@wildo-ai/saas-models 1.1.4 → 1.1.6

package/dist/esm/requests/manual-controllers-routes-urls.d.ts

@@ -8,29 +8,6 @@
  * - Keep only path segments here (no `MAIN_API_BASE_PATH` prefix) — the
  *   prefix is prepended once at each boundary (backend mount / frontend client)
  */
-/**
- * Main API base path — the mount prefix under which the entire main
- * controllers registry is served (every resource route AND every
- * {@link MANUAL_CONTROLLER_ROUTES_URLS} entry).
- *
- * This is the SINGLE SOURCE OF TRUTH for the prefix. It is consumed by:
- *  - the backend HTTP server mount (`app.use(MAIN_API_BASE_PATH, mainRouter)`),
- *  - the frontend HTTP client when building absolute API URLs
- *    (`${MAIN_API_BASE_PATH}${MANUAL_CONTROLLER_ROUTES_URLS[...]}`),
- *  - the refresh-token cookie `Path` scope, which MUST path-match the served
- *    auth routes (`${MAIN_API_BASE_PATH}/auth/*`) or the browser drops it.
- *
- * Why a shared symbol and not a literal: previously `/api/v1` was a literal
- * duplicated across the mount and the client. The absence of a shared symbol
- * let the refresh-token cookie `Path` be authored against the bare route
- * segment (`/auth`, omitting this prefix), so the browser stored the cookie
- * but never sent it to `/api/v1/auth/token/refresh` — silently breaking token
- * refresh for every session (forced logout on first refresh). Deriving every
- * prefix consumer from this constant closes that drift class.
- *
- * NOT under this prefix: the root-level engine routes in
- * {@link ENGINE_ROOT_ROUTES} (health/time probes), mounted at the app root.
- */
 export declare const MAIN_API_BASE_PATH = "/api/v1";
 /**
  * Where RFC 8414 authorization-server metadata must be served for an issuer that carries a PATH.
@@ -166,6 +143,37 @@ export declare enum ManualControllerRouteKey {
      * something for a token that has left the process.
      */
     PROVIDER_CONNECTION_ACCESS_TOKEN = "PROVIDER_CONNECTION_ACCESS_TOKEN",
+    /**
+     * The CONNECTIONS one owner holds — one entry per connection, never one per ref (#1727).
+     *
+     * A vendor served by several refs (an engine part and the add-on packages beside it, declared in
+     * `providers.sharedConnections`) holds ONE stored grant keyed on its base ref (#1670, #1725), so a screen
+     * listing stored credential ROWS by ref showed a person one Microsoft account per ref while they had
+     * authorized once. This answers the unit a person actually granted: the connection, the refs it serves,
+     * the scopes its consent has ACCUMULATED (#1671, read from the sealed grant — never a token), its health,
+     * and the credential rows a disconnect deletes. The credential resource LIST cannot say the scopes: they
+     * live inside the sealed value.
+     *
+     * Disconnecting is NOT a second door: it is the credential resource's own DELETE of the rows named here,
+     * which already authorizes, asks for step-up, records who revoked, and tells the vendor (#545).
+     */
+    PROVIDER_CONNECTION_LIST = "PROVIDER_CONNECTION_LIST",
+    /**
+     * A signed-in person's browser triggers ONE declared provider operation, executed on the backend (#367).
+     *
+     * The credential stays on the server: the browser names the provider, the operation and whose account
+     * to spend, and receives the operation's parsed output. Reachable only for operations the application
+     * declared in `providers.browserOperations` — everything else is refused, and every refusal is audited.
+     */
+    PROVIDER_OPERATION_EXECUTE = "PROVIDER_OPERATION_EXECUTE",
+    /**
+     * The CHOICES for one input of a declared provider operation (#333) — a workspace, a project — listed by
+     * running the input's declared options operation through the same connection.
+     *
+     * Admitted only when BOTH the operation and its options operation are declared browser-reachable for
+     * the named connection; a refusal is audited exactly as the execute door's is.
+     */
+    PROVIDER_OPERATION_INPUT_OPTIONS = "PROVIDER_OPERATION_INPUT_OPTIONS",
     /** Enterprise SSO: initiate OAuth2 flow for an org's OIDC connection (Step 15) */
     AUTH_ENTERPRISE_SSO_AUTHORIZE = "AUTH_ENTERPRISE_SSO_AUTHORIZE",
     AUTH_APP_ENTERPRISE_AUTHORIZE = "AUTH_APP_ENTERPRISE_AUTHORIZE",
@@ -278,6 +286,7 @@ export declare enum ManualControllerRouteKey {
     AUTH_PHONE_VERIFY_CONFIRM = "AUTH_PHONE_VERIFY_CONFIRM",
     AUTH_RESEND_VERIFICATION = "AUTH_RESEND_VERIFICATION",
     AUTH_COMPLETE_ORG_ONBOARDING = "AUTH_COMPLETE_ORG_ONBOARDING",
+    AUTH_COMPLETE_PROFILE_ONBOARDING = "AUTH_COMPLETE_PROFILE_ONBOARDING",
     AUTH_ONE_OFF_SESSION_CREATE = "AUTH_ONE_OFF_SESSION_CREATE",
     AUTH_ONE_OFF_SESSION_CREATE_ORG = "AUTH_ONE_OFF_SESSION_CREATE_ORG",
     AUTH_ONE_OFF_SESSION_EXCHANGE = "AUTH_ONE_OFF_SESSION_EXCHANGE",
@@ -289,9 +298,25 @@ export declare enum ManualControllerRouteKey {
     AUTH_METHODS_MINE = "AUTH_METHODS_MINE",
     AUTH_IDENTITY_LINKS_LIST = "AUTH_IDENTITY_LINKS_LIST",
     AUTH_IDENTITY_LINKS_UNLINK = "AUTH_IDENTITY_LINKS_UNLINK",
+    /** Which governed documents the signed-in person owes an acceptance of (#1258). */
+    GOVERNED_DOCUMENT_ACCEPTANCES_OWED = "GOVERNED_DOCUMENT_ACCEPTANCES_OWED",
+    /** Record the signed-in person's acceptance of in-force governed-document releases (#1258). */
+    GOVERNED_DOCUMENT_ACCEPTANCES_ACCEPT = "GOVERNED_DOCUMENT_ACCEPTANCES_ACCEPT",
+    /**
+     * Record that a governed document (e.g. the privacy notice) was DELIVERED to the signed-in caller
+     * (#1258 Step 5 / R11). The anonymous half of the same fact is `ANONYMOUS_USERS.record_notice_delivered`
+     * — two doors because the two callers have different security characteristics, one recorder underneath.
