npm - @wildo-ai/saas-models - Versions diffs - 1.1.6 → 1.1.7 - Mend

@wildo-ai/saas-models 1.1.6 → 1.1.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (869) hide show

package/dist/esm/requests/manual-controllers-routes-documentation.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"manual-controllers-routes-documentation.js","sourceRoot":"","sources":["../../../../src/requests/manual-controllers-routes-documentation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAE5E;;;;;;;;;;;GAWG;AACH,MAAM,CAAN,IAAY,0BAaX;AAbD,WAAY,0BAA0B;IACpC,gGAAgG;IAChG,+DAAiC,CAAA;IACjC,wGAAwG;IACxG,oEAAsC,CAAA;IACtC,2GAA2G;IAC3G,sEAAwC,CAAA;IACxC,uFAAuF;IACvF,kEAAoC,CAAA;IACpC,yEAAyE;IACzE,4DAA8B,CAAA;IAC9B,kFAAkF;IAClF,wEAA0C,CAAA;AAC5C,CAAC,EAbW,0BAA0B,KAA1B,0BAA0B,QAarC;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,mCASX;AATD,WAAY,mCAAmC;IAC7C,2GAA2G;IAC3G,wDAAiB,CAAA;IACjB,kEAAkE;IAClE,8EAAuC,CAAA;IACvC,0EAA0E;IAC1E,sEAA+B,CAAA;IAC/B,kFAAkF;IAClF,gGAAyD,CAAA;AAC3D,CAAC,EATW,mCAAmC,KAAnC,mCAAmC,QAS9C;AAED,oEAAoE;AACpE,MAAM,CAAN,IAAY,gCAGX;AAHD,WAAY,gCAAgC;IAC1C,2DAAuB,CAAA;IACvB,yDAAqB,CAAA;AACvB,CAAC,EAHW,gCAAgC,KAAhC,gCAAgC,QAG3C;AA0CD,sFAAsF;AACtF,SAAS,EAAE,CAAC,OAAe;IACzB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,IAAI,GAAG,0BAA0B,CAAC,cAAc,CAAC;AACvD,MAAM,GAAG,GAAG,0BAA0B,CAAC,iBAAiB,CAAC;AACzD,MAAM,WAAW,GAAG,0BAA0B,CAAC,kBAAkB,CAAC;AAClE,MAAM,MAAM,GAAG,0BAA0B,CAAC,gBAAgB,CAAC;AAC3D,MAAM,KAAK,GAAG,0BAA0B,CAAC,aAAa,CAAC;AACvD,MAAM,OAAO,GAAG,0BAA0B,CAAC,mBAAmB,CAAC;AAE/D,MAAM,MAAM,GAAG,mCAAmC,CAAC,MAAM,CAAC;AAC1D,MAAM,MAAM,GAAG,mCAAmC,CAAC,aAAa,CAAC;AAEjE,MAAM,aAAa,GAAG,oEAAoE,CAAC;AAC3F,MAAM,iBAAiB,GAAG,+CAA+C,CAAC;AAE1E,gGAAgG;AAChG,MAAM,CAAC,MAAM,0CAA0C,GAA+C;IACpG,CAAC,0BAA0B,CAAC,cAAc,CAAC,EACzC,yHAAyH;UACvH,oHAAoH;UACpH,yHAAyH;UACzH,oGAAoG;IACxG,CAAC,0BAA0B,CAAC,iBAAiB,CAAC,EAC5C,oHAAoH;UAClH,oHAAoH;UACpH,uHAAuH;UACvH,6FAA6F;IACjG,CAAC,0BAA0B,CAAC,kBAAkB,CAAC,EAC7C,uHAAuH;UACrH,+CAA+C;IACnD,CAAC,0BAA0B,CAAC,gBAAgB,CAAC,EAC3C,sHAAsH;UACpH,gFAAgF;IACpF,CAAC,0BAA0B,CAAC,aAAa,CAAC,EACxC,wHAAwH;UACtH,wDAAwD;IAC5D,CAAC,0BAA0B,CAAC,mBAAmB,CAAC,EAC9C,qHAAqH;UACnH,kEAAkE;CACvE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAyE;IACzH,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE;QACjD,WAAW,EAAE,gCAAgC,CAAC,QAAQ;QACtD,cAAc,EACZ,kHAAkH;cAChH,qHAAqH;cACrH,iHAAiH;KACtH;IAED,gGAAgG;IAChG,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE;QACxC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,yEAAyE;QAClF,WAAW,EACT,uHAAuH;cACrH,mHAAmH;cACnH,sHAAsH;cACtH,4CAA4C;QAChD,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,aAAa;QACpC,aAAa,EAAE,EAAE,CAAC,kFAAkF,CAAC;KACtG;IACD,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE;QACrD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,8BAA8B;QACvC,WAAW,EACT,uHAAuH;cACrH,wHAAwH;cACxH,kHAAkH;cAClH,uEAAuE;QAC3E,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,aAAa;QACpC,aAAa,EAAE,EAAE,CAAC,6EAA6E,CAAC;KACjG;IACD,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE;QAC5C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,8BAA8B;QACvC,WAAW,EACT,0HAA0H;cACxH,sHAAsH;cACtH,yEAAyE;QAC7E,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,aAAa;QACpC,aAAa,EAAE,EAAE,CAAC,yEAAyE,CAAC;KAC7F;IACD,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE;QAC7C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,yBAAyB;QAClC,WAAW,EACT,wHAAwH;cACtH,uHAAuH;cACvH,qEAAqE;QACzE,cAAc,EAAE,MAAM;QACtB,qBAAqB,EACnB,8GAA8G;QAChH,aAAa,EAAE,EAAE,CAAC,kEAAkE,CAAC;KACtF;IACD,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE;QAC7C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,yDAAyD;QAClE,WAAW,EACT,uHAAuH;cACrH,2EAA2E;QAC/E,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,uEAAuE;QAC9F,aAAa,EAAE,EAAE,CAAC,yDAAyD,CAAC;KAC7E;IACD,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE;QACtC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,0BAA0B;QACnC,WAAW,EACT,2HAA2H;cACzH,iGAAiG;QACrG,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,+DAA+D,CAAC;KACnF;IACD,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE;QAC1C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,qBAAqB;QAC9B,WAAW,EACT,wHAAwH;cACtH,oHAAoH;cACpH,6CAA6C;QACjD,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,+CAA+C,CAAC;KACnE;IACD,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE;QACxC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,wBAAwB;QACjC,WAAW,EACT,yHAAyH;cACvH,wHAAwH;cACxH,mGAAmG;QACvG,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,aAAa;QACpC,aAAa,EAAE,EAAE,CAAC,yDAAyD,CAAC;KAC7E;IACD,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE;QAC5C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,yBAAyB;QAClC,WAAW,EACT,qHAAqH;cACnH,mGAAmG;QACvG,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,2EAA2E;QAClG,aAAa,EAAE,EAAE,CAAC,oDAAoD,CAAC;KACxE;IACD,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE;QACnD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,+BAA+B;QACxC,WAAW,EACT,wHAAwH;cACtH,8EAA8E;QAClF,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,aAAa;QACpC,aAAa,EAAE,EAAE,CAAC,sFAAsF,CAAC;KAC1G;IACD,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE;QACtD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,0BAA0B;QACnC,WAAW,EACT,yHAAyH;cACvH,kEAAkE;QACtE,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,aAAa;QACpC,aAAa,EAAE,EAAE,CAAC,4EAA4E,CAAC;KAChG;IACD,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE;QACvD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,2BAA2B;QACpC,WAAW,EACT,mHAAmH;cACjH,wEAAwE;QAC5E,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,0EAA0E;QACjG,aAAa,EAAE,EAAE,CAAC,gEAAgE,CAAC;KACpF;IACD,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE;QACvD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,kCAAkC;QAC3C,WAAW,EACT,sHAAsH;cACpH,qHAAqH;cACrH,kHAAkH;cAClH,uHAAuH;cACvH,qHAAqH;cACrH,4GAA4G;QAChH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,+GAA+G;QACtI,aAAa,EAAE,EAAE,CAAC,8GAA8G,CAAC;KAClI;IACD,CAAC,wBAAwB,CAAC,gCAAgC,CAAC,EAAE;QAC3D,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,6BAA6B;QACtC,WAAW,EACT,wHAAwH;cACtH,sHAAsH;cACtH,oHAAoH;cACpH,qHAAqH;cACrH,0BAA0B;QAC9B,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,qFAAqF;QAC5G,aAAa,EAAE,EAAE,CAAC,4FAA4F,CAAC;KAChH;IAED,gGAAgG;IAChG,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE;QAC/C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,uHAAuH;cACrH,uHAAuH;cACvH,cAAc;QAClB,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,wEAAwE;QAC/F,aAAa,EAAE,EAAE,CAAC,uDAAuD,CAAC;KAC3E;IACD,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE;QACjD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,qCAAqC;QAC9C,WAAW,EACT,sHAAsH;cACpH,qHAAqH;cACrH,8MAA8M;cAC9M,8CAA8C;QAClD,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,6EAA6E;QACpG,aAAa,EAAE,EAAE,CAAC,0FAA0F,CAAC;KAC9G;IACD,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE;QACjD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,qCAAqC;QAC9C,WAAW,EAAE,+FAA+F;QAC5G,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,gFAAgF;QACvG,aAAa,EAAE,EAAE,CAAC,6BAA6B,CAAC;KACjD;IACD,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE;QACnD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,6BAA6B;QACtC,WAAW,EACT,mHAAmH;cACjH,sFAAsF;QAC1F,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,oCAAoC,CAAC;KACxD;IACD,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE;QACpD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,8BAA8B;QACvC,WAAW,EACT,wHAAwH;cACtH,iDAAiD;QACrD,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,kEAAkE,CAAC;KACtF;IACD,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE;QACpD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,8BAA8B;QACvC,WAAW,EAAE,gFAAgF;QAC7F,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,6BAA6B,CAAC;KACjD;IAED,gGAAgG;IAChG,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,EAAE;QAClD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,6BAA6B;QACtC,WAAW,EAAE,kGAAkG;QAC/G,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,8EAA8E;QACrG,aAAa,EAAE,EAAE,CAAC,uBAAuB,CAAC;KAC3C;IACD,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE;QACpD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,+BAA+B;QACxC,WAAW,EACT,wHAAwH;QAC1H,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,oEAAoE;QAC3F,aAAa,EAAE,EAAE,CAAC,qEAAqE,CAAC;KACzF;IACD,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE;QAC9C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,sBAAsB;QAC/B,WAAW,EACT,oHAAoH;cAClH,0GAA0G;QAC9G,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,qDAAqD,CAAC;KACzE;IACD,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE;QACrD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,wBAAwB;QACjC,WAAW,EACT,wHAAwH;cACtH,uGAAuG;QAC3G,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,8BAA8B,CAAC;KAClD;IACD,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE;QAC/C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,oBAAoB;QAC7B,WAAW,EACT,uHAAuH;cACrH,4DAA4D;QAChE,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,oEAAoE;QAC3F,aAAa,EAAE,EAAE,CAAC,qEAAqE,CAAC;KACzF;IACD,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE;QAChD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,cAAc;QACvB,WAAW,EACT,oHAAoH;cAClH,4DAA4D;QAChE,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,6DAA6D;QACpF,aAAa,EAAE,EAAE,CAAC,6BAA6B,CAAC;KACjD;IACD,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE;QAC5C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,2BAA2B;QACpC,WAAW,EACT,uHAAuH;cACrH,sEAAsE;QAC1E,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,8EAA8E;QACrG,aAAa,EAAE,EAAE,CAAC,uBAAuB,CAAC;KAC3C;IACD,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE;QAC9C,WAAW,EAAE,gCAAgC,CAAC,QAAQ;QACtD,cAAc,EACZ,sGAAsG;cACpG,qHAAqH;cACrH,qHAAqH;KAC1H;IACD,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE;QACjD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,sHAAsH;cACpH,2CAA2C;QAC/C,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,qCAAqC,CAAC;KACzD;IACD,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE;QACpD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,mCAAmC;QAC5C,WAAW,EAAE,wFAAwF;QACrG,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,yBAAyB,CAAC;KAC7C;IACD,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE;QAC/C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,mBAAmB;QAC5B,WAAW,EACT,uHAAuH;cACrH,+BAA+B;QACnC,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,aAAa;QACpC,aAAa,EAAE,EAAE,CAAC,gFAAgF,CAAC;KACpG;IACD,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE;QACjD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,qBAAqB;QAC9B,WAAW,EAAE,mGAAmG;QAChH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,wDAAwD;QAC/E,aAAa,EAAE,EAAE,CAAC,4CAA4C,CAAC;KAChE;IAED,gGAAgG;IAChG,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE;QACxD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,4BAA4B;QACrC,WAAW,EACT,sGAAsG;cACpG,uHAAuH;QAC3H,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,4CAA4C,CAAC;KAChE;IACD,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE;QACvD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,+BAA+B;QACxC,WAAW,EAAE,2GAA2G;QACxH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,4BAA4B,CAAC;KAChD;IACD,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE;QACpD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,8BAA8B;QACvC,WAAW,EACT,8FAA8F;cAC5F,2GAA2G;cAC3G,yIAAyI;cACzI,sGAAsG;cACtG,qGAAqG;cACrG,iGAAiG;cACjG,0BAA0B;QAC9B,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,aAAa;QACpC,aAAa,EAAE,EAAE,CAAC,2CAA2C,CAAC;KAC/D;IACD,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE;QACnD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,iCAAiC;QAC1C,WAAW,EACT,uGAAuG;cACrG,mGAAmG;cACnG,wGAAwG;QAC5G,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,qDAAqD;QAC5E,aAAa,EAAE,EAAE,CAAC,4CAA4C,CAAC;KAChE;IACD,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE;QAC5C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,kBAAkB;QAC3B,WAAW,EAAE,8GAA8G;QAC3H,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,oCAAoC,CAAC;KACxD;IACD,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE;QAC9C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,kBAAkB;QAC3B,WAAW,EACT,yGAAyG;cACvG,0BAA0B;QAC9B,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,6DAA6D;QACpF,aAAa,EAAE,EAAE,CAAC,yBAAyB,CAAC;KAC7C;IACD,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE;QAC9C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,kBAAkB;QAC3B,WAAW,EAAE,mGAAmG;QAChH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,kCAAkC,CAAC;KACtD;IAED,gGAAgG;IAChG,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE;QAC5C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,yCAAyC;QAClD,WAAW,EACT,iHAAiH;cAC/G,sHAAsH;cACtH,uBAAuB;QAC3B,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,iCAAiC,CAAC;KACrD;IACD,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE;QAC/C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,oBAAoB;QAC7B,WAAW,EACT,wHAAwH;cACtH,qBAAqB;QACzB,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,6DAA6D,CAAC;KACjF;IACD,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE;QAC5C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,uBAAuB;QAChC,WAAW,EACT,qHAAqH;cACnH,oGAAoG;QACxG,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,6DAA6D;QACpF,aAAa,EAAE,EAAE,CAAC,mCAAmC,CAAC;KACvD;IACD,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE;QACnD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,2BAA2B;QACpC,WAAW,EAAE,2GAA2G;QACxH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,kCAAkC,CAAC;KACtD;IACD,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE;QACrD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QAC5B,OAAO,EAAE,oBAAoB;QAC7B,WAAW,EACT,wHAAwH;cACtH,2BAA2B;QAC/B,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,6DAA6D;QACpF,aAAa,EAAE,EAAE,CAAC,2BAA2B,CAAC;KAC/C;IACD,CAAC,wBAAwB,CAAC,kCAAkC,CAAC,EAAE;QAC7D,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,2CAA2C;QACpD,WAAW,EACT,iHAAiH;cAC/G,+GAA+G;cAC/G,oBAAoB;QACxB,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,iDAAiD,CAAC;KACrE;IACD,CAAC,wBAAwB,CAAC,oCAAoC,CAAC,EAAE;QAC/D,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,2BAA2B;QACpC,WAAW,EACT,gHAAgH;cAC9G,6GAA6G;cAC7G,0GAA0G;QAC9G,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,sEAAsE,CAAC;KAC1F;IACD,CAAC,wBAAwB,CAAC,kCAAkC,CAAC,EAAE;QAC7D,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,qDAAqD;QAC9D,WAAW,EACT,kHAAkH;cAChH,6GAA6G;cAC7G,kFAAkF;QACtF,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,iFAAiF,CAAC;KACrG;IACD,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE;QACtC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,2CAA2C;QACpD,WAAW,EACT,yHAAyH;cACvH,sHAAsH;cACtH,uHAAuH;cACvH,mHAAmH;QACvH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,6BAA6B,CAAC;KACjD;IACD,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE;QACtD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,yBAAyB;QAClC,WAAW,EACT,wHAAwH;cACtH,0GAA0G;QAC9G,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,2CAA2C,CAAC;KAC/D;IACD,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE;QAC9C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,+CAA+C;QACxD,WAAW,EACT,wHAAwH;cACtH,0HAA0H;cAC1H,0GAA0G;cAC1G,+GAA+G;QACnH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,sEAAsE,CAAC;KAC1F;IACD,CAAC,wBAAwB,CAAC,+BAA+B,CAAC,EAAE;QAC1D,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,oDAAoD;QAC7D,WAAW,EACT,yHAAyH;cACvH,qHAAqH;cACrH,oHAAoH;cACpH,8HAA8H;cAC9H,2DAA2D;QAC/D,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,oCAAoC,CAAC;KACxD;IACD,CAAC,wBAAwB,CAAC,8BAA8B,CAAC,EAAE;QACzD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,sCAAsC;QAC/C,WAAW,EACT,0HAA0H;cACxH,uFAAuF;QAC3F,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,uCAAuC,CAAC;KAC3D;IAED,gGAAgG;IAChG,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE;QAChD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,wBAAwB;QACjC,WAAW,EACT,uHAAuH;cACrH,oHAAoH;cACpH,iBAAiB;QACrB,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,aAAa;QACpC,aAAa,EAAE,EAAE,CAAC,gDAAgD,CAAC;KACpE;IACD,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE;QAC/C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC;QAC1C,OAAO,EAAE,yBAAyB;QAClC,WAAW,EACT,qHAAqH;cACnH,gHAAgH;cAChH,kHAAkH;QACtH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,0FAA0F;QACjH,aAAa,EAAE,EAAE,CAAC,gEAAgE,CAAC;KACpF;IACD,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE;QAC9C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,4DAA4D;QACrE,WAAW,EACT,mHAAmH;cACjH,+GAA+G;cAC/G,+GAA+G;cAC/G,wEAAwE;QAC5E,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,kDAAkD;QACzE,aAAa,EAAE,EAAE,CAAC,4FAA4F,CAAC;KAChH;IACD,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE;QACxD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,mCAAmC;QAC5C,WAAW,EACT,mHAAmH;cACjH,8EAA8E;QAClF,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,aAAa;QACpC,aAAa,EAAE,EAAE,CAAC,qDAAqD,CAAC;KACzE;IACD,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE;QACxD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,uCAAuC;QAChD,WAAW,EACT,wHAAwH;cACtH,8DAA8D;QAClE,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,aAAa;QACpC,aAAa,EAAE,EAAE,CAAC,qDAAqD,CAAC;KACzE;IACD,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE;QAC1C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,sBAAsB;QAC/B,WAAW,EACT,uHAAuH;cACrH,yBAAyB;QAC7B,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,aAAa;QACpC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,qDAAqD,EAAE;KAC/F;IACD,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE;QACxC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,iCAAiC;QAC1C,WAAW,EACT,wHAAwH;cACtH,oHAAoH;cACpH,6BAA6B;QACjC,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,wDAAwD;QAC/E,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,2EAA2E,EAAE;KACrH;IACD,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE;QAC7C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,qHAAqH;cACnH,oHAAoH;cACpH,kCAAkC;QACtC,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,+DAA+D;QACtF,aAAa,EAAE,EAAE,CAAC,iCAAiC,CAAC;KACrD;IACD,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE;QACxC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC;QAC1C,OAAO,EAAE,6BAA6B;QACtC,WAAW,EACT,wHAAwH;cACtH,oHAAoH;cACpH,yBAAyB;QAC7B,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,6DAA6D;QACpF,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,iDAAiD,EAAE;KAC3F;IACD,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE;QAC9C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,qBAAqB;QAC9B,WAAW,EACT,yHAAyH;cACvH,uHAAuH;cACvH,QAAQ;QACZ,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,wFAAwF,CAAC;KAC5G;IAED,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,EAAE;QAC3C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,qHAAqH;cACnH,uHAAuH;cACvH,0EAA0E;QAC9E,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,kGAAkG,CAAC;KACtH;IAED,gGAAgG;IAChG,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE;QACtD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,oCAAoC;QAC7C,WAAW,EACT,yHAAyH;cACvH,6FAA6F;QACjG,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,+CAA+C,CAAC;KACnE;IACD,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE;QACtD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,8BAA8B;QACvC,WAAW,EACT,uHAAuH;cACrH,oHAAoH;cACpH,yDAAyD;QAC7D,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,sDAAsD,EAAE;KAChG;IACD,CAAC,wBAAwB,CAAC,+BAA+B,CAAC,EAAE;QAC1D,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,qDAAqD;QAC9D,WAAW,EACT,uHAAuH;cACrH,cAAc;QAClB,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,sDAAsD,EAAE;KAChG;IACD,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE;QACxD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,kCAAkC;QAC3C,WAAW,EAAE,kHAAkH;QAC/H,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,gDAAgD;QACvE,aAAa,EAAE,EAAE,CAAC,0CAA0C,CAAC;KAC9D;IACD,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE;QACtD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,yHAAyH;cACvH,4BAA4B;QAChC,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,uCAAuC,CAAC;KAC3D;IACD,CAAC,wBAAwB,CAAC,+BAA+B,CAAC,EAAE;QAC1D,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,uDAAuD;QAChE,WAAW,EAAE,iFAAiF;QAC9F,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,uCAAuC,CAAC;KAC3D;IAED,gGAAgG;IAChG,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE;QACnD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,mCAAmC;QAC5C,WAAW,EACT,mHAAmH;cACjH,qHAAqH;cACrH,iHAAiH;cACjH,uDAAuD;QAC3D,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iFAAiF;QACxG,aAAa,EAAE,EAAE,CAAC,iCAAiC,CAAC;KACrD;IACD,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE;QACrD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,yCAAyC;QAClD,WAAW,EACT,sHAAsH;cACpH,iHAAiH;cACjH,qHAAqH;cACrH,8CAA8C;QAClD,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iFAAiF;QACxG,aAAa,EAAE,EAAE,CAAC,iCAAiC,CAAC;KACrD;IACD,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE;QAC9C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,kBAAkB;QAC3B,WAAW,EACT,yHAAyH;cACvH,qHAAqH;cACrH,4BAA4B;QAChC,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,wCAAwC;QAC/D,aAAa,EAAE,EAAE,CAAC,cAAc,CAAC;KAClC;IACD,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE;QACnD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,wBAAwB;QACjC,WAAW,EACT,qHAAqH;cACnH,oHAAoH;cACpH,4DAA4D;QAChE,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,gFAAgF;QACvG,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,0EAA0E,EAAE;KACpH;IACD,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE;QACjD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,2BAA2B;QACpC,WAAW,EACT,8GAA8G;cAC5G,kFAAkF;QACtF,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,8EAA8E;QACrG,aAAa,EAAE,EAAE,CAAC,gFAAgF,CAAC;KACpG;IACD,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE;QAC/C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,gBAAgB;QACzB,WAAW,EACT,uHAAuH;cACrH,sHAAsH;cACtH,yEAAyE;QAC7E,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,4EAA4E;QACnG,aAAa,EAAE,EAAE,CAAC,iDAAiD,CAAC;KACrE;IACD,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,EAAE;QAClD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,mBAAmB;QAC5B,WAAW,EAAE,qGAAqG;QAClH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,gDAAgD;QACvE,aAAa,EAAE,EAAE,CAAC,wBAAwB,CAAC;KAC5C;IACD,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE;QAChD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,gBAAgB;QACzB,WAAW,EACT,oHAAoH;cAClH,wDAAwD;QAC5D,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,4EAA4E;QACnG,aAAa,EAAE,EAAE,CAAC,kFAAkF,CAAC;KACtG;IACD,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE;QACrD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,sBAAsB;QAC/B,WAAW,EACT,wHAAwH;cACtH,qHAAqH;cACrH,sFAAsF;QAC1F,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,4DAA4D;QACnF,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,0EAA0E,EAAE;KACpH;IACD,CAAC,wBAAwB,CAAC,kCAAkC,CAAC,EAAE;QAC7D,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,mHAAmH;cACjH,gHAAgH;cAChH,8CAA8C;QAClD,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,2EAA2E;QAClG,aAAa,EAAE,EAAE,CAAC,sDAAsD,CAAC;KAC1E;IACD,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,EAAE;QAClD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,+BAA+B;QACxC,WAAW,EACT,0HAA0H;cACxH,gHAAgH;cAChH,mFAAmF;QACvF,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,kEAAkE;QACzF,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,6EAA6E,EAAE;KACvH;IACD,CAAC,wBAAwB,CAAC,8BAA8B,CAAC,EAAE;QACzD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC;QAC5D,OAAO,EAAE,wCAAwC;QACjD,WAAW,EACT,sHAAsH;cACpH,qHAAqH;cACrH,oEAAoE;QACxE,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,4FAA4F;QACnH,aAAa,EAAE,EAAE,CAAC,sEAAsE,CAAC;KAC1F;IAED,gGAAgG;IAChG,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE;QACpD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,wCAAwC;QACjD,WAAW,EACT,6GAA6G;cAC3G,qHAAqH;cACrH,iHAAiH;cACjH,8GAA8G;cAC9G,8GAA8G;cAC9G,iHAAiH;cACjH,+CAA+C;QACnD,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,gDAAgD,CAAC;KACpE;IACD,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE;QACvD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,iCAAiC;QAC1C,WAAW,EACT,yFAAyF;cACvF,qHAAqH;cACrH,gHAAgH;cAChH,kHAAkH;cAClH,uHAAuH;QAC3H,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,gGAAgG;QACvH,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,qFAAqF,EAAE;KAC/H;IACD,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE;QACvD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,+CAA+C;QACxD,WAAW,EACT,2HAA2H;cACzH,qHAAqH;cACrH,mHAAmH;cACnH,2GAA2G;QAC/G,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,6DAA6D,CAAC;KACjF;IACD,CAAC,wBAAwB,CAAC,oCAAoC,CAAC,EAAE;QAC/D,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,yCAAyC;QAClD,WAAW,EACT,qHAAqH;cACnH,yDAAyD;cACzD,gHAAgH;cAChH,8GAA8G;cAC9G,kFAAkF;QACtF,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,mDAAmD,CAAC;KACvE;IACD,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE;QACxD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,uBAAuB;QAChC,WAAW,EACT,oHAAoH;cAClH,uHAAuH;cACvH,wGAAwG;cACxG,+GAA+G;cAC/G,oHAAoH;cACpH,uEAAuE;QAC3E,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,mEAAmE,CAAC;KACvF;IAED,CAAC,wBAAwB,CAAC,gCAAgC,CAAC,EAAE;QAC3D,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,2DAA2D;QACpE,WAAW,EACT,8HAA8H;cAC5H,gIAAgI;cAChI,qHAAqH;cACrH,+GAA+G;cAC/G,4GAA4G;cAC5G,kHAAkH;cAClH,mDAAmD;QACvD,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,mFAAmF,CAAC;KACvG;IACD,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE;QACnD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,uHAAuH;cACrH,uHAAuH;cACvH,6GAA6G;cAC7G,mHAAmH;cACnH,kHAAkH;cAClH,0HAA0H;cAC1H,6GAA6G;QACjH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,+CAA+C,CAAC;KACnE;IACD,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE;QACrD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,qEAAqE;QAC9E,WAAW,EACT,8GAA8G;cAC5G,+GAA+G;cAC/G,0GAA0G;cAC1G,2GAA2G;cAC3G,+GAA+G;cAC/G,mBAAmB;QACvB,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,sGAAsG,CAAC;KAC1H;IACD,CAAC,wBAAwB,CAAC,gCAAgC,CAAC,EAAE;QAC3D,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,wDAAwD;QACjE,WAAW,EACT,mHAAmH;cACjH,uHAAuH;cACvH,kHAAkH;cAClH,sHAAsH;cACtH,oHAAoH;cACpH,2CAA2C;QAC/C,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,kGAAkG,CAAC;KACtH;IAED,gGAAgG;IAChG,CAAC,wBAAwB,CAAC,YAAY,CAAC,EAAE;QACvC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC;QAC7D,OAAO,EAAE,iCAAiC;QAC1C,WAAW,EACT,sHAAsH;cACpH,uHAAuH;cACvH,iHAAiH;cACjH,mHAAmH;cACnH,mHAAmH;cACnH,qHAAqH;QACzH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,8EAA8E;QACrG,aAAa,EAAE,EAAE,CAAC,uDAAuD,CAAC;KAC3E;IACD,CAAC,wBAAwB,CAAC,+BAA+B,CAAC,EAAE;QAC1D,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,oDAAoD;QAC7D,WAAW,EACT,wHAAwH;cACtH,sHAAsH;cACtH,gHAAgH;cAChH,uCAAuC;QAC3C,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,kFAAkF;QACzG,aAAa,EAAE,EAAE,CAAC,2CAA2C,CAAC;KAC/D;IACD,CAAC,wBAAwB,CAAC,cAAc,CAAC,EAAE;QACzC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,YAAY;QACrB,WAAW,EACT,sHAAsH;cACpH,qHAAqH;cACrH,QAAQ;QACZ,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,8EAA8E;QACrG,aAAa,EAAE,EAAE,CAAC,iBAAiB,CAAC;KACrC;IACD,CAAC,wBAAwB,CAAC,SAAS,CAAC,EAAE;QACpC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,2BAA2B;QACpC,WAAW,EACT,sHAAsH;cACpH,oHAAoH;cACpH,mHAAmH;QACvH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,8DAA8D;QACrF,aAAa,EAAE,EAAE,CAAC,yEAAyE,CAAC;KAC7F;IAED,gGAAgG;IAChG,CAAC,wBAAwB,CAAC,UAAU,CAAC,EAAE;QACrC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC;QAC5C,OAAO,EAAE,kCAAkC;QAC3C,WAAW,EACT,sHAAsH;cACpH,wHAAwH;cACxH,2EAA2E;QAC/E,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,sEAAsE;QAC7F,aAAa,EAAE,EAAE,CAAC,yDAAyD,CAAC;KAC7E;IACD,CAAC,wBAAwB,CAAC,cAAc,CAAC,EAAE;QACzC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,sHAAsH;cACpH,yCAAyC;QAC7C,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,8BAA8B,CAAC;KAClD;IACD,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE;QACtC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,uCAAuC;QAChD,WAAW,EACT,wHAAwH;cACtH,mDAAmD;QACvD,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,qCAAqC,EAAE;KAC/E;IACD,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE;QAC9C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QAC5B,OAAO,EAAE,0CAA0C;QACnD,WAAW,EACT,iHAAiH;cAC/G,4HAA4H;QAChI,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,yCAAyC,CAAC;KAC7D;IACD,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE;QACpD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,oCAAoC;QAC7C,WAAW,EACT,yHAAyH;cACvH,4DAA4D;QAChE,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,4EAA4E;QACnG,aAAa,EAAE,EAAE,CAAC,8CAA8C,CAAC;KAClE;IACD,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE;QACpD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QAC5B,OAAO,EAAE,wBAAwB;QACjC,WAAW,EACT,uHAAuH;cACrH,kGAAkG;QACtG,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,kCAAkC,CAAC;KACtD;IAED,gGAAgG;IAChG,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE;QAC1C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,wBAAwB;QACjC,WAAW,EACT,wHAAwH;cACtH,gGAAgG;QACpG,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,gEAAgE;QACvF,aAAa,EAAE,EAAE,CAAC,4CAA4C,CAAC;KAChE;IACD,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE;QAC5C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,sCAAsC;QAC/C,WAAW,EACT,wHAAwH;cACtH,qHAAqH;cACrH,WAAW;QACf,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,qCAAqC,CAAC;KACzD;IACD,CAAC,wBAAwB,CAAC,kCAAkC,CAAC,EAAE;QAC7D,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,uDAAuD;QAChE,WAAW,EACT,sHAAsH;cACpH,qHAAqH;cACrH,6GAA6G;cAC7G,6GAA6G;cAC7G,oHAAoH;QACxH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,2FAA2F;QAClH,aAAa,EAAE,EAAE,CAAC,qHAAqH,CAAC;KACzI;IACD,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE;QACtC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,wCAAwC;QACjD,WAAW,EACT,wHAAwH;cACtH,qHAAqH;cACrH,+CAA+C;QACnD,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,2BAA2B,CAAC;KAC/C;IACD,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE;QACxD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,iEAAiE;QAC1E,WAAW,EACT,uHAAuH;cACrH,0HAA0H;cAC1H,4HAA4H;cAC5H,wHAAwH;cACxH,4HAA4H;cAC5H,yHAAyH;QAC7H,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,4DAA4D,CAAC;KAChF;IACD,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE;QACjD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,oEAAoE;QAC7E,WAAW,EACT,6HAA6H;cAC3H,8HAA8H;cAC9H,8HAA8H;cAC9H,6GAA6G;QACjH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,2CAA2C,CAAC;KAC/D;IACD,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE;QAC7C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,2EAA2E;QACpF,WAAW,EACT,+HAA+H;cAC7H,6HAA6H;cAC7H,2HAA2H;cAC3H,4HAA4H;cAC5H,8HAA8H;cAC9H,8HAA8H;cAC9H,4BAA4B;QAChC,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,wCAAwC,CAAC;KAC5D;IACD,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE;QACnD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,yEAAyE;QAClF,WAAW,EACT,8HAA8H;cAC5H,2HAA2H;cAC3H,8HAA8H;cAC9H,2HAA2H;cAC3H,4GAA4G;QAChH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,6CAA6C,CAAC;KACjE;IACD,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE;QACvD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,wFAAwF;QACjG,WAAW,EACT,2HAA2H;cACzH,wHAAwH;cACxH,qHAAqH;cACrH,kHAAkH;cAClH,gJAAgJ;cAChJ,0HAA0H;cAC1H,sHAAsH;cACtH,6GAA6G;cAC7G,sBAAsB;QAC1B,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,8CAA8C,CAAC;KAClE;IACD,CAAC,wBAAwB,CAAC,8BAA8B,CAAC,EAAE;QACzD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,sEAAsE;QAC/E,WAAW,EACT,gIAAgI;cAC9H,4HAA4H;cAC5H,yHAAyH;cACzH,2HAA2H;cAC3H,cAAc;QAClB,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,mDAAmD,CAAC;KACvE;IACD,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE;QAC/C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,6EAA6E;QACtF,WAAW,EACT,oHAAoH;cAClH,uHAAuH;cACvH,2HAA2H;cAC3H,8HAA8H;cAC9H,cAAc;QAClB,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,0BAA0B,CAAC;KAC9C;IACD,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE;QACtD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,yEAAyE;QAClF,WAAW,EACT,oIAAoI;cAClI,sIAAsI;cACtI,qIAAqI;cACrI,wIAAwI;cACxI,mHAAmH;QACvH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,mEAAmE,CAAC;KACvF;IACD,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE;QACrD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,qDAAqD;QAC9D,WAAW,EACT,oHAAoH;cAClH,qHAAqH;cACrH,iFAAiF;QACrF,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,yEAAyE,CAAC;KAC7F;IACD,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE;QAC/C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC;QAC5C,OAAO,EAAE,uCAAuC;QAChD,WAAW,EACT,0HAA0H;cACxH,sEAAsE;QAC1E,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,kEAAkE,CAAC;KACtF;IACD,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE;QACjD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,kCAAkC;QAC3C,WAAW,EACT,uHAAuH;cACrH,wHAAwH;cACxH,mHAAmH;cACnH,0HAA0H;QAC9H,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,qBAAqB,CAAC;KACzC;IACD,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE;QACpD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,yDAAyD;QAClE,WAAW,EACT,sHAAsH;cACpH,qHAAqH;cACrH,wHAAwH;cACxH,qGAAqG;QACzG,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,uBAAuB,CAAC;KAC3C;IACD,CAAC,wBAAwB,CAAC,gCAAgC,CAAC,EAAE;QAC3D,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,qCAAqC;QAC9C,WAAW,EACT,wHAAwH;cACtH,qHAAqH;cACrH,sEAAsE;QAC1E,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,gCAAgC,CAAC;KACpD;IACD,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,EAAE;QAC3C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,iCAAiC;QAC1C,WAAW,EACT,sHAAsH;cACpH,uCAAuC;QAC3C,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,yBAAyB,CAAC;KAC7C;IACD,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE;QACrD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC;QAC1C,OAAO,EAAE,yCAAyC;QAClD,WAAW,EACT,qHAAqH;cACnH,6CAA6C;QACjD,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,wEAAwE,CAAC;KAC5F;IACD,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE;QACjD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,0CAA0C;QACnD,WAAW,EACT,uHAAuH;cACrH,kDAAkD;QACtD,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,0BAA0B,CAAC;KAC9C;CACF,CAAC","sourcesContent":["/*\n What each manually mounted controller route IS, for consumer documentation.