@fleetless/contracts 1.0.2 → 1.0.4

package/dist/mcp.js

@@ -37,7 +37,7 @@ export const MCP_PROTOCOL_VERSION = '2025-11-25';
  *
  * **Not parameterised, and that is now a statement rather than the absence of
  * one.** The central endpoint serves the org's team with the console tool
- * family (2026-09-05, D7); an app's users reach a different endpoint, whose
+ * family; an app's users reach a different endpoint, whose
  * path `mcpAppEndpointPath` builds. Two constants for two audiences, so a call
  * site says which it means instead of an argument deciding it.
  *
@@ -49,7 +49,7 @@ export const MCP_PROTOCOL_VERSION = '2025-11-25';
  */
 export const MCP_ENDPOINT_PATH = '/mcp';
 /**
- * The path of **one app's** MCP server (D7) — what an app user pastes into
+ * The path of **one app's** MCP server — what an app user pastes into
  * their AI tool, served only while the app's `appAuthConfig.mcp_enabled` is on.
  *
  * A helper rather than a template literal at four call sites, for

package/dist/oauth.d.ts

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 import { z } from 'zod';
 /**
- * **OAuth 2.1, and it remains only for MCP** (2026-09-05 app-user-auth, D8).
+ * **OAuth 2.1, and it remains only for MCP.**
  *
  * This file used to describe two front doors: an app's end users signing in
  * through a Fleetless-hosted, app-branded login page, and MCP clients signing
@@ -172,10 +172,9 @@ export type DynamicClientRegistrationResponse = z.infer<typeof dynamicClientRegi
  * **The MCP token endpoint's request — one grant, because the servers serve
  * one.**
  *
- * Both authorization servers, central and per-app, exchange through
- * `exchangeMcpAuthorizationCode` (`cloud/src/mcp-oauth-core.ts`), whose first
- * act is to refuse anything but `authorization_code` before a single lookup
- * happens. There is no refresh grant here: a session ends when its token
+ * Both authorization servers, central and per-app, exchange through one
+ * implementation, whose first act is to refuse anything but
+ * `authorization_code` before a single lookup happens. There is no refresh grant here: a session ends when its token
  * expires and the client signs in again.
  *
  * **This was a `discriminatedUnion` with a `refresh_token` branch, and that
@@ -302,7 +301,7 @@ export type OauthRedirectResponse = z.infer<typeof oauthRedirectResponse>;
  * shape and the documentation, not the error path.
  *
  * **Four route entries point at it**: `GET /mcp/oauth/authorize` and
- * `GET /mcp/:appIdentifier/oauth/authorize` (D7), which read the same wire.
+ * `GET /mcp/:appIdentifier/oauth/authorize`, which read the same wire.
  * They spent a release naming nothing — the app-level `/oauth/authorize` this
  * was written for was deleted, and `query: null` was read as "there is no
  * query here" rather than as "the handler reads it by hand" — and the eight
@@ -325,10 +324,10 @@ export type OauthAuthorizeQuery = z.infer<typeof oauthAuthorizeQuery>;
  *
  * It carried one parameter, `app_identifier`, on the argument that RFC 7591's
  * registration body has no field for it and one endpoint could serve every
- * app. It was kept — explicitly, in its own doc comment — "for the per-app MCP
- * registration the MCP train adds (D7), which needs exactly this parameter".
+ * app. It was kept — explicitly, in its own doc comment — for a per-app MCP
+ * registration that was said to need exactly this parameter.
  *
- * **That train shipped and needed no such parameter.** `POST
+ * **That registration shipped and needed no such parameter.** `POST
  * /mcp/:appIdentifier/oauth/register` puts the app in the **path**, built by
  * `MCP_APP_PATHS`, and `resolveAppMcpTarget` reads it from `request.params`;
  * `registerMcpDynamicClient` never looks at a query at all. So the one reason

package/dist/oauth.js

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 import { z } from 'zod';
 /**
- * **OAuth 2.1, and it remains only for MCP** (2026-09-05 app-user-auth, D8).