+     */
+    GOVERNED_DOCUMENT_NOTICE_DELIVERED = "GOVERNED_DOCUMENT_NOTICE_DELIVERED",
     AUTH_REAUTH = "AUTH_REAUTH",
     /** Challenge leg of a PASSKEY step-up: WebAuthn is challenge-response, so re-auth needs two round-trips. */
     AUTH_REAUTH_PASSKEY_OPTIONS = "AUTH_REAUTH_PASSKEY_OPTIONS",
+    /** Which factors can re-prove the signed-in person for a given `ReAuthenticationPurpose` (#1417). */
+    AUTH_REAUTH_METHODS = "AUTH_REAUTH_METHODS",
+    /** Start re-authenticating through one of the signed-in person's own linked identity providers (#1441). */
+    AUTH_REAUTH_FEDERATED_AUTHORIZE = "AUTH_REAUTH_FEDERATED_AUTHORIZE",
+    /** Redeem the one-time code a federated re-authentication returned, for its proof (#1441). */
+    AUTH_REAUTH_FEDERATED_EXCHANGE = "AUTH_REAUTH_FEDERATED_EXCHANGE",
     AUTH_SAML_LOGIN = "AUTH_SAML_LOGIN",
     AUTH_SAML_ACS = "AUTH_SAML_ACS",
     AUTH_SAML_METADATA = "AUTH_SAML_METADATA",
@@ -322,16 +347,106 @@ export declare enum ManualControllerRouteKey {
     FILES_METADATA = "FILES_METADATA",
     /** Mint a time-limited share link for a stored file. */
     FILES_SHARE = "FILES_SHARE",
+    /**
+     * Revoke EVERY live share link of a stored file — "stop sharing this file". Its own address rather than a
+     * second verb on {@link FILES_SHARE}: minting answers 201 with a link, revoking answers 200 with a count,
+     * and `/shares` names the collection being emptied.
+     */
+    FILES_SHARES_REVOKE = "FILES_SHARES_REVOKE",
     I18N_GET_LABELS = "I18N_GET_LABELS",
     CHARTS_DATA = "CHARTS_DATA",
+    /**
+     * The application's SUBJECT-ERASURE LANE, summarized — counts only, never a row (#269).
+     *
+     * An evidence reader must be able to say what the erasure lane DID: how many requests arrived, who
+     * raised each, how many were withdrawn, how many completed or failed, and whether the completed ones
+     * carry the outcome they promise. Every read variant on an application's erasure-request resource is
+     * subject-scoped by design — correctly, since the lane is the subject's own door — so before this route
+     * existed the lane could be read one subject at a time, as that subject, and as a whole not at all.
+     *
+     * It is a route rather than a resource verb because the ANSWER is an aggregate. Adding an
+     * application-wide LIST would hand an evidence reader every data subject who ever asked to be erased,
+     * in order to count them — the shape #1244 retired. This endpoint runs the count where the rows live
+     * and returns no identifier, no row and no free text.
+     *
+     * Derived, not authored: the resource, the fields and the two operations come from the application's
+     * own `subjectErasureLane` declaration (#1209), so an application that declares a lane gets this
+     * answer without writing an operation, and an application that declares none gets an explicit
+     * "not applicable" rather than a silence indistinguishable from a lane with no activity.
+     */
+    SUBJECT_ERASURE_LANE_EVIDENCE = "SUBJECT_ERASURE_LANE_EVIDENCE",
+    /**
+     * Every physical model-provider call in a window, as counts: which providers and models, how the
+     * calls ended, what they consumed, and how many records are incomplete. The door onto
+     * `providerCallRecords` for `evidence-requirement:outbound-call-record` C2; it returns no row.
+     */
+    PROVIDER_CALL_EVIDENCE = "PROVIDER_CALL_EVIDENCE",
+    /**
+     * Model cost per case, tenant, agent or model over a window (#1598): tokens and exact cost rounded once,
+     * with the unattributed and unpriced calls counted apart, and expert time joined on a case summary.
+     * APPLICATION administrators only (super-administrator or billing manager): the firm's internal margin data.
+     * POST because the case filter is a list of references.
+     */
+    MODEL_COST_SUMMARY = "MODEL_COST_SUMMARY",
+    /**
+     * The override rate of experts' decisions on agents' proposals over a window (#1599), grouped by agent, tool, case
+     * or decider. Metadata only. An organization administrator for their own organization; an application
+     * super-administrator for any.
+     */
+    AGENT_WORK_OVERRIDE_RATE = "AGENT_WORK_OVERRIDE_RATE",
+    /**
+     * Export one organization's decisions on one agent's proposals as pseudonymised JSON Lines (#1599), and record the
+     * export. Refused, and audited, without the organization's ACTIVE export authorisation.
+     */
+    AGENT_WORK_EVALUATION_EXPORT = "AGENT_WORK_EVALUATION_EXPORT",
+    /**
+     * Where the usage rows stand with respect to the provider flush, as counts: pending, reported,
+     * unreportable by reason, and the contradictions `evidence-requirement:usage-flush-run-record` C3
+     * forbids. It returns no row.
+     */
+    USAGE_FLUSH_EVIDENCE = "USAGE_FLUSH_EVIDENCE",
+    /**
+     * Every retention-enforcement record whose sweep run fell in a window (#1636): per run and per class-bound
+     * resource, what was deleted under which period and how the run ended. The door onto
+     * `retentionEnforcementRecords` for `evidence-requirement:retention-window-declaration` C1; the records are
+     * counts and instants, so it names no person and no deleted row.
+     */
+    RETENTION_ENFORCEMENT_EVIDENCE = "RETENTION_ENFORCEMENT_EVIDENCE",
+    /**
+     * Did a SCHEDULED run actually happen as often as it was supposed to (#1029)?
+     *
+     * `assessScheduledEvidenceCoverage` answers it and calls itself "a trusted backend measurement
+     * seam, not an authorization endpoint" — which says the DOOR must carry the gating, not that there
+     * should be no door. Without one the assessment had no caller at all outside its own tests: the
+     * job-execution and payload stores are REPOSITORY_ONLY, so nothing outside the backend process
+     * could reach it, and every PERFORMED clause resting on run history stayed unanswerable.
+     *
+     * POST because the caller supplies the historical SCHEDULE BASIS, which is a body. That is the
+     * seam's own contract — *"an explicitly supplied historical schedule basis… callers must retain its
+     * authorityRefs with the report"* — and the basis is derived from git by
+     * `scripts/assurance/derive-schedule-segments.mjs`, so what the caller sends is reproducible from
+     * commits rather than typed.
