@fleetless/contracts 2.0.0 → 4.0.0-next.1

package/CHANGELOG.md

@@ -3,7 +3,42 @@
 All notable changes to `@fleetless/contracts` are recorded here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the
 project uses [semantic versioning](https://semver.org/spec/v2.0.0.html) over
-the wire shapes.
+the wire shapes. A pull request that changes what a consumer sees adds its
+entry under `## [Unreleased]`; the release renames that heading to the
+version.
+
+## [Unreleased]
+
+### Added
+
+- **Protocol 4: a job heartbeat, and a vanished action server ends its job.**
+  Protocol bumped: bridges from `4.1.0`, and protocol 3 sunsets
+  2026-12-27 (protocol 2 sunset 2026-12-21). The bridge now sends a
+  `job_update` heartbeat every `JOB_HEARTBEAT_INTERVAL_MS` for every running
+  job; `job_lost` gains an optional `error`, so a bridge that finds its
+  action server gone can say `action_server_lost` instead of leaving the
+  cloud to guess. `JOB_HEARTBEAT_TIMEOUT_MS` bounds a protocol-4 job's
+  silence once it has been heard from at all; `patience_ms` now bounds only
+  the acceptance gap on such a job (unchanged for protocol 3, which sends no
+  heartbeat). `JOB_OFFLINE_GRACE_MS` (five minutes) replaces the informal
+  one-minute disconnect grace a job got before. `errors.ts` documents
+  `action_server_lost` and every job error code already in use that had
+  never been written down: `action_failed`, `goal_rejected`,
+  `goal_send_failed`, `result_failed`, `goal_uncontrollable`,
+  `bridge_disconnected`, `config_changed`.
+
+## [3.0.0] — 2026-09-22
+
+The protocol window carries over unchanged: `LATEST_BRIDGE_VERSION` is still `4.0.0`, and protocol 2 still sunsets 2026-12-21. Everything below is the REST surface.
+
+### Added
+
+- **Auth-config as three slices, not one document.** `putAppAuthRegistrationRequest` (`self_registration`, `allowed_domains`, `allowed_origins`), `putAppAuthUrlsRequest` (`invite_url`, `verify_url`, `reset_url`) and `putAppAuthMcpRequest` (`mcp_enabled`, `mcp_login_url`) are three `.strict()` replaces behind three new routes — `PUT /api/apps/:id/auth-config/registration`, `/urls` and `/mcp` — each merged server-side against the stored row, so a write to one slice can no longer clear a field it never showed. `GET /api/apps/:id/auth-config` is unchanged and still answers the whole document.
+- **A deletion preview and a delete.** `appDeletionSummary` — six independent counts (`user_count`, `role_count`, `server_key_count`, `invitation_count`, `oidc_provider_count`, `mail_template_count`), deliberately not summed — is what `GET /api/apps/:id/deletion-preview` (`200`) answers and what the `app.deleted` audit event carries, computed by the same function so the confirmation dialog and the eventual receipt cannot quietly disagree. `DELETE /api/apps/:id` (Owner tier, `204`) runs the cascade: an app's users, roles, server keys, invitations, OIDC configuration and mail templates all go; its robots do not, since they belong to the org, not the app. **No `force` parameter** — unlike the robot deletion pair this is modelled on, an app has no open-session state to force past, and inventing one would be a guess wearing a guard's clothes.
+
+### Removed
+
+- **`putAppAuthConfigRequest` and `PUT /api/apps/:id/auth-config`.** Replaced by the three slice requests and routes above — `PUT /api/apps/:id/auth-config/registration`, `PUT /api/apps/:id/auth-config/urls` and `PUT /api/apps/:id/auth-config/mcp`. This is the break that makes this release a major: a caller still sending the old whole-document body finds no route left to send it to.
 
 ## [2.0.0] — 2026-09-22
 

package/CONTRIBUTING.md

@@ -73,8 +73,9 @@ an issue first — so we can say what else has to move with it.
 
