@fleetless/contracts 1.0.0 → 1.0.3

package/dist/identity.d.ts

@@ -1,7 +1,8 @@
+// SPDX-License-Identifier: Apache-2.0
 import { z } from 'zod';
 /**
  * **Fleetless users: the org's team, and the only people who reach the
- * console** (spec `2026-09-05-app-user-auth`, D1).
+ * console.**
  *
  * There are two identity spaces now and **nothing joins them**:
  *
@@ -16,7 +17,7 @@ import { z } from 'zod';
  * A Fleetless user who wants to use an app registers or is invited like
  * anybody else; there is no path from one space to the other.
  *
- * **What that deleted, with no successor** (D1): groups and the Org Admins
+ * **What that deleted, with no successor**: groups and the Org Admins
  * group, app assignments, impersonation, the per-user MCP override and the
  * org-level federation policy. The 2026-08-29 model had put developers and end
  * users into one pool per org and connected them with all of the above; in use
@@ -48,7 +49,7 @@ export declare const password: z.ZodString;
 /** The bound on a Fleetless user's display name; `APP_USER_DISPLAY_NAME_MAX` matches it, so a rename cannot be legal in one space and refused in the other. */
 export declare const USER_DISPLAY_NAME_MAX = 120;
 /**
- * **The two tiers a Fleetless user can hold** (D1). Owner-exclusive: delete
+ * **The two tiers a Fleetless user can hold**. Owner-exclusive: delete
  * the org, edit org settings, promote to owner, and later billing. Everything
  * else a Fleetless user may do, a `developer` may do.
  *
@@ -96,7 +97,7 @@ export type PatchOrgResponse = z.infer<typeof patchOrgResponse>;
  * central endpoint), and `has_password`. The last is the interesting one — it
  * existed because a pool user might have been provisioned by an identity
  * provider and hold no Fleetless credential. A Fleetless user always holds
- * one: the console is password-only by design (D1), which removes the
+ * one: the console is password-only by design, which removes the
  * IdP-lockout class entirely, so a field reporting whether the credential
  * exists would have exactly one value forever.
  */
@@ -128,7 +129,7 @@ export declare const fleetlessUserListResponse: z.ZodObject<{
 }, z.core.$strip>;
 export type FleetlessUserListResponse = z.infer<typeof fleetlessUserListResponse>;
 /**
- * Access plus refresh (spec §3.4). The access token is short-lived; the
+ * Access plus refresh. The access token is short-lived; the
  * refresh token rotates on every use, so a stolen one is detectable when the
  * original is presented again.
  *
@@ -146,8 +147,8 @@ export declare const refreshRequest: z.ZodObject<{
 }, z.core.$strip>;
 export type RefreshRequest = z.infer<typeof refreshRequest>;
 /**
- * Registering an org creates the org and its first owner in one step
- * (André, 2026-08-10): whoever registers the organisation is the owner.
+ * Registering an org creates the org and its first owner in one step: whoever
+ * registers the organisation is the owner.
  */
 export declare const signUpRequest: z.ZodObject<{
     org_name: z.ZodString;
@@ -204,7 +205,7 @@ export declare const waitlistRequest: z.ZodObject<{
 export type WaitlistRequest = z.infer<typeof waitlistRequest>;
 /**
  * Console login. Fleetless users only, always the Fleetless password — the
- * console has no federated door at all (D1), which removes the IdP-lockout
+ * console has no federated door at all, which removes the IdP-lockout
  * class entirely.
  *
  * This resolves a person by address alone, and a Fleetless user's email is
@@ -222,7 +223,7 @@ export declare const developerLoginRequest: z.ZodObject<{
 }, z.core.$strip>;
 export type DeveloperLoginRequest = z.infer<typeof developerLoginRequest>;
 /**
- * What happened to the mail, in four words instead of one (W6c).
+ * What happened to the mail, in four words instead of one.
  *
  * `mail_sent: boolean` could not tell **"we have no SMTP configured"** from
  * **"we tried and the server refused"**, so the console had to pick a sentence
@@ -387,10 +388,10 @@ export declare const tierChangeRequest: z.ZodObject<{
 export type TierChangeRequest = z.infer<typeof tierChangeRequest>;
 /**
  * What a `forbidden` refusal carries when the reason is the caller's **tier**
- * rather than a missing grant (W6c).
+ * rather than a missing grant.
  *
- * §3.3 makes `forbidden` deliberately silent about *existence*, and that stays
- * true — this says nothing about what the target is. But "your role does not
+ * `forbidden` is deliberately silent about *existence*, and that stays true —
+ * this says nothing about what the target is. But "your role does not
  * permit this" and "there is no such thing" are the same answer today, and a
  * developer cannot tell *ask an owner* from *you have the wrong id*. Naming
  * the required tier reveals only what the caller could read off the docs.
@@ -429,8 +430,8 @@ export type PasswordChangeRequest = z.infer<typeof passwordChangeRequest>;
  *
  * **The response never says whether the address exists.** It is unauthenticated
  * and would otherwise be an account-enumeration oracle — the one place where
- * §3.3's "reveal nothing about what exists" is not a preference but the whole
- * point. So this answers the same way for a known and an unknown address, in
+ * revealing nothing about what exists is not a preference but the whole point.
+ * So this answers the same way for a known and an unknown address, in
  * status, body **and timing**, and any consumer that renders "no such account"
  * from it has reintroduced the oracle.
  *
@@ -463,24 +464,20 @@ export type PasswordResetConfirm = z.infer<typeof passwordResetConfirm>;
  * An IdP issuer URL — **an attacker-supplied string that decides where the
  * *server* connects.**
  *
- * `redirectUri` in `oauth.ts` got a parsed scheme check and an explicit
- * loopback allow-list, with the reasoning written down, because it decides
- * where a *credential* goes. This field got `z.url()` — in the same file, in
- * the same wave. Argus-W7b found it and stored `file:///etc/passwd`,
- * `http://169.254.169.254/latest/meta-data` and `http://infra-postgres-1:5432`
- * through the app's IdP route, then caught the outbound discovery fetch on a
- * listener he stood up. **That is this project's own question — which rules
- * have we already written down, and where else do they apply — answered badly,
- * one field over.**
+ * `redirectUri` in `oauth.ts` carries a parsed scheme check and an explicit
+ * loopback allow-list because it decides where a *credential* goes. A bare
+ * `z.url()` here would accept `file:///etc/passwd`, a cloud metadata address or
+ * an internal database host, and the server would then fetch it during issuer
+ * discovery. The same rule applies one field over.
  *
  * **What this shape can decide, it now decides:** http(s) only (so no `file:`,
  * `gopher:`, `data:`), no credentials in the URL, no fragment, no query. RFC
- * 8414 §3 builds the discovery URL from the issuer's path, so a query string
+ * 8414 builds the discovery URL from the issuer's path, so a query string
  * there is meaningless and a `@` is a redirect trick.
  *
  * **What it cannot decide, stated rather than implied:** it cannot tell
- * `http://localhost:8081/realms/fleetless-test` — the dev IdP this project
- * ships — from `http://127.0.0.1:5432`. Both are loopback http. So **this is
+ * a development identity provider on `http://localhost:8081` from a database
+ * on `http://127.0.0.1:5432`. Both are loopback http. So **this is
  * not the SSRF defence and must not be mistaken for one.** The defence belongs
  * at the fetch, in the cloud: refuse loopback, link-local and private ranges
  * unless something explicitly opts in for development, and it names DNS
@@ -498,7 +495,7 @@ export type IdpIssuer = z.infer<typeof idpIssuer>;
  * here.** `oidcCallbackErrorCode` and `oidcCallbackError` described the page
  * `GET /mcp/oauth/idp-callback` rendered when a group's identity provider sent
  * a browser back — `jit_disabled` and `email_collision` name provisioning steps
- * only a group provider had. D1 makes Fleetless users password-only and deletes
+ * only a group provider had. Fleetless users are password-only now, which deletes
  * group providers, so the flow that produced these codes cannot start; the
  * route is gone from this manifest and from the cloud.
  *

package/dist/identity.js

@@ -2,7 +2,7 @@
 import { z } from 'zod';
 /**
  * **Fleetless users: the org's team, and the only people who reach the
- * console** (spec `2026-09-05-app-user-auth`, D1).
+ * console.**
  *
  * There are two identity spaces now and **nothing joins them**:
  *
@@ -17,7 +17,7 @@ import { z } from 'zod';
  * A Fleetless user who wants to use an app registers or is invited like
  * anybody else; there is no path from one space to the other.
  *
- * **What that deleted, with no successor** (D1): groups and the Org Admins
+ * **What that deleted, with no successor**: groups and the Org Admins
  * group, app assignments, impersonation, the per-user MCP override and the
  * org-level federation policy. The 2026-08-29 model had put developers and end
  * users into one pool per org and connected them with all of the above; in use
@@ -49,7 +49,7 @@ export const password = z.string().min(12).max(256);
 /** The bound on a Fleetless user's display name; `APP_USER_DISPLAY_NAME_MAX` matches it, so a rename cannot be legal in one space and refused in the other. */
 export const USER_DISPLAY_NAME_MAX = 120;
 /**
- * **The two tiers a Fleetless user can hold** (D1). Owner-exclusive: delete
+ * **The two tiers a Fleetless user can hold**. Owner-exclusive: delete
  * the org, edit org settings, promote to owner, and later billing. Everything
  * else a Fleetless user may do, a `developer` may do.
  *
@@ -95,7 +95,7 @@ export const patchOrgResponse = z.object({
  * central endpoint), and `has_password`. The last is the interesting one — it
  * existed because a pool user might have been provisioned by an identity
  * provider and hold no Fleetless credential. A Fleetless user always holds
- * one: the console is password-only by design (D1), which removes the
+ * one: the console is password-only by design, which removes the
  * IdP-lockout class entirely, so a field reporting whether the credential
  * exists would have exactly one value forever.
  */
@@ -126,7 +126,7 @@ export const fleetlessUserListResponse = z.object({
     }),
 });
 /**
- * Access plus refresh (spec §3.4). The access token is short-lived; the
+ * Access plus refresh. The access token is short-lived; the
  * refresh token rotates on every use, so a stolen one is detectable when the
  * original is presented again.
  *
@@ -146,8 +146,8 @@ export const sessionTokens = z.object({
 });
 export const refreshRequest = z.object({ refresh_token: z.string().min(1) });
 /**
- * Registering an org creates the org and its first owner in one step
- * (André, 2026-08-10): whoever registers the organisation is the owner.
+ * Registering an org creates the org and its first owner in one step: whoever
+ * registers the organisation is the owner.
  */
 export const signUpRequest = z.object({
     org_name: z.string().min(1).max(120),
@@ -181,7 +181,7 @@ export const signUpResponse = z.object({
 export const waitlistRequest = z.object({ email: z.email().max(254) });
 /**
  * Console login. Fleetless users only, always the Fleetless password — the
- * console has no federated door at all (D1), which removes the IdP-lockout
+ * console has no federated door at all, which removes the IdP-lockout
  * class entirely.
  *
  * This resolves a person by address alone, and a Fleetless user's email is
@@ -198,7 +198,7 @@ export const developerLoginRequest = z.object({
     password: z.string().min(1),
 });
 /**
- * What happened to the mail, in four words instead of one (W6c).
+ * What happened to the mail, in four words instead of one.
  *
  * `mail_sent: boolean` could not tell **"we have no SMTP configured"** from
  * **"we tried and the server refused"**, so the console had to pick a sentence
@@ -353,10 +353,10 @@ export const patchFleetlessUserRequest = z
 export const tierChangeRequest = z.object({ tier: orgAdminTier }).strict();
 /**
  * What a `forbidden` refusal carries when the reason is the caller's **tier**
- * rather than a missing grant (W6c).
+ * rather than a missing grant.
  *
- * §3.3 makes `forbidden` deliberately silent about *existence*, and that stays
- * true — this says nothing about what the target is. But "your role does not
+ * `forbidden` is deliberately silent about *existence*, and that stays true —
+ * this says nothing about what the target is. But "your role does not
  * permit this" and "there is no such thing" are the same answer today, and a
  * developer cannot tell *ask an owner* from *you have the wrong id*. Naming
  * the required tier reveals only what the caller could read off the docs.
@@ -392,8 +392,8 @@ export const passwordChangeRequest = z.object({
  *
  * **The response never says whether the address exists.** It is unauthenticated
  * and would otherwise be an account-enumeration oracle — the one place where
- * §3.3's "reveal nothing about what exists" is not a preference but the whole
- * point. So this answers the same way for a known and an unknown address, in
+ * revealing nothing about what exists is not a preference but the whole point.
+ * So this answers the same way for a known and an unknown address, in
  * status, body **and timing**, and any consumer that renders "no such account"
  * from it has reintroduced the oracle.
  *
@@ -424,24 +424,20 @@ export const passwordResetConfirm = z.object({
  * An IdP issuer URL — **an attacker-supplied string that decides where the
  * *server* connects.**
  *
- * `redirectUri` in `oauth.ts` got a parsed scheme check and an explicit
- * loopback allow-list, with the reasoning written down, because it decides
- * where a *credential* goes. This field got `z.url()` — in the same file, in
- * the same wave. Argus-W7b found it and stored `file:///etc/passwd`,
- * `http://169.254.169.254/latest/meta-data` and `http://infra-postgres-1:5432`
- * through the app's IdP route, then caught the outbound discovery fetch on a
- * listener he stood up. **That is this project's own question — which rules
- * have we already written down, and where else do they apply — answered badly,
- * one field over.**
+ * `redirectUri` in `oauth.ts` carries a parsed scheme check and an explicit
+ * loopback allow-list because it decides where a *credential* goes. A bare
+ * `z.url()` here would accept `file:///etc/passwd`, a cloud metadata address or
+ * an internal database host, and the server would then fetch it during issuer
+ * discovery. The same rule applies one field over.
  *
  * **What this shape can decide, it now decides:** http(s) only (so no `file:`,
  * `gopher:`, `data:`), no credentials in the URL, no fragment, no query. RFC
- * 8414 §3 builds the discovery URL from the issuer's path, so a query string
+ * 8414 builds the discovery URL from the issuer's path, so a query string
  * there is meaningless and a `@` is a redirect trick.
  *
  * **What it cannot decide, stated rather than implied:** it cannot tell
- * `http://localhost:8081/realms/fleetless-test` — the dev IdP this project
- * ships — from `http://127.0.0.1:5432`. Both are loopback http. So **this is
+ * a development identity provider on `http://localhost:8081` from a database
+ * on `http://127.0.0.1:5432`. Both are loopback http. So **this is
  * not the SSRF defence and must not be mistaken for one.** The defence belongs
  * at the fetch, in the cloud: refuse loopback, link-local and private ranges
  * unless something explicitly opts in for development, and it names DNS
@@ -476,7 +472,7 @@ export const idpIssuer = z
  * here.** `oidcCallbackErrorCode` and `oidcCallbackError` described the page
  * `GET /mcp/oauth/idp-callback` rendered when a group's identity provider sent
  * a browser back — `jit_disabled` and `email_collision` name provisioning steps
- * only a group provider had. D1 makes Fleetless users password-only and deletes
+ * only a group provider had. Fleetless users are password-only now, which deletes
  * group providers, so the flow that produced these codes cannot start; the
  * route is gone from this manifest and from the cloud.
  *

package/dist/index.d.ts

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
 export { SLUG_RULE, ROS_NAME_RULE, ROS_TYPE_NAME_RULE, FIELD_PATH_RULE, slug, rosName, rosTypeName, fieldPath, wireSeqCursor, wireTimestampMs, applyErrorKind, applyError, } from './common.js';
 export type { ApplyErrorKind, ApplyError } from './common.js';
 export { MCP_PROTOCOL_VERSION, MCP_ENDPOINT_PATH, mcpAppEndpointPath, MCP_APP_PATHS, MCP_TOOL_NAME_MAX, MCP_ASSET_LINK_PATH, MCP_ASSET_LINK_TTL_MS, mcpToolNamePattern, mcpToolKind, mcpExposure, mcpCapabilities, mcpRobotDatasheet, mcpRolePreviewResponse, } from './mcp.js';
@@ -12,10 +13,9 @@ export { FLEETLESS_FORMAT_VERSION, RESERVED_SLUGS, parameterType, parameterSpec,
 export type { CameraSource } from './config.js';
 export type { ParameterType, ParameterSpec, ActionConfig, ServiceConfig, PublisherConfig, CameraConfig, CameraCredentials, AlertCondition, DatapointAlert, DatapointNumeric, DatapointRetention, DatapointChart, DatapointConfig, RobotConfigDoc, ValidationIssue, ConfigState, } from './config.js';
 /**
- * FL-005 — the one account of what is wrong with a document, shared by the
- * cloud and the console. The cloud held a second copy for one wave; it was
- * deleted in wave 2 task 8 (cloud `a307e18`, 2026-09-03). See
- * `config-issues.ts`'s header for what that window cost.
+ * The one account of what is wrong with a configuration document, shared by
+ * every layer that reports on one. See `config-issues.ts`'s header for why a
+ * second copy of this vocabulary is a defect rather than a convenience.
  */
 export { DOCUMENT_ROOT_PATH, EXPOSURE_SECTIONS, schemaIssues, formatPath, splitFormatPath, configSchemaHash, } from './config-issues.js';
 export type { SchemaIssue, ExposureSection } from './config-issues.js';

package/dist/index.js

@@ -2,46 +2,45 @@
 export { SLUG_RULE, ROS_NAME_RULE, ROS_TYPE_NAME_RULE, FIELD_PATH_RULE, slug, rosName, rosTypeName, fieldPath, wireSeqCursor, wireTimestampMs, applyErrorKind, applyError, } from './common.js';
 export { MCP_PROTOCOL_VERSION, MCP_ENDPOINT_PATH, mcpAppEndpointPath, MCP_APP_PATHS, MCP_TOOL_NAME_MAX, MCP_ASSET_LINK_PATH, MCP_ASSET_LINK_TTL_MS, mcpToolNamePattern, mcpToolKind, mcpExposure, mcpCapabilities, mcpRobotDatasheet, mcpRolePreviewResponse, } from './mcp.js';
 export { PROTOCOL_VERSION, bridgeHello, cloudHelloOk, cloudHelloError, cloudPing, bridgePong, datapointFrame, bridgeState, bridgePressure, PRESSURE_SLUG, cloudConfig, bridgeConfigApplied, cloudIntrospectRequest, bridgeIntrospect, cloudTypeRequest, bridgeTypeDefinitions, cloudInvoke, cloudCancel, cloudPublish, bridgeJobUpdate, bridgeJobLost, snapshotHeader, cloudCameraStart, cloudCameraStop, bridgeCameraState, SNAPSHOT_MAX_BYTES, CLOSE_ROBOT_DELETED, 
-// W7 — assets.
+// Assets.
 bridgeAssetsAvailable, cloudAssetRequest, bridgeAssetProgress, 
-// W6b — addressing.
+// Addressing.
 activeJob, DEFAULT_PATIENCE_MS, MAX_PATIENCE_MS, MIN_PATIENCE_MS, } from './protocol.js';
 export { jobState, job, jobEvent, busyDetails, publisherBusyDetails, jobQueueFullDetails } from './jobs.js';
 export { JOB_RUN_PAGE_MAX, JOB_RUN_RETENTION_DAYS, jobActor, jobRunKind, jobRun, jobRunQuery, jobRunListResponse, jobRunSummaryQuery, jobRunSummary, } from './jobs.js';
 export { FLEETLESS_FORMAT_VERSION, RESERVED_SLUGS, parameterType, parameterSpec, parameterMap, serviceDescription, parameterDescription, messageTemplate, messageRef, messageBody, messageMap, PLACEHOLDER_RE, placeholderNames, actionConfig, serviceConfig, publisherConfig, cameraConfig, alertCondition, datapointAlert, rateThrottleHz, datapointNumeric, datapointRetention, datapointChart, datapointConfig, robotConfigDoc, validationIssue, configState, snapshotIntervalSeconds, 
-// FL-002 — the defaults the format names, so nobody invents them twice.
+// The defaults the format names, so nobody invents them twice.
 ALERT_SEVERITY_DEFAULT, ALERT_ENABLED_DEFAULT, RETENTION_INTERVAL_SECONDS_DEFAULT, CHART_WINDOW_MINUTES_DEFAULT, 
-// W6
+// Retention, history and quotas.
 cameraSource, cameraCredentials, } from './config.js';
 /**
- * FL-005 — the one account of what is wrong with a document, shared by the
- * cloud and the console. The cloud held a second copy for one wave; it was
- * deleted in wave 2 task 8 (cloud `a307e18`, 2026-09-03). See
- * `config-issues.ts`'s header for what that window cost.
+ * The one account of what is wrong with a configuration document, shared by
+ * every layer that reports on one. See `config-issues.ts`'s header for why a
+ * second copy of this vocabulary is a defect rather than a convenience.
  */
 export { DOCUMENT_ROOT_PATH, EXPOSURE_SECTIONS, schemaIssues, formatPath, splitFormatPath, configSchemaHash, } from './config-issues.js';
 export { rosGraphEntry, rosGraph, typeField, typeDefinition, parameterFieldsOf } from './introspection.js';
 export { robot, patchRobotResponse, robotToken, createRobotRequest, createRobotResponse, exposureCounts, robotListItem, robotListResponse, datapointValue, robotDetailResponse, configDraftResponse, putConfigDraftRequest, publishConfigResponse, configVersionsResponse, configVersionResponse, introspectionResponse, typesResponse, fetchTypesRequest, fetchTypesResponse, datapointDescriptor, datapointListResponse, robotDetailsDoc, putRobotDetailsResponse, putRobotDetailsRequest, invokeRequest, invokeResponse, 
-// W6b — addressing.
+// Addressing.
 cancelRequest, releaseLiveQuery, serviceCallResponse, invokeOrServiceResponse, publishRequest, jobResponse, robotJobsResponse, rateLimitDetails, exposure, exposureListResponse, SNAPSHOT_HEADERS, ASSET_UPLOAD_HEADERS, cameraDescriptor, cameraListResponse, liveSessionResponse, snapshotMetaResponse, 
-// W6 — retention, history, quotas.
+// Retention, history, quotas.
 historyQuery, historySamplesResponse, historyBucketsResponse, historyResponse, orgQuotas, orgQuotaUsage, orgQuotaUsageCounts, robotDeletionSummary, RESOURCE_HEALTH_STATES, resourceHealthState, resourceHealthListResponse, orgHealthQuery, robotDeleteQuery, 
-// W3a — robot rename, slug rename.
+// Robot rename, slug rename.
 patchRobotRequest, renameSlugRequest, renameSlugResponse, slugUsageResponse, } from './rest.js';
 export { LATENCY_BUCKET_MS, BRIDGE_LATENCY_RETENTION_DAYS, MAX_LATENCY_BUCKETS_PER_RESPONSE, latencyBucket, robotLatencySeries, orgLatencyQuery, orgLatencyResponse, USAGE_WINDOW_MAX_DAYS, usageMetric, usageDay, orgUsageQuery, usageRow, orgUsageResponse, } from './rest.js';
 export { clientAuth, authOk, authError, clientInvoke, clientCancel, clientPublish, commandResult, errorFrame, clientSubscribe, clientUnsubscribe, subscribeError, datapointEvent, resourceHealthEvent, resourceHealthCleared, liveSessionEndReason, liveSessionEvent, ORG_EVENT_SAMPLE_INTERVAL_MS, ORG_EVENT_ORG_CEILING_PER_SECOND, ORG_EVENT_BUFFER_SIZE, ORG_EVENT_BUFFER_IDLE_MS, ORG_EVENT_DETAIL_MAX_BYTES, orgEventKind, orgEventSeverity, orgEvent, orgEventSubscribe, orgEventUnsubscribe, orgEventReplay, orgEventDropped, } from './realtime.js';
 export { password, org, patchOrgResponse, sessionTokens, refreshRequest, signUpRequest, signUpResponse, 
 // 2026-09-04 — the public site (closed beta).
 waitlistRequest, developerLoginRequest, 
-// 2026-09-05 — the two identity spaces (app-user-auth, D1).
+// The two identity spaces.
 USER_DISPLAY_NAME_MAX, orgAdminTier, fleetlessUser, fleetlessUserListResponse, createTeamInviteRequest, teamInvite, pendingTeamInvite, pendingTeamInviteListResponse, acceptTeamInviteRequest, patchFleetlessUserRequest, tierChangeRequest, 
-// W6c — identity.
+// Identity.
 mailStatus, tierRequiredDetails, passwordChangeRequest, passwordResetRequest, passwordResetConfirm, idpIssuer, 
-// W3a — auth/me, org and member patches.
+// auth/me, org and member patches.
 authMeResponse, patchOrgRequest, patchAuthMeRequest, } from './identity.js';
 export { appIdentifier, app, appListResponse, createAppRequest, updateAppRequest, serverKeyToken, serverKey, serverKeyListResponse, createServerKeyResponse, role, roleListResponse, rolePermissions, } from './apps.js';
 export { clientLoginRequest, clientRefreshRequest, clientLogoutRequest, clientRegisterRequest, clientVerifyEmailRequest, clientResendVerificationRequest, clientPasswordResetRequest, clientPasswordResetConfirmRequest, clientAcceptInvitationRequest, CLIENT_OIDC_CALLBACK_PATH, clientProviderListQuery, clientProviderListResponse, clientOidcStartQuery, clientOidcCallbackQuery, clientOidcExchangeRequest, clientOidcErrorCode, clientMcpInteraction, clientMcpInteractionDecisionResponse, mcpConsentGrant, mcpConsentGrantListResponse, clientIdentity, } from './client-auth.js';
-// 2026-09-05 — the per-app identity space (app-user-auth, D1/D3/D4/D5).
+// The per-app identity space.
 export { APP_USER_DISPLAY_NAME_MAX, APP_URL_PLACEHOLDERS, MAIL_TEMPLATE_VARIABLES, DEFAULT_MAIL_TEMPLATES, providerSlug, appUserStatus, appUser, appUserListResponse, createAppUserRequest, patchAppUserRequest, createAppInvitationRequest, appInvitation, pendingAppInvitation, appInvitationListResponse, appOidcProvider, appOidcProviderListResponse, createAppOidcProviderRequest, patchAppOidcProviderRequest, appUrlTemplate, allowedOrigin, emailDomain, appAuthConfig, putAppAuthConfigRequest, mailTemplateKind, appMailTemplate, appMailTemplateListResponse, putAppMailTemplateRequest, mailTemplatePreviewRequest, mailTemplatePreviewResponse, mailTemplateProblemDetails, mailOutcome, } from './app-users.js';
 export { assetKind, URDF_ASSET_NAME, asset, urdfCompleteness, assetListResponse, missingAssetQuery, assetSyncRequest, assetSyncResponse, assetSyncState, assetSyncStatus, assetFailure, assetFailureKind, assetTooLargeDetails, assetSyncBusyDetails, ASSET_UPLOAD_MAX_BYTES, } from './assets.js';
 export { auditActor, auditEvent, auditQuery, auditListResponse, AUDIT_CSV_COLUMNS, AUDIT_RETENTION_DAYS } from './audit.js';

package/dist/introspection.d.ts

@@ -1,6 +1,7 @@
+// SPDX-License-Identifier: Apache-2.0
 import { z } from 'zod';
 /**
- * Introspection (spec §4.1, §4.5): what the connected bridge can tell the
+ * Introspection: what the connected bridge can tell the
  * cloud about the robot's ROS graph, so the console can offer a quick pick
  * instead of a blank text field.
  *
@@ -45,10 +46,10 @@ export interface TypeField {
 }
 export declare const typeField: z.ZodType<TypeField>;
 /**
- * A resolved type of one robot. Custom types are per robot (spec §4.5): two
- * robots may define `custom_msgs/msg/Speed` differently and both are right.
+ * A resolved type of one robot. Custom types are per robot: two robots may
+ * define `custom_msgs/msg/Speed` differently and both are right.
  *
- * W2 resolved messages only; W4 adds services and actions, because a
+ * Messages, services and actions all appear here, because a
  * `parameterSpec.name` has to resolve against *something*, and an action has
  * no flat field list — it has a goal, a result and a feedback tree.
  *
@@ -65,8 +66,8 @@ export declare const typeField: z.ZodType<TypeField>;
  * a result in. They are carried so the console can show what an action will
  * report back, and so a client knows the shape of `job.result` in advance.
  *
- * The `msg` member keeps W2's exact shape, so every type already stored stays
- * valid without migration.
+ * The `msg` member is the flat field list a message resolves to; the other
+ * two carry one tree per part.
  */
 export declare const typeDefinition: z.ZodDiscriminatedUnion<[z.ZodObject<{
     name: z.ZodString;

package/dist/introspection.js

@@ -2,7 +2,7 @@
 import { z } from 'zod';
 import { rosName, rosTypeName } from './common.js';
 /**
- * Introspection (spec §4.1, §4.5): what the connected bridge can tell the
+ * Introspection: what the connected bridge can tell the
  * cloud about the robot's ROS graph, so the console can offer a quick pick
  * instead of a blank text field.
  *
@@ -31,10 +31,10 @@ export const typeField = z.lazy(() => z.object({
     fields: z.array(typeField).nullable(),
 }));
 /**
- * A resolved type of one robot. Custom types are per robot (spec §4.5): two
- * robots may define `custom_msgs/msg/Speed` differently and both are right.
+ * A resolved type of one robot. Custom types are per robot: two robots may
+ * define `custom_msgs/msg/Speed` differently and both are right.
  *
- * W2 resolved messages only; W4 adds services and actions, because a
+ * Messages, services and actions all appear here, because a
  * `parameterSpec.name` has to resolve against *something*, and an action has
  * no flat field list — it has a goal, a result and a feedback tree.
  *
@@ -51,8 +51,8 @@ export const typeField = z.lazy(() => z.object({
  * a result in. They are carried so the console can show what an action will
  * report back, and so a client knows the shape of `job.result` in advance.
  *
- * The `msg` member keeps W2's exact shape, so every type already stored stays
- * valid without migration.
+ * The `msg` member is the flat field list a message resolves to; the other
+ * two carry one tree per part.
  */
 export const typeDefinition = z.discriminatedUnion('kind', [
     z.object({

package/dist/jobs.d.ts

@@ -1,15 +1,16 @@
+// SPDX-License-Identifier: Apache-2.0
 import { z } from 'zod';
 /**
- * Jobs (spec §6.1, §11.3): one running unit of work on a robot — an action
+ * Jobs: one running unit of work on a robot — an action
  * goal or a service call — with an id both sides know, so bridge and cloud
  * stay in sync across a disconnect.
  *
  * Two rules shape everything here:
  *
- * 1. **State is observed by slug, not by id.** The id is informative (§11.3);
- *    a client watches `robot × slug` and sees whatever job is running there,
- *    which is also why every observer of a slug sees the same job.
- * 2. **`lost` is a real outcome and must be said out loud** (§6.1). Job state
+ * 1. **State is observed by slug, not by id.** The id is informative; a client
+ *    watches `robot × slug` and sees whatever job is running there, which is
+ *    also why every observer of a slug sees the same job.
+ * 2. **`lost` is a real outcome and must be said out loud.** Job state
  *    lives only in the bridge's memory; if it restarts mid-job, the results
  *    are gone. The cloud then marks the job `lost` — never leaves it reading
  *    "running" because nobody contradicted it. A system that reports a
@@ -49,8 +50,8 @@ export type Job = z.infer<typeof job>;
 /**
  * One update about a job, pushed to subscribers of its slug.
  *
- * `timestamp_ms` is the bridge's capture time, exactly as for a datapoint
- * (§6.3 says action feedback carries it too) — so a client computes the age
+ * `timestamp_ms` is the bridge's capture time, exactly as for a datapoint —
+ * action feedback carries it too — so a client computes the age
  * of a progress report the same way it computes the age of a sensor value,
  * and a burst of late-delivered feedback after a reconnect is visibly late
  * rather than looking current.
@@ -86,9 +87,8 @@ export declare const jobEvent: z.ZodObject<{
 }, z.core.$strip>;
 export type JobEvent = z.infer<typeof jobEvent>;
 /**
- * What a busy refusal tells the caller (spec §11.3: "inkl. Information, was
- * läuft"). A refusal that only says "busy" forces the caller to guess whether
- * to wait or to give up.
+ * What a busy refusal tells the caller: what is already running. A refusal that
+ * only says "busy" forces the caller to guess whether to wait or to give up.
  */
 export declare const busyDetails: z.ZodObject<{
     running: z.ZodObject<{
@@ -115,7 +115,7 @@ export declare const busyDetails: z.ZodObject<{
 }, z.core.$strip>;
 export type BusyDetails = z.infer<typeof busyDetails>;
 /**
- * What a `publisher_busy` refusal tells the caller (spec §6.4).
+ * What a `publisher_busy` refusal tells the caller.
  *
  * "Another caller is publishing and has not been quiet long enough" names a
  * state and no action: the caller does not know how much longer, because
@@ -133,7 +133,7 @@ export declare const publisherBusyDetails: z.ZodObject<{
 }, z.core.$strip>;
 export type PublisherBusyDetails = z.infer<typeof publisherBusyDetails>;
 /**
- * What a `job_queue_full` refusal tells the caller (W6b).
+ * What a `job_queue_full` refusal tells the caller.
  *
  * Both numbers, not just the limit: `limit` alone says how big the queue is
  * and nothing about whether waiting will help, and `queued` alone cannot be
@@ -163,7 +163,7 @@ export declare const JOB_RUN_RETENTION_DAYS = 90;
  * invites every reader to handle it.
  *
  * **`app_user` is what a client-app caller writes now, and `end_user` stays**
- * (app-user auth, D1). The seam this comment used to describe — two names for
+ * identity spaces. The seam this comment used to describe — two names for
  * two ways into one merged pool — is settled: the two identity spaces are
  * separate tables again, and `app_user` is a row in `app_users`, belonging to
  * exactly one app. `end_user` is kept for the same reason `auditActor.kind`
@@ -188,10 +188,10 @@ export declare const jobRunKind: z.ZodEnum<{
 }>;
 export type JobRunKind = z.infer<typeof jobRunKind>;
 /**
- * One durable record of one invocation (spec `2026-08-20-timeseries-and-run-history`,
- * D2). One row per run, never one per event: the per-event timeline's write rate
+ * One durable record of one invocation. One row per run, never one per event:
+ * the per-event timeline's write rate
  * is set by the bridge, and a throttled log that cannot say it was throttled is
- * the instrument this codebase refuses everywhere else. The live timeline is
+ * an instrument that cannot say what it does not know. The live timeline is
  * delivered in full by realtime, for as long as somebody is watching.
  */
 export declare const jobRun: z.ZodObject<{