@fleetless/contracts 1.2.0 → 3.0.0

package/dist/routes.js

@@ -1,16 +1,16 @@
 // SPDX-License-Identifier: Apache-2.0
-import { appListResponse, createAppRequest, createServerKeyResponse, app as appSchema, role, roleListResponse, rolePermissions, serverKeyListResponse, updateAppRequest, } from './apps.js';
+import { appListResponse, appDeletionSummary, createAppRequest, createServerKeyResponse, app as appSchema, role, roleListResponse, rolePermissions, serverKeyListResponse, updateAppRequest, } from './apps.js';
 import { alertListResponse, orgAlertsQuery, orgFiringAlertsResponse } from './alerts.js';
-import { asset, assetListResponse, assetSyncRequest, assetSyncResponse, assetSyncStatus, missingAssetQuery } from './assets.js';
+import { asset, assetListResponse, assetsClearResponse, assetSyncRequest, assetSyncResponse, assetSyncStatus, missingAssetQuery } from './assets.js';
 import { auditListResponse, auditQuery } from './audit.js';
 import { CLIENT_OIDC_CALLBACK_PATH, clientAcceptInvitationRequest, clientIdentity, clientLoginRequest, clientLogoutRequest, clientMcpInteraction, clientMcpInteractionDecisionResponse, clientOidcCallbackQuery, clientOidcExchangeRequest, clientOidcStartQuery, clientPasswordResetConfirmRequest, clientPasswordResetRequest, clientProviderListQuery, clientProviderListResponse, clientRefreshRequest, clientRegisterRequest, clientResendVerificationRequest, clientVerifyEmailRequest, mcpConsentGrantListResponse, } from './client-auth.js';
 import { clientRobotListResponse } from './client-robots.js';
-import { appAuthConfig, appInvitation, appInvitationListResponse, appMailTemplate, appMailTemplateListResponse, appOidcProvider, appOidcProviderListResponse, appUser, appUserListResponse, createAppInvitationRequest, createAppOidcProviderRequest, createAppUserRequest, mailOutcome, mailTemplatePreviewRequest, mailTemplatePreviewResponse, patchAppOidcProviderRequest, patchAppUserRequest, putAppAuthConfigRequest, putAppMailTemplateRequest, } from './app-users.js';
+import { appAuthConfig, appInvitation, appInvitationListResponse, appMailTemplate, appMailTemplateListResponse, appOidcProvider, appOidcProviderListResponse, appUser, appUserListResponse, createAppInvitationRequest, createAppOidcProviderRequest, createAppUserRequest, mailOutcome, mailTemplatePreviewRequest, mailTemplatePreviewResponse, patchAppOidcProviderRequest, patchAppUserRequest, putAppAuthMcpRequest, putAppAuthRegistrationRequest, putAppAuthUrlsRequest, putAppMailTemplateRequest, } from './app-users.js';
 import { acceptTeamInviteRequest, authMeResponse, createTeamInviteRequest, fleetlessUser, fleetlessUserListResponse, passwordChangeRequest, passwordResetConfirm, passwordResetRequest, patchAuthMeRequest, patchFleetlessUserRequest, patchOrgRequest, patchOrgResponse, pendingTeamInviteListResponse, refreshRequest, sessionTokens, signUpRequest, signUpResponse, teamInvite, tierChangeRequest, waitlistRequest, } from './identity.js';
 import { jobRunListResponse, jobRunQuery, jobRunSummary, jobRunSummaryQuery } from './jobs.js';
 import { MCP_APP_PATHS, mcpRobotDatasheet, mcpRolePreviewResponse } from './mcp.js';
 import { authorizationServerMetadata, dynamicClientRegistrationRequest, dynamicClientRegistrationResponse, oauthAuthorizeQuery, oauthRedirectResponse, oauthTokenRequest, oauthTokenResponse, protectedResourceMetadata, } from './oauth.js';
-import { cameraListResponse, cancelRequest, configDraftResponse, configVersionResponse, configVersionsResponse, createRobotRequest, createRobotResponse, datapointListResponse, datapointValue, exposureListResponse, fetchTypesRequest, fetchTypesResponse, historyQuery, historyResponse, introspectionResponse, invokeOrServiceResponse, invokeRequest, jobResponse, liveSessionResponse, orgHealthQuery, orgLatencyQuery, orgLatencyResponse, orgQuotaUsage, orgUsageQuery, orgUsageResponse, patchRobotRequest, patchRobotResponse, publishConfigResponse, publishRequest, putConfigDraftRequest, putRobotDetailsRequest, putRobotDetailsResponse, releaseLiveQuery, renameSlugRequest, renameSlugResponse, robotDeleteQuery, resourceHealthListResponse, robotDeletionSummary, robotDetailResponse, robotJobsResponse, robotListResponse, slugUsageResponse, snapshotMetaResponse, typesResponse, } from './rest.js';
