@fleetless/contracts 2.0.0 → 4.0.0-next.1

package/dist/index.d.ts

@@ -3,7 +3,7 @@ export { SLUG_RULE, ROS_NAME_RULE, ROS_TYPE_NAME_RULE, FIELD_PATH_RULE, slug, ro
 export type { ApplyErrorKind, ApplyError } from './common.js';
 export { MCP_PROTOCOL_VERSION, MCP_ENDPOINT_PATH, mcpAppEndpointPath, MCP_APP_PATHS, MCP_TOOL_NAME_MAX, MCP_ASSET_LINK_PATH, MCP_ASSET_LINK_TTL_MS, mcpToolNamePattern, mcpToolKind, mcpExposure, mcpCapabilities, mcpRobotDatasheet, mcpRolePreviewResponse, } from './mcp.js';
 export type { McpAppPaths, McpToolKind, McpExposure, McpCapabilities, McpRobotDatasheet, McpRolePreviewResponse, } from './mcp.js';
-export { PROTOCOL_VERSION, PROTOCOL_VERSIONS, PROTOCOL_SUNSET_DAYS, LATEST_BRIDGE_VERSION, protocolStatus, minimumProtocolVersion, sunsetOf, statusFromTable, bridgeHello, cloudHelloOk, cloudHelloError, cloudPing, bridgePong, bridgeLinkMode, datapointFrame, bridgeState, cloudConfig, bridgeConfigApplied, cloudIntrospectRequest, bridgeIntrospect, cloudTypeRequest, bridgeTypeDefinitions, cloudInvoke, cloudCancel, cloudPublish, bridgeJobUpdate, bridgeJobLost, snapshotHeader, cloudCameraStart, cloudCameraStop, bridgeCameraState, SNAPSHOT_MAX_BYTES, CLOSE_ROBOT_DELETED, CLOSE_TOKEN_ROTATED, bridgeAssetsAvailable, cloudAssetRequest, bridgeAssetProgress, activeJob, DEFAULT_PATIENCE_MS, MAX_PATIENCE_MS, MIN_PATIENCE_MS, } from './protocol.js';
+export { PROTOCOL_VERSION, PROTOCOL_VERSIONS, PROTOCOL_SUNSET_DAYS, LATEST_BRIDGE_VERSION, protocolStatus, minimumProtocolVersion, sunsetOf, statusFromTable, bridgeHello, cloudHelloOk, cloudHelloError, cloudPing, bridgePong, bridgeLinkMode, datapointFrame, bridgeState, cloudConfig, bridgeConfigApplied, cloudIntrospectRequest, bridgeIntrospect, cloudTypeRequest, bridgeTypeDefinitions, cloudInvoke, cloudCancel, cloudPublish, bridgeJobUpdate, bridgeJobLost, snapshotHeader, cloudCameraStart, cloudCameraStop, bridgeCameraState, SNAPSHOT_MAX_BYTES, CLOSE_ROBOT_DELETED, CLOSE_TOKEN_ROTATED, bridgeAssetsAvailable, cloudAssetRequest, bridgeAssetProgress, activeJob, DEFAULT_PATIENCE_MS, MAX_PATIENCE_MS, MIN_PATIENCE_MS, JOB_HEARTBEAT_INTERVAL_MS, JOB_HEARTBEAT_TIMEOUT_MS, JOB_OFFLINE_GRACE_MS, } from './protocol.js';
 export type { ProtocolVersionEntry, ProtocolStatus, BridgeHello, CloudHelloOk, CloudHelloError, CloudPing, BridgePong, BridgeLinkMode, DatapointFrame, BridgeState, CloudConfig, BridgeConfigApplied, CloudIntrospectRequest, BridgeIntrospect, CloudTypeRequest, BridgeTypeDefinitions, CloudInvoke, CloudCancel, CloudPublish, BridgeJobUpdate, BridgeJobLost, SnapshotHeader, CloudCameraStart, CloudCameraStop, BridgeCameraState, ActiveJob, BridgeAssetsAvailable, CloudAssetRequest, BridgeAssetProgress, } from './protocol.js';
 export { jobState, job, jobEvent, busyDetails, publisherBusyDetails, jobQueueFullDetails } from './jobs.js';
 export type { JobState, Job, JobEvent, BusyDetails, PublisherBusyDetails, JobQueueFullDetails, } from './jobs.js';
@@ -31,14 +31,14 @@ export { clientAuth, authOk, authError, clientInvoke, clientCancel, clientPublis
 export type { ClientAuth, AuthOk, AuthError, ClientInvoke, ClientCancel, ClientPublish, CommandResult, ErrorFrame, ClientSubscribe, ClientUnsubscribe, SubscribeError, DatapointEvent, ResourceHealthEvent, ResourceHealthCleared, LiveSessionEndReason, LiveSessionEvent, OrgEventKind, OrgEventSeverity, OrgEvent, OrgEventSubscribe, OrgEventUnsubscribe, OrgEventReplay, OrgEventDropped, } from './realtime.js';