+ * **OAuth 2.1, and it remains only for MCP.**
  *
  * This file used to describe two front doors: an app's end users signing in
  * through a Fleetless-hosted, app-branded login page, and MCP clients signing
@@ -77,8 +77,8 @@ export const oauthError = z.object({
      * makes the two indistinguishable to the caller, and *a field that cannot
      * express a distinction produces a workaround somewhere else*. Answering in
      * `apiError` instead would keep the distinction and hand an RFC-compliant
-     * client a body it cannot parse — which is the conformance this wave exists
-     * to provide.
+     * client a body it cannot parse, which is the conformance this dialect
+     * exists to provide.
      *
      * So both: `error` is what a standard client reads, `fleetless_code` is what
      * our own tooling switches on. RFC 6749 §5.2 permits additional members, and
@@ -107,8 +107,7 @@ export const redirectUri = z
     .refine((v) => {
     // Parsed, not prefix-matched. `startsWith('https://')` alone accepts the
     // literal string `https://` and anything else that merely opens with
-    // those characters — a shape check standing in for a value check, which
-    // is the failure this project keeps meeting under other names.
+    // those characters — a shape check standing in for a value check.
     let url;
     try {
         url = new URL(v);
@@ -232,10 +231,9 @@ export const dynamicClientRegistrationResponse = z.object({
  * **The MCP token endpoint's request — one grant, because the servers serve
  * one.**
  *
- * Both authorization servers, central and per-app, exchange through
- * `exchangeMcpAuthorizationCode` (`cloud/src/mcp-oauth-core.ts`), whose first
- * act is to refuse anything but `authorization_code` before a single lookup
- * happens. There is no refresh grant here: a session ends when its token
+ * Both authorization servers, central and per-app, exchange through one
+ * implementation, whose first act is to refuse anything but
+ * `authorization_code` before a single lookup happens. There is no refresh grant here: a session ends when its token
  * expires and the client signs in again.
  *
  * **This was a `discriminatedUnion` with a `refresh_token` branch, and that
@@ -398,14 +396,13 @@ export const oauthRedirectResponse = z.object({
  * differently, and it worked — but every path it held belonged to the app-level
  * OAuth flow (`authorize`, `token`, `register`, `consent`, `login`,
  * `impersonate`, `idpCallback`) or to the stub resource's metadata documents,
- * and OAuth 2.1 now remains only for MCP (D8). The MCP authorization server
- * builds its own paths in `cloud/src/routes/mcp-oauth.ts`, where they are read
- * by one file rather than by two repositories.
+ * and OAuth 2.1 now remains only for MCP. The MCP authorization server builds
+ * its own paths, where they are read by one file rather than by two.
  *
- * Deleted rather than left with the four entries whose routes this train also
- * removes, because that is precisely the defect this constant was created after
- * and then reproduced: its `idpStart` entry named a route the cloud had deleted
- * and stood for months with nothing noticing. A constant whose every value
+ * Deleted rather than left holding entries whose routes are gone, which is the
+ * defect it was created to prevent and then reproduced: an entry naming a route
+ * the server had deleted stood for months with nothing noticing. A constant
+ * whose every value
  * names a deleted route is that failure at full size.
  */
 /**
@@ -421,7 +418,7 @@ export const oauthRedirectResponse = z.object({
  * shape and the documentation, not the error path.
  *
  * **Four route entries point at it**: `GET /mcp/oauth/authorize` and
- * `GET /mcp/:appIdentifier/oauth/authorize` (D7), which read the same wire.
+ * `GET /mcp/:appIdentifier/oauth/authorize`, which read the same wire.