+     */
+    SCHEDULED_EVIDENCE_COVERAGE = "SCHEDULED_EVIDENCE_COVERAGE",
     ANALYTICS_EVENTS = "ANALYTICS_EVENTS",
     ANALYTICS_MOMENTS_ACHIEVED = "ANALYTICS_MOMENTS_ACHIEVED",
     PROGRESSION_MILESTONES = "PROGRESSION_MILESTONES",
     FEATURES_RESOLVED = "FEATURES_RESOLVED",
+    /**
+     * A fresh proof-of-work challenge for a public submission (#1735): the consent-exempt answer a form sends
+     * when no consented captcha vendor is running in the visitor's browser.
+     */
+    SUBMISSION_CHALLENGE_PROOF_OF_WORK = "SUBMISSION_CHALLENGE_PROOF_OF_WORK",
     /** Frontend-visible flow/actor systems (metadata + renderable graph). */
     FLOWS_ACTORS_FRONTEND_INFO = "FLOWS_ACTORS_FRONTEND_INFO",
     /** The caller's own conversation history for a flow/actor system. */
     FLOWS_ACTORS_HISTORY = "FLOWS_ACTORS_HISTORY",
+    /** The pending decisions the caller may act on — an inbox across conversations (#1594). */
+    FLOWS_ACTORS_DECISIONS = "FLOWS_ACTORS_DECISIONS",
+    /** Act on one pending decision: answer, reassign, claim, unclaim or escalate (#1594). */
+    FLOWS_ACTORS_DECISION_ACT = "FLOWS_ACTORS_DECISION_ACT",
+    /** Who one pending decision may be moved to — the people who could answer it (#1594). */
+    FLOWS_ACTORS_DECISION_CANDIDATES = "FLOWS_ACTORS_DECISION_CANDIDATES",
     /**
      * A2A agent card (public, CORS-open metadata) advertising this app's exposed
      * actor systems as A2A skills + the security schemes a caller must satisfy.

package/dist/esm/requests/manual-controllers-routes-urls.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manual-controllers-routes-urls.d.ts","sourceRoot":"","sources":["../../../src/requests/manual-controllers-routes-urls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,kBAAkB,YAAY,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,sCAAsC,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,oCAAoC,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEjF;AAeD,oBAAY,wBAAwB;IAClC,sBAAsB,2BAA2B;IAEjD,aAAa,kBAAkB;IAC/B,0BAA0B,+BAA+B;IACzD,iBAAiB,sBAAsB;IACvC,kBAAkB,uBAAuB;IACzC,qBAAqB,0BAA0B;IAC/C,oBAAoB,yBAAyB;IAE7C;;;;;;;OAOG;IACH,yBAAyB,8BAA8B;IACvD;;;;;;;OAOG;IACH,4BAA4B,iCAAiC;IAC7D;;;;;;;;;;OAUG;IACH;;;;;;;;;;;;;;;;;;;OAmBG;IACH,4BAA4B,iCAAiC;IAC7D,6BAA6B,kCAAkC;IAC/D;;;;;;;;;;;OAWG;IACH,oCAAoC,yCAAyC;IAC7E;;;;;;;;;;OAUG;IACH,gCAAgC,qCAAqC;IACrE,kFAAkF;IAClF,6BAA6B,kCAAkC;IAC/D,6BAA6B,kCAAkC;IAC/D,mBAAmB,wBAAwB;IAC3C;;;;OAIG;IACH,oBAAoB,yBAAyB;IAC7C,wFAAwF;IACxF,wBAAwB,6BAA6B;IACrD;;;;OAIG;IACH,0BAA0B,+BAA+B;IACzD,2FAA2F;IAC3F,mBAAmB,wBAAwB;IAC3C,gGAAgG;IAChG,wBAAwB,6BAA6B;IACrD;;;;OAIG;IACH,sBAAsB,2BAA2B;IACjD,iFAAiF;IACjF,uBAAuB,4BAA4B;IACnD,sDAAsD;IACtD,qBAAqB,0BAA0B;IAC/C;;;;;OAKG;IACH,0BAA0B,+BAA+B;IACzD;;;;;;;;OAQG;IACH,kCAAkC,uCAAuC;IACzE;;;;;OAKG;IACH,uBAAuB,4BAA4B;IACnD;;;;;;;;;;;;OAYG;IACH,8BAA8B,mCAAmC;IACjE;;;;;;OAMG;IACH,2BAA2B,gCAAgC;IAC3D,WAAW,gBAAgB;IAC3B,2HAA2H;IAC3H,eAAe,oBAAoB;IACnC,2BAA2B,gCAAgC;IAC3D,4BAA4B,iCAAiC;IAC7D,aAAa,kBAAkB;IAC/B,sBAAsB,2BAA2B;IAIjD,oBAAoB,yBAAyB;IAC7C,sBAAsB,2BAA2B;IAGjD,wBAAwB,6BAA6B;IACrD,yBAAyB,8BAA8B;IACvD,yBAAyB,8BAA8B;IACvD,iBAAiB,sBAAsB;IACvC,kBAAkB,uBAAuB;IAGzC,uBAAuB,4BAA4B;IACnD,yBAAyB,8BAA8B;IAGvD,mBAAmB,wBAAwB;IAC3C,0BAA0B,+BAA+B;IACzD,oBAAoB,yBAAyB;IAG7C,6BAA6B,kCAAkC;IAC/D,4BAA4B,iCAAiC;IAC7D,yBAAyB,8BAA8B;IACvD,wBAAwB,6BAA6B;IACrD,iBAAiB,sBAAsB;IACvC,mBAAmB,wBAAwB;IAC3C,mBAAmB,wBAAwB;IAG3C,oBAAoB,yBAAyB;IAC7C,sBAAsB,2BAA2B;IAGjD,iBAAiB,sBAAsB;IACvC,mBAAmB,wBAAwB;IAG3C,sBAAsB,2BAA2B;IACjD,yBAAyB,8BAA8B;IAGvD,wBAAwB,6BAA6B;IAGrD,4BAA4B,iCAAiC;IAG7D,2BAA2B,gCAAgC;IAC3D,+BAA+B,oCAAoC;IACnE,6BAA6B,kCAAkC;IAC/D,2BAA2B,gCAAgC;IAC3D,+BAA+B,oCAAoC;IAGnE,oBAAoB,yBAAyB;IAC7C,iBAAiB,sBAAsB;IACvC,qBAAqB,0BAA0B;IAC/C,iBAAiB,sBAAsB;IACvC,wBAAwB,6BAA6B;IACrD,0BAA0B,+BAA+B;IACzD,WAAW,gBAAgB;IAC3B,4GAA4G;IAC5G,2BAA2B,gCAAgC;IAG3D,eAAe,oBAAoB;IACnC,aAAa,kBAAkB;IAC/B,kBAAkB,uBAAuB;IACzC,aAAa,kBAAkB;IAC/B,kPAAkP;IAClP,mBAAmB,wBAAwB;IAC3C,gBAAgB,qBAAqB;IAErC;;;;;;;;OAQG;IACH,gGAAgG;IAChG,yBAAyB,8BAA8B;IACvD,8EAA8E;IAC9E,yBAAyB,8BAA8B;IACvD;;;;OAIG;IACH,UAAU,eAAe;IACzB,yEAAyE;IACzE,cAAc,mBAAmB;IACjC,wDAAwD;IACxD,WAAW,gBAAgB;IAE3B,eAAe,oBAAoB;IAEnC,WAAW,gBAAgB;IAE3B,gBAAgB,qBAAqB;IACrC,0BAA0B,+BAA+B;IAEzD,sBAAsB,2BAA2B;IACjD,iBAAiB,sBAAsB;IAEvC,yEAAyE;IACzE,0BAA0B,+BAA+B;IACzD,qEAAqE;IACrE,oBAAoB,yBAAyB;IAG7C;;;;;OAKG;IACH,cAAc,mBAAmB;IACjC;;;;OAIG;IACH,SAAS,cAAc;IAGvB;;;;;;;;;OASG;IACH,YAAY,iBAAiB;IAC7B;;;;;;;;;OASG;IACH,+BAA+B,oCAAoC;CACpE;AAED,eAAO,MAAM,6BAA6B,EAAE,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAqJlF,CAAC;AAOF,oBAAY,kBAAkB;IAC5B,eAAe,oBAAoB;IACnC,gBAAgB,qBAAqB;IACrC,WAAW,gBAAgB;CAC5B;AAED,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAIjE,CAAC"}
+{"version":3,"file":"manual-controllers-routes-urls.d.ts","sourceRoot":"","sources":["../../../../src/requests/manual-controllers-routes-urls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AA4BH,eAAO,MAAM,kBAAkB,YAAY,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,sCAAsC,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,oCAAoC,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEjF;AAeD,oBAAY,wBAAwB;IAClC,sBAAsB,2BAA2B;IAEjD,aAAa,kBAAkB;IAC/B,0BAA0B,+BAA+B;IACzD,iBAAiB,sBAAsB;IACvC,kBAAkB,uBAAuB;IACzC,qBAAqB,0BAA0B;IAC/C,oBAAoB,yBAAyB;IAE7C;;;;;;;OAOG;IACH,yBAAyB,8BAA8B;IACvD;;;;;;;OAOG;IACH,4BAA4B,iCAAiC;IAC7D;;;;;;;;;;OAUG;IACH;;;;;;;;;;;;;;;;;;;OAmBG;IACH,4BAA4B,iCAAiC;IAC7D,6BAA6B,kCAAkC;IAC/D;;;;;;;;;;;OAWG;IACH,oCAAoC,yCAAyC;IAC7E;;;;;;;;;;OAUG;IACH,gCAAgC,qCAAqC;IACrE;;;;;;;;;;;;;OAaG;IACH,wBAAwB,6BAA6B;IACrD;;;;;;OAMG;IACH,0BAA0B,+BAA+B;IACzD;;;;;;OAMG;IACH,gCAAgC,qCAAqC;IACrE,kFAAkF;IAClF,6BAA6B,kCAAkC;IAC/D,6BAA6B,kCAAkC;IAC/D,mBAAmB,wBAAwB;IAC3C;;;;OAIG;IACH,oBAAoB,yBAAyB;IAC7C,wFAAwF;IACxF,wBAAwB,6BAA6B;IACrD;;;;OAIG;IACH,0BAA0B,+BAA+B;IACzD,2FAA2F;IAC3F,mBAAmB,wBAAwB;IAC3C,gGAAgG;IAChG,wBAAwB,6BAA6B;IACrD;;;;OAIG;IACH,sBAAsB,2BAA2B;IACjD,iFAAiF;IACjF,uBAAuB,4BAA4B;IACnD,sDAAsD;IACtD,qBAAqB,0BAA0B;IAC/C;;;;;OAKG;IACH,0BAA0B,+BAA+B;IACzD;;;;;;;;OAQG;IACH,kCAAkC,uCAAuC;IACzE;;;;;OAKG;IACH,uBAAuB,4BAA4B;IACnD;;;;;;;;;;;;OAYG;IACH,8BAA8B,mCAAmC;IACjE;;;;;;OAMG;IACH,2BAA2B,gCAAgC;IAC3D,WAAW,gBAAgB;IAC3B,2HAA2H;IAC3H,eAAe,oBAAoB;IACnC,2BAA2B,gCAAgC;IAC3D,4BAA4B,iCAAiC;IAC7D,aAAa,kBAAkB;IAC/B,sBAAsB,2BAA2B;IAIjD,oBAAoB,yBAAyB;IAC7C,sBAAsB,2BAA2B;IAGjD,wBAAwB,6BAA6B;IACrD,yBAAyB,8BAA8B;IACvD,yBAAyB,8BAA8B;IACvD,iBAAiB,sBAAsB;IACvC,kBAAkB,uBAAuB;IAGzC,uBAAuB,4BAA4B;IACnD,yBAAyB,8BAA8B;IAGvD,mBAAmB,wBAAwB;IAC3C,0BAA0B,+BAA+B;IACzD,oBAAoB,yBAAyB;IAG7C,6BAA6B,kCAAkC;IAC/D,4BAA4B,iCAAiC;IAC7D,yBAAyB,8BAA8B;IACvD,wBAAwB,6BAA6B;IACrD,iBAAiB,sBAAsB;IACvC,mBAAmB,wBAAwB;IAC3C,mBAAmB,wBAAwB;IAG3C,oBAAoB,yBAAyB;IAC7C,sBAAsB,2BAA2B;IAGjD,iBAAiB,sBAAsB;IACvC,mBAAmB,wBAAwB;IAG3C,sBAAsB,2BAA2B;IACjD,yBAAyB,8BAA8B;IAGvD,wBAAwB,6BAA6B;IAGrD,4BAA4B,iCAAiC;IAE7D,gCAAgC,qCAAqC;IAGrE,2BAA2B,gCAAgC;IAC3D,+BAA+B,oCAAoC;IACnE,6BAA6B,kCAAkC;IAC/D,2BAA2B,gCAAgC;IAC3D,+BAA+B,oCAAoC;IAGnE,oBAAoB,yBAAyB;IAC7C,iBAAiB,sBAAsB;IACvC,qBAAqB,0BAA0B;IAC/C,iBAAiB,sBAAsB;IACvC,wBAAwB,6BAA6B;IACrD,0BAA0B,+BAA+B;IACzD,mFAAmF;IACnF,kCAAkC,uCAAuC;IACzE,+FAA+F;IAC/F,oCAAoC,yCAAyC;IAC7E;;;;OAIG;IACH,kCAAkC,uCAAuC;IACzE,WAAW,gBAAgB;IAC3B,4GAA4G;IAC5G,2BAA2B,gCAAgC;IAC3D,qGAAqG;IACrG,mBAAmB,wBAAwB;IAC3C,2GAA2G;IAC3G,+BAA+B,oCAAoC;IACnE,8FAA8F;IAC9F,8BAA8B,mCAAmC;IAGjE,eAAe,oBAAoB;IACnC,aAAa,kBAAkB;IAC/B,kBAAkB,uBAAuB;IACzC,aAAa,kBAAkB;IAC/B,kPAAkP;IAClP,mBAAmB,wBAAwB;IAC3C,gBAAgB,qBAAqB;IAErC;;;;;;;;OAQG;IACH,gGAAgG;IAChG,yBAAyB,8BAA8B;IACvD,8EAA8E;IAC9E,yBAAyB,8BAA8B;IACvD;;;;OAIG;IACH,UAAU,eAAe;IACzB,yEAAyE;IACzE,cAAc,mBAAmB;IACjC,wDAAwD;IACxD,WAAW,gBAAgB;IAC3B;;;;OAIG;IACH,mBAAmB,wBAAwB;IAE3C,eAAe,oBAAoB;IAEnC,WAAW,gBAAgB;IAC3B;;;;;;;;;;;;;;;;