\n \n ## Why this file exists\n \n A Wildo application serves two disjoint families of HTTP routes. The RESOURCE REGISTRY builds one\n * family from the resource configurations, and every mechanism downstream — the OpenAPI generator,\n * the API-reference renderer, the link index — projects that family and only that family. The other\n * family is mounted by hand, controller by controller, from\n * {@link MANUAL_CONTROLLER_ROUTES_URLS}: sign-in, token refresh, MFA, passkeys, SAML, the OAuth 2.0\n * authorization-server endpoints, the MCP and A2A doors, file transfer, i18n labels, charts.\n \n Nothing projected the second family, so it appeared in NO generated API reference. Measured\n * 2026-09-09 on the four committed documents of the two dogfood applications — 439, 576, 146 and 160\n * paths — every one of which contained zero paths under `/auth`. The reference told an integrator\n * that operations accept a bearer token and never told them which endpoint issues one; worse, four\n * operation-header descriptions in the same document say a step-up token is \"obtained from\n * `POST /api/v1/auth/reauth`\", a path that document does not publish.\n \n ## Why the facts live HERE and not at the mount site\n \n The route's VERB and its one-line purpose are already written at each `logRouteRegistration(...)`\n * call — 203 of them — inside `@wildo-ai/saas-backend-lib`. That package is the backend runtime, and\n * the documentation projector runs inside the companion's introspection subprocess, which loads the\n * application's SHARED library and never the backend. So the mount site cannot be the source: it is\n * not reachable from where the answer is needed.\n \n This catalog is therefore the shared, statically-loadable source, and it is *total over\n {@link ManualControllerRouteKey}** by construction. A route key added tomorrow does not compile\n * until somebody says what it is and whether it may be published — which is the whole point: an\n * undocumented route should be a build failure, not a silent hole in a customer-facing reference.\n \n ## What is deliberately NOT here\n \n No request or response JSON Schema. The request bodies are Zod schemas declared inside the backend\n * controllers, unreachable from this package; hand-copying them here would create a second copy of a\n * contract with nothing checking the two agree — the exact drift this repository refuses elsewhere.\n * Each entry therefore names its payload in PROSE and authors its success status, which is honest\n * about what is known. Wiring the real schemas is a later, larger change that has to move them into a\n * shared module first.\n /\n\nimport { HttpMethod } from './http-requests.shared';\nimport { ManualControllerRouteKey } from './manual-controllers-routes-urls';\n\n/\n The API-reference grouping a manual route belongs to — the OpenAPI `tag` it is published under.\n \n Deliberately NOT one group per controller. A reader groups by what they are trying to DO, and the\n * controller split is an implementation fact: sign-in lives in one controller and password change in\n * another, and both are \"authentication\" to the person reading.\n \n The values must not collide with any resource identifier, because the generator turns a tag name\n * into `technical-documentation:resource/<name>` and two tags claiming one ref would make the\n * renderer's conservation check refuse the document. Resource identifiers are the resource TYPES\n * (`users`, `organizations`, `oauthConsentGrants`, …); none of these names is one.\n /\nexport enum ManualControllerRouteGroup {\n /* Signing in, staying signed in, signing out, and everything that proves who the caller is. /\n AUTHENTICATION = 'authentication',\n /* This application acting as an OAuth 2.0 / OpenID Connect authorization server for other software. /\n IDENTITY_PROVIDER = 'identityProvider',\n /* Connecting a third-party account so this application can act as it. The opposite arrow from sign-in. /\n CONNECTED_ACCOUNTS = 'connectedAccounts',\n /* The doors an autonomous agent knocks on: Model Context Protocol and Agent2Agent. /\n AGENT_INTERFACES = 'agentInterfaces',\n /* Transferring a stored file by its own id, wherever it is attached. /\n FILE_TRANSFER = 'fileTransfer',\n /* Reads a client makes to work out what this application currently offers it. /\n APPLICATION_RUNTIME = 'applicationRuntime',\n}\n\n/\n What a caller must present. Mirrors the documentation vocabulary the resource projector already\n * resolves from role bindings, so both families of routes describe access the same way.\n /\nexport enum ManualControllerRouteAuthentication {\n /* No credential. The request itself carries whatever authorization it needs (a single-use token, say). /\n PUBLIC = 'public',\n /* An anonymous-session token in the anonymous-session header. /\n ANONYMOUS_SESSION = 'anonymous_session',\n /* A bearer access token, or an API key where the surface accepts one. /\n AUTHENTICATED = 'authenticated',\n /* Either an anonymous session or a full credential; the endpoint serves both. /\n ANONYMOUS_OR_AUTHENTICATED = 'anonymous_or_authenticated',\n}\n\n/* Whether a route reaches the generated consumer API reference. /\nexport enum ManualControllerRoutePublication {\n PUBLISHED = 'published',\n WITHHELD = 'withheld',\n}\n\n/* A route that is published: everything the projector needs to emit an OpenAPI operation. /\nexport interface PublishedManualControllerRouteDocumentation {\n readonly publication: ManualControllerRoutePublication.PUBLISHED;\n readonly group: ManualControllerRouteGroup;\n /\n The methods actually mounted for this path, measured from the controllers rather than assumed.\n * One key can carry several (`/oauth/register/{clientId}` is GET, PUT and DELETE; RFC 7592 defines\n * ONE endpoint whose method selects the operation), and each becomes its own OpenAPI operation.\n /\n readonly methods: readonly HttpMethod[];\n /* Short action label. Becomes the OpenAPI `summary`; the generator caps it at 200 characters. /\n readonly summary: string;\n /* What the endpoint does, what it expects, and what a caller does with the answer. Capped at 2000. /\n readonly description: string;\n readonly authentication: ManualControllerRouteAuthentication;\n /* One sentence naming the credential. Capped at 500. /\n readonly authenticationSummary: string;\n /\n The success status and what it means. Authored because no response schema is projected: without\n * it the generator would emit a bare `204 No Content`, which is wrong for almost every route here.\n /\n readonly successStatus: { readonly code: string; readonly meaning: string };\n}\n\n/\n A route that is NOT published, and why.\n \n The reason is a required field rather than a comment on purpose. Withholding a route from a\n * customer-facing reference is a decision, and a decision with no recorded reason is indistinguishable\n * from an oversight — which is how this whole family came to be missing in the first place.\n /\nexport interface WithheldManualControllerRouteDocumentation {\n readonly publication: ManualControllerRoutePublication.WITHHELD;\n readonly withheldReason: string;\n}\n\nexport type ManualControllerRouteDocumentation =\n \| PublishedManualControllerRouteDocumentation\n \| WithheldManualControllerRouteDocumentation;\n\n/* Shorthand for the common `200` success row, so the entries below stay readable. /\nfunction ok(meaning: string): { code: string; meaning: string } {\n return { code: '200', meaning };\n}\n\nconst AUTH = ManualControllerRouteGroup.AUTHENTICATION;\nconst IDP = ManualControllerRouteGroup.IDENTITY_PROVIDER;\nconst CONNECTIONS = ManualControllerRouteGroup.CONNECTED_ACCOUNTS;\nconst AGENTS = ManualControllerRouteGroup.AGENT_INTERFACES;\nconst FILES = ManualControllerRouteGroup.FILE_TRANSFER;\nconst RUNTIME = ManualControllerRouteGroup.APPLICATION_RUNTIME;\n\nconst PUBLIC = ManualControllerRouteAuthentication.PUBLIC;\nconst BEARER = ManualControllerRouteAuthentication.AUTHENTICATED;\n\nconst NO_CREDENTIAL = 'No credential. This endpoint is reachable before a caller has one.';\nconst BEARER_CREDENTIAL = 'A bearer access token identifying the caller.';\n\n/* Prose group descriptions, emitted as each published group's OpenAPI `tags[].description`. /\nexport const MANUAL_CONTROLLER_ROUTE_GROUP_DESCRIPTIONS: Record<ManualControllerRouteGroup, string> = {\n [ManualControllerRouteGroup.AUTHENTICATION]:\n 'Obtaining a credential, keeping it, and giving it up. Start at Identify a caller* to learn which methods an account '\n + 'can use, then call the method you chose; a successful call returns the access token every other operation in this '\n + 'reference accepts as `Authorization: Bearer <token>`. These endpoints are mounted by the framework rather than derived '\n + 'from a resource, so their payloads are described in prose here rather than carrying a JSON Schema.',\n [ManualControllerRouteGroup.IDENTITY_PROVIDER]:\n 'This application acting as an OAuth 2.0 authorization server and OpenID Connect provider for OTHER software — the '\n + 'endpoints a client, an MCP client or an agent uses to obtain a token bound to this application. Distinct from the '\n + 'authentication endpoints, which sign a person in TO this application. Payloads follow the cited RFCs; this reference '\n + 'publishes the addresses and the contract summary rather than re-stating the specifications.',\n [ManualControllerRouteGroup.CONNECTED_ACCOUNTS]:\n 'Connecting a third-party account so this application can act as that account. The opposite direction from signing in '\n + 'with a vendor: same protocol, opposite arrow.',\n [ManualControllerRouteGroup.AGENT_INTERFACES]:\n 'The endpoints autonomous software talks to: the Model Context Protocol server and the Agent2Agent surface, plus the '\n + 'public metadata each advertises so a client can discover where to get a token.',\n [ManualControllerRouteGroup.FILE_TRANSFER]:\n 'Transferring a stored file by its own id. Distinct from a resource\\'s own `…/{id}/files/{field}` routes, which upload '\n + 'and replace the file bound to one field of one record.',\n [ManualControllerRouteGroup.APPLICATION_RUNTIME]:\n 'Reads a client makes to work out what this application currently offers it — resolved features, translated labels, '\n + 'chart data, conversational history, product-analytics ingestion.',\n};\n\n/*\n Every manually mounted route, keyed by the route it is mounted at.\n \n TOTAL over {@link ManualControllerRouteKey}: the `Record` type makes a new route key a compile\n * error until it is described here. That is the mechanism that keeps this catalog honest — a\n * hand-kept list of \"the ones we remembered\" is precisely what rots.\n /\nexport const MANUAL_CONTROLLER_ROUTE_DOCUMENTATION: Record<ManualControllerRouteKey, ManualControllerRouteDocumentation> = {\n [ManualControllerRouteKey.APPLICATION_CONFIG_GET]: {\n publication: ManualControllerRoutePublication.WITHHELD,\n withheldReason:\n 'Bootstrap contract between this application\\'s backend and its OWN frontend bundles. The response is keyed by a '\n + '`frontendServiceName` query parameter and its shape follows whatever that frontend is configured to need, so it is '\n + 'not a stable surface for an integrator and publishing it would invite calls that break when a frontend changes.',\n },\n\n // ─── Signing in ──────────────────────────────────────────────────────────────────────────────\n [ManualControllerRouteKey.AUTH_IDENTIFY]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Identify a caller and list the authentication methods available to them',\n description:\n 'The first step of every sign-in. Post the identifier a person signs in with (their email address, typically) and the '\n + 'answer says which authentication methods that account can use — password, passkey, magic link, one-time code, an '\n + 'enterprise connection — so the caller can present the right one next. Deliberately does not say whether the account '\n + 'exists in terms an attacker can enumerate.',\n authentication: PUBLIC,\n authenticationSummary: NO_CREDENTIAL,\n successStatus: ok('The methods this caller may authenticate with, and what each of them needs next.'),\n },\n [ManualControllerRouteKey.AUTH_AUTHENTICATE_PASSWORD]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Authenticate with a password',\n description:\n 'Sign in with an identifier and a password. On success the response carries the access token every other operation in '\n + 'this reference accepts as `Authorization: Bearer <token>`, and the refresh token is set as an HTTP-only cookie scoped '\n + 'to the authentication routes. When the account requires a second factor the answer says so and names the factor '\n + 'instead of issuing a token; complete it at the matching MFA endpoint.',\n authentication: PUBLIC,\n authenticationSummary: NO_CREDENTIAL,\n successStatus: ok('An access token and the caller\\'s session, or the second factor still owed.'),\n },\n [ManualControllerRouteKey.AUTH_AUTHENTICATE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Authenticate with any method',\n description:\n 'The universal sign-in endpoint: name the method and supply its proof, and the answer is the same shape whichever method '\n + 'was used. Prefer this over the per-method endpoints when the client renders whatever Identify a caller* offered, '\n + 'because one code path then serves every method the application enables.',\n authentication: PUBLIC,\n authenticationSummary: NO_CREDENTIAL,\n successStatus: ok('An access token and the caller\\'s session, or the next step still owed.'),\n },\n [ManualControllerRouteKey.AUTH_TOKEN_REFRESH]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Refresh an access token',\n description:\n 'Exchange the refresh token for a new access token. Deliberately NOT behind bearer authentication — the caller reaches '\n + 'this endpoint precisely because their access token has expired. Browsers send the refresh token automatically in its '\n + 'HTTP-only cookie, which is why the request needs no body from them.',\n authentication: PUBLIC,\n authenticationSummary:\n 'No bearer token. The refresh token itself is the credential, sent in its HTTP-only cookie or in the request.',\n successStatus: ok('A fresh access token, and a rotated refresh token in its cookie.'),\n },\n [ManualControllerRouteKey.AUTH_SESSION_STATE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET],\n summary: 'Read the state of an in-progress authentication session',\n description:\n 'Where a multi-step sign-in has got to: which factors are satisfied, which are still owed, and whether the session is '\n + 'still live. Addressed by the session identifier a previous step returned.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The session identifier is the thing being asked about.',\n successStatus: ok('The session\\'s current step and what it still requires.'),\n },\n [ManualControllerRouteKey.AUTH_LOGOUT]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Sign out of this session',\n description:\n 'Ends the caller\\'s current session and clears the refresh-token cookie. The cookie is cleared even when no refresh token '\n + 'was presented, because clearing is the user-visible act and a stale cookie must not survive it.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The session is ended and the refresh-token cookie is cleared.'),\n },\n [ManualControllerRouteKey.AUTH_LOGOUT_ALL]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Sign out everywhere',\n description:\n 'Invalidates every access and refresh token this user holds, on every device, by moving the user\\'s invalidation fence '\n + 'forward. Use it after a password change or a suspected compromise; unlike Sign out of this session it reaches '\n + 'sessions the caller is not currently using.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('Every session this user holds is now invalid.'),\n },\n [ManualControllerRouteKey.AUTH_REGISTER]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Register a new account',\n description:\n 'Creates an account from the sign-up details the application asks for. Whether the new account can sign in immediately, '\n + 'must verify its email address first, must enroll a second factor before it can sign in, or must complete organization '\n + 'onboarding depends on how this application is configured; the answer says which of those applies.',\n authentication: PUBLIC,\n authenticationSummary: NO_CREDENTIAL,\n successStatus: ok('The account, and what it must do before it can sign in.'),\n },\n [ManualControllerRouteKey.AUTH_VERIFY_EMAIL]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Verify an email address',\n description:\n 'Consumes the single-use token from a verification email and marks the address verified, which is what activates an '\n + 'account that was waiting on it. The token is single-use: a second call with the same token fails.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The single-use token in the request is what authorizes it.',\n successStatus: ok('The address is verified and the account is active.'),\n },\n [ManualControllerRouteKey.AUTH_RESEND_VERIFICATION]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Resend the verification email',\n description:\n 'Sends the verification email again for an address that has not been verified. Answers the same way whether or not the '\n + 'address belongs to an account, so it cannot be used to discover who has one.',\n authentication: PUBLIC,\n authenticationSummary: NO_CREDENTIAL,\n successStatus: ok('The request was accepted; a message is sent if the address is awaiting verification.'),\n },\n [ManualControllerRouteKey.AUTH_PASSWORD_RESET_REQUEST]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Request a password reset',\n description:\n 'Starts a password reset by emailing a single-use link to the address supplied. Answers identically whether or not that '\n + 'address has an account, so it cannot be used to enumerate users.',\n authentication: PUBLIC,\n authenticationSummary: NO_CREDENTIAL,\n successStatus: ok('The request was accepted; a message is sent if the address has an account.'),\n },\n [ManualControllerRouteKey.AUTH_PASSWORD_RESET_COMPLETE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Complete a password reset',\n description:\n 'Sets the new password, presenting the single-use token from the reset email. The token is consumed, and existing '\n + 'sessions are invalidated so a stolen session cannot outlive the reset.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The single-use reset token is what authorizes the change.',\n successStatus: ok('The password is changed and previous sessions are invalidated.'),\n },\n [ManualControllerRouteKey.AUTH_COMPLETE_ORG_ONBOARDING]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Complete organization onboarding',\n description:\n 'For applications that name an account\\'s organization at onboarding: creates the organization and makes the account '\n + 'its owner, on an authentication session parked at `ONBOARDING_PENDING` — by registration, by email verification or '\n + 'enrollment, or by a sign-in answered `nextStep: onboarding` because the account still owes its organization. It '\n + 'signs the account in when nothing else is owed; when another onboarding obligation remains (the person\\'s names, for '\n + 'a user type that collects them at onboarding), the session stays parked and the response names what is still owed. '\n + 'A sign-in response carries the access token; the refresh token is set only as the HttpOnly refresh cookie.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The parked session id in the body is what authorizes the completion, and it is consumed by it.',\n successStatus: ok('The organization exists and the account owns it; the account is signed in unless another obligation remains.'),\n },\n [ManualControllerRouteKey.AUTH_COMPLETE_PROFILE_ONBOARDING]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Complete profile onboarding',\n description:\n 'For user types that collect a person\\'s first and last name at onboarding rather than on the sign-up form: writes the '\n + 'account\\'s profile with those names, on an authentication session parked at `ONBOARDING_PENDING` that owes them. It '\n + 'signs the account in when nothing else is owed; when the organization is still owed, the session stays parked and '\n + 'the response names what remains. A sign-in response carries the access token; the refresh token is set only as the '\n + 'HttpOnly refresh cookie.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The parked session id in the body is what authorizes the completion.',\n successStatus: ok('The profile carries the names; the account is signed in unless another obligation remains.'),\n },\n\n // ─── Invitations ─────────────────────────────────────────────────────────────────────────────\n [ManualControllerRouteKey.AUTH_INVITATION_INFO]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET],\n summary: 'Read what an invitation offers',\n description:\n 'Given an invitation token, returns the inviting organization and the authentication methods it allows, so the accept '\n + 'screen can offer the right choice. Read-only: it does NOT consume the token, so it is safe to call before the person '\n + 'has decided.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The invitation token is what identifies the invitation.',\n successStatus: ok('The inviting organization and the methods it accepts.'),\n },\n [ManualControllerRouteKey.AUTH_ACCEPT_INVITATION]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Accept an invitation with its token',\n description:\n 'Consumes an invitation token and joins the invited organization. It then signs the person in, emails them a sign-in '\n + 'link when they chose one, or, for an existing account whose policy does not allow signing in from an emailed link, '\n + 'answers `nextStep: sign_in_required` and signs nobody in. For somebody arriving from the invitation email with no session. A signed-in user acting on their own pending invitations uses Accept one of my '\n + 'invitations instead, which needs no token.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The single-use invitation token is what authorizes the join.',\n successStatus: ok('Membership is created; the caller is signed in, sent a sign-in link, or told to sign in.'),\n },\n [ManualControllerRouteKey.AUTH_REJECT_INVITATION]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Reject an invitation with its token',\n description: 'Consumes an invitation token and declines it. No account is created and no session is issued.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The single-use invitation token is what authorizes the refusal.',\n successStatus: ok('The invitation is declined.'),\n },\n [ManualControllerRouteKey.AUTH_LIST_MY_INVITATIONS]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET],\n summary: 'List my pending invitations',\n description:\n 'Every pending invitation addressed to the signed-in caller\\'s own email address. Authorized by ownership of that '\n + 'address rather than by a token, so it works in-app without anybody opening an email.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The caller\\'s pending invitations.'),\n },\n [ManualControllerRouteKey.AUTH_ACCEPT_MY_INVITATION]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Accept one of my invitations',\n description:\n 'Joins an organization that invited the signed-in caller\\'s own email address. No invitation token and no new session: '\n + 'the caller keeps the session they already have.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('Membership is created; the caller\\'s existing session continues.'),\n },\n [ManualControllerRouteKey.AUTH_REJECT_MY_INVITATION]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Reject one of my invitations',\n description: 'Declines an invitation addressed to the signed-in caller\\'s own email address.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The invitation is declined.'),\n },\n\n // ─── Multi-factor authentication ─────────────────────────────────────────────────────────────\n [ManualControllerRouteKey.AUTH_MFA_EMAIL_OTP_SEND]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Send an email one-time code',\n description: 'Emails a one-time code for the authentication session that is waiting on an email second factor.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The in-progress authentication session identifies the caller.',\n successStatus: ok('A code has been sent.'),\n },\n [ManualControllerRouteKey.AUTH_MFA_EMAIL_OTP_VERIFY]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Verify an email one-time code',\n description:\n 'Presents the emailed code. When it is the last factor owed, the answer carries the access token and completes sign-in.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The code and the in-progress session are the proof.',\n successStatus: ok('The factor is satisfied; an access token when nothing else is owed.'),\n },\n [ManualControllerRouteKey.AUTH_MFA_TOTP_SETUP]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Begin TOTP enrolment',\n description:\n 'Starts enrolling an authenticator app: returns the shared secret and its provisioning URI to render as a QR code. '\n + 'Enrolment is not finished until Confirm TOTP enrolment proves the caller can produce a code from it.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The secret and provisioning URI to show the caller.'),\n },\n [ManualControllerRouteKey.AUTH_MFA_TOTP_VERIFY_SETUP]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Confirm TOTP enrolment',\n description:\n 'Completes enrolment by presenting a code generated from the secret just issued. Only after this does TOTP count as an '\n + 'available method — enrolling without confirming would lock the caller out of their own second factor.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('TOTP is enrolled and usable.'),\n },\n [ManualControllerRouteKey.AUTH_MFA_TOTP_VERIFY]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Verify a TOTP code',\n description:\n 'Presents a code from the enrolled authenticator app for an authentication session waiting on that factor. When it is '\n + 'the last factor owed, the answer carries the access token.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The code and the in-progress session are the proof.',\n successStatus: ok('The factor is satisfied; an access token when nothing else is owed.'),\n },\n [ManualControllerRouteKey.AUTH_MFA_TOTP_DISABLE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Disable TOTP',\n description:\n 'Removes the enrolled authenticator app. Removing a second factor is a sensitive operation, so it requires a fresh '\n + 're-authentication proof obtained from Re-authenticate.',\n authentication: BEARER,\n authenticationSummary: 'A bearer access token plus a fresh re-authentication token.',\n successStatus: ok('TOTP is no longer enrolled.'),\n },\n [ManualControllerRouteKey.AUTH_SMS_OTP_SEND]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Send an SMS one-time code',\n description:\n 'Texts a one-time code to the account\\'s verified phone number. Present the code at Authenticate with any method, '\n + 'naming the SMS method — this family has no separate verify endpoint.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The in-progress authentication session identifies the caller.',\n successStatus: ok('A code has been sent.'),\n },\n [ManualControllerRouteKey.AUTH_SMS_OTP_VERIFY]: {\n publication: ManualControllerRoutePublication.WITHHELD,\n withheldReason:\n 'Declared in the route registry and mounted by NO controller — measured 2026-09-09 by scanning every '\n + '`this.router.<verb>(…)` call in the engine, where this is the only registry key with no mount. Publishing it would '\n + 'document an address that answers 404. Verification of an SMS code goes through the universal authenticate endpoint.',\n },\n [ManualControllerRouteKey.AUTH_PHONE_VERIFY_SEND]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Send a phone-verification code',\n description:\n 'Texts a code to prove the caller controls a phone number they are adding. Distinct from the SMS second factor: this '\n + 'establishes the number, that one uses it.