+import { cameraListResponse, cancelRequest, configDraftResponse, configVersionResponse, configVersionsResponse, createRobotRequest, createRobotResponse, datapointListResponse, datapointValue, exposureListResponse, fetchTypesRequest, fetchTypesResponse, historyQuery, historyResponse, introspectionResponse, invokeOrServiceResponse, invokeRequest, jobResponse, liveSessionResponse, orgHealthQuery, orgLatencyQuery, orgLatencyResponse, orgQuotaUsage, orgUsageQuery, orgUsageResponse, patchRobotRequest, patchRobotResponse, publishConfigResponse, publishRequest, putConfigDraftRequest, putRobotDetailsRequest, putRobotDetailsResponse, robotTokenRotateResponse, jointStatePutRequest, jointStatePutResponse, releaseLiveQuery, renameSlugRequest, renameSlugResponse, robotDeleteQuery, resourceHealthListResponse, robotDeletionSummary, robotDetailResponse, robotJobsResponse, robotListResponse, slugUsageResponse, snapshotMetaResponse, typesResponse, } from './rest.js';
 export const ROUTE_SECTIONS = [
     { id: 'health', title: 'Health' },
     { id: 'developer-auth', title: 'Developer auth' },
@@ -295,6 +295,32 @@ export const ROUTES = [
         notes: 'A `default_role_id` naming a role of another app is refused: it is the one cross-app authorization check this shape can carry. ' +
             'Changing the robot set closes every live subscription the app\'s users hold, since a grant may no longer name a reachable robot.',
     },
+    {
+        method: 'GET', path: '/api/apps/:id/deletion-preview', section: 'apps',
+        summary: 'Reports what deleting the app would destroy, without destroying it.',
+        audience: 'developer', auth: 'developer', rateLimited: false, ownerTier: false, status: 200,
+        params: [{ name: 'id', description: 'The app\'s uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`.' }],
+        query: null, request: null, response: appDeletionSummary,
+        errors: [...DEVELOPER_GUARD, 'invalid_uuid', 'not_found'], transport: 'http',
+        notes: 'The same shape the delete\'s own audit event carries, computed by the same function on purpose: the confirmation dialog and the eventual ' +
+            'receipt agree by construction, and any difference between them is real drift rather than two estimates that quietly disagree. \n\n' +
+            '**No `force` parameter, unlike the robot pair this is modelled on.** A robot\'s open live session is a single nameable state whose ' +
+            'interruption is its own hazard, which is why that route makes the caller pass `force` explicitly. An app has no equivalent state to ' +
+            'force past, and inventing one would be a guess wearing a guard\'s clothes — this preview is the guard.',
+    },
+    {
+        method: 'DELETE', path: '/api/apps/:id', section: 'apps',
+        summary: 'Deletes an app and everything it produced.',
+        audience: 'developer', auth: 'developer', rateLimited: false, ownerTier: true, status: 204,
+        params: [{ name: 'id', description: 'The app\'s uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`.' }],
+        query: null, request: null, response: null,
+        errors: [...DEVELOPER_GUARD, 'tier_required', 'invalid_uuid', 'not_found'], transport: 'http',
+        notes: 'Owner tier, and the gate runs **after** the org-scoped lookup: a developer-tier admin therefore sees the same `404` a stranger would ' +
+            'for an app outside their org, rather than a tier refusal that confirms the id exists. A full cascade — its users, roles, server keys, ' +
+            'invitations, OIDC provider configuration and mail templates all go, recorded once as `app.deleted` carrying an `appDeletionSummary`. ' +
+            'Its robots are untouched: they belong to the org, not to the app. \n\n**No `force` parameter** — see ' +
+            '`GET /api/apps/:id/deletion-preview`.',
+    },
     {
         method: 'POST', path: '/api/apps/:id/roles', section: 'apps',
         summary: 'Creates a custom role on the app.',
@@ -681,22 +707,55 @@ export const ROUTES = [
         errors: [...DEVELOPER_GUARD, 'invalid_uuid', 'not_found'], transport: 'http',
         notes: 'One row per app, created with the app and never absent — an app that has configured nothing reads back the defaults rather than a ' +
             '`404`. `oidc_callback_url` is in the answer and not in the request: it is minted by the cloud from its own public base URL, is the same ' +