;;OAkBG;IACH,6BAA6B,kCAAkC;IAC/D;;;;OAIG;IACH,sBAAsB,2BAA2B;IACjD;;;;;OAKG;IACH,kBAAkB,uBAAuB;IACzC;;;;OAIG;IACH,wBAAwB,6BAA6B;IACrD;;;OAGG;IACH,4BAA4B,iCAAiC;IAC7D;;;;OAIG;IACH,oBAAoB,yBAAyB;IAC7C;;;;;OAKG;IACH,8BAA8B,mCAAmC;IACjE;;;;;;;;;;;;;;OAcG;IACH,2BAA2B,gCAAgC;IAE3D,gBAAgB,qBAAqB;IACrC,0BAA0B,+BAA+B;IAEzD,sBAAsB,2BAA2B;IACjD,iBAAiB,sBAAsB;IAEvC;;;OAGG;IACH,kCAAkC,uCAAuC;IAEzE,yEAAyE;IACzE,0BAA0B,+BAA+B;IACzD,qEAAqE;IACrE,oBAAoB,yBAAyB;IAC7C,2FAA2F;IAC3F,sBAAsB,2BAA2B;IACjD,yFAAyF;IACzF,yBAAyB,8BAA8B;IACvD,yFAAyF;IACzF,gCAAgC,qCAAqC;IAGrE;;;;;OAKG;IACH,cAAc,mBAAmB;IACjC;;;;OAIG;IACH,SAAS,cAAc;IAGvB;;;;;;;;;OASG;IACH,YAAY,iBAAiB;IAC7B;;;;;;;;;OASG;IACH,+BAA+B,oCAAoC;CACpE;AAED,eAAO,MAAM,6BAA6B,EAAE,MAAM,CAAC,wBAAwB,EAAE,MAAM,CA8KlF,CAAC;AAOF,oBAAY,kBAAkB;IAC5B,eAAe,oBAAoB;IACnC,gBAAgB,qBAAqB;IACrC,WAAW,gBAAgB;CAC5B;AAED,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAIjE,CAAC"}

package/dist/esm/requests/manual-controllers-routes-urls.js

@@ -31,6 +31,8 @@
  * NOT under this prefix: the root-level engine routes in
  * {@link ENGINE_ROOT_ROUTES} (health/time probes), mounted at the app root.
  */
+// The one import this atom takes, and it is itself import-free: the browser-reachable path lives with its atom (#1735).
+import { SUBMISSION_CHALLENGE_PROOF_OF_WORK_PATH } from '../security/submission-challenge/submission-challenge.shared.js';
 export const MAIN_API_BASE_PATH = '/api/v1';
 /**
  * Where RFC 8414 authorization-server metadata must be served for an issuer that carries a PATH.
@@ -183,6 +185,37 @@ export var ManualControllerRouteKey;
      * something for a token that has left the process.
      */
     ManualControllerRouteKey["PROVIDER_CONNECTION_ACCESS_TOKEN"] = "PROVIDER_CONNECTION_ACCESS_TOKEN";
+    /**
+     * The CONNECTIONS one owner holds — one entry per connection, never one per ref (#1727).
+     *
+     * A vendor served by several refs (an engine part and the add-on packages beside it, declared in
+     * `providers.sharedConnections`) holds ONE stored grant keyed on its base ref (#1670, #1725), so a screen
+     * listing stored credential ROWS by ref showed a person one Microsoft account per ref while they had
+     * authorized once. This answers the unit a person actually granted: the connection, the refs it serves,
+     * the scopes its consent has ACCUMULATED (#1671, read from the sealed grant — never a token), its health,
+     * and the credential rows a disconnect deletes. The credential resource LIST cannot say the scopes: they
+     * live inside the sealed value.
+     *
+     * Disconnecting is NOT a second door: it is the credential resource's own DELETE of the rows named here,
+     * which already authorizes, asks for step-up, records who revoked, and tells the vendor (#545).
+     */
+    ManualControllerRouteKey["PROVIDER_CONNECTION_LIST"] = "PROVIDER_CONNECTION_LIST";
+    /**
+     * A signed-in person's browser triggers ONE declared provider operation, executed on the backend (#367).
+     *
+     * The credential stays on the server: the browser names the provider, the operation and whose account
+     * to spend, and receives the operation's parsed output. Reachable only for operations the application
+     * declared in `providers.browserOperations` — everything else is refused, and every refusal is audited.
+     */
+    ManualControllerRouteKey["PROVIDER_OPERATION_EXECUTE"] = "PROVIDER_OPERATION_EXECUTE";
+    /**
+     * The CHOICES for one input of a declared provider operation (#333) — a workspace, a project — listed by
+     * running the input's declared options operation through the same connection.
+     *
+     * Admitted only when BOTH the operation and its options operation are declared browser-reachable for
+     * the named connection; a refusal is audited exactly as the execute door's is.