 export { password, org, patchOrgResponse, sessionTokens, refreshRequest, signUpRequest, signUpResponse, waitlistRequest, developerLoginRequest, USER_DISPLAY_NAME_MAX, orgAdminTier, fleetlessUser, fleetlessUserListResponse, createTeamInviteRequest, teamInvite, pendingTeamInvite, pendingTeamInviteListResponse, acceptTeamInviteRequest, patchFleetlessUserRequest, tierChangeRequest, mailStatus, tierRequiredDetails, passwordChangeRequest, passwordResetRequest, passwordResetConfirm, idpIssuer, authMeResponse, patchOrgRequest, patchAuthMeRequest, } from './identity.js';
 export type { Org, PatchOrgResponse, SessionTokens, RefreshRequest, SignUpRequest, SignUpResponse, WaitlistRequest, DeveloperLoginRequest, OrgAdminTier, FleetlessUser, FleetlessUserListResponse, CreateTeamInviteRequest, TeamInvite, PendingTeamInvite, PendingTeamInviteListResponse, AcceptTeamInviteRequest, PatchFleetlessUserRequest, TierChangeRequest, MailStatus, TierRequiredDetails, PasswordChangeRequest, PasswordResetRequest, PasswordResetConfirm, IdpIssuer, AuthMeResponse, PatchOrgRequest, PatchAuthMeRequest, } from './identity.js';
-export { appIdentifier, app, appListResponse, createAppRequest, updateAppRequest, serverKeyToken, serverKey, serverKeyListResponse, createServerKeyResponse, role, roleListResponse, rolePermissions, } from './apps.js';
-export type { App, AppListResponse, CreateAppRequest, UpdateAppRequest, ServerKey, ServerKeyListResponse, CreateServerKeyResponse, Role, RoleListResponse, RolePermissions, } from './apps.js';
+export { appIdentifier, app, appListResponse, appDeletionSummary, createAppRequest, updateAppRequest, serverKeyToken, serverKey, serverKeyListResponse, createServerKeyResponse, role, roleListResponse, rolePermissions, } from './apps.js';
+export type { App, AppListResponse, AppDeletionSummary, CreateAppRequest, UpdateAppRequest, ServerKey, ServerKeyListResponse, CreateServerKeyResponse, Role, RoleListResponse, RolePermissions, } from './apps.js';
 export { clientLoginRequest, clientRefreshRequest, clientLogoutRequest, clientRegisterRequest, clientVerifyEmailRequest, clientResendVerificationRequest, clientPasswordResetRequest, clientPasswordResetConfirmRequest, clientAcceptInvitationRequest, CLIENT_OIDC_CALLBACK_PATH, clientProviderListQuery, clientProviderListResponse, clientOidcStartQuery, clientOidcCallbackQuery, clientOidcExchangeRequest, clientOidcErrorCode, clientMcpInteraction, clientMcpInteractionDecisionResponse, mcpConsentGrant, mcpConsentGrantListResponse, clientIdentity, } from './client-auth.js';
 export type { ClientLoginRequest, ClientRefreshRequest, ClientLogoutRequest, ClientRegisterRequest, ClientVerifyEmailRequest, ClientResendVerificationRequest, ClientPasswordResetRequest, ClientPasswordResetConfirmRequest, ClientAcceptInvitationRequest, ClientProviderListQuery, ClientProviderListResponse, ClientOidcStartQuery, ClientOidcCallbackQuery, ClientOidcExchangeRequest, ClientOidcErrorCode, ClientMcpInteraction, ClientMcpInteractionDecisionResponse, McpConsentGrant, McpConsentGrantListResponse, ClientIdentity, } from './client-auth.js';
 export { clientRobotListItem, clientRobotListResponse } from './client-robots.js';
 export type { ClientRobotListItem, ClientRobotListResponse } from './client-robots.js';