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('A code has been sent to the number.'),\n },\n [ManualControllerRouteKey.AUTH_PHONE_VERIFY_CONFIRM]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Confirm a phone-verification code',\n description: 'Presents the texted code and marks the phone number verified on the caller\\'s account.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The number is verified.'),\n },\n [ManualControllerRouteKey.AUTH_MAGIC_LINK_SEND]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Send a magic link',\n description:\n 'Emails a single-use sign-in link. Answers identically whether or not the address has an active account, so it cannot '\n + 'be used to discover who does.',\n authentication: PUBLIC,\n authenticationSummary: NO_CREDENTIAL,\n successStatus: ok('The request was accepted; a link is sent if the address has an active account.'),\n },\n [ManualControllerRouteKey.AUTH_MAGIC_LINK_VERIFY]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Verify a magic link',\n description: 'Consumes the token from a magic link and signs the caller in. Single-use: a replayed token fails.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The single-use link token is the proof.',\n successStatus: ok('An access token and the caller\\'s session.'),\n },\n\n // ─── Passkeys (WebAuthn) ─────────────────────────────────────────────────────────────────────\n [ManualControllerRouteKey.AUTH_PASSKEY_REGISTER_OPTIONS]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Begin passkey registration',\n description:\n 'Returns the WebAuthn creation options — challenge, relying party, excluded credentials — to hand to '\n + '`navigator.credentials.create()`. WebAuthn is challenge-response, which is why registering a passkey takes two calls.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('WebAuthn creation options for the browser.'),\n },\n [ManualControllerRouteKey.AUTH_PASSKEY_REGISTER_VERIFY]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Complete passkey registration',\n description: 'Presents the attestation the authenticator produced and stores the passkey against the caller\\'s account.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The passkey is registered.'),\n },\n [ManualControllerRouteKey.AUTH_PASSKEY_AUTH_OPTIONS]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Begin passkey authentication',\n description:\n 'Returns `{ sessionId, options, expiresInSeconds }`: the WebAuthn request options to hand to '\n + '`navigator.credentials.get()`, the authentication session their challenge is bound to, and how long that '\n + 'challenge can still be redeemed — a waiting autofill request should be restarted before then. Without a `sessionId` it opens a sign-in '\n + 'before any email is known (passkey autofill, or a sign-in-with-a-passkey button). For a sign-in the '\n + 'options list no credentials, so the device offers every account the person holds for this site and '\n + 'the answer is the same whatever email was entered; for a second factor they list the signed-in '\n + 'account\\'s own passkeys.',\n authentication: PUBLIC,\n authenticationSummary: NO_CREDENTIAL,\n successStatus: ok('WebAuthn request options for the browser.'),\n },\n [ManualControllerRouteKey.AUTH_PASSKEY_AUTH_VERIFY]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Complete passkey authentication',\n description:\n 'Presents the assertion the authenticator produced, with the `sessionId` its options were issued for. '\n + 'The account is the one the passkey belongs to, whatever email was entered. On success the answer '\n + 'carries the access token; `passkeyCredentialUnknown` marks a passkey this application no longer holds.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The WebAuthn assertion is the proof.',\n successStatus: ok('An access token and the caller\\'s session.'),\n },\n [ManualControllerRouteKey.AUTH_PASSKEY_LIST]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET],\n summary: 'List my passkeys',\n description: 'Every passkey registered on the caller\\'s account, with the name and last-used time to show in a manager UI.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The caller\\'s registered passkeys.'),\n },\n [ManualControllerRouteKey.AUTH_PASSKEY_REMOVE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Remove a passkey',\n description:\n 'Deletes one registered passkey. Removing an authentication method is sensitive, so it requires a fresh '\n + 're-authentication proof.',\n authentication: BEARER,\n authenticationSummary: 'A bearer access token plus a fresh re-authentication token.',\n successStatus: ok('The passkey is removed.'),\n },\n [ManualControllerRouteKey.AUTH_PASSKEY_RENAME]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Rename a passkey',\n description: 'Changes the label a passkey is shown under. Cosmetic: it does not affect what the passkey can do.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The passkey\\'s label is changed.'),\n },\n\n // ─── Managing my authentication methods ──────────────────────────────────────────────────────\n [ManualControllerRouteKey.AUTH_METHODS_MINE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET],\n summary: 'List my enrolled authentication methods',\n description:\n 'Which methods the signed-in caller has actually enrolled — password, TOTP, passkeys, linked identities — for a '\n + '\"security settings\" screen. Distinct from Identify a caller, which answers the same question before sign-in and '\n + 'says less on purpose.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The caller\\'s enrolled methods.'),\n },\n [ManualControllerRouteKey.AUTH_PASSWORD_CHANGE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Change my password',\n description:\n 'Replaces the caller\\'s password, presenting the current one. Refresh tokens are invalidated, so other sessions cannot '\n + 'outlive the change.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The password is changed and other sessions are invalidated.'),\n },\n [ManualControllerRouteKey.AUTH_PASSWORD_SET]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Set my first password',\n description:\n 'Adds a password to an account that has never had one — somebody who signed up through a vendor identity or a magic '\n + 'link. There is no current password to present, so a fresh re-authentication proof takes its place.',\n authentication: BEARER,\n authenticationSummary: 'A bearer access token plus a fresh re-authentication token.',\n successStatus: ok('A password is set on the account.'),\n },\n [ManualControllerRouteKey.AUTH_IDENTITY_LINKS_LIST]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET],\n summary: 'List my linked identities',\n description: 'The external identity providers linked to the caller\\'s account, and which one each sign-in came through.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The caller\\'s linked identities.'),\n },\n [ManualControllerRouteKey.AUTH_IDENTITY_LINKS_UNLINK]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.DELETE],\n summary: 'Unlink an identity',\n description:\n 'Removes one linked external identity. Refused when it is the caller\\'s only way in, so unlinking cannot lock somebody '\n + 'out of their own account.',\n authentication: BEARER,\n authenticationSummary: 'A bearer access token plus a fresh re-authentication token.',\n successStatus: ok('The identity is unlinked.'),\n },\n [ManualControllerRouteKey.GOVERNED_DOCUMENT_ACCEPTANCES_OWED]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.GET],\n summary: 'List the documents I owe an acceptance of',\n description:\n 'The governed documents in force that the caller has never accepted, or that changed materially since they last '\n + 'did — each with every in-force variant (one per locale and jurisdiction). Empty for an application that asks '\n + 'for no acceptance.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The documents the caller owes an acceptance of.'),\n },\n [ManualControllerRouteKey.GOVERNED_DOCUMENT_ACCEPTANCES_ACCEPT]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.POST],\n summary: 'Accept governed documents',\n description:\n 'Records that the caller accepted the named in-force releases. Only release IDS are sent: which version, which '\n + 'document and how the application asked are all read from the application\\'s own configuration, so a caller '\n + 'cannot choose the terms they are recorded as having agreed to. An id naming nothing in force is ignored.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The acceptances are recorded; the response lists what is still owed.'),\n },\n [ManualControllerRouteKey.GOVERNED_DOCUMENT_NOTICE_DELIVERED]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.POST],\n summary: 'Record that a governed document was delivered to me',\n description:\n 'Records that the caller was shown the named governed document. Only the document REF is sent: the exact release '\n + 'version in force is resolved from the application\\'s own configuration, never from the request. A document '\n + 'whose in-force release does not permit recording a delivery is silently a no-op.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The delivery is recorded, or silently skipped when nothing in force permits it.'),\n },\n [ManualControllerRouteKey.AUTH_REAUTH]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Re-authenticate for a sensitive operation',\n description:\n 'Proves the person at the keyboard is still the account holder, and returns the single-use step-up token that sensitive '\n + 'operations require in their step-up header. This is the endpoint those operations point at. `purpose` says what the '\n + 'proof is for: `step_up` (the default) must use a factor the account\\'s step-up policy accepts; `bind_authenticator`, '\n + 'asked for when adding a way to sign in, accepts any factor the account holds and is accepted only by those doors.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('A single-use step-up token.'),\n },\n [ManualControllerRouteKey.AUTH_REAUTH_PASSKEY_OPTIONS]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Begin a passkey step-up',\n description:\n 'The challenge leg of re-authenticating with a passkey. WebAuthn is challenge-response, so a passkey step-up needs two '\n + 'round-trips: take these options to the authenticator, then present the assertion at Re-authenticate.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('WebAuthn request options for the step-up.'),\n },\n [ManualControllerRouteKey.AUTH_REAUTH_METHODS]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET],\n summary: 'List the factors that can re-authenticate you',\n description:\n 'Which of the signed-in person\\'s own factors can produce a re-authentication proof for the given `purpose`, strongest '\n + 'first. For `step_up`, only factors the account\\'s step-up policy accepts are listed; for `bind_authenticator` (adding a '\n + 'way to sign in), every factor the account holds is. Also lists the linked identities whose provider can '\n + 're-authenticate the person (`identityLinks`). Both empty means the account must add an accepted factor first.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The factors, strongest first, and the re-provable linked identities.'),\n },\n [ManualControllerRouteKey.AUTH_REAUTH_FEDERATED_AUTHORIZE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Re-authenticate through a linked identity provider',\n description:\n 'Starts a re-authentication at the identity provider behind one of the signed-in person\\'s own linked accounts, for the '\n + 'given `purpose`. Answers the provider URL to open (in a popup). The provider is asked to sign the person in afresh '\n + '(OIDC `prompt=login` + `max_age=0`, SAML `ForceAuthn`), and the proof is minted only if its signed answer (the ID '\n + 'token\\'s `auth_time`, or the assertion\\'s `AuthnInstant`) shows a sign-in newer than this request. Refused for a link whose '\n + 'provider or connection has not enabled re-authentication.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The identity provider URL to open.'),\n },\n [ManualControllerRouteKey.AUTH_REAUTH_FEDERATED_EXCHANGE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Redeem a federated re-authentication',\n description:\n 'Exchanges the one-time code a federated re-authentication returned for its single-use re-authentication token. The code '\n + 'is redeemable only by the account it was minted for, with that account\\'s own bearer.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('A single-use re-authentication token.'),\n },\n\n // ─── Signing in through somebody else's identity provider ────────────────────────────────────\n [ManualControllerRouteKey.AUTH_OAUTH2_AUTHORIZE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET],\n summary: 'Start a social sign-in',\n description:\n 'Returns the vendor authorization URL to send the browser to, for the named provider. The client navigates there; the '\n + 'vendor sends the person back to the callback below. Returns a URL rather than redirecting, so the client controls '\n + 'the navigation.',\n authentication: PUBLIC,\n authenticationSummary: NO_CREDENTIAL,\n successStatus: ok('The provider authorization URL to navigate to.'),\n },\n [ManualControllerRouteKey.AUTH_OAUTH2_CALLBACK]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET, HttpMethod.POST],\n summary: 'Social sign-in callback',\n description:\n 'Where the identity provider sends the browser back. You do not call this — it is the redirect URI you register '\n + 'with the vendor, published here so you can configure it. Accepts POST as well as GET because some vendors use '\n + '`response_mode=form_post`. It completes the sign-in and hands the client a one-time code to exchange for tokens.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The provider\\'s authorization code and the state parameter are the proof.',\n successStatus: ok('The caller is redirected onward with a one-time exchange code.'),\n },\n [ManualControllerRouteKey.AUTH_TOKEN_EXCHANGE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Exchange a one-time code for tokens or the onboarding step',\n description:\n 'Turns the single-use code a redirect flow handed back into the access token and session. Single-use: the code is '\n + 'consumed, so it cannot be replayed if it leaks into a browser history or a referrer header. When the account '\n + 'still has to name its organization, the answer is instead the onboarding step and the session to complete it '\n + 'with — no token and no session cookie until the organization is named.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The single-use code is the proof.',\n successStatus: ok('An access token and the caller\\'s session, or the organization-onboarding step still owed.'),\n },\n [ManualControllerRouteKey.AUTH_ENTERPRISE_SSO_AUTHORIZE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET],\n summary: 'Start an organization SSO sign-in',\n description:\n 'Begins sign-in through one organization\\'s own OpenID Connect connection, addressed by that organization and the '\n + 'connection it configured. Answers with the authorization URL to navigate to.',\n authentication: PUBLIC,\n authenticationSummary: NO_CREDENTIAL,\n successStatus: ok('The connection\\'s authorization URL to navigate to.'),\n },\n [ManualControllerRouteKey.AUTH_APP_ENTERPRISE_AUTHORIZE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET],\n summary: 'Start an application-wide SSO sign-in',\n description:\n 'The same as the organization flow, for a connection the APPLICATION owns rather than one tenant — the shape used when '\n + 'every user signs in through one corporate identity provider.',\n authentication: PUBLIC,\n authenticationSummary: NO_CREDENTIAL,\n successStatus: ok('The connection\\'s authorization URL to navigate to.'),\n },\n [ManualControllerRouteKey.AUTH_SAML_LOGIN]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET],\n summary: 'Start a SAML sign-in',\n description:\n 'Service-provider-initiated SAML: builds the authentication request for the named connection and sends the browser to '\n + 'that identity provider.',\n authentication: PUBLIC,\n authenticationSummary: NO_CREDENTIAL,\n successStatus: { code: '302', meaning: 'The browser is redirected to the identity provider.' },\n },\n [ManualControllerRouteKey.AUTH_SAML_ACS]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'SAML assertion consumer service',\n description:\n 'Where a SAML identity provider posts its assertion. You do not call this — it is the ACS URL you configure in the '\n + 'identity provider, published here so an administrator can find it. The assertion\\'s signature is validated before '\n + 'anything in it is believed.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The signed SAML assertion is the proof.',\n successStatus: { code: '302', meaning: 'The assertion is accepted and the browser continues into the application.' },\n },\n [ManualControllerRouteKey.AUTH_SAML_METADATA]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET],\n summary: 'SAML service-provider metadata',\n description:\n 'The SAML metadata document for one scope — entity id, ACS URL, certificates — to upload into an identity provider. '\n + 'Addressed by the scope kind and its identifier, because an application-wide connection and a per-organization one '\n + 'are different service providers.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. Service-provider metadata is public by design.',\n successStatus: ok('The SAML metadata XML document.'),\n },\n [ManualControllerRouteKey.AUTH_SAML_SLO]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET, HttpMethod.POST],\n summary: 'SAML single-logout endpoint',\n description:\n 'Where an identity provider sends logout requests and responses. Inbound — the identity provider calls it. Accepts '\n + 'GET for the redirect binding and POST for the POST binding. To START a logout from this application, use End my '\n + 'SAML session instead.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The signed SAML logout message is the proof.',\n successStatus: { code: '302', meaning: 'The session is ended and the browser continues.' },\n },\n [ManualControllerRouteKey.AUTH_SAML_SP_LOGOUT]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'End my SAML session',\n description:\n 'Service-provider-initiated single logout: ends the caller\\'s session here and, when the identity provider supports it, '\n + 'hands back where to redirect so the identity-provider session ends too. The outbound counterpart of the SLO endpoint '\n + 'above.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The session is ended, with the identity provider\\'s logout location when there is one.'),\n },\n\n [ManualControllerRouteKey.AUTH_OIDC_LOGOUT]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'End my enterprise OIDC session',\n description:\n 'Ends the caller\\'s session here and, when the connection is configured for it, hands back where to redirect so the '\n + 'identity-provider session ends too. Without this a person who signs out is still signed in at their provider, so the '\n + 'next sign-in is silent. The OIDC counterpart of End my SAML session.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The session is ended, with the identity provider\\'s logout location when the connection has one.'),\n },\n\n // ─── Sessions that cross a boundary ──────────────────────────────────────────────────────────\n [ManualControllerRouteKey.AUTH_CROSS_FRONTEND_HANDOFF]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Hand a session to another frontend',\n description:\n 'Issues a one-time code bound to a named frontend of this application, so a signed-in person can be moved to it without '\n + 'signing in again. The target exchanges the code at Exchange a one-time code for tokens.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('A one-time code bound to the target frontend.'),\n },\n [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_CREATE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Mint a one-off session token',\n description:\n 'Creates a single-purpose token that grants a named user a bounded session in an application — for a deep link into a '\n + 'specific screen, or a machine acting on somebody\\'s behalf for one task. The lifetime, the number of uses and the '\n + 'moment of consumption are all stated when it is minted.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: { code: '201', meaning: 'The one-off token and the terms it was minted under.' },\n },\n [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_CREATE_ORG]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Mint a one-off session token within an organization',\n description:\n 'The same as minting a one-off session token, addressed within one organization so the resulting session is scoped to '\n + 'that tenant.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: { code: '201', meaning: 'The one-off token and the terms it was minted under.' },\n },\n [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_EXCHANGE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Exchange a one-off session token',\n description: 'Turns a one-off session token into the session it was minted for. The token is consumed on the terms it carries.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The one-off token is the proof.',\n successStatus: ok('An access token and the bounded session.'),\n },\n [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_REVOKE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Revoke a one-off session token',\n description:\n 'Cancels a minted one-off token before it is used, addressed by its id — never by its value, so revoking never requires '\n + 'handling the secret again.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The token can no longer be exchanged.'),\n },\n [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_REVOKE_ORG]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Revoke a one-off session token within an organization',\n description: 'The same revocation, addressed within the organization the token was minted in.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The token can no longer be exchanged.'),\n },\n\n // ─── This application as an OAuth 2.0 / OpenID Connect provider ──────────────────────────────\n [ManualControllerRouteKey.OAUTH_PROVIDER_DISCOVERY]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: IDP,\n methods: [HttpMethod.GET],\n summary: 'OpenID Connect discovery document',\n description:\n 'The provider metadata an OpenID Connect client reads first: the issuer, every endpoint below, the signing keys\\' '\n + 'location and the grants supported. OIDC Discovery locates it by appending the well-known path to the issuer, which '\n + 'is why it sits under the API mount. The same document is served at the RFC 8414 location as well, because that '\n + 'specification builds the address the other way round.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. Provider metadata is public and cross-origin readable by design.',\n successStatus: ok('The provider metadata document.'),\n },\n [ManualControllerRouteKey.OAUTH_PROVIDER_AS_METADATA]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: IDP,\n methods: [HttpMethod.GET],\n summary: 'OAuth 2.0 authorization-server metadata',\n description:\n 'The SAME document as the OpenID Connect discovery document, at the address RFC 8414 clients derive — many OAuth and '\n + 'MCP clients probe this one first. It is a second location, not a second contract. Note that the framework also '\n + 'serves it above the API mount, with the well-known segment inserted between the host and the issuer path, which is '\n + 'the construction the RFC actually specifies.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. Provider metadata is public and cross-origin readable by design.',\n successStatus: ok('The provider metadata document.'),\n },\n [ManualControllerRouteKey.OAUTH_PROVIDER_JWKS]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: IDP,\n methods: [HttpMethod.GET],\n summary: 'JSON Web Key Set',\n description:\n 'The public keys that verify tokens this application issues — the `jwks_uri` the discovery document points at. Fetch it '\n + 'rather than pinning a key: keys rotate, and a client that caches the set and re-fetches on an unknown key id keeps '\n + 'working across a rotation.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. Public keys are public.',\n successStatus: ok('The key set.'),\n },\n [ManualControllerRouteKey.OAUTH_PROVIDER_AUTHORIZE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: IDP,\n methods: [HttpMethod.GET],\n summary: 'Authorization endpoint',\n description:\n 'Where a client sends a person to approve delegated access, for the authorization-code flow. When the client is one '\n + 'that requires explicit consent and none has been given, the answer says consent is required rather than issuing a '\n + 'code; the decision is then posted to the consent endpoint.',\n authentication: PUBLIC,\n authenticationSummary: 'No client credential. The person\\'s own session establishes who is consenting.',\n successStatus: { code: '302', meaning: 'The browser is redirected back to the client with an authorization code.' },\n },\n [ManualControllerRouteKey.OAUTH_PROVIDER_CONSENT]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: IDP,\n methods: [HttpMethod.POST],\n summary: 'Record a consent decision',\n description:\n 'The approve-or-deny answer to a consent prompt the authorization endpoint raised, presenting the single-use '\n + 'consent-request token it issued. Approving is what mints the authorization code.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The single-use consent-request token authorizes the decision.',\n successStatus: ok('The decision is recorded, with the authorization code when it was an approval.'),\n },\n [ManualControllerRouteKey.OAUTH_PROVIDER_TOKEN]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: IDP,\n methods: [HttpMethod.POST],\n summary: 'Token endpoint',\n description:\n 'Where a client obtains an access token: `client_credentials` for software acting as itself, `authorization_code` for '\n + 'software acting on a person\\'s behalf. Request the audience you intend to call — a token minted for the general API '\n + 'is not accepted at the Model Context Protocol surface, and the reverse.',\n authentication: PUBLIC,\n authenticationSummary: 'No bearer token. The client authenticates with its own client credentials.',\n successStatus: ok('An access token, its lifetime and its audience.'),\n },\n [ManualControllerRouteKey.OAUTH_PROVIDER_USERINFO]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: IDP,\n methods: [HttpMethod.GET],\n summary: 'UserInfo endpoint',\n description: 'The standard OpenID Connect claims for the person a delegated access token was issued on behalf of.',\n authentication: BEARER,\n authenticationSummary: 'A bearer access token issued by this provider.',\n successStatus: ok('The subject\\'s claims.'),\n },\n [ManualControllerRouteKey.OAUTH_PROVIDER_REVOKE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: IDP,\n methods: [HttpMethod.POST],\n summary: 'Revoke a token',\n description:\n 'RFC 7009 revocation: the presented token stops working. Kills a TOKEN — to end the login SESSION a delegation was '\n + 'authorized from, use the end-session endpoint instead.',\n authentication: PUBLIC,\n authenticationSummary: 'No bearer token. The client authenticates with its own client credentials.',\n successStatus: ok('The token is revoked. Answers the same way for a token that was already invalid.'),\n },\n [ManualControllerRouteKey.OAUTH_PROVIDER_END_SESSION]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: IDP,\n methods: [HttpMethod.GET],\n summary: 'End-session endpoint',\n description:\n 'OpenID Connect RP-Initiated Logout: a relying party sends the person here, with an id-token hint, to end the provider '\n + 'session their delegation was authorized from. A trusted relying party is logged out and redirected inline; anybody '\n + 'else is shown a confirmation prompt, whose answer goes to the confirmation endpoint.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The id-token hint names the session to end.',\n successStatus: { code: '302', meaning: 'The session is ended, or the browser is sent to the confirmation prompt.' },\n },\n [ManualControllerRouteKey.OAUTH_PROVIDER_END_SESSION_CONFIRM]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: IDP,\n methods: [HttpMethod.POST],\n summary: 'Confirm an end-session request',\n description:\n 'The person\\'s answer to the logout confirmation prompt, presenting the single-use token the end-session endpoint '\n + 'minted. Deliberately not bearer-authenticated: somebody arriving from a relying party\\'s redirect may have no '\n + 'session in this application\\'s own frontend.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The single-use confirmation token authorizes the decision.',\n successStatus: ok('Where to send the browser once the session is ended.'),\n },\n [ManualControllerRouteKey.OAUTH_PROVIDER_REGISTER]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: IDP,\n methods: [HttpMethod.POST],\n summary: 'Register a client dynamically',\n description:\n 'RFC 7591 dynamic client registration: software registers itself and receives its client credentials plus a registration '\n + 'access token for managing that registration afterwards. The route always exists; it answers `404` unless this '\n + 'application has opted into dynamic registration, so a client can probe it safely.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential, when the application allows dynamic registration.',\n successStatus: { code: '201', meaning: 'The registration, its client credentials and its registration access token.' },\n },\n [ManualControllerRouteKey.OAUTH_PROVIDER_REGISTER_CLIENT]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: IDP,\n methods: [HttpMethod.GET, HttpMethod.PUT, HttpMethod.DELETE],\n summary: 'Manage a dynamically registered client',\n description:\n 'RFC 7592 client configuration: a dynamically registered client reads, replaces or deletes its OWN registration. One '\n + 'address, three methods, because the specification defines one endpoint whose method selects the operation. Answers '\n + '`404` unless this application has opted into dynamic registration.',\n authentication: BEARER,\n authenticationSummary: 'The registration access token issued when the client registered — not a user access token.',\n successStatus: ok('The registration, after the requested read, replacement or deletion.'),\n },\n\n // ─── Connecting a third-party account ────────────────────────────────────────────────────────\n [ManualControllerRouteKey.PROVIDER_CONNECTION_START]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: CONNECTIONS,\n methods: [HttpMethod.POST],\n summary: 'Start connecting a third-party account',\n description:\n 'Begins an outbound connection so this application can later act as the connected account. The path names a '\n + 'provider ref, and the grant belongs to that ref\\u2019s CONNECTION: a ref the application declares as a member of a '\n + 'shared connection (`providers.sharedConnections`) connects the one connection its base ref owns, so connecting '\n + 'through any member and through the base produce the same single grant. With `addScopes` it grows the stored '\n + 'connection instead of connecting afresh. The opposite direction from social sign-in, which uses a vendor to '\n + 'identify a person. An application that declares no connectable provider answers with a \"not connectable\" error '\n + 'rather than a missing route, which names why.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The provider authorization URL to navigate to.'),\n },\n [ManualControllerRouteKey.PROVIDER_CONNECTION_CALLBACK]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: CONNECTIONS,\n methods: [HttpMethod.GET],\n summary: 'Third-party connection callback',\n description:\n 'Where a provider returns after the person authorizes the connection. You do not call '\n + 'this — it is the redirect URI to register with the vendor. ONE address serves every provider, keyed by the state '\n + 'parameter, because a redirect URI must be registered before it is accepted and a path per provider would mean '\n + 'registering one per vendor, per environment, by hand. It authenticates nobody and exchanges nothing: a redirect '\n + 'carries no bearer token, so it hands the approval back to the application, which finishes it as the signed-in person.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The single-use state parameter identifies the attempt and defends against CSRF.',\n successStatus: { code: '302', meaning: 'The browser continues into the application, carrying the approval for it to finish.' },\n },\n [ManualControllerRouteKey.PROVIDER_CONNECTION_COMPLETE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: CONNECTIONS,\n methods: [HttpMethod.POST],\n summary: 'Finish a connection the provider has approved',\n description:\n 'Exchanges an approval the vendor just granted for a stored grant. The application calls this on the person\\u2019s behalf '\n + 'when they return from the vendor; the callback cannot, because a redirect carries no credential and so cannot tell '\n + 'who is finishing the flow. The attempt is consumed here, once and atomically, and is only completed for the same '\n + 'person who began it \\u2014 so an approval somebody else obtained cannot be redeemed against their target.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The connection outcome, and the provider it was stored for.'),\n },\n [ManualControllerRouteKey.PROVIDER_CONNECTION_STORE_CREDENTIAL]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: CONNECTIONS,\n methods: [HttpMethod.POST],\n summary: 'Store a typed credential for a provider',\n description:\n 'For a vendor whose credential is TYPED rather than granted. Stored under the ref\\u2019s connection, like a granted '\n + 'one. Takes one value per slot the provider declares as '\n + 'identifying an account, and refuses any name the provider did not declare — so a caller cannot invent a slot, '\n + 'and cannot write an account token into the slot holding the application\\u2019s own registration. Values are '\n + 'sealed by the write door; the request is the only place they exist in plaintext.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The stored credential ids, one per slot supplied.'),\n },\n [ManualControllerRouteKey.PROVIDER_CONNECTION_CATALOGUE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: CONNECTIONS,\n methods: [HttpMethod.GET],\n summary: 'What can be connected',\n description:\n 'Lists what this application declares as connectable, ONE entry per connection: a shared connection\\u2019s members '\n + 'are folded into its base ref\\u2019s entry, which names every ref it serves in `servesRefs`, and a ref declared in no '\n + 'shared connection is its own connection. Each entry carries the owner scopes it admits and whether it '\n + 'carries an authorization flow. Answers the question the stored-credential list cannot: a person with nothing '\n + 'connected has an empty list and no way to learn what they might connect. Admissibility is a recorded decision per '\n + 'provider, so this reports a decision rather than inspecting a vendor.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The connectable providers, each with its admissible owner scopes.'),\n },\n\n [ManualControllerRouteKey.PROVIDER_CONNECTION_ACCESS_TOKEN]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: CONNECTIONS,\n methods: [HttpMethod.GET],\n summary: 'A short-lived access token for your own connected account',\n description:\n 'Resolves the caller\\u2019s OWN grant for a provider \\u2014 the grant of that ref\\u2019s connection, so a member of a shared '\n + 'connection answers with the one grant its base holds \\u2014 and returns its access token, renewed if the vendor\\u2019s expiry '\n + 'has passed \\u2014 the one credential a browser may be handed, because a vendor\\u2019s own picker authorizes as the '\n + 'signed-in user and cannot open without it. Never the refresh token; never another owner\\u2019s account. Each '\n + 'hand-out is recorded as a USE of the credential, so revoking or erasing the connection is visible against '\n + 'every token that left the process. Answers 404 when nothing is connected, so a surface can offer the connection '\n + 'rather than open a picker on nobody\\u2019s files.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The access token, with its expiry and granted scopes when the vendor stated them.'),\n },\n [ManualControllerRouteKey.PROVIDER_CONNECTION_LIST]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: CONNECTIONS,\n methods: [HttpMethod.GET],\n summary: 'The connections an owner holds',\n description:\n 'One entry per CONNECTION the owner (`ownerScope` = USER for the caller\\u2019s own, ORGANIZATION with `ownerId` for a '\n + 'tenant the caller administers) has stored a credential under \\u2014 never one per provider ref, because several refs '\n + 'of one vendor share one grant. Each entry names the refs the connection serves, the scopes its consent has '\n + 'accumulated (read from the sealed grant; no token is returned), its validation state, and the credential rows it '\n + 'is made of. Disconnecting is the credential resource\\u2019s own DELETE of those rows, which authorizes, may ask '\n + 'for step-up, records who revoked, and withdraws the grant at a vendor that accepts a withdrawal. An organization\\u2019s '\n + 'connections are listed only for a caller holding the role the organization credential list itself requires.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The owner\\u2019s connections, one entry each.'),\n },\n [ManualControllerRouteKey.PROVIDER_OPERATION_EXECUTE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: CONNECTIONS,\n methods: [HttpMethod.POST],\n summary: 'Run a provider operation this application lets your browser trigger',\n description:\n 'Executes one operation of a connected third-party provider on the server and returns its parsed output. The '\n + 'credential never reaches the browser: the body names whose account to spend (`connection`, defaulting to the '\n + 'application\\u2019s own), an optional catalogue `domain`, and the operation `input`. Only operations the '\n + 'application declared browser-reachable can run, for the connections and roles it declared; anything else '\n + 'answers 403 and the refusal is recorded. Every executed call is recorded too, successful or not, against the '\n + 'person who asked.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The provider\\u2019s HTTP status and the operation\\u2019s output, parsed through its declared schema.'),\n },\n [ManualControllerRouteKey.PROVIDER_OPERATION_INPUT_OPTIONS]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: CONNECTIONS,\n methods: [HttpMethod.POST],\n summary: 'List the choices for one input of a provider operation',\n description:\n 'Lists the values a person may pick for one input of a browser-reachable provider operation \\u2014 a workspace, a '\n + 'project \\u2014 by running the input\\u2019s declared options operation on the server, through the connection named in '\n + 'the body. The list is exactly what that account can see, and the credential never reaches the browser. Both the '\n + 'operation and its options operation must be declared browser-reachable for that connection; otherwise the answer is '\n + '403 and the refusal is recorded. A choice the list depends on must be passed in `input`: without it the answer is '\n + '400 naming it, rather than an empty list.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The options operation that answered, and each choice as a value and the vendor\\u2019s own label.'),\n },\n\n // ─── Agent interfaces ────────────────────────────────────────────────────────────────────────\n [ManualControllerRouteKey.MCP_ENDPOINT]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AGENTS,\n methods: [HttpMethod.POST, HttpMethod.GET, HttpMethod.DELETE],\n summary: 'Model Context Protocol endpoint',\n description:\n 'The JSON-RPC 2.0 endpoint an MCP client talks to over the Streamable HTTP transport: `initialize`, `tools/list` and '\n + '`tools/call`. Only POST does work. GET and DELETE answer `405` with `Allow: POST` on purpose — this server offers no '\n + 'server-initiated stream and has no protocol-level sessions to end, and a bare `404` would make an older client '\n + 'conclude there is no MCP endpoint here and fall back to a retired transport. A call must present an access token '\n + 'bound to this surface\\'s own audience; a token minted for the general API is refused. Named server instances are '\n + 'served under this path with the instance reference appended, each with its own audience and its own tool catalogue.',\n authentication: BEARER,\n authenticationSummary: 'A bearer access token whose audience is this Model Context Protocol surface.',\n successStatus: ok('The JSON-RPC response for the method that was called.'),\n },\n [ManualControllerRouteKey.MCP_PROTECTED_RESOURCE_METADATA]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AGENTS,\n methods: [HttpMethod.GET],\n summary: 'Model Context Protocol protected-resource metadata',\n description:\n 'RFC 9728 metadata: the resource identifier this surface expects a token to be bound to, and the authorization servers '\n + 'that can issue one. An MCP client that receives `401` reads the location from the challenge header and fetches this '\n + 'to learn where to get a token. Each named server instance publishes its own copy under its own path, so every '\n + 'instance advertises its own audience.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. Discovery metadata is public and cross-origin readable by design.',\n successStatus: ok('The protected-resource metadata document.'),\n },\n [ManualControllerRouteKey.A2A_AGENT_CARD]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AGENTS,\n methods: [HttpMethod.GET],\n summary: 'Agent card',\n description:\n 'The Agent2Agent card describing what this application exposes as agent skills, the task endpoint\\'s address and the '\n + 'security schemes a caller must satisfy. Public metadata, like a discovery document: fetch it before addressing the '\n + 'agent.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The agent card is public and cross-origin readable by design.',\n successStatus: ok('The agent card.'),\n },\n [ManualControllerRouteKey.A2A_TASKS]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AGENTS,\n methods: [HttpMethod.POST],\n summary: 'Agent2Agent task endpoint',\n description:\n 'The JSON-RPC endpoint that accepts agent messages and tasks, streaming over server-sent events when the caller asks '\n + 'for it. Its absolute URL is the card\\'s advertised address AND the agent\\'s canonical audience: an inbound access '\n + 'token must be bound to it. Named agent instances are served under this path with the instance reference appended.',\n authentication: BEARER,\n authenticationSummary: 'A bearer access token whose audience is this agent endpoint.',\n successStatus: ok('The JSON-RPC response, or an event stream when streaming was requested.'),\n },\n\n // ─── File transfer ───────────────────────────────────────────────────────────────────────────\n [ManualControllerRouteKey.FILES_ITEM]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: FILES,\n methods: [HttpMethod.GET, HttpMethod.DELETE],\n summary: 'Download or delete a stored file',\n description:\n 'GET streams the file\\'s bytes; DELETE removes it. One address, two methods. A file is downloadable only in a status '\n + 'that permits it — one still being scanned, or quarantined, is refused rather than served. Distinct from a resource\\'s '\n + 'own file routes, which address the file bound to one field of one record.',\n authentication: BEARER,\n authenticationSummary: 'A bearer access token, or the consumable token a share link carries.',\n successStatus: ok('The file\\'s bytes, or confirmation that it was deleted.'),\n },\n [ManualControllerRouteKey.FILES_METADATA]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: FILES,\n methods: [HttpMethod.GET],\n summary: 'Read a stored file\\'s metadata',\n description:\n 'Name, size, content type and status, without transferring the bytes. Metadata is withheld for statuses where saying '\n + 'anything about the file would be wrong.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The file\\'s metadata record.'),\n },\n [ManualControllerRouteKey.FILES_SHARE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: FILES,\n methods: [HttpMethod.POST],\n summary: 'Create a share link for a stored file',\n description:\n 'Mints a time-limited link that lets somebody without an account download this one file. The link carries a consumable '\n + 'token whose lifetime is stated when it is minted.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: { code: '201', meaning: 'The share link and when it expires.' },\n },\n [ManualControllerRouteKey.FILES_SHARES_REVOKE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: FILES,\n methods: [HttpMethod.DELETE],\n summary: 'Revoke every share link of a stored file',\n description:\n 'Stops sharing this file: every link minted for it that is still live stops working at once, whoever minted it. '\n + 'Anyone who may create a share link for the file may revoke them. Idempotent: with no live link it answers a count of zero.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('How many live share links were revoked.'),\n },\n [ManualControllerRouteKey.FILES_UPLOAD_GRANT_STATUS]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: FILES,\n methods: [HttpMethod.GET],\n summary: 'Read the status of an upload grant',\n description:\n 'Where an upload grant has got to, addressed by the grant token itself. Public because the token IS the credential: the '\n + 'page somebody drops a file onto has no session of its own.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The grant token in the address is what authorizes the read.',\n successStatus: ok('The grant\\'s state and what it still allows.'),\n },\n [ManualControllerRouteKey.FILES_UPLOAD_GRANT_REVOKE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: FILES,\n methods: [HttpMethod.DELETE],\n summary: 'Revoke an upload grant',\n description:\n 'Cancels an upload grant before it is used. Addressed by the grant\\'s id, never by its token value, so revoking never '\n + 'requires handling the secret. Only the grant\\'s minter, or a super-administrator, may revoke it.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The grant can no longer be used.'),\n },\n\n // ─── What this application currently offers ──────────────────────────────────────────────────\n [ManualControllerRouteKey.I18N_GET_LABELS]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.GET],\n summary: 'Read translated labels',\n description:\n 'The label bundle for a locale — every piece of display text this application has authored. A client renders from this '\n + 'rather than inventing text from field names; a label that is missing is meant to look missing.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. Labels are needed before anybody has signed in.',\n successStatus: ok('The label bundle for the requested locale.'),\n },\n [ManualControllerRouteKey.FEATURES_RESOLVED]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.GET],\n summary: 'Read the caller\\'s resolved features',\n description:\n 'Which features are actually on for this caller, after the application\\'s declarations, their organization\\'s plan and '\n + 'any per-caller overrides have all been applied. This is the resolved answer — do not re-derive it client-side from '\n + 'the plan.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The caller\\'s resolved feature set.'),\n },\n [ManualControllerRouteKey.SUBMISSION_CHALLENGE_PROOF_OF_WORK]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.GET],\n summary: 'Get a proof-of-work challenge for a public submission',\n description:\n 'A signed, expiring SHA-256 puzzle. When the application protects a public form (the contact form) with a captcha, a '\n + 'submission must carry an answer in the `x-submission-challenge-response` header: either a token from the consented '\n + 'captcha vendor, or the solution to this challenge. Find the number whose SHA-256 of `salt + number` equals '\n + '`challenge`, then send `{\"kind\":\"proof_of_work\",\"challenge\":<this object>,\"number\":<n>}` as that header. A '\n + 'solution is accepted once, before the salt\\'s expiry. Nothing about the caller is stored or sent to a third party.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. A visitor who has not signed in needs a challenge to submit a public form.',\n successStatus: ok('The challenge: algorithm, salt (carrying its expiry), challenge hash, the largest number to try, and its signature.'),\n },\n [ManualControllerRouteKey.CHARTS_DATA]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.POST],\n summary: 'Run a declared chart and read its data',\n description:\n 'Executes one chart the application has declared, addressed by its reference, and returns the series it produced. POST '\n + 'because the filters, ranges and groupings a chart accepts are a body, not a query string. Only declared charts can '\n + 'be run: this is not a general query endpoint.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The chart\\'s data series.'),\n },\n [ManualControllerRouteKey.SUBJECT_ERASURE_LANE_EVIDENCE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.GET],\n summary: \"Summarize this application's subject-erasure lane over a window\",\n description:\n 'Counts, for a closed window, what the erasure lane did: how many requests arrived and who raised each, how many were '\n + 'withdrawn, how many reached a terminal state, and how many of those are missing the requester, justification or outcome '\n + 'their own record promises. It also reports whether the withdrawal door is reachable to a subject and what schedule drives '\n + 'execution, both read from the lane the application declared. It returns NO row and NO identifier — an evidence reader '\n + 'proving the lane works must not be handed every person who asked to be erased in order to count them. An application that '\n + 'declares no erasure lane is told so explicitly, because a lane with no activity and no lane at all are the same zeroes.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The lane summary, or a statement that no lane is declared.'),\n },\n [ManualControllerRouteKey.PROVIDER_CALL_EVIDENCE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.GET],\n summary: 'Count the model-provider calls this application made over a window',\n description:\n 'Counts, for a closed window, every call the application made to a model provider: grouped by provider, model, kind of call '\n + 'and outcome, with the tokens each group consumed. It also counts the records that are incomplete (no provider, no model, no '\n + 'reported usage) separately, so a gap is visible rather than folded into the total. It returns NO row: the question is about '\n + 'the population of calls, and a record names an agent and an instant an evidence reader has no need to hold.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The provider-call summary for the window.'),\n },\n [ManualControllerRouteKey.MODEL_COST_SUMMARY]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.POST],\n summary: 'Summarize model cost per case, organization, agent or model over a window',\n description:\n 'Totals, for a window, what the application\\'s model calls cost: grouped by case, organization, agent or model, per currency, '\n + 'with the tokens each group consumed and the exact cost rounded up once per total. Calls made outside any unit of work, and '\n + 'calls no registered price covered, are counted apart so a gap is visible rather than folded into a total. A case summary '\n + 'also reports the expert review time recorded on each case, or says that none is recorded. Application administrators only '\n + '(super-administrator or billing manager): it is the application\\'s internal cost data. A window covers at most a year. POST '\n + 'because the case filter is a list of references. To invoice a month, list the model-cost period aggregates instead and link '\n + 'the one the invoice bills.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The model-cost summary for the window.'),\n },\n [ManualControllerRouteKey.AGENT_WORK_OVERRIDE_RATE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.POST],\n summary: 'Report how often experts overrode what an agent proposed, over a window',\n description:\n 'Counts, for a window, the decisions people took on agents\\' proposals, grouped by agent, tool, case or decider: accepted as '\n + 'proposed, accepted after a change, and rejected. The override rate is the changed and rejected decisions over all three. '\n + 'Decisions nobody took (the window lapsed, the work was withdrawn, or the requester lost their access) are counted apart and '\n + 'never enter the rate. It reads the decision records only, never their content. An organization administrator reads their '\n + 'own organization; an application super-administrator may read any, or all. A window covers at most a year.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The override rate per group for the window.'),\n },\n [ManualControllerRouteKey.AGENT_WORK_EVALUATION_EXPORT]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.POST],\n summary: 'Export an organization\\'s decisions on one agent\\'s proposals as an evaluation dataset',\n description:\n 'Exports, for one organization, one agent and a window, the decisions its people took on that agent\\'s proposals, as JSON '\n + 'Lines: one object per decision, with no decider and no organization. The record\\'s own identifiers (the decision, the '\n + 'case, the run, the task, the work product, the decider, the organization) are replaced by pseudonyms wherever they '\n + 'appear, including inside kept content; any other value in the kept proposal or final version is exported as the '\n + 'organization kept it. The proposal and the final version are included only when the organization kept them. Cases the organization walled off '\n + 'are left out, and a case of a privileged kind goes only with its client\\'s recorded consent. The export is refused, and '\n + 'the refusal recorded, unless the organization holds an active export authorisation; every export is recorded on its '\n + 'ledger and in the audit trail. An organization administrator for their own organization, or an application '\n + 'super-administrator.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The dataset, and the id of its ledger entry.'),\n },\n [ManualControllerRouteKey.RETENTION_ENFORCEMENT_EVIDENCE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.GET],\n summary: 'List the retention enforcement records of the sweep runs in a window',\n description:\n 'Returns, for a closed window, every record the retention-class sweep wrote: one per run and per resource bound to a retention '\n + 'class, with the class, the period the run applied, the cutoff, how many rows it deleted and the window of their retention '\n + 'start, how many a legal hold kept, and whether the run completed, deferred work to the next run, failed or skipped the '\n + 'resource. A failed run has a record too. The records hold counts and instants only, so the answer names no person and no '\n + 'deleted row.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The retention enforcement records for the window.'),\n },\n [ManualControllerRouteKey.USAGE_FLUSH_EVIDENCE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.GET],\n summary: 'Count where the metered-usage rows stand with respect to the provider flush',\n description:\n 'Counts every usage row by flush state (pending, reported, unreportable), the unreportable rows by reason, and the '\n + 'contradictions that must never exist: an unreportable row with no reason, one with no decision instant, and one also '\n + 'marked reported. The window adds how many rows were decided unreportable inside it. It returns NO row: a usage row names '\n + 'a customer and a quantity, which an evidence reader has no need to hold. An application with billing off measures no store, '\n + 'and says so.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The usage flush summary.'),\n },\n [ManualControllerRouteKey.SCHEDULED_EVIDENCE_COVERAGE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.POST],\n summary: 'Assess whether a scheduled run happened as often as it was scheduled to',\n description:\n 'Compares the runs this application retained, and its live job history, against the schedule that was IN FORCE across the period — '\n + 'supplied by the caller as historical segments, each naming the commit that set it. Reports coverage, missing occurrences, duplicate '\n + 'runs, outcomes, unavailable results, deferral and timeliness separately, because a run that happened and failed, one that happened '\n + 'late, and one that never happened are different findings. POST because the schedule basis is a body: the current cron cannot stand in '\n + 'for what the schedule WAS, so a caller that supplies none gets a refusal rather than an assessment against today.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The coverage assessment for one scheduled target over the period.'),\n },\n [ManualControllerRouteKey.FLOWS_ACTORS_FRONTEND_INFO]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.GET],\n summary: 'Read the flow and actor systems a client may render',\n description:\n 'The metadata and renderable graph for every flow or actor system this application exposes to its frontends — what '\n + 'exists, what it is called, and how it is shaped — and the autonomous agents the application declares, by reference '\n + 'and actor system: the only values an organization OAuth client may be bound to.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The visible flow and actor systems, and the declared autonomous agents.'),\n },\n [ManualControllerRouteKey.FLOWS_ACTORS_HISTORY]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.GET, HttpMethod.DELETE],\n summary: 'Read or clear my conversation history',\n description:\n 'GET returns the caller\\'s OWN conversation history with a flow or actor system; DELETE clears a conversation. Scoped to '\n + 'the caller: it is never a window onto somebody else\\'s conversation.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The caller\\'s conversation, or confirmation that it was cleared.'),\n },\n [ManualControllerRouteKey.FLOWS_ACTORS_DECISIONS]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.GET],\n summary: 'List the decisions waiting on me',\n description:\n 'The pending decisions an agent is waiting on that the caller may act on, across every conversation: their own, those '\n + 'assigned to them, and those routed to a role they hold in the decision\\'s organization. Each is a decision card — the '\n + 'call being asked for, its deadline, its route and what the caller may do — and never the conversation behind it. '\n + 'Every row is re-checked against the same rule an act is, so the list never shows a decision the caller could not act on.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The decision cards.'),\n },\n [ManualControllerRouteKey.FLOWS_ACTORS_DECISION_ACT]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.POST],\n summary: 'Answer, reassign, claim, unclaim or escalate a decision',\n description:\n 'Acts on one pending decision. `answer` approves or denies the call, optionally with edited arguments; the work then '\n + 'runs as the person who raised it, with their access as it stands now. `reassign` and `escalate` move it to another '\n + 'person, who must be able to answer it; `claim` takes a role-routed decision for yourself and `unclaim` gives it back. '\n + 'A decision that does not exist, is settled, or is not routed to the caller all answer the same way.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('What the act came to.'),\n },\n [ManualControllerRouteKey.FLOWS_ACTORS_DECISION_CANDIDATES]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.GET],\n summary: 'List who a decision may be moved to',\n description:\n 'The people in the decision\\'s organization who could answer it, for a caller who may reassign or escalate it. Each is '\n + 'checked against the same rule a move is, so choosing one of them is never refused for who they are. A decision the '\n + 'caller may not move answers the same way as one that does not exist.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The people it may be moved to.'),\n },\n [ManualControllerRouteKey.ANALYTICS_EVENTS]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.POST],\n summary: 'Record product-analytics events',\n description:\n 'Ingests a batch of product-analytics events. Mounted only when this application enables product analytics; where it '\n + 'does not, the address does not exist.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The batch was accepted.'),\n },\n [ManualControllerRouteKey.ANALYTICS_MOMENTS_ACHIEVED]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.GET, HttpMethod.POST],\n summary: 'Read or record achieved product moments',\n description:\n 'GET lists the declared moments this caller has reached; POST records that they have reached one. Mounted only when '\n + 'this application enables product analytics.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The caller\\'s achieved moments, or confirmation that one was recorded.'),\n },\n [ManualControllerRouteKey.PROGRESSION_MILESTONES]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.GET],\n summary: 'Read the declared progression milestones',\n description:\n 'The milestone definitions this application has declared, for a client rendering onboarding or progress. Mounted only '\n + 'when this application enables product analytics.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The declared milestones.'),\n },\n};\n"]}
1	+ {"version":3,"file":"manual-controllers-routes-documentation.js","sourceRoot":"","sources":["../../../src/requests/manual-controllers-routes-documentation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAE5E;;;;;;;;;;;GAWG;AACH,MAAM,CAAN,IAAY,0BAaX;AAbD,WAAY,0BAA0B;IACpC,gGAAgG;IAChG,+DAAiC,CAAA;IACjC,wGAAwG;IACxG,oEAAsC,CAAA;IACtC,2GAA2G;IAC3G,sEAAwC,CAAA;IACxC,uFAAuF;IACvF,kEAAoC,CAAA;IACpC,yEAAyE;IACzE,4DAA8B,CAAA;IAC9B,kFAAkF;IAClF,wEAA0C,CAAA;AAC5C,CAAC,EAbW,0BAA0B,KAA1B,0BAA0B,QAarC;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,mCASX;AATD,WAAY,mCAAmC;IAC7C,2GAA2G;IAC3G,wDAAiB,CAAA;IACjB,kEAAkE;IAClE,8EAAuC,CAAA;IACvC,0EAA0E;IAC1E,sEAA+B,CAAA;IAC/B,kFAAkF;IAClF,gGAAyD,CAAA;AAC3D,CAAC,EATW,mCAAmC,KAAnC,mCAAmC,QAS9C;AAED,oEAAoE;AACpE,MAAM,CAAN,IAAY,gCAGX;AAHD,WAAY,gCAAgC;IAC1C,2DAAuB,CAAA;IACvB,yDAAqB,CAAA;AACvB,CAAC,EAHW,gCAAgC,KAAhC,gCAAgC,QAG3C;AA0CD,sFAAsF;AACtF,SAAS,EAAE,CAAC,OAAe;IACzB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,IAAI,GAAG,0BAA0B,CAAC,cAAc,CAAC;AACvD,MAAM,GAAG,GAAG,0BAA0B,CAAC,iBAAiB,CAAC;AACzD,MAAM,WAAW,GAAG,0BAA0B,CAAC,kBAAkB,CAAC;AAClE,MAAM,MAAM,GAAG,0BAA0B,CAAC,gBAAgB,CAAC;AAC3D,MAAM,KAAK,GAAG,0BAA0B,CAAC,aAAa,CAAC;AACvD,MAAM,OAAO,GAAG,0BAA0B,CAAC,mBAAmB,CAAC;AAE/D,MAAM,MAAM,GAAG,mCAAmC,CAAC,MAAM,CAAC;AAC1D,MAAM,MAAM,GAAG,mCAAmC,CAAC,aAAa,CAAC;AAEjE,MAAM,aAAa,GAAG,oEAAoE,CAAC;AAC3F,MAAM,iBAAiB,GAAG,+CAA+C,CAAC;AAE1E,gGAAgG;AAChG,MAAM,CAAC,MAAM,0CAA0C,GAA+C;IACpG,CAAC,0BAA0B,CAAC,cAAc,CAAC,EACzC,yHAAyH;UACvH,oHAAoH;UACpH,yHAAyH;UACzH,oGAAoG;IACxG,CAAC,0BAA0B,CAAC,iBAAiB,CAAC,EAC5C,oHAAoH;UAClH,oHAAoH;UACpH,uHAAuH;UACvH,6FAA6F;IACjG,CAAC,0BAA0B,CAAC,kBAAkB,CAAC,EAC7C,uHAAuH;UACrH,+CAA+C;IACnD,CAAC,0BAA0B,CAAC,gBAAgB,CAAC,EAC3C,sHAAsH;UACpH,gFAAgF;IACpF,CAAC,0BAA0B,CAAC,aAAa,CAAC,EACxC,wHAAwH;UACtH,wDAAwD;IAC5D,CAAC,0BAA0B,CAAC,mBAAmB,CAAC,EAC9C,qHAAqH;UACnH,kEAAkE;CACvE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAyE;IACzH,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE;QACjD,WAAW,EAAE,gCAAgC,CAAC,QAAQ;QACtD,cAAc,EACZ,kHAAkH;cAChH,qHAAqH;cACrH,iHAAiH;KACtH;IAED,gGAAgG;IAChG,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE;QACxC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,yEAAyE;QAClF,WAAW,EACT,uHAAuH;cACrH,mHAAmH;cACnH,sHAAsH;cACtH,4CAA4C;QAChD,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,aAAa;QACpC,aAAa,EAAE,EAAE,CAAC,kFAAkF,CAAC;KACtG;IACD,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE;QACrD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,8BAA8B;QACvC,WAAW,EACT,uHAAuH;cACrH,wHAAwH;cACxH,kHAAkH;cAClH,uEAAuE;QAC3E,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,aAAa;QACpC,aAAa,EAAE,EAAE,CAAC,6EAA6E,CAAC;KACjG;IACD,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE;QAC5C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,8BAA8B;QACvC,WAAW,EACT,0HAA0H;cACxH,sHAAsH;cACtH,yEAAyE;QAC7E,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,aAAa;QACpC,aAAa,EAAE,EAAE,CAAC,yEAAyE,CAAC;KAC7F;IACD,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE;QAC7C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,yBAAyB;QAClC,WAAW,EACT,wHAAwH;cACtH,uHAAuH;cACvH,qEAAqE;QACzE,cAAc,EAAE,MAAM;QACtB,qBAAqB,EACnB,8GAA8G;QAChH,aAAa,EAAE,EAAE,CAAC,kEAAkE,CAAC;KACtF;IACD,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE;QAC7C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,yDAAyD;QAClE,WAAW,EACT,uHAAuH;cACrH,2EAA2E;QAC/E,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,uEAAuE;QAC9F,aAAa,EAAE,EAAE,CAAC,yDAAyD,CAAC;KAC7E;IACD,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE;QACtC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,0BAA0B;QACnC,WAAW,EACT,2HAA2H;cACzH,iGAAiG;QACrG,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,+DAA+D,CAAC;KACnF;IACD,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE;QAC1C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,qBAAqB;QAC9B,WAAW,EACT,wHAAwH;cACtH,oHAAoH;cACpH,6CAA6C;QACjD,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,+CAA+C,CAAC;KACnE;IACD,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE;QACxC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,wBAAwB;QACjC,WAAW,EACT,yHAAyH;cACvH,wHAAwH;cACxH,mGAAmG;QACvG,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,aAAa;QACpC,aAAa,EAAE,EAAE,CAAC,yDAAyD,CAAC;KAC7E;IACD,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE;QAC5C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,yBAAyB;QAClC,WAAW,EACT,qHAAqH;cACnH,mGAAmG;QACvG,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,2EAA2E;QAClG,aAAa,EAAE,EAAE,CAAC,oDAAoD,CAAC;KACxE;IACD,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE;QACnD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,+BAA+B;QACxC,WAAW,EACT,wHAAwH;cACtH,8EAA8E;QAClF,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,aAAa;QACpC,aAAa,EAAE,EAAE,CAAC,sFAAsF,CAAC;KAC1G;IACD,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE;QACtD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,0BAA0B;QACnC,WAAW,EACT,yHAAyH;cACvH,kEAAkE;QACtE,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,aAAa;QACpC,aAAa,EAAE,EAAE,CAAC,4EAA4E,CAAC;KAChG;IACD,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE;QACvD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,2BAA2B;QACpC,WAAW,EACT,mHAAmH;cACjH,wEAAwE;QAC5E,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,0EAA0E;QACjG,aAAa,EAAE,EAAE,CAAC,gEAAgE,CAAC;KACpF;IACD,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE;QACvD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,kCAAkC;QAC3C,WAAW,EACT,sHAAsH;cACpH,qHAAqH;cACrH,kHAAkH;cAClH,uHAAuH;cACvH,qHAAqH;cACrH,4GAA4G;QAChH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,+GAA+G;QACtI,aAAa,EAAE,EAAE,CAAC,8GAA8G,CAAC;KAClI;IACD,CAAC,wBAAwB,CAAC,gCAAgC,CAAC,EAAE;QAC3D,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,6BAA6B;QACtC,WAAW,EACT,wHAAwH;cACtH,sHAAsH;cACtH,oHAAoH;cACpH,qHAAqH;cACrH,0BAA0B;QAC9B,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,qFAAqF;QAC5G,aAAa,EAAE,EAAE,CAAC,4FAA4F,CAAC;KAChH;IAED,gGAAgG;IAChG,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE;QAC/C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,uHAAuH;cACrH,uHAAuH;cACvH,cAAc;QAClB,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,wEAAwE;QAC/F,aAAa,EAAE,EAAE,CAAC,uDAAuD,CAAC;KAC3E;IACD,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE;QACjD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,qCAAqC;QAC9C,WAAW,EACT,sHAAsH;cACpH,qHAAqH;cACrH,8MAA8M;cAC9M,8CAA8C;QAClD,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,6EAA6E;QACpG,aAAa,EAAE,EAAE,CAAC,0FAA0F,CAAC;KAC9G;IACD,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE;QACjD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,qCAAqC;QAC9C,WAAW,EAAE,+FAA+F;QAC5G,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,gFAAgF;QACvG,aAAa,EAAE,EAAE,CAAC,6BAA6B,CAAC;KACjD;IACD,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE;QACnD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,6BAA6B;QACtC,WAAW,EACT,mHAAmH;cACjH,sFAAsF;QAC1F,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,oCAAoC,CAAC;KACxD;IACD,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE;QACpD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,8BAA8B;QACvC,WAAW,EACT,wHAAwH;cACtH,iDAAiD;QACrD,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,kEAAkE,CAAC;KACtF;IACD,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE;QACpD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,8BAA8B;QACvC,WAAW,EAAE,gFAAgF;QAC7F,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,6BAA6B,CAAC;KACjD;IAED,gGAAgG;IAChG,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,EAAE;QAClD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,6BAA6B;QACtC,WAAW,EAAE,kGAAkG;QAC/G,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,8EAA8E;QACrG,aAAa,EAAE,EAAE,CAAC,uBAAuB,CAAC;KAC3C;IACD,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE;QACpD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,+BAA+B;QACxC,WAAW,EACT,wHAAwH;QAC1H,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,oEAAoE;QAC3F,aAAa,EAAE,EAAE,CAAC,qEAAqE,CAAC;KACzF;IACD,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE;QAC9C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,sBAAsB;QAC/B,WAAW,EACT,oHAAoH;cAClH,0GAA0G;QAC9G,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,qDAAqD,CAAC;KACzE;IACD,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE;QACrD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,wBAAwB;QACjC,WAAW,EACT,wHAAwH;cACtH,uGAAuG;QAC3G,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,8BAA8B,CAAC;KAClD;IACD,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE;QAC/C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,oBAAoB;QAC7B,WAAW,EACT,uHAAuH;cACrH,4DAA4D;QAChE,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,oEAAoE;QAC3F,aAAa,EAAE,EAAE,CAAC,qEAAqE,CAAC;KACzF;IACD,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE;QAChD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,cAAc;QACvB,WAAW,EACT,oHAAoH;cAClH,4DAA4D;QAChE,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,6DAA6D;QACpF,aAAa,EAAE,EAAE,CAAC,6BAA6B,CAAC;KACjD;IACD,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE;QAC5C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,2BAA2B;QACpC,WAAW,EACT,uHAAuH;cACrH,sEAAsE;QAC1E,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,8EAA8E;QACrG,aAAa,EAAE,EAAE,CAAC,uBAAuB,CAAC;KAC3C;IACD,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE;QAC9C,WAAW,EAAE,gCAAgC,CAAC,QAAQ;QACtD,cAAc,EACZ,sGAAsG;cACpG,qHAAqH;cACrH,qHAAqH;KAC1H;IACD,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE;QACjD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,sHAAsH;cACpH,2CAA2C;QAC/C,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,qCAAqC,CAAC;KACzD;IACD,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE;QACpD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,mCAAmC;QAC5C,WAAW,EAAE,wFAAwF;QACrG,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,yBAAyB,CAAC;KAC7C;IACD,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE;QAC/C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,mBAAmB;QAC5B,WAAW,EACT,uHAAuH;cACrH,+BAA+B;QACnC,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,aAAa;QACpC,aAAa,EAAE,EAAE,CAAC,gFAAgF,CAAC;KACpG;IACD,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE;QACjD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,qBAAqB;QAC9B,WAAW,EAAE,mGAAmG;QAChH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,wDAAwD;QAC/E,aAAa,EAAE,EAAE,CAAC,4CAA4C,CAAC;KAChE;IAED,gGAAgG;IAChG,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE;QACxD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,4BAA4B;QACrC,WAAW,EACT,sGAAsG;cACpG,uHAAuH;QAC3H,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,4CAA4C,CAAC;KAChE;IACD,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE;QACvD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,+BAA+B;QACxC,WAAW,EAAE,2GAA2G;QACxH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,4BAA4B,CAAC;KAChD;IACD,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE;QACpD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,8BAA8B;QACvC,WAAW,EACT,8FAA8F;cAC5F,2GAA2G;cAC3G,yIAAyI;cACzI,sGAAsG;cACtG,qGAAqG;cACrG,iGAAiG;cACjG,0BAA0B;QAC9B,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,aAAa;QACpC,aAAa,EAAE,EAAE,CAAC,2CAA2C,CAAC;KAC/D;IACD,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE;QACnD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,iCAAiC;QAC1C,WAAW,EACT,uGAAuG;cACrG,mGAAmG;cACnG,wGAAwG;QAC5G,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,qDAAqD;QAC5E,aAAa,EAAE,EAAE,CAAC,4CAA4C,CAAC;KAChE;IACD,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE;QAC5C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,kBAAkB;QAC3B,WAAW,EAAE,8GAA8G;QAC3H,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,oCAAoC,CAAC;KACxD;IACD,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE;QAC9C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,kBAAkB;QAC3B,WAAW,EACT,yGAAyG;cACvG,0BAA0B;QAC9B,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,6DAA6D;QACpF,aAAa,EAAE,EAAE,CAAC,yBAAyB,CAAC;KAC7C;IACD,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE;QAC9C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,kBAAkB;QAC3B,WAAW,EAAE,mGAAmG;QAChH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,kCAAkC,CAAC;KACtD;IAED,gGAAgG;IAChG,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE;QAC5C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,yCAAyC;QAClD,WAAW,EACT,iHAAiH;cAC/G,sHAAsH;cACtH,uBAAuB;QAC3B,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,iCAAiC,CAAC;KACrD;IACD,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE;QAC/C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,oBAAoB;QAC7B,WAAW,EACT,wHAAwH;cACtH,qBAAqB;QACzB,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,6DAA6D,CAAC;KACjF;IACD,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE;QAC5C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,uBAAuB;QAChC,WAAW,EACT,qHAAqH;cACnH,oGAAoG;QACxG,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,6DAA6D;QACpF,aAAa,EAAE,EAAE,CAAC,mCAAmC,CAAC;KACvD;IACD,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE;QACnD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,2BAA2B;QACpC,WAAW,EAAE,2GAA2G;QACxH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,kCAAkC,CAAC;KACtD;IACD,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE;QACrD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QAC5B,OAAO,EAAE,oBAAoB;QAC7B,WAAW,EACT,wHAAwH;cACtH,2BAA2B;QAC/B,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,6DAA6D;QACpF,aAAa,EAAE,EAAE,CAAC,2BAA2B,CAAC;KAC/C;IACD,CAAC,wBAAwB,CAAC,kCAAkC,CAAC,EAAE;QAC7D,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,2CAA2C;QACpD,WAAW,EACT,iHAAiH;cAC/G,+GAA+G;cAC/G,oBAAoB;QACxB,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,iDAAiD,CAAC;KACrE;IACD,CAAC,wBAAwB,CAAC,oCAAoC,CAAC,EAAE;QAC/D,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,2BAA2B;QACpC,WAAW,EACT,gHAAgH;cAC9G,6GAA6G;cAC7G,0GAA0G;QAC9G,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,sEAAsE,CAAC;KAC1F;IACD,CAAC,wBAAwB,CAAC,kCAAkC,CAAC,EAAE;QAC7D,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,qDAAqD;QAC9D,WAAW,EACT,kHAAkH;cAChH,6GAA6G;cAC7G,kFAAkF;QACtF,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,iFAAiF,CAAC;KACrG;IACD,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE;QACtC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,2CAA2C;QACpD,WAAW,EACT,yHAAyH;cACvH,sHAAsH;cACtH,uHAAuH;cACvH,mHAAmH;QACvH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,6BAA6B,CAAC;KACjD;IACD,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE;QACtD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,yBAAyB;QAClC,WAAW,EACT,wHAAwH;cACtH,0GAA0G;QAC9G,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,2CAA2C,CAAC;KAC/D;IACD,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE;QAC9C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,+CAA+C;QACxD,WAAW,EACT,wHAAwH;cACtH,0HAA0H;cAC1H,0GAA0G;cAC1G,+GAA+G;QACnH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,sEAAsE,CAAC;KAC1F;IACD,CAAC,wBAAwB,CAAC,+BAA+B,CAAC,EAAE;QAC1D,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,oDAAoD;QAC7D,WAAW,EACT,yHAAyH;cACvH,qHAAqH;cACrH,oHAAoH;cACpH,8HAA8H;cAC9H,2DAA2D;QAC/D,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,oCAAoC,CAAC;KACxD;IACD,CAAC,wBAAwB,CAAC,8BAA8B,CAAC,EAAE;QACzD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,sCAAsC;QAC/C,WAAW,EACT,0HAA0H;cACxH,uFAAuF;QAC3F,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,uCAAuC,CAAC;KAC3D;IAED,gGAAgG;IAChG,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE;QAChD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,wBAAwB;QACjC,WAAW,EACT,uHAAuH;cACrH,oHAAoH;cACpH,iBAAiB;QACrB,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,aAAa;QACpC,aAAa,EAAE,EAAE,CAAC,gDAAgD,CAAC;KACpE;IACD,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE;QAC/C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC;QAC1C,OAAO,EAAE,yBAAyB;QAClC,WAAW,EACT,qHAAqH;cACnH,gHAAgH;cAChH,kHAAkH;QACtH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,0FAA0F;QACjH,aAAa,EAAE,EAAE,CAAC,gEAAgE,CAAC;KACpF;IACD,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE;QAC9C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,4DAA4D;QACrE,WAAW,EACT,mHAAmH;cACjH,+GAA+G;cAC/G,+GAA+G;cAC/G,wEAAwE;QAC5E,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,kDAAkD;QACzE,aAAa,EAAE,EAAE,CAAC,4FAA4F,CAAC;KAChH;IACD,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE;QACxD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,mCAAmC;QAC5C,WAAW,EACT,mHAAmH;cACjH,8EAA8E;QAClF,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,aAAa;QACpC,aAAa,EAAE,EAAE,CAAC,qDAAqD,CAAC;KACzE;IACD,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE;QACxD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,uCAAuC;QAChD,WAAW,EACT,wHAAwH;cACtH,8DAA8D;QAClE,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,aAAa;QACpC,aAAa,EAAE,EAAE,CAAC,qDAAqD,CAAC;KACzE;IACD,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE;QAC1C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,sBAAsB;QAC/B,WAAW,EACT,uHAAuH;cACrH,yBAAyB;QAC7B,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,aAAa;QACpC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,qDAAqD,EAAE;KAC/F;IACD,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE;QACxC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,iCAAiC;QAC1C,WAAW,EACT,wHAAwH;cACtH,oHAAoH;cACpH,6BAA6B;QACjC,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,wDAAwD;QAC/E,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,2EAA2E,EAAE;KACrH;IACD,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE;QAC7C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,qHAAqH;cACnH,oHAAoH;cACpH,kCAAkC;QACtC,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,+DAA+D;QACtF,aAAa,EAAE,EAAE,CAAC,iCAAiC,CAAC;KACrD;IACD,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE;QACxC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC;QAC1C,OAAO,EAAE,6BAA6B;QACtC,WAAW,EACT,wHAAwH;cACtH,oHAAoH;cACpH,yBAAyB;QAC7B,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,6DAA6D;QACpF,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,iDAAiD,EAAE;KAC3F;IACD,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE;QAC9C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,qBAAqB;QAC9B,WAAW,EACT,yHAAyH;cACvH,uHAAuH;cACvH,QAAQ;QACZ,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,wFAAwF,CAAC;KAC5G;IAED,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,EAAE;QAC3C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,qHAAqH;cACnH,uHAAuH;cACvH,0EAA0E;QAC9E,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,kGAAkG,CAAC;KACtH;IAED,gGAAgG;IAChG,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE;QACtD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,oCAAoC;QAC7C,WAAW,EACT,yHAAyH;cACvH,6FAA6F;QACjG,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,+CAA+C,CAAC;KACnE;IACD,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE;QACtD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,8BAA8B;QACvC,WAAW,EACT,uHAAuH;cACrH,oHAAoH;cACpH,yDAAyD;QAC7D,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,sDAAsD,EAAE;KAChG;IACD,CAAC,wBAAwB,CAAC,+BAA+B,CAAC,EAAE;QAC1D,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,qDAAqD;QAC9D,WAAW,EACT,uHAAuH;cACrH,cAAc;QAClB,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,sDAAsD,EAAE;KAChG;IACD,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE;QACxD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,kCAAkC;QAC3C,WAAW,EAAE,kHAAkH;QAC/H,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,gDAAgD;QACvE,aAAa,EAAE,EAAE,CAAC,0CAA0C,CAAC;KAC9D;IACD,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE;QACtD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,yHAAyH;cACvH,4BAA4B;QAChC,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,uCAAuC,CAAC;KAC3D;IACD,CAAC,wBAAwB,CAAC,+BAA+B,CAAC,EAAE;QAC1D,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,uDAAuD;QAChE,WAAW,EAAE,iFAAiF;QAC9F,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,uCAAuC,CAAC;KAC3D;IAED,gGAAgG;IAChG,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE;QACnD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,mCAAmC;QAC5C,WAAW,EACT,mHAAmH;cACjH,qHAAqH;cACrH,iHAAiH;cACjH,uDAAuD;QAC3D,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iFAAiF;QACxG,aAAa,EAAE,EAAE,CAAC,iCAAiC,CAAC;KACrD;IACD,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE;QACrD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,yCAAyC;QAClD,WAAW,EACT,sHAAsH;cACpH,iHAAiH;cACjH,qHAAqH;cACrH,8CAA8C;QAClD,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iFAAiF;QACxG,aAAa,EAAE,EAAE,CAAC,iCAAiC,CAAC;KACrD;IACD,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE;QAC9C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,kBAAkB;QAC3B,WAAW,EACT,yHAAyH;cACvH,qHAAqH;cACrH,4BAA4B;QAChC,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,wCAAwC;QAC/D,aAAa,EAAE,EAAE,CAAC,cAAc,CAAC;KAClC;IACD,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE;QACnD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,wBAAwB;QACjC,WAAW,EACT,qHAAqH;cACnH,oHAAoH;cACpH,4DAA4D;QAChE,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,gFAAgF;QACvG,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,0EAA0E,EAAE;KACpH;IACD,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE;QACjD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,2BAA2B;QACpC,WAAW,EACT,8GAA8G;cAC5G,kFAAkF;QACtF,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,8EAA8E;QACrG,aAAa,EAAE,EAAE,CAAC,gFAAgF,CAAC;KACpG;IACD,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE;QAC/C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,gBAAgB;QACzB,WAAW,EACT,uHAAuH;cACrH,sHAAsH;cACtH,yEAAyE;QAC7E,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,4EAA4E;QACnG,aAAa,EAAE,EAAE,CAAC,iDAAiD,CAAC;KACrE;IACD,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,EAAE;QAClD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,mBAAmB;QAC5B,WAAW,EAAE,qGAAqG;QAClH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,gDAAgD;QACvE,aAAa,EAAE,EAAE,CAAC,wBAAwB,CAAC;KAC5C;IACD,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE;QAChD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,gBAAgB;QACzB,WAAW,EACT,oHAAoH;cAClH,wDAAwD;QAC5D,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,4EAA4E;QACnG,aAAa,EAAE,EAAE,CAAC,kFAAkF,CAAC;KACtG;IACD,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE;QACrD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,sBAAsB;QAC/B,WAAW,EACT,wHAAwH;cACtH,qHAAqH;cACrH,sFAAsF;QAC1F,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,4DAA4D;QACnF,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,0EAA0E,EAAE;KACpH;IACD,CAAC,wBAAwB,CAAC,kCAAkC,CAAC,EAAE;QAC7D,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,mHAAmH;cACjH,gHAAgH;cAChH,8CAA8C;QAClD,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,2EAA2E;QAClG,aAAa,EAAE,EAAE,CAAC,sDAAsD,CAAC;KAC1E;IACD,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,EAAE;QAClD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,+BAA+B;QACxC,WAAW,EACT,0HAA0H;cACxH,gHAAgH;cAChH,mFAAmF;QACvF,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,kEAAkE;QACzF,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,6EAA6E,EAAE;KACvH;IACD,CAAC,wBAAwB,CAAC,8BAA8B,CAAC,EAAE;QACzD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,GAAG;QACV,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC;QAC5D,OAAO,EAAE,wCAAwC;QACjD,WAAW,EACT,sHAAsH;cACpH,qHAAqH;cACrH,oEAAoE;QACxE,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,4FAA4F;QACnH,aAAa,EAAE,EAAE,CAAC,sEAAsE,CAAC;KAC1F;IAED,gGAAgG;IAChG,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE;QACpD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,wCAAwC;QACjD,WAAW,EACT,6GAA6G;cAC3G,qHAAqH;cACrH,iHAAiH;cACjH,8GAA8G;cAC9G,8GAA8G;cAC9G,iHAAiH;cACjH,+CAA+C;QACnD,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,gDAAgD,CAAC;KACpE;IACD,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE;QACvD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,iCAAiC;QAC1C,WAAW,EACT,yFAAyF;cACvF,qHAAqH;cACrH,gHAAgH;cAChH,kHAAkH;cAClH,uHAAuH;QAC3H,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,gGAAgG;QACvH,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,qFAAqF,EAAE;KAC/H;IACD,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE;QACvD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,+CAA+C;QACxD,WAAW,EACT,2HAA2H;cACzH,qHAAqH;cACrH,mHAAmH;cACnH,2GAA2G;QAC/G,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,6DAA6D,CAAC;KACjF;IACD,CAAC,wBAAwB,CAAC,oCAAoC,CAAC,EAAE;QAC/D,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,yCAAyC;QAClD,WAAW,EACT,qHAAqH;cACnH,yDAAyD;cACzD,gHAAgH;cAChH,8GAA8G;cAC9G,kFAAkF;QACtF,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,mDAAmD,CAAC;KACvE;IACD,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE;QACxD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,uBAAuB;QAChC,WAAW,EACT,oHAAoH;cAClH,uHAAuH;cACvH,wGAAwG;cACxG,+GAA+G;cAC/G,oHAAoH;cACpH,uEAAuE;QAC3E,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,mEAAmE,CAAC;KACvF;IAED,CAAC,wBAAwB,CAAC,gCAAgC,CAAC,EAAE;QAC3D,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,2DAA2D;QACpE,WAAW,EACT,8HAA8H;cAC5H,gIAAgI;cAChI,qHAAqH;cACrH,+GAA+G;cAC/G,4GAA4G;cAC5G,kHAAkH;cAClH,mDAAmD;QACvD,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,mFAAmF,CAAC;KACvG;IACD,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE;QACnD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,uHAAuH;cACrH,uHAAuH;cACvH,6GAA6G;cAC7G,mHAAmH;cACnH,kHAAkH;cAClH,0HAA0H;cAC1H,6GAA6G;QACjH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,+CAA+C,CAAC;KACnE;IACD,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE;QACrD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,qEAAqE;QAC9E,WAAW,EACT,8GAA8G;cAC5G,+GAA+G;cAC/G,0GAA0G;cAC1G,2GAA2G;cAC3G,+GAA+G;cAC/G,mBAAmB;QACvB,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,sGAAsG,CAAC;KAC1H;IACD,CAAC,wBAAwB,CAAC,gCAAgC,CAAC,EAAE;QAC3D,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,wDAAwD;QACjE,WAAW,EACT,mHAAmH;cACjH,uHAAuH;cACvH,kHAAkH;cAClH,sHAAsH;cACtH,oHAAoH;cACpH,2CAA2C;QAC/C,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,kGAAkG,CAAC;KACtH;IAED,gGAAgG;IAChG,CAAC,wBAAwB,CAAC,YAAY,CAAC,EAAE;QACvC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC;QAC7D,OAAO,EAAE,iCAAiC;QAC1C,WAAW,EACT,sHAAsH;cACpH,uHAAuH;cACvH,iHAAiH;cACjH,mHAAmH;cACnH,mHAAmH;cACnH,qHAAqH;QACzH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,8EAA8E;QACrG,aAAa,EAAE,EAAE,CAAC,uDAAuD,CAAC;KAC3E;IACD,CAAC,wBAAwB,CAAC,+BAA+B,CAAC,EAAE;QAC1D,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,oDAAoD;QAC7D,WAAW,EACT,wHAAwH;cACtH,sHAAsH;cACtH,gHAAgH;cAChH,uCAAuC;QAC3C,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,kFAAkF;QACzG,aAAa,EAAE,EAAE,CAAC,2CAA2C,CAAC;KAC/D;IACD,CAAC,wBAAwB,CAAC,cAAc,CAAC,EAAE;QACzC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,YAAY;QACrB,WAAW,EACT,sHAAsH;cACpH,qHAAqH;cACrH,QAAQ;QACZ,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,8EAA8E;QACrG,aAAa,EAAE,EAAE,CAAC,iBAAiB,CAAC;KACrC;IACD,CAAC,wBAAwB,CAAC,SAAS,CAAC,EAAE;QACpC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,2BAA2B;QACpC,WAAW,EACT,sHAAsH;cACpH,oHAAoH;cACpH,mHAAmH;QACvH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,8DAA8D;QACrF,aAAa,EAAE,EAAE,CAAC,yEAAyE,CAAC;KAC7F;IAED,gGAAgG;IAChG,CAAC,wBAAwB,CAAC,UAAU,CAAC,EAAE;QACrC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC;QAC5C,OAAO,EAAE,kCAAkC;QAC3C,WAAW,EACT,sHAAsH;cACpH,wHAAwH;cACxH,2EAA2E;QAC/E,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,sEAAsE;QAC7F,aAAa,EAAE,EAAE,CAAC,yDAAyD,CAAC;KAC7E;IACD,CAAC,wBAAwB,CAAC,cAAc,CAAC,EAAE;QACzC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,sHAAsH;cACpH,yCAAyC;QAC7C,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,8BAA8B,CAAC;KAClD;IACD,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE;QACtC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,uCAAuC;QAChD,WAAW,EACT,wHAAwH;cACtH,mDAAmD;QACvD,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,qCAAqC,EAAE;KAC/E;IACD,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE;QAC9C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QAC5B,OAAO,EAAE,0CAA0C;QACnD,WAAW,EACT,iHAAiH;cAC/G,4HAA4H;QAChI,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,yCAAyC,CAAC;KAC7D;IACD,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE;QACpD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,oCAAoC;QAC7C,WAAW,EACT,yHAAyH;cACvH,4DAA4D;QAChE,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,4EAA4E;QACnG,aAAa,EAAE,EAAE,CAAC,8CAA8C,CAAC;KAClE;IACD,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE;QACpD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QAC5B,OAAO,EAAE,wBAAwB;QACjC,WAAW,EACT,uHAAuH;cACrH,kGAAkG;QACtG,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,kCAAkC,CAAC;KACtD;IAED,gGAAgG;IAChG,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE;QAC1C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,wBAAwB;QACjC,WAAW,EACT,wHAAwH;cACtH,gGAAgG;QACpG,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,gEAAgE;QACvF,aAAa,EAAE,EAAE,CAAC,4CAA4C,CAAC;KAChE;IACD,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE;QAC5C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,sCAAsC;QAC/C,WAAW,EACT,wHAAwH;cACtH,qHAAqH;cACrH,WAAW;QACf,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,qCAAqC,CAAC;KACzD;IACD,CAAC,wBAAwB,CAAC,kCAAkC,CAAC,EAAE;QAC7D,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,uDAAuD;QAChE,WAAW,EACT,sHAAsH;cACpH,qHAAqH;cACrH,6GAA6G;cAC7G,6GAA6G;cAC7G,oHAAoH;QACxH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,2FAA2F;QAClH,aAAa,EAAE,EAAE,CAAC,qHAAqH,CAAC;KACzI;IACD,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE;QACtC,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,wCAAwC;QACjD,WAAW,EACT,wHAAwH;cACtH,qHAAqH;cACrH,+CAA+C;QACnD,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,2BAA2B,CAAC;KAC/C;IACD,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE;QACxD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,iEAAiE;QAC1E,WAAW,EACT,uHAAuH;cACrH,0HAA0H;cAC1H,4HAA4H;cAC5H,wHAAwH;cACxH,4HAA4H;cAC5H,yHAAyH;QAC7H,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,4DAA4D,CAAC;KAChF;IACD,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE;QACjD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,oEAAoE;QAC7E,WAAW,EACT,6HAA6H;cAC3H,8HAA8H;cAC9H,8HAA8H;cAC9H,6GAA6G;QACjH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,2CAA2C,CAAC;KAC/D;IACD,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE;QAC7C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,2EAA2E;QACpF,WAAW,EACT,+HAA+H;cAC7H,6HAA6H;cAC7H,2HAA2H;cAC3H,4HAA4H;cAC5H,8HAA8H;cAC9H,8HAA8H;cAC9H,4BAA4B;QAChC,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,wCAAwC,CAAC;KAC5D;IACD,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE;QACnD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,yEAAyE;QAClF,WAAW,EACT,8HAA8H;cAC5H,2HAA2H;cAC3H,8HAA8H;cAC9H,2HAA2H;cAC3H,4GAA4G;QAChH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,6CAA6C,CAAC;KACjE;IACD,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE;QACvD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,wFAAwF;QACjG,WAAW,EACT,2HAA2H;cACzH,wHAAwH;cACxH,qHAAqH;cACrH,kHAAkH;cAClH,gJAAgJ;cAChJ,0HAA0H;cAC1H,sHAAsH;cACtH,6GAA6G;cAC7G,sBAAsB;QAC1B,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,8CAA8C,CAAC;KAClE;IACD,CAAC,wBAAwB,CAAC,8BAA8B,CAAC,EAAE;QACzD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,sEAAsE;QAC/E,WAAW,EACT,gIAAgI;cAC9H,4HAA4H;cAC5H,yHAAyH;cACzH,2HAA2H;cAC3H,cAAc;QAClB,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,mDAAmD,CAAC;KACvE;IACD,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE;QAC/C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,6EAA6E;QACtF,WAAW,EACT,oHAAoH;cAClH,uHAAuH;cACvH,2HAA2H;cAC3H,8HAA8H;cAC9H,cAAc;QAClB,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,0BAA0B,CAAC;KAC9C;IACD,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE;QACtD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,yEAAyE;QAClF,WAAW,EACT,oIAAoI;cAClI,sIAAsI;cACtI,qIAAqI;cACrI,wIAAwI;cACxI,mHAAmH;QACvH,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,mEAAmE,CAAC;KACvF;IACD,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE;QACrD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,qDAAqD;QAC9D,WAAW,EACT,oHAAoH;cAClH,qHAAqH;cACrH,iFAAiF;QACrF,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,yEAAyE,CAAC;KAC7F;IACD,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE;QAC/C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC;QAC5C,OAAO,EAAE,uCAAuC;QAChD,WAAW,EACT,0HAA0H;cACxH,sEAAsE;QAC1E,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,kEAAkE,CAAC;KACtF;IACD,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE;QACjD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,kCAAkC;QAC3C,WAAW,EACT,uHAAuH;cACrH,wHAAwH;cACxH,mHAAmH;cACnH,0HAA0H;QAC9H,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,qBAAqB,CAAC;KACzC;IACD,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE;QACpD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,yDAAyD;QAClE,WAAW,EACT,sHAAsH;cACpH,qHAAqH;cACrH,wHAAwH;cACxH,qGAAqG;QACzG,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,uBAAuB,CAAC;KAC3C;IACD,CAAC,wBAAwB,CAAC,gCAAgC,CAAC,EAAE;QAC3D,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,qCAAqC;QAC9C,WAAW,EACT,wHAAwH;cACtH,qHAAqH;cACrH,sEAAsE;QAC1E,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,gCAAgC,CAAC;KACpD;IACD,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,EAAE;QAC3C,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,iCAAiC;QAC1C,WAAW,EACT,sHAAsH;cACpH,uCAAuC;QAC3C,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,yBAAyB,CAAC;KAC7C;IACD,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE;QACrD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC;QAC1C,OAAO,EAAE,yCAAyC;QAClD,WAAW,EACT,qHAAqH;cACnH,6CAA6C;QACjD,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,wEAAwE,CAAC;KAC5F;IACD,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE;QACjD,WAAW,EAAE,gCAAgC,CAAC,SAAS;QACvD,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,OAAO,EAAE,0CAA0C;QACnD,WAAW,EACT,uHAAuH;cACrH,kDAAkD;QACtD,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,iBAAiB;QACxC,aAAa,EAAE,EAAE,CAAC,0BAA0B,CAAC;KAC9C;CACF,CAAC","sourcesContent":["/*\n What each manually mounted controller route IS, for consumer documentation.\n \n ## Why this file exists\n \n A Wildo application serves two disjoint families of HTTP routes. The RESOURCE REGISTRY builds one\n * family from the resource configurations, and every mechanism downstream — the OpenAPI generator,\n * the API-reference renderer, the link index — projects that family and only that family. The other\n * family is mounted by hand, controller by controller, from\n * {@link MANUAL_CONTROLLER_ROUTES_URLS}: sign-in, token refresh, MFA, passkeys, SAML, the OAuth 2.0\n * authorization-server endpoints, the MCP and A2A doors, file transfer, i18n labels, charts.\n \n Nothing projected the second family, so it appeared in NO generated API reference. Measured\n * 2026-09-09 on the four committed documents of the two dogfood applications — 439, 576, 146 and 160\n * paths — every one of which contained zero paths under `/auth`. The reference told an integrator\n * that operations accept a bearer token and never told them which endpoint issues one; worse, four\n * operation-header descriptions in the same document say a step-up token is \"obtained from\n * `POST /api/v1/auth/reauth`\", a path that document does not publish.\n \n ## Why the facts live HERE and not at the mount site\n \n The route's VERB and its one-line purpose are already written at each `logRouteRegistration(...)`\n * call — 203 of them — inside `@wildo-ai/saas-backend-lib`. That package is the backend runtime, and\n * the documentation projector runs inside the companion's introspection subprocess, which loads the\n * application's SHARED library and never the backend. So the mount site cannot be the source: it is\n * not reachable from where the answer is needed.\n \n This catalog is therefore the shared, statically-loadable source, and it is *total over\n {@link ManualControllerRouteKey}** by construction. A route key added tomorrow does not compile\n * until somebody says what it is and whether it may be published — which is the whole point: an\n * undocumented route should be a build failure, not a silent hole in a customer-facing reference.\n \n ## What is deliberately NOT here\n \n No request or response JSON Schema. The request bodies are Zod schemas declared inside the backend\n * controllers, unreachable from this package; hand-copying them here would create a second copy of a\n * contract with nothing checking the two agree — the exact drift this repository refuses elsewhere.\n * Each entry therefore names its payload in PROSE and authors its success status, which is honest\n * about what is known. Wiring the real schemas is a later, larger change that has to move them into a\n * shared module first.\n /\n\nimport { HttpMethod } from './http-requests.shared';\nimport { ManualControllerRouteKey } from './manual-controllers-routes-urls';\n\n/\n The API-reference grouping a manual route belongs to — the OpenAPI `tag` it is published under.\n \n Deliberately NOT one group per controller. A reader groups by what they are trying to DO, and the\n * controller split is an implementation fact: sign-in lives in one controller and password change in\n * another, and both are \"authentication\" to the person reading.\n \n The values must not collide with any resource identifier, because the generator turns a tag name\n * into `technical-documentation:resource/<name>` and two tags claiming one ref would make the\n * renderer's conservation check refuse the document. Resource identifiers are the resource TYPES\n * (`users`, `organizations`, `oauthConsentGrants`, …); none of these names is one.\n /\nexport enum ManualControllerRouteGroup {\n /* Signing in, staying signed in, signing out, and everything that proves who the caller is. /\n AUTHENTICATION = 'authentication',\n /* This application acting as an OAuth 2.0 / OpenID Connect authorization server for other software. /\n IDENTITY_PROVIDER = 'identityProvider',\n /* Connecting a third-party account so this application can act as it. The opposite arrow from sign-in. /\n CONNECTED_ACCOUNTS = 'connectedAccounts',\n /* The doors an autonomous agent knocks on: Model Context Protocol and Agent2Agent. /\n AGENT_INTERFACES = 'agentInterfaces',\n /* Transferring a stored file by its own id, wherever it is attached. /\n FILE_TRANSFER = 'fileTransfer',\n /* Reads a client makes to work out what this application currently offers it. /\n APPLICATION_RUNTIME = 'applicationRuntime',\n}\n\n/\n What a caller must present. Mirrors the documentation vocabulary the resource projector already\n * resolves from role bindings, so both families of routes describe access the same way.\n /\nexport enum ManualControllerRouteAuthentication {\n /* No credential. The request itself carries whatever authorization it needs (a single-use token, say). /\n PUBLIC = 'public',\n /* An anonymous-session token in the anonymous-session header. /\n ANONYMOUS_SESSION = 'anonymous_session',\n /* A bearer access token, or an API key where the surface accepts one. /\n AUTHENTICATED = 'authenticated',\n /* Either an anonymous session or a full credential; the endpoint serves both. /\n ANONYMOUS_OR_AUTHENTICATED = 'anonymous_or_authenticated',\n}\n\n/* Whether a route reaches the generated consumer API reference. /\nexport enum ManualControllerRoutePublication {\n PUBLISHED = 'published',\n WITHHELD = 'withheld',\n}\n\n/* A route that is published: everything the projector needs to emit an OpenAPI operation. /\nexport interface PublishedManualControllerRouteDocumentation {\n readonly publication: ManualControllerRoutePublication.PUBLISHED;\n readonly group: ManualControllerRouteGroup;\n /\n The methods actually mounted for this path, measured from the controllers rather than assumed.\n * One key can carry several (`/oauth/register/{clientId}` is GET, PUT and DELETE; RFC 7592 defines\n * ONE endpoint whose method selects the operation), and each becomes its own OpenAPI operation.\n /\n readonly methods: readonly HttpMethod[];\n /* Short action label. Becomes the OpenAPI `summary`; the generator caps it at 200 characters. /\n readonly summary: string;\n /* What the endpoint does, what it expects, and what a caller does with the answer. Capped at 2000. /\n readonly description: string;\n readonly authentication: ManualControllerRouteAuthentication;\n /* One sentence naming the credential. Capped at 500. /\n readonly authenticationSummary: string;\n /\n The success status and what it means. Authored because no response schema is projected: without\n * it the generator would emit a bare `204 No Content`, which is wrong for almost every route here.\n /\n readonly successStatus: { readonly code: string; readonly meaning: string };\n}\n\n/\n A route that is NOT published, and why.\n \n The reason is a required field rather than a comment on purpose. Withholding a route from a\n * customer-facing reference is a decision, and a decision with no recorded reason is indistinguishable\n * from an oversight — which is how this whole family came to be missing in the first place.\n /\nexport interface WithheldManualControllerRouteDocumentation {\n readonly publication: ManualControllerRoutePublication.WITHHELD;\n readonly withheldReason: string;\n}\n\nexport type ManualControllerRouteDocumentation =\n \| PublishedManualControllerRouteDocumentation\n \| WithheldManualControllerRouteDocumentation;\n\n/* Shorthand for the common `200` success row, so the entries below stay readable. /\nfunction ok(meaning: string): { code: string; meaning: string } {\n return { code: '200', meaning };\n}\n\nconst AUTH = ManualControllerRouteGroup.AUTHENTICATION;\nconst IDP = ManualControllerRouteGroup.IDENTITY_PROVIDER;\nconst CONNECTIONS = ManualControllerRouteGroup.CONNECTED_ACCOUNTS;\nconst AGENTS = ManualControllerRouteGroup.AGENT_INTERFACES;\nconst FILES = ManualControllerRouteGroup.FILE_TRANSFER;\nconst RUNTIME = ManualControllerRouteGroup.APPLICATION_RUNTIME;\n\nconst PUBLIC = ManualControllerRouteAuthentication.PUBLIC;\nconst BEARER = ManualControllerRouteAuthentication.AUTHENTICATED;\n\nconst NO_CREDENTIAL = 'No credential. This endpoint is reachable before a caller has one.';\nconst BEARER_CREDENTIAL = 'A bearer access token identifying the caller.';\n\n/* Prose group descriptions, emitted as each published group's OpenAPI `tags[].description`. /\nexport const MANUAL_CONTROLLER_ROUTE_GROUP_DESCRIPTIONS: Record<ManualControllerRouteGroup, string> = {\n [ManualControllerRouteGroup.AUTHENTICATION]:\n 'Obtaining a credential, keeping it, and giving it up. Start at Identify a caller* to learn which methods an account '\n + 'can use, then call the method you chose; a successful call returns the access token every other operation in this '\n + 'reference accepts as `Authorization: Bearer <token>`. These endpoints are mounted by the framework rather than derived '\n + 'from a resource, so their payloads are described in prose here rather than carrying a JSON Schema.',\n [ManualControllerRouteGroup.IDENTITY_PROVIDER]:\n 'This application acting as an OAuth 2.0 authorization server and OpenID Connect provider for OTHER software — the '\n + 'endpoints a client, an MCP client or an agent uses to obtain a token bound to this application. Distinct from the '\n + 'authentication endpoints, which sign a person in TO this application. Payloads follow the cited RFCs; this reference '\n + 'publishes the addresses and the contract summary rather than re-stating the specifications.',\n [ManualControllerRouteGroup.CONNECTED_ACCOUNTS]:\n 'Connecting a third-party account so this application can act as that account. The opposite direction from signing in '\n + 'with a vendor: same protocol, opposite arrow.',\n [ManualControllerRouteGroup.AGENT_INTERFACES]:\n 'The endpoints autonomous software talks to: the Model Context Protocol server and the Agent2Agent surface, plus the '\n + 'public metadata each advertises so a client can discover where to get a token.',\n [ManualControllerRouteGroup.FILE_TRANSFER]:\n 'Transferring a stored file by its own id. Distinct from a resource\\'s own `…/{id}/files/{field}` routes, which upload '\n + 'and replace the file bound to one field of one record.',\n [ManualControllerRouteGroup.APPLICATION_RUNTIME]:\n 'Reads a client makes to work out what this application currently offers it — resolved features, translated labels, '\n + 'chart data, conversational history, product-analytics ingestion.',\n};\n\n/*\n Every manually mounted route, keyed by the route it is mounted at.\n \n TOTAL over {@link ManualControllerRouteKey}: the `Record` type makes a new route key a compile\n * error until it is described here. That is the mechanism that keeps this catalog honest — a\n * hand-kept list of \"the ones we remembered\" is precisely what rots.\n /\nexport const MANUAL_CONTROLLER_ROUTE_DOCUMENTATION: Record<ManualControllerRouteKey, ManualControllerRouteDocumentation> = {\n [ManualControllerRouteKey.APPLICATION_CONFIG_GET]: {\n publication: ManualControllerRoutePublication.WITHHELD,\n withheldReason:\n 'Bootstrap contract between this application\\'s backend and its OWN frontend bundles. The response is keyed by a '\n + '`frontendServiceName` query parameter and its shape follows whatever that frontend is configured to need, so it is '\n + 'not a stable surface for an integrator and publishing it would invite calls that break when a frontend changes.',\n },\n\n // ─── Signing in ──────────────────────────────────────────────────────────────────────────────\n [ManualControllerRouteKey.AUTH_IDENTIFY]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Identify a caller and list the authentication methods available to them',\n description:\n 'The first step of every sign-in. Post the identifier a person signs in with (their email address, typically) and the '\n + 'answer says which authentication methods that account can use — password, passkey, magic link, one-time code, an '\n + 'enterprise connection — so the caller can present the right one next. Deliberately does not say whether the account '\n + 'exists in terms an attacker can enumerate.',\n authentication: PUBLIC,\n authenticationSummary: NO_CREDENTIAL,\n successStatus: ok('The methods this caller may authenticate with, and what each of them needs next.'),\n },\n [ManualControllerRouteKey.AUTH_AUTHENTICATE_PASSWORD]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Authenticate with a password',\n description:\n 'Sign in with an identifier and a password. On success the response carries the access token every other operation in '\n + 'this reference accepts as `Authorization: Bearer <token>`, and the refresh token is set as an HTTP-only cookie scoped '\n + 'to the authentication routes. When the account requires a second factor the answer says so and names the factor '\n + 'instead of issuing a token; complete it at the matching MFA endpoint.',\n authentication: PUBLIC,\n authenticationSummary: NO_CREDENTIAL,\n successStatus: ok('An access token and the caller\\'s session, or the second factor still owed.'),\n },\n [ManualControllerRouteKey.AUTH_AUTHENTICATE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Authenticate with any method',\n description:\n 'The universal sign-in endpoint: name the method and supply its proof, and the answer is the same shape whichever method '\n + 'was used. Prefer this over the per-method endpoints when the client renders whatever Identify a caller* offered, '\n + 'because one code path then serves every method the application enables.',\n authentication: PUBLIC,\n authenticationSummary: NO_CREDENTIAL,\n successStatus: ok('An access token and the caller\\'s session, or the next step still owed.'),\n },\n [ManualControllerRouteKey.AUTH_TOKEN_REFRESH]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Refresh an access token',\n description:\n 'Exchange the refresh token for a new access token. Deliberately NOT behind bearer authentication — the caller reaches '\n + 'this endpoint precisely because their access token has expired. Browsers send the refresh token automatically in its '\n + 'HTTP-only cookie, which is why the request needs no body from them.',\n authentication: PUBLIC,\n authenticationSummary:\n 'No bearer token. The refresh token itself is the credential, sent in its HTTP-only cookie or in the request.',\n successStatus: ok('A fresh access token, and a rotated refresh token in its cookie.'),\n },\n [ManualControllerRouteKey.AUTH_SESSION_STATE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET],\n summary: 'Read the state of an in-progress authentication session',\n description:\n 'Where a multi-step sign-in has got to: which factors are satisfied, which are still owed, and whether the session is '\n + 'still live. Addressed by the session identifier a previous step returned.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The session identifier is the thing being asked about.',\n successStatus: ok('The session\\'s current step and what it still requires.'),\n },\n [ManualControllerRouteKey.AUTH_LOGOUT]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Sign out of this session',\n description:\n 'Ends the caller\\'s current session and clears the refresh-token cookie. The cookie is cleared even when no refresh token '\n + 'was presented, because clearing is the user-visible act and a stale cookie must not survive it.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The session is ended and the refresh-token cookie is cleared.'),\n },\n [ManualControllerRouteKey.AUTH_LOGOUT_ALL]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Sign out everywhere',\n description:\n 'Invalidates every access and refresh token this user holds, on every device, by moving the user\\'s invalidation fence '\n + 'forward. Use it after a password change or a suspected compromise; unlike Sign out of this session it reaches '\n + 'sessions the caller is not currently using.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('Every session this user holds is now invalid.'),\n },\n [ManualControllerRouteKey.AUTH_REGISTER]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Register a new account',\n description:\n 'Creates an account from the sign-up details the application asks for. Whether the new account can sign in immediately, '\n + 'must verify its email address first, must enroll a second factor before it can sign in, or must complete organization '\n + 'onboarding depends on how this application is configured; the answer says which of those applies.',\n authentication: PUBLIC,\n authenticationSummary: NO_CREDENTIAL,\n successStatus: ok('The account, and what it must do before it can sign in.'),\n },\n [ManualControllerRouteKey.AUTH_VERIFY_EMAIL]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Verify an email address',\n description:\n 'Consumes the single-use token from a verification email and marks the address verified, which is what activates an '\n + 'account that was waiting on it. The token is single-use: a second call with the same token fails.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The single-use token in the request is what authorizes it.',\n successStatus: ok('The address is verified and the account is active.'),\n },\n [ManualControllerRouteKey.AUTH_RESEND_VERIFICATION]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Resend the verification email',\n description:\n 'Sends the verification email again for an address that has not been verified. Answers the same way whether or not the '\n + 'address belongs to an account, so it cannot be used to discover who has one.',\n authentication: PUBLIC,\n authenticationSummary: NO_CREDENTIAL,\n successStatus: ok('The request was accepted; a message is sent if the address is awaiting verification.'),\n },\n [ManualControllerRouteKey.AUTH_PASSWORD_RESET_REQUEST]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Request a password reset',\n description:\n 'Starts a password reset by emailing a single-use link to the address supplied. Answers identically whether or not that '\n + 'address has an account, so it cannot be used to enumerate users.',\n authentication: PUBLIC,\n authenticationSummary: NO_CREDENTIAL,\n successStatus: ok('The request was accepted; a message is sent if the address has an account.'),\n },\n [ManualControllerRouteKey.AUTH_PASSWORD_RESET_COMPLETE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Complete a password reset',\n description:\n 'Sets the new password, presenting the single-use token from the reset email. The token is consumed, and existing '\n + 'sessions are invalidated so a stolen session cannot outlive the reset.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The single-use reset token is what authorizes the change.',\n successStatus: ok('The password is changed and previous sessions are invalidated.'),\n },\n [ManualControllerRouteKey.AUTH_COMPLETE_ORG_ONBOARDING]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Complete organization onboarding',\n description:\n 'For applications that name an account\\'s organization at onboarding: creates the organization and makes the account '\n + 'its owner, on an authentication session parked at `ONBOARDING_PENDING` — by registration, by email verification or '\n + 'enrollment, or by a sign-in answered `nextStep: onboarding` because the account still owes its organization. It '\n + 'signs the account in when nothing else is owed; when another onboarding obligation remains (the person\\'s names, for '\n + 'a user type that collects them at onboarding), the session stays parked and the response names what is still owed. '\n + 'A sign-in response carries the access token; the refresh token is set only as the HttpOnly refresh cookie.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The parked session id in the body is what authorizes the completion, and it is consumed by it.',\n successStatus: ok('The organization exists and the account owns it; the account is signed in unless another obligation remains.'),\n },\n [ManualControllerRouteKey.AUTH_COMPLETE_PROFILE_ONBOARDING]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Complete profile onboarding',\n description:\n 'For user types that collect a person\\'s first and last name at onboarding rather than on the sign-up form: writes the '\n + 'account\\'s profile with those names, on an authentication session parked at `ONBOARDING_PENDING` that owes them. It '\n + 'signs the account in when nothing else is owed; when the organization is still owed, the session stays parked and '\n + 'the response names what remains. A sign-in response carries the access token; the refresh token is set only as the '\n + 'HttpOnly refresh cookie.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The parked session id in the body is what authorizes the completion.',\n successStatus: ok('The profile carries the names; the account is signed in unless another obligation remains.'),\n },\n\n // ─── Invitations ─────────────────────────────────────────────────────────────────────────────\n [ManualControllerRouteKey.AUTH_INVITATION_INFO]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET],\n summary: 'Read what an invitation offers',\n description:\n 'Given an invitation token, returns the inviting organization and the authentication methods it allows, so the accept '\n + 'screen can offer the right choice. Read-only: it does NOT consume the token, so it is safe to call before the person '\n + 'has decided.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The invitation token is what identifies the invitation.',\n successStatus: ok('The inviting organization and the methods it accepts.'),\n },\n [ManualControllerRouteKey.AUTH_ACCEPT_INVITATION]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Accept an invitation with its token',\n description:\n 'Consumes an invitation token and joins the invited organization. It then signs the person in, emails them a sign-in '\n + 'link when they chose one, or, for an existing account whose policy does not allow signing in from an emailed link, '\n + 'answers `nextStep: sign_in_required` and signs nobody in. For somebody arriving from the invitation email with no session. A signed-in user acting on their own pending invitations uses Accept one of my '\n + 'invitations instead, which needs no token.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The single-use invitation token is what authorizes the join.',\n successStatus: ok('Membership is created; the caller is signed in, sent a sign-in link, or told to sign in.'),\n },\n [ManualControllerRouteKey.AUTH_REJECT_INVITATION]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Reject an invitation with its token',\n description: 'Consumes an invitation token and declines it. No account is created and no session is issued.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The single-use invitation token is what authorizes the refusal.',\n successStatus: ok('The invitation is declined.'),\n },\n [ManualControllerRouteKey.AUTH_LIST_MY_INVITATIONS]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET],\n summary: 'List my pending invitations',\n description:\n 'Every pending invitation addressed to the signed-in caller\\'s own email address. Authorized by ownership of that '\n + 'address rather than by a token, so it works in-app without anybody opening an email.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The caller\\'s pending invitations.'),\n },\n [ManualControllerRouteKey.AUTH_ACCEPT_MY_INVITATION]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Accept one of my invitations',\n description:\n 'Joins an organization that invited the signed-in caller\\'s own email address. No invitation token and no new session: '\n + 'the caller keeps the session they already have.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('Membership is created; the caller\\'s existing session continues.'),\n },\n [ManualControllerRouteKey.AUTH_REJECT_MY_INVITATION]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Reject one of my invitations',\n description: 'Declines an invitation addressed to the signed-in caller\\'s own email address.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The invitation is declined.'),\n },\n\n // ─── Multi-factor authentication ─────────────────────────────────────────────────────────────\n [ManualControllerRouteKey.AUTH_MFA_EMAIL_OTP_SEND]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Send an email one-time code',\n description: 'Emails a one-time code for the authentication session that is waiting on an email second factor.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The in-progress authentication session identifies the caller.',\n successStatus: ok('A code has been sent.'),\n },\n [ManualControllerRouteKey.AUTH_MFA_EMAIL_OTP_VERIFY]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Verify an email one-time code',\n description:\n 'Presents the emailed code. When it is the last factor owed, the answer carries the access token and completes sign-in.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The code and the in-progress session are the proof.',\n successStatus: ok('The factor is satisfied; an access token when nothing else is owed.'),\n },\n [ManualControllerRouteKey.AUTH_MFA_TOTP_SETUP]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Begin TOTP enrolment',\n description:\n 'Starts enrolling an authenticator app: returns the shared secret and its provisioning URI to render as a QR code. '\n + 'Enrolment is not finished until Confirm TOTP enrolment proves the caller can produce a code from it.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The secret and provisioning URI to show the caller.'),\n },\n [ManualControllerRouteKey.AUTH_MFA_TOTP_VERIFY_SETUP]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Confirm TOTP enrolment',\n description:\n 'Completes enrolment by presenting a code generated from the secret just issued. Only after this does TOTP count as an '\n + 'available method — enrolling without confirming would lock the caller out of their own second factor.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('TOTP is enrolled and usable.'),\n },\n [ManualControllerRouteKey.AUTH_MFA_TOTP_VERIFY]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Verify a TOTP code',\n description:\n 'Presents a code from the enrolled authenticator app for an authentication session waiting on that factor. When it is '\n + 'the last factor owed, the answer carries the access token.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The code and the in-progress session are the proof.',\n successStatus: ok('The factor is satisfied; an access token when nothing else is owed.'),\n },\n [ManualControllerRouteKey.AUTH_MFA_TOTP_DISABLE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Disable TOTP',\n description:\n 'Removes the enrolled authenticator app. Removing a second factor is a sensitive operation, so it requires a fresh '\n + 're-authentication proof obtained from Re-authenticate.',\n authentication: BEARER,\n authenticationSummary: 'A bearer access token plus a fresh re-authentication token.',\n successStatus: ok('TOTP is no longer enrolled.'),\n },\n [ManualControllerRouteKey.AUTH_SMS_OTP_SEND]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Send an SMS one-time code',\n description:\n 'Texts a one-time code to the account\\'s verified phone number. Present the code at Authenticate with any method, '\n + 'naming the SMS method — this family has no separate verify endpoint.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The in-progress authentication session identifies the caller.',\n successStatus: ok('A code has been sent.'),\n },\n [ManualControllerRouteKey.AUTH_SMS_OTP_VERIFY]: {\n publication: ManualControllerRoutePublication.WITHHELD,\n withheldReason:\n 'Declared in the route registry and mounted by NO controller — measured 2026-09-09 by scanning every '\n + '`this.router.<verb>(…)` call in the engine, where this is the only registry key with no mount. Publishing it would '\n + 'document an address that answers 404. Verification of an SMS code goes through the universal authenticate endpoint.',\n },\n [ManualControllerRouteKey.AUTH_PHONE_VERIFY_SEND]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Send a phone-verification code',\n description:\n 'Texts a code to prove the caller controls a phone number they are adding. Distinct from the SMS second factor: this '\n + 'establishes the number, that one uses it.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('A code has been sent to the number.'),\n },\n [ManualControllerRouteKey.AUTH_PHONE_VERIFY_CONFIRM]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Confirm a phone-verification code',\n description: 'Presents the texted code and marks the phone number verified on the caller\\'s account.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The number is verified.'),\n },\n [ManualControllerRouteKey.AUTH_MAGIC_LINK_SEND]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Send a magic link',\n description:\n 'Emails a single-use sign-in link. Answers identically whether or not the address has an active account, so it cannot '\n + 'be used to discover who does.',\n authentication: PUBLIC,\n authenticationSummary: NO_CREDENTIAL,\n successStatus: ok('The request was accepted; a link is sent if the address has an active account.'),\n },\n [ManualControllerRouteKey.AUTH_MAGIC_LINK_VERIFY]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Verify a magic link',\n description: 'Consumes the token from a magic link and signs the caller in. Single-use: a replayed token fails.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The single-use link token is the proof.',\n successStatus: ok('An access token and the caller\\'s session.'),\n },\n\n // ─── Passkeys (WebAuthn) ─────────────────────────────────────────────────────────────────────\n [ManualControllerRouteKey.AUTH_PASSKEY_REGISTER_OPTIONS]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Begin passkey registration',\n description:\n 'Returns the WebAuthn creation options — challenge, relying party, excluded credentials — to hand to '\n + '`navigator.credentials.create()`. WebAuthn is challenge-response, which is why registering a passkey takes two calls.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('WebAuthn creation options for the browser.'),\n },\n [ManualControllerRouteKey.AUTH_PASSKEY_REGISTER_VERIFY]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Complete passkey registration',\n description: 'Presents the attestation the authenticator produced and stores the passkey against the caller\\'s account.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The passkey is registered.'),\n },\n [ManualControllerRouteKey.AUTH_PASSKEY_AUTH_OPTIONS]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Begin passkey authentication',\n description:\n 'Returns `{ sessionId, options, expiresInSeconds }`: the WebAuthn request options to hand to '\n + '`navigator.credentials.get()`, the authentication session their challenge is bound to, and how long that '\n + 'challenge can still be redeemed — a waiting autofill request should be restarted before then. Without a `sessionId` it opens a sign-in '\n + 'before any email is known (passkey autofill, or a sign-in-with-a-passkey button). For a sign-in the '\n + 'options list no credentials, so the device offers every account the person holds for this site and '\n + 'the answer is the same whatever email was entered; for a second factor they list the signed-in '\n + 'account\\'s own passkeys.',\n authentication: PUBLIC,\n authenticationSummary: NO_CREDENTIAL,\n successStatus: ok('WebAuthn request options for the browser.'),\n },\n [ManualControllerRouteKey.AUTH_PASSKEY_AUTH_VERIFY]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Complete passkey authentication',\n description:\n 'Presents the assertion the authenticator produced, with the `sessionId` its options were issued for. '\n + 'The account is the one the passkey belongs to, whatever email was entered. On success the answer '\n + 'carries the access token; `passkeyCredentialUnknown` marks a passkey this application no longer holds.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The WebAuthn assertion is the proof.',\n successStatus: ok('An access token and the caller\\'s session.'),\n },\n [ManualControllerRouteKey.AUTH_PASSKEY_LIST]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET],\n summary: 'List my passkeys',\n description: 'Every passkey registered on the caller\\'s account, with the name and last-used time to show in a manager UI.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The caller\\'s registered passkeys.'),\n },\n [ManualControllerRouteKey.AUTH_PASSKEY_REMOVE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Remove a passkey',\n description:\n 'Deletes one registered passkey. Removing an authentication method is sensitive, so it requires a fresh '\n + 're-authentication proof.',\n authentication: BEARER,\n authenticationSummary: 'A bearer access token plus a fresh re-authentication token.',\n successStatus: ok('The passkey is removed.'),\n },\n [ManualControllerRouteKey.AUTH_PASSKEY_RENAME]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Rename a passkey',\n description: 'Changes the label a passkey is shown under. Cosmetic: it does not affect what the passkey can do.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The passkey\\'s label is changed.'),\n },\n\n // ─── Managing my authentication methods ──────────────────────────────────────────────────────\n [ManualControllerRouteKey.AUTH_METHODS_MINE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET],\n summary: 'List my enrolled authentication methods',\n description:\n 'Which methods the signed-in caller has actually enrolled — password, TOTP, passkeys, linked identities — for a '\n + '\"security settings\" screen. Distinct from Identify a caller, which answers the same question before sign-in and '\n + 'says less on purpose.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The caller\\'s enrolled methods.'),\n },\n [ManualControllerRouteKey.AUTH_PASSWORD_CHANGE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Change my password',\n description:\n 'Replaces the caller\\'s password, presenting the current one. Refresh tokens are invalidated, so other sessions cannot '\n + 'outlive the change.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The password is changed and other sessions are invalidated.'),\n },\n [ManualControllerRouteKey.AUTH_PASSWORD_SET]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Set my first password',\n description:\n 'Adds a password to an account that has never had one — somebody who signed up through a vendor identity or a magic '\n + 'link. There is no current password to present, so a fresh re-authentication proof takes its place.',\n authentication: BEARER,\n authenticationSummary: 'A bearer access token plus a fresh re-authentication token.',\n successStatus: ok('A password is set on the account.'),\n },\n [ManualControllerRouteKey.AUTH_IDENTITY_LINKS_LIST]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET],\n summary: 'List my linked identities',\n description: 'The external identity providers linked to the caller\\'s account, and which one each sign-in came through.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The caller\\'s linked identities.'),\n },\n [ManualControllerRouteKey.AUTH_IDENTITY_LINKS_UNLINK]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.DELETE],\n summary: 'Unlink an identity',\n description:\n 'Removes one linked external identity. Refused when it is the caller\\'s only way in, so unlinking cannot lock somebody '\n + 'out of their own account.',\n authentication: BEARER,\n authenticationSummary: 'A bearer access token plus a fresh re-authentication token.',\n successStatus: ok('The identity is unlinked.'),\n },\n [ManualControllerRouteKey.GOVERNED_DOCUMENT_ACCEPTANCES_OWED]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.GET],\n summary: 'List the documents I owe an acceptance of',\n description:\n 'The governed documents in force that the caller has never accepted, or that changed materially since they last '\n + 'did — each with every in-force variant (one per locale and jurisdiction). Empty for an application that asks '\n + 'for no acceptance.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The documents the caller owes an acceptance of.'),\n },\n [ManualControllerRouteKey.GOVERNED_DOCUMENT_ACCEPTANCES_ACCEPT]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.POST],\n summary: 'Accept governed documents',\n description:\n 'Records that the caller accepted the named in-force releases. Only release IDS are sent: which version, which '\n + 'document and how the application asked are all read from the application\\'s own configuration, so a caller '\n + 'cannot choose the terms they are recorded as having agreed to. An id naming nothing in force is ignored.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The acceptances are recorded; the response lists what is still owed.'),\n },\n [ManualControllerRouteKey.GOVERNED_DOCUMENT_NOTICE_DELIVERED]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.POST],\n summary: 'Record that a governed document was delivered to me',\n description:\n 'Records that the caller was shown the named governed document. Only the document REF is sent: the exact release '\n + 'version in force is resolved from the application\\'s own configuration, never from the request. A document '\n + 'whose in-force release does not permit recording a delivery is silently a no-op.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The delivery is recorded, or silently skipped when nothing in force permits it.'),\n },\n [ManualControllerRouteKey.AUTH_REAUTH]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Re-authenticate for a sensitive operation',\n description:\n 'Proves the person at the keyboard is still the account holder, and returns the single-use step-up token that sensitive '\n + 'operations require in their step-up header. This is the endpoint those operations point at. `purpose` says what the '\n + 'proof is for: `step_up` (the default) must use a factor the account\\'s step-up policy accepts; `bind_authenticator`, '\n + 'asked for when adding a way to sign in, accepts any factor the account holds and is accepted only by those doors.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('A single-use step-up token.'),\n },\n [ManualControllerRouteKey.AUTH_REAUTH_PASSKEY_OPTIONS]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Begin a passkey step-up',\n description:\n 'The challenge leg of re-authenticating with a passkey. WebAuthn is challenge-response, so a passkey step-up needs two '\n + 'round-trips: take these options to the authenticator, then present the assertion at Re-authenticate.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('WebAuthn request options for the step-up.'),\n },\n [ManualControllerRouteKey.AUTH_REAUTH_METHODS]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET],\n summary: 'List the factors that can re-authenticate you',\n description:\n 'Which of the signed-in person\\'s own factors can produce a re-authentication proof for the given `purpose`, strongest '\n + 'first. For `step_up`, only factors the account\\'s step-up policy accepts are listed; for `bind_authenticator` (adding a '\n + 'way to sign in), every factor the account holds is. Also lists the linked identities whose provider can '\n + 're-authenticate the person (`identityLinks`). Both empty means the account must add an accepted factor first.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The factors, strongest first, and the re-provable linked identities.'),\n },\n [ManualControllerRouteKey.AUTH_REAUTH_FEDERATED_AUTHORIZE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Re-authenticate through a linked identity provider',\n description:\n 'Starts a re-authentication at the identity provider behind one of the signed-in person\\'s own linked accounts, for the '\n + 'given `purpose`. Answers the provider URL to open (in a popup). The provider is asked to sign the person in afresh '\n + '(OIDC `prompt=login` + `max_age=0`, SAML `ForceAuthn`), and the proof is minted only if its signed answer (the ID '\n + 'token\\'s `auth_time`, or the assertion\\'s `AuthnInstant`) shows a sign-in newer than this request. Refused for a link whose '\n + 'provider or connection has not enabled re-authentication.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The identity provider URL to open.'),\n },\n [ManualControllerRouteKey.AUTH_REAUTH_FEDERATED_EXCHANGE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Redeem a federated re-authentication',\n description:\n 'Exchanges the one-time code a federated re-authentication returned for its single-use re-authentication token. The code '\n + 'is redeemable only by the account it was minted for, with that account\\'s own bearer.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('A single-use re-authentication token.'),\n },\n\n // ─── Signing in through somebody else's identity provider ────────────────────────────────────\n [ManualControllerRouteKey.AUTH_OAUTH2_AUTHORIZE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET],\n summary: 'Start a social sign-in',\n description:\n 'Returns the vendor authorization URL to send the browser to, for the named provider. The client navigates there; the '\n + 'vendor sends the person back to the callback below. Returns a URL rather than redirecting, so the client controls '\n + 'the navigation.',\n authentication: PUBLIC,\n authenticationSummary: NO_CREDENTIAL,\n successStatus: ok('The provider authorization URL to navigate to.'),\n },\n [ManualControllerRouteKey.AUTH_OAUTH2_CALLBACK]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET, HttpMethod.POST],\n summary: 'Social sign-in callback',\n description:\n 'Where the identity provider sends the browser back. You do not call this — it is the redirect URI you register '\n + 'with the vendor, published here so you can configure it. Accepts POST as well as GET because some vendors use '\n + '`response_mode=form_post`. It completes the sign-in and hands the client a one-time code to exchange for tokens.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The provider\\'s authorization code and the state parameter are the proof.',\n successStatus: ok('The caller is redirected onward with a one-time exchange code.'),\n },\n [ManualControllerRouteKey.AUTH_TOKEN_EXCHANGE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Exchange a one-time code for tokens or the onboarding step',\n description:\n 'Turns the single-use code a redirect flow handed back into the access token and session. Single-use: the code is '\n + 'consumed, so it cannot be replayed if it leaks into a browser history or a referrer header. When the account '\n + 'still has to name its organization, the answer is instead the onboarding step and the session to complete it '\n + 'with — no token and no session cookie until the organization is named.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The single-use code is the proof.',\n successStatus: ok('An access token and the caller\\'s session, or the organization-onboarding step still owed.'),\n },\n [ManualControllerRouteKey.AUTH_ENTERPRISE_SSO_AUTHORIZE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET],\n summary: 'Start an organization SSO sign-in',\n description:\n 'Begins sign-in through one organization\\'s own OpenID Connect connection, addressed by that organization and the '\n + 'connection it configured. Answers with the authorization URL to navigate to.',\n authentication: PUBLIC,\n authenticationSummary: NO_CREDENTIAL,\n successStatus: ok('The connection\\'s authorization URL to navigate to.'),\n },\n [ManualControllerRouteKey.AUTH_APP_ENTERPRISE_AUTHORIZE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET],\n summary: 'Start an application-wide SSO sign-in',\n description:\n 'The same as the organization flow, for a connection the APPLICATION owns rather than one tenant — the shape used when '\n + 'every user signs in through one corporate identity provider.',\n authentication: PUBLIC,\n authenticationSummary: NO_CREDENTIAL,\n successStatus: ok('The connection\\'s authorization URL to navigate to.'),\n },\n [ManualControllerRouteKey.AUTH_SAML_LOGIN]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET],\n summary: 'Start a SAML sign-in',\n description:\n 'Service-provider-initiated SAML: builds the authentication request for the named connection and sends the browser to '\n + 'that identity provider.',\n authentication: PUBLIC,\n authenticationSummary: NO_CREDENTIAL,\n successStatus: { code: '302', meaning: 'The browser is redirected to the identity provider.' },\n },\n [ManualControllerRouteKey.AUTH_SAML_ACS]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'SAML assertion consumer service',\n description:\n 'Where a SAML identity provider posts its assertion. You do not call this — it is the ACS URL you configure in the '\n + 'identity provider, published here so an administrator can find it. The assertion\\'s signature is validated before '\n + 'anything in it is believed.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The signed SAML assertion is the proof.',\n successStatus: { code: '302', meaning: 'The assertion is accepted and the browser continues into the application.' },\n },\n [ManualControllerRouteKey.AUTH_SAML_METADATA]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET],\n summary: 'SAML service-provider metadata',\n description:\n 'The SAML metadata document for one scope — entity id, ACS URL, certificates — to upload into an identity provider. '\n + 'Addressed by the scope kind and its identifier, because an application-wide connection and a per-organization one '\n + 'are different service providers.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. Service-provider metadata is public by design.',\n successStatus: ok('The SAML metadata XML document.'),\n },\n [ManualControllerRouteKey.AUTH_SAML_SLO]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.GET, HttpMethod.POST],\n summary: 'SAML single-logout endpoint',\n description:\n 'Where an identity provider sends logout requests and responses. Inbound — the identity provider calls it. Accepts '\n + 'GET for the redirect binding and POST for the POST binding. To START a logout from this application, use End my '\n + 'SAML session instead.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The signed SAML logout message is the proof.',\n successStatus: { code: '302', meaning: 'The session is ended and the browser continues.' },\n },\n [ManualControllerRouteKey.AUTH_SAML_SP_LOGOUT]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'End my SAML session',\n description:\n 'Service-provider-initiated single logout: ends the caller\\'s session here and, when the identity provider supports it, '\n + 'hands back where to redirect so the identity-provider session ends too. The outbound counterpart of the SLO endpoint '\n + 'above.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The session is ended, with the identity provider\\'s logout location when there is one.'),\n },\n\n [ManualControllerRouteKey.AUTH_OIDC_LOGOUT]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'End my enterprise OIDC session',\n description:\n 'Ends the caller\\'s session here and, when the connection is configured for it, hands back where to redirect so the '\n + 'identity-provider session ends too. Without this a person who signs out is still signed in at their provider, so the '\n + 'next sign-in is silent. The OIDC counterpart of End my SAML session.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The session is ended, with the identity provider\\'s logout location when the connection has one.'),\n },\n\n // ─── Sessions that cross a boundary ──────────────────────────────────────────────────────────\n [ManualControllerRouteKey.AUTH_CROSS_FRONTEND_HANDOFF]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Hand a session to another frontend',\n description:\n 'Issues a one-time code bound to a named frontend of this application, so a signed-in person can be moved to it without '\n + 'signing in again. The target exchanges the code at Exchange a one-time code for tokens.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('A one-time code bound to the target frontend.'),\n },\n [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_CREATE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Mint a one-off session token',\n description:\n 'Creates a single-purpose token that grants a named user a bounded session in an application — for a deep link into a '\n + 'specific screen, or a machine acting on somebody\\'s behalf for one task. The lifetime, the number of uses and the '\n + 'moment of consumption are all stated when it is minted.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: { code: '201', meaning: 'The one-off token and the terms it was minted under.' },\n },\n [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_CREATE_ORG]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Mint a one-off session token within an organization',\n description:\n 'The same as minting a one-off session token, addressed within one organization so the resulting session is scoped to '\n + 'that tenant.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: { code: '201', meaning: 'The one-off token and the terms it was minted under.' },\n },\n [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_EXCHANGE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Exchange a one-off session token',\n description: 'Turns a one-off session token into the session it was minted for. The token is consumed on the terms it carries.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The one-off token is the proof.',\n successStatus: ok('An access token and the bounded session.'),\n },\n [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_REVOKE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Revoke a one-off session token',\n description:\n 'Cancels a minted one-off token before it is used, addressed by its id — never by its value, so revoking never requires '\n + 'handling the secret again.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The token can no longer be exchanged.'),\n },\n [ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_REVOKE_ORG]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AUTH,\n methods: [HttpMethod.POST],\n summary: 'Revoke a one-off session token within an organization',\n description: 'The same revocation, addressed within the organization the token was minted in.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The token can no longer be exchanged.'),\n },\n\n // ─── This application as an OAuth 2.0 / OpenID Connect provider ──────────────────────────────\n [ManualControllerRouteKey.OAUTH_PROVIDER_DISCOVERY]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: IDP,\n methods: [HttpMethod.GET],\n summary: 'OpenID Connect discovery document',\n description:\n 'The provider metadata an OpenID Connect client reads first: the issuer, every endpoint below, the signing keys\\' '\n + 'location and the grants supported. OIDC Discovery locates it by appending the well-known path to the issuer, which '\n + 'is why it sits under the API mount. The same document is served at the RFC 8414 location as well, because that '\n + 'specification builds the address the other way round.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. Provider metadata is public and cross-origin readable by design.',\n successStatus: ok('The provider metadata document.'),\n },\n [ManualControllerRouteKey.OAUTH_PROVIDER_AS_METADATA]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: IDP,\n methods: [HttpMethod.GET],\n summary: 'OAuth 2.0 authorization-server metadata',\n description:\n 'The SAME document as the OpenID Connect discovery document, at the address RFC 8414 clients derive — many OAuth and '\n + 'MCP clients probe this one first. It is a second location, not a second contract. Note that the framework also '\n + 'serves it above the API mount, with the well-known segment inserted between the host and the issuer path, which is '\n + 'the construction the RFC actually specifies.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. Provider metadata is public and cross-origin readable by design.',\n successStatus: ok('The provider metadata document.'),\n },\n [ManualControllerRouteKey.OAUTH_PROVIDER_JWKS]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: IDP,\n methods: [HttpMethod.GET],\n summary: 'JSON Web Key Set',\n description:\n 'The public keys that verify tokens this application issues — the `jwks_uri` the discovery document points at. Fetch it '\n + 'rather than pinning a key: keys rotate, and a client that caches the set and re-fetches on an unknown key id keeps '\n + 'working across a rotation.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. Public keys are public.',\n successStatus: ok('The key set.'),\n },\n [ManualControllerRouteKey.OAUTH_PROVIDER_AUTHORIZE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: IDP,\n methods: [HttpMethod.GET],\n summary: 'Authorization endpoint',\n description:\n 'Where a client sends a person to approve delegated access, for the authorization-code flow. When the client is one '\n + 'that requires explicit consent and none has been given, the answer says consent is required rather than issuing a '\n + 'code; the decision is then posted to the consent endpoint.',\n authentication: PUBLIC,\n authenticationSummary: 'No client credential. The person\\'s own session establishes who is consenting.',\n successStatus: { code: '302', meaning: 'The browser is redirected back to the client with an authorization code.' },\n },\n [ManualControllerRouteKey.OAUTH_PROVIDER_CONSENT]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: IDP,\n methods: [HttpMethod.POST],\n summary: 'Record a consent decision',\n description:\n 'The approve-or-deny answer to a consent prompt the authorization endpoint raised, presenting the single-use '\n + 'consent-request token it issued. Approving is what mints the authorization code.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The single-use consent-request token authorizes the decision.',\n successStatus: ok('The decision is recorded, with the authorization code when it was an approval.'),\n },\n [ManualControllerRouteKey.OAUTH_PROVIDER_TOKEN]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: IDP,\n methods: [HttpMethod.POST],\n summary: 'Token endpoint',\n description:\n 'Where a client obtains an access token: `client_credentials` for software acting as itself, `authorization_code` for '\n + 'software acting on a person\\'s behalf. Request the audience you intend to call — a token minted for the general API '\n + 'is not accepted at the Model Context Protocol surface, and the reverse.',\n authentication: PUBLIC,\n authenticationSummary: 'No bearer token. The client authenticates with its own client credentials.',\n successStatus: ok('An access token, its lifetime and its audience.'),\n },\n [ManualControllerRouteKey.OAUTH_PROVIDER_USERINFO]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: IDP,\n methods: [HttpMethod.GET],\n summary: 'UserInfo endpoint',\n description: 'The standard OpenID Connect claims for the person a delegated access token was issued on behalf of.',\n authentication: BEARER,\n authenticationSummary: 'A bearer access token issued by this provider.',\n successStatus: ok('The subject\\'s claims.'),\n },\n [ManualControllerRouteKey.OAUTH_PROVIDER_REVOKE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: IDP,\n methods: [HttpMethod.POST],\n summary: 'Revoke a token',\n description:\n 'RFC 7009 revocation: the presented token stops working. Kills a TOKEN — to end the login SESSION a delegation was '\n + 'authorized from, use the end-session endpoint instead.',\n authentication: PUBLIC,\n authenticationSummary: 'No bearer token. The client authenticates with its own client credentials.',\n successStatus: ok('The token is revoked. Answers the same way for a token that was already invalid.'),\n },\n [ManualControllerRouteKey.OAUTH_PROVIDER_END_SESSION]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: IDP,\n methods: [HttpMethod.GET],\n summary: 'End-session endpoint',\n description:\n 'OpenID Connect RP-Initiated Logout: a relying party sends the person here, with an id-token hint, to end the provider '\n + 'session their delegation was authorized from. A trusted relying party is logged out and redirected inline; anybody '\n + 'else is shown a confirmation prompt, whose answer goes to the confirmation endpoint.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The id-token hint names the session to end.',\n successStatus: { code: '302', meaning: 'The session is ended, or the browser is sent to the confirmation prompt.' },\n },\n [ManualControllerRouteKey.OAUTH_PROVIDER_END_SESSION_CONFIRM]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: IDP,\n methods: [HttpMethod.POST],\n summary: 'Confirm an end-session request',\n description:\n 'The person\\'s answer to the logout confirmation prompt, presenting the single-use token the end-session endpoint '\n + 'minted. Deliberately not bearer-authenticated: somebody arriving from a relying party\\'s redirect may have no '\n + 'session in this application\\'s own frontend.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The single-use confirmation token authorizes the decision.',\n successStatus: ok('Where to send the browser once the session is ended.'),\n },\n [ManualControllerRouteKey.OAUTH_PROVIDER_REGISTER]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: IDP,\n methods: [HttpMethod.POST],\n summary: 'Register a client dynamically',\n description:\n 'RFC 7591 dynamic client registration: software registers itself and receives its client credentials plus a registration '\n + 'access token for managing that registration afterwards. The route always exists; it answers `404` unless this '\n + 'application has opted into dynamic registration, so a client can probe it safely.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential, when the application allows dynamic registration.',\n successStatus: { code: '201', meaning: 'The registration, its client credentials and its registration access token.' },\n },\n [ManualControllerRouteKey.OAUTH_PROVIDER_REGISTER_CLIENT]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: IDP,\n methods: [HttpMethod.GET, HttpMethod.PUT, HttpMethod.DELETE],\n summary: 'Manage a dynamically registered client',\n description:\n 'RFC 7592 client configuration: a dynamically registered client reads, replaces or deletes its OWN registration. One '\n + 'address, three methods, because the specification defines one endpoint whose method selects the operation. Answers '\n + '`404` unless this application has opted into dynamic registration.',\n authentication: BEARER,\n authenticationSummary: 'The registration access token issued when the client registered — not a user access token.',\n successStatus: ok('The registration, after the requested read, replacement or deletion.'),\n },\n\n // ─── Connecting a third-party account ────────────────────────────────────────────────────────\n [ManualControllerRouteKey.PROVIDER_CONNECTION_START]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: CONNECTIONS,\n methods: [HttpMethod.POST],\n summary: 'Start connecting a third-party account',\n description:\n 'Begins an outbound connection so this application can later act as the connected account. The path names a '\n + 'provider ref, and the grant belongs to that ref\\u2019s CONNECTION: a ref the application declares as a member of a '\n + 'shared connection (`providers.sharedConnections`) connects the one connection its base ref owns, so connecting '\n + 'through any member and through the base produce the same single grant. With `addScopes` it grows the stored '\n + 'connection instead of connecting afresh. The opposite direction from social sign-in, which uses a vendor to '\n + 'identify a person. An application that declares no connectable provider answers with a \"not connectable\" error '\n + 'rather than a missing route, which names why.