-            'for every app and every provider, and is the value a developer registers at their identity provider.',
+            'for every app and every provider, and is the value a developer registers at their identity provider. It stays read-only on every slice ' +
+            'write below for a second reason: a writable callback URL would let a caller point the return leg of an OIDC sign-in, which carries an ' +
+            'authorization code, at a host they own. `updated_at` is read-only for a duller one: the server stamps it on every write, and a ' +
+            'client-supplied value would be a lie about when the row last changed.',
+    },
+    {
+        method: 'PUT', path: '/api/apps/:id/auth-config/registration', section: 'apps',
+        summary: 'Replaces who may self-register, and from where.',
+        audience: 'developer', auth: 'developer', rateLimited: false, ownerTier: false, status: 200,
+        params: [{ name: 'id', description: 'The app\'s uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`.' }],
+        query: null, request: putAppAuthRegistrationRequest, response: appAuthConfig,
+        errors: [...DEVELOPER_GUARD, 'invalid_uuid', 'validation_error', 'not_found'], transport: 'http',
+        notes: '**A replace, not a merge, and `.strict()`**: `self_registration`, `allowed_domains` and `allowed_origins` all arrive or the write is ' +
+            'refused, so a client built against an older shape cannot silently clear a setting it does not know about. `oidc_callback_url` and ' +
+            '`updated_at` are the server\'s, refused in this body as in every slice\'s — see `GET`\'s notes for why. ' +
+            '\n\n`400 validation_error` is where the two field rules land: an entry in `allowed_domains` must be lowercase, since a capitalised one ' +
+            'can never match a lowercased address, and an entry in `allowed_origins` must be a bare scheme-host-port with no path, since a browser ' +
+            'sends nothing longer in its `Origin` header. Each refuses at configuration time rather than failing silently later. ' +
+            '\n\nThe merge is server-side against the stored row, so this write never disturbs the urls or mcp slice.',
     },
     {
-        method: 'PUT', path: '/api/apps/:id/auth-config', section: 'apps',
-        summary: "Replaces the app's auth settings in one write.",
+        method: 'PUT', path: '/api/apps/:id/auth-config/urls', section: 'apps',
+        summary: "Replaces the three pages Fleetless's mails point at.",
         audience: 'developer', auth: 'developer', rateLimited: false, ownerTier: false, status: 200,
         params: [{ name: 'id', description: 'The app\'s uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`.' }],
-        query: null, request: putAppAuthConfigRequest, response: appAuthConfig,
+        query: null, request: putAppAuthUrlsRequest, response: appAuthConfig,
         errors: [...DEVELOPER_GUARD, 'invalid_uuid', 'validation_error', 'not_found'], transport: 'http',
-        notes: '**A replace, not a merge, and `.strict()`**: every field arrives or the write is refused, so a client built against an older shape ' +
-            'cannot silently clear a setting it does not know about. `oidc_callback_url` and `updated_at` are refused in the body — a writable ' +
-            'callback URL would let a caller point the return leg of an OIDC sign-in, which carries an authorization code, at a host they own. ' +
-            '\n\n`400 validation_error` is where the three field rules land: a URL template must be https (or `http` on `localhost`) and carry its ' +
-            'placeholder exactly once, an origin must be a bare scheme-host-port with no path, and a domain must be lowercase. Each refuses at ' +
-            'configuration time because each would otherwise fail silently later — a second placeholder leaves one occurrence literal in a mailed ' +
-            'link, an origin with a path can never equal a browser\'s `Origin` header, and a capitalised domain can never match a lowercased address.',
+        notes: '**A replace, not a merge, and `.strict()`**: `invite_url`, `verify_url` and `reset_url` all arrive or the write is refused, so a ' +
+            'client built against an older shape cannot silently clear a setting it does not know about. `oidc_callback_url` and `updated_at` are ' +