-export { APP_USER_DISPLAY_NAME_MAX, APP_URL_PLACEHOLDERS, MAIL_TEMPLATE_VARIABLES, DEFAULT_MAIL_TEMPLATES, providerSlug, appUserStatus, appUser, appUserListResponse, createAppUserRequest, patchAppUserRequest, createAppInvitationRequest, appInvitation, pendingAppInvitation, appInvitationListResponse, appOidcProvider, appOidcProviderListResponse, createAppOidcProviderRequest, patchAppOidcProviderRequest, appUrlTemplate, allowedOrigin, emailDomain, appAuthConfig, putAppAuthConfigRequest, mailTemplateKind, appMailTemplate, appMailTemplateListResponse, putAppMailTemplateRequest, mailTemplatePreviewRequest, mailTemplatePreviewResponse, mailTemplateProblemDetails, mailOutcome, } from './app-users.js';
-export type { AppUserStatus, AppUser, AppUserListResponse, CreateAppUserRequest, PatchAppUserRequest, CreateAppInvitationRequest, AppInvitation, PendingAppInvitation, AppInvitationListResponse, AppOidcProvider, AppOidcProviderListResponse, CreateAppOidcProviderRequest, PatchAppOidcProviderRequest, AppAuthConfig, PutAppAuthConfigRequest, MailTemplateKind, AppMailTemplate, AppMailTemplateListResponse, PutAppMailTemplateRequest, MailTemplatePreviewRequest, MailTemplatePreviewResponse, MailTemplateProblemDetails, MailOutcome, } from './app-users.js';
+export { APP_USER_DISPLAY_NAME_MAX, APP_URL_PLACEHOLDERS, MAIL_TEMPLATE_VARIABLES, DEFAULT_MAIL_TEMPLATES, providerSlug, appUserStatus, appUser, appUserListResponse, createAppUserRequest, patchAppUserRequest, createAppInvitationRequest, appInvitation, pendingAppInvitation, appInvitationListResponse, appOidcProvider, appOidcProviderListResponse, createAppOidcProviderRequest, patchAppOidcProviderRequest, appUrlTemplate, allowedOrigin, emailDomain, appAuthConfig, putAppAuthRegistrationRequest, putAppAuthUrlsRequest, putAppAuthMcpRequest, mailTemplateKind, appMailTemplate, appMailTemplateListResponse, putAppMailTemplateRequest, mailTemplatePreviewRequest, mailTemplatePreviewResponse, mailTemplateProblemDetails, mailOutcome, } from './app-users.js';
+export type { AppUserStatus, AppUser, AppUserListResponse, CreateAppUserRequest, PatchAppUserRequest, CreateAppInvitationRequest, AppInvitation, PendingAppInvitation, AppInvitationListResponse, AppOidcProvider, AppOidcProviderListResponse, CreateAppOidcProviderRequest, PatchAppOidcProviderRequest, AppAuthConfig, PutAppAuthRegistrationRequest, PutAppAuthUrlsRequest, PutAppAuthMcpRequest, MailTemplateKind, AppMailTemplate, AppMailTemplateListResponse, PutAppMailTemplateRequest, MailTemplatePreviewRequest, MailTemplatePreviewResponse, MailTemplateProblemDetails, MailOutcome, } from './app-users.js';
 export { assetKind, URDF_ASSET_NAME, asset, urdfCompleteness, assetListResponse, assetsClearResponse, missingAssetQuery, assetSyncRequest, assetSyncResponse, assetSyncState, assetSyncStatus, assetFailure, assetFailureKind, assetStoreRefusedDetails, assetSyncBusyDetails, ROBOT_ASSET_STORE_BYTES, } from './assets.js';
 export type { AssetKind, Asset, UrdfCompleteness, AssetListResponse, AssetsClearResponse, MissingAssetQuery, AssetSyncRequest, AssetSyncResponse, AssetSyncState, AssetSyncStatus, AssetFailure, AssetFailureKind, AssetStoreRefusedDetails, AssetSyncBusyDetails, } from './assets.js';
 export { auditActor, auditEvent, auditQuery, auditListResponse, AUDIT_CSV_COLUMNS, AUDIT_RETENTION_DAYS } from './audit.js';