  * They spent a release naming nothing — the app-level `/oauth/authorize` this
  * was written for was deleted, and `query: null` was read as "there is no
  * query here" rather than as "the handler reads it by hand" — and the eight
@@ -455,10 +452,9 @@ export const oauthAuthorizeQuery = z
     // **No `scope`, because this authorization server issues none.** The field
     // was here describing itself as "carried onto the interaction and read
     // again at consent"; neither authorize handler reads it, the interaction
-    // row has no column for it, and the consent screen answers `scopes: []`
-    // from a comment that says so in as many words
-    // (`cloud/src/routes/client-mcp-interactions.ts`). A parameter documented
-    // as carried and in fact dropped is worse than one that is absent.
+    // row has no column for it, and the consent screen answers `scopes: []`.
+    // A parameter documented as carried and in fact dropped is worse than one
+    // that is absent.
 })
     .meta({
     description: 'The authorization request an MCP client sends, per RFC 6749 §4.1.1 with mandatory PKCE. The handler reads it parameter by parameter rather than through one parse, because the answers differ: `client_id` and `redirect_uri` are refused flat, with no redirect, since until both are confirmed there is no trusted target to bounce a browser to, and everything after them is reported to the client\'s own callback as query parameters.',
@@ -468,10 +464,10 @@ export const oauthAuthorizeQuery = z
  *
  * It carried one parameter, `app_identifier`, on the argument that RFC 7591's
  * registration body has no field for it and one endpoint could serve every
- * app. It was kept — explicitly, in its own doc comment — "for the per-app MCP
- * registration the MCP train adds (D7), which needs exactly this parameter".
+ * app. It was kept — explicitly, in its own doc comment — for a per-app MCP
+ * registration that was said to need exactly this parameter.
  *
- * **That train shipped and needed no such parameter.** `POST
+ * **That registration shipped and needed no such parameter.** `POST
  * /mcp/:appIdentifier/oauth/register` puts the app in the **path**, built by
  * `MCP_APP_PATHS`, and `resolveAppMcpTarget` reads it from `request.params`;
  * `registerMcpDynamicClient` never looks at a query at all. So the one reason

package/dist/realtime.js

@@ -295,7 +295,7 @@ export const liveSessionEndReason = z.enum([
     /**
      * The cloud ended it and cannot say which of the above applied. **Kept
      * deliberately**: a channel that cannot say "I do not know" will say
-     * something false instead, and this project has paid for that four times in
+     * something false instead, which is the costlier failure in
      * the camera path alone.
      */
     'unknown',

package/dist/rest.d.ts

@@ -829,7 +829,7 @@ export type ServiceCallResponse = z.infer<typeof serviceCallResponse>;
  * **This union exists so the route can name a response at all.** The entry
  * carried `response: null` while the handler demonstrably answers something,
  * which reads in the generated reference as *this route returns nothing* —
- * the documented absence this project keeps paying for. A `null` there should
+ * a documented absence. A `null` there should
  * mean `204`, and on this route it did not.
  */
 export declare const invokeOrServiceResponse: z.ZodUnion<readonly [z.ZodObject<{

package/dist/rest.js

@@ -416,7 +416,7 @@ export const serviceCallResponse = z.object({
  * **This union exists so the route can name a response at all.** The entry
  * carried `response: null` while the handler demonstrably answers something,
  * which reads in the generated reference as *this route returns nothing* —
- * the documented absence this project keeps paying for. A `null` there should
+ * a documented absence. A `null` there should
  * mean `204`, and on this route it did not.
  */
 export const invokeOrServiceResponse = z.union([invokeResponse, serviceCallResponse]);
@@ -546,7 +546,7 @@ export const jobResponse = z.object({
  * surface minted it cannot be routed correctly by anything.
  *
  * So the link shapes are fixed here rather than in whichever repo builds them.