+            'the server\'s, refused in this body as in every slice\'s — see `GET`\'s notes for why. ' +
+            '\n\n`400 validation_error` is where the field rule lands: a URL template must be https (or `http` on `localhost`) and carry its ' +
+            'placeholder exactly once — a second occurrence leaves one literal in a mailed link, refused here rather than failing silently once ' +
+            'the mail is sent. ' +
+            '\n\nThe merge is server-side against the stored row, so this write never disturbs the registration or mcp slice.',
+    },
+    {
+        method: 'PUT', path: '/api/apps/:id/auth-config/mcp', section: 'apps',
+        summary: 'Replaces the MCP switch and its login URL together.',
+        audience: 'developer', auth: 'developer', rateLimited: false, ownerTier: false, status: 200,
+        params: [{ name: 'id', description: 'The app\'s uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`.' }],
+        query: null, request: putAppAuthMcpRequest, response: appAuthConfig,
+        errors: [...DEVELOPER_GUARD, 'invalid_uuid', 'validation_error', 'not_found'], transport: 'http',
+        notes: '**A replace, not a merge, and `.strict()`**: `mcp_enabled` and `mcp_login_url` both arrive or the write is refused, so a client built ' +
+            'against an older shape cannot silently clear a setting it does not know about. `oidc_callback_url` and `updated_at` are the server\'s, ' +
+            'refused in this body as in every slice\'s — see `GET`\'s notes for why. ' +
+            '\n\n`mcp_login_url` answers to the same rule as the `urls` slice\'s three templates — https (or `http` on `localhost`), its placeholder ' +
+            'exactly once — refused as `400 validation_error` rather than left to fail mid-OAuth, in a client\'s browser where no console screen ' +
+            'is watching. ' +
+            '\n\nThe merge is server-side against the stored row, so this write never disturbs the registration or urls slice.',
     },
     {
         method: 'GET', path: '/api/apps/:id/mail-templates', section: 'apps',
@@ -1664,6 +1723,40 @@ export const ROUTES = [
             'and the event carries no `details`, because the one interesting value here is the token. `max_robots` is checked before anything is ' +
             'created, which is only safe because robot deletion exists.',
     },
+    {
+        method: 'POST', path: '/api/robots/:id/token/rotate', section: 'robots',
+        summary: 'Mints a new bridge token for the robot and invalidates the old one.',
+        audience: 'developer', auth: 'developer', rateLimited: false, ownerTier: true, status: 201,
+        params: [{ name: 'id', description: 'The robot\'s uuid, as returned by `POST /api/robots` or listed by `GET /api/robots`.' }],
+        query: null, request: null, response: robotTokenRotateResponse,
+        errors: [...DEVELOPER_GUARD, 'tier_required', 'invalid_uuid', 'not_found'], transport: 'http',
+        notes: 'Owner tier, behind the org-scoped lookup, so a developer-tier admin sees the `404` a stranger would for a robot outside their org rather ' +
+            'than a tier refusal that confirms the id exists. `token` is the only moment the new secret exists outside the caller\'s hands — the cloud ' +
+            'stores a hash — so a caller who loses it rotates again. Audited as `robot.token_rotated`, with no `details`: the one interesting value ' +
+            'here is the token. \n\n**It stops the bridge that is connected right now.** The old secret is gone the instant the hash is replaced, so ' +
+            'the cloud closes that socket with `CLOSE_TOKEN_ROTATED` rather than leaving a bridge speaking on a credential nothing would accept ' +
+            'again. A bridge that does not know the code reconnects and is refused at hello as `invalid_token`, which is the honest answer and ends ' +
+            'the same way. **The robot is offline until somebody puts the new token on it** — this is a deliberate interruption, not a background ' +
+            'rekey, and a fleet cannot be rotated without a visit to each robot.',
+    },
+    {
+        method: 'PUT', path: '/api/robots/:id/urdf/joint-state', section: 'robots',
+        summary: 'Chooses the datapoint whose joint positions move the robot\'s URDF, or clears it.',
+        audience: 'developer', auth: 'developer', rateLimited: false, ownerTier: false, status: 200,