+     */
+    ManualControllerRouteKey["PROVIDER_OPERATION_INPUT_OPTIONS"] = "PROVIDER_OPERATION_INPUT_OPTIONS";
     /** Enterprise SSO: initiate OAuth2 flow for an org's OIDC connection (Step 15) */
     ManualControllerRouteKey["AUTH_ENTERPRISE_SSO_AUTHORIZE"] = "AUTH_ENTERPRISE_SSO_AUTHORIZE";
     ManualControllerRouteKey["AUTH_APP_ENTERPRISE_AUTHORIZE"] = "AUTH_APP_ENTERPRISE_AUTHORIZE";
@@ -308,6 +341,8 @@ export var ManualControllerRouteKey;
     ManualControllerRouteKey["AUTH_RESEND_VERIFICATION"] = "AUTH_RESEND_VERIFICATION";
     // W5.7: Complete org onboarding (deferred org creation)
     ManualControllerRouteKey["AUTH_COMPLETE_ORG_ONBOARDING"] = "AUTH_COMPLETE_ORG_ONBOARDING";
+    // #1374: Complete the profile-names obligation (names collected after the address is proven)
+    ManualControllerRouteKey["AUTH_COMPLETE_PROFILE_ONBOARDING"] = "AUTH_COMPLETE_PROFILE_ONBOARDING";
     // W7.3b: One-off session token management
     ManualControllerRouteKey["AUTH_ONE_OFF_SESSION_CREATE"] = "AUTH_ONE_OFF_SESSION_CREATE";
     ManualControllerRouteKey["AUTH_ONE_OFF_SESSION_CREATE_ORG"] = "AUTH_ONE_OFF_SESSION_CREATE_ORG";
@@ -321,9 +356,25 @@ export var ManualControllerRouteKey;
     ManualControllerRouteKey["AUTH_METHODS_MINE"] = "AUTH_METHODS_MINE";
     ManualControllerRouteKey["AUTH_IDENTITY_LINKS_LIST"] = "AUTH_IDENTITY_LINKS_LIST";
     ManualControllerRouteKey["AUTH_IDENTITY_LINKS_UNLINK"] = "AUTH_IDENTITY_LINKS_UNLINK";
+    /** Which governed documents the signed-in person owes an acceptance of (#1258). */
+    ManualControllerRouteKey["GOVERNED_DOCUMENT_ACCEPTANCES_OWED"] = "GOVERNED_DOCUMENT_ACCEPTANCES_OWED";
+    /** Record the signed-in person's acceptance of in-force governed-document releases (#1258). */
+    ManualControllerRouteKey["GOVERNED_DOCUMENT_ACCEPTANCES_ACCEPT"] = "GOVERNED_DOCUMENT_ACCEPTANCES_ACCEPT";
+    /**
+     * Record that a governed document (e.g. the privacy notice) was DELIVERED to the signed-in caller
+     * (#1258 Step 5 / R11). The anonymous half of the same fact is `ANONYMOUS_USERS.record_notice_delivered`
+     * — two doors because the two callers have different security characteristics, one recorder underneath.
+     */
+    ManualControllerRouteKey["GOVERNED_DOCUMENT_NOTICE_DELIVERED"] = "GOVERNED_DOCUMENT_NOTICE_DELIVERED";
     ManualControllerRouteKey["AUTH_REAUTH"] = "AUTH_REAUTH";
     /** Challenge leg of a PASSKEY step-up: WebAuthn is challenge-response, so re-auth needs two round-trips. */
     ManualControllerRouteKey["AUTH_REAUTH_PASSKEY_OPTIONS"] = "AUTH_REAUTH_PASSKEY_OPTIONS";
+    /** Which factors can re-prove the signed-in person for a given `ReAuthenticationPurpose` (#1417). */
+    ManualControllerRouteKey["AUTH_REAUTH_METHODS"] = "AUTH_REAUTH_METHODS";
+    /** Start re-authenticating through one of the signed-in person's own linked identity providers (#1441). */
+    ManualControllerRouteKey["AUTH_REAUTH_FEDERATED_AUTHORIZE"] = "AUTH_REAUTH_FEDERATED_AUTHORIZE";
+    /** Redeem the one-time code a federated re-authentication returned, for its proof (#1441). */
+    ManualControllerRouteKey["AUTH_REAUTH_FEDERATED_EXCHANGE"] = "AUTH_REAUTH_FEDERATED_EXCHANGE";
     // SAML Routes (AUTH-2)
     ManualControllerRouteKey["AUTH_SAML_LOGIN"] = "AUTH_SAML_LOGIN";
     ManualControllerRouteKey["AUTH_SAML_ACS"] = "AUTH_SAML_ACS";
@@ -355,16 +406,106 @@ export var ManualControllerRouteKey;
     ManualControllerRouteKey["FILES_METADATA"] = "FILES_METADATA";
     /** Mint a time-limited share link for a stored file. */
     ManualControllerRouteKey["FILES_SHARE"] = "FILES_SHARE";
+    /**
+     * Revoke EVERY live share link of a stored file — "stop sharing this file". Its own address rather than a
+     * second verb on {@link FILES_SHARE}: minting answers 201 with a link, revoking answers 200 with a count,
+     * and `/shares` names the collection being emptied.
+     */
+    ManualControllerRouteKey["FILES_SHARES_REVOKE"] = "FILES_SHARES_REVOKE";
     ManualControllerRouteKey["I18N_GET_LABELS"] = "I18N_GET_LABELS";
     ManualControllerRouteKey["CHARTS_DATA"] = "CHARTS_DATA";
+    /**
+     * The application's SUBJECT-ERASURE LANE, summarized — counts only, never a row (#269).
+     *
+     * An evidence reader must be able to say what the erasure lane DID: how many requests arrived, who
+     * raised each, how many were withdrawn, how many completed or failed, and whether the completed ones
+     * carry the outcome they promise. Every read variant on an application's erasure-request resource is
+     * subject-scoped by design — correctly, since the lane is the subject's own door — so before this route
+     * existed the lane could be read one subject at a time, as that subject, and as a whole not at all.
+     *
+     * It is a route rather than a resource verb because the ANSWER is an aggregate. Adding an
+     * application-wide LIST would hand an evidence reader every data subject who ever asked to be erased,
+     * in order to count them — the shape #1244 retired. This endpoint runs the count where the rows live
+     * and returns no identifier, no row and no free text.
+     *
+     * Derived, not authored: the resource, the fields and the two operations come from the application's
+     * own `subjectErasureLane` declaration (#1209), so an application that declares a lane gets this
+     * answer without writing an operation, and an application that declares none gets an explicit
+     * "not applicable" rather than a silence indistinguishable from a lane with no activity.
+     */
+    ManualControllerRouteKey["SUBJECT_ERASURE_LANE_EVIDENCE"] = "SUBJECT_ERASURE_LANE_EVIDENCE";
+    /**
+     * Every physical model-provider call in a window, as counts: which providers and models, how the
+     * calls ended, what they consumed, and how many records are incomplete. The door onto
+     * `providerCallRecords` for `evidence-requirement:outbound-call-record` C2; it returns no row.
+     */
+    ManualControllerRouteKey["PROVIDER_CALL_EVIDENCE"] = "PROVIDER_CALL_EVIDENCE";
+    /**
+     * Model cost per case, tenant, agent or model over a window (#1598): tokens and exact cost rounded once,
+     * with the unattributed and unpriced calls counted apart, and expert time joined on a case summary.
+     * APPLICATION administrators only (super-administrator or billing manager): the firm's internal margin data.
+     * POST because the case filter is a list of references.
+     */
+    ManualControllerRouteKey["MODEL_COST_SUMMARY"] = "MODEL_COST_SUMMARY";
+    /**
+     * The override rate of experts' decisions on agents' proposals over a window (#1599), grouped by agent, tool, case
+     * or decider. Metadata only. An organization administrator for their own organization; an application
+     * super-administrator for any.
+     */
+    ManualControllerRouteKey["AGENT_WORK_OVERRIDE_RATE"] = "AGENT_WORK_OVERRIDE_RATE";
+    /**
+     * Export one organization's decisions on one agent's proposals as pseudonymised JSON Lines (#1599), and record the
+     * export. Refused, and audited, without the organization's ACTIVE export authorisation.
+     */
+    ManualControllerRouteKey["AGENT_WORK_EVALUATION_EXPORT"] = "AGENT_WORK_EVALUATION_EXPORT";
+    /**
+     * Where the usage rows stand with respect to the provider flush, as counts: pending, reported,
+     * unreportable by reason, and the contradictions `evidence-requirement:usage-flush-run-record` C3
+     * forbids. It returns no row.
+     */
+    ManualControllerRouteKey["USAGE_FLUSH_EVIDENCE"] = "USAGE_FLUSH_EVIDENCE";
+    /**
+     * Every retention-enforcement record whose sweep run fell in a window (#1636): per run and per class-bound
+     * resource, what was deleted under which period and how the run ended. The door onto
+     * `retentionEnforcementRecords` for `evidence-requirement:retention-window-declaration` C1; the records are
+     * counts and instants, so it names no person and no deleted row.
+     */
+    ManualControllerRouteKey["RETENTION_ENFORCEMENT_EVIDENCE"] = "RETENTION_ENFORCEMENT_EVIDENCE";
+    /**
+     * Did a SCHEDULED run actually happen as often as it was supposed to (#1029)?
+     *
+     * `assessScheduledEvidenceCoverage` answers it and calls itself "a trusted backend measurement
+     * seam, not an authorization endpoint" — which says the DOOR must carry the gating, not that there
+     * should be no door. Without one the assessment had no caller at all outside its own tests: the
+     * job-execution and payload stores are REPOSITORY_ONLY, so nothing outside the backend process
+     * could reach it, and every PERFORMED clause resting on run history stayed unanswerable.
+     *
+     * POST because the caller supplies the historical SCHEDULE BASIS, which is a body. That is the
+     * seam's own contract — *"an explicitly supplied historical schedule basis… callers must retain its
+     * authorityRefs with the report"* — and the basis is derived from git by
+     * `scripts/assurance/derive-schedule-segments.mjs`, so what the caller sends is reproducible from
+     * commits rather than typed.
+     */
+    ManualControllerRouteKey["SCHEDULED_EVIDENCE_COVERAGE"] = "SCHEDULED_EVIDENCE_COVERAGE";
     ManualControllerRouteKey["ANALYTICS_EVENTS"] = "ANALYTICS_EVENTS";
     ManualControllerRouteKey["ANALYTICS_MOMENTS_ACHIEVED"] = "ANALYTICS_MOMENTS_ACHIEVED";
     ManualControllerRouteKey["PROGRESSION_MILESTONES"] = "PROGRESSION_MILESTONES";
     ManualControllerRouteKey["FEATURES_RESOLVED"] = "FEATURES_RESOLVED";
+    /**
+     * A fresh proof-of-work challenge for a public submission (#1735): the consent-exempt answer a form sends
+     * when no consented captcha vendor is running in the visitor's browser.
+     */
+    ManualControllerRouteKey["SUBMISSION_CHALLENGE_PROOF_OF_WORK"] = "SUBMISSION_CHALLENGE_PROOF_OF_WORK";
     /** Frontend-visible flow/actor systems (metadata + renderable graph). */
     ManualControllerRouteKey["FLOWS_ACTORS_FRONTEND_INFO"] = "FLOWS_ACTORS_FRONTEND_INFO";
     /** The caller's own conversation history for a flow/actor system. */
     ManualControllerRouteKey["FLOWS_ACTORS_HISTORY"] = "FLOWS_ACTORS_HISTORY";
+    /** The pending decisions the caller may act on — an inbox across conversations (#1594). */
+    ManualControllerRouteKey["FLOWS_ACTORS_DECISIONS"] = "FLOWS_ACTORS_DECISIONS";
+    /** Act on one pending decision: answer, reassign, claim, unclaim or escalate (#1594). */
+    ManualControllerRouteKey["FLOWS_ACTORS_DECISION_ACT"] = "FLOWS_ACTORS_DECISION_ACT";
+    /** Who one pending decision may be moved to — the people who could answer it (#1594). */
+    ManualControllerRouteKey["FLOWS_ACTORS_DECISION_CANDIDATES"] = "FLOWS_ACTORS_DECISION_CANDIDATES";
     // === A2A (external actor exposure — Agent2Agent protocol) ===
     /**
      * A2A agent card (public, CORS-open metadata) advertising this app's exposed
@@ -417,6 +558,11 @@ export const MANUAL_CONTROLLER_ROUTES_URLS = {
     [ManualControllerRouteKey.PROVIDER_CONNECTION_CATALOGUE]: '/connections',
     [ManualControllerRouteKey.PROVIDER_CONNECTION_STORE_CREDENTIAL]: '/connections/:providerRef/credential',
     [ManualControllerRouteKey.PROVIDER_CONNECTION_ACCESS_TOKEN]: '/connections/:providerRef/access-token',
+    // A STATIC segment beside `/connections/callback`: `linked` is never a provider ref's route, because every
+    // ref-addressed connection route has a second segment (`/start`, `/credential`, `/access-token`).