package/dist/index.js

@@ -5,7 +5,7 @@ export { PROTOCOL_VERSION, PROTOCOL_VERSIONS, PROTOCOL_SUNSET_DAYS, LATEST_BRIDG
 // Assets.
 bridgeAssetsAvailable, cloudAssetRequest, bridgeAssetProgress, 
 // Addressing.
-activeJob, DEFAULT_PATIENCE_MS, MAX_PATIENCE_MS, MIN_PATIENCE_MS, } from './protocol.js';
+activeJob, DEFAULT_PATIENCE_MS, MAX_PATIENCE_MS, MIN_PATIENCE_MS, JOB_HEARTBEAT_INTERVAL_MS, JOB_HEARTBEAT_TIMEOUT_MS, JOB_OFFLINE_GRACE_MS, } from './protocol.js';
 export { jobState, job, jobEvent, busyDetails, publisherBusyDetails, jobQueueFullDetails } from './jobs.js';
 export { JOB_RUN_PAGE_MAX, JOB_RUN_RETENTION_DAYS, jobActor, jobRunKind, jobRun, jobRunQuery, jobRunListResponse, jobRunSummaryQuery, jobRunSummary, } from './jobs.js';
 export { FLEETLESS_FORMAT_VERSION, RESERVED_SLUGS, parameterType, parameterSpec, parameterMap, serviceDescription, parameterDescription, messageTemplate, messageRef, messageBody, messageMap, PLACEHOLDER_RE, placeholderNames, actionConfig, serviceConfig, publisherConfig, cameraConfig, alertCondition, datapointAlert, rateThrottleHz, datapointNumeric, datapointRetention, datapointChart, datapointConfig, lowBandwidthSection, LOW_BANDWIDTH_DEFAULTS, robotConfigDoc, validationIssue, configState, snapshotIntervalSeconds, 
@@ -38,11 +38,11 @@ USER_DISPLAY_NAME_MAX, orgAdminTier, fleetlessUser, fleetlessUserListResponse, c
 mailStatus, tierRequiredDetails, passwordChangeRequest, passwordResetRequest, passwordResetConfirm, idpIssuer, 
 // auth/me, org and member patches.
 authMeResponse, patchOrgRequest, patchAuthMeRequest, } from './identity.js';
-export { appIdentifier, app, appListResponse, createAppRequest, updateAppRequest, serverKeyToken, serverKey, serverKeyListResponse, createServerKeyResponse, role, roleListResponse, rolePermissions, } from './apps.js';
+export { appIdentifier, app, appListResponse, appDeletionSummary, createAppRequest, updateAppRequest, serverKeyToken, serverKey, serverKeyListResponse, createServerKeyResponse, role, roleListResponse, rolePermissions, } from './apps.js';
 export { clientLoginRequest, clientRefreshRequest, clientLogoutRequest, clientRegisterRequest, clientVerifyEmailRequest, clientResendVerificationRequest, clientPasswordResetRequest, clientPasswordResetConfirmRequest, clientAcceptInvitationRequest, CLIENT_OIDC_CALLBACK_PATH, clientProviderListQuery, clientProviderListResponse, clientOidcStartQuery, clientOidcCallbackQuery, clientOidcExchangeRequest, clientOidcErrorCode, clientMcpInteraction, clientMcpInteractionDecisionResponse, mcpConsentGrant, mcpConsentGrantListResponse, clientIdentity, } from './client-auth.js';
 export { clientRobotListItem, clientRobotListResponse } from './client-robots.js';
 // The per-app identity space.
-export { APP_USER_DISPLAY_NAME_MAX, APP_URL_PLACEHOLDERS, MAIL_TEMPLATE_VARIABLES, DEFAULT_MAIL_TEMPLATES, providerSlug, appUserStatus, appUser, appUserListResponse, createAppUserRequest, patchAppUserRequest, createAppInvitationRequest, appInvitation, pendingAppInvitation, appInvitationListResponse, appOidcProvider, appOidcProviderListResponse, createAppOidcProviderRequest, patchAppOidcProviderRequest, appUrlTemplate, allowedOrigin, emailDomain, appAuthConfig, putAppAuthConfigRequest, mailTemplateKind, appMailTemplate, appMailTemplateListResponse, putAppMailTemplateRequest, mailTemplatePreviewRequest, mailTemplatePreviewResponse, mailTemplateProblemDetails, mailOutcome, } from './app-users.js';
+export { APP_USER_DISPLAY_NAME_MAX, APP_URL_PLACEHOLDERS, MAIL_TEMPLATE_VARIABLES, DEFAULT_MAIL_TEMPLATES, providerSlug, appUserStatus, appUser, appUserListResponse, createAppUserRequest, patchAppUserRequest, createAppInvitationRequest, appInvitation, pendingAppInvitation, appInvitationListResponse, appOidcProvider, appOidcProviderListResponse, createAppOidcProviderRequest, patchAppOidcProviderRequest, appUrlTemplate, allowedOrigin, emailDomain, appAuthConfig, putAppAuthRegistrationRequest, putAppAuthUrlsRequest, putAppAuthMcpRequest, mailTemplateKind, appMailTemplate, appMailTemplateListResponse, putAppMailTemplateRequest, mailTemplatePreviewRequest, mailTemplatePreviewResponse, mailTemplateProblemDetails, mailOutcome, } from './app-users.js';
 export { assetKind, URDF_ASSET_NAME, asset, urdfCompleteness, assetListResponse, assetsClearResponse, missingAssetQuery, assetSyncRequest, assetSyncResponse, assetSyncState, assetSyncStatus, assetFailure, assetFailureKind, assetStoreRefusedDetails, assetSyncBusyDetails, ROBOT_ASSET_STORE_BYTES, } from './assets.js';
 export { auditActor, auditEvent, auditQuery, auditListResponse, AUDIT_CSV_COLUMNS, AUDIT_RETENTION_DAYS } from './audit.js';
 export { alertRowCondition, alertSeverity, alertState, datapointAlertRow, alertListResponse, orgFiringAlertsResponse, orgAlertsQuery, datapointDisplay, putDatapointDisplayRequest, } from './alerts.js';

