As a consequence of the way BackupServiceHTTPEndpoint is defined we can call this function with a blob service endpoint and flow won't complain.
On the other hand makeBlobServiceEndpointURL has the same problem - it probably wasn't noticed since it was defined when blob service was the only service available.

I don't fell strong about requesting changes here since I am not sure how serious it is. However it doesn't look right to me that we are introducing type but the type system is able to detect incorrect usage.

Agree with that - the blob client endpoints were very simple and the introduced type system was more about useful constants than any verification. Even the replacePathParams function is very simple and replaces anything that starts with :.

In the long term, these helpers should be file-private and used only to build higher level APIs like these in D8993-D8996.
For now, I wouldn't block it either because it just works well, and the aforementioned 'higher level APIs' are also introduced.

If we really want to be more strict, we can replace type of endpoint.path from string to union of explicit strings: type BackupServiceEndpointPath = '/backups' | '/backups/:backup_id/user_keys' | ... - this should solve the issue (checked this quickly - flow will complain)

Done!