- * **They moved to the auth portal** (auth-portal spec `2026-08-30`, D-A1): the
+ * **They moved to the auth portal**: the
  * console serves no credential page at all any more, and `{portal}` is the
  * cloud's `AUTH_PUBLIC_URL` — `auth.fleetless.dev` where the deployment has
  * that vhost, the cloud's own base where it does not, since the cloud renders
@@ -558,7 +558,7 @@ export const jobResponse = z.object({
  * | team invitation                | `{portal}/accept-invite/{token}` |
  *
  * **An app user's links are not in this table, and cannot be** (2026-09-05,
- * D2/D5). Fleetless renders an app user no page, so there is no `{portal}` path
+ * Fleetless renders an app user no page, so there is no `{portal}` path
  * to name: the link points into the **developer's own app**, at the template
  * they configured (`appAuthConfig.invite_url`, `verify_url`, `reset_url`), with
  * the token substituted for `{token}`. That is why those fields are validated
@@ -569,7 +569,7 @@ export const jobResponse = z.object({
  * not a row to restore"*. It was designed; the answer was that the row belongs
  * to the developer and not to this table.
  *
- * The strings themselves live in `cloud/src/portal-paths.ts`, read by the
+ * The strings themselves live server-side, read by the
  * route that serves each page AND by the builder that mails it — one constant,
  * because the defect this table records happened again after it was written:
  * the mailer, the page and this table can each spell a path differently, and

package/dist/routes.js

@@ -63,45 +63,43 @@ export const IN_HANDLER_ROUTES = [
  * **The three refusals every `auth: 'developer'` route inherits from its guard**,
  * spelled once rather than retyped eighty times.
  *
- * They are the arms of `cloud/src/auth.ts`'s `requireDeveloper`: no bearer or an
- * unverifiable one is `401 unauthorized`, an expired one `401 token_expired`, a
+ * They are the arms of the developer guard: no bearer or an unverifiable one is
+ * `401 unauthorized`, an expired one `401 token_expired`, a
  * vanished account or a bumped `token_version` `401 token_revoked`.
  *
  * **Three, not four: `403 forbidden` went with the Org Admins group.** It stood
  * for "an account that is no longer in the org's Org Admins group", and the
- * two-space cut leaves a Fleetless user who IS the team — `TokenRefusalReason`
- * in `cloud/src/auth.ts` is `'expired' | 'revoked' | 'invalid'`, and
- * `createRequireDeveloper` answers 401 codes only. A removed team member now
- * gets `401 token_revoked`; a reader of the API reference who branched on
+ * two identity spaces leave a Fleetless user who IS the team, and the guard's
+ * refusal reasons are `'expired' | 'revoked' | 'invalid'` — 401 codes only. A
+ * removed team member gets `401 token_revoked`; a reader of the API reference
+ * who branched on
  * `forbidden` to render "you lost console access" was branching on an answer no
  * developer-guarded route can send. The `forbidden` producers that remain
  * (`history.ts`, `commands.ts`, `cameras.ts`, `robots.ts`, `mcp.ts`) all sit on
  * `developer_or_client` or MCP surfaces, which is why `CLIENT_GUARD` keeps it.
  *
  * **Not `invalid_token`.** That code exists in `ERROR_CODES` and this guard has
- * never sent it; the three above are what `sendTokenRefusal` actually maps to.
- * Said plainly because the planning note for this file assumed otherwise, and a
- * documented refusal a caller cannot receive is the third failure mode in
- * CLAUDE.md's list.
+ * never sent it; the three above are what the token refusal actually maps to.
+ * Said plainly, because a documented refusal a caller cannot receive is worse
+ * than an undocumented one: a consumer branches on it and the branch is dead.
  */
 const DEVELOPER_GUARD = ['unauthorized', 'token_expired', 'token_revoked'];
 /**
- * The same, for `auth: 'developer_or_client'` — `createRequireDeveloperOrClient`,
- * which resolves a developer bearer, an end-user bearer **or** a server key
- * through one `resolveAnyToken`.
+ * The same, for `auth: 'developer_or_client'` — one guard resolving a developer
+ * bearer, an end-user bearer **or** a server key through a single token lookup.