package/dist/protocol.d.ts

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 import { z } from 'zod';
 /**
- * Bridge <-> cloud protocol, version 3.
+ * Bridge <-> cloud protocol, version 4.
  *
  * The version is exchanged in the hello handshake. Since 2026-09 the cloud
  * serves a **window** of versions, not one: every entry of
@@ -11,6 +11,18 @@ import { z } from 'zod';
  * which names the window and reaches the robot's detail view as
  * `last_hello_error`.
  *
+ * **4 (2026-09-28):** the bridge sends a `job_update` heartbeat at
+ * `JOB_HEARTBEAT_INTERVAL_MS` for every running job, whether or not the
+ * action said anything new, and reports a vanished action server with
+ * `job_lost`'s new optional `error`, `action_server_lost`. The cloud bounds
+ * a protocol-4 job's silence by the heartbeat (`JOB_HEARTBEAT_TIMEOUT_MS`)
+ * once it has heard from the job at all; `patience_ms` still bounds
+ * acceptance, the same as before. Offline tolerance is
+ * `JOB_OFFLINE_GRACE_MS` (five minutes), up from the informal one minute a
+ * protocol-3 bridge got. A protocol-3 bridge sends no heartbeat and keeps
+ * today's behaviour exactly: `patience_ms` alone bounds the whole running
+ * job, silence included.
+ *
  * **3 (2026-09-22):** the ping carries `latency_ms` and `lag_ms`, the bridge
  * sends `link_mode`, `bridge_state` gains `low_bandwidth`, and the
  * `bridge_pressure` datapoint is gone. A protocol-2 bridge is served until
@@ -23,7 +35,7 @@ import { z } from 'zod';
  * **2 (2026-08-21):** `config_applied.errors` entries gained `kind` and `code`
  * beside `message`.
  */
-export declare const PROTOCOL_VERSION = 3;
+export declare const PROTOCOL_VERSION = 4;
 /** Days between a version's deprecation and its sunset. */
 export declare const PROTOCOL_SUNSET_DAYS = 90;
 export interface ProtocolVersionEntry {
@@ -36,13 +48,15 @@ export interface ProtocolVersionEntry {
 /**
  * Every protocol version the cloud has served, oldest first. A test keeps
  * exactly one entry current and equal to `PROTOCOL_VERSION`; `test/changelog.test.ts`
- * requires the CHANGELOG's current section to name the newest `bridge_from`
- * and the previous entry's `sunsetOf(...)` date, and `scripts/verify-version-tag.mjs`
- * requires a dated heading for the tag being released.
+ * requires some CHANGELOG section — `[Unreleased]` or a dated one — to name
+ * the newest `bridge_from` together with the previous entry's `sunsetOf(...)`
+ * date, so the pull request that moves this window is the one that fails
+ * without saying so; and `scripts/verify-version-tag.mjs` requires a dated
+ * heading for the tag being released.
  */
 export declare const PROTOCOL_VERSIONS: readonly ProtocolVersionEntry[];
 /** The newest bridge package. The cloud mails organisations still below it. */
-export declare const LATEST_BRIDGE_VERSION = "4.0.0";
+export declare const LATEST_BRIDGE_VERSION = "4.1.0";
 export interface ProtocolStatus {
     status: 'current' | 'deprecated' | 'unsupported';
     /** ISO date, or null for a current or unknown version. */
@@ -128,6 +142,40 @@ export declare const MAX_PATIENCE_MS = 120000;
  * this end bounds what the caller can do to the robot.
  */
 export declare const MIN_PATIENCE_MS = 1000;
+/**
+ * How often a protocol-4 bridge sends a `job_update` heartbeat for every
+ * running job — the last known state, whether or not the action itself said
+ * anything new. One second: often enough that `JOB_HEARTBEAT_TIMEOUT_MS`
+ * can be a small multiple of it and still absorb a missed beat or two, rare
+ * enough that it costs nothing next to the datapoint traffic a busy robot
+ * already sends.
+ */
+export declare const JOB_HEARTBEAT_INTERVAL_MS = 1000;
+/**
+ * How long a protocol-4 job may go without a `job_update` — heartbeat or
+ * real progress, either counts — before the cloud settles it `lost` with
+ * `bridge_timeout`, once the bridge is connected. Five heartbeats: enough
+ * slack for an ordinary scheduling jitter, small next to `patience_ms`
+ * because it no longer has to cover the acceptance gap too. `patience_ms`
+ * bounds only the time from `invoke` to the *first* update on a protocol-4
+ * job; every rearm after that uses this constant instead. A protocol-3
+ * bridge sends no heartbeat, so this constant does not apply to it —
+ * `patience_ms` keeps bounding the whole running job there, exactly as
+ * before.
+ */
+export declare const JOB_HEARTBEAT_TIMEOUT_MS = 5000;
+/**
+ * How long a running job survives its robot going offline before the cloud
+ * gives up and settles it `lost` with `bridge_disconnected`. Five minutes:
+ * long enough that an ordinary Wi-Fi dead zone — the case this constant
+ * exists for — never costs a job, since a robot with no safety layer of its
+ * own (§ Fleetless is not a safety layer) keeps driving through one and the
+ * result the cloud is waiting for is often still coming. A robot connected
+ * the whole time never reaches this bound at all: while online, silence is
+ * `JOB_HEARTBEAT_TIMEOUT_MS`'s question (protocol 4) or `patience_ms`'s
+ * (protocol 3), never this one's.
+ */
+export declare const JOB_OFFLINE_GRACE_MS = 300000;
 /** Re-exported so consumers keep importing wire names from one place. */
 export { slug } from './common.js';
 /**
@@ -598,10 +646,23 @@ export type BridgeJobUpdate = z.infer<typeof bridgeJobUpdate>;
  * left to enumerate, so it is `hello.active_job_ids` that closes that gap.
  * Both paths end in the same place — the cloud publishes `lost` rather than
  * leaving a job reading "running" because nobody contradicted it.
+ *
+ * **`error` (since protocol 4) is optional and, when present, applies to
+ * every job named in `job_ids`.** A vanished action server is discovered
+ * once, by the bridge's own liveness check on that one goal, so a frame
+ * naming several jobs at once — plausible if several goals shared the same
+ * server — always shares the same cause. Absent means today's behaviour:
+ * the cloud settles the job `lost` with no specific code, the same as a
+ * protocol-3 bridge's frame, which carries no `error` at all and still
+ * parses under this schema unchanged.
  */
 export declare const bridgeJobLost: z.ZodObject<{
     type: z.ZodLiteral<"job_lost">;
     job_ids: z.ZodArray<z.ZodUUID>;
+    error: z.ZodOptional<z.ZodObject<{
+        code: z.ZodString;
+        message: z.ZodString;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 export type BridgeJobLost = z.infer<typeof bridgeJobLost>;
 /** Cloud asks for a fresh ROS graph; `request_id` correlates the answer. */

