@fleetless/contracts 1.0.2 → 1.0.4

package/dist/config.js

@@ -48,22 +48,20 @@ import { alertSeverity } from './alerts.js';
  * index. Splitting them would put one rule here and its three siblings there
  * — the shape this file has twice had to undo.
  *
- * **Every refusal that answers one of the spec's codes carries
+ * **Every refusal that answers one of the format's validation codes carries
  * `params: { code }`** with that code, which zod passes through `safeParse`
  * untouched. The cloud maps an issue to a code and its repair by reading that
  * field, never by matching the message prose — a join nobody notices
  * breaking.
  *
- * Read the sentence narrowly, because a wider reading is false and was
- * written here once. Plenty of refusals in this file carry no `params.code`,
- * and correctly: the section caps (`parameterMap`'s fifty, `messageMap`'s two
- * hundred), the camera device-path rules, and every refusal zod raises on its
- * own — `unrecognized_keys` behind `unknown_key`, `too_big` behind
- * `invalid_rate`. Those are not spec codes wearing a different hat; the cloud
- * reaches them through zod's own issue codes. The one *spec* code with no
- * `params` is a reversed pair of bounds — `min_value`/`max_value` on a
- * parameter, `y_min`/`y_max` on a chart: `invalid_range` was deleted with
- * `expected_range`, and no code replaced it.
+ * Read that sentence narrowly. Plenty of refusals in this file carry no
+ * `params.code`, and correctly: the section caps (`parameterMap`'s fifty,
+ * `messageMap`'s two hundred), the camera device-path rules, and every refusal
+ * zod raises on its own — `unrecognized_keys` behind `unknown_key`, `too_big`
+ * behind `invalid_rate`. Those are not validation codes wearing a different
+ * hat; a consumer reaches them through zod's own issue codes. The one named
+ * code with no `params` is a reversed pair of bounds — `min_value`/`max_value`
+ * on a parameter, `y_min`/`y_max` on a chart — for which no code exists.
  *
  * `robotConfigDoc` carries all six sections — messages, datapoints, actions,
  * services, publishers and cameras — plus the alerts, the chart bounds and the
@@ -91,16 +89,12 @@ import { alertSeverity } from './alerts.js';
  * which is a published artifact other tools validate against and which a person
  * reads. One constant with two readers, never two strings that happen to agree
  * — `config-zod-messages.test.ts` asserts the two readings are the same string
- * at all 24 pattern positions the document has, because under D3 nothing
- * consumes `patternErrorMessage` at runtime and an unwatched second spelling of
- * a live rule drifts word for word, forever and invisibly.
+ * at every pattern position the document has. An unwatched second spelling of a
+ * live rule drifts word for word, forever and invisibly.
  *
- * In the console `patternErrorMessage` is also the live pattern diagnostic
- * **until wave 3 lands**: `useMonacoYaml.ts` still passes `validate: true`, so
- * between task 7's artifacts and D3 these sentences are what monaco-yaml shows.
- * D3 then turns that validation off, and from there the message a developer
- * sees comes from this schema's own parser and from the cloud — the same
- * sentence, which is the point of there being one.
+ * An editor that validates against the published JSON Schema shows
+ * `patternErrorMessage`; one that does not shows whatever the server's parser
+ * says. They are the same sentence, which is the point of there being one.
  *
  * The tense matters because the two states look identical from inside this
  * file. Whoever reads it after wave 3 should find a claim that was true when
@@ -136,11 +130,10 @@ const mapKey = slug.meta({ patternErrorMessage: SLUG_RULE });
 /**
  * One field, carrying the sentence it says when it is absent.
  *
- * **Three shapes of "this key is not here", and the first version of this
- * helper caught one of them.** A walk over every required key of a fully
- * populated document — `config-zod-messages.test.ts`, which is the guard that
- * found it — says the format has 52 required-key positions and that 14 were
- * still answering in zod's words:
+ * **Three shapes of "this key is not here", and a helper has to cover all
+ * three.** A walk over every required key of a fully populated document —
+ * `config-zod-messages.test.ts` — enumerates every required-key position in the
+ * format and asserts none of them still answers in zod's words:
  *
  * - `invalid_type`, the ordinary case: a string, a number, an object.
  * - `invalid_value` from a `z.literal` or a `z.enum`. A missing `fleetless:`
@@ -160,10 +153,10 @@ const mapKey = slug.meta({ patternErrorMessage: SLUG_RULE });
  * **`z.unknown()` needs a wrapper before it can be given a sentence at all.**
  * It accepts `undefined`, so zod marks the key required and raises its own
  * `expected nonoptional, received undefined` — an issue it attributes to
- * neither the field nor the object, so no error map of ours is consulted
- * (measured). `z.nonoptional` puts a schema there that can carry one. The JSON
- * Schema and the inferred type are byte-identical either way (measured, zod
- * 4.4.3), and a field that is genuinely optional is `.optional()` and is
+ * neither the field nor the object, so no error map of ours is consulted.
+ * `z.nonoptional` puts a schema there that can carry one. The JSON Schema and
+ * the inferred type are identical either way, and a field that is genuinely
+ * optional is `.optional()` and is
  * skipped here — but it is **not** behaviourally free, and that is the one
  * place this task changed what the format accepts: a required key *present*
  * holding `undefined` is now refused where zod's internal check accepted it.
@@ -179,11 +172,11 @@ const mapKey = slug.meta({ patternErrorMessage: SLUG_RULE });
  *
  * `clone` is the only way to add an `error` to a schema that is already built,
  * and **it drops the schema's registry entry** — its `description`, its
- * `examples`, every annotation this wave added, all of which live in
+ * `examples` and every other annotation, all of which live in
  * `z.globalRegistry` keyed by the schema instance rather than in its
- * definition. So the entry is read back and put on the clone. Measured on zod
- * 4.4.3: `z.globalRegistry.get` resolves the whole `.meta()` parent chain into
- * one object, so what is copied is what the export would have produced, and a
+ * definition. So the entry is read back and put on the clone.
+ * `z.globalRegistry.get` resolves the whole `.meta()` parent chain into one
+ * object, so what is copied is what the export would have produced, and a
  * later `.meta()` on the result merges with it as it did before. A wrapper that
  * silently emptied every hover in the format would be the worst available way
  * to improve one message.
@@ -234,8 +227,8 @@ const saysItIsMissing = (field) => {
  * The second arm is the discriminated union: zod hands its error map the whole
  * object and points the path at the discriminator, so `input` is not
  * `undefined` and the first arm cannot see it. `Object.hasOwn` rather than
- * `in`, on this project's own rule — a document's keys are chosen by a
- * developer, and `constructor` satisfies the slug grammar.
+ * `in`, because a document's keys are chosen by a developer and `constructor`
+ * satisfies the slug grammar.
  */
 const absent = (issue, key) => issue.input === undefined
     || (issue.code === 'invalid_union'
@@ -327,8 +320,8 @@ const describeValues = (values, table) => values.map((value) => table[value]);
  *
  * The two syntaxes collide. `defaultSnippets` bodies are inserted as LSP
  * snippets, where `${1:front}` is a tab stop and `${speed}` is a *variable* —
- * and an unknown variable is not left alone. Measured against
- * monaco-editor 0.52.2's own `SnippetParser`, which is what the console runs:
+ * and an unknown variable is not left alone. Against monaco-editor's own
+ * `SnippetParser`:
  *
  * | body holds | the editor inserts |
  * |---|---|
@@ -351,17 +344,16 @@ const param = (name) => `\\\${${name}}`;
  * `{ battery: … }`, and `battery: ▮` offers the `…`. Both positions are real
  * and both were silent, but they are **one skeleton**, so each is authored once
  * as a `Snippet` constant and wrapped here for the section — never copied.
- * Two copies of one skeleton is the drift this wave caught three times in three
- * reviews: a body inventing a value its sibling had already answered, under a
- * label that still agreed. `config-snippets.test.ts` deep-compares the two
- * positions rather than trusting this.
+ * Two copies of one skeleton drift: a body invents a value its sibling had
+ * already answered, under a label that still agrees.
+ * `config-snippets.test.ts` deep-compares the two positions rather than
+ * trusting this.
  *
  * **The slug key belongs to the wrapper, not to the skeleton**, because it
  * differs per snippet — `battery_voltage` for a plain datapoint, `battery` for
  * the numeric one. It therefore takes tab stop `${1}`, and an entry body's own
  * stops are numbered from `${2}` throughout. At the entry position that leaves
- * no `${1}` at all, which costs nothing — measured against
- * monaco-editor 0.52.2's own `SnippetParser`, the version the console runs: it
+ * no `${1}` at all, which costs nothing: monaco-editor's `SnippetParser`
  * sorts placeholders by index and requires neither that they start at 1 nor
  * that they be contiguous, so a body of `a: ${2:x}` visits `2` first, and one
  * of `a: ${2:x}` / `b: ${5:y}` visits `2` then `5`.
@@ -588,9 +580,9 @@ export const parameterSpec = strictObject({
      * A default must satisfy the same constraints a caller's value must.
      *
      * Without this, a default is the one way past bounds that are otherwise
-     * the enforcement point — the spec calls `min_value`/`max_value` "the
-     * speed limit that actually holds", enforced in the cloud before anything
-     * reaches the robot. But a caller who simply omits the parameter gets the
+     * the enforcement point. `min_value`/`max_value` are the speed limit that
+     * actually holds, enforced in the cloud before anything reaches the robot.
+     * But a caller who simply omits the parameter gets the
      * default, and the bridge fills it at the template walk without
      * re-checking bounds, deliberately: a second enforcement point there
      * would be the weaker of two policies. So `{min_value: -1, max_value: 1,
@@ -787,10 +779,9 @@ export const datapointAlert = strictObject({
          * `getInsertTextForProperty` (`yaml.worker.js:8520`) takes
          * `defaultSnippets[0].body` only when a node carries **exactly one**
          * snippet, so accepting `condition` from the key list writes the bare key
-         * here where every other node this wave touched writes its whole block.
-         * The two stay anyway: the value position — a developer who has written
-         * `condition:` and pressed ⏎ — is where the question "what goes here?" is
-         * actually asked, and that is the position this wave exists to answer.
+         * here where every other node writes its whole block. The two stay anyway:
+         * the value position — a developer who has written `condition:` and pressed
+         * ⏎ — is where the question "what goes here?" is actually asked.
          * Merging them into one would buy back the key completion by deleting the
          * choice the schema deliberately does not name, which is the worse trade;
          * anyone tempted to make it should change the key-completion behaviour
@@ -962,9 +953,9 @@ const NUMERIC_DATAPOINT_SNIPPET = {
         /**
          * The quotes inside `unit` are part of the inserted text and are not
          * decoration. A body string is written into the document verbatim, and `%`
-         * is a YAML directive indicator: measured with `yaml` 2.9.0, `unit: %` is a
-         * **syntax error** ("Plain value cannot start with directive indicator
-         * character %") while `unit: "%"` parses to `%`. Nothing between here and
+         * is a YAML directive indicator: `unit: %` is a **syntax error** ("Plain
+         * value cannot start with directive indicator character %") while
+         * `unit: "%"` parses to `%`. Nothing between here and
          * the buffer quotes a scalar for us.
          */
         numeric: { scale: 100, unit: '"%"', decimals: 1 },
@@ -1144,10 +1135,9 @@ export const datapointConfig = strictObject({
  * `z.unknown()`, because a template can be any shape a ROS message can — so
  * nothing below the top of it is checked by the type at all.
  *
- * That gap was measured and missed once already: a top-level `message: null`
- * was refused while `message: { linear: { x: null } }` parsed clean, and a
- * check written to catch exactly this was deleted on the strength of six test
- * cases, none of which reached inside a body.
+ * The gap is easy to miss: a top-level `message: null` is refused while
+ * `message: { linear: { x: null } }` parses clean, and a test suite that never
+ * reaches inside a body cannot tell the two apart.
  *
  * Walked with an explicit stack and a seen-set, not recursion: a YAML anchor
  * can make a template both very deep and genuinely cyclic, and a developer can
@@ -1231,10 +1221,9 @@ export const messageBody = messageTemplate;
  * contract.** This runs inside `publisherConfig`'s failsafe refinement, so a
  * `RangeError: Maximum call stack size exceeded` did not stay here: it
  * propagated out of `safeParse`, which is specified to return a result and
- * not to throw. Measured on the recursive version — fine at 8 000 levels of
- * nesting, throwing at 20 000 — and a flow-style YAML one-liner reaches that
- * in about 120 KB of input. A draft PUT would have answered 500 where it
- * meant 400.
+ * not to throw. A recursive walk survives a few thousand levels of nesting and
+ * throws somewhere above that, which a flow-style YAML one-liner reaches in
+ * about 120 KB of input — so a draft PUT would answer 500 where it meant 400.
  *
  * `seen` is not an optimisation. YAML anchors can express a cycle
  * (`&a { b: *a }`), and the parser resolves an alias to the same object, so
@@ -1302,14 +1291,13 @@ const SHARED_MESSAGE_SNIPPET = {
  * that paragraph would be a second thing to keep true.
  *
  * **How the description gets here is zod behaviour, not something written
- * below.** Measured against zod 4.4.3: `.meta()` on an already-registered
- * schema merges rather than replaces, and the clone resolves the parent's entry
+ * below.** `.meta()` on an already-registered schema merges rather than
+ * replaces, and the clone resolves the parent's entry
  * *lazily* — a clone taken before the parent was registered at all still sees
  * the parent's description afterwards. So no spread is needed and there is no
- * evaluation-order hazard. This was first written as
- * `.meta({ ...messageTemplate.meta(), … })`; dropping the spread was measured
- * to change nothing in the export, and two mechanisms for one description is
- * the shape this file removes rather than adds.
+ * evaluation-order hazard. A defensive `.meta({ ...messageTemplate.meta(), … })`
+ * spread changes nothing in the export and is a second mechanism for one
+ * description, so it is deliberately absent.
  *
  * It is undocumented behaviour all the same, so `config-snippets.test.ts`
  * asserts this node still carries a description and that it is the same string
@@ -1598,8 +1586,8 @@ export const cameraCredentials = strictObject({
  * therefore no validation rule to forget.
  *
  * **Each branch carries its own `defaultSnippets`, rather than one list on the
- * union.** Both placements were measured and both work; this one keeps a
- * label beside the branch it names, so the two cannot drift, and it makes a
+ * union.** Both placements work; this one keeps a label beside the branch it
+ * names, so the two cannot drift, and it makes a
  * fifth source impossible to add without one — `config-snippets.test.ts`
  * walks the exported branches and fails on any that carries none.
  */
@@ -1637,15 +1625,14 @@ export const cameraSource = z.discriminatedUnion('kind', [
                  * `rosTypeName` accepts either, publish accepts either, no diagnostic
                  * fires anywhere, and the bridge then subscribes with the wrong type and
                  * delivers no frames. A snippet supplying a wrong answer where it could
-                 * have supplied a question is this project's *check that cannot fire*,
-                 * arriving through a hint the developer trusts.
+                 * have supplied a question is a defect arriving through a hint the
+                 * developer trusts.
                  *
                  * `kind: 'ros'` stays a literal, because the branch really does fix it.
                  *
-                 * Measured through the actual pipeline rather than assumed, because
-                 * choice syntax is the one construct here that three layers must each
+                 * Choice syntax is the one construct here that three layers must each
                  * pass through unharmed: yaml-language-server's `stringifyObject` emits
-                 * the body verbatim, and monaco-editor 0.52.2's `SnippetParser` parses
+                 * the body verbatim, and monaco-editor's `SnippetParser` parses
                  * `${2|a,b|}` into a placeholder carrying both options whose
                  * `toString()` — the text on the buffer before anyone chooses — is the
                  * first one. So a developer who tabs past this gets a document
@@ -1795,9 +1782,9 @@ export const cameraSource = z.discriminatedUnion('kind', [
  *
  * The bound lives here once, and `rest.ts`'s `cameraDescriptor` reuses it —
  * the same treatment `rateThrottleHz` got, and for the same reason: the
- * descriptor used to say `snapshot_interval_ms` while the document said
- * seconds, so the cloud converted on one descriptor and not its sibling, with
- * nothing in either file saying so.
+ * two spellings of one interval — milliseconds in a descriptor, seconds in the
+ * document — mean a server converting on one and not the other, with nothing in
+ * either file saying so.
  */
 export const snapshotIntervalSeconds = z.number().int().min(1).max(3600);
 /**

package/dist/errors.js

@@ -112,14 +112,11 @@ export const ERROR_CODES = [
     'email_taken',
     'identifier_taken',
     'weak_password',
-    /* `not_a_member` was removed on 2026-08-29. It had no producer anywhere in
-     * this repository or in the cloud (`grep` found exactly two hits: its own
-     * entry here and a test asserting the entry existed), and its vocabulary was
-     * the deleted model's — "member" of an app's pool, in a platform whose
-     * membership is now a group and whose access is an assignment. A code that
-     * nothing emits and whose noun no longer exists is the third failure mode in
-     * this project's list: a guard written against a state no producer reports.
-     * The refusals that do the work are `forbidden` (silent about existence) and
+    /* `not_a_member` is gone. It had no producer anywhere, and its vocabulary was
+     * a deleted model's — "member" of an app's pool, in a platform whose access is
+     * an assignment. A code that nothing emits, whose noun no longer exists, is a
+     * refusal a consumer must still branch on and can never receive. The refusals
+     * that do the work are `forbidden` (silent about existence) and
      * `tier_required` (about the caller's own tier). */
     /**
      * The account itself is blocked — distinct from `forbidden` on purpose: it
@@ -397,7 +394,7 @@ export const ERROR_CODES = [
     // `WWW-Authenticate` **header**, which is correct and present, not the body.
     //
     // So the rule is about the JSON-RPC layer, and the transport layer below it
-    // is ordinary Fastify. Stating it as "never `apiError` anywhere" was the
+    // is ordinary HTTP. Stating it as "never `apiError` anywhere" was the
     // kind of tidy sentence that is easier to remember than the truth — and
     // this file has now produced two of those about itself.
     //
@@ -416,8 +413,8 @@ export const ERROR_CODES = [
      * flag; the central-MCP cut deleted the per-app `/mcp/<identifier>` endpoint
      * that flag gated, and 2026-08-29 removed the field itself from `app`, so
      * the code stood for a year with nothing able to produce it. The
-     * app-user-auth design brings the per-app endpoint back (D7) with the switch
-     * on `appAuthConfig` rather than on `app`, and this is its refusal again.
+     * per-app endpoint is back, with the switch on `appAuthConfig` rather than on
+     * `app`, and this is its refusal again.
      *
      * The lesson that survives is about the year in between: an enum member with
      * no producer is not harmless, because a reader arriving at it takes it for
@@ -465,7 +462,7 @@ export const ERROR_CODES = [
      * would make a client branch on which route it called.
      */
     'capability_required',
-    // 2026-08-29 — org-central identity (D1/D2).
+    // Org-central identity.
     /**
      * **An org must keep at least one Owner**, so the last one is neither
      * deletable nor demotable. 409, on both `DELETE /api/org/users/:id` and
@@ -481,7 +478,7 @@ export const ERROR_CODES = [
      * caller could infer from a silence about existence.
      */
     'last_owner',
-    // 2026-08-29 — oidc-federation (D3/D4).
+    // OIDC federation.
     /**
      * **The target is in a state that refuses the operation** — not the caller's
      * rights, not the target's existence, but *what the target currently is*.
@@ -545,7 +542,7 @@ export const ERROR_CODES = [
      * `409` from the configuration routes: the draft parses as YAML but its root
      * is not a mapping — a list, a scalar, or an empty document. Distinct from
      * `validation_error`, which is about a field inside a document that *is* one.
-     * Produced by `cloud/src/routes/config.ts`.
+     * Produced by the configuration draft route.
      */
     'draft_not_a_document',
     /**
@@ -553,23 +550,22 @@ export const ERROR_CODES = [
      * it has no mapping for, and the code the realtime socket sends for the same
      * state. It says nothing about the request, deliberately: a caller cannot act
      * on it beyond retrying, and the detail belongs in the server's log rather
-     * than in a body a stranger receives. Produced by `cloud/src/server.ts`'s
-     * error handler and `cloud/src/ws/realtime.ts`.
+     * than in a body a stranger receives. Produced by the server's own error
+     * handler and by the realtime socket.
      */
     'internal_error',
     /**
      * `422` from `POST /api/robots/:id/jobs/:slug/cancel`: the job exists and the
      * caller may address it, but it is in a state that has nothing left to
      * cancel — already settled, or of a kind that does not support cancellation.
-     * Produced by `cloud/src/commands.ts` and mapped in
-     * `cloud/src/routes/commands.ts`.
+     * Produced by the command layer and mapped onto the job routes.
      */
     'not_cancellable',
     /**
      * `415`. The request carried a body in a media type the route does not read.
      * It is the cloud-wide answer from the content-type parser, not one route's:
      * a caller reaching it never got as far as validation, which is why this is
-     * not a `validation_error`. Produced by `cloud/src/server.ts`.
+     * not a `validation_error`. Produced by the server itself.
      */
     'unsupported_media_type',
     /**
@@ -579,16 +575,14 @@ export const ERROR_CODES = [
      * hash recorded on the interaction row.
      *
      * **The impersonation interstitial it also named is deleted** with the rest
-     * of the app OAuth flow (2026-09-05, D1/D2). That page is where this defence
-     * was found missing on a GET rather than a POST — three times over, on three
-     * different screens — which is the reason worth carrying forward: the check
-     * belongs on every verb that *renders* the step, not only on the one that
+     * of the app OAuth flow. The rule that outlives it: this defence goes on
+     * every verb that *renders* the step, not only on the one that
      * completes it.
      *
      * Deliberately not `invalid_token` or `unauthorized`: nothing about the
      * caller's credential is being refused, and the remedy is specific and
-     * actionable — start the flow again in this browser. Produced by
-     * `cloud/src/routes/console-oauth.ts` and `cloud/src/routes/mcp-oauth.ts`.
+     * actionable — start the flow again in this browser. Produced by both
+     * hosted authorization flows.
      */
     'wrong_browser',
     /**
@@ -602,9 +596,8 @@ export const ERROR_CODES = [
      * why nothing noticed. The envelope validates; only the *code* was absent
      * from the one list a client can match against, so a caller branching on
      * `ERROR_CODES` fell through to its unknown-error arm for the single most
-     * common refusal the editor produces. That is this file's own "documented
-     * absence" failure, on the codes list itself. Produced by
-     * `cloud/src/routes/config.ts`.
+     * common refusal an editor produces — a documented absence on the codes list
+     * itself. Produced by the configuration draft route.
      */
     'invalid_yaml',
     /**
@@ -614,7 +607,7 @@ export const ERROR_CODES = [
      *
      * Two codes rather than one, because the two say different things to whoever
      * typed the text: the first means "this is not YAML", the second means "this
-     * is YAML I cannot keep". Produced by `cloud/src/routes/config.ts`.
+     * is YAML I cannot keep". Produced by the configuration draft route.
      */
     'unstorable_yaml',
     // 2026-09-05 — app-user auth (two identity spaces, the JSON client API).

package/dist/identity.d.ts

@@ -2,7 +2,7 @@
 import { z } from 'zod';
 /**
  * **Fleetless users: the org's team, and the only people who reach the
- * console** (spec `2026-09-05-app-user-auth`, D1).
+ * console.**
  *
  * There are two identity spaces now and **nothing joins them**:
  *
@@ -17,7 +17,7 @@ import { z } from 'zod';
  * A Fleetless user who wants to use an app registers or is invited like
  * anybody else; there is no path from one space to the other.
  *
- * **What that deleted, with no successor** (D1): groups and the Org Admins
+ * **What that deleted, with no successor**: groups and the Org Admins
  * group, app assignments, impersonation, the per-user MCP override and the
  * org-level federation policy. The 2026-08-29 model had put developers and end
  * users into one pool per org and connected them with all of the above; in use
@@ -49,7 +49,7 @@ export declare const password: z.ZodString;
 /** The bound on a Fleetless user's display name; `APP_USER_DISPLAY_NAME_MAX` matches it, so a rename cannot be legal in one space and refused in the other. */
 export declare const USER_DISPLAY_NAME_MAX = 120;
 /**
- * **The two tiers a Fleetless user can hold** (D1). Owner-exclusive: delete
+ * **The two tiers a Fleetless user can hold**. Owner-exclusive: delete
  * the org, edit org settings, promote to owner, and later billing. Everything
  * else a Fleetless user may do, a `developer` may do.
  *
@@ -97,7 +97,7 @@ export type PatchOrgResponse = z.infer<typeof patchOrgResponse>;
  * central endpoint), and `has_password`. The last is the interesting one — it
  * existed because a pool user might have been provisioned by an identity
  * provider and hold no Fleetless credential. A Fleetless user always holds
- * one: the console is password-only by design (D1), which removes the
+ * one: the console is password-only by design, which removes the
  * IdP-lockout class entirely, so a field reporting whether the credential
  * exists would have exactly one value forever.
  */
@@ -205,7 +205,7 @@ export declare const waitlistRequest: z.ZodObject<{
 export type WaitlistRequest = z.infer<typeof waitlistRequest>;
 /**
  * Console login. Fleetless users only, always the Fleetless password — the
- * console has no federated door at all (D1), which removes the IdP-lockout
+ * console has no federated door at all, which removes the IdP-lockout
  * class entirely.
  *
  * This resolves a person by address alone, and a Fleetless user's email is
@@ -495,7 +495,7 @@ export type IdpIssuer = z.infer<typeof idpIssuer>;
  * here.** `oidcCallbackErrorCode` and `oidcCallbackError` described the page
  * `GET /mcp/oauth/idp-callback` rendered when a group's identity provider sent
  * a browser back — `jit_disabled` and `email_collision` name provisioning steps
- * only a group provider had. D1 makes Fleetless users password-only and deletes
+ * only a group provider had. Fleetless users are password-only now, which deletes
  * group providers, so the flow that produced these codes cannot start; the
  * route is gone from this manifest and from the cloud.
  *

package/dist/identity.js

@@ -2,7 +2,7 @@
 import { z } from 'zod';
 /**
  * **Fleetless users: the org's team, and the only people who reach the
- * console** (spec `2026-09-05-app-user-auth`, D1).
+ * console.**
  *
  * There are two identity spaces now and **nothing joins them**:
  *
@@ -17,7 +17,7 @@ import { z } from 'zod';
  * A Fleetless user who wants to use an app registers or is invited like
  * anybody else; there is no path from one space to the other.
  *
- * **What that deleted, with no successor** (D1): groups and the Org Admins
+ * **What that deleted, with no successor**: groups and the Org Admins
  * group, app assignments, impersonation, the per-user MCP override and the
  * org-level federation policy. The 2026-08-29 model had put developers and end
  * users into one pool per org and connected them with all of the above; in use
@@ -49,7 +49,7 @@ export const password = z.string().min(12).max(256);
 /** The bound on a Fleetless user's display name; `APP_USER_DISPLAY_NAME_MAX` matches it, so a rename cannot be legal in one space and refused in the other. */
 export const USER_DISPLAY_NAME_MAX = 120;
 /**
- * **The two tiers a Fleetless user can hold** (D1). Owner-exclusive: delete
+ * **The two tiers a Fleetless user can hold**. Owner-exclusive: delete
  * the org, edit org settings, promote to owner, and later billing. Everything
  * else a Fleetless user may do, a `developer` may do.
  *
@@ -95,7 +95,7 @@ export const patchOrgResponse = z.object({
  * central endpoint), and `has_password`. The last is the interesting one — it
  * existed because a pool user might have been provisioned by an identity
  * provider and hold no Fleetless credential. A Fleetless user always holds
- * one: the console is password-only by design (D1), which removes the
+ * one: the console is password-only by design, which removes the
  * IdP-lockout class entirely, so a field reporting whether the credential
  * exists would have exactly one value forever.
  */
@@ -181,7 +181,7 @@ export const signUpResponse = z.object({
 export const waitlistRequest = z.object({ email: z.email().max(254) });
 /**
  * Console login. Fleetless users only, always the Fleetless password — the
- * console has no federated door at all (D1), which removes the IdP-lockout
+ * console has no federated door at all, which removes the IdP-lockout
  * class entirely.
  *
  * This resolves a person by address alone, and a Fleetless user's email is
@@ -472,7 +472,7 @@ export const idpIssuer = z
  * here.** `oidcCallbackErrorCode` and `oidcCallbackError` described the page
  * `GET /mcp/oauth/idp-callback` rendered when a group's identity provider sent
  * a browser back — `jit_disabled` and `email_collision` name provisioning steps
- * only a group provider had. D1 makes Fleetless users password-only and deletes
+ * only a group provider had. Fleetless users are password-only now, which deletes
  * group providers, so the flow that produced these codes cannot start; the
  * route is gone from this manifest and from the cloud.
  *

package/dist/index.js

@@ -32,7 +32,7 @@ export { clientAuth, authOk, authError, clientInvoke, clientCancel, clientPublis
 export { password, org, patchOrgResponse, sessionTokens, refreshRequest, signUpRequest, signUpResponse, 
 // 2026-09-04 — the public site (closed beta).
 waitlistRequest, developerLoginRequest, 
-// 2026-09-05 — the two identity spaces (app-user-auth, D1).
+// The two identity spaces.
 USER_DISPLAY_NAME_MAX, orgAdminTier, fleetlessUser, fleetlessUserListResponse, createTeamInviteRequest, teamInvite, pendingTeamInvite, pendingTeamInviteListResponse, acceptTeamInviteRequest, patchFleetlessUserRequest, tierChangeRequest, 
 // Identity.
 mailStatus, tierRequiredDetails, passwordChangeRequest, passwordResetRequest, passwordResetConfirm, idpIssuer, 
@@ -40,7 +40,7 @@ mailStatus, tierRequiredDetails, passwordChangeRequest, passwordResetRequest, pa
 authMeResponse, patchOrgRequest, patchAuthMeRequest, } from './identity.js';
 export { appIdentifier, app, appListResponse, createAppRequest, updateAppRequest, serverKeyToken, serverKey, serverKeyListResponse, createServerKeyResponse, role, roleListResponse, rolePermissions, } from './apps.js';
 export { clientLoginRequest, clientRefreshRequest, clientLogoutRequest, clientRegisterRequest, clientVerifyEmailRequest, clientResendVerificationRequest, clientPasswordResetRequest, clientPasswordResetConfirmRequest, clientAcceptInvitationRequest, CLIENT_OIDC_CALLBACK_PATH, clientProviderListQuery, clientProviderListResponse, clientOidcStartQuery, clientOidcCallbackQuery, clientOidcExchangeRequest, clientOidcErrorCode, clientMcpInteraction, clientMcpInteractionDecisionResponse, mcpConsentGrant, mcpConsentGrantListResponse, clientIdentity, } from './client-auth.js';
-// 2026-09-05 — the per-app identity space (app-user-auth, D1/D3/D4/D5).
+// The per-app identity space.
 export { APP_USER_DISPLAY_NAME_MAX, APP_URL_PLACEHOLDERS, MAIL_TEMPLATE_VARIABLES, DEFAULT_MAIL_TEMPLATES, providerSlug, appUserStatus, appUser, appUserListResponse, createAppUserRequest, patchAppUserRequest, createAppInvitationRequest, appInvitation, pendingAppInvitation, appInvitationListResponse, appOidcProvider, appOidcProviderListResponse, createAppOidcProviderRequest, patchAppOidcProviderRequest, appUrlTemplate, allowedOrigin, emailDomain, appAuthConfig, putAppAuthConfigRequest, mailTemplateKind, appMailTemplate, appMailTemplateListResponse, putAppMailTemplateRequest, mailTemplatePreviewRequest, mailTemplatePreviewResponse, mailTemplateProblemDetails, mailOutcome, } from './app-users.js';
 export { assetKind, URDF_ASSET_NAME, asset, urdfCompleteness, assetListResponse, missingAssetQuery, assetSyncRequest, assetSyncResponse, assetSyncState, assetSyncStatus, assetFailure, assetFailureKind, assetTooLargeDetails, assetSyncBusyDetails, ASSET_UPLOAD_MAX_BYTES, } from './assets.js';
 export { auditActor, auditEvent, auditQuery, auditListResponse, AUDIT_CSV_COLUMNS, AUDIT_RETENTION_DAYS } from './audit.js';

package/dist/jobs.d.ts

@@ -163,7 +163,7 @@ export declare const JOB_RUN_RETENTION_DAYS = 90;
  * invites every reader to handle it.
  *
  * **`app_user` is what a client-app caller writes now, and `end_user` stays**
- * (app-user auth, D1). The seam this comment used to describe — two names for
+ * identity spaces. The seam this comment used to describe — two names for
  * two ways into one merged pool — is settled: the two identity spaces are
  * separate tables again, and `app_user` is a row in `app_users`, belonging to
  * exactly one app. `end_user` is kept for the same reason `auditActor.kind`
@@ -188,10 +188,10 @@ export declare const jobRunKind: z.ZodEnum<{
 }>;
 export type JobRunKind = z.infer<typeof jobRunKind>;
 /**
- * One durable record of one invocation (spec `2026-08-20-timeseries-and-run-history`,
- * D2). One row per run, never one per event: the per-event timeline's write rate
+ * One durable record of one invocation. One row per run, never one per event:
+ * the per-event timeline's write rate
  * is set by the bridge, and a throttled log that cannot say it was throttled is
- * the instrument this codebase refuses everywhere else. The live timeline is
+ * an instrument that cannot say what it does not know. The live timeline is
  * delivered in full by realtime, for as long as somebody is watching.
  */
 export declare const jobRun: z.ZodObject<{

package/dist/jobs.js

@@ -166,7 +166,7 @@ export const JOB_RUN_RETENTION_DAYS = 90;
  * invites every reader to handle it.
  *
  * **`app_user` is what a client-app caller writes now, and `end_user` stays**
- * (app-user auth, D1). The seam this comment used to describe — two names for
+ * identity spaces. The seam this comment used to describe — two names for
  * two ways into one merged pool — is settled: the two identity spaces are
  * separate tables again, and `app_user` is a row in `app_users`, belonging to
  * exactly one app. `end_user` is kept for the same reason `auditActor.kind`
@@ -192,10 +192,10 @@ export const jobActor = z.object({
 });
 export const jobRunKind = z.enum(['action', 'service']);
 /**
- * One durable record of one invocation (spec `2026-08-20-timeseries-and-run-history`,
- * D2). One row per run, never one per event: the per-event timeline's write rate
+ * One durable record of one invocation. One row per run, never one per event:
+ * the per-event timeline's write rate
  * is set by the bridge, and a throttled log that cannot say it was throttled is
- * the instrument this codebase refuses everywhere else. The live timeline is
+ * an instrument that cannot say what it does not know. The live timeline is
  * delivered in full by realtime, for as long as somebody is watching.
  */
 export const jobRun = z.object({

package/dist/mcp.d.ts

@@ -36,7 +36,7 @@ export declare const MCP_PROTOCOL_VERSION: "2025-11-25";
  *
  * **Not parameterised, and that is now a statement rather than the absence of
  * one.** The central endpoint serves the org's team with the console tool
- * family (2026-09-05, D7); an app's users reach a different endpoint, whose
+ * family; an app's users reach a different endpoint, whose
  * path `mcpAppEndpointPath` builds. Two constants for two audiences, so a call
  * site says which it means instead of an argument deciding it.
  *
@@ -48,7 +48,7 @@ export declare const MCP_PROTOCOL_VERSION: "2025-11-25";
  */
 export declare const MCP_ENDPOINT_PATH: "/mcp";
 /**
- * The path of **one app's** MCP server (D7) — what an app user pastes into
+ * The path of **one app's** MCP server — what an app user pastes into
  * their AI tool, served only while the app's `appAuthConfig.mcp_enabled` is on.
  *
  * A helper rather than a template literal at four call sites, for
@@ -72,7 +72,7 @@ export declare const MCP_ENDPOINT_PATH: "/mcp";
 export declare function mcpAppEndpointPath(appIdentifier: string): string;
 /**
  * **Every path one app's MCP server answers on, built from its identifier
- * once** (D7).
+ * once**.
  *
  * Six strings, and each of them is spelled in at least three places that
  * cannot see one another: the cloud registers the route, the console renders a