  *
- * **The same four codes, not five.** `sendTokenRefusal` has a fifth arm,
- * `account_blocked`, and this list carried it for exactly one commit. Nothing
- * reaches it: `TokenRefusalReason` admits `'blocked'`, but no site in
- * `cloud/src` constructs one — the only reasons ever returned are `'invalid'`,
- * `'revoked'` and `'forbidden'`. `auth.ts` says why on the line where the check
- * used to be: D2 replaced "block the account" with "remove the assignment", so
- * an app user who loses access loses it because no assignment resolves, and
- * there is no blocked state left to re-check.
+ * **The same four codes, not five.** The token refusal has a fifth arm,
+ * `account_blocked`, which this list must not carry. Nothing reaches it: the
+ * refusal type admits `'blocked'`, but no site in
+ * the cloud constructs one — the only reasons ever returned are `'invalid'`,
+ * `'revoked'` and `'forbidden'`. Access is withdrawn by removing an assignment
+ * rather than by blocking an account, so an app user who loses access loses it
+ * because no assignment resolves, and there is no blocked state left to
+ * re-check.
  *
  * Listing it would have documented a refusal no caller can receive — the same
- * mistake as the `invalid_token` above, found by review rather than by any test
- * here, because a code in `ERROR_CODES` satisfies every check this file has.
+ * mistake as the `invalid_token` above. No check here catches it, because a
+ * code in `ERROR_CODES` satisfies every one of them.
  *
  * It keeps `forbidden`, which `DEVELOPER_GUARD` no longer carries: this guard's
  * routes have live 403 producers — a slug the role does not grant
@@ -420,7 +418,7 @@ export const ROUTES = [
             'listing beside it. `POST /api/client/register` answers `202` to the same fact, because there the caller is a stranger. `404 not_found` ' +
             'is the app, or a `role_id` that is not a role of it — a role of another app is refused rather than stored, since a user holding one ' +
             'would carry rights nothing in this app can resolve. **The password policy answers `400 validation_error`**, not a code of its own: the ' +
-            'twelve-character minimum is the `password` field\'s schema rule, and every route in this repository that takes a password refuses a ' +
+            'twelve-character minimum is the `password` field\'s schema rule, and every route that takes a password refuses a ' +
             'short one exactly the way it refuses any other malformed field. An account created here is `active` immediately: a developer entering ' +
             'somebody by hand has made the decision the verification mail automates, and its address counts as proven. `409 target_state_conflict` ' +
             'names `default_role_id` when `role_id` is absent and the app has no default role, or its default names a role that no longer resolves ' +
@@ -590,7 +588,7 @@ export const ROUTES = [
             '`POST /api/client/invitations/accept`, the same answer one that expired or never existed gets — the developer withdrew it deliberately, ' +
             'and an answer saying so would tell whoever still holds the link that it was once real.',
     },
-    /* --------------------------------------- the app's OIDC providers (D4) */
+    /* ------------------------------------------- the app's OIDC providers */
     {
         method: 'GET', path: '/api/apps/:id/oidc-providers', section: 'apps',
         summary: "Lists every OIDC provider configured on the app, enabled or not.",
@@ -975,7 +973,7 @@ export const ROUTES = [
         audience: 'internal', auth: 'none', rateLimited: true, ownerTier: false, status: 200,
         params: [], query: null, request: null, response: null,
         errors: ['rate_limited', 'validation_error', 'token_spent'], transport: 'http',
-        notes: 'The identifier-first step, with nothing left to identify: Fleetless users are password-only (design D1/D7), so **this step does not ' +
+        notes: 'The identifier-first step, with nothing left to identify: Fleetless users are password-only, so **this step does not ' +
             'read the address at all** — it renders the password card for a known address, an unknown one and an empty one alike, and the login ' +
             'step below answers the same `401` for all three. That is a property of the shape rather than of two branches agreeing: there is no ' +
             'lookup here whose result could differ. A browser form post gets the password card; a JSON caller gets `{ "next" }`, which has no ' +
@@ -1133,10 +1131,10 @@ export const ROUTES = [
             'a token belongs to its own app\'s endpoint. The code is `forbidden` rather than `mcp_disabled` because nothing is switched off — the ' +
             'caller is at the wrong server — and per-app sign-in mints exactly such tokens, so the two states must not share a word. ' +
             '`mcp_access_denied` is gone with the per-user override and the ' +
-            'group flag it read: every Fleetless user has MCP access here (D1). Stateless: a fresh transport per request, no session id, nothing ' +
+            'group flag it read: every Fleetless user has MCP access here. Stateless: a fresh transport per request, no session id, nothing ' +
             'survives the call.',
     },
-    /* ----------------------------------------- mcp (one app's own server, D7) */
+    /* --------------------------------------------- mcp (one app's own server) */
     {
         method: 'POST', path: MCP_APP.endpoint, section: 'mcp',
         summary: "One app's MCP endpoint: the same stateless Streamable HTTP transport, carrying that app's robots.",
@@ -1174,11 +1172,11 @@ export const ROUTES = [
         notes: 'MCP\'s Streamable HTTP gives this path three verbs: `POST` carries JSON-RPC, `GET` opens the server-initiated SSE stream, and `DELETE` ' +
             'ends a session. This server has no sessions — the argument is in `MCP_PROTOCOL_VERSION`\'s own note, and a per-process session map is ' +
             'what breaks at the second cloud instance — so `GET` and `DELETE` answer `405`, which is what a client is built to fall back from. ' +
-            '\n\n**The `405` is this cloud\'s own answer, not the SDK\'s**, and the difference was measured: MCP SDK 1.30.0 opens an SSE stream on ' +
+            '\n\n**The `405` is this cloud\'s own answer, not the SDK\'s**, and the two differ: MCP SDK 1.30.0 opens an SSE stream on ' +
             '`GET` (`handleGetRequest`) and answers `200` on `DELETE` (`handleDeleteRequest`), neither of which a stateless server has any ' +
             'business doing, so the cloud writes the `405` itself in the transport\'s own JSON-RPC error shape with `Allow: POST`. \n\n**The row exists so that the `405` is not a `404`.** An unregistered verb answers ' +
             '`404`, and at a path whose last segment is an app identifier a `404` already means *no such app* — one answer for two states, which is ' +
-            'the failure this project keeps paying for. Registering the verb lets the endpoint say "this app\'s server is here; this verb is not ' +
+            'one answer for two states. Registering the verb lets the endpoint say "this app\'s server is here; this verb is not ' +
             'part of it". The central `/mcp` registers neither verb and does not need to: its path takes no parameter, so nothing can misread its ' +
             '`404`. \n\n**The `405` body is the transport\'s JSON-RPC error object, not the `apiError` envelope.** The three codes above are the ' +
             'refusals that come *first* — the app, its switch, then the bearer, in the order `POST` describes — and they are `apiError` because ' +
@@ -1228,7 +1226,7 @@ export const ROUTES = [
             'canonical public base, never from the friendly `mcp.fleetless.dev` alias or the request\'s `Host`**, because a client checks a minted ' +
             'token\'s `iss` and `aud` against these exact strings. \n\n**Unlike the central document, `authorization_endpoint` does not move to an ' +
             'auth-portal origin**, and there is nothing here for one to serve: this authorization step renders no Fleetless page at all. It ' +
-            'redirects to the app\'s own `mcp_login_url` (D7), which is on the developer\'s origin already.',
+            'redirects to the app\'s own `mcp_login_url`, which is on the developer\'s origin already.',
     },
     {
         method: 'POST', path: MCP_APP.register, section: 'mcp',
@@ -1236,7 +1234,7 @@ export const ROUTES = [
         audience: 'client', auth: 'none', rateLimited: true, ownerTier: false, status: 201,
         params: [APP_IDENTIFIER], query: null, request: dynamicClientRegistrationRequest, response: dynamicClientRegistrationResponse,
         errors: ['rate_limited', 'not_found'], transport: 'http',
-        notes: 'RFC 7591, the same wire and the same handler as `POST /mcp/oauth/register` — `registerMcpDynamicClient`, one implementation, because a ' +