package/dist/protocol.js

@@ -7,7 +7,7 @@ import { rosGraph, typeDefinition } from './introspection.js';
 import { jobState } from './jobs.js';
 import { rosTypeName } from './common.js';
 /**
- * Bridge <-> cloud protocol, version 3.
+ * Bridge <-> cloud protocol, version 4.
  *
  * The version is exchanged in the hello handshake. Since 2026-09 the cloud
  * serves a **window** of versions, not one: every entry of
@@ -17,6 +17,18 @@ import { rosTypeName } from './common.js';
  * which names the window and reaches the robot's detail view as
  * `last_hello_error`.
  *
+ * **4 (2026-09-28):** the bridge sends a `job_update` heartbeat at
+ * `JOB_HEARTBEAT_INTERVAL_MS` for every running job, whether or not the
+ * action said anything new, and reports a vanished action server with
+ * `job_lost`'s new optional `error`, `action_server_lost`. The cloud bounds
+ * a protocol-4 job's silence by the heartbeat (`JOB_HEARTBEAT_TIMEOUT_MS`)
+ * once it has heard from the job at all; `patience_ms` still bounds
+ * acceptance, the same as before. Offline tolerance is
+ * `JOB_OFFLINE_GRACE_MS` (five minutes), up from the informal one minute a
+ * protocol-3 bridge got. A protocol-3 bridge sends no heartbeat and keeps
+ * today's behaviour exactly: `patience_ms` alone bounds the whole running
+ * job, silence included.
+ *
  * **3 (2026-09-22):** the ping carries `latency_ms` and `lag_ms`, the bridge
  * sends `link_mode`, `bridge_state` gains `low_bandwidth`, and the
  * `bridge_pressure` datapoint is gone. A protocol-2 bridge is served until
@@ -29,22 +41,25 @@ import { rosTypeName } from './common.js';
  * **2 (2026-08-21):** `config_applied.errors` entries gained `kind` and `code`
  * beside `message`.
  */
-export const PROTOCOL_VERSION = 3;
+export const PROTOCOL_VERSION = 4;
 /** Days between a version's deprecation and its sunset. */
 export const PROTOCOL_SUNSET_DAYS = 90;
 /**
  * Every protocol version the cloud has served, oldest first. A test keeps
  * exactly one entry current and equal to `PROTOCOL_VERSION`; `test/changelog.test.ts`
- * requires the CHANGELOG's current section to name the newest `bridge_from`
- * and the previous entry's `sunsetOf(...)` date, and `scripts/verify-version-tag.mjs`
- * requires a dated heading for the tag being released.
+ * requires some CHANGELOG section — `[Unreleased]` or a dated one — to name
+ * the newest `bridge_from` together with the previous entry's `sunsetOf(...)`
+ * date, so the pull request that moves this window is the one that fails
+ * without saying so; and `scripts/verify-version-tag.mjs` requires a dated
+ * heading for the tag being released.
  */
 export const PROTOCOL_VERSIONS = [
     { version: 2, bridge_from: '3.0.0', deprecated_at: '2026-09-22' },
-    { version: 3, bridge_from: '4.0.0', deprecated_at: null },
+    { version: 3, bridge_from: '4.0.0', deprecated_at: '2026-09-28' },
+    { version: 4, bridge_from: '4.1.0', deprecated_at: null },
 ];
 /** The newest bridge package. The cloud mails organisations still below it. */
-export const LATEST_BRIDGE_VERSION = '4.0.0';
+export const LATEST_BRIDGE_VERSION = '4.1.0';
 const DAY_MS = 24 * 60 * 60 * 1000;
 function isoDate(date) {
     return date.toISOString().slice(0, 10);
@@ -146,6 +161,40 @@ export const MAX_PATIENCE_MS = 120_000;
  * this end bounds what the caller can do to the robot.
  */
 export const MIN_PATIENCE_MS = 1_000;
+/**
+ * How often a protocol-4 bridge sends a `job_update` heartbeat for every
+ * running job — the last known state, whether or not the action itself said
+ * anything new. One second: often enough that `JOB_HEARTBEAT_TIMEOUT_MS`
+ * can be a small multiple of it and still absorb a missed beat or two, rare