+    [ManualControllerRouteKey.PROVIDER_CONNECTION_LIST]: '/connections/linked',
+    [ManualControllerRouteKey.PROVIDER_OPERATION_EXECUTE]: '/provider-operations/:providerRef/:operationId',
+    [ManualControllerRouteKey.PROVIDER_OPERATION_INPUT_OPTIONS]: '/provider-operations/:providerRef/:operationId/input-options/:inputField',
     [ManualControllerRouteKey.AUTH_ENTERPRISE_SSO_AUTHORIZE]: '/auth/enterprise/authorize/:orgId/:connectionId',
     [ManualControllerRouteKey.AUTH_APP_ENTERPRISE_AUTHORIZE]: '/auth/app-enterprise/authorize/:connectionId',
     [ManualControllerRouteKey.AUTH_TOKEN_EXCHANGE]: '/auth/token/exchange',
@@ -467,6 +613,7 @@ export const MANUAL_CONTROLLER_ROUTES_URLS = {
     [ManualControllerRouteKey.AUTH_RESEND_VERIFICATION]: '/auth/resend-verification',
     // W5.7: Complete org onboarding
     [ManualControllerRouteKey.AUTH_COMPLETE_ORG_ONBOARDING]: '/auth/onboarding/complete-org',
+    [ManualControllerRouteKey.AUTH_COMPLETE_PROFILE_ONBOARDING]: '/auth/onboarding/complete-profile',
     // W7.3b: One-off session token management
     [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_CREATE]: '/apps/:applicationId/auth/one-off-session',
     [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_CREATE_ORG]: '/orgs/:organizationId/apps/:applicationId/auth/one-off-session',
@@ -480,8 +627,14 @@ export const MANUAL_CONTROLLER_ROUTES_URLS = {
     [ManualControllerRouteKey.AUTH_METHODS_MINE]: '/auth/methods/mine',
     [ManualControllerRouteKey.AUTH_IDENTITY_LINKS_LIST]: '/auth/identity-links',
     [ManualControllerRouteKey.AUTH_IDENTITY_LINKS_UNLINK]: '/auth/identity-links/:linkId',
+    [ManualControllerRouteKey.GOVERNED_DOCUMENT_ACCEPTANCES_OWED]: '/governed-documents/acceptances/owed',
+    [ManualControllerRouteKey.GOVERNED_DOCUMENT_ACCEPTANCES_ACCEPT]: '/governed-documents/acceptances',
+    [ManualControllerRouteKey.GOVERNED_DOCUMENT_NOTICE_DELIVERED]: '/governed-documents/notice-delivered',
     [ManualControllerRouteKey.AUTH_REAUTH]: '/auth/reauth',
     [ManualControllerRouteKey.AUTH_REAUTH_PASSKEY_OPTIONS]: '/auth/reauth/passkey/options',
+    [ManualControllerRouteKey.AUTH_REAUTH_METHODS]: '/auth/reauth/methods',
+    [ManualControllerRouteKey.AUTH_REAUTH_FEDERATED_AUTHORIZE]: '/auth/reauth/federated/authorize',
+    [ManualControllerRouteKey.AUTH_REAUTH_FEDERATED_EXCHANGE]: '/auth/reauth/federated/exchange',
     // SAML Routes (AUTH-2)
     [ManualControllerRouteKey.AUTH_SAML_LOGIN]: '/auth/saml/login/:connectionId',
     [ManualControllerRouteKey.AUTH_SAML_ACS]: '/auth/saml/acs',
@@ -496,8 +649,17 @@ export const MANUAL_CONTROLLER_ROUTES_URLS = {
     [ManualControllerRouteKey.FILES_ITEM]: '/files/:fileId',
     [ManualControllerRouteKey.FILES_METADATA]: '/files/:fileId/metadata',
     [ManualControllerRouteKey.FILES_SHARE]: '/files/:fileId/share',
+    [ManualControllerRouteKey.FILES_SHARES_REVOKE]: '/files/:fileId/shares',
     [ManualControllerRouteKey.I18N_GET_LABELS]: '/i18n/labels',
     [ManualControllerRouteKey.CHARTS_DATA]: '/charts/:chartRef/data',
+    [ManualControllerRouteKey.SUBJECT_ERASURE_LANE_EVIDENCE]: '/assurance/subject-erasure-lane-evidence',
+    [ManualControllerRouteKey.PROVIDER_CALL_EVIDENCE]: '/assurance/provider-call-evidence',
+    [ManualControllerRouteKey.MODEL_COST_SUMMARY]: '/model-cost/summary',
+    [ManualControllerRouteKey.AGENT_WORK_OVERRIDE_RATE]: '/agent-work/override-rate',
+    [ManualControllerRouteKey.AGENT_WORK_EVALUATION_EXPORT]: '/agent-work/evaluation-exports',
+    [ManualControllerRouteKey.RETENTION_ENFORCEMENT_EVIDENCE]: '/assurance/retention-enforcement-evidence',
+    [ManualControllerRouteKey.USAGE_FLUSH_EVIDENCE]: '/assurance/usage-flush-evidence',
+    [ManualControllerRouteKey.SCHEDULED_EVIDENCE_COVERAGE]: '/assurance/scheduled-evidence-coverage',
     // MFA — Email OTP (Step 10)
     [ManualControllerRouteKey.AUTH_MFA_EMAIL_OTP_SEND]: '/auth/mfa/email-otp/send',
     [ManualControllerRouteKey.AUTH_MFA_EMAIL_OTP_VERIFY]: '/auth/mfa/email-otp/verify',
@@ -517,8 +679,12 @@ export const MANUAL_CONTROLLER_ROUTES_URLS = {
     [ManualControllerRouteKey.ANALYTICS_MOMENTS_ACHIEVED]: '/analytics/moments/achieved',
     [ManualControllerRouteKey.PROGRESSION_MILESTONES]: '/progression/milestones',
     [ManualControllerRouteKey.FEATURES_RESOLVED]: '/features/resolved',
+    [ManualControllerRouteKey.SUBMISSION_CHALLENGE_PROOF_OF_WORK]: SUBMISSION_CHALLENGE_PROOF_OF_WORK_PATH,
     [ManualControllerRouteKey.FLOWS_ACTORS_FRONTEND_INFO]: '/flows-actors/frontend-info',
     [ManualControllerRouteKey.FLOWS_ACTORS_HISTORY]: '/flows-actors/history',
+    [ManualControllerRouteKey.FLOWS_ACTORS_DECISIONS]: '/flows-actors/decisions',
+    [ManualControllerRouteKey.FLOWS_ACTORS_DECISION_ACT]: '/flows-actors/decisions/:decisionRef/:act',
+    [ManualControllerRouteKey.FLOWS_ACTORS_DECISION_CANDIDATES]: '/flows-actors/decisions/:decisionRef/candidates',
     // === A2A (external actor exposure) ===
     // Card served under the API mount, so with issuer `${publicUrl}${MAIN_API_BASE_PATH}`
     // a caller's `${issuer}/a2a/.well-known/agent-card.json` resolves here (a root-level