 **CI runs on GitHub Actions**, in this repository
 (`.github/workflows/verify.yml`) — the suite, on every push and every pull
-request. `release.yml` publishes on a release tag and calls that same file
-first, so a release is never checked by a different pipeline than a push.
+request. `release.yml` (the **Release** button) calls that same file on the
+commit it publishes, so a release is never checked by a different pipeline
+than a push.
 
 **Your pull request is verified, a fork's included** — the same file, the
 same suite. The first run by a first-time contributor waits for a maintainer
@@ -82,10 +83,11 @@ to press approve on it; that is a button on your run, not a setting anybody
 has to change, so checks sitting idle for a while are the queue and not a
 failure. The run reads code and reaches nothing else: it is granted
 `contents: read`, no secret is exposed to it, and publishing lives in a
-workflow only a tag can trigger.
+workflow only a maintainer's own **Run workflow** press can trigger.
 
-Run `pnpm typecheck && pnpm build && pnpm test && pnpm artifacts && pnpm run
-test:pack` yourself first and you've seen everything `verify` will tell you.
+Run `pnpm typecheck && pnpm build && pnpm test && node --test
+'.github/release/*.test.mjs' && pnpm artifacts && pnpm run test:pack`
+yourself first and you've seen everything `verify` will tell you.
 Mind `pnpm artifacts`: `artifacts/` is generated *and* committed, and CI
 fails if regenerating it changes a file — so commit whatever it writes
 together with the schema you changed. That is the single most common reason
@@ -123,22 +125,31 @@ is refused by a `prepublishOnly` script — the rule has a mechanism rather
 than only a sentence. (`publish` is unaffected: it publishes the tarball
 `verify` packed, and npm runs no prepare lifecycle for a tarball argument.)
 
-1. Update `CHANGELOG.md` and set the new version in `package.json`. **CI
-   checks both** (`scripts/verify-version-tag.mjs`): `package.json` must
-   equal the tag without its `v`, and `CHANGELOG.md` needs a dated heading
-   reading exactly `## [X.Y.Z] — YYYY-MM-DD`. `CHANGELOG.md` ships inside
-   the tarball — skip an entry and you've documented the wrong version to
-   every consumer, and npm won't take a version back.
-
-   The same script refuses a release tag that would move npm's `latest`
-   backwards — a backported `v1.0.1` published while `latest` is `2.0.0`
-   would make `npm i @fleetless/contracts`, the command the README gives
-   outsiders, install a package a major version behind.
-2. Commit, push, and let the `verify` job go green on the branch (the
-   Actions tab).
-3. Tag `vX.Y.Z` (or `vX.Y.Z-beta.N` for a pre-release, which publishes to
-   the `next` dist-tag) and push the tag. The tag run's `verify` job runs
-   again and then `publish`.
+**Release is a button**, not a tag you push. Press **Run workflow** on
+`release` (the Actions tab), on `main`. The version comes from the
+Conventional Commits since the last tag; a release PR turns
+`CHANGELOG.md`'s `## [Unreleased]` into that version, dated, and sets it in
+`package.json` — the same two things `scripts/verify-version-tag.mjs` always
+checked, now written by the release PR instead of by hand. That PR merges
+itself once the required `verify` check passes; the merge commit is tagged,
+`verify.yml` runs again on it and packs the tarball, and `publish` ships
+exactly that tarball.
+
+A person still writes the `## [Unreleased]` entries — in the feature's own
+pull request, as the change goes in — because the release only renames that
+heading to a version; it never writes prose. An empty `## [Unreleased]`
+refuses the release outright, before any branch or commit exists.
+
+A pull request that moves the protocol window writes one of those entries
+too, and `test/changelog.test.ts` is red until it does: some section has to
+name the newest `bridge_from` together with the date the version before it
+sunsets. It need not be the newest section — a release that leaves the
+protocol alone has nothing true to restate about it.
+
+For a pre-release — a branch elsewhere that must pin this change before it
+is final — check `prerelease` among the workflow's inputs: it publishes
+`X.Y.Z-next.N` under the `next` dist-tag, from any branch, with no tag, no
+release PR and no changelog entry.
 