+ * enough that it costs nothing next to the datapoint traffic a busy robot
+ * already sends.
+ */
+export const JOB_HEARTBEAT_INTERVAL_MS = 1_000;
+/**
+ * How long a protocol-4 job may go without a `job_update` — heartbeat or
+ * real progress, either counts — before the cloud settles it `lost` with
+ * `bridge_timeout`, once the bridge is connected. Five heartbeats: enough
+ * slack for an ordinary scheduling jitter, small next to `patience_ms`
+ * because it no longer has to cover the acceptance gap too. `patience_ms`
+ * bounds only the time from `invoke` to the *first* update on a protocol-4
+ * job; every rearm after that uses this constant instead. A protocol-3
+ * bridge sends no heartbeat, so this constant does not apply to it —
+ * `patience_ms` keeps bounding the whole running job there, exactly as
+ * before.
+ */
+export const JOB_HEARTBEAT_TIMEOUT_MS = 5_000;
+/**
+ * How long a running job survives its robot going offline before the cloud
+ * gives up and settles it `lost` with `bridge_disconnected`. Five minutes:
+ * long enough that an ordinary Wi-Fi dead zone — the case this constant
+ * exists for — never costs a job, since a robot with no safety layer of its
+ * own (§ Fleetless is not a safety layer) keeps driving through one and the
+ * result the cloud is waiting for is often still coming. A robot connected
+ * the whole time never reaches this bound at all: while online, silence is
+ * `JOB_HEARTBEAT_TIMEOUT_MS`'s question (protocol 4) or `patience_ms`'s
+ * (protocol 3), never this one's.
+ */
+export const JOB_OFFLINE_GRACE_MS = 300_000;
 /** Re-exported so consumers keep importing wire names from one place. */
 export { slug } from './common.js';
 /**
@@ -440,10 +489,20 @@ export const bridgeJobUpdate = z.object({
  * left to enumerate, so it is `hello.active_job_ids` that closes that gap.
  * Both paths end in the same place — the cloud publishes `lost` rather than
  * leaving a job reading "running" because nobody contradicted it.
+ *
+ * **`error` (since protocol 4) is optional and, when present, applies to
+ * every job named in `job_ids`.** A vanished action server is discovered
+ * once, by the bridge's own liveness check on that one goal, so a frame
+ * naming several jobs at once — plausible if several goals shared the same
+ * server — always shares the same cause. Absent means today's behaviour:
+ * the cloud settles the job `lost` with no specific code, the same as a
+ * protocol-3 bridge's frame, which carries no `error` at all and still
+ * parses under this schema unchanged.
  */
 export const bridgeJobLost = z.object({
     type: z.literal('job_lost'),
     job_ids: z.array(z.uuid()),
+    error: z.object({ code: z.string().min(1), message: z.string().min(1) }).optional(),
 });
 /** Cloud asks for a fresh ROS graph; `request_id` correlates the answer. */
 export const cloudIntrospectRequest = z.object({

package/dist/realtime.d.ts

@@ -256,8 +256,8 @@ export declare const liveSessionEndReason: z.ZodEnum<{
     unknown: "unknown";
     publish_failed: "publish_failed";
     robot_offline: "robot_offline";
-    released_by_peer: "released_by_peer";
     config_changed: "config_changed";
+    released_by_peer: "released_by_peer";
     revoked: "revoked";
     expired: "expired";
     robot_deleted: "robot_deleted";
@@ -287,8 +287,8 @@ export declare const liveSessionEvent: z.ZodObject<{
         unknown: "unknown";
         publish_failed: "publish_failed";
         robot_offline: "robot_offline";
-        released_by_peer: "released_by_peer";
         config_changed: "config_changed";
+        released_by_peer: "released_by_peer";
         revoked: "revoked";
         expired: "expired";
         robot_deleted: "robot_deleted";