+        notes: 'RFC 7591, the same wire and the same handler as `POST /mcp/oauth/register` — one implementation, because a ' +
             'second answer to "is this redirect URI acceptable" would agree with the first only by luck. The request schema is what the endpoint ' +
             'accepts rather than what it parses, for the reason that row gives: §3.2.2 needs two distinguishable refusals and one `safeParse` ' +
             'failure offers one. `client_name` and `redirect_uris` are read; `grant_types`, `response_types` and `scope` are accepted and ignored, ' +
@@ -1256,7 +1254,7 @@ export const ROUTES = [
         params: [APP_IDENTIFIER], query: oauthAuthorizeQuery, request: null, response: null,
         errors: ['not_found', 'target_state_conflict'], transport: 'http',
         notes: 'The same query as `GET /mcp/oauth/authorize`, read the same way — parameter by parameter, because the answers differ and one parse ' +
-            'would collapse them. \n\n**Fleetless renders no page here, and that is the whole of D7.** The route writes an interaction — ten minutes, as the OIDC ones live ' +
+            'would collapse them. \n\n**Fleetless renders no page here**, and that is the whole of it. The route writes an interaction — ten minutes, as the OIDC ones live ' +
             '— and redirects to `appAuthConfig.mcp_login_url` with `{interaction}` filled in. The app then authenticates the person with its own ' +
             'UI, reads `GET /api/client/mcp/interactions/:id` to show the client\'s claimed name and the scopes it asked for, and calls approve or ' +
             'deny. \n\nClient and `redirect_uri` are validated first and a failure there never redirects — the open-redirect discipline `GET ' +
@@ -1273,7 +1271,7 @@ export const ROUTES = [
             'under `/api/client/mcp/interactions/:id`. `409 ' +
             'target_state_conflict` names `mcp_login_url` with rule `not_set`: MCP is enabled and no page is configured to send the person to. It ' +
             'is the same code and the same shape `send_mail` answers for an unconfigured `invite_url`, and the refusal is the honest one — ' +
-            'Fleetless has nowhere to redirect, and rendering a page of its own instead would contradict D2.',
+            'Fleetless has nowhere to redirect, and rendering a page of its own would contradict the rule that Fleetless shows an app user no page.',
     },
     {
         method: 'POST', path: MCP_APP.token, section: 'mcp',
@@ -1516,7 +1514,7 @@ export const ROUTES = [
             '\n\n**It lists `rate_limited` and no other code, because every sign-in outcome it has is a redirect.** Success and failure alike are ' +
             'a `302` to the app\'s own ' +
             '`redirect_uri`: `?code=…&state=…` when a session was resolved, `?error=<clientOidcErrorCode>&state=…` when it was not, so the app ' +
-            'renders its own message and can bind either answer to the request it started. Fleetless shows an app user no page (D2). \n\n**The one ' +
+            'renders its own message and can bind either answer to the request it started. Fleetless shows an app user no page. \n\n**The one ' +
             'exception is a `state` that resolves to no interaction** — unknown, hand-edited, or past its ten minutes. Then there is no confirmed ' +
             'redirect target to carry the answer to, and bouncing a browser to an unvalidated one is the hole the whole flow is arranged to avoid, ' +
             'so the cloud renders an HTML problem page at `400`. That is the only Fleetless-rendered surface an app user can reach. It is HTML ' +
@@ -1539,7 +1537,7 @@ export const ROUTES = [
             'is, not how vague the answer is: a mailed one-time code is a credential, an interaction id names a pending request, and the two ' +
             'deserve different advice on the app\'s own page.',
     },
-    /* --------------------------- the app's own MCP consent screen (D7) */
+    /* ------------------------------- the app's own MCP consent screen */
     {
         method: 'GET', path: '/api/client/mcp/interactions/:id', section: 'client-auth',
         summary: 'Reads a pending MCP authorization so the app can draw its own consent screen.',
@@ -1574,7 +1572,7 @@ export const ROUTES = [
         query: null, request: null, response: clientMcpInteractionDecisionResponse,
         errors: [...CLIENT_GUARD, 'rate_limited', 'interaction_expired', 'mcp_disabled'], transport: 'http',