 `publish` carries no npm token. It authenticates by **trusted publishing**:
 GitHub mints a short-lived credential for the job, npm checks it against the
@@ -150,12 +161,18 @@ The job refuses a missing credential by name, rather than failing on an opaque
 error from deep inside `npm publish`. There is no repository secret to add and
 no `.npmrc` anywhere.
 
-**If the publish job goes red after `npm publish` already ran, do not press
-retry.** npm refuses to republish a version — the resulting 403 reads like
-a broken run, not like a release that already happened. Check `npm view
-@fleetless/contracts@<version>` first.
-
-Removing a bad tag is an ordinary git operation here — nothing configures
-tag protection, so `git tag -d vX.Y.Z` locally and `git push origin
-:refs/tags/vX.Y.Z` remotely both just work. What that does *not* undo is a
-publish: the tag is retractable, the npm version is not.
+**If the publish job goes red after `npm publish` already ran, run Release
+again.** It sees that npm already has the version and does not publish
+twice — npm refuses to republish a version, and a second attempt would only
+read like a broken run. The rerun continues from there: it waits for the
+registry to serve it, then finishes. Check `npm view
+@fleetless/contracts@<version>` first if you want to see for yourself before
+pressing anything.
+
+Creating or deleting a `v*` tag is restricted — the organisation ruleset
+`release-tags` allows only admins and the release App, which is how the
+workflow tags a release without a maintainer pushing one by hand. An admin
+can still remove a bad tag; ask one if you are not. What removing it does
+*not* undo is a publish: the tag is retractable, the npm version is not —
+and Release computes the next version from the newest tag, so deleting one
+changes what a later run proposes.

package/artifacts/constants.json

@@ -1,6 +1,6 @@
 {
   "AUDIT_RETENTION_DAYS": 90,
-  "PROTOCOL_VERSION": 3,
+  "PROTOCOL_VERSION": 4,
   "PROTOCOL_VERSIONS": [
     {
       "version": 2,
@@ -10,13 +10,21 @@
     {
       "version": 3,
       "bridge_from": "4.0.0",
+      "deprecated_at": "2026-09-28"
+    },
+    {
+      "version": 4,
+      "bridge_from": "4.1.0",
       "deprecated_at": null
     }
   ],
   "PROTOCOL_SUNSET_DAYS": 90,
-  "LATEST_BRIDGE_VERSION": "4.0.0",
+  "LATEST_BRIDGE_VERSION": "4.1.0",
   "CLOSE_ROBOT_DELETED": 4004,
   "CLOSE_TOKEN_ROTATED": 4005,
+  "JOB_HEARTBEAT_INTERVAL_MS": 1000,
+  "JOB_HEARTBEAT_TIMEOUT_MS": 5000,
+  "JOB_OFFLINE_GRACE_MS": 300000,
   "ASSET_UPLOAD_HEADERS": {
     "kind": "x-fleetless-asset-kind",
     "name": "x-fleetless-asset-name",

package/artifacts/openapi.json

@@ -924,6 +924,93 @@
             }
           }
         }
+      },
+      "delete": {
+        "operationId": "delete_api_apps_id",
+        "summary": "Deletes an app and everything it produced.",
+        "tags": [
+          "apps"
+        ],
+        "security": [
+          {
+            "developerSession": []
+          }
+        ],
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "description": "The app's uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Success."
+          },
+          "default": {
+            "description": "An error envelope. Codes this route is known to answer: `unauthorized`, `token_expired`, `token_revoked`, `tier_required`, `invalid_uuid`, `not_found`.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/api-error"
+                }
+              }
+            }
+          }
+        },
+        "description": "Owner tier, and the gate runs **after** the org-scoped lookup: a developer-tier admin therefore sees the same `404` a stranger would for an app outside their org, rather than a tier refusal that confirms the id exists. A full cascade — its users, roles, server keys, invitations, OIDC provider configuration and mail templates all go, recorded once as `app.deleted` carrying an `appDeletionSummary`. Its robots are untouched: they belong to the org, not to the app. \n\n**No `force` parameter** — see `GET /api/apps/:id/deletion-preview`."
+      }
+    },
+    "/api/apps/{id}/deletion-preview": {
+      "get": {
+        "operationId": "get_api_apps_id_deletion_preview",
+        "summary": "Reports what deleting the app would destroy, without destroying it.",
+        "tags": [
+          "apps"
+        ],
+        "security": [
+          {
+            "developerSession": []
+          }
+        ],
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "description": "The app's uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/app-deletion-summary"
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "An error envelope. Codes this route is known to answer: `unauthorized`, `token_expired`, `token_revoked`, `invalid_uuid`, `not_found`.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/api-error"
+                }
+              }
+            }
+          }
+        },
+        "description": "The same shape the delete's own audit event carries, computed by the same function on purpose: the confirmation dialog and the eventual receipt agree by construction, and any difference between them is real drift rather than two estimates that quietly disagree. \n\n**No `force` parameter, unlike the robot pair this is modelled on.** A robot's open live session is a single nameable state whose interruption is its own hazard, which is why that route makes the caller pass `force` explicitly. An app has no equivalent state to force past, and inventing one would be a guess wearing a guard's clothes — this preview is the guard."
       }
     },
     "/api/apps/{id}/roles": {
@@ -2376,11 +2463,13 @@
             }
           }
         },
-        "description": "One row per app, created with the app and never absent — an app that has configured nothing reads back the defaults rather than a `404`. `oidc_callback_url` is in the answer and not in the request: it is minted by the cloud from its own public base URL, is the same for every app and every provider, and is the value a developer registers at their identity provider."
-      },
+        "description": "One row per app, created with the app and never absent — an app that has configured nothing reads back the defaults rather than a `404`. `oidc_callback_url` is in the answer and not in the request: it is minted by the cloud from its own public base URL, is the same for every app and every provider, and is the value a developer registers at their identity provider. It stays read-only on every slice write below for a second reason: a writable callback URL would let a caller point the return leg of an OIDC sign-in, which carries an authorization code, at a host they own. `updated_at` is read-only for a duller one: the server stamps it on every write, and a client-supplied value would be a lie about when the row last changed."
+      }
+    },
+    "/api/apps/{id}/auth-config/registration": {
       "put": {
-        "operationId": "put_api_apps_id_auth_config",
-        "summary": "Replaces the app's auth settings in one write.",
+        "operationId": "put_api_apps_id_auth_config_registration",
+        "summary": "Replaces who may self-register, and from where.",
         "tags": [
           "apps"
         ],
@@ -2422,13 +2511,129 @@
             }
           }
         },
-        "description": "**A replace, not a merge, and `.strict()`**: every field arrives or the write is refused, so a client built against an older shape cannot silently clear a setting it does not know about. `oidc_callback_url` and `updated_at` are refused in the body — a writable callback URL would let a caller point the return leg of an OIDC sign-in, which carries an authorization code, at a host they own. \n\n`400 validation_error` is where the three field rules land: a URL template must be https (or `http` on `localhost`) and carry its placeholder exactly once, an origin must be a bare scheme-host-port with no path, and a domain must be lowercase. Each refuses at configuration time because each would otherwise fail silently later — a second placeholder leaves one occurrence literal in a mailed link, an origin with a path can never equal a browser's `Origin` header, and a capitalised domain can never match a lowercased address.",
+        "description": "**A replace, not a merge, and `.strict()`**: `self_registration`, `allowed_domains` and `allowed_origins` all arrive or the write is refused, so a client built against an older shape cannot silently clear a setting it does not know about. `oidc_callback_url` and `updated_at` are the server's, refused in this body as in every slice's — see `GET`'s notes for why. \n\n`400 validation_error` is where the two field rules land: an entry in `allowed_domains` must be lowercase, since a capitalised one can never match a lowercased address, and an entry in `allowed_origins` must be a bare scheme-host-port with no path, since a browser sends nothing longer in its `Origin` header. Each refuses at configuration time rather than failing silently later. \n\nThe merge is server-side against the stored row, so this write never disturbs the urls or mcp slice.",
         "requestBody": {
           "required": true,
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/put-app-auth-config-request"
+                "$ref": "#/components/schemas/put-app-auth-registration-request"
+              }
+            }
+          }
+        }
+      }
+    },
+    "/api/apps/{id}/auth-config/urls": {
+      "put": {
+        "operationId": "put_api_apps_id_auth_config_urls",
+        "summary": "Replaces the three pages Fleetless's mails point at.",
+        "tags": [
+          "apps"
+        ],
+        "security": [
+          {
+            "developerSession": []
+          }
+        ],
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "description": "The app's uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/app-auth-config"
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "An error envelope. Codes this route is known to answer: `unauthorized`, `token_expired`, `token_revoked`, `invalid_uuid`, `validation_error`, `not_found`.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/api-error"
+                }
+              }
+            }
+          }
+        },
+        "description": "**A replace, not a merge, and `.strict()`**: `invite_url`, `verify_url` and `reset_url` all arrive or the write is refused, so a client built against an older shape cannot silently clear a setting it does not know about. `oidc_callback_url` and `updated_at` are the server's, refused in this body as in every slice's — see `GET`'s notes for why. \n\n`400 validation_error` is where the field rule lands: a URL template must be https (or `http` on `localhost`) and carry its placeholder exactly once — a second occurrence leaves one literal in a mailed link, refused here rather than failing silently once the mail is sent. \n\nThe merge is server-side against the stored row, so this write never disturbs the registration or mcp slice.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/put-app-auth-urls-request"
+              }
+            }
+          }
+        }
+      }
+    },
+    "/api/apps/{id}/auth-config/mcp": {
+      "put": {
+        "operationId": "put_api_apps_id_auth_config_mcp",
+        "summary": "Replaces the MCP switch and its login URL together.",
+        "tags": [
+          "apps"
+        ],
+        "security": [
+          {
+            "developerSession": []
+          }
+        ],
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "description": "The app's uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/app-auth-config"
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "An error envelope. Codes this route is known to answer: `unauthorized`, `token_expired`, `token_revoked`, `invalid_uuid`, `validation_error`, `not_found`.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/api-error"
+                }
+              }
+            }
+          }
+        },
+        "description": "**A replace, not a merge, and `.strict()`**: `mcp_enabled` and `mcp_login_url` both arrive or the write is refused, so a client built against an older shape cannot silently clear a setting it does not know about. `oidc_callback_url` and `updated_at` are the server's, refused in this body as in every slice's — see `GET`'s notes for why. \n\n`mcp_login_url` answers to the same rule as the `urls` slice's three templates — https (or `http` on `localhost`), its placeholder exactly once — refused as `400 validation_error` rather than left to fail mid-OAuth, in a client's browser where no console screen is watching. \n\nThe merge is server-side against the stored row, so this write never disturbs the registration or urls slice.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/put-app-auth-mcp-request"
               }
             }
           }
@@ -8674,6 +8879,56 @@
         ],
         "additionalProperties": false
       },
+      "app-deletion-summary": {
+        "type": "object",
+        "properties": {
+          "user_count": {
+            "type": "integer",
+            "minimum": 0,
+            "maximum": 9007199254740991,
+            "description": "App users deleted with the app. They are the developer's own customers, not Fleetless users, and exist in no other app."
+          },
+          "role_count": {
+            "type": "integer",
+            "minimum": 0,
+            "maximum": 9007199254740991,
+            "description": "Roles deleted with the app, each with its per-robot slug grants."
+          },
+          "server_key_count": {
+            "type": "integer",
+            "minimum": 0,
+            "maximum": 9007199254740991,
+            "description": "Server keys deleted with the app. A client still holding one is refused at its next request."
+          },
+          "invitation_count": {
+            "type": "integer",
+            "minimum": 0,
+            "maximum": 9007199254740991,
+            "description": "Outstanding invitations — unspent and unexpired — that will never be accepted."
+          },
+          "oidc_provider_count": {
+            "type": "integer",
+            "minimum": 0,
+            "maximum": 9007199254740991,
+            "description": "Identity providers configured for this app. The providers themselves are somebody else's; only this app's configuration of them goes."
+          },
+          "mail_template_count": {
+            "type": "integer",
+            "minimum": 0,
+            "maximum": 9007199254740991,
+            "description": "Custom mail templates, of at most three. A kind using the Fleetless default text is not counted — there is no row to lose."
+          }
+        },
+        "required": [
+          "user_count",
+          "role_count",
+          "server_key_count",
+          "invitation_count",
+          "oidc_provider_count",
+          "mail_template_count"
+        ],
+        "additionalProperties": false
+      },
       "app-invitation": {
         "type": "object",
         "properties": {
@@ -16318,7 +16573,33 @@
           "message"
         ]
       },
-      "put-app-auth-config-request": {
+      "put-app-auth-mcp-request": {
+        "type": "object",
+        "properties": {
+          "mcp_enabled": {
+            "type": "boolean",
+            "description": "Whether this app serves an MCP endpoint at `/mcp/<identifier>`. Off refuses the whole OAuth surface for the app, not merely the tool calls, and is re-read on every request rather than cached off a token."
+          },
+          "mcp_login_url": {
+            "anyOf": [
+              {
+                "type": "string",
+                "maxLength": 500
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "The page an MCP authorization redirects to, with `{interaction}` where the interaction id goes. Not a token: the id names a pending request the server already holds, and the app authenticates the user itself before approving it."
+          }
+        },
+        "required": [
+          "mcp_enabled",
+          "mcp_login_url"
+        ],
+        "additionalProperties": false
+      },
+      "put-app-auth-registration-request": {
         "type": "object",
         "properties": {
           "self_registration": {
@@ -16344,11 +16625,18 @@
               "maxLength": 200
             },
             "description": "The origins the client auth API answers CORS for, and the only origins an OIDC `redirect_uri` may name. Bare origins: scheme, host and port, with no path — a browser sends nothing longer, so an entry carrying one could never match."
-          },
-          "mcp_enabled": {
-            "type": "boolean",
-            "description": "Whether this app serves an MCP endpoint at `/mcp/<identifier>`. Off refuses the whole OAuth surface for the app, not merely the tool calls, and is re-read on every request rather than cached off a token."
-          },
+          }
+        },
+        "required": [
+          "self_registration",
+          "allowed_domains",
+          "allowed_origins"
+        ],
+        "additionalProperties": false
+      },
+      "put-app-auth-urls-request": {
+        "type": "object",
+        "properties": {
           "invite_url": {
             "anyOf": [
               {
@@ -16384,29 +16672,12 @@
               }
             ],
             "description": "The page that takes a new password, with `{token}` where the token goes."
-          },
-          "mcp_login_url": {
-            "anyOf": [
-              {
-                "type": "string",
-                "maxLength": 500
-              },
-              {
-                "type": "null"
-              }
-            ],
-            "description": "The page an MCP authorization redirects to, with `{interaction}` where the interaction id goes. Not a token: the id names a pending request the server already holds, and the app authenticates the user itself before approving it."
           }
         },
         "required": [
-          "self_registration",
-          "allowed_domains",
-          "allowed_origins",
-          "mcp_enabled",
           "invite_url",
           "verify_url",
-          "reset_url",
-          "mcp_login_url"
+          "reset_url"
         ],
         "additionalProperties": false
       },