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The provider authorization URL to navigate to.'),\n },\n [ManualControllerRouteKey.PROVIDER_CONNECTION_CALLBACK]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: CONNECTIONS,\n methods: [HttpMethod.GET],\n summary: 'Third-party connection callback',\n description:\n 'Where a provider returns after the person authorizes the connection. You do not call '\n + 'this — it is the redirect URI to register with the vendor. ONE address serves every provider, keyed by the state '\n + 'parameter, because a redirect URI must be registered before it is accepted and a path per provider would mean '\n + 'registering one per vendor, per environment, by hand. It authenticates nobody and exchanges nothing: a redirect '\n + 'carries no bearer token, so it hands the approval back to the application, which finishes it as the signed-in person.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The single-use state parameter identifies the attempt and defends against CSRF.',\n successStatus: { code: '302', meaning: 'The browser continues into the application, carrying the approval for it to finish.' },\n },\n [ManualControllerRouteKey.PROVIDER_CONNECTION_COMPLETE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: CONNECTIONS,\n methods: [HttpMethod.POST],\n summary: 'Finish a connection the provider has approved',\n description:\n 'Exchanges an approval the vendor just granted for a stored grant. The application calls this on the person\\u2019s behalf '\n + 'when they return from the vendor; the callback cannot, because a redirect carries no credential and so cannot tell '\n + 'who is finishing the flow. The attempt is consumed here, once and atomically, and is only completed for the same '\n + 'person who began it \\u2014 so an approval somebody else obtained cannot be redeemed against their target.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The connection outcome, and the provider it was stored for.'),\n },\n [ManualControllerRouteKey.PROVIDER_CONNECTION_STORE_CREDENTIAL]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: CONNECTIONS,\n methods: [HttpMethod.POST],\n summary: 'Store a typed credential for a provider',\n description:\n 'For a vendor whose credential is TYPED rather than granted. Stored under the ref\\u2019s connection, like a granted '\n + 'one. Takes one value per slot the provider declares as '\n + 'identifying an account, and refuses any name the provider did not declare — so a caller cannot invent a slot, '\n + 'and cannot write an account token into the slot holding the application\\u2019s own registration. Values are '\n + 'sealed by the write door; the request is the only place they exist in plaintext.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The stored credential ids, one per slot supplied.'),\n },\n [ManualControllerRouteKey.PROVIDER_CONNECTION_CATALOGUE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: CONNECTIONS,\n methods: [HttpMethod.GET],\n summary: 'What can be connected',\n description:\n 'Lists what this application declares as connectable, ONE entry per connection: a shared connection\\u2019s members '\n + 'are folded into its base ref\\u2019s entry, which names every ref it serves in `servesRefs`, and a ref declared in no '\n + 'shared connection is its own connection. Each entry carries the owner scopes it admits and whether it '\n + 'carries an authorization flow. Answers the question the stored-credential list cannot: a person with nothing '\n + 'connected has an empty list and no way to learn what they might connect. Admissibility is a recorded decision per '\n + 'provider, so this reports a decision rather than inspecting a vendor.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The connectable providers, each with its admissible owner scopes.'),\n },\n\n [ManualControllerRouteKey.PROVIDER_CONNECTION_ACCESS_TOKEN]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: CONNECTIONS,\n methods: [HttpMethod.GET],\n summary: 'A short-lived access token for your own connected account',\n description:\n 'Resolves the caller\\u2019s OWN grant for a provider \\u2014 the grant of that ref\\u2019s connection, so a member of a shared '\n + 'connection answers with the one grant its base holds \\u2014 and returns its access token, renewed if the vendor\\u2019s expiry '\n + 'has passed \\u2014 the one credential a browser may be handed, because a vendor\\u2019s own picker authorizes as the '\n + 'signed-in user and cannot open without it. Never the refresh token; never another owner\\u2019s account. Each '\n + 'hand-out is recorded as a USE of the credential, so revoking or erasing the connection is visible against '\n + 'every token that left the process. Answers 404 when nothing is connected, so a surface can offer the connection '\n + 'rather than open a picker on nobody\\u2019s files.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The access token, with its expiry and granted scopes when the vendor stated them.'),\n },\n [ManualControllerRouteKey.PROVIDER_CONNECTION_LIST]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: CONNECTIONS,\n methods: [HttpMethod.GET],\n summary: 'The connections an owner holds',\n description:\n 'One entry per CONNECTION the owner (`ownerScope` = USER for the caller\\u2019s own, ORGANIZATION with `ownerId` for a '\n + 'tenant the caller administers) has stored a credential under \\u2014 never one per provider ref, because several refs '\n + 'of one vendor share one grant. Each entry names the refs the connection serves, the scopes its consent has '\n + 'accumulated (read from the sealed grant; no token is returned), its validation state, and the credential rows it '\n + 'is made of. Disconnecting is the credential resource\\u2019s own DELETE of those rows, which authorizes, may ask '\n + 'for step-up, records who revoked, and withdraws the grant at a vendor that accepts a withdrawal. An organization\\u2019s '\n + 'connections are listed only for a caller holding the role the organization credential list itself requires.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The owner\\u2019s connections, one entry each.'),\n },\n [ManualControllerRouteKey.PROVIDER_OPERATION_EXECUTE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: CONNECTIONS,\n methods: [HttpMethod.POST],\n summary: 'Run a provider operation this application lets your browser trigger',\n description:\n 'Executes one operation of a connected third-party provider on the server and returns its parsed output. The '\n + 'credential never reaches the browser: the body names whose account to spend (`connection`, defaulting to the '\n + 'application\\u2019s own), an optional catalogue `domain`, and the operation `input`. Only operations the '\n + 'application declared browser-reachable can run, for the connections and roles it declared; anything else '\n + 'answers 403 and the refusal is recorded. Every executed call is recorded too, successful or not, against the '\n + 'person who asked.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The provider\\u2019s HTTP status and the operation\\u2019s output, parsed through its declared schema.'),\n },\n [ManualControllerRouteKey.PROVIDER_OPERATION_INPUT_OPTIONS]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: CONNECTIONS,\n methods: [HttpMethod.POST],\n summary: 'List the choices for one input of a provider operation',\n description:\n 'Lists the values a person may pick for one input of a browser-reachable provider operation \\u2014 a workspace, a '\n + 'project \\u2014 by running the input\\u2019s declared options operation on the server, through the connection named in '\n + 'the body. The list is exactly what that account can see, and the credential never reaches the browser. Both the '\n + 'operation and its options operation must be declared browser-reachable for that connection; otherwise the answer is '\n + '403 and the refusal is recorded. A choice the list depends on must be passed in `input`: without it the answer is '\n + '400 naming it, rather than an empty list.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The options operation that answered, and each choice as a value and the vendor\\u2019s own label.'),\n },\n\n // ─── Agent interfaces ────────────────────────────────────────────────────────────────────────\n [ManualControllerRouteKey.MCP_ENDPOINT]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AGENTS,\n methods: [HttpMethod.POST, HttpMethod.GET, HttpMethod.DELETE],\n summary: 'Model Context Protocol endpoint',\n description:\n 'The JSON-RPC 2.0 endpoint an MCP client talks to over the Streamable HTTP transport: `initialize`, `tools/list` and '\n + '`tools/call`. Only POST does work. GET and DELETE answer `405` with `Allow: POST` on purpose — this server offers no '\n + 'server-initiated stream and has no protocol-level sessions to end, and a bare `404` would make an older client '\n + 'conclude there is no MCP endpoint here and fall back to a retired transport. A call must present an access token '\n + 'bound to this surface\\'s own audience; a token minted for the general API is refused. Named server instances are '\n + 'served under this path with the instance reference appended, each with its own audience and its own tool catalogue.',\n authentication: BEARER,\n authenticationSummary: 'A bearer access token whose audience is this Model Context Protocol surface.',\n successStatus: ok('The JSON-RPC response for the method that was called.'),\n },\n [ManualControllerRouteKey.MCP_PROTECTED_RESOURCE_METADATA]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AGENTS,\n methods: [HttpMethod.GET],\n summary: 'Model Context Protocol protected-resource metadata',\n description:\n 'RFC 9728 metadata: the resource identifier this surface expects a token to be bound to, and the authorization servers '\n + 'that can issue one. An MCP client that receives `401` reads the location from the challenge header and fetches this '\n + 'to learn where to get a token. Each named server instance publishes its own copy under its own path, so every '\n + 'instance advertises its own audience.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. Discovery metadata is public and cross-origin readable by design.',\n successStatus: ok('The protected-resource metadata document.'),\n },\n [ManualControllerRouteKey.A2A_AGENT_CARD]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AGENTS,\n methods: [HttpMethod.GET],\n summary: 'Agent card',\n description:\n 'The Agent2Agent card describing what this application exposes as agent skills, the task endpoint\\'s address and the '\n + 'security schemes a caller must satisfy. Public metadata, like a discovery document: fetch it before addressing the '\n + 'agent.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The agent card is public and cross-origin readable by design.',\n successStatus: ok('The agent card.'),\n },\n [ManualControllerRouteKey.A2A_TASKS]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: AGENTS,\n methods: [HttpMethod.POST],\n summary: 'Agent2Agent task endpoint',\n description:\n 'The JSON-RPC endpoint that accepts agent messages and tasks, streaming over server-sent events when the caller asks '\n + 'for it. Its absolute URL is the card\\'s advertised address AND the agent\\'s canonical audience: an inbound access '\n + 'token must be bound to it. Named agent instances are served under this path with the instance reference appended.',\n authentication: BEARER,\n authenticationSummary: 'A bearer access token whose audience is this agent endpoint.',\n successStatus: ok('The JSON-RPC response, or an event stream when streaming was requested.'),\n },\n\n // ─── File transfer ───────────────────────────────────────────────────────────────────────────\n [ManualControllerRouteKey.FILES_ITEM]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: FILES,\n methods: [HttpMethod.GET, HttpMethod.DELETE],\n summary: 'Download or delete a stored file',\n description:\n 'GET streams the file\\'s bytes; DELETE removes it. One address, two methods. A file is downloadable only in a status '\n + 'that permits it — one still being scanned, or quarantined, is refused rather than served. Distinct from a resource\\'s '\n + 'own file routes, which address the file bound to one field of one record.',\n authentication: BEARER,\n authenticationSummary: 'A bearer access token, or the consumable token a share link carries.',\n successStatus: ok('The file\\'s bytes, or confirmation that it was deleted.'),\n },\n [ManualControllerRouteKey.FILES_METADATA]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: FILES,\n methods: [HttpMethod.GET],\n summary: 'Read a stored file\\'s metadata',\n description:\n 'Name, size, content type and status, without transferring the bytes. Metadata is withheld for statuses where saying '\n + 'anything about the file would be wrong.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The file\\'s metadata record.'),\n },\n [ManualControllerRouteKey.FILES_SHARE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: FILES,\n methods: [HttpMethod.POST],\n summary: 'Create a share link for a stored file',\n description:\n 'Mints a time-limited link that lets somebody without an account download this one file. The link carries a consumable '\n + 'token whose lifetime is stated when it is minted.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: { code: '201', meaning: 'The share link and when it expires.' },\n },\n [ManualControllerRouteKey.FILES_SHARES_REVOKE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: FILES,\n methods: [HttpMethod.DELETE],\n summary: 'Revoke every share link of a stored file',\n description:\n 'Stops sharing this file: every link minted for it that is still live stops working at once, whoever minted it. '\n + 'Anyone who may create a share link for the file may revoke them. Idempotent: with no live link it answers a count of zero.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('How many live share links were revoked.'),\n },\n [ManualControllerRouteKey.FILES_UPLOAD_GRANT_STATUS]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: FILES,\n methods: [HttpMethod.GET],\n summary: 'Read the status of an upload grant',\n description:\n 'Where an upload grant has got to, addressed by the grant token itself. Public because the token IS the credential: the '\n + 'page somebody drops a file onto has no session of its own.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. The grant token in the address is what authorizes the read.',\n successStatus: ok('The grant\\'s state and what it still allows.'),\n },\n [ManualControllerRouteKey.FILES_UPLOAD_GRANT_REVOKE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: FILES,\n methods: [HttpMethod.DELETE],\n summary: 'Revoke an upload grant',\n description:\n 'Cancels an upload grant before it is used. Addressed by the grant\\'s id, never by its token value, so revoking never '\n + 'requires handling the secret. Only the grant\\'s minter, or a super-administrator, may revoke it.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The grant can no longer be used.'),\n },\n\n // ─── What this application currently offers ──────────────────────────────────────────────────\n [ManualControllerRouteKey.I18N_GET_LABELS]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.GET],\n summary: 'Read translated labels',\n description:\n 'The label bundle for a locale — every piece of display text this application has authored. A client renders from this '\n + 'rather than inventing text from field names; a label that is missing is meant to look missing.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. Labels are needed before anybody has signed in.',\n successStatus: ok('The label bundle for the requested locale.'),\n },\n [ManualControllerRouteKey.FEATURES_RESOLVED]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.GET],\n summary: 'Read the caller\\'s resolved features',\n description:\n 'Which features are actually on for this caller, after the application\\'s declarations, their organization\\'s plan and '\n + 'any per-caller overrides have all been applied. This is the resolved answer — do not re-derive it client-side from '\n + 'the plan.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The caller\\'s resolved feature set.'),\n },\n [ManualControllerRouteKey.SUBMISSION_CHALLENGE_PROOF_OF_WORK]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.GET],\n summary: 'Get a proof-of-work challenge for a public submission',\n description:\n 'A signed, expiring SHA-256 puzzle. When the application protects a public form (the contact form) with a captcha, a '\n + 'submission must carry an answer in the `x-submission-challenge-response` header: either a token from the consented '\n + 'captcha vendor, or the solution to this challenge. Find the number whose SHA-256 of `salt + number` equals '\n + '`challenge`, then send `{\"kind\":\"proof_of_work\",\"challenge\":<this object>,\"number\":<n>}` as that header. A '\n + 'solution is accepted once, before the salt\\'s expiry. Nothing about the caller is stored or sent to a third party.',\n authentication: PUBLIC,\n authenticationSummary: 'No credential. A visitor who has not signed in needs a challenge to submit a public form.',\n successStatus: ok('The challenge: algorithm, salt (carrying its expiry), challenge hash, the largest number to try, and its signature.'),\n },\n [ManualControllerRouteKey.CHARTS_DATA]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.POST],\n summary: 'Run a declared chart and read its data',\n description:\n 'Executes one chart the application has declared, addressed by its reference, and returns the series it produced. POST '\n + 'because the filters, ranges and groupings a chart accepts are a body, not a query string. Only declared charts can '\n + 'be run: this is not a general query endpoint.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The chart\\'s data series.'),\n },\n [ManualControllerRouteKey.SUBJECT_ERASURE_LANE_EVIDENCE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.GET],\n summary: \"Summarize this application's subject-erasure lane over a window\",\n description:\n 'Counts, for a closed window, what the erasure lane did: how many requests arrived and who raised each, how many were '\n + 'withdrawn, how many reached a terminal state, and how many of those are missing the requester, justification or outcome '\n + 'their own record promises. It also reports whether the withdrawal door is reachable to a subject and what schedule drives '\n + 'execution, both read from the lane the application declared. It returns NO row and NO identifier — an evidence reader '\n + 'proving the lane works must not be handed every person who asked to be erased in order to count them. An application that '\n + 'declares no erasure lane is told so explicitly, because a lane with no activity and no lane at all are the same zeroes.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The lane summary, or a statement that no lane is declared.'),\n },\n [ManualControllerRouteKey.PROVIDER_CALL_EVIDENCE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.GET],\n summary: 'Count the model-provider calls this application made over a window',\n description:\n 'Counts, for a closed window, every call the application made to a model provider: grouped by provider, model, kind of call '\n + 'and outcome, with the tokens each group consumed. It also counts the records that are incomplete (no provider, no model, no '\n + 'reported usage) separately, so a gap is visible rather than folded into the total. It returns NO row: the question is about '\n + 'the population of calls, and a record names an agent and an instant an evidence reader has no need to hold.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The provider-call summary for the window.'),\n },\n [ManualControllerRouteKey.MODEL_COST_SUMMARY]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.POST],\n summary: 'Summarize model cost per case, organization, agent or model over a window',\n description:\n 'Totals, for a window, what the application\\'s model calls cost: grouped by case, organization, agent or model, per currency, '\n + 'with the tokens each group consumed and the exact cost rounded up once per total. Calls made outside any unit of work, and '\n + 'calls no registered price covered, are counted apart so a gap is visible rather than folded into a total. A case summary '\n + 'also reports the expert review time recorded on each case, or says that none is recorded. Application administrators only '\n + '(super-administrator or billing manager): it is the application\\'s internal cost data. A window covers at most a year. POST '\n + 'because the case filter is a list of references. To invoice a month, list the model-cost period aggregates instead and link '\n + 'the one the invoice bills.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The model-cost summary for the window.'),\n },\n [ManualControllerRouteKey.AGENT_WORK_OVERRIDE_RATE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.POST],\n summary: 'Report how often experts overrode what an agent proposed, over a window',\n description:\n 'Counts, for a window, the decisions people took on agents\\' proposals, grouped by agent, tool, case or decider: accepted as '\n + 'proposed, accepted after a change, and rejected. The override rate is the changed and rejected decisions over all three. '\n + 'Decisions nobody took (the window lapsed, the work was withdrawn, or the requester lost their access) are counted apart and '\n + 'never enter the rate. It reads the decision records only, never their content. An organization administrator reads their '\n + 'own organization; an application super-administrator may read any, or all. A window covers at most a year.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The override rate per group for the window.'),\n },\n [ManualControllerRouteKey.AGENT_WORK_EVALUATION_EXPORT]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.POST],\n summary: 'Export an organization\\'s decisions on one agent\\'s proposals as an evaluation dataset',\n description:\n 'Exports, for one organization, one agent and a window, the decisions its people took on that agent\\'s proposals, as JSON '\n + 'Lines: one object per decision, with no decider and no organization. The record\\'s own identifiers (the decision, the '\n + 'case, the run, the task, the work product, the decider, the organization) are replaced by pseudonyms wherever they '\n + 'appear, including inside kept content; any other value in the kept proposal or final version is exported as the '\n + 'organization kept it. The proposal and the final version are included only when the organization kept them. Cases the organization walled off '\n + 'are left out, and a case of a privileged kind goes only with its client\\'s recorded consent. The export is refused, and '\n + 'the refusal recorded, unless the organization holds an active export authorisation; every export is recorded on its '\n + 'ledger and in the audit trail. An organization administrator for their own organization, or an application '\n + 'super-administrator.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The dataset, and the id of its ledger entry.'),\n },\n [ManualControllerRouteKey.RETENTION_ENFORCEMENT_EVIDENCE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.GET],\n summary: 'List the retention enforcement records of the sweep runs in a window',\n description:\n 'Returns, for a closed window, every record the retention-class sweep wrote: one per run and per resource bound to a retention '\n + 'class, with the class, the period the run applied, the cutoff, how many rows it deleted and the window of their retention '\n + 'start, how many a legal hold kept, and whether the run completed, deferred work to the next run, failed or skipped the '\n + 'resource. A failed run has a record too. The records hold counts and instants only, so the answer names no person and no '\n + 'deleted row.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The retention enforcement records for the window.'),\n },\n [ManualControllerRouteKey.USAGE_FLUSH_EVIDENCE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.GET],\n summary: 'Count where the metered-usage rows stand with respect to the provider flush',\n description:\n 'Counts every usage row by flush state (pending, reported, unreportable), the unreportable rows by reason, and the '\n + 'contradictions that must never exist: an unreportable row with no reason, one with no decision instant, and one also '\n + 'marked reported. The window adds how many rows were decided unreportable inside it. It returns NO row: a usage row names '\n + 'a customer and a quantity, which an evidence reader has no need to hold. An application with billing off measures no store, '\n + 'and says so.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The usage flush summary.'),\n },\n [ManualControllerRouteKey.SCHEDULED_EVIDENCE_COVERAGE]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.POST],\n summary: 'Assess whether a scheduled run happened as often as it was scheduled to',\n description:\n 'Compares the runs this application retained, and its live job history, against the schedule that was IN FORCE across the period — '\n + 'supplied by the caller as historical segments, each naming the commit that set it. Reports coverage, missing occurrences, duplicate '\n + 'runs, outcomes, unavailable results, deferral and timeliness separately, because a run that happened and failed, one that happened '\n + 'late, and one that never happened are different findings. POST because the schedule basis is a body: the current cron cannot stand in '\n + 'for what the schedule WAS, so a caller that supplies none gets a refusal rather than an assessment against today.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The coverage assessment for one scheduled target over the period.'),\n },\n [ManualControllerRouteKey.FLOWS_ACTORS_FRONTEND_INFO]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.GET],\n summary: 'Read the flow and actor systems a client may render',\n description:\n 'The metadata and renderable graph for every flow or actor system this application exposes to its frontends — what '\n + 'exists, what it is called, and how it is shaped — and the autonomous agents the application declares, by reference '\n + 'and actor system: the only values an organization OAuth client may be bound to.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The visible flow and actor systems, and the declared autonomous agents.'),\n },\n [ManualControllerRouteKey.FLOWS_ACTORS_HISTORY]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.GET, HttpMethod.DELETE],\n summary: 'Read or clear my conversation history',\n description:\n 'GET returns the caller\\'s OWN conversation history with a flow or actor system; DELETE clears a conversation. Scoped to '\n + 'the caller: it is never a window onto somebody else\\'s conversation.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The caller\\'s conversation, or confirmation that it was cleared.'),\n },\n [ManualControllerRouteKey.FLOWS_ACTORS_DECISIONS]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.GET],\n summary: 'List the decisions waiting on me',\n description:\n 'The pending decisions an agent is waiting on that the caller may act on, across every conversation: their own, those '\n + 'assigned to them, and those routed to a role they hold in the decision\\'s organization. Each is a decision card — the '\n + 'call being asked for, its deadline, its route and what the caller may do — and never the conversation behind it. '\n + 'Every row is re-checked against the same rule an act is, so the list never shows a decision the caller could not act on.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The decision cards.'),\n },\n [ManualControllerRouteKey.FLOWS_ACTORS_DECISION_ACT]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.POST],\n summary: 'Answer, reassign, claim, unclaim or escalate a decision',\n description:\n 'Acts on one pending decision. `answer` approves or denies the call, optionally with edited arguments; the work then '\n + 'runs as the person who raised it, with their access as it stands now. `reassign` and `escalate` move it to another '\n + 'person, who must be able to answer it; `claim` takes a role-routed decision for yourself and `unclaim` gives it back. '\n + 'A decision that does not exist, is settled, or is not routed to the caller all answer the same way.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('What the act came to.'),\n },\n [ManualControllerRouteKey.FLOWS_ACTORS_DECISION_CANDIDATES]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.GET],\n summary: 'List who a decision may be moved to',\n description:\n 'The people in the decision\\'s organization who could answer it, for a caller who may reassign or escalate it. Each is '\n + 'checked against the same rule a move is, so choosing one of them is never refused for who they are. A decision the '\n + 'caller may not move answers the same way as one that does not exist.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The people it may be moved to.'),\n },\n [ManualControllerRouteKey.ANALYTICS_EVENTS]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.POST],\n summary: 'Record product-analytics events',\n description:\n 'Ingests a batch of product-analytics events. Mounted only when this application enables product analytics; where it '\n + 'does not, the address does not exist.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The batch was accepted.'),\n },\n [ManualControllerRouteKey.ANALYTICS_MOMENTS_ACHIEVED]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.GET, HttpMethod.POST],\n summary: 'Read or record achieved product moments',\n description:\n 'GET lists the declared moments this caller has reached; POST records that they have reached one. Mounted only when '\n + 'this application enables product analytics.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The caller\\'s achieved moments, or confirmation that one was recorded.'),\n },\n [ManualControllerRouteKey.PROGRESSION_MILESTONES]: {\n publication: ManualControllerRoutePublication.PUBLISHED,\n group: RUNTIME,\n methods: [HttpMethod.GET],\n summary: 'Read the declared progression milestones',\n description:\n 'The milestone definitions this application has declared, for a client rendering onboarding or progress. Mounted only '\n + 'when this application enables product analytics.',\n authentication: BEARER,\n authenticationSummary: BEARER_CREDENTIAL,\n successStatus: ok('The declared milestones.'),\n },\n};\n"]}