         notes: 'The person is already signed in **at the app**, by whatever means that app uses, and this is the app telling Fleetless what they ' +
-            'decided. Fleetless never sees that sign-in, which is D7 in one sentence. \n\nThe guard admits all three caller kinds and the handler ' +
+            'decided. Fleetless never sees that sign-in. \n\nThe guard admits all three caller kinds and the handler ' +
             'takes one: a developer bearer or a server key reaching this is `401 unauthorized`, because a consent is a person\'s and a server key ' +
             'is not a person — the same shape `POST /api/client/password/change` has. `403 mcp_disabled` is the app\'s switch, re-read here as it is ' +
             'on every request — and it is the one refusal on this surface that names the switch, because reaching it needs an app-user session ' +
@@ -1615,7 +1613,7 @@ export const ROUTES = [
         params: [], query: null, request: null, response: mcpConsentGrantListResponse,
         errors: [...CLIENT_GUARD], transport: 'http',
         notes: '**So the developer\'s app can offer a "connected apps" screen of its own**, which is the only place an end user could ever be shown ' +
-            'this: Fleetless renders no page for an app\'s users (D2), and the console is the developer\'s tool rather than their customers\'. ' +
+            'this: Fleetless renders no page for an app\'s users, and the console is the developer\'s tool rather than their customers\'. ' +
             '\n\nThe answer is about the bearer\'s own account and takes no user id — there is no id to pass and therefore nothing to pass the ' +
             'wrong one. The guard admits all three caller kinds because it is shared, and the handler takes one: a developer bearer or a server ' +
             'key is `401 unauthorized`, the shape `POST /api/client/password/change` has, because a consent is a person\'s and a server key is not ' +
@@ -1937,7 +1935,7 @@ export const ROUTES = [
         errors: [...CLIENT_GUARD, 'invalid_uuid', 'not_found', 'capability_required', 'validation_error'], transport: 'http',
         notes: 'Needs the `action_history` capability, and **this route is what makes that switch mean something** — it was unkeepable while nothing ' +
             'durable recorded what had run. Two residuals worth stating rather than implying away. `history` is a syntactically valid slug and ' +
-            'Fastify matches a static segment first, so a robot with a service literally slugged `history` can no longer be **read** through ' +
+            'The router matches a static segment first, so a robot with a service literally slugged `history` can no longer be **read** through ' +
             '`GET /api/robots/:id/jobs/:slug`; invoking, cancelling and the listing are unaffected. And a run row names its actor by email address, ' +
             'so an end user holding this capability learns which other people have been driving the machine. `robot_id` in the query is shared with ' +
             'the org-wide read; a *different* one here is refused rather than quietly answered about the robot in the path.',
@@ -2278,7 +2276,7 @@ export const ROUTES = [
             'upload token minted by `POST /api/robots/:id/assets/sync`, verified in a `preParsing` hook so a refusal precedes the work rather than ' +
             'following it: a `preHandler` would already have buffered the whole file. The announced size is refused there too, before a single byte ' +
             'is read — it is an announcement and not a proof, so it only ever rejects early and never accepts early, and a body that lies small is ' +
-            'still caught by the real length check. Past both, Fastify\'s own body limit answers a bare `413 bad_request` with neither ceiling nor ' +
+            'still caught by the real length check. Past both, the server\'s own body limit answers a bare `413 bad_request` with neither ceiling nor ' +
             'size in it. Rate limited per robot inside that same hook, which is why `rateLimited` is `false`: there is no rate-limiting preHandler ' +
             'registered on this route.',
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fleetless/contracts",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "Fleetless wire contracts: the bridge-cloud protocol, the REST API schemas and the error codes, as zod schemas with generated JSON Schema and OpenAPI artifacts.",
   "license": "Apache-2.0",
   "author": "Dehne Robotik GmbH",