package/dist/rest.d.ts

@@ -1440,6 +1440,8 @@ export type HistoryResponse = z.infer<typeof historyResponse>;
  * |---|---|---|
  * | `DELETE /api/robots/:id` | — | `204`. `?force=true` to proceed while a live session is open; without it, `409 robot_in_use` |
  * | `GET /api/robots/:id/deletion-preview` | — | `robotDeletionSummary` — the same shape the audit event carries |
+ * | `DELETE /api/apps/:id` | — | `204`. No `force` parameter — an app has no open-session hazard to force past, so the preview is the guard |
+ * | `GET /api/apps/:id/deletion-preview` | — | `appDeletionSummary` — the same shape the audit event carries |
  * | `GET /api/org/health` | — | `resourceHealthListResponse`; `?robot_id=` narrows it to one robot |
  *
  * Plus `resourceHealthEvent`, pushed on the **developer** realtime socket

package/dist/rest.js

@@ -1228,6 +1228,8 @@ export const historyResponse = z.union([historySamplesResponse, historyBucketsRe
  * |---|---|---|
  * | `DELETE /api/robots/:id` | — | `204`. `?force=true` to proceed while a live session is open; without it, `409 robot_in_use` |
  * | `GET /api/robots/:id/deletion-preview` | — | `robotDeletionSummary` — the same shape the audit event carries |
+ * | `DELETE /api/apps/:id` | — | `204`. No `force` parameter — an app has no open-session hazard to force past, so the preview is the guard |
+ * | `GET /api/apps/:id/deletion-preview` | — | `appDeletionSummary` — the same shape the audit event carries |
  * | `GET /api/org/health` | — | `resourceHealthListResponse`; `?robot_id=` narrows it to one robot |
  *
  * Plus `resourceHealthEvent`, pushed on the **developer** realtime socket

package/dist/routes.js

@@ -1,11 +1,11 @@
 // SPDX-License-Identifier: Apache-2.0
-import { appListResponse, createAppRequest, createServerKeyResponse, app as appSchema, role, roleListResponse, rolePermissions, serverKeyListResponse, updateAppRequest, } from './apps.js';
+import { appListResponse, appDeletionSummary, createAppRequest, createServerKeyResponse, app as appSchema, role, roleListResponse, rolePermissions, serverKeyListResponse, updateAppRequest, } from './apps.js';
 import { alertListResponse, orgAlertsQuery, orgFiringAlertsResponse } from './alerts.js';
 import { asset, assetListResponse, assetsClearResponse, assetSyncRequest, assetSyncResponse, assetSyncStatus, missingAssetQuery } from './assets.js';
 import { auditListResponse, auditQuery } from './audit.js';
 import { CLIENT_OIDC_CALLBACK_PATH, clientAcceptInvitationRequest, clientIdentity, clientLoginRequest, clientLogoutRequest, clientMcpInteraction, clientMcpInteractionDecisionResponse, clientOidcCallbackQuery, clientOidcExchangeRequest, clientOidcStartQuery, clientPasswordResetConfirmRequest, clientPasswordResetRequest, clientProviderListQuery, clientProviderListResponse, clientRefreshRequest, clientRegisterRequest, clientResendVerificationRequest, clientVerifyEmailRequest, mcpConsentGrantListResponse, } from './client-auth.js';
 import { clientRobotListResponse } from './client-robots.js';
-import { appAuthConfig, appInvitation, appInvitationListResponse, appMailTemplate, appMailTemplateListResponse, appOidcProvider, appOidcProviderListResponse, appUser, appUserListResponse, createAppInvitationRequest, createAppOidcProviderRequest, createAppUserRequest, mailOutcome, mailTemplatePreviewRequest, mailTemplatePreviewResponse, patchAppOidcProviderRequest, patchAppUserRequest, putAppAuthConfigRequest, putAppMailTemplateRequest, } from './app-users.js';
+import { appAuthConfig, appInvitation, appInvitationListResponse, appMailTemplate, appMailTemplateListResponse, appOidcProvider, appOidcProviderListResponse, appUser, appUserListResponse, createAppInvitationRequest, createAppOidcProviderRequest, createAppUserRequest, mailOutcome, mailTemplatePreviewRequest, mailTemplatePreviewResponse, patchAppOidcProviderRequest, patchAppUserRequest, putAppAuthMcpRequest, putAppAuthRegistrationRequest, putAppAuthUrlsRequest, putAppMailTemplateRequest, } from './app-users.js';
 import { acceptTeamInviteRequest, authMeResponse, createTeamInviteRequest, fleetlessUser, fleetlessUserListResponse, passwordChangeRequest, passwordResetConfirm, passwordResetRequest, patchAuthMeRequest, patchFleetlessUserRequest, patchOrgRequest, patchOrgResponse, pendingTeamInviteListResponse, refreshRequest, sessionTokens, signUpRequest, signUpResponse, teamInvite, tierChangeRequest, waitlