualControllerRouteKey.AUTH_PASSWORD_RESET_REQUEST]: '/auth/password-reset/request',\n  [ManualControllerRouteKey.AUTH_PASSWORD_RESET_COMPLETE]: '/auth/password-reset/complete',\n  [ManualControllerRouteKey.AUTH_REGISTER]: '/auth/register',\n  [ManualControllerRouteKey.AUTH_ACCEPT_INVITATION]: '/auth/invitation/accept',\n  [ManualControllerRouteKey.AUTH_INVITATION_INFO]: '/auth/invitation/info',\n  [ManualControllerRouteKey.AUTH_REJECT_INVITATION]: '/auth/invitation/reject',\n  [ManualControllerRouteKey.AUTH_LIST_MY_INVITATIONS]: '/auth/invitations/mine',\n  [ManualControllerRouteKey.AUTH_ACCEPT_MY_INVITATION]: '/auth/invitations/accept',\n  [ManualControllerRouteKey.AUTH_REJECT_MY_INVITATION]: '/auth/invitations/reject',\n  [ManualControllerRouteKey.AUTH_VERIFY_EMAIL]: '/auth/verify-email',\n  [ManualControllerRouteKey.AUTH_SESSION_STATE]: '/auth/session/:sessionId',\n\n  // Magic Link (Phase G2)\n  [ManualControllerRouteKey.AUTH_MAGIC_LINK_SEND]: '/auth/magic-link/send',\n  [ManualControllerRouteKey.AUTH_MAGIC_LINK_VERIFY]: '/auth/magic-link/verify',\n\n  // SMS OTP (Phase G2)\n  [ManualControllerRouteKey.AUTH_SMS_OTP_SEND]: '/auth/sms-otp/send',\n  [ManualControllerRouteKey.AUTH_SMS_OTP_VERIFY]: '/auth/sms-otp/verify',\n\n  // Phone Verification (Phase G2)\n  [ManualControllerRouteKey.AUTH_PHONE_VERIFY_SEND]: '/auth/phone/verify/send',\n  [ManualControllerRouteKey.AUTH_PHONE_VERIFY_CONFIRM]: '/auth/phone/verify/confirm',\n\n  // Resend Verification Email (F5)\n  [ManualControllerRouteKey.AUTH_RESEND_VERIFICATION]: '/auth/resend-verification',\n\n  // W5.7: Complete org onboarding\n  [ManualControllerRouteKey.AUTH_COMPLETE_ORG_ONBOARDING]: '/auth/onboarding/complete-org',\n  [ManualControllerRouteKey.AUTH_COMPLETE_PROFILE_ONBOARDING]: '/auth/onboarding/complete-profile',\n\n  // W7.3b: One-off session token management\n  [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_CREATE]: '/apps/:applicationId/auth/one-off-session',\n  [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_CREATE_ORG]: '/orgs/:organizationId/apps/:applicationId/auth/one-off-session',\n  [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_EXCHANGE]: '/auth/one-off-session/exchange',\n  [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_REVOKE]: '/apps/:applicationId/auth/one-off-session/:tokenId/revoke',\n  [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_REVOKE_ORG]: '/orgs/:organizationId/apps/:applicationId/auth/one-off-session/:tokenId/revoke',\n\n  // Method Management (#13f)\n  [ManualControllerRouteKey.AUTH_PASSWORD_CHANGE]: '/auth/password/change',\n  [ManualControllerRouteKey.AUTH_PASSWORD_SET]: '/auth/password/set',\n  [ManualControllerRouteKey.AUTH_MFA_TOTP_DISABLE]: '/auth/mfa/totp/disable',\n  [ManualControllerRouteKey.AUTH_METHODS_MINE]: '/auth/methods/mine',\n  [ManualControllerRouteKey.AUTH_IDENTITY_LINKS_LIST]: '/auth/identity-links',\n  [ManualControllerRouteKey.AUTH_IDENTITY_LINKS_UNLINK]: '/auth/identity-links/:linkId',\n  [ManualControllerRouteKey.GOVERNED_DOCUMENT_ACCEPTANCES_OWED]: '/governed-documents/acceptances/owed',\n  [ManualControllerRouteKey.GOVERNED_DOCUMENT_ACCEPTANCES_ACCEPT]: '/governed-documents/acceptances',\n  [ManualControllerRouteKey.GOVERNED_DOCUMENT_NOTICE_DELIVERED]: '/governed-documents/notice-delivered',\n  [ManualControllerRouteKey.AUTH_REAUTH]: '/auth/reauth',\n  [ManualControllerRouteKey.AUTH_REAUTH_PASSKEY_OPTIONS]: '/auth/reauth/passkey/options',\n  [ManualControllerRouteKey.AUTH_REAUTH_METHODS]: '/auth/reauth/methods',\n  [ManualControllerRouteKey.AUTH_REAUTH_FEDERATED_AUTHORIZE]: '/auth/reauth/federated/authorize',\n  [ManualControllerRouteKey.AUTH_REAUTH_FEDERATED_EXCHANGE]: '/auth/reauth/federated/exchange',\n\n  // SAML Routes (AUTH-2)\n  [ManualControllerRouteKey.AUTH_SAML_LOGIN]: '/auth/saml/login/:connectionId',\n  [ManualControllerRouteKey.AUTH_SAML_ACS]: '/auth/saml/acs',\n  [ManualControllerRouteKey.AUTH_SAML_METADATA]: '/auth/saml/metadata/:scopeType/:scopeId',\n  [ManualControllerRouteKey.AUTH_SAML_SLO]: '/auth/saml/slo',\n  [ManualControllerRouteKey.AUTH_SAML_SP_LOGOUT]: '/auth/saml/logout',\n  [ManualControllerRouteKey.AUTH_OIDC_LOGOUT]: '/auth/oidc/logout',\n\n  // Direct file transfer. `upload-grants` MUST stay ahead of the `:fileId` family at the mount site,\n  // or Express reads `upload-grants` as a file id — the controller registers them in that order.\n  [ManualControllerRouteKey.FILES_UPLOAD_GRANT_STATUS]: '/files/upload-grants/:token',\n  [ManualControllerRouteKey.FILES_UPLOAD_GRANT_REVOKE]: '/files/upload-grants/:grantId',\n  [ManualControllerRouteKey.FILES_ITEM]: '/files/:fileId',\n  [ManualControllerRouteKey.FILES_METADATA]: '/files/:fileId/metadata',\n  [ManualControllerRouteKey.FILES_SHARE]: '/files/:fileId/share',\n  [ManualControllerRouteKey.FILES_SHARES_REVOKE]: '/files/:fileId/shares',\n\n  [ManualControllerRouteKey.I18N_GET_LABELS]: '/i18n/labels',\n\n  [ManualControllerRouteKey.CHARTS_DATA]: '/charts/:chartRef/data',\n  [ManualControllerRouteKey.SUBJECT_ERASURE_LANE_EVIDENCE]: '/assurance/subject-erasure-lane-evidence',\n  [ManualControllerRouteKey.PROVIDER_CALL_EVIDENCE]: '/assurance/provider-call-evidence',\n  [ManualControllerRouteKey.USAGE_FLUSH_EVIDENCE]: '/assurance/usage-flush-evidence',\n  [ManualControllerRouteKey.SCHEDULED_EVIDENCE_COVERAGE]: '/assurance/scheduled-evidence-coverage',\n\n  // MFA — Email OTP (Step 10)\n  [ManualControllerRouteKey.AUTH_MFA_EMAIL_OTP_SEND]: '/auth/mfa/email-otp/send',\n  [ManualControllerRouteKey.AUTH_MFA_EMAIL_OTP_VERIFY]: '/auth/mfa/email-otp/verify',\n\n  // MFA — TOTP (Step 11)\n  [ManualControllerRouteKey.AUTH_MFA_TOTP_SETUP]: '/auth/mfa/totp/setup',\n  [ManualControllerRouteKey.AUTH_MFA_TOTP_VERIFY_SETUP]: '/auth/mfa/totp/verify-setup',\n  [ManualControllerRouteKey.AUTH_MFA_TOTP_VERIFY]: '/auth/mfa/totp/verify',\n\n  // WebAuthn/Passkey Routes (Phase G1)\n  [ManualControllerRouteKey.AUTH_PASSKEY_REGISTER_OPTIONS]: '/auth/passkey/register/options',\n  [ManualControllerRouteKey.AUTH_PASSKEY_REGISTER_VERIFY]: '/auth/passkey/register/verify',\n  [ManualControllerRouteKey.AUTH_PASSKEY_AUTH_OPTIONS]: '/auth/passkey/authenticate/options',\n  [ManualControllerRouteKey.AUTH_PASSKEY_AUTH_VERIFY]: '/auth/passkey/authenticate/verify',\n  [ManualControllerRouteKey.AUTH_PASSKEY_LIST]: '/auth/passkey/list',\n  [ManualControllerRouteKey.AUTH_PASSKEY_REMOVE]: '/auth/passkey/remove',\n  [ManualControllerRouteKey.AUTH_PASSKEY_RENAME]: '/auth/passkey/rename',\n\n  [ManualControllerRouteKey.ANALYTICS_EVENTS]: '/analytics/events',\n  [ManualControllerRouteKey.ANALYTICS_MOMENTS_ACHIEVED]: '/analytics/moments/achieved',\n\n  [ManualControllerRouteKey.PROGRESSION_MILESTONES]: '/progression/milestones',\n  [ManualControllerRouteKey.FEATURES_RESOLVED]: '/features/resolved',\n\n  [ManualControllerRouteKey.FLOWS_ACTORS_FRONTEND_INFO]: '/flows-actors/frontend-info',\n  [ManualControllerRouteKey.FLOWS_ACTORS_HISTORY]: '/flows-actors/history',\n\n  // === A2A (external actor exposure) ===\n  // Card served under the API mount, so with issuer `${publicUrl}${MAIN_API_BASE_PATH}`\n  // a caller's `${issuer}/a2a/.well-known/agent-card.json` resolves here (a root-level\n  // `/.well-known/agent-card.json` alias is a reverse-proxy concern).\n  [ManualControllerRouteKey.A2A_AGENT_CARD]: '/a2a/.well-known/agent-card.json',\n  [ManualControllerRouteKey.A2A_TASKS]: '/a2a',\n\n  // === MCP (Model Context Protocol server) ===\n  // JSON-RPC endpoint + RFC 9728 protected-resource metadata, served under the API mount. The\n  // metadata's `resource` is `${publicUrl}${MAIN_API_BASE_PATH}/mcp`; a root-level\n  // `/.well-known/oauth-protected-resource` alias is a reverse-proxy concern.\n  [ManualControllerRouteKey.MCP_ENDPOINT]: '/mcp',\n  [ManualControllerRouteKey.MCP_PROTECTED_RESOURCE_METADATA]: '/.well-known/oauth-protected-resource',\n};\n\n// =====================================================\n// Root-level engine routes (NOT under /api/v1)\n// These are mounted at the Express app root (e.g. /health/*)\n// =====================================================\n\nexport enum EngineRootRouteKey {\n  HEALTH_LIVENESS = 'HEALTH_LIVENESS',\n  HEALTH_READINESS = 'HEALTH_READINESS',\n  HEALTH_TIME = 'HEALTH_TIME',\n}\n\nexport const ENGINE_ROOT_ROUTES: Record<EngineRootRouteKey, string> = {\n  [EngineRootRouteKey.HEALTH_LIVENESS]: '/health',\n  [EngineRootRouteKey.HEALTH_READINESS]: '/health/ready',\n  [EngineRootRouteKey.HEALTH_TIME]: '/health/time',\n};\n"]}

package/dist/esm/requests/websocket.shared.schemas.d.ts

@@ -3,7 +3,8 @@ import { DataMode } from '../resources/resources-config.shared.schemas';
 import { ValueMomentRole, ValueMomentScope } from '../config/analytics-value-moments.shared.schemas';
 import { OnboardingStatus } from '../config/frontend/onboarding.shared.schemas';
 import { GuidanceFlowScope, GuidanceRenderMode } from '../guidance/guidance-flow.shared.schemas';
-import { ProgressionScope, MilestoneRewardType } from '../guidance/milestone-definition.shared.schemas';
+import { CelebrationDisplayMode } from '../notifications/notifications.shared.schemas';
+import { MilestoneCelebrationLevel, ProgressionScope, MilestoneRewardType } from '../guidance/milestone-definition.shared.schemas';
 import { LifecycleStage, LifecycleScope } from '../guidance/lifecycle-state.shared.schemas';
 import { ResourceOperationVariantType } from '../resources/resources.shared.schemas';
 import { ResourcePrimaryScope } from '../resources/resources.shared.schemas';
@@ -31,6 +32,15 @@ export declare enum CoreWebSocketEvent {
     RESOURCE_UNLOCKED = "resource:unlocked",
     RESOURCE_CUSTOM = "resource:custom",
     RESOURCE_CUSTOM_ERROR = "resource:custom:error",
+    /**
+     * How far a BACKGROUND BULK run has got, sent to the person who started it (server → client).
+     *
+     * Addressed to the USER rather than to a resource room: the run spans many rows, so no row's room
+     * is the right place, and the job's own row is an internal record most people cannot read. The
+     * rows themselves still broadcast their ordinary sync events as they change, so the listing
+     * updates itself; this event is what lets the surface say how much is left (#1461).
+     */
+    BULK_JOB_PROGRESS = "bulk-job:progress",
     FLOWS_ACTORS_START = "flows-actors:start",
     FLOWS_ACTORS_STARTED = "flows-actors:started",
     FLOWS_ACTORS_MESSAGE = "flows-actors:message",
@@ -141,6 +151,10 @@ export declare const WS_ResourceNotificationPayloadSchema: z.ZodObject<{
     isBulkOperation: z.ZodDefault<z.ZodBoolean>;
     variantKey: z.ZodOptional<z.ZodString>;
     contextResourceIdentifiers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    deliveryPolicy: z.ZodObject<{
+        target: z.ZodUnion<readonly [z.ZodEnum<typeof import("..").CoreUserNotificationTarget>, z.ZodString]>;
+        alwaysDeliver: z.ZodBoolean;
+    }, z.core.$strip>;
     action: z.ZodUnion<readonly [z.ZodEnum<typeof ResourceAction>, z.ZodString]>;
     notificationLevel: z.ZodOptional<z.ZodEnum<typeof NotificationLevel>>;
     affectedIds: z.ZodArray<z.ZodString>;
@@ -149,7 +163,7 @@ export declare const WS_ResourceNotificationPayloadSchema: z.ZodObject<{
     timestamp: z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodDate, z.ZodString]>, z.ZodCoercedDate<string | Date>>>;
     frontendDisplayHints: z.ZodOptional<z.ZodObject<{
         celebration: z.ZodOptional<z.ZodObject<{
-            mode: z.ZodDefault<z.ZodEnum<typeof import("..").CelebrationDisplayMode>>;
+            mode: z.ZodDefault<z.ZodEnum<typeof CelebrationDisplayMode>>;
         }, z.core.$strip>>;
         nextStep: z.ZodOptional<z.ZodObject<{
             operationRef: z.ZodString;
@@ -230,15 +244,12 @@ export declare const WS_MilestoneAchievedPayloadSchema: z.ZodObject<{
         type: z.ZodEnum<typeof MilestoneRewardType>;
         featureRef: z.ZodOptional<z.ZodString>;
         guidanceFlowRef: z.ZodOptional<z.ZodString>;
-        celebrationLevel: z.ZodOptional<z.ZodEnum<{
-            low: "low";
-            medium: "medium";
-            high: "high";
-        }>>;
+        celebrationLevel: z.ZodOptional<z.ZodEnum<typeof MilestoneCelebrationLevel>>;
+        celebrationMode: z.ZodOptional<z.ZodEnum<typeof CelebrationDisplayMode>>;
     }, z.core.$strip>;
     lifecycleTransition: z.ZodOptional<z.ZodObject<{
-        from: z.ZodString;
-        to: z.ZodString;
+        from: z.ZodEnum<typeof LifecycleStage>;
+        to: z.ZodEnum<typeof LifecycleStage>;
     }, z.core.$strip>>;
     achievedAt: z.ZodPipe<z.ZodUnion<readonly [z.ZodDate, z.ZodString]>, z.ZodCoercedDate<string | Date>>;
     totalPoints: z.ZodNumber;
@@ -527,8 +538,8 @@ export declare const WS_ResourceEditingPayloadSchema: z.ZodObject<{
     initiatorUserId: z.ZodOptional<z.ZodString>;
     timestamp: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodDate, z.ZodString]>, z.ZodCoercedDate<string | Date>>>;
     reason: z.ZodOptional<z.ZodEnum<{
-        timeout: "timeout";
         manual: "manual";
+        timeout: "timeout";
         disconnect: "disconnect";
         auth_refresh: "auth_refresh";
         organization_switch: "organization_switch";
@@ -561,6 +572,42 @@ export declare const WS_ResourceCustomEventPayloadSchema: z.ZodObject<{
     dataMode: z.ZodOptional<z.ZodEnum<typeof DataMode>>;
 }, z.core.$strip>;
 export type WS_ResourceCustomEventPayload = z.infer<typeof WS_ResourceCustomEventPayloadSchema>;
+/**
+ * How far a background bulk run has got.
+ *
+ * `attemptedCount` is what the run was GIVEN, and it never changes during the run — it is the
+ * denominator a progress bar needs. `processedCount` counts rows the run has finished with, whether
+ * they succeeded or were refused, so `processed / attempted` is honest progress rather than a
+ * success rate; `failedCount` is how many of those were refusals.
+ *
+ * `finished` is explicit rather than inferred from `processedCount === attemptedCount`: a run that
+ * ends early — a worker lost, a job that failed outright — would otherwise leave a bar sitting at
+ * 94% forever with nothing to say it had stopped.
+ */
+export declare const WS_BulkJobProgressPayloadSchema: z.ZodObject<{
+    jobId: z.ZodString;
+    resourceType: z.ZodString;
+    operationIdentifier: z.ZodString;
+    attemptedCount: z.ZodNumber;
+    processedCount: z.ZodNumber;
+    failedCount: z.ZodNumber;
+    finished: z.ZodBoolean;
+    failures: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        resourceId: z.ZodString;
+        customMessageReference: z.ZodOptional<z.ZodString>;
+        errorType: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+    timestamp: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodDate, z.ZodString]>, z.ZodCoercedDate<string | Date>>>;
+}, z.core.$strip>;
+/**
+ * How many individual refusals a finished bulk run reports over the wire.
+ *
+ * 50 is what a person can actually read in a panel before it stops being a summary; the exact count
+ * is always `failedCount`, and the complete list is in the job result. A larger number would make
+ * the message bigger without making it more useful.
+ */
+export declare const BULK_JOB_REPORTED_FAILURE_LIMIT: 50;
+export type WS_BulkJobProgressPayload = z.infer<typeof WS_BulkJobProgressPayloadSchema>;
 /** Error response for custom events */
 export declare const WS_ResourceCustomErrorPayloadSchema: z.ZodObject<{
     eventName: z.ZodString;
@@ -637,11 +684,32 @@ export declare const WS_FlowsActorsApprovalAnnouncementDataSchema: z.ZodObject<{
     approvalId: z.ZodString;
     toolName: z.ZodString;
     toolArgs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    toolInputSchema: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     requestedAt: z.ZodString;
     expiresAt: z.ZodOptional<z.ZodString>;
     resourceServerInstanceRef: z.ZodString;
 }, z.core.$strip>;
 export type WS_FlowsActorsApprovalAnnouncementData = z.infer<typeof WS_FlowsActorsApprovalAnnouncementDataSchema>;
+/**
+ * A TOOL-STATUS announcement, carried in the `data` bag of a `FLOWS_ACTORS_MESSAGE` of type
+ * `PROGRESS` — one per tool CALL while an assistant turn is working.
+ *
+ * It carries FACTS, never words. The server used to send `content: "Looking up your todos…"`,
+ * composed from the tool name by a humanizer: English produced by code, untranslatable, and wrong
+ * for any resource whose identifier is not also its name (#1283,
+ * `.claude/rules/display-text-comes-from-i18n.md`). The person's words are now resolved in the
+ * browser from the label tree — the component's status labels, and the resource's own authored
+ * title — and `content` carries the tool name verbatim, a value rather than a sentence.
+ *
+ * Producer: `ConversationalExecutionBackendService` (`onToolEvent`). Consumer: the flows-actors
+ * view's status line. The A2A plane ignores tool-status frames (they carry no `messageId`).
+ */
+export declare const WS_FlowsActorsToolStatusDataSchema: z.ZodObject<{
+    toolStatus: z.ZodLiteral<true>;
+    tool: z.ZodString;
+    readsResourceType: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type WS_FlowsActorsToolStatusData = z.infer<typeof WS_FlowsActorsToolStatusDataSchema>;
 /** Human approval request (server → client) */
 export declare const WS_FlowsActorsApprovalRequestPayloadSchema: z.ZodObject<{
     systemRef: z.ZodString;
@@ -666,6 +734,7 @@ export declare const WS_FlowsActorsApprovalResponsePayloadSchema: z.ZodObject<{
     approved: z.ZodBoolean;
     comment: z.ZodOptional<z.ZodString>;
     resourceServerInstanceRef: z.ZodOptional<z.ZodString>;
+    modifiedToolArgs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, z.core.$strip>;
 export type WS_FlowsActorsApprovalResponsePayload = z.infer<typeof WS_FlowsActorsApprovalResponsePayloadSchema>;
 /** Status update during execution (server → client) */
@@ -688,12 +757,99 @@ export declare const WS_FlowsActorsCompletedPayloadSchema: z.ZodObject<{
 }, z.core.$strip>;
 export type WS_FlowsActorsCompletedPayload = z.infer<typeof WS_FlowsActorsCompletedPayloadSchema>;
 /** Execution error (server → client) */
+/**
+ * Why a flows-actors request reported an error on `FLOWS_ACTORS_ERROR` — from the socket boundary
+ * (an unauthenticated or malformed request) or from the conversational turn itself.
+ *
+ * One named vocabulary, so a client that must BRANCH on a code — the approval surface keeps a refused
+ * modification on screen rather than dropping it (#587) — compares against a member instead of a
+ * string it copied from the producer.
+ */
+export declare enum FlowsActors_ExecutionErrorCode {
+    /** The socket carries no authenticated user, so a conversation cannot be started. */
+    UNAUTHENTICATED = "UNAUTHENTICATED",
+    /** The inbound flows-actors payload failed validation. */
+    INVALID_PAYLOAD = "INVALID_PAYLOAD",
+    /** The conversation has no resolvable owner scope. */
+    NO_OWNER = "NO_OWNER",
+    /** The system has no agentic actor bound to an agent to converse with. */
+    NO_CHAT_ACTOR = "NO_CHAT_ACTOR",
+    /** No user message was provided to start the conversation. */
+    EMPTY_INPUT = "EMPTY_INPUT",
+    /** The execution record could not be opened. */
+    PERSIST_FAILED = "PERSIST_FAILED",
+    /** The assistant failed to produce a response. */
+    AGENT_FAILED = "AGENT_FAILED",
+    /**
+     * The approver's edited tool arguments were refused. RECOVERABLE: the approval is still pending and
+     * can be answered again, so a surface must keep it — this is the one code a client branches on.
+     */
+    APPROVAL_MODIFICATION_REJECTED = "APPROVAL_MODIFICATION_REJECTED",
+    /** The system is a FLOW system, and conversational execution of flows is not implemented. */
+    FLOW_CONVERSATION_NOT_IMPLEMENTED = "FLOW_CONVERSATION_NOT_IMPLEMENTED",
+    /** No actor system is registered under the requested ref. */
+    SYSTEM_NOT_FOUND = "SYSTEM_NOT_FOUND",
+    /**
+     * The application requires consent purposes the person has not granted
+     * (`compliance.serviceConsentRequirement.requiredPurposes`), so no turn is started. Terminal for this turn,
+     * and cured by the person recording their consent in their own preferences — the same refusal every other
+     * user-initiated surface answers (#534).
+     */
+    SERVICE_CONSENT_REQUIRED = "SERVICE_CONSENT_REQUIRED",
+    /**
+     * CLIENT-DETECTED — no server emits it. The socket that started this turn dropped before the turn
+     * ended. A turn's events are emitted to the socket that started it, so after a drop none of them can
+     * arrive, whether the server went away (a restart) or only the connection did; without this the turn
+     * stays `STARTING` / `RUNNING` forever and the composer never comes back (#1464, 2026-09-24).
+     * RECOVERABLE: when the server survived, the turn still completes and is persisted, and the thread's
+     * own history carries the reply.
+     */
+    CONNECTION_LOST = "CONNECTION_LOST"
+}
+/**
+ * Why the server refused an approver's EDIT to a tool call's arguments (#1186).
+ *
+ * The refusal used to travel as English prose in `errorMessage`, which the approval card printed after a
+ * localized prefix — untranslatable, and the one place on the card a person read a server sentence. Each
+ * member is a different diagnosis with a different remedy, so the card renders a label per member; the
+ * prose stays in `errorMessage` for logs.
+ */
+export declare enum FlowsActors_ApprovalModificationRefusalReason {
+    /** The agent that raised the approval is no longer registered, so nothing can check the arguments. */
+    AGENT_NOT_REGISTERED = "agent_not_registered",
+    /** The agent no longer declares the tool the approval names. */
+    TOOL_NOT_DECLARED = "tool_not_declared",
+    /** The tool no longer requires approval, so the pending decision is stale. */
+    TOOL_NO_LONGER_GATED = "tool_no_longer_gated",
+    /** The edited arguments fail the tool's own input schema; `argumentPaths` names the offending ones. */
+    ARGUMENTS_INVALID = "arguments_invalid",
+    /** The approval-signing key is not configured, so a modified call cannot be re-bound. */
+    SIGNING_KEY_NOT_CONFIGURED = "signing_key_not_configured",
+    /** The paused turn's resume payload does not contain the call the approval names. */
+    CALL_NOT_REWRITABLE = "call_not_rewritable"
+}
+/**
+ * The structured half of an `APPROVAL_MODIFICATION_REJECTED` error: what the card needs to say, in labels.
+ * `reason` is a {@link FlowsActors_ApprovalModificationRefusalReason} member, kept a STRING on the wire for
+ * the same reason `errorCode` is — a client older than a new reason must still parse the payload.
+ */
+export declare const WS_FlowsActorsApprovalModificationRefusalSchema: z.ZodObject<{
+    reason: z.ZodString;
+    toolName: z.ZodOptional<z.ZodString>;
+    argumentPaths: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export type WS_FlowsActorsApprovalModificationRefusal = z.infer<typeof WS_FlowsActorsApprovalModificationRefusalSchema>;
 export declare const WS_FlowsActorsErrorPayloadSchema: z.ZodObject<{
     systemRef: z.ZodString;
     executionId: z.ZodString;
     errorCode: z.ZodString;
     errorMessage: z.ZodString;
     recoverable: z.ZodDefault<z.ZodBoolean>;
+    approvalModificationRefusal: z.ZodOptional<z.ZodObject<{
+        reason: z.ZodString;
+        toolName: z.ZodOptional<z.ZodString>;
+        argumentPaths: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 export type WS_FlowsActorsErrorPayload = z.infer<typeof WS_FlowsActorsErrorPayloadSchema>;
 export declare const WS_AuthRefreshPayloadSchema: z.ZodObject<{
@@ -769,6 +925,10 @@ export declare const WebSocketEventSchemas: {
         isBulkOperation: z.ZodDefault<z.ZodBoolean>;
         variantKey: z.ZodOptional<z.ZodString>;
         contextResourceIdentifiers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        deliveryPolicy: z.ZodObject<{
+            target: z.ZodUnion<readonly [z.ZodEnum<typeof import("..").CoreUserNotificationTarget>, z.ZodString]>;
+            alwaysDeliver: z.ZodBoolean;
+        }, z.core.$strip>;
         action: z.ZodUnion<readonly [z.ZodEnum<typeof ResourceAction>, z.ZodString]>;
         notificationLevel: z.ZodOptional<z.ZodEnum<typeof NotificationLevel>>;
         affectedIds: z.ZodArray<z.ZodString>;
@@ -777,7 +937,7 @@ export declare const WebSocketEventSchemas: {
         timestamp: z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodDate, z.ZodString]>, z.ZodCoercedDate<string | Date>>>;
         frontendDisplayHints: z.ZodOptional<z.ZodObject<{
             celebration: z.ZodOptional<z.ZodObject<{
-                mode: z.ZodDefault<z.ZodEnum<typeof import("..").CelebrationDisplayMode>>;
+                mode: z.ZodDefault<z.ZodEnum<typeof CelebrationDisplayMode>>;
             }, z.core.$strip>>;
             nextStep: z.ZodOptional<z.ZodObject<{
                 operationRef: z.ZodString;
@@ -902,8 +1062,8 @@ export declare const WebSocketEventSchemas: {
         initiatorUserId: z.ZodOptional<z.ZodString>;
         timestamp: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodDate, z.ZodString]>, z.ZodCoercedDate<string | Date>>>;
         reason: z.ZodOptional<z.ZodEnum<{
-            timeout: "timeout";
             manual: "manual";
+            timeout: "timeout";
             disconnect: "disconnect";
             auth_refresh: "auth_refresh";
             organization_switch: "organization_switch";
@@ -916,8 +1076,8 @@ export declare const WebSocketEventSchemas: {
         initiatorUserId: z.ZodOptional<z.ZodString>;
         timestamp: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodDate, z.ZodString]>, z.ZodCoercedDate<string | Date>>>;
         reason: z.ZodOptional<z.ZodEnum<{
-            timeout: "timeout";
             manual: "manual";
+            timeout: "timeout";
             disconnect: "disconnect";
             auth_refresh: "auth_refresh";
             organization_switch: "organization_switch";
@@ -969,6 +1129,21 @@ export declare const WebSocketEventSchemas: {
         resourceData: z.ZodOptional<z.ZodUnknown>;
         dataMode: z.ZodOptional<z.ZodEnum<typeof DataMode>>;
     }, z.core.$strip>;
+    readonly "bulk-job:progress": z.ZodObject<{
+        jobId: z.ZodString;
+        resourceType: z.ZodString;
+        operationIdentifier: z.ZodString;
+        attemptedCount: z.ZodNumber;
+        processedCount: z.ZodNumber;
+        failedCount: z.ZodNumber;
+        finished: z.ZodBoolean;
+        failures: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            resourceId: z.ZodString;
+            customMessageReference: z.ZodOptional<z.ZodString>;
+            errorType: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>>;
+        timestamp: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodDate, z.ZodString]>, z.ZodCoercedDate<string | Date>>>;
+    }, z.core.$strip>;
     readonly "resource:custom:error": z.ZodObject<{
         eventName: z.ZodString;
         error: z.ZodString;
@@ -1021,6 +1196,7 @@ export declare const WebSocketEventSchemas: {
         approved: z.ZodBoolean;
         comment: z.ZodOptional<z.ZodString>;
         resourceServerInstanceRef: z.ZodOptional<z.ZodString>;
+        modifiedToolArgs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     }, z.core.$strip>;
     readonly "flows-actors:status-update": z.ZodObject<{
         systemRef: z.ZodString;
@@ -1043,6 +1219,11 @@ export declare const WebSocketEventSchemas: {
         errorCode: z.ZodString;
         errorMessage: z.ZodString;
         recoverable: z.ZodDefault<z.ZodBoolean>;
+        approvalModificationRefusal: z.ZodOptional<z.ZodObject<{
+            reason: z.ZodString;
+            toolName: z.ZodOptional<z.ZodString>;
+            argumentPaths: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
     }, z.core.$strip>;
     readonly "billing:status_changed": z.ZodObject<{
         scopeType: z.ZodEnum<typeof ResourcePrimaryScope>;
@@ -1105,15 +1286,12 @@ export declare const WebSocketEventSchemas: {
             type: z.ZodEnum<typeof MilestoneRewardType>;
             featureRef: z.ZodOptional<z.ZodString>;
             guidanceFlowRef: z.ZodOptional<z.ZodString>;
-            celebrationLevel: z.ZodOptional<z.ZodEnum<{
-                low: "low";
-                medium: "medium";
-                high: "high";
-            }>>;
+            celebrationLevel: z.ZodOptional<z.ZodEnum<typeof MilestoneCelebrationLevel>>;
+            celebrationMode: z.ZodOptional<z.ZodEnum<typeof CelebrationDisplayMode>>;
         }, z.core.$strip>;
         lifecycleTransition: z.ZodOptional<z.ZodObject<{
-            from: z.ZodString;
-            to: z.ZodString;
+            from: z.ZodEnum<typeof LifecycleStage>;
+            to: z.ZodEnum<typeof LifecycleStage>;
         }, z.core.$strip>>;
         achievedAt: z.ZodPipe<z.ZodUnion<readonly [z.ZodDate, z.ZodString]>, z.ZodCoercedDate<string | Date>>;
         totalPoints: z.ZodNumber;