+        params: [{ name: 'id', description: 'The robot\'s uuid, as returned by `POST /api/robots` or listed by `GET /api/robots`.' }],
+        query: null, request: jointStatePutRequest, response: jointStatePutResponse,
+        errors: [...DEVELOPER_GUARD, 'invalid_uuid', 'not_found', 'validation_error'], transport: 'http',
+        notes: '**What qualifies**: a datapoint of the **published** configuration whose ROS type is `sensor_msgs/msg/JointState` and which carries no ' +
+            '`field` — the whole message, because positions and names arrive together and a single extracted field is half of a pose. Anything else ' +
+            'is a `validation_error` naming that rule rather than a stored mapping that renders a battery reading as a robot. `{ "slug": null }` ' +
+            'clears it, which is why the field is required and nullable rather than optional. \n\n**The mapping cannot outlive what it points at.** ' +
+            'Every successful publish re-checks it against the new document and clears it when it no longer qualifies, recording ' +
+            '`robot.joint_state_cleared` with the version that did it; a slug rename rewrites it like every other reference the editor already ' +
+            'rewrites; deleting the robot takes it along. Every write through this route — a slug or `null` — is on the record too, as ' +
+            '`robot.joint_state_set` with the actor and the slug, so a clear a person made is never mistaken for one a publish made. The stored ' +
+            'value reads back on `GET /api/robots/:id/assets` as `joint_state_slug`, so a renderer fetches the URDF, the meshes and the mapping ' +
+            'from one place.',
+    },
     {
         method: 'GET', path: '/api/robots', section: 'robots',
         summary: "Lists the org's robots with their connection state and exposure counts.",
@@ -2233,6 +2326,20 @@ export const ROUTES = [
         notes: 'Developer sessions only, like starting a sync: the guard admits three caller kinds and the handler answers `401 unauthorized` to the ' +
             'other two. A sync belonging to another robot reads exactly like one that never existed, which is why the robot is resolved first.',
     },
+    {
+        method: 'DELETE', path: '/api/robots/:id/assets', section: 'assets',
+        summary: "Empties a robot's asset store: every URDF, mesh and texture, gone at once.",
+        audience: 'client', auth: 'developer_or_client', rateLimited: false, ownerTier: true, status: 200,
+        params: [{ name: 'id', description: 'The robot\'s uuid, as returned by `POST /api/robots` or listed by `GET /api/robots`.' }],
+        query: null, request: null, response: assetsClearResponse,
+        errors: [...CLIENT_GUARD, 'tier_required', 'invalid_uuid', 'not_found', 'busy'], transport: 'http',
+        notes: 'The store\'s escape hatch: a full store is never a dead end, and this is the blunt third of the three answers to it — the URDF upload ' +
+            'is exempt from the gate, reconcile after a sync already frees what the new URDF stopped referencing, and this route lets an Owner clear ' +
+            'the robot outright. Owner tier, unconditionally, like starting a sync. Removes every asset of the robot and resets its store to `0`; ' +
+            "the next sync fills it again. It does not touch the bridge's availability report — `urdf_available` still answers from the connected " +
+            'robot, unrelated to what this cloud happens to have stored. A clear while a sync is running is `409 busy` naming that sync\'s ' +
+            'details, the same refusal starting a second sync gets, because deleting under a running upload would leave the store counter wrong.',
+    },
     /* ------------------------------------------------ org (quotas and fleet reads) */
     {
         method: 'GET', path: '/api/org/quotas', section: 'org',
@@ -2306,15 +2413,16 @@ export const ROUTES = [
         summary: 'Takes one asset file from a robot during a sync.',
         audience: 'internal', auth: 'robot_upload', rateLimited: false, ownerTier: false, status: 201,
         params: [], query: null, request: null, response: asset,
-        errors: ['unauthorized', 'rate_limited', 'asset_too_large', 'validation_error', 'not_found', 'quota_exceeded', 'bad_request'], transport: 'http',
+        errors: ['unauthorized', 'rate_limited', 'validation_error', 'not_found', 'quota_exceeded', 'bad_request'], transport: 'http',
         notes: 'The body is the **raw file bytes**, not JSON, so it has no request schema; everything about the file — its kind, its name, its sync id ' +
             'and its announced size — rides in the `x-fleetless-asset-*` headers `ASSET_UPLOAD_HEADERS` names. The credential is a short-lived ' +
             'upload token minted by `POST /api/robots/:id/assets/sync`, verified in a `preParsing` hook so a refusal precedes the work rather than ' +
-            'following it: a `preHandler` would already have buffered the whole file. The announced size is refused there too, before a single byte ' +
-            'is read — it is an announcement and not a proof, so it only ever rejects early and never accepts early, and a body that lies small is ' +
-            'still caught by the real length check. Past both, the server\'s own body limit answers a bare `413 bad_request` with neither ceiling nor ' +
-            'size in it. Rate limited per robot inside that same hook, which is why `rateLimited` is `false`: there is no rate-limiting preHandler ' +
-            'registered on this route.',
+            'following it: a `preHandler` would already have buffered the whole file. **Nothing is refused for its own size** — the robot\'s asset ' +
+            'store is the only limit, so the announced size is checked there against `ROBOT_ASSET_STORE_BYTES` and a file with no room left answers ' +
+            '`409 quota_exceeded` carrying `store_bytes`, `used_bytes` and `size_bytes`, while the sync carries on with the next file. Past that, ' +
+            'the server\'s own body limit answers a bare `413 bad_request` with none of those numbers in it. Rate limited per robot inside that same ' +
+            'hook, which is why `rateLimited` is `false`: there is no rate-limiting preHandler registered on this route. The URDF itself is never ' +
+            'refused for the store; only meshes and textures are charged against it.',
     },
     /* ------------------------------------ realtime and bridge transports */
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fleetless/contracts",
-  "version": "1.2.0",
+  "version": "3.0.0",
   "description": "Fleetless wire contracts: the bridge-cloud protocol, the REST API schemas and the error codes, as zod schemas with generated JSON Schema and OpenAPI artifacts.",
   "license": "Apache-2.0",
   "author": "Dehne Robotik GmbH",

package/artifacts/schema/bridge-pressure.schema.json

@@ -1,292 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "type": "object",
-  "properties": {
-    "link": {
-      "type": "object",
-      "properties": {
-        "rate_bps": {
-          "anyOf": [
-            {
-              "type": "number",
-              "minimum": 0
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "snapshot_max_bytes": {
-          "type": "integer",
-          "minimum": 0,
-          "maximum": 9007199254740991
-        }
-      },
-      "required": [
-        "rate_bps",
-        "snapshot_max_bytes"
-      ]
-    },
-    "tiers": {
-      "type": "object",
-      "properties": {
-        "0": {
-          "type": "object",
-          "properties": {
-            "sent": {
-              "type": "integer",
-              "minimum": 0,
-              "maximum": 9007199254740991
-            },
-            "bytes": {
-              "type": "integer",
-              "minimum": 0,
-              "maximum": 9007199254740991
-            },
-            "drops": {
-              "type": "integer",
-              "minimum": 0,
-              "maximum": 9007199254740991
-            },
-            "high_water": {
-              "type": "integer",
-              "minimum": 0,
-              "maximum": 9007199254740991
-            }
-          },
-          "required": [
-            "sent",
-            "bytes",
-            "drops",
-            "high_water"
-          ]
-        },
-        "1": {
-          "type": "object",
-          "properties": {
-            "sent": {
-              "type": "integer",
-              "minimum": 0,
-              "maximum": 9007199254740991
-            },
-            "bytes": {
-              "type": "integer",
-              "minimum": 0,
-              "maximum": 9007199254740991
-            },
-            "drops": {
-              "type": "integer",
-              "minimum": 0,
-              "maximum": 9007199254740991
-            },
-            "high_water": {
-              "type": "integer",
-              "minimum": 0,
-              "maximum": 9007199254740991
-            }
-          },
-          "required": [
-            "sent",
-            "bytes",
-            "drops",
-            "high_water"
-          ]
-        },
-        "2": {
-          "type": "object",
-          "properties": {
-            "sent": {
-              "type": "integer",
-              "minimum": 0,
-              "maximum": 9007199254740991
-            },
-            "bytes": {
-              "type": "integer",
-              "minimum": 0,
-              "maximum": 9007199254740991
-            },
-            "drops": {
-              "type": "integer",
-              "minimum": 0,
-              "maximum": 9007199254740991
-            },
-            "high_water": {
-              "type": "integer",
-              "minimum": 0,
-              "maximum": 9007199254740991
-            }
-          },
-          "required": [
-            "sent",
-            "bytes",
-            "drops",
-            "high_water"
-          ]
-        },
-        "3": {
-          "type": "object",
-          "properties": {
-            "sent": {
-              "type": "integer",
-              "minimum": 0,
-              "maximum": 9007199254740991
-            },
-            "bytes": {
-              "type": "integer",
-              "minimum": 0,
-              "maximum": 9007199254740991
-            },
-            "drops": {
-              "type": "integer",
-              "minimum": 0,
-              "maximum": 9007199254740991
-            },
-            "high_water": {
-              "type": "integer",
-              "minimum": 0,
-              "maximum": 9007199254740991
-            }
-          },
-          "required": [
-            "sent",
-            "bytes",
-            "drops",
-            "high_water"
-          ]
-        },
-        "4": {
-          "type": "object",
-          "properties": {
-            "sent": {
-              "type": "integer",
-              "minimum": 0,
-              "maximum": 9007199254740991
-            },
-            "bytes": {
-              "type": "integer",
-              "minimum": 0,
-              "maximum": 9007199254740991
-            },
-            "drops": {
-              "type": "integer",
-              "minimum": 0,
-              "maximum": 9007199254740991
-            },
-            "high_water": {
-              "type": "integer",
-              "minimum": 0,
-              "maximum": 9007199254740991
-            }
-          },
-          "required": [
-            "sent",
-            "bytes",
-            "drops",
-            "high_water"
-          ]
-        },
-        "5": {
-          "type": "object",
-          "properties": {
-            "sent": {
-              "type": "integer",
-              "minimum": 0,
-              "maximum": 9007199254740991
-            },
-            "bytes": {
-              "type": "integer",
-              "minimum": 0,
-              "maximum": 9007199254740991
-            },
-            "drops": {
-              "type": "integer",
-              "minimum": 0,
-              "maximum": 9007199254740991
-            },
-            "high_water": {
-              "type": "integer",
-              "minimum": 0,
-              "maximum": 9007199254740991
-            }
-          },
-          "required": [
-            "sent",
-            "bytes",
-            "drops",
-            "high_water"
-          ]
-        }
-      },
-      "additionalProperties": false
-    },
-    "video": {
-      "type": "object",
-      "properties": {
-        "active_streams": {
-          "type": "integer",
-          "minimum": 0,
-          "maximum": 9007199254740991
-        },
-        "bitrate_sum_kbps": {
-          "type": "integer",
-          "minimum": 0,
-          "maximum": 9007199254740991
-        },
-        "uplink_kbps": {
-          "anyOf": [
-            {
-              "type": "integer",
-              "minimum": 0,
-              "maximum": 9007199254740991
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "override_kbps": {
-          "anyOf": [
-            {
-              "type": "integer",
-              "minimum": 0,
-              "maximum": 9007199254740991
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "video_budget_kbps": {
-          "anyOf": [
-            {
-              "type": "integer",
-              "minimum": 0,
-              "maximum": 9007199254740991
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
-        "reserve_kbps": {
-          "type": "integer",
-          "minimum": 0,
-          "maximum": 9007199254740991
-        }
-      },
-      "required": [
-        "active_streams",
-        "bitrate_sum_kbps",
-        "uplink_kbps",
-        "override_kbps",
-        "video_budget_kbps",
-        "reserve_kbps"
-      ]
-    }
-  },
-  "required": [
-    "link",
-    "tiers",
-    "video"
-  ]
-}

package/artifacts/schema/put-app-auth-config-request.schema.json

@@ -1,93 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "type": "object",
-  "properties": {
-    "self_registration": {
-      "type": "boolean",
-      "description": "Whether a stranger may create an account in this app. Off refuses `POST /api/client/register` with `403 registration_closed`, and refuses an unknown identity at an OIDC callback with the same reasoning — one switch for one decision, whichever door the person arrives at."
-    },
-    "allowed_domains": {
-      "maxItems": 50,
-      "type": "array",
-      "items": {
-        "type": "string",
-        "minLength": 1,
-        "maxLength": 253,
-        "pattern": "^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z]{2,63}$"
-      },
-      "description": "The email domains self-registration accepts, lowercase. An empty list means no domain restriction, not \"nobody\" — the switch above is what closes the door. **An invitation always bypasses this**, by password and through a provider alike."
-    },
-    "allowed_origins": {
-      "maxItems": 20,
-      "type": "array",
-      "items": {
-        "type": "string",
-        "maxLength": 200
-      },
-      "description": "The origins the client auth API answers CORS for, and the only origins an OIDC `redirect_uri` may name. Bare origins: scheme, host and port, with no path — a browser sends nothing longer, so an entry carrying one could never match."
-    },
-    "mcp_enabled": {
-      "type": "boolean",
-      "description": "Whether this app serves an MCP endpoint at `/mcp/<identifier>`. Off refuses the whole OAuth surface for the app, not merely the tool calls, and is re-read on every request rather than cached off a token."
-    },
-    "invite_url": {
-      "anyOf": [
-        {
-          "type": "string",
-          "maxLength": 500
-        },
-        {
-          "type": "null"
-        }
-      ],
-      "description": "The page in the developer's app that accepts an invitation, with `{token}` where the token goes. `null` when unconfigured, and then an invitation still issues but `send_mail` is refused with `409 target_state_conflict` — there would be nowhere for the link to point."
-    },
-    "verify_url": {
-      "anyOf": [
-        {
-          "type": "string",
-          "maxLength": 500
-        },
-        {
-          "type": "null"
-        }
-      ],
-      "description": "The page that confirms a new address, with `{token}` where the token goes. Self-registration needs it: without a page to send people to, a registration would leave an account nobody can activate."
-    },
-    "reset_url": {
-      "anyOf": [
-        {
-          "type": "string",
-          "maxLength": 500
-        },
-        {
-          "type": "null"
-        }
-      ],
-      "description": "The page that takes a new password, with `{token}` where the token goes."
-    },
-    "mcp_login_url": {
-      "anyOf": [
-        {
-          "type": "string",
-          "maxLength": 500
-        },
-        {
-          "type": "null"
-        }
-      ],
-      "description": "The page an MCP authorization redirects to, with `{interaction}` where the interaction id goes. Not a token: the id names a pending request the server already holds, and the app authenticates the user itself before approving it."
-    }
-  },
-  "required": [
-    "self_registration",
-    "allowed_domains",
-    "allowed_origins",
-    "mcp_enabled",
-    "invite_url",
-    "verify_url",
-    "reset_url",
-    "mcp_login_url"
-  ],
-  "additionalProperties": false
-}