@wildo-ai/saas-models 1.1.5 → 1.1.7

package/dist/esm/queue/queues.shared.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"queues.shared.utils.js","sourceRoot":"","sources":["../../../../src/queue/queues.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAG1E,+EAA+E;AAC/E,yBAAyB;AACzB,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,gBAAgB;IAC3B;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,cAAc,CACnB,KAAa,EACb,QAAgB,EAChB,OAAsB;QAEtB,MAAM,IAAI,GAAG,eAAe,KAAK,IAAI,QAAQ,EAAE,CAAC;QAChD,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,mBAAmB,CAAC,KAAa,EAAE,KAAa,EAAE,gBAAyB;QAChF,0EAA0E;QAC1E,oEAAoE;QACpE,oCAAoC;QACpC,EAAE;QACF,wEAAwE;QACxE,0EAA0E;QAC1E,0EAA0E;QAC1E,6EAA6E;QAC7E,sEAAsE;QACtE,EAAE;QACF,0EAA0E;QAC1E,2EAA2E;QAC3E,yBAAyB;QACzB,OAAO,gBAAgB;YACrB,CAAC,CAAC,eAAe,KAAK,IAAI,gBAAgB,IAAI,KAAK,EAAE;YACrD,CAAC,CAAC,eAAe,KAAK,IAAI,KAAK,EAAE,CAAC;IACtC,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,oBAAoB,CAAC,KAAa,EAAE,UAAkB;QAC3D,OAAO,eAAe,KAAK,WAAW,UAAU,EAAE,CAAC;IACrD,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,CAAC,mBAAmB,CAAC,eAAuB,EAAE,OAAe;QACjE,OAAO,GAAG,eAAe,UAAU,OAAO,EAAE,CAAC;IAC/C,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,wBAAwB,CAAC,KAAa,EAAE,UAAkB;QAC/D,OAAO,eAAe,KAAK,gBAAgB,UAAU,EAAE,CAAC;IAC1D,CAAC;IAED;;;;;;;;;;OAUG;IACH,MAAM,CAAC,sBAAsB,CAC3B,MAAc,EACd,QAAgB,EAChB,OAAsB;QAEtB,MAAM,IAAI,GAAG,wBAAwB,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC1D,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CAAC,SAAiB;QAMrC,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEnC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,2CAA2C;QAC3C,8DAA8D;QAC9D,EAAE;QACF,6EAA6E;QAC7E,2EAA2E;QAC3E,yEAAyE;QACzE,OAAO;QACP,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;YACzB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YAClC,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;gBACpB,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE;gBAClC,oEAAoE;gBACpE,sEAAsE;gBACtE,mEAAmE;gBACnE,OAAO,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;aACjD,CAAC;QACJ,CAAC;QAED,2BAA2B;QAC3B,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;YACzB,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;gBAC5B,uEAAuE;gBACvE,OAAO;oBACL,IAAI,EAAE,UAAU;oBAChB,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;oBACpB,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;oBAClB,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;iBAClB,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,wDAAwD;gBACxD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,IAAI,CAAC;gBAClC,OAAO;oBACL,IAAI,EAAE,KAAK;oBACX,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;oBACpB,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;oBAClB,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;iBAClB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,SAAiB;QACxC,OAAO,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,eAAe,CAAC,SAAiB;QACtC,OAAO,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,SAAiB;QACnC,OAAO,SAAS,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,gBAAgB,CAAC,SAAiB;QACvC,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACzE,OAAO,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AAED,+EAA+E;AAC/E,uBAAuB;AACvB,qDAAqD;AACrD,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAa,EACb,QAAgB,EAChB,OAAsB;IAEtB,OAAO,gBAAgB,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AACnE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAE,KAAa,EAAE,gBAAyB;IACzF,OAAO,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;AAC9E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa,EAAE,UAAkB;IACpE,OAAO,gBAAgB,CAAC,oBAAoB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,eAAuB,EAAE,OAAe;IAC1E,OAAO,gBAAgB,CAAC,mBAAmB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;AACxE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAa,EAAE,UAAkB;IACxE,OAAO,gBAAgB,CAAC,wBAAwB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAwB,EAAE,OAAe;IAC3E,IAAI,KAAa,CAAC;IAElB,QAAQ,MAAM,CAAC,WAAW,EAAE,CAAC;QAC3B,KAAK,uBAAuB,CAAC,KAAK;YAChC,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC;YAC3B,MAAM;QACR,KAAK,uBAAuB,CAAC,MAAM;YACjC,KAAK,GAAG,MAAM,CAAC,WAAW,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;YAC3C,MAAM;QACR,KAAK,uBAAuB,CAAC,WAAW,CAAC;QACzC;YACE,KAAK,GAAG,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAClD,MAAM;IACV,CAAC;IAED,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAwB;IAChE,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,UAAU,IAAI,mBAAmB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC7C,UAAU,IAAI,MAAM,CAAC,SAAS,CAAC;IACjC,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAyB1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAiC;IAC1E,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAExD,8EAA8E;IAC9E,+EAA+E;IAC/E,6EAA6E;IAC7E,MAAM,SAAS,GACb,CAAC,KAAK,IAAI,KAAK,KAAK,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAE9E,OAAO,UAAU,kBAAkB,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,SAAS,EAAE,CAAC;AAC/G,CAAC","sourcesContent":["/**\n * Queues Shared Utilities\n * \n * All queue-related utility classes consolidated in a single file.\n * Includes: queue naming, retry delay calculations (legacy functions).\n */\n\nimport { RetryPolicy_BackoffType } from '../errors/errors.shared.schemas';\nimport { QueueRetryConfig, QUEUE_RETRY_DEFAULTS, QueueVariant } from './queues.shared.schemas';\n\n// ============================================================================\n// QUEUE NAMING UTILITIES\n// ============================================================================\n\n/**\n * Utilities for building queue names.\n *\n * Mono-env architecture: each deployment has its own infra, so env is NOT\n * part of queue names. Uniqueness comes from appId alone.\n *\n * The `appId` here is the application's canonical identifier — its Mongo `_id`,\n * projected into the app runtime as env `APPLICATION_ID` and exposed by\n * `AppConfigurationService.applicationId`. It is NOT the human-readable\n * `appSlug`. Every producer AND consumer of a given app's queues must derive\n * the name from the same identifier; keying one side on the slug orphans the\n * queue (nothing consumes it) and a slug rename would silently orphan it again.\n *\n * Queue naming convention:\n * - App queues: wildo.queue.{appId}.{category}[.{variant}]\n * - Reply queues: wildo.reply.{appId}.{podId}\n * - Domain queues: wildo.queue.{appId}.domain.{domainName}\n * - Platform queues: wildo.queue.platform.{msName}.{category}[.{variant}]\n */\nexport class QueueNamingUtils {\n  /**\n   * Build queue name following the convention:\n   * wildo.queue.{appId}.{category}[.{variant}]\n   *\n   * @param appId - Canonical application identifier (the app's Mongo `_id` /\n   *   env `APPLICATION_ID`), NOT the human-readable slug. Producer and consumer\n   *   must agree on this identifier or the queue is orphaned.\n   * @param category - Queue category (operations, scheduled, callbacks, domain.*)\n   * @param variant - Optional variant (priority, deadletter)\n   * @returns Formatted queue name\n   *\n   * @example\n   * QueueNamingUtils.buildQueueName('6a08488438bc965729b8b9ff', 'operations')\n   * // => 'wildo.queue.6a08488438bc965729b8b9ff.operations'\n   */\n  static buildQueueName(\n    appId: string,\n    category: string,\n    variant?: QueueVariant\n  ): string {\n    const base = `wildo.queue.${appId}.${category}`;\n    return variant ? `${base}.${variant}` : base;\n  }\n\n  /**\n   * Build reply queue name for RPC pattern.\n   * Reply queues are exclusive, auto-delete, and transient.\n   * \n   * wildo.reply.{appId}.{podId}\n   */\n  static buildReplyQueueName(appId: string, podId: string, principalSegment?: string): string {\n    // `principalSegment` makes an RPC reply queue attributable to the RUNTIME\n    // that owns it, which is what lets a broker permission separate one\n    // runtime's replies from another's.\n    //\n    // Without it the name is `wildo.reply.<appId>.<podId>` and `podId` is a\n    // per-PROCESS token carrying no principal — so a minion's reply queue and\n    // the application backend's differ only by an opaque suffix, and no regex\n    // can admit one while refusing the other. Narrowing a minion's broker `read`\n    // therefore refused its OWN replies and crash-looped it (2026-08-12).\n    //\n    // OPTIONAL, and absent means the historical layout. Existing callers keep\n    // producing exactly the names they produce today; only a caller that knows\n    // its principal opts in.\n    return principalSegment\n      ? `wildo.reply.${appId}.${principalSegment}.${podId}`\n      : `wildo.reply.${appId}.${podId}`;\n  }\n\n  /**\n   * Build domain-specific queue name.\n   *\n   * wildo.queue.{appId}.domain.{domainName}\n   */\n  static buildDomainQueueName(appId: string, domainName: string): string {\n    return `wildo.queue.${appId}.domain.${domainName}`;\n  }\n\n  /**\n   * Build a delay (retry-hold) queue name for durable backoff.\n   *\n   * A delay queue holds a failed job for a fixed TTL, then dead-letters it back\n   * to its source queue for re-delivery. One queue exists PER distinct delay\n   * value so every message in it shares the same `x-message-ttl` — this avoids\n   * RabbitMQ's per-message-TTL head-of-line blocking (where a short-delay message\n   * would wait behind a longer-delay one ahead of it in the queue). The delay is\n   * embedded in the name, so the set of delay queues stays bounded by the (few)\n   * distinct backoff delays an app produces (`baseDelayMs × 2^attempt`, capped).\n   *\n   * `{sourceQueueName}.delay.{delayMs}`\n   *\n   * @param sourceQueueName - Full name of the queue the message returns to on expiry\n   * @param delayMs - Hold duration in ms (becomes the delay queue's `x-message-ttl`)\n   * @example\n   * QueueNamingUtils.buildDelayQueueName('wildo.queue.my-app.operations', 2000)\n   * // => 'wildo.queue.my-app.operations.delay.2000'\n   */\n  static buildDelayQueueName(sourceQueueName: string, delayMs: number): string {\n    return `${sourceQueueName}.delay.${delayMs}`;\n  }\n\n  /**\n   * Build minion-tick queue name (KD-12 of\n   * `.claude/plans/minions-and-workers-implementation.md`).\n   *\n   * `wildo.queue.{appId}.minion-tick.{minionName}`\n   *\n   * Each minion subscribes only to its own per-minion queue so the\n   * backend-api and the minion (which both connect to the same RabbitMQ\n   * vhost) do not compete on the shared `scheduled` queue. The publisher\n   * (`platform-crontabs-batches-manager`) routes `MINION_TICK` ticks to\n   * this per-minion queue; `SCHEDULED_CRON` ticks keep flowing to the\n   * shared `scheduled` queue (consumed by the backend-api executor).\n   */\n  static buildMinionTickQueueName(appId: string, minionName: string): string {\n    return `wildo.queue.${appId}.minion-tick.${minionName}`;\n  }\n\n  /**\n   * Build platform microservice queue name.\n   * Platform queues don't include environment as they're shared infrastructure.\n   * \n   * wildo.queue.platform.{msName}.{category}[.{variant}]\n   * \n   * @param msName - Microservice name\n   * @param category - Queue category\n   * @param variant - Optional variant\n   * @returns Formatted platform queue name\n   */\n  static buildPlatformQueueName(\n    msName: string,\n    category: string,\n    variant?: QueueVariant\n  ): string {\n    const base = `wildo.queue.platform.${msName}.${category}`;\n    return variant ? `${base}.${variant}` : base;\n  }\n\n  /**\n   * Parse a queue name to extract its components.\n   * \n   * @param queueName - Full queue name to parse\n   * @returns Parsed components or null if invalid format\n   */\n  static parseQueueName(queueName: string): {\n    type: 'app' | 'platform' | 'reply';\n    identifier: string;\n    category?: string;\n    variant?: string;\n  } | null {\n    const parts = queueName.split('.');\n    \n    if (parts.length < 3 || parts[0] !== 'wildo') {\n      return null;\n    }\n\n    // Reply queue: wildo.reply.{appId}.{podId}\n    //           or wildo.reply.{appId}.{principalSegment}.{podId}\n    //\n    // `category` stays the LAST segment in both layouts, so it remains the podId\n    // rather than silently becoming the principal for principal-scoped names —\n    // a caller reading `category` expecting a pod identity must keep getting\n    // one.\n    if (parts[1] === 'reply') {\n      if (parts.length < 4) return null;\n      return {\n        type: 'reply',\n        identifier: parts[2],\n        category: parts[parts.length - 1]!,\n        // Present only for the principal-scoped layout; `undefined` for the\n        // historical one rather than an empty string, so \"no principal in the\n        // name\" is distinguishable from \"a principal whose name is empty\".\n        variant: parts.length > 4 ? parts[3] : undefined,\n      };\n    }\n\n    // Queue: wildo.queue.{...}\n    if (parts[1] === 'queue') {\n      if (parts[2] === 'platform') {\n        // Platform queue: wildo.queue.platform.{msName}.{category}[.{variant}]\n        return {\n          type: 'platform',\n          identifier: parts[3],\n          category: parts[4],\n          variant: parts[5],\n        };\n      } else {\n        // App queue: wildo.queue.{appId}.{category}[.{variant}]\n        if (parts.length < 4) return null;\n        return {\n          type: 'app',\n          identifier: parts[2],\n          category: parts[3],\n          variant: parts[4],\n        };\n      }\n    }\n\n    return null;\n  }\n\n  /**\n   * Check if a queue name is a dead letter queue.\n   */\n  static isDeadLetterQueue(queueName: string): boolean {\n    return queueName.endsWith('.deadletter');\n  }\n\n  /**\n   * Check if a queue name is a priority queue.\n   */\n  static isPriorityQueue(queueName: string): boolean {\n    return queueName.endsWith('.priority');\n  }\n\n  /**\n   * Check if a queue name is a reply queue.\n   */\n  static isReplyQueue(queueName: string): boolean {\n    return queueName.startsWith('wildo.reply.');\n  }\n\n  /**\n   * Get the base queue name (without variant suffix).\n   * \n   * @param queueName - Full queue name\n   * @returns Base queue name without variant\n   */\n  static getBaseQueueName(queueName: string): string {\n    if (queueName.endsWith('.priority') || queueName.endsWith('.deadletter')) {\n      return queueName.substring(0, queueName.lastIndexOf('.'));\n    }\n    return queueName;\n  }\n}\n\n// ============================================================================\n// STANDALONE FUNCTIONS\n// Convenience wrappers around QueueNamingUtils class\n// ============================================================================\n\n/**\n * Build queue name following the convention.\n * wildo.queue.{appId}.{category}[.{variant}]\n */\nexport function buildQueueName(\n  appId: string,\n  category: string,\n  variant?: QueueVariant\n): string {\n  return QueueNamingUtils.buildQueueName(appId, category, variant);\n}\n\n/**\n * Build reply queue name for RPC pattern.\n * wildo.reply.{appId}.{podId}\n */\nexport function buildReplyQueueName(appId: string, podId: string, principalSegment?: string): string {\n  return QueueNamingUtils.buildReplyQueueName(appId, podId, principalSegment);\n}\n\n/**\n * Build domain queue name.\n * wildo.queue.{appId}.domain.{domainName}\n */\nexport function buildDomainQueueName(appId: string, domainName: string): string {\n  return QueueNamingUtils.buildDomainQueueName(appId, domainName);\n}\n\n/**\n * Build a delay (retry-hold) queue name for durable backoff.\n * {sourceQueueName}.delay.{delayMs}\n */\nexport function buildDelayQueueName(sourceQueueName: string, delayMs: number): string {\n  return QueueNamingUtils.buildDelayQueueName(sourceQueueName, delayMs);\n}\n\n/**\n * Build per-minion tick queue name (KD-12).\n * wildo.queue.{appId}.minion-tick.{minionName}\n */\nexport function buildMinionTickQueueName(appId: string, minionName: string): string {\n  return QueueNamingUtils.buildMinionTickQueueName(appId, minionName);\n}\n\n/**\n * Calculate retry delay based on policy and attempt number.\n * \n * @param config Retry configuration\n * @param attempt Current retry attempt (0-indexed)\n * @returns Delay in milliseconds (capped at maxDelayMs)\n */\nexport function calculateRetryDelay(config: QueueRetryConfig, attempt: number): number {\n  let delay: number;\n  \n  switch (config.retryPolicy) {\n    case RetryPolicy_BackoffType.FIXED:\n      delay = config.baseDelayMs;\n      break;\n    case RetryPolicy_BackoffType.LINEAR:\n      delay = config.baseDelayMs * (attempt + 1);\n      break;\n    case RetryPolicy_BackoffType.EXPONENTIAL:\n    default:\n      delay = config.baseDelayMs * Math.pow(2, attempt);\n      break;\n  }\n  \n  return Math.min(delay, config.maxDelayMs);\n}\n\n/**\n * Estimate retry duration assuming each retry takes exactly config.timeoutMs.\n * Excludes the initial attempt and broker waiting time. Worker execution is not\n * capped by timeoutMs; the legacy function name does not imply an enforced maximum.\n *\n * @param config Retry configuration\n * @returns Estimated retry duration in milliseconds under the stated assumption\n */\nexport function calculateMaxRetryDuration(config: QueueRetryConfig): number {\n  let totalDelay = 0;\n  for (let i = 0; i < config.maxRetries; i++) {\n    totalDelay += calculateRetryDelay(config, i);\n    totalDelay += config.timeoutMs;\n  }\n  return totalDelay;\n}\n\n// ============================================================================\n// BROKER CONNECTION URL\n// ============================================================================\n\n/**\n * The RabbitMQ default virtual host, whose NAME is the single character `/`.\n *\n * Every broker ships with it, and an app that authors no\n * `backingServices.rabbitmq.vhost` lands here (isolation then comes from the\n * per-app user's permission regex rather than from a dedicated vhost).\n *\n * Note the deliberate ambiguity this constant resolves: `/` is BOTH the name of\n * the default vhost AND the AMQP URI path separator. Conflating the two is what\n * broke the two pre-consolidation URL builders — see\n * {@link buildRabbitMQConnectionUrl}.\n */\nexport const DEFAULT_RABBITMQ_VHOST = '/';\n\n/** Connection inputs for {@link buildRabbitMQConnectionUrl}. */\nexport interface RabbitMQConnectionUrlParts {\n  /** Broker hostname, e.g. `'localhost'`. */\n  host: string;\n  /** Broker AMQP port, e.g. `5672`. */\n  port: number;\n  /** Per-app broker username (minted by the infra provider module). */\n  username: string;\n  /** Per-app broker password (minted by the infra provider module). */\n  password: string;\n  /**\n   * Virtual host **name** — e.g. `'wonder-todos'`, with NO leading slash. This\n   * is the value authored at `backingServices.rabbitmq.vhost` in\n   * `wildo.infra.<envName>.config.ts` and the same name the infra provider\n   * passes to `ensureVhost()` (`PUT /api/vhosts/{name}`), so the string that\n   * names the vhost on the broker is the string that appears here.\n   *\n   * Omit it — or pass {@link DEFAULT_RABBITMQ_VHOST} — to connect to the broker\n   * default vhost.\n   */\n  vhost?: string;\n}\n\n/**\n * Assemble the AMQP connection URL for a broker + vhost + credential triple.\n *\n * This is the SINGLE owner of AMQP URL assembly across the monorepo. It exists\n * because the URL was previously built ad-hoc at three call sites with three\n * different conventions, two of which were wrong in the same way — they\n * interpolated the vhost directly after the port with no separator:\n *\n * ```ts\n * `amqp://${user}:${pass}@${host}:${port}${vhost || '/'}`   // ← the old, broken form\n * ```\n *\n * That form only ever worked because the `'/'` fallback doubles as the URI path\n * separator, so the default case accidentally produced a well-formed URL with an\n * empty path. The moment a real vhost was threaded through it produced\n * `amqp://…@localhost:5672wonder-todos` — a malformed authority that fails to\n * connect. A silent misconfiguration (every app quietly sharing the default\n * vhost) was therefore load-bearing for the URL builder not crashing, which is\n * why the two defects had to be fixed together.\n *\n * The encoding rules, per the AMQP URI spec (RFC 3986 userinfo + path):\n *\n * - **Userinfo is percent-encoded.** Minted passwords are random and may contain\n *   `@`, `:` or `/`, any of which would otherwise terminate the userinfo or\n *   authority early and silently retarget the connection.\n * - **The path separator is unconditional.** The `/` after the port is always\n *   emitted; it is URI syntax, never vhost data.\n * - **An EMPTY path means the default vhost.** So both an omitted vhost and the\n *   literal default-vhost name `'/'` collapse to `amqp://host:port/`. This is\n *   byte-for-byte what the previous builders emitted for the default case, so\n *   consolidating cannot regress a currently-connected deployment.\n * - **A named vhost is percent-encoded** into exactly one path segment, so a\n *   vhost containing `/` encodes to `%2F` and addresses one vhost rather than\n *   splitting into a bogus second segment.\n *\n * @example\n * buildRabbitMQConnectionUrl({ host: 'localhost', port: 5672, username: 'wildo', password: 'pw' });\n * // → 'amqp://wildo:pw@localhost:5672/'                (default vhost)\n *\n * buildRabbitMQConnectionUrl({ host: 'localhost', port: 5672, username: 'wildo', password: 'pw', vhost: 'wonder-todos' });\n * // → 'amqp://wildo:pw@localhost:5672/wonder-todos'    (per-app vhost)\n */\nexport function buildRabbitMQConnectionUrl(parts: RabbitMQConnectionUrlParts): string {\n  const { host, port, username, password, vhost } = parts;\n\n  // An empty path addresses the broker default vhost. Encoding the literal name\n  // `'/'` as `%2F` would ALSO address it, but emitting the empty path keeps this\n  // builder's default-case output identical to the pre-consolidation builders.\n  const vhostPath =\n    !vhost || vhost === DEFAULT_RABBITMQ_VHOST ? '' : encodeURIComponent(vhost);\n\n  return `amqp://${encodeURIComponent(username)}:${encodeURIComponent(password)}@${host}:${port}/${vhostPath}`;\n}\n"]}
