@fleetless/contracts 1.0.3 → 1.0.4

package/CHANGELOG.md

@@ -5,6 +5,25 @@ follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the
 project uses [semantic versioning](https://semver.org/spec/v2.0.0.html) over
 the wire shapes.
 
+## [1.0.4] — 2026-09-07
+
+Two things a grep over the published 1.0.3 tarball found that the guard was not
+looking for. **No wire shape changes**; `artifacts/` is byte-identical to 1.0.3.
+
+### Fixed
+
+- **A published `dist/` comment cited `CLAUDE.md`** and two internal server
+  symbols by name. Rewritten to say what the rule is rather than where it is
+  written down.
+- **The markdown this package ships was outside the guard.** `README.md`,
+  `CHANGELOG.md`, `SECURITY.md`, `CONTRIBUTING.md` and `CODE_OF_CONDUCT.md` are
+  published bytes like any other, and nothing was scanning them. They are now
+  swept for every marker class — with the stance classes deliberately exempt,
+  because those documents are legitimately *about* this repository and a guard
+  that reddened on "this repository is a schema library" would be demanding they
+  stop addressing their reader.
+- **A new marker class**: a reference to a file only the maintainers have.
+
 ## [1.0.3] — 2026-09-07
 
 The second half of 1.0.2's sweep. **No wire shape changes**: every file under

package/dist/routes.js

@@ -79,20 +79,18 @@ export const IN_HANDLER_ROUTES = [
  * `developer_or_client` or MCP surfaces, which is why `CLIENT_GUARD` keeps it.
  *
  * **Not `invalid_token`.** That code exists in `ERROR_CODES` and this guard has
- * never sent it; the three above are what `sendTokenRefusal` actually maps to.
- * Said plainly because the planning note for this file assumed otherwise, and a
- * documented refusal a caller cannot receive is the third failure mode in
- * CLAUDE.md's list.
+ * never sent it; the three above are what the token refusal actually maps to.
+ * Said plainly, because a documented refusal a caller cannot receive is worse
+ * than an undocumented one: a consumer branches on it and the branch is dead.
  */
 const DEVELOPER_GUARD = ['unauthorized', 'token_expired', 'token_revoked'];
 /**
- * The same, for `auth: 'developer_or_client'` — `createRequireDeveloperOrClient`,
- * which resolves a developer bearer, an end-user bearer **or** a server key
- * through one `resolveAnyToken`.
+ * The same, for `auth: 'developer_or_client'` — one guard resolving a developer
+ * bearer, an end-user bearer **or** a server key through a single token lookup.
  *
- * **The same four codes, not five.** `sendTokenRefusal` has a fifth arm,
- * `account_blocked`, and this list carried it for exactly one commit. Nothing
- * reaches it: `TokenRefusalReason` admits `'blocked'`, but no site in
+ * **The same four codes, not five.** The token refusal has a fifth arm,
+ * `account_blocked`, which this list must not carry. Nothing reaches it: the
+ * refusal type admits `'blocked'`, but no site in
  * the cloud constructs one — the only reasons ever returned are `'invalid'`,
  * `'revoked'` and `'forbidden'`. Access is withdrawn by removing an assignment
  * rather than by blocking an account, so an app user who loses access loses it

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fleetless/contracts",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "description": "Fleetless wire contracts: the bridge-cloud protocol, the REST API schemas and the error codes, as zod schemas with generated JSON Schema and OpenAPI artifacts.",
   "license": "Apache-2.0",
   "author": "Dehne Robotik GmbH",