@fleetless/contracts 1.0.0 → 1.0.2

package/dist/routes.d.ts

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
 /**
  * **The route manifest: every HTTP route the cloud registers, declared once.**
  *
@@ -62,9 +63,9 @@ export interface RouteEntry {
      * It exists because the OpenAPI render marked every request body `required`,
      * which documented a refusal `POST /api/robots/:id/jobs/:slug/cancel` does not
      * make: it parses `request.body ?? {}`, and a bodyless `POST` was every
-     * caller's shape before `job_id` existed. Getting that wrong in the other
-     * direction is what W5's worst bug was — a bodyless `POST` with a JSON
-     * content type rejected outright — so this is a fact worth carrying rather
+     * caller's shape before `job_id` existed. Getting it wrong in the other
+     * direction — a bodyless `POST` with a JSON content type rejected outright —
+     * makes whole routes unreachable, so this is a fact worth carrying rather
      * than a default worth assuming.
      */
     readonly requestOptional?: true;

package/dist/routes.js

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
 import { appListResponse, createAppRequest, createServerKeyResponse, app as appSchema, role, roleListResponse, rolePermissions, serverKeyListResponse, updateAppRequest, } from './apps.js';
 import { alertListResponse, orgAlertsQuery, orgFiringAlertsResponse } from './alerts.js';
 import { asset, assetListResponse, assetSyncRequest, assetSyncResponse, assetSyncStatus, missingAssetQuery } from './assets.js';
@@ -1171,8 +1172,8 @@ export const ROUTES = [
         params: [APP_IDENTIFIER], query: null, request: null, response: null,
         errors: ['not_found', 'unauthorized', 'forbidden'], transport: 'http',
         notes: 'MCP\'s Streamable HTTP gives this path three verbs: `POST` carries JSON-RPC, `GET` opens the server-initiated SSE stream, and `DELETE` ' +
-            'ends a session. This server has no sessions — the argument is in `MCP_PROTOCOL_VERSION`\'s own note, and W8\'s second cloud instance is ' +
-            'where a per-process session map would break — so `GET` and `DELETE` answer `405`, which is what a client is built to fall back from. ' +
+            'ends a session. This server has no sessions — the argument is in `MCP_PROTOCOL_VERSION`\'s own note, and a per-process session map is ' +
+            'what breaks at the second cloud instance — so `GET` and `DELETE` answer `405`, which is what a client is built to fall back from. ' +
             '\n\n**The `405` is this cloud\'s own answer, not the SDK\'s**, and the difference was measured: MCP SDK 1.30.0 opens an SSE stream on ' +
             '`GET` (`handleGetRequest`) and answers `200` on `DELETE` (`handleDeleteRequest`), neither of which a stateless server has any ' +
             'business doing, so the cloud writes the `405` itself in the transport\'s own JSON-RPC error shape with `Allow: POST`. \n\n**The row exists so that the `405` is not a `404`.** An unregistered verb answers ' +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fleetless/contracts",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Fleetless wire contracts: the bridge-cloud protocol, the REST API schemas and the error codes, as zod schemas with generated JSON Schema and OpenAPI artifacts.",
   "license": "Apache-2.0",
   "author": "Dehne Robotik GmbH",
@@ -10,7 +10,8 @@
     "url": "https://github.com/fleetless/contracts"
   },
   "bugs": {
-    "url": "https://github.com/fleetless/contracts/issues"
+    "url": "https://github.com/fleetless/contracts/issues",
+    "email": "security@fleetless.dev"
   },
   "keywords": [
     "fleetless",
@@ -36,21 +37,25 @@
     "LICENSE",
     "NOTICE",
     "README.md",
-    "CHANGELOG.md"
+    "CHANGELOG.md",
+    "SECURITY.md",
+    "CONTRIBUTING.md",
+    "CODE_OF_CONDUCT.md"
   ],
   "engines": {
     "node": ">=20"
   },
   "scripts": {
     "typecheck": "tsc --noEmit && tsc --noEmit -p test/tsconfig.json",
-    "build": "tsc",
-    "prepare": "tsc",
+    "build": "tsc && node scripts/stamp-dist.mjs",
+    "prepare": "tsc && node scripts/stamp-dist.mjs",
     "test": "vitest run",
     "artifacts": "tsx scripts/export-schemas.ts",
-    "test:pack": "node scripts/verify-pack.mjs"
+    "test:pack": "node scripts/verify-pack.mjs",
+    "prepublishOnly": "node scripts/refuse-manual-publish.mjs"
   },
   "dependencies": {
-    "zod": "^4.0.0"
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",