+{"version":3,"file":"queues.shared.utils.js","sourceRoot":"","sources":["../../../src/queue/queues.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAG1E,+EAA+E;AAC/E,yBAAyB;AACzB,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,gBAAgB;IAC3B;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,cAAc,CACnB,KAAa,EACb,QAAgB,EAChB,OAAsB;QAEtB,MAAM,IAAI,GAAG,eAAe,KAAK,IAAI,QAAQ,EAAE,CAAC;QAChD,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,mBAAmB,CAAC,KAAa,EAAE,KAAa,EAAE,gBAAyB;QAChF,0EAA0E;QAC1E,oEAAoE;QACpE,oCAAoC;QACpC,EAAE;QACF,wEAAwE;QACxE,0EAA0E;QAC1E,0EAA0E;QAC1E,6EAA6E;QAC7E,sEAAsE;QACtE,EAAE;QACF,0EAA0E;QAC1E,2EAA2E;QAC3E,yBAAyB;QACzB,OAAO,gBAAgB;YACrB,CAAC,CAAC,eAAe,KAAK,IAAI,gBAAgB,IAAI,KAAK,EAAE;YACrD,CAAC,CAAC,eAAe,KAAK,IAAI,KAAK,EAAE,CAAC;IACtC,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,oBAAoB,CAAC,KAAa,EAAE,UAAkB;QAC3D,OAAO,eAAe,KAAK,WAAW,UAAU,EAAE,CAAC;IACrD,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,CAAC,mBAAmB,CAAC,eAAuB,EAAE,OAAe;QACjE,OAAO,GAAG,eAAe,UAAU,OAAO,EAAE,CAAC;IAC/C,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,wBAAwB,CAAC,KAAa,EAAE,UAAkB;QAC/D,OAAO,eAAe,KAAK,gBAAgB,UAAU,EAAE,CAAC;IAC1D,CAAC;IAED;;;;;;;;;;OAUG;IACH,MAAM,CAAC,sBAAsB,CAC3B,MAAc,EACd,QAAgB,EAChB,OAAsB;QAEtB,MAAM,IAAI,GAAG,wBAAwB,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC1D,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CAAC,SAAiB;QAMrC,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEnC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,2CAA2C;QAC3C,8DAA8D;QAC9D,EAAE;QACF,6EAA6E;QAC7E,2EAA2E;QAC3E,yEAAyE;QACzE,OAAO;QACP,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;YACzB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YAClC,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;gBACpB,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE;gBAClC,oEAAoE;gBACpE,sEAAsE;gBACtE,mEAAmE;gBACnE,OAAO,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;aACjD,CAAC;QACJ,CAAC;QAED,2BAA2B;QAC3B,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;YACzB,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;gBAC5B,uEAAuE;gBACvE,OAAO;oBACL,IAAI,EAAE,UAAU;oBAChB,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;oBACpB,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;oBAClB,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;iBAClB,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,wDAAwD;gBACxD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,IAAI,CAAC;gBAClC,OAAO;oBACL,IAAI,EAAE,KAAK;oBACX,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;oBACpB,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;oBAClB,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;iBAClB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,SAAiB;QACxC,OAAO,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,eAAe,CAAC,SAAiB;QACtC,OAAO,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,SAAiB;QACnC,OAAO,SAAS,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,gBAAgB,CAAC,SAAiB;QACvC,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACzE,OAAO,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AAED,+EAA+E;AAC/E,uBAAuB;AACvB,qDAAqD;AACrD,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAa,EACb,QAAgB,EAChB,OAAsB;IAEtB,OAAO,gBAAgB,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AACnE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAE,KAAa,EAAE,gBAAyB;IACzF,OAAO,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;AAC9E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa,EAAE,UAAkB;IACpE,OAAO,gBAAgB,CAAC,oBAAoB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,eAAuB,EAAE,OAAe;IAC1E,OAAO,gBAAgB,CAAC,mBAAmB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;AACxE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAa,EAAE,UAAkB;IACxE,OAAO,gBAAgB,CAAC,wBAAwB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAwB,EAAE,OAAe;IAC3E,IAAI,KAAa,CAAC;IAElB,QAAQ,MAAM,CAAC,WAAW,EAAE,CAAC;QAC3B,KAAK,uBAAuB,CAAC,KAAK;YAChC,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC;YAC3B,MAAM;QACR,KAAK,uBAAuB,CAAC,MAAM;YACjC,KAAK,GAAG,MAAM,CAAC,WAAW,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;YAC3C,MAAM;QACR,KAAK,uBAAuB,CAAC,WAAW,CAAC;QACzC;YACE,KAAK,GAAG,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAClD,MAAM;IACV,CAAC;IAED,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAwB;IAChE,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,UAAU,IAAI,mBAAmB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC7C,UAAU,IAAI,MAAM,CAAC,SAAS,CAAC;IACjC,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAyB1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAiC;IAC1E,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAExD,8EAA8E;IAC9E,+EAA+E;IAC/E,6EAA6E;IAC7E,MAAM,SAAS,GACb,CAAC,KAAK,IAAI,KAAK,KAAK,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAE9E,OAAO,UAAU,kBAAkB,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,SAAS,EAAE,CAAC;AAC/G,CAAC","sourcesContent":["/**\n * Queues Shared Utilities\n * \n * All queue-related utility classes consolidated in a single file.\n * Includes: queue naming, retry delay calculations (legacy functions).\n */\n\nimport { RetryPolicy_BackoffType } from '../errors/errors.shared.schemas';\nimport { QueueRetryConfig, QUEUE_RETRY_DEFAULTS, QueueVariant } from './queues.shared.schemas';\n\n// ============================================================================\n// QUEUE NAMING UTILITIES\n// ============================================================================\n\n/**\n * Utilities for building queue names.\n *\n * Mono-env architecture: each deployment has its own infra, so env is NOT\n * part of queue names. Uniqueness comes from appId alone.\n *\n * The `appId` here is the application's canonical identifier — its Mongo `_id`,\n * projected into the app runtime as env `APPLICATION_ID` and exposed by\n * `AppConfigurationService.applicationId`. It is NOT the human-readable\n * `appSlug`. Every producer AND consumer of a given app's queues must derive\n * the name from the same identifier; keying one side on the slug orphans the\n * queue (nothing consumes it) and a slug rename would silently orphan it again.\n *\n * Queue naming convention:\n * - App queues: wildo.queue.{appId}.{category}[.{variant}]\n * - Reply queues: wildo.reply.{appId}.{podId}\n * - Domain queues: wildo.queue.{appId}.domain.{domainName}\n * - Platform queues: wildo.queue.platform.{msName}.{category}[.{variant}]\n */\nexport class QueueNamingUtils {\n  /**\n   * Build queue name following the convention:\n   * wildo.queue.{appId}.{category}[.{variant}]\n   *\n   * @param appId - Canonical application identifier (the app's Mongo `_id` /\n   *   env `APPLICATION_ID`), NOT the human-readable slug. Producer and consumer\n   *   must agree on this identifier or the queue is orphaned.\n   * @param category - Queue category (operations, scheduled, callbacks, domain.*)\n   * @param variant - Optional variant (priority, deadletter)\n   * @returns Formatted queue name\n   *\n   * @example\n   * QueueNamingUtils.buildQueueName('6a08488438bc965729b8b9ff', 'operations')\n   * // => 'wildo.queue.6a08488438bc965729b8b9ff.operations'\n   */\n  static buildQueueName(\n    appId: string,\n    category: string,\n    variant?: QueueVariant\n  ): string {\n    const base = `wildo.queue.${appId}.${category}`;\n    return variant ? `${base}.${variant}` : base;\n  }\n\n  /**\n   * Build reply queue name for RPC pattern.\n   * Reply queues are exclusive, auto-delete, and transient.\n   * \n   * wildo.reply.{appId}.{podId}\n   */\n  static buildReplyQueueName(appId: string, podId: string, principalSegment?: string): string {\n    // `principalSegment` makes an RPC reply queue attributable to the RUNTIME\n    // that owns it, which is what lets a broker permission separate one\n    // runtime's replies from another's.\n    //\n    // Without it the name is `wildo.reply.<appId>.<podId>` and `podId` is a\n    // per-PROCESS token carrying no principal — so a minion's reply queue and\n    // the application backend's differ only by an opaque suffix, and no regex\n    // can admit one while refusing the other. Narrowing a minion's broker `read`\n    // therefore refused its OWN replies and crash-looped it (2026-08-12).\n    //\n    // OPTIONAL, and absent means the historical layout. Existing callers keep\n    // producing exactly the names they produce today; only a caller that knows\n    // its principal opts in.\n    return principalSegment\n      ? `wildo.reply.${appId}.${principalSegment}.${podId}`\n      : `wildo.reply.${appId}.${podId}`;\n  }\n\n  /**\n   * Build domain-specific queue name.\n   *\n   * wildo.queue.{appId}.domain.{domainName}\n   */\n  static buildDomainQueueName(appId: string, domainName: string): string {\n    return `wildo.queue.${appId}.domain.${domainName}`;\n  }\n\n  /**\n   * Build a delay (retry-hold) queue name for durable backoff.\n   *\n   * A delay queue holds a failed job for a fixed TTL, then dead-letters it back\n   * to its source queue for re-delivery. One queue exists PER distinct delay\n   * value so every message in it shares the same `x-message-ttl` — this avoids\n   * RabbitMQ's per-message-TTL head-of-line blocking (where a short-delay message\n   * would wait behind a longer-delay one ahead of it in the queue). The delay is\n   * embedded in the name, so the set of delay queues stays bounded by the (few)\n   * distinct backoff delays an app produces (`baseDelayMs × 2^attempt`, capped).\n   *\n   * `{sourceQueueName}.delay.{delayMs}`\n   *\n   * @param sourceQueueName - Full name of the queue the message returns to on expiry\n   * @param delayMs - Hold duration in ms (becomes the delay queue's `x-message-ttl`)\n   * @example\n   * QueueNamingUtils.buildDelayQueueName('wildo.queue.my-app.operations', 2000)\n   * // => 'wildo.queue.my-app.operations.delay.2000'\n   */\n  static buildDelayQueueName(sourceQueueName: string, delayMs: number): string {\n    return `${sourceQueueName}.delay.${delayMs}`;\n  }\n\n  /**\n   * Build minion-tick queue name (KD-12 of\n   * `.claude/plans/minions-and-workers-implementation.md`).\n   *\n   * `wildo.queue.{appId}.minion-tick.{minionName}`\n   *\n   * Each minion subscribes only to its own per-minion queue so the\n   * backend-api and the minion (which both connect to the same RabbitMQ\n   * vhost) do not compete on the shared `scheduled` queue. The publisher\n   * (`platform-crontabs-batches-manager`) routes `MINION_TICK` ticks to\n   * this per-minion queue; `SCHEDULED_CRON` ticks keep flowing to the\n   * shared `scheduled` queue (consumed by the backend-api executor).\n   */\n  static buildMinionTickQueueName(appId: string, minionName: string): string {\n    return `wildo.queue.${appId}.minion-tick.${minionName}`;\n  }\n\n  /**\n   * Build platform microservice queue name.\n   * Platform queues don't include environment as they're shared infrastructure.\n   * \n   * wildo.queue.platform.{msName}.{category}[.{variant}]\n   * \n   * @param msName - Microservice name\n   * @param category - Queue category\n   * @param variant - Optional variant\n   * @returns Formatted platform queue name\n   */\n  static buildPlatformQueueName(\n    msName: string,\n    category: string,\n    variant?: QueueVariant\n  ): string {\n    const base = `wildo.queue.platform.${msName}.${category}`;\n    return variant ? `${base}.${variant}` : base;\n  }\n\n  /**\n   * Parse a queue name to extract its components.\n   * \n   * @param queueName - Full queue name to parse\n   * @returns Parsed components or null if invalid format\n   */\n  static parseQueueName(queueName: string): {\n    type: 'app' | 'platform' | 'reply';\n    identifier: string;\n    category?: string;\n    variant?: string;\n  } | null {\n    const parts = queueName.split('.');\n    \n    if (parts.length < 3 || parts[0] !== 'wildo') {\n      return null;\n    }\n\n    // Reply queue: wildo.reply.{appId}.{podId}\n    //           or wildo.reply.{appId}.{principalSegment}.{podId}\n    //\n    // `category` stays the LAST segment in both layouts, so it remains the podId\n    // rather than silently becoming the principal for principal-scoped names —\n    // a caller reading `category` expecting a pod identity must keep getting\n    // one.\n    if (parts[1] === 'reply') {\n      if (parts.length < 4) return null;\n      return {\n        type: 'reply',\n        identifier: parts[2],\n        category: parts[parts.length - 1]!,\n        // Present only for the principal-scoped layout; `undefined` for the\n        // historical one rather than an empty string, so \"no principal in the\n        // name\" is distinguishable from \"a principal whose name is empty\".\n        variant: parts.length > 4 ? parts[3] : undefined,\n      };\n    }\n\n    // Queue: wildo.queue.{...}\n    if (parts[1] === 'queue') {\n      if (parts[2] === 'platform') {\n        // Platform queue: wildo.queue.platform.{msName}.{category}[.{variant}]\n        return {\n          type: 'platform',\n          identifier: parts[3],\n          category: parts[4],\n          variant: parts[5],\n        };\n      } else {\n        // App queue: wildo.queue.{appId}.{category}[.{variant}]\n        if (parts.length < 4) return null;\n        return {\n          type: 'app',\n          identifier: parts[2],\n          category: parts[3],\n          variant: parts[4],\n        };\n      }\n    }\n\n    return null;\n  }\n\n  /**\n   * Check if a queue name is a dead letter queue.\n   */\n  static isDeadLetterQueue(queueName: string): boolean {\n    return queueName.endsWith('.deadletter');\n  }\n\n  /**\n   * Check if a queue name is a priority queue.\n   */\n  static isPriorityQueue(queueName: string): boolean {\n    return queueName.endsWith('.priority');\n  }\n\n  /**\n   * Check if a queue name is a reply queue.\n   */\n  static isReplyQueue(queueName: string): boolean {\n    return queueName.startsWith('wildo.reply.');\n  }\n\n  /**\n   * Get the base queue name (without variant suffix).\n   * \n   * @param queueName - Full queue name\n   * @returns Base queue name without variant\n   */\n  static getBaseQueueName(queueName: string): string {\n    if (queueName.endsWith('.priority') || queueName.endsWith('.deadletter')) {\n      return queueName.substring(0, queueName.lastIndexOf('.'));\n    }\n    return queueName;\n  }\n}\n\n// ============================================================================\n// STANDALONE FUNCTIONS\n// Convenience wrappers around QueueNamingUtils class\n// ============================================================================\n\n/**\n * Build queue name following the convention.\n * wildo.queue.{appId}.{category}[.{variant}]\n */\nexport function buildQueueName(\n  appId: string,\n  category: string,\n  variant?: QueueVariant\n): string {\n  return QueueNamingUtils.buildQueueName(appId, category, variant);\n}\n\n/**\n * Build reply queue name for RPC pattern.\n * wildo.reply.{appId}.{podId}\n */\nexport function buildReplyQueueName(appId: string, podId: string, principalSegment?: string): string {\n  return QueueNamingUtils.buildReplyQueueName(appId, podId, principalSegment);\n}\n\n/**\n * Build domain queue name.\n * wildo.queue.{appId}.domain.{domainName}\n */\nexport function buildDomainQueueName(appId: string, domainName: string): string {\n  return QueueNamingUtils.buildDomainQueueName(appId, domainName);\n}\n\n/**\n * Build a delay (retry-hold) queue name for durable backoff.\n * {sourceQueueName}.delay.{delayMs}\n */\nexport function buildDelayQueueName(sourceQueueName: string, delayMs: number): string {\n  return QueueNamingUtils.buildDelayQueueName(sourceQueueName, delayMs);\n}\n\n/**\n * Build per-minion tick queue name (KD-12).\n * wildo.queue.{appId}.minion-tick.{minionName}\n */\nexport function buildMinionTickQueueName(appId: string, minionName: string): string {\n  return QueueNamingUtils.buildMinionTickQueueName(appId, minionName);\n}\n\n/**\n * Calculate retry delay based on policy and attempt number.\n * \n * @param config Retry configuration\n * @param attempt Current retry attempt (0-indexed)\n * @returns Delay in milliseconds (capped at maxDelayMs)\n */\nexport function calculateRetryDelay(config: QueueRetryConfig, attempt: number): number {\n  let delay: number;\n  \n  switch (config.retryPolicy) {\n    case RetryPolicy_BackoffType.FIXED:\n      delay = config.baseDelayMs;\n      break;\n    case RetryPolicy_BackoffType.LINEAR:\n      delay = config.baseDelayMs * (attempt + 1);\n      break;\n    case RetryPolicy_BackoffType.EXPONENTIAL:\n    default:\n      delay = config.baseDelayMs * Math.pow(2, attempt);\n      break;\n  }\n  \n  return Math.min(delay, config.maxDelayMs);\n}\n\n/**\n * Estimate retry duration assuming each retry takes exactly config.timeoutMs.\n * Excludes the initial attempt and broker waiting time. Worker execution is not\n * capped by timeoutMs; the legacy function name does not imply an enforced maximum.\n *\n * @param config Retry configuration\n * @returns Estimated retry duration in milliseconds under the stated assumption\n */\nexport function calculateMaxRetryDuration(config: QueueRetryConfig): number {\n  let totalDelay = 0;\n  for (let i = 0; i < config.maxRetries; i++) {\n    totalDelay += calculateRetryDelay(config, i);\n    totalDelay += config.timeoutMs;\n  }\n  return totalDelay;\n}\n\n// ============================================================================\n// BROKER CONNECTION URL\n// ============================================================================\n\n/**\n * The RabbitMQ default virtual host, whose NAME is the single character `/`.\n *\n * Every broker ships with it, and an app that authors no\n * `backingServices.rabbitmq.vhost` lands here (isolation then comes from the\n * per-app user's permission regex rather than from a dedicated vhost).\n *\n * Note the deliberate ambiguity this constant resolves: `/` is BOTH the name of\n * the default vhost AND the AMQP URI path separator. Conflating the two is what\n * broke the two pre-consolidation URL builders — see\n * {@link buildRabbitMQConnectionUrl}.\n */\nexport const DEFAULT_RABBITMQ_VHOST = '/';\n\n/** Connection inputs for {@link buildRabbitMQConnectionUrl}. */\nexport interface RabbitMQConnectionUrlParts {\n  /** Broker hostname, e.g. `'localhost'`. */\n  host: string;\n  /** Broker AMQP port, e.g. `5672`. */\n  port: number;\n  /** Per-app broker username (minted by the infra provider module). */\n  username: string;\n  /** Per-app broker password (minted by the infra provider module). */\n  password: string;\n  /**\n   * Virtual host **name** — e.g. `'wonder-todos'`, with NO leading slash. This\n   * is the value authored at `backingServices.rabbitmq.vhost` in\n   * `wildo.infra.<envName>.config.ts` and the same name the infra provider\n   * passes to `ensureVhost()` (`PUT /api/vhosts/{name}`), so the string that\n   * names the vhost on the broker is the string that appears here.\n   *\n   * Omit it — or pass {@link DEFAULT_RABBITMQ_VHOST} — to connect to the broker\n   * default vhost.\n   */\n  vhost?: string;\n}\n\n/**\n * Assemble the AMQP connection URL for a broker + vhost + credential triple.\n *\n * This is the SINGLE owner of AMQP URL assembly across the monorepo. It exists\n * because the URL was previously built ad-hoc at three call sites with three\n * different conventions, two of which were wrong in the same way — they\n * interpolated the vhost directly after the port with no separator:\n *\n * ```ts\n * `amqp://${user}:${pass}@${host}:${port}${vhost || '/'}`   // ← the old, broken form\n * ```\n *\n * That form only ever worked because the `'/'` fallback doubles as the URI path\n * separator, so the default case accidentally produced a well-formed URL with an\n * empty path. The moment a real vhost was threaded through it produced\n * `amqp://…@localhost:5672wonder-todos` — a malformed authority that fails to\n * connect. A silent misconfiguration (every app quietly sharing the default\n * vhost) was therefore load-bearing for the URL builder not crashing, which is\n * why the two defects had to be fixed together.\n *\n * The encoding rules, per the AMQP URI spec (RFC 3986 userinfo + path):\n *\n * - **Userinfo is percent-encoded.** Minted passwords are random and may contain\n *   `@`, `:` or `/`, any of which would otherwise terminate the userinfo or\n *   authority early and silently retarget the connection.\n * - **The path separator is unconditional.** The `/` after the port is always\n *   emitted; it is URI syntax, never vhost data.\n * - **An EMPTY path means the default vhost.** So both an omitted vhost and the\n *   literal default-vhost name `'/'` collapse to `amqp://host:port/`. This is\n *   byte-for-byte what the previous builders emitted for the default case, so\n *   consolidating cannot regress a currently-connected deployment.\n * - **A named vhost is percent-encoded** into exactly one path segment, so a\n *   vhost containing `/` encodes to `%2F` and addresses one vhost rather than\n *   splitting into a bogus second segment.\n *\n * @example\n * buildRabbitMQConnectionUrl({ host: 'localhost', port: 5672, username: 'wildo', password: 'pw' });\n * // → 'amqp://wildo:pw@localhost:5672/'                (default vhost)\n *\n * buildRabbitMQConnectionUrl({ host: 'localhost', port: 5672, username: 'wildo', password: 'pw', vhost: 'wonder-todos' });\n * // → 'amqp://wildo:pw@localhost:5672/wonder-todos'    (per-app vhost)\n */\nexport function buildRabbitMQConnectionUrl(parts: RabbitMQConnectionUrlParts): string {\n  const { host, port, username, password, vhost } = parts;\n\n  // An empty path addresses the broker default vhost. Encoding the literal name\n  // `'/'` as `%2F` would ALSO address it, but emitting the empty path keeps this\n  // builder's default-case output identical to the pre-consolidation builders.\n  const vhostPath =\n    !vhost || vhost === DEFAULT_RABBITMQ_VHOST ? '' : encodeURIComponent(vhost);\n\n  return `amqp://${encodeURIComponent(username)}:${encodeURIComponent(password)}@${host}:${port}/${vhostPath}`;\n}\n"]}

package/dist/esm/queue/rabbitmq-queue-args.shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rabbitmq-queue-args.shared.d.ts","sourceRoot":"","sources":["../../../../src/queue/rabbitmq-queue-args.shared.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAC"}
+{"version":3,"file":"rabbitmq-queue-args.shared.d.ts","sourceRoot":"","sources":["../../../src/queue/rabbitmq-queue-args.shared.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAC"}

package/dist/esm/queue/rabbitmq-queue-args.shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"rabbitmq-queue-args.shared.js","sourceRoot":"","sources":["../../../../src/queue/rabbitmq-queue-args.shared.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,oBAAoB,EAAE,wBAAwB;IAC9C,uBAAuB,EAAE,2BAA2B;IACpD,WAAW,EAAE,eAAe;IAC5B,UAAU,EAAE,cAAc;CAClB,CAAC","sourcesContent":["/**\n * Canonical RabbitMQ queue argument keys.\n *\n * Single source of truth for AMQP queue arguments (x-*).\n * Used by RabbitMQ adapter when asserting queues.\n */\nexport const RabbitMQQueueArgKeys = {\n  DEAD_LETTER_EXCHANGE: 'x-dead-letter-exchange',\n  DEAD_LETTER_ROUTING_KEY: 'x-dead-letter-routing-key',\n  MESSAGE_TTL: 'x-message-ttl',\n  MAX_LENGTH: 'x-max-length',\n} as const;\n"]}
+{"version":3,"file":"rabbitmq-queue-args.shared.js","sourceRoot":"","sources":["../../../src/queue/rabbitmq-queue-args.shared.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,oBAAoB,EAAE,wBAAwB;IAC9C,uBAAuB,EAAE,2BAA2B;IACpD,WAAW,EAAE,eAAe;IAC5B,UAAU,EAAE,cAAc;CAClB,CAAC","sourcesContent":["/**\n * Canonical RabbitMQ queue argument keys.\n *\n * Single source of truth for AMQP queue arguments (x-*).\n * Used by RabbitMQ adapter when asserting queues.\n */\nexport const RabbitMQQueueArgKeys = {\n  DEAD_LETTER_EXCHANGE: 'x-dead-letter-exchange',\n  DEAD_LETTER_ROUTING_KEY: 'x-dead-letter-routing-key',\n  MESSAGE_TTL: 'x-message-ttl',\n  MAX_LENGTH: 'x-max-length',\n} as const;\n"]}

package/dist/esm/rag/rag-retrieval-health.shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rag-retrieval-health.shared.d.ts","sourceRoot":"","sources":["../../../../src/rag/rag-retrieval-health.shared.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,oBAAY,wBAAwB;IAClC,gFAAgF;IAChF,OAAO,YAAY;IACnB,2FAA2F;IAC3F,QAAQ,aAAa;IACrB,wFAAwF;IACxF,MAAM,WAAW;IACjB,0FAA0F;IAC1F,OAAO,YAAY;CACpB;AAED,4FAA4F;AAC5F,oBAAY,2BAA2B;IACrC,iFAAiF;IACjF,SAAS,cAAc;IACvB,yFAAyF;IACzF,cAAc,mBAAmB;IACjC,wFAAwF;IACxF,MAAM,WAAW;IACjB,4DAA4D;IAC5D,aAAa,kBAAkB;CAChC"}
+{"version":3,"file":"rag-retrieval-health.shared.d.ts","sourceRoot":"","sources":["../../../src/rag/rag-retrieval-health.shared.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,oBAAY,wBAAwB;IAClC,gFAAgF;IAChF,OAAO,YAAY;IACnB,2FAA2F;IAC3F,QAAQ,aAAa;IACrB,wFAAwF;IACxF,MAAM,WAAW;IACjB,0FAA0F;IAC1F,OAAO,YAAY;CACpB;AAED,4FAA4F;AAC5F,oBAAY,2BAA2B;IACrC,iFAAiF;IACjF,SAAS,cAAc;IACvB,yFAAyF;IACzF,cAAc,mBAAmB;IACjC,wFAAwF;IACxF,MAAM,WAAW;IACjB,4DAA4D;IAC5D,aAAa,kBAAkB;CAChC"}

package/dist/esm/rag/rag-retrieval-health.shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"rag-retrieval-health.shared.js","sourceRoot":"","sources":["../../../../src/rag/rag-retrieval-health.shared.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAN,IAAY,wBASX;AATD,WAAY,wBAAwB;IAClC,gFAAgF;IAChF,+CAAmB,CAAA;IACnB,2FAA2F;IAC3F,iDAAqB,CAAA;IACrB,wFAAwF;IACxF,6CAAiB,CAAA;IACjB,0FAA0F;IAC1F,+CAAmB,CAAA;AACrB,CAAC,EATW,wBAAwB,KAAxB,wBAAwB,QASnC;AAED,4FAA4F;AAC5F,MAAM,CAAN,IAAY,2BASX;AATD,WAAY,2BAA2B;IACrC,iFAAiF;IACjF,sDAAuB,CAAA;IACvB,yFAAyF;IACzF,gEAAiC,CAAA;IACjC,wFAAwF;IACxF,gDAAiB,CAAA;IACjB,4DAA4D;IAC5D,8DAA+B,CAAA;AACjC,CAAC,EATW,2BAA2B,KAA3B,2BAA2B,QAStC","sourcesContent":["/**\n * Search availability, separate from hit count, permissions and context budgets.\n * Shared by the engine result and application response schemas so projections cannot silently\n * rename a failure into a healthy empty result. No provider/database error text belongs here.\n */\nexport enum RagRetrievalSearchStatus {\n  /** All requested search arms completed; zero hits is a valid search outcome. */\n  HEALTHY = 'healthy',\n  /** Some requested arms or resource stores were unavailable; at least one arm completed. */\n  DEGRADED = 'degraded',\n  /** No usable search result: execution failed or every requested arm was unavailable. */\n  FAILED = 'failed',\n  /** No admitted corpus or no searchable query; does not establish absence of knowledge. */\n  NOT_RUN = 'not-run',\n}\n\n/** Query-vector preparation, independent of the search store's actual arm participation. */\nexport enum RagRetrievalEmbeddingStatus {\n  /** A query vector was produced; this does not certify vector-index readiness. */\n  GENERATED = 'generated',\n  /** No embeddings provider is configured. Healthy lexical-only retrieval is supported. */\n  NOT_CONFIGURED = 'not-configured',\n  /** A configured provider or its binding failed; lexical retrieval may still succeed. */\n  FAILED = 'failed',\n  /** No admitted corpus required query-vector preparation. */\n  NOT_REQUESTED = 'not-requested',\n}\n"]}
+{"version":3,"file":"rag-retrieval-health.shared.js","sourceRoot":"","sources":["../../../src/rag/rag-retrieval-health.shared.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAN,IAAY,wBASX;AATD,WAAY,wBAAwB;IAClC,gFAAgF;IAChF,+CAAmB,CAAA;IACnB,2FAA2F;IAC3F,iDAAqB,CAAA;IACrB,wFAAwF;IACxF,6CAAiB,CAAA;IACjB,0FAA0F;IAC1F,+CAAmB,CAAA;AACrB,CAAC,EATW,wBAAwB,KAAxB,wBAAwB,QASnC;AAED,4FAA4F;AAC5F,MAAM,CAAN,IAAY,2BASX;AATD,WAAY,2BAA2B;IACrC,iFAAiF;IACjF,sDAAuB,CAAA;IACvB,yFAAyF;IACzF,gEAAiC,CAAA;IACjC,wFAAwF;IACxF,gDAAiB,CAAA;IACjB,4DAA4D;IAC5D,8DAA+B,CAAA;AACjC,CAAC,EATW,2BAA2B,KAA3B,2BAA2B,QAStC","sourcesContent":["/**\n * Search availability, separate from hit count, permissions and context budgets.\n * Shared by the engine result and application response schemas so projections cannot silently\n * rename a failure into a healthy empty result. No provider/database error text belongs here.\n */\nexport enum RagRetrievalSearchStatus {\n  /** All requested search arms completed; zero hits is a valid search outcome. */\n  HEALTHY = 'healthy',\n  /** Some requested arms or resource stores were unavailable; at least one arm completed. */\n  DEGRADED = 'degraded',\n  /** No usable search result: execution failed or every requested arm was unavailable. */\n  FAILED = 'failed',\n  /** No admitted corpus or no searchable query; does not establish absence of knowledge. */\n  NOT_RUN = 'not-run',\n}\n\n/** Query-vector preparation, independent of the search store's actual arm participation. */\nexport enum RagRetrievalEmbeddingStatus {\n  /** A query vector was produced; this does not certify vector-index readiness. */\n  GENERATED = 'generated',\n  /** No embeddings provider is configured. Healthy lexical-only retrieval is supported. */\n  NOT_CONFIGURED = 'not-configured',\n  /** A configured provider or its binding failed; lexical retrieval may still succeed. */\n  FAILED = 'failed',\n  /** No admitted corpus required query-vector preparation. */\n  NOT_REQUESTED = 'not-requested',\n}\n"]}

package/dist/esm/requests/header-keys.shared.d.ts

@@ -58,6 +58,12 @@ export declare const WildoHeaderKeys: {
      */
     readonly CLIENT_INSTANCE_ID: "x-client-instance-id";
     readonly REAUTH_TOKEN: "x-reauth-token";
+    /**
+     * The answer to a submission challenge — a captcha vendor's token or the engine's proof of work —
+     * JSON-encoded (`encodeSubmissionChallengeResponse`). Read by a public form's backend operation that
+     * requires a challenge (`POST /inbound-contacts` when the application declares a captcha provider).
+     */
+    readonly SUBMISSION_CHALLENGE_RESPONSE: "x-submission-challenge-response";
     /**
      * The caller's identity for ONE intended mutation, so a retry receives the first request's outcome instead of running
      * again. Taken only by an operation variant that declares `idempotencyKey`; see `idempotency-key.shared.ts` for the

package/dist/esm/requests/header-keys.shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"header-keys.shared.d.ts","sourceRoot":"","sources":["../../../../src/requests/header-keys.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;IAqC1B;;;;;;;;;;;OAWG;;;;;;;;;;;IAyBH;;;;;OAKG;;;IAOH;;;;OAIG;;;;;;;;;;;;;;CAoCK,CAAC"}
+{"version":3,"file":"header-keys.shared.d.ts","sourceRoot":"","sources":["../../../src/requests/header-keys.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;IAqC1B;;;;;;;;;;;OAWG;;;;;;;;;;;IAyBH;;;;;OAKG;;;IAOH;;;;OAIG;;IAIH;;;;OAIG;;;;;;;;;;;;;;CAoCK,CAAC"}

package/dist/esm/requests/header-keys.shared.js

@@ -78,6 +78,13 @@ export const WildoHeaderKeys = {
     CLIENT_INSTANCE_ID: 'x-client-instance-id',
     // ── Step-up re-authentication ──────────────────────────────────────
     REAUTH_TOKEN: 'x-reauth-token',
+    // ── Public submission challenge (#1735) ────────────────────────────
+    /**
+     * The answer to a submission challenge — a captcha vendor's token or the engine's proof of work —
+     * JSON-encoded (`encodeSubmissionChallengeResponse`). Read by a public form's backend operation that
+     * requires a challenge (`POST /inbound-contacts` when the application declares a captcha provider).
+     */
+    SUBMISSION_CHALLENGE_RESPONSE: 'x-submission-challenge-response',
     // ── Request idempotency ────────────────────────────────────────────
     /**
      * The caller's identity for ONE intended mutation, so a retry receives the first request's outcome instead of running

package/dist/esm/requests/header-keys.shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"header-keys.shared.js","sourceRoot":"","sources":["../../../../src/requests/header-keys.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,sEAAsE;IACtE,aAAa,EAAE,eAAe;IAC9B,YAAY,EAAE,cAAc;IAC5B,cAAc,EAAE,gBAAgB;IAChC,MAAM,EAAE,QAAQ;IAChB,UAAU,EAAE,YAAY;IACxB,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;IACpB,aAAa,EAAE,eAAe;IAC9B,aAAa,EAAE,eAAe;IAC9B,MAAM,EAAE,QAAQ;IAChB,QAAQ,EAAE,UAAU;IACpB,gBAAgB,EAAE,kBAAkB;IACpC,IAAI,EAAE,MAAM;IAEZ,uEAAuE;IACvE,eAAe,EAAE,iBAAiB;IAElC,uEAAuE;IACvE,uEAAuE;IACvE,uEAAuE;IACvE,gEAAgE;IAChE,sCAAsC;IACtC,oEAAoE;IACpE,mBAAmB,EAAE,2BAA2B;IAEhD,sEAAsE;IACtE,UAAU,EAAE,cAAc;IAC1B,cAAc,EAAE,kBAAkB;IAElC,sEAAsE;IACtE,eAAe,EAAE,mBAAmB;IACpC,OAAO,EAAE,WAAW;IACpB,eAAe,EAAE,mBAAmB;IACpC,gBAAgB,EAAE,oBAAoB;IAEtC;;;;;;;;;;;OAWG;IACH,uBAAuB,EAAE,iCAAiC;IAE1D,sEAAsE;IACtE,eAAe,EAAE,mBAAmB;IACpC,aAAa,EAAE,iBAAiB;IAEhC,sEAAsE;IACtE,wFAAwF;IACxF,wFAAwF;IACxF,iFAAiF;IACjF,gFAAgF;IAChF,cAAc,EAAE,kBAAkB;IAElC,sEAAsE;IACtE,gBAAgB,EAAE,mBAAmB;IACrC,oBAAoB,EAAE,uBAAuB;IAC7C,gBAAgB,EAAE,mBAAmB;IAErC,sEAAsE;IACtE,OAAO,EAAE,WAAW;IACpB,WAAW,EAAE,eAAe;IAE5B,sEAAsE;IACtE,qBAAqB,EAAE,yBAAyB;IAChD;;;;;OAKG;IACH,kBAAkB,EAAE,sBAAsB;IAE1C,sEAAsE;IACtE,YAAY,EAAE,gBAAgB;IAE9B,sEAAsE;IACtE;;;;OAIG;IACH,eAAe,EAAE,iBAAiB;IAElC,sEAAsE;IACtE,eAAe,EAAE,mBAAmB;IAEpC,sEAAsE;IACtE,sBAAsB,EAAE,0BAA0B;IAClD,iBAAiB,EAAE,qBAAqB;IACxC,uBAAuB,EAAE,2BAA2B;IAEpD,sEAAsE;IACtE,oEAAoE;IACpE,+DAA+D;IAC/D,oEAAoE;IACpE,mEAAmE;IACnE,yCAAyC;IACzC,oEAAoE;IACpE,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,oCAAoC;IACpC,YAAY,EAAE,gBAAgB;IAE9B,sEAAsE;IACtE,gBAAgB,EAAE,oBAAoB;IACtC,yBAAyB,EAAE,6BAA6B;IAExD,uEAAuE;IACvE,aAAa,EAAE,eAAe;IAE9B,sEAAsE;IACtE,aAAa,EAAE,iBAAiB;IAChC,eAAe,EAAE,mBAAmB;IACpC,cAAc,EAAE,kBAAkB;IAClC,OAAO,EAAE,WAAW;CACZ,CAAC","sourcesContent":["/**\n * Canonical HTTP header keys for the entire Wildo platform.\n *\n * Single source of truth — imported by backend, frontend, platform, and CLI.\n * All values are lowercase (HTTP/2 canonical form). Express normalizes\n * incoming headers to lowercase automatically, so these work for both\n * reading (req.headers[key]) and writing (res.setHeader(key, value)).\n */\nexport const WildoHeaderKeys = {\n  // ── Standard HTTP ──────────────────────────────────────────────────\n  AUTHORIZATION: 'authorization',\n  CONTENT_TYPE: 'content-type',\n  CONTENT_LENGTH: 'content-length',\n  ACCEPT: 'accept',\n  USER_AGENT: 'user-agent',\n  ETAG: 'etag',\n  IF_MATCH: 'if-match',\n  LAST_MODIFIED: 'last-modified',\n  CACHE_CONTROL: 'cache-control',\n  ORIGIN: 'origin',\n  LOCATION: 'location',\n  WWW_AUTHENTICATE: 'www-authenticate',\n  HOST: 'host',\n\n  // ── SIEM webhook (HMAC signature) ───────────────────────────────────\n  X_SIGNATURE_256: 'x-signature-256',\n\n  // ── M2M outbound webhook (JWT signature) ────────────────────────────\n  // Carries the compact-serialized JWT (header.payload.signature) signed\n  // with `JwtPrivateKeys.APPLICATION_WEBHOOK`. Embeds `bodyHash` (sha256\n  // hex of the POST body) as a claim so consumers can verify both\n  // identity AND payload integrity. See\n  // `notifications/webhooks/outbound/` in saas-backend-lib (Phase 3).\n  X_WEBHOOK_SIGNATURE: 'x-wildo-webhook-signature',\n\n  // ── Service identity ───────────────────────────────────────────────\n  SERVICE_ID: 'x-service-id',\n  APPLICATION_ID: 'x-application-id',\n\n  // ── Authentication ─────────────────────────────────────────────────\n  PLATFORM_SECRET: 'x-platform-secret',\n  API_KEY: 'x-api-key',\n  ORGANIZATION_ID: 'x-organization-id',\n  LIFECYCLE_SECRET: 'x-lifecycle-secret',\n\n  /**\n   * A short-lived attestation, MINTED BY apps-manager, that the bearer is one\n   * named runtime principal (`minion:<name>`) of one application.\n   *\n   * A separate header from {@link WildoHeaderKeys.AUTHORIZATION} on purpose. The\n   * bearer is not a platform service and must not present itself through\n   * `SERVICE_ID`, and it is not the application backend either — an application\n   * JWT is signed with a key EVERY runtime of that application holds, so a claim\n   * carried there could name any sibling. This header's token is signed by\n   * apps-manager, which is the only party that learns the principal from the\n   * secret PRESENTED rather than from anything the caller asserts.\n   */\n  RUNTIME_PRINCIPAL_TOKEN: 'x-wildo-runtime-principal-token',\n\n  // ── Target application (cross-app operations) ──────────────────────\n  TARGET_APP_SLUG: 'x-target-app-slug',\n  TARGET_APP_ID: 'x-target-app-id',\n\n  // ── Observability ──────────────────────────────────────────────────\n  // The canonical per-request identifier carried across every service hop. The receiver's\n  // `setupRequestContext` ingests it into the request-scoped ALS frame, so the downstream\n  // request's EC, logs and audit all share one correlationId. (Replaced the former\n  // `x-request-uuid`, which was set on the platform channel but never read back.)\n  CORRELATION_ID: 'x-correlation-id',\n\n  // ── Rate limiting (response) ───────────────────────────────────────\n  RATE_LIMIT_LIMIT: 'x-ratelimit-limit',\n  RATE_LIMIT_REMAINING: 'x-ratelimit-remaining',\n  RATE_LIMIT_RESET: 'x-ratelimit-reset',\n\n  // ── File transfer (gateway) ────────────────────────────────────────\n  FILE_ID: 'x-file-id',\n  STORAGE_KEY: 'x-storage-key',\n\n  // ── Frontend originator ────────────────────────────────────────────\n  FRONTEND_SERVICE_NAME: 'x-frontend-service-name',\n  /**\n   * Which browser/device INSTALL issued the request. Sent ONLY when the application authored a\n   * non-`DISABLED` `compliance.clientInstanceIdScope`, and INGESTED only under that same policy —\n   * the backend fails closed, so an unopted application records nothing even if a client sends it.\n   * See `ClientInstanceIdScope` for the privacy reasoning.\n   */\n  CLIENT_INSTANCE_ID: 'x-client-instance-id',\n\n  // ── Step-up re-authentication ──────────────────────────────────────\n  REAUTH_TOKEN: 'x-reauth-token',\n\n  // ── Request idempotency ────────────────────────────────────────────\n  /**\n   * The caller's identity for ONE intended mutation, so a retry receives the first request's outcome instead of running\n   * again. Taken only by an operation variant that declares `idempotencyKey`; see `idempotency-key.shared.ts` for the\n   * value syntax, the bounds and the refusals. Standard name, not `x-`-prefixed: it is the IETF httpapi draft's header.\n   */\n  IDEMPOTENCY_KEY: 'idempotency-key',\n\n  // ── MFA enrollment ─────────────────────────────────────────────────\n  AUTH_SESSION_ID: 'x-auth-session-id',\n\n  // ── Anonymous sessions (W7.3a) ─────────────────────────────────────\n  ANONYMOUS_SESSION_INIT: 'x-anonymous-session-init',\n  ANONYMOUS_SESSION: 'x-anonymous-session',\n  ANONYMOUS_SESSION_TOKEN: 'x-anonymous-session-token',\n\n  // ── Marketing site first-touch attribution (Phase 0.5, Q-D=β) ──────\n  // Sent by the marketing-site bootstrap on the very first request to\n  // the anonymous-session-init endpoint. Carries the path of the\n  // landing page (e.g. `/pricing`, `/blog/post-slug`) — distinct from\n  // `req.path` because the session-init endpoint URL is itself not a\n  // marketing landing page. Stored ONCE on\n  // `AnonymousUser.marketingMetadata.landingPath` (first-touch only).\n  // Carried in the engine CORS `allowedHeaders` floor (framework-universal),\n  // since it travels with `x-anonymous-session-init` on the same preflighted\n  // session-init request — see `engineAllowedHeaders` in saas-backend-lib's\n  // `http-server.backend.service.ts`.\n  LANDING_PATH: 'x-landing-path',\n\n  // ── Consumable tokens (W7.3b) ──────────────────────────────────────\n  CONSUMABLE_TOKEN: 'x-consumable-token',\n  CONSUMABLE_TOKEN_CONSUMED: 'x-consumable-token-consumed',\n\n  // ── CRDT time synchronization ───────────────────────────────────────\n  X_SERVER_TIME: 'x-server-time',\n\n  // ── Proxy headers ──────────────────────────────────────────────────\n  FORWARDED_FOR: 'x-forwarded-for',\n  FORWARDED_PROTO: 'x-forwarded-proto',\n  FORWARDED_HOST: 'x-forwarded-host',\n  REAL_IP: 'x-real-ip',\n} as const;\n"]}
+{"version":3,"file":"header-keys.shared.js","sourceRoot":"","sources":["../../../src/requests/header-keys.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,sEAAsE;IACtE,aAAa,EAAE,eAAe;IAC9B,YAAY,EAAE,cAAc;IAC5B,cAAc,EAAE,gBAAgB;IAChC,MAAM,EAAE,QAAQ;IAChB,UAAU,EAAE,YAAY;IACxB,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;IACpB,aAAa,EAAE,eAAe;IAC9B,aAAa,EAAE,eAAe;IAC9B,MAAM,EAAE,QAAQ;IAChB,QAAQ,EAAE,UAAU;IACpB,gBAAgB,EAAE,kBAAkB;IACpC,IAAI,EAAE,MAAM;IAEZ,uEAAuE;IACvE,eAAe,EAAE,iBAAiB;IAElC,uEAAuE;IACvE,uEAAuE;IACvE,uEAAuE;IACvE,gEAAgE;IAChE,sCAAsC;IACtC,oEAAoE;IACpE,mBAAmB,EAAE,2BAA2B;IAEhD,sEAAsE;IACtE,UAAU,EAAE,cAAc;IAC1B,cAAc,EAAE,kBAAkB;IAElC,sEAAsE;IACtE,eAAe,EAAE,mBAAmB;IACpC,OAAO,EAAE,WAAW;IACpB,eAAe,EAAE,mBAAmB;IACpC,gBAAgB,EAAE,oBAAoB;IAEtC;;;;;;;;;;;OAWG;IACH,uBAAuB,EAAE,iCAAiC;IAE1D,sEAAsE;IACtE,eAAe,EAAE,mBAAmB;IACpC,aAAa,EAAE,iBAAiB;IAEhC,sEAAsE;IACtE,wFAAwF;IACxF,wFAAwF;IACxF,iFAAiF;IACjF,gFAAgF;IAChF,cAAc,EAAE,kBAAkB;IAElC,sEAAsE;IACtE,gBAAgB,EAAE,mBAAmB;IACrC,oBAAoB,EAAE,uBAAuB;IAC7C,gBAAgB,EAAE,mBAAmB;IAErC,sEAAsE;IACtE,OAAO,EAAE,WAAW;IACpB,WAAW,EAAE,eAAe;IAE5B,sEAAsE;IACtE,qBAAqB,EAAE,yBAAyB;IAChD;;;;;OAKG;IACH,kBAAkB,EAAE,sBAAsB;IAE1C,sEAAsE;IACtE,YAAY,EAAE,gBAAgB;IAE9B,sEAAsE;IACtE;;;;OAIG;IACH,6BAA6B,EAAE,iCAAiC;IAEhE,sEAAsE;IACtE;;;;OAIG;IACH,eAAe,EAAE,iBAAiB;IAElC,sEAAsE;IACtE,eAAe,EAAE,mBAAmB;IAEpC,sEAAsE;IACtE,sBAAsB,EAAE,0BAA0B;IAClD,iBAAiB,EAAE,qBAAqB;IACxC,uBAAuB,EAAE,2BAA2B;IAEpD,sEAAsE;IACtE,oEAAoE;IACpE,+DAA+D;IAC/D,oEAAoE;IACpE,mEAAmE;IACnE,yCAAyC;IACzC,oEAAoE;IACpE,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,oCAAoC;IACpC,YAAY,EAAE,gBAAgB;IAE9B,sEAAsE;IACtE,gBAAgB,EAAE,oBAAoB;IACtC,yBAAyB,EAAE,6BAA6B;IAExD,uEAAuE;IACvE,aAAa,EAAE,eAAe;IAE9B,sEAAsE;IACtE,aAAa,EAAE,iBAAiB;IAChC,eAAe,EAAE,mBAAmB;IACpC,cAAc,EAAE,kBAAkB;IAClC,OAAO,EAAE,WAAW;CACZ,CAAC","sourcesContent":["/**\n * Canonical HTTP header keys for the entire Wildo platform.\n *\n * Single source of truth — imported by backend, frontend, platform, and CLI.\n * All values are lowercase (HTTP/2 canonical form). Express normalizes\n * incoming headers to lowercase automatically, so these work for both\n * reading (req.headers[key]) and writing (res.setHeader(key, value)).\n */\nexport const WildoHeaderKeys = {\n  // ── Standard HTTP ──────────────────────────────────────────────────\n  AUTHORIZATION: 'authorization',\n  CONTENT_TYPE: 'content-type',\n  CONTENT_LENGTH: 'content-length',\n  ACCEPT: 'accept',\n  USER_AGENT: 'user-agent',\n  ETAG: 'etag',\n  IF_MATCH: 'if-match',\n  LAST_MODIFIED: 'last-modified',\n  CACHE_CONTROL: 'cache-control',\n  ORIGIN: 'origin',\n  LOCATION: 'location',\n  WWW_AUTHENTICATE: 'www-authenticate',\n  HOST: 'host',\n\n  // ── SIEM webhook (HMAC signature) ───────────────────────────────────\n  X_SIGNATURE_256: 'x-signature-256',\n\n  // ── M2M outbound webhook (JWT signature) ────────────────────────────\n  // Carries the compact-serialized JWT (header.payload.signature) signed\n  // with `JwtPrivateKeys.APPLICATION_WEBHOOK`. Embeds `bodyHash` (sha256\n  // hex of the POST body) as a claim so consumers can verify both\n  // identity AND payload integrity. See\n  // `notifications/webhooks/outbound/` in saas-backend-lib (Phase 3).\n  X_WEBHOOK_SIGNATURE: 'x-wildo-webhook-signature',\n\n  // ── Service identity ───────────────────────────────────────────────\n  SERVICE_ID: 'x-service-id',\n  APPLICATION_ID: 'x-application-id',\n\n  // ── Authentication ─────────────────────────────────────────────────\n  PLATFORM_SECRET: 'x-platform-secret',\n  API_KEY: 'x-api-key',\n  ORGANIZATION_ID: 'x-organization-id',\n  LIFECYCLE_SECRET: 'x-lifecycle-secret',\n\n  /**\n   * A short-lived attestation, MINTED BY apps-manager, that the bearer is one\n   * named runtime principal (`minion:<name>`) of one application.\n   *\n   * A separate header from {@link WildoHeaderKeys.AUTHORIZATION} on purpose. The\n   * bearer is not a platform service and must not present itself through\n   * `SERVICE_ID`, and it is not the application backend either — an application\n   * JWT is signed with a key EVERY runtime of that application holds, so a claim\n   * carried there could name any sibling. This header's token is signed by\n   * apps-manager, which is the only party that learns the principal from the\n   * secret PRESENTED rather than from anything the caller asserts.\n   */\n  RUNTIME_PRINCIPAL_TOKEN: 'x-wildo-runtime-principal-token',\n\n  // ── Target application (cross-app operations) ──────────────────────\n  TARGET_APP_SLUG: 'x-target-app-slug',\n  TARGET_APP_ID: 'x-target-app-id',\n\n  // ── Observability ──────────────────────────────────────────────────\n  // The canonical per-request identifier carried across every service hop. The receiver's\n  // `setupRequestContext` ingests it into the request-scoped ALS frame, so the downstream\n  // request's EC, logs and audit all share one correlationId. (Replaced the former\n  // `x-request-uuid`, which was set on the platform channel but never read back.)\n  CORRELATION_ID: 'x-correlation-id',\n\n  // ── Rate limiting (response) ───────────────────────────────────────\n  RATE_LIMIT_LIMIT: 'x-ratelimit-limit',\n  RATE_LIMIT_REMAINING: 'x-ratelimit-remaining',\n  RATE_LIMIT_RESET: 'x-ratelimit-reset',\n\n  // ── File transfer (gateway) ────────────────────────────────────────\n  FILE_ID: 'x-file-id',\n  STORAGE_KEY: 'x-storage-key',\n\n  // ── Frontend originator ────────────────────────────────────────────\n  FRONTEND_SERVICE_NAME: 'x-frontend-service-name',\n  /**\n   * Which browser/device INSTALL issued the request. Sent ONLY when the application authored a\n   * non-`DISABLED` `compliance.clientInstanceIdScope`, and INGESTED only under that same policy —\n   * the backend fails closed, so an unopted application records nothing even if a client sends it.\n   * See `ClientInstanceIdScope` for the privacy reasoning.\n   */\n  CLIENT_INSTANCE_ID: 'x-client-instance-id',\n\n  // ── Step-up re-authentication ──────────────────────────────────────\n  REAUTH_TOKEN: 'x-reauth-token',\n\n  // ── Public submission challenge (#1735) ────────────────────────────\n  /**\n   * The answer to a submission challenge — a captcha vendor's token or the engine's proof of work —\n   * JSON-encoded (`encodeSubmissionChallengeResponse`). Read by a public form's backend operation that\n   * requires a challenge (`POST /inbound-contacts` when the application declares a captcha provider).\n   */\n  SUBMISSION_CHALLENGE_RESPONSE: 'x-submission-challenge-response',\n\n  // ── Request idempotency ────────────────────────────────────────────\n  /**\n   * The caller's identity for ONE intended mutation, so a retry receives the first request's outcome instead of running\n   * again. Taken only by an operation variant that declares `idempotencyKey`; see `idempotency-key.shared.ts` for the\n   * value syntax, the bounds and the refusals. Standard name, not `x-`-prefixed: it is the IETF httpapi draft's header.\n   */\n  IDEMPOTENCY_KEY: 'idempotency-key',\n\n  // ── MFA enrollment ─────────────────────────────────────────────────\n  AUTH_SESSION_ID: 'x-auth-session-id',\n\n  // ── Anonymous sessions (W7.3a) ─────────────────────────────────────\n  ANONYMOUS_SESSION_INIT: 'x-anonymous-session-init',\n  ANONYMOUS_SESSION: 'x-anonymous-session',\n  ANONYMOUS_SESSION_TOKEN: 'x-anonymous-session-token',\n\n  // ── Marketing site first-touch attribution (Phase 0.5, Q-D=β) ──────\n  // Sent by the marketing-site bootstrap on the very first request to\n  // the anonymous-session-init endpoint. Carries the path of the\n  // landing page (e.g. `/pricing`, `/blog/post-slug`) — distinct from\n  // `req.path` because the session-init endpoint URL is itself not a\n  // marketing landing page. Stored ONCE on\n  // `AnonymousUser.marketingMetadata.landingPath` (first-touch only).\n  // Carried in the engine CORS `allowedHeaders` floor (framework-universal),\n  // since it travels with `x-anonymous-session-init` on the same preflighted\n  // session-init request — see `engineAllowedHeaders` in saas-backend-lib's\n  // `http-server.backend.service.ts`.\n  LANDING_PATH: 'x-landing-path',\n\n  // ── Consumable tokens (W7.3b) ──────────────────────────────────────\n  CONSUMABLE_TOKEN: 'x-consumable-token',\n  CONSUMABLE_TOKEN_CONSUMED: 'x-consumable-token-consumed',\n\n  // ── CRDT time synchronization ───────────────────────────────────────\n  X_SERVER_TIME: 'x-server-time',\n\n  // ── Proxy headers ──────────────────────────────────────────────────\n  FORWARDED_FOR: 'x-forwarded-for',\n  FORWARDED_PROTO: 'x-forwarded-proto',\n  FORWARDED_HOST: 'x-forwarded-host',\n  REAL_IP: 'x-real-ip',\n} as const;\n"]}

package/dist/esm/requests/http-requests.shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-requests.shared.d.ts","sourceRoot":"","sources":["../../../../src/requests/http-requests.shared.ts"],"names":[],"mappings":"AAEA,oBAAY,UAAU;IACpB,GAAG,QAAQ;IACX,IAAI,SAAS;IACb,GAAG,QAAQ;IACX,KAAK,UAAU;IACf,MAAM,WAAW;IACjB,OAAO,YAAY;CACpB;AAED,oBAAY,cAAc;IACxB,EAAE,MAAM;IACR,OAAO,MAAM;IACb,QAAQ,MAAM;IACd,UAAU,MAAM;IAChB,WAAW,MAAM;IACjB,YAAY,MAAM;IAClB,SAAS,MAAM;IACf,SAAS,MAAM;IACf,kBAAkB,MAAM;IACxB,QAAQ,MAAM;IACd,iBAAiB,MAAM;IACvB,oBAAoB,MAAM;IAC1B,iBAAiB,MAAM;IACvB,qBAAqB,MAAM;IAC3B,WAAW,MAAM;IACjB,mBAAmB,MAAM;IACzB,eAAe,MAAM;CACtB;AAGD,oBAAY,eAAe;IACzB,IAAI,qBAAqB;IACzB,SAAS,wBAAwB;IACjC,IAAI,6BAA6B;IACjC,IAAI,eAAe;IACnB,IAAI,cAAc;IAClB,GAAG,oBAAoB;IACvB,GAAG,aAAa;IAChB,GAAG,oBAAoB;CACxB"}
+{"version":3,"file":"http-requests.shared.d.ts","sourceRoot":"","sources":["../../../src/requests/http-requests.shared.ts"],"names":[],"mappings":"AAEA,oBAAY,UAAU;IACpB,GAAG,QAAQ;IACX,IAAI,SAAS;IACb,GAAG,QAAQ;IACX,KAAK,UAAU;IACf,MAAM,WAAW;IACjB,OAAO,YAAY;CACpB;AAED,oBAAY,cAAc;IACxB,EAAE,MAAM;IACR,OAAO,MAAM;IACb,QAAQ,MAAM;IACd,UAAU,MAAM;IAChB,WAAW,MAAM;IACjB,YAAY,MAAM;IAClB,SAAS,MAAM;IACf,SAAS,MAAM;IACf,kBAAkB,MAAM;IACxB,QAAQ,MAAM;IACd,iBAAiB,MAAM;IACvB,oBAAoB,MAAM;IAC1B,iBAAiB,MAAM;IACvB,qBAAqB,MAAM;IAC3B,WAAW,MAAM;IACjB,mBAAmB,MAAM;IACzB,eAAe,MAAM;CACtB;AAGD,oBAAY,eAAe;IACzB,IAAI,qBAAqB;IACzB,SAAS,wBAAwB;IACjC,IAAI,6BAA6B;IACjC,IAAI,eAAe;IACnB,IAAI,cAAc;IAClB,GAAG,oBAAoB;IACvB,GAAG,aAAa;IAChB,GAAG,oBAAoB;CACxB"}

package/dist/esm/requests/http-requests.shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"http-requests.shared.js","sourceRoot":"","sources":["../../../../src/requests/http-requests.shared.ts"],"names":[],"mappings":"AAEA,MAAM,CAAN,IAAY,UAOX;AAPD,WAAY,UAAU;IACpB,yBAAW,CAAA;IACX,2BAAa,CAAA;IACb,yBAAW,CAAA;IACX,6BAAe,CAAA;IACf,+BAAiB,CAAA;IACjB,iCAAmB,CAAA;AACrB,CAAC,EAPW,UAAU,KAAV,UAAU,QAOrB;AAED,MAAM,CAAN,IAAY,cAkBX;AAlBD,WAAY,cAAc;IACxB,iDAAQ,CAAA;IACR,2DAAa,CAAA;IACb,6DAAc,CAAA;IACd,iEAAgB,CAAA;IAChB,mEAAiB,CAAA;IACjB,qEAAkB,CAAA;IAClB,+DAAe,CAAA;IACf,+DAAe,CAAA;IACf,iFAAwB,CAAA;IACxB,6DAAc,CAAA;IACd,+EAAuB,CAAA;IACvB,qFAA0B,CAAA;IAC1B,+EAAuB,CAAA;IACvB,uFAA2B,CAAA;IAC3B,mEAAiB,CAAA;IACjB,mFAAyB,CAAA;IACzB,2EAAqB,CAAA;AACvB,CAAC,EAlBW,cAAc,KAAd,cAAc,QAkBzB;AAGD,MAAM,CAAN,IAAY,eASX;AATD,WAAY,eAAe;IACzB,4CAAyB,CAAA;IACzB,oDAAiC,CAAA;IACjC,oDAAiC,CAAA;IACjC,sCAAmB,CAAA;IACnB,qCAAkB,CAAA;IAClB,0CAAuB,CAAA;IACvB,mCAAgB,CAAA;IAChB,0CAAuB,CAAA;AACzB,CAAC,EATW,eAAe,KAAf,eAAe,QAS1B","sourcesContent":["\n\nexport enum HttpMethod {\n  GET = 'GET',\n  POST = 'POST',\n  PUT = 'PUT',\n  PATCH = 'PATCH',\n  DELETE = 'DELETE',\n  OPTIONS = 'OPTIONS',\n}\n\nexport enum HttpStatusCode {\n  OK = 200,\n  CREATED = 201,\n  ACCEPTED = 202,\n  NO_CONTENT = 204,\n  BAD_REQUEST = 400,\n  UNAUTHORIZED = 401,\n  FORBIDDEN = 403,\n  NOT_FOUND = 404,\n  METHOD_NOT_ALLOWED = 405,\n  CONFLICT = 409,\n  PAYLOAD_TOO_LARGE = 413,\n  UNPROCESSABLE_ENTITY = 422,\n  TOO_MANY_REQUESTS = 429,\n  INTERNAL_SERVER_ERROR = 500,\n  BAD_GATEWAY = 502,\n  SERVICE_UNAVAILABLE = 503,\n  GATEWAY_TIMEOUT = 504\n}\n\n\nexport enum HttpContentType {\n  JSON = 'application/json',\n  FORM_DATA = 'multipart/form-data',\n  FILE = 'application/octet-stream',\n  TEXT = 'text/plain',\n  HTML = 'text/html',\n  XML = 'application/xml',\n  CSV = 'text/csv',\n  PDF = 'application/pdf',\n}"]}
+{"version":3,"file":"http-requests.shared.js","sourceRoot":"","sources":["../../../src/requests/http-requests.shared.ts"],"names":[],"mappings":"AAEA,MAAM,CAAN,IAAY,UAOX;AAPD,WAAY,UAAU;IACpB,yBAAW,CAAA;IACX,2BAAa,CAAA;IACb,yBAAW,CAAA;IACX,6BAAe,CAAA;IACf,+BAAiB,CAAA;IACjB,iCAAmB,CAAA;AACrB,CAAC,EAPW,UAAU,KAAV,UAAU,QAOrB;AAED,MAAM,CAAN,IAAY,cAkBX;AAlBD,WAAY,cAAc;IACxB,iDAAQ,CAAA;IACR,2DAAa,CAAA;IACb,6DAAc,CAAA;IACd,iEAAgB,CAAA;IAChB,mEAAiB,CAAA;IACjB,qEAAkB,CAAA;IAClB,+DAAe,CAAA;IACf,+DAAe,CAAA;IACf,iFAAwB,CAAA;IACxB,6DAAc,CAAA;IACd,+EAAuB,CAAA;IACvB,qFAA0B,CAAA;IAC1B,+EAAuB,CAAA;IACvB,uFAA2B,CAAA;IAC3B,mEAAiB,CAAA;IACjB,mFAAyB,CAAA;IACzB,2EAAqB,CAAA;AACvB,CAAC,EAlBW,cAAc,KAAd,cAAc,QAkBzB;AAGD,MAAM,CAAN,IAAY,eASX;AATD,WAAY,eAAe;IACzB,4CAAyB,CAAA;IACzB,oDAAiC,CAAA;IACjC,oDAAiC,CAAA;IACjC,sCAAmB,CAAA;IACnB,qCAAkB,CAAA;IAClB,0CAAuB,CAAA;IACvB,mCAAgB,CAAA;IAChB,0CAAuB,CAAA;AACzB,CAAC,EATW,eAAe,KAAf,eAAe,QAS1B","sourcesContent":["\n\nexport enum HttpMethod {\n  GET = 'GET',\n  POST = 'POST',\n  PUT = 'PUT',\n  PATCH = 'PATCH',\n  DELETE = 'DELETE',\n  OPTIONS = 'OPTIONS',\n}\n\nexport enum HttpStatusCode {\n  OK = 200,\n  CREATED = 201,\n  ACCEPTED = 202,\n  NO_CONTENT = 204,\n  BAD_REQUEST = 400,\n  UNAUTHORIZED = 401,\n  FORBIDDEN = 403,\n  NOT_FOUND = 404,\n  METHOD_NOT_ALLOWED = 405,\n  CONFLICT = 409,\n  PAYLOAD_TOO_LARGE = 413,\n  UNPROCESSABLE_ENTITY = 422,\n  TOO_MANY_REQUESTS = 429,\n  INTERNAL_SERVER_ERROR = 500,\n  BAD_GATEWAY = 502,\n  SERVICE_UNAVAILABLE = 503,\n  GATEWAY_TIMEOUT = 504\n}\n\n\nexport enum HttpContentType {\n  JSON = 'application/json',\n  FORM_DATA = 'multipart/form-data',\n  FILE = 'application/octet-stream',\n  TEXT = 'text/plain',\n  HTML = 'text/html',\n  XML = 'application/xml',\n  CSV = 'text/csv',\n  PDF = 'application/pdf',\n}"]}

package/dist/esm/requests/idempotency-key.shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"idempotency-key.shared.d.ts","sourceRoot":"","sources":["../../../../src/requests/idempotency-key.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,mHAAmH;AACnH,oBAAY,0CAA0C;IACpD;;;OAGG;IACH,QAAQ,aAAa;IACrB;;;OAGG;IACH,QAAQ,aAAa;CACtB;AAED;;;GAGG;AACH,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAE9C,uHAAuH;AACvH,oBAAY,yBAAyB;IACnC,0EAA0E;IAC1E,QAAQ,6BAA6B;IACrC,uHAAuH;IACvH,SAAS,8BAA8B;IACvC;;;;OAIG;IACH,YAAY,iCAAiC;CAC9C;AAED,4CAA4C;AAC5C,oBAAY,2BAA2B;IACrC,MAAM,WAAW;IACjB,GAAG,QAAQ;IACX,SAAS,cAAc;CACxB;AAED,MAAM,MAAM,yBAAyB,GACjC;IAAE,OAAO,EAAE,2BAA2B,CAAC,MAAM,CAAA;CAAE,GAC/C;IAAE,OAAO,EAAE,2BAA2B,CAAC,GAAG,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,OAAO,EAAE,2BAA2B,CAAC,SAAS,CAAA;CAAE,CAAC;AAKvD;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,yBAAyB,CA6BhH;AAED,iGAAiG;AACjG,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE9D"}
+{"version":3,"file":"idempotency-key.shared.d.ts","sourceRoot":"","sources":["../../../src/requests/idempotency-key.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,mHAAmH;AACnH,oBAAY,0CAA0C;IACpD;;;OAGG;IACH,QAAQ,aAAa;IACrB;;;OAGG;IACH,QAAQ,aAAa;CACtB;AAED;;;GAGG;AACH,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAE9C,uHAAuH;AACvH,oBAAY,yBAAyB;IACnC,0EAA0E;IAC1E,QAAQ,6BAA6B;IACrC,uHAAuH;IACvH,SAAS,8BAA8B;IACvC;;;;OAIG;IACH,YAAY,iCAAiC;CAC9C;AAED,4CAA4C;AAC5C,oBAAY,2BAA2B;IACrC,MAAM,WAAW;IACjB,GAAG,QAAQ;IACX,SAAS,cAAc;CACxB;AAED,MAAM,MAAM,yBAAyB,GACjC;IAAE,OAAO,EAAE,2BAA2B,CAAC,MAAM,CAAA;CAAE,GAC/C;IAAE,OAAO,EAAE,2BAA2B,CAAC,GAAG,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,OAAO,EAAE,2BAA2B,CAAC,SAAS,CAAA;CAAE,CAAC;AAKvD;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,yBAAyB,CA6BhH;AAED,iGAAiG;AACjG,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE9D"}

package/dist/esm/requests/idempotency-key.shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"idempotency-key.shared.js","sourceRoot":"","sources":["../../../../src/requests/idempotency-key.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,mHAAmH;AACnH,MAAM,CAAN,IAAY,0CAWX;AAXD,WAAY,0CAA0C;IACpD;;;OAGG;IACH,mEAAqB,CAAA;IACrB;;;OAGG;IACH,mEAAqB,CAAA;AACvB,CAAC,EAXW,0CAA0C,KAA1C,0CAA0C,QAWrD;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAE9C,uHAAuH;AACvH,MAAM,CAAN,IAAY,yBAWX;AAXD,WAAY,yBAAyB;IACnC,0EAA0E;IAC1E,kEAAqC,CAAA;IACrC,uHAAuH;IACvH,oEAAuC,CAAA;IACvC;;;;OAIG;IACH,0EAA6C,CAAA;AAC/C,CAAC,EAXW,yBAAyB,KAAzB,yBAAyB,QAWpC;AAED,4CAA4C;AAC5C,MAAM,CAAN,IAAY,2BAIX;AAJD,WAAY,2BAA2B;IACrC,gDAAiB,CAAA;IACjB,0CAAW,CAAA;IACX,sDAAuB,CAAA;AACzB,CAAC,EAJW,2BAA2B,KAA3B,2BAA2B,QAItC;AAOD,uHAAuH;AACvH,MAAM,QAAQ,GAAG,wBAAwB,CAAC;AAE1C;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAA2C;IACnF,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,2BAA2B,CAAC,MAAM,EAAE,CAAC;IAC9E,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,2BAA2B,CAAC,SAAS,EAAE,CAAC;IACvF,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,2BAA2B,CAAC,SAAS,EAAE,CAAC;IAElF,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,2BAA2B,CAAC,SAAS,EAAE,CAAC;QACxG,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAChC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACpD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACrC,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,IAAI,IAAI,SAAS,KAAK,GAAG;gBAAE,OAAO,EAAE,OAAO,EAAE,2BAA2B,CAAC,SAAS,EAAE,CAAC;YAC/G,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBAChC,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI;oBAAE,OAAO,EAAE,OAAO,EAAE,2BAA2B,CAAC,SAAS,EAAE,CAAC;gBACnG,GAAG,IAAI,OAAO,CAAC;gBACf,KAAK,IAAI,CAAC,CAAC;gBACX,SAAS;YACX,CAAC;YACD,GAAG,IAAI,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,2BAA2B,CAAC,SAAS,EAAE,CAAC;QACrF,GAAG,GAAG,KAAK,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,0BAA0B;QAAE,OAAO,EAAE,OAAO,EAAE,2BAA2B,CAAC,SAAS,EAAE,CAAC;IAC3H,OAAO,EAAE,OAAO,EAAE,2BAA2B,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;AAC3D,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,0BAA0B,CAAC,GAAW;IACpD,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC,GAAG,CAAC;AACvE,CAAC","sourcesContent":["/**\n * The `Idempotency-Key` request header: its vocabulary, its bounds and its one parser (#535).\n *\n * A caller that sends the same key again is asking for the outcome of the FIRST request, not for a second execution. An\n * operation variant declares whether it takes the header ({@link ResourceOperationIdempotencyKeyRequirement}); the\n * framework parses and bounds the value here, refuses a malformed or undeclared one, and hands the key to the operation's\n * implementation, which owns what \"the same request\" means for its effects (a billing mutation, for example, replays the\n * committed change and refuses the same key sent with a different request).\n *\n * Shared by the backend controller that reads the header, the frontend client that writes it and the OpenAPI projection\n * that documents it, so the three cannot disagree about what a key is.\n *\n * spec-cite: draft-ietf-httpapi-idempotency-key-header-07 (2025-10-15), https://datatracker.ietf.org/doc/html/draft-ietf-httpapi-idempotency-key-header\n * — the header name, its String value, and the 400/409/422 outcomes are taken from that draft; the wording here is this\n * repository's own.\n */\n\n/** Whether an operation variant takes the `Idempotency-Key` request header. Absent on a variant: it takes none. */\nexport enum ResourceOperationIdempotencyKeyRequirement {\n  /**\n   * The header is honored when a caller sends it, and a request without it runs unkeyed. For an operation whose effect\n   * converges when repeated (cancelling, resuming), so an unkeyed retry is safe even though it is not deduplicated.\n   */\n  ACCEPTED = 'accepted',\n  /**\n   * A request without the header is refused with 400 before anything runs. For an operation whose repeat is a second,\n   * different effect (adding an add-on twice adds two), where an unkeyed retry is exactly the duplicate the key prevents.\n   */\n  REQUIRED = 'required',\n}\n\n/**\n * Longest key accepted, in characters. A key is stored as part of an operation's admission identity, which also carries\n * the operation name, inside a 255-character column; 200 leaves room for that prefix. A UUID is 36.\n */\nexport const IDEMPOTENCY_KEY_MAX_LENGTH = 200;\n\n/** Why the framework refused a request's `Idempotency-Key`, carried as the client-branchable `error.code` of a 400. */\nexport enum IdempotencyKeyRefusalCode {\n  /** The operation requires the header and the request did not send one. */\n  REQUIRED = 'idempotency_key_required',\n  /** The header is present but is not a String of 1 to {@link IDEMPOTENCY_KEY_MAX_LENGTH} printable ASCII characters. */\n  MALFORMED = 'idempotency_key_malformed',\n  /**\n   * The header was sent to a MUTATION that does not take one. Refused rather than ignored: a caller who sent a key believes\n   * a retry is deduplicated, and silently ignoring it would let that retry run twice. A read-shaped operation ignores an\n   * undeclared key instead, because repeating a read is harmless.\n   */\n  NOT_ACCEPTED = 'idempotency_key_not_accepted',\n}\n\n/** What one reading of the header found. */\nexport enum IdempotencyKeyHeaderOutcome {\n  ABSENT = 'absent',\n  KEY = 'key',\n  MALFORMED = 'malformed',\n}\n\nexport type IdempotencyKeyHeaderParse =\n  | { outcome: IdempotencyKeyHeaderOutcome.ABSENT }\n  | { outcome: IdempotencyKeyHeaderOutcome.KEY; key: string }\n  | { outcome: IdempotencyKeyHeaderOutcome.MALFORMED };\n\n/** The unquoted form some clients send (Stripe's SDKs among them): token characters only, so it cannot hide a list. */\nconst BARE_KEY = /^[A-Za-z0-9._~:+/=-]+$/;\n\n/**\n * Read one request's `Idempotency-Key` header value.\n *\n * Accepts the draft's String form (`\"8e03978e-40d5-43e8-bc93-6894a57f9324\"`, printable ASCII, `\\\"` and `\\\\` the only\n * escapes) and, for clients that send it unquoted, a bare token. Anything else is MALFORMED, never trimmed into a key:\n *\n * - an empty value (the header was sent, so the caller meant something);\n * - a repeated header, which Node joins with `, ` and which could otherwise be read as one key made of two;\n * - a control or non-ASCII character, which would reach logs and a stored admission identity;\n * - a key longer than {@link IDEMPOTENCY_KEY_MAX_LENGTH}.\n */\nexport function parseIdempotencyKeyHeader(raw: string | readonly string[] | undefined): IdempotencyKeyHeaderParse {\n  if (raw === undefined) return { outcome: IdempotencyKeyHeaderOutcome.ABSENT };\n  if (typeof raw !== 'string') return { outcome: IdempotencyKeyHeaderOutcome.MALFORMED };\n  const value = raw.trim();\n  if (value.length === 0) return { outcome: IdempotencyKeyHeaderOutcome.MALFORMED };\n\n  let key = '';\n  if (value.startsWith('\"')) {\n    if (value.length < 2 || !value.endsWith('\"')) return { outcome: IdempotencyKeyHeaderOutcome.MALFORMED };\n    const body = value.slice(1, -1);\n    for (let index = 0; index < body.length; index += 1) {\n      const character = body[index]!;\n      const code = character.charCodeAt(0);\n      if (code < 0x20 || code > 0x7e || character === '\"') return { outcome: IdempotencyKeyHeaderOutcome.MALFORMED };\n      if (character === '\\\\') {\n        const escaped = body[index + 1];\n        if (escaped !== '\"' && escaped !== '\\\\') return { outcome: IdempotencyKeyHeaderOutcome.MALFORMED };\n        key += escaped;\n        index += 1;\n        continue;\n      }\n      key += character;\n    }\n  } else {\n    if (!BARE_KEY.test(value)) return { outcome: IdempotencyKeyHeaderOutcome.MALFORMED };\n    key = value;\n  }\n  if (key.length === 0 || key.length > IDEMPOTENCY_KEY_MAX_LENGTH) return { outcome: IdempotencyKeyHeaderOutcome.MALFORMED };\n  return { outcome: IdempotencyKeyHeaderOutcome.KEY, key };\n}\n\n/** Write a key as the header's String form, the inverse of {@link parseIdempotencyKeyHeader}. */\nexport function formatIdempotencyKeyHeader(key: string): string {\n  return `\"${key.replace(/[\\\\\"]/g, (character) => `\\\\${character}`)}\"`;\n}\n"]}
+{"version":3,"file":"idempotency-key.shared.js","sourceRoot":"","sources":["../../../src/requests/idempotency-key.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,mHAAmH;AACnH,MAAM,CAAN,IAAY,0CAWX;AAXD,WAAY,0CAA0C;IACpD;;;OAGG;IACH,mEAAqB,CAAA;IACrB;;;OAGG;IACH,mEAAqB,CAAA;AACvB,CAAC,EAXW,0CAA0C,KAA1C,0CAA0C,QAWrD;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAE9C,uHAAuH;AACvH,MAAM,CAAN,IAAY,yBAWX;AAXD,WAAY,yBAAyB;IACnC,0EAA0E;IAC1E,kEAAqC,CAAA;IACrC,uHAAuH;IACvH,oEAAuC,CAAA;IACvC;;;;OAIG;IACH,0EAA6C,CAAA;AAC/C,CAAC,EAXW,yBAAyB,KAAzB,yBAAyB,QAWpC;AAED,4CAA4C;AAC5C,MAAM,CAAN,IAAY,2BAIX;AAJD,WAAY,2BAA2B;IACrC,gDAAiB,CAAA;IACjB,0CAAW,CAAA;IACX,sDAAuB,CAAA;AACzB,CAAC,EAJW,2BAA2B,KAA3B,2BAA2B,QAItC;AAOD,uHAAuH;AACvH,MAAM,QAAQ,GAAG,wBAAwB,CAAC;AAE1C;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAA2C;IACnF,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,2BAA2B,CAAC,MAAM,EAAE,CAAC;IAC9E,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,2BAA2B,CAAC,SAAS,EAAE,CAAC;IACvF,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,2BAA2B,CAAC,SAAS,EAAE,CAAC;IAElF,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,2BAA2B,CAAC,SAAS,EAAE,CAAC;QACxG,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAChC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACpD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACrC,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,IAAI,IAAI,SAAS,KAAK,GAAG;gBAAE,OAAO,EAAE,OAAO,EAAE,2BAA2B,CAAC,SAAS,EAAE,CAAC;YAC/G,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBAChC,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI;oBAAE,OAAO,EAAE,OAAO,EAAE,2BAA2B,CAAC,SAAS,EAAE,CAAC;gBACnG,GAAG,IAAI,OAAO,CAAC;gBACf,KAAK,IAAI,CAAC,CAAC;gBACX,SAAS;YACX,CAAC;YACD,GAAG,IAAI,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,2BAA2B,CAAC,SAAS,EAAE,CAAC;QACrF,GAAG,GAAG,KAAK,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,0BAA0B;QAAE,OAAO,EAAE,OAAO,EAAE,2BAA2B,CAAC,SAAS,EAAE,CAAC;IAC3H,OAAO,EAAE,OAAO,EAAE,2BAA2B,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;AAC3D,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,0BAA0B,CAAC,GAAW;IACpD,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC,GAAG,CAAC;AACvE,CAAC","sourcesContent":["/**\n * The `Idempotency-Key` request header: its vocabulary, its bounds and its one parser (#535).\n *\n * A caller that sends the same key again is asking for the outcome of the FIRST request, not for a second execution. An\n * operation variant declares whether it takes the header ({@link ResourceOperationIdempotencyKeyRequirement}); the\n * framework parses and bounds the value here, refuses a malformed or undeclared one, and hands the key to the operation's\n * implementation, which owns what \"the same request\" means for its effects (a billing mutation, for example, replays the\n * committed change and refuses the same key sent with a different request).\n *\n * Shared by the backend controller that reads the header, the frontend client that writes it and the OpenAPI projection\n * that documents it, so the three cannot disagree about what a key is.\n *\n * spec-cite: draft-ietf-httpapi-idempotency-key-header-07 (2025-10-15), https://datatracker.ietf.org/doc/html/draft-ietf-httpapi-idempotency-key-header\n * — the header name, its String value, and the 400/409/422 outcomes are taken from that draft; the wording here is this\n * repository's own.\n */\n\n/** Whether an operation variant takes the `Idempotency-Key` request header. Absent on a variant: it takes none. */\nexport enum ResourceOperationIdempotencyKeyRequirement {\n  /**\n   * The header is honored when a caller sends it, and a request without it runs unkeyed. For an operation whose effect\n   * converges when repeated (cancelling, resuming), so an unkeyed retry is safe even though it is not deduplicated.\n   */\n  ACCEPTED = 'accepted',\n  /**\n   * A request without the header is refused with 400 before anything runs. For an operation whose repeat is a second,\n   * different effect (adding an add-on twice adds two), where an unkeyed retry is exactly the duplicate the key prevents.\n   */\n  REQUIRED = 'required',\n}\n\n/**\n * Longest key accepted, in characters. A key is stored as part of an operation's admission identity, which also carries\n * the operation name, inside a 255-character column; 200 leaves room for that prefix. A UUID is 36.\n */\nexport const IDEMPOTENCY_KEY_MAX_LENGTH = 200;\n\n/** Why the framework refused a request's `Idempotency-Key`, carried as the client-branchable `error.code` of a 400. */\nexport enum IdempotencyKeyRefusalCode {\n  /** The operation requires the header and the request did not send one. */\n  REQUIRED = 'idempotency_key_required',\n  /** The header is present but is not a String of 1 to {@link IDEMPOTENCY_KEY_MAX_LENGTH} printable ASCII characters. */\n  MALFORMED = 'idempotency_key_malformed',\n  /**\n   * The header was sent to a MUTATION that does not take one. Refused rather than ignored: a caller who sent a key believes\n   * a retry is deduplicated, and silently ignoring it would let that retry run twice. A read-shaped operation ignores an\n   * undeclared key instead, because repeating a read is harmless.\n   */\n  NOT_ACCEPTED = 'idempotency_key_not_accepted',\n}\n\n/** What one reading of the header found. */\nexport enum IdempotencyKeyHeaderOutcome {\n  ABSENT = 'absent',\n  KEY = 'key',\n  MALFORMED = 'malformed',\n}\n\nexport type IdempotencyKeyHeaderParse =\n  | { outcome: IdempotencyKeyHeaderOutcome.ABSENT }\n  | { outcome: IdempotencyKeyHeaderOutcome.KEY; key: string }\n  | { outcome: IdempotencyKeyHeaderOutcome.MALFORMED };\n\n/** The unquoted form some clients send (Stripe's SDKs among them): token characters only, so it cannot hide a list. */\nconst BARE_KEY = /^[A-Za-z0-9._~:+/=-]+$/;\n\n/**\n * Read one request's `Idempotency-Key` header value.\n *\n * Accepts the draft's String form (`\"8e03978e-40d5-43e8-bc93-6894a57f9324\"`, printable ASCII, `\\\"` and `\\\\` the only\n * escapes) and, for clients that send it unquoted, a bare token. Anything else is MALFORMED, never trimmed into a key:\n *\n * - an empty value (the header was sent, so the caller meant something);\n * - a repeated header, which Node joins with `, ` and which could otherwise be read as one key made of two;\n * - a control or non-ASCII character, which would reach logs and a stored admission identity;\n * - a key longer than {@link IDEMPOTENCY_KEY_MAX_LENGTH}.\n */\nexport function parseIdempotencyKeyHeader(raw: string | readonly string[] | undefined): IdempotencyKeyHeaderParse {\n  if (raw === undefined) return { outcome: IdempotencyKeyHeaderOutcome.ABSENT };\n  if (typeof raw !== 'string') return { outcome: IdempotencyKeyHeaderOutcome.MALFORMED };\n  const value = raw.trim();\n  if (value.length === 0) return { outcome: IdempotencyKeyHeaderOutcome.MALFORMED };\n\n  let key = '';\n  if (value.startsWith('\"')) {\n    if (value.length < 2 || !value.endsWith('\"')) return { outcome: IdempotencyKeyHeaderOutcome.MALFORMED };\n    const body = value.slice(1, -1);\n    for (let index = 0; index < body.length; index += 1) {\n      const character = body[index]!;\n      const code = character.charCodeAt(0);\n      if (code < 0x20 || code > 0x7e || character === '\"') return { outcome: IdempotencyKeyHeaderOutcome.MALFORMED };\n      if (character === '\\\\') {\n        const escaped = body[index + 1];\n        if (escaped !== '\"' && escaped !== '\\\\') return { outcome: IdempotencyKeyHeaderOutcome.MALFORMED };\n        key += escaped;\n        index += 1;\n        continue;\n      }\n      key += character;\n    }\n  } else {\n    if (!BARE_KEY.test(value)) return { outcome: IdempotencyKeyHeaderOutcome.MALFORMED };\n    key = value;\n  }\n  if (key.length === 0 || key.length > IDEMPOTENCY_KEY_MAX_LENGTH) return { outcome: IdempotencyKeyHeaderOutcome.MALFORMED };\n  return { outcome: IdempotencyKeyHeaderOutcome.KEY, key };\n}\n\n/** Write a key as the header's String form, the inverse of {@link parseIdempotencyKeyHeader}. */\nexport function formatIdempotencyKeyHeader(key: string): string {\n  return `\"${key.replace(/[\\\\\"]/g, (character) => `\\\\${character}`)}\"`;\n}\n"]}

package/dist/esm/requests/manual-controllers-routes-documentation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manual-controllers-routes-documentation.d.ts","sourceRoot":"","sources":["../../../../src/requests/manual-controllers-routes-documentation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAE5E;;;;;;;;;;;GAWG;AACH,oBAAY,0BAA0B;IACpC,gGAAgG;IAChG,cAAc,mBAAmB;IACjC,wGAAwG;IACxG,iBAAiB,qBAAqB;IACtC,2GAA2G;IAC3G,kBAAkB,sBAAsB;IACxC,uFAAuF;IACvF,gBAAgB,oBAAoB;IACpC,yEAAyE;IACzE,aAAa,iBAAiB;IAC9B,kFAAkF;IAClF,mBAAmB,uBAAuB;CAC3C;AAED;;;GAGG;AACH,oBAAY,mCAAmC;IAC7C,2GAA2G;IAC3G,MAAM,WAAW;IACjB,kEAAkE;IAClE,iBAAiB,sBAAsB;IACvC,0EAA0E;IAC1E,aAAa,kBAAkB;IAC/B,kFAAkF;IAClF,0BAA0B,+BAA+B;CAC1D;AAED,oEAAoE;AACpE,oBAAY,gCAAgC;IAC1C,SAAS,cAAc;IACvB,QAAQ,aAAa;CACtB;AAED,8FAA8F;AAC9F,MAAM,WAAW,2CAA2C;IAC1D,QAAQ,CAAC,WAAW,EAAE,gCAAgC,CAAC,SAAS,CAAC;IACjE,QAAQ,CAAC,KAAK,EAAE,0BAA0B,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IACxC,kGAAkG;IAClG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,uGAAuG;IACvG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,mCAAmC,CAAC;IAC7D,yDAAyD;IACzD,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7E;AAED;;;;;;GAMG;AACH,MAAM,WAAW,0CAA0C;IACzD,QAAQ,CAAC,WAAW,EAAE,gCAAgC,CAAC,QAAQ,CAAC;IAChE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,MAAM,kCAAkC,GAC1C,2CAA2C,GAC3C,0CAA0C,CAAC;AAoB/C,gGAAgG;AAChG,eAAO,MAAM,0CAA0C,EAAE,MAAM,CAAC,0BAA0B,EAAE,MAAM,CAuBjG,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,qCAAqC,EAAE,MAAM,CAAC,wBAAwB,EAAE,kCAAkC,CA85CtH,CAAC"}
+{"version":3,"file":"manual-controllers-routes-documentation.d.ts","sourceRoot":"","sources":["../../../src/requests/manual-controllers-routes-documentation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAE5E;;;;;;;;;;;GAWG;AACH,oBAAY,0BAA0B;IACpC,gGAAgG;IAChG,cAAc,mBAAmB;IACjC,wGAAwG;IACxG,iBAAiB,qBAAqB;IACtC,2GAA2G;IAC3G,kBAAkB,sBAAsB;IACxC,uFAAuF;IACvF,gBAAgB,oBAAoB;IACpC,yEAAyE;IACzE,aAAa,iBAAiB;IAC9B,kFAAkF;IAClF,mBAAmB,uBAAuB;CAC3C;AAED;;;GAGG;AACH,oBAAY,mCAAmC;IAC7C,2GAA2G;IAC3G,MAAM,WAAW;IACjB,kEAAkE;IAClE,iBAAiB,sBAAsB;IACvC,0EAA0E;IAC1E,aAAa,kBAAkB;IAC/B,kFAAkF;IAClF,0BAA0B,+BAA+B;CAC1D;AAED,oEAAoE;AACpE,oBAAY,gCAAgC;IAC1C,SAAS,cAAc;IACvB,QAAQ,aAAa;CACtB;AAED,8FAA8F;AAC9F,MAAM,WAAW,2CAA2C;IAC1D,QAAQ,CAAC,WAAW,EAAE,gCAAgC,CAAC,SAAS,CAAC;IACjE,QAAQ,CAAC,KAAK,EAAE,0BAA0B,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IACxC,kGAAkG;IAClG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,uGAAuG;IACvG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,mCAAmC,CAAC;IAC7D,yDAAyD;IACzD,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7E;AAED;;;;;;GAMG;AACH,MAAM,WAAW,0CAA0C;IACzD,QAAQ,CAAC,WAAW,EAAE,gCAAgC,CAAC,QAAQ,CAAC;IAChE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,MAAM,kCAAkC,GAC1C,2CAA2C,GAC3C,0CAA0C,CAAC;AAoB/C,gGAAgG;AAChG,eAAO,MAAM,0CAA0C,EAAE,MAAM,CAAC,0BAA0B,EAAE,MAAM,CAuBjG,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,qCAAqC,EAAE,MAAM,CAAC,wBAAwB,EAAE,kCAAkC,CAkjDtH,CAAC"}

package/dist/esm/requests/manual-controllers-routes-documentation.js

@@ -1079,9 +1079,13 @@ export const MANUAL_CONTROLLER_ROUTE_DOCUMENTATION = {
         group: CONNECTIONS,
         methods: [HttpMethod.POST],
         summary: 'Start connecting a third-party account',
-        description: 'Begins an outbound connection to the named provider so this application can later act as the connected account. The '
-            + 'opposite direction from social sign-in, which uses a vendor to identify a person. An application that declares no '
-            + 'connectable provider answers with a "not connectable" error rather than a missing route, which names why.',
+        description: 'Begins an outbound connection so this application can later act as the connected account. The path names a '
+            + 'provider ref, and the grant belongs to that ref\u2019s CONNECTION: a ref the application declares as a member of a '
+            + 'shared connection (`providers.sharedConnections`) connects the one connection its base ref owns, so connecting '
+            + 'through any member and through the base produce the same single grant. With `addScopes` it grows the stored '
+            + 'connection instead of connecting afresh. The opposite direction from social sign-in, which uses a vendor to '
+            + 'identify a person. An application that declares no connectable provider answers with a "not connectable" error '
+            + 'rather than a missing route, which names why.',
         authentication: BEARER,
         authenticationSummary: BEARER_CREDENTIAL,
         successStatus: ok('The provider authorization URL to navigate to.'),
@@ -1118,7 +1122,8 @@ export const MANUAL_CONTROLLER_ROUTE_DOCUMENTATION = {
         group: CONNECTIONS,
         methods: [HttpMethod.POST],
         summary: 'Store a typed credential for a provider',
-        description: 'For a vendor whose credential is TYPED rather than granted. Takes one value per slot the provider declares as '
+        description: 'For a vendor whose credential is TYPED rather than granted. Stored under the ref\u2019s connection, like a granted '
+            + 'one. Takes one value per slot the provider declares as '
             + 'identifying an account, and refuses any name the provider did not declare — so a caller cannot invent a slot, '
             + 'and cannot write an account token into the slot holding the application\u2019s own registration. Values are '
             + 'sealed by the write door; the request is the only place they exist in plaintext.',
@@ -1131,7 +1136,9 @@ export const MANUAL_CONTROLLER_ROUTE_DOCUMENTATION = {
         group: CONNECTIONS,
         methods: [HttpMethod.GET],
         summary: 'What can be connected',
-        description: 'Lists the providers this application declares as connectable, with the owner scopes each one admits and whether it '
+        description: 'Lists what this application declares as connectable, ONE entry per connection: a shared connection\u2019s members '
+            + 'are folded into its base ref\u2019s entry, which names every ref it serves in `servesRefs`, and a ref declared in no '
+            + 'shared connection is its own connection. Each entry carries the owner scopes it admits and whether it '
             + 'carries an authorization flow. Answers the question the stored-credential list cannot: a person with nothing '
             + 'connected has an empty list and no way to learn what they might connect. Admissibility is a recorded decision per '
             + 'provider, so this reports a decision rather than inspecting a vendor.',
@@ -1144,7 +1151,8 @@ export const MANUAL_CONTROLLER_ROUTE_DOCUMENTATION = {
         group: CONNECTIONS,
         methods: [HttpMethod.GET],
         summary: 'A short-lived access token for your own connected account',
-        description: 'Resolves the caller\u2019s OWN grant for a provider and returns its access token, renewed if the vendor\u2019s expiry '
+        description: 'Resolves the caller\u2019s OWN grant for a provider \u2014 the grant of that ref\u2019s connection, so a member of a shared '
+            + 'connection answers with the one grant its base holds \u2014 and returns its access token, renewed if the vendor\u2019s expiry '
             + 'has passed \u2014 the one credential a browser may be handed, because a vendor\u2019s own picker authorizes as the '
             + 'signed-in user and cannot open without it. Never the refresh token; never another owner\u2019s account. Each '
             + 'hand-out is recorded as a USE of the credential, so revoking or erasing the connection is visible against '
@@ -1154,6 +1162,22 @@ export const MANUAL_CONTROLLER_ROUTE_DOCUMENTATION = {
         authenticationSummary: BEARER_CREDENTIAL,
         successStatus: ok('The access token, with its expiry and granted scopes when the vendor stated them.'),
     },
+    [ManualControllerRouteKey.PROVIDER_CONNECTION_LIST]: {
+        publication: ManualControllerRoutePublication.PUBLISHED,
+        group: CONNECTIONS,
+        methods: [HttpMethod.GET],
+        summary: 'The connections an owner holds',
+        description: 'One entry per CONNECTION the owner (`ownerScope` = USER for the caller\u2019s own, ORGANIZATION with `ownerId` for a '
+            + 'tenant the caller administers) has stored a credential under \u2014 never one per provider ref, because several refs '
+            + 'of one vendor share one grant. Each entry names the refs the connection serves, the scopes its consent has '
+            + 'accumulated (read from the sealed grant; no token is returned), its validation state, and the credential rows it '
+            + 'is made of. Disconnecting is the credential resource\u2019s own DELETE of those rows, which authorizes, may ask '
+            + 'for step-up, records who revoked, and withdraws the grant at a vendor that accepts a withdrawal. An organization\u2019s '
+            + 'connections are listed only for a caller holding the role the organization credential list itself requires.',
+        authentication: BEARER,
+        authenticationSummary: BEARER_CREDENTIAL,
+        successStatus: ok('The owner\u2019s connections, one entry each.'),
+    },
     [ManualControllerRouteKey.PROVIDER_OPERATION_EXECUTE]: {
         publication: ManualControllerRoutePublication.PUBLISHED,
         group: CONNECTIONS,
@@ -1329,6 +1353,20 @@ export const MANUAL_CONTROLLER_ROUTE_DOCUMENTATION = {
         authenticationSummary: BEARER_CREDENTIAL,
         successStatus: ok('The caller\'s resolved feature set.'),
     },
+    [ManualControllerRouteKey.SUBMISSION_CHALLENGE_PROOF_OF_WORK]: {
+        publication: ManualControllerRoutePublication.PUBLISHED,
+        group: RUNTIME,
+        methods: [HttpMethod.GET],
+        summary: 'Get a proof-of-work challenge for a public submission',
+        description: 'A signed, expiring SHA-256 puzzle. When the application protects a public form (the contact form) with a captcha, a '
+            + 'submission must carry an answer in the `x-submission-challenge-response` header: either a token from the consented '
+            + 'captcha vendor, or the solution to this challenge. Find the number whose SHA-256 of `salt + number` equals '
+            + '`challenge`, then send `{"kind":"proof_of_work","challenge":<this object>,"number":<n>}` as that header. A '
+            + 'solution is accepted once, before the salt\'s expiry. Nothing about the caller is stored or sent to a third party.',
+        authentication: PUBLIC,
+        authenticationSummary: 'No credential. A visitor who has not signed in needs a challenge to submit a public form.',
+        successStatus: ok('The challenge: algorithm, salt (carrying its expiry), challenge hash, the largest number to try, and its signature.'),
+    },
     [ManualControllerRouteKey.CHARTS_DATA]: {
         publication: ManualControllerRoutePublication.PUBLISHED,
         group: RUNTIME,
@@ -1369,6 +1407,68 @@ export const MANUAL_CONTROLLER_ROUTE_DOCUMENTATION = {
         authenticationSummary: BEARER_CREDENTIAL,
         successStatus: ok('The provider-call summary for the window.'),
     },
+    [ManualControllerRouteKey.MODEL_COST_SUMMARY]: {
+        publication: ManualControllerRoutePublication.PUBLISHED,
+        group: RUNTIME,
+        methods: [HttpMethod.POST],
+        summary: 'Summarize model cost per case, organization, agent or model over a window',
+        description: 'Totals, for a window, what the application\'s model calls cost: grouped by case, organization, agent or model, per currency, '
+            + 'with the tokens each group consumed and the exact cost rounded up once per total. Calls made outside any unit of work, and '
+            + 'calls no registered price covered, are counted apart so a gap is visible rather than folded into a total. A case summary '
+            + 'also reports the expert review time recorded on each case, or says that none is recorded. Application administrators only '
+            + '(super-administrator or billing manager): it is the application\'s internal cost data. A window covers at most a year. POST '
+            + 'because the case filter is a list of references. To invoice a month, list the model-cost period aggregates instead and link '
+            + 'the one the invoice bills.',
+        authentication: BEARER,
+        authenticationSummary: BEARER_CREDENTIAL,
+        successStatus: ok('The model-cost summary for the window.'),
+    },
+    [ManualControllerRouteKey.AGENT_WORK_OVERRIDE_RATE]: {
+        publication: ManualControllerRoutePublication.PUBLISHED,
+        group: RUNTIME,
+        methods: [HttpMethod.POST],
+        summary: 'Report how often experts overrode what an agent proposed, over a window',
+        description: 'Counts, for a window, the decisions people took on agents\' proposals, grouped by agent, tool, case or decider: accepted as '
+            + 'proposed, accepted after a change, and rejected. The override rate is the changed and rejected decisions over all three. '
+            + 'Decisions nobody took (the window lapsed, the work was withdrawn, or the requester lost their access) are counted apart and '
+            + 'never enter the rate. It reads the decision records only, never their content. An organization administrator reads their '
+            + 'own organization; an application super-administrator may read any, or all. A window covers at most a year.',
+        authentication: BEARER,
+        authenticationSummary: BEARER_CREDENTIAL,
+        successStatus: ok('The override rate per group for the window.'),
+    },
+    [ManualControllerRouteKey.AGENT_WORK_EVALUATION_EXPORT]: {
+        publication: ManualControllerRoutePublication.PUBLISHED,
+        group: RUNTIME,
+        methods: [HttpMethod.POST],
+        summary: 'Export an organization\'s decisions on one agent\'s proposals as an evaluation dataset',
+        description: 'Exports, for one organization, one agent and a window, the decisions its people took on that agent\'s proposals, as JSON '
+            + 'Lines: one object per decision, with no decider and no organization. The record\'s own identifiers (the decision, the '
+            + 'case, the run, the task, the work product, the decider, the organization) are replaced by pseudonyms wherever they '
+            + 'appear, including inside kept content; any other value in the kept proposal or final version is exported as the '
+            + 'organization kept it. The proposal and the final version are included only when the organization kept them. Cases the organization walled off '
+            + 'are left out, and a case of a privileged kind goes only with its client\'s recorded consent. The export is refused, and '
+            + 'the refusal recorded, unless the organization holds an active export authorisation; every export is recorded on its '
+            + 'ledger and in the audit trail. An organization administrator for their own organization, or an application '
+            + 'super-administrator.',
+        authentication: BEARER,
+        authenticationSummary: BEARER_CREDENTIAL,
+        successStatus: ok('The dataset, and the id of its ledger entry.'),
+    },
+    [ManualControllerRouteKey.RETENTION_ENFORCEMENT_EVIDENCE]: {
+        publication: ManualControllerRoutePublication.PUBLISHED,
+        group: RUNTIME,
+        methods: [HttpMethod.GET],
+        summary: 'List the retention enforcement records of the sweep runs in a window',
+        description: 'Returns, for a closed window, every record the retention-class sweep wrote: one per run and per resource bound to a retention '
+            + 'class, with the class, the period the run applied, the cutoff, how many rows it deleted and the window of their retention '
+            + 'start, how many a legal hold kept, and whether the run completed, deferred work to the next run, failed or skipped the '
+            + 'resource. A failed run has a record too. The records hold counts and instants only, so the answer names no person and no '
+            + 'deleted row.',
+        authentication: BEARER,
+        authenticationSummary: BEARER_CREDENTIAL,
+        successStatus: ok('The retention enforcement records for the window.'),
+    },
     [ManualControllerRouteKey.USAGE_FLUSH_EVIDENCE]: {
         publication: ManualControllerRoutePublication.PUBLISHED,
         group: RUNTIME,
@@ -1403,10 +1503,11 @@ export const MANUAL_CONTROLLER_ROUTE_DOCUMENTATION = {
         methods: [HttpMethod.GET],
         summary: 'Read the flow and actor systems a client may render',
         description: 'The metadata and renderable graph for every flow or actor system this application exposes to its frontends — what '
-            + 'exists, what it is called, and how it is shaped.',
+            + 'exists, what it is called, and how it is shaped — and the autonomous agents the application declares, by reference '
+            + 'and actor system: the only values an organization OAuth client may be bound to.',
         authentication: BEARER,
         authenticationSummary: BEARER_CREDENTIAL,
-        successStatus: ok('The visible flow and actor systems.'),
+        successStatus: ok('The visible flow and actor systems, and the declared autonomous agents.'),
     },
     [ManualControllerRouteKey.FLOWS_ACTORS_HISTORY]: {
         publication: ManualControllerRoutePublication.PUBLISHED,
@@ -1419,6 +1520,44 @@ export const MANUAL_CONTROLLER_ROUTE_DOCUMENTATION = {
         authenticationSummary: BEARER_CREDENTIAL,
         successStatus: ok('The caller\'s conversation, or confirmation that it was cleared.'),
     },
+    [ManualControllerRouteKey.FLOWS_ACTORS_DECISIONS]: {
+        publication: ManualControllerRoutePublication.PUBLISHED,
+        group: RUNTIME,
+        methods: [HttpMethod.GET],
+        summary: 'List the decisions waiting on me',
+        description: 'The pending decisions an agent is waiting on that the caller may act on, across every conversation: their own, those '
+            + 'assigned to them, and those routed to a role they hold in the decision\'s organization. Each is a decision card — the '
+            + 'call being asked for, its deadline, its route and what the caller may do — and never the conversation behind it. '
+            + 'Every row is re-checked against the same rule an act is, so the list never shows a decision the caller could not act on.',
+        authentication: BEARER,
+        authenticationSummary: BEARER_CREDENTIAL,
+        successStatus: ok('The decision cards.'),
+    },
+    [ManualControllerRouteKey.FLOWS_ACTORS_DECISION_ACT]: {
+        publication: ManualControllerRoutePublication.PUBLISHED,
+        group: RUNTIME,
+        methods: [HttpMethod.POST],
+        summary: 'Answer, reassign, claim, unclaim or escalate a decision',
+        description: 'Acts on one pending decision. `answer` approves or denies the call, optionally with edited arguments; the work then '
+            + 'runs as the person who raised it, with their access as it stands now. `reassign` and `escalate` move it to another '
+            + 'person, who must be able to answer it; `claim` takes a role-routed decision for yourself and `unclaim` gives it back. '
+            + 'A decision that does not exist, is settled, or is not routed to the caller all answer the same way.',
+        authentication: BEARER,
+        authenticationSummary: BEARER_CREDENTIAL,
+        successStatus: ok('What the act came to.'),
+    },
+    [ManualControllerRouteKey.FLOWS_ACTORS_DECISION_CANDIDATES]: {
+        publication: ManualControllerRoutePublication.PUBLISHED,
+        group: RUNTIME,
+        methods: [HttpMethod.GET],
+        summary: 'List who a decision may be moved to',
+        description: 'The people in the decision\'s organization who could answer it, for a caller who may reassign or escalate it. Each is '
+            + 'checked against the same rule a move is, so choosing one of them is never refused for who they are. A decision the '
+            + 'caller may not move answers the same way as one that does not exist.',
+        authentication: BEARER,
+        authenticationSummary: BEARER_CREDENTIAL,
+        successStatus: ok('The people it may be moved to.'),
+    },
     [ManualControllerRouteKey.ANALYTICS_EVENTS]: {
         publication: ManualControllerRoutePublication.PUBLISHED,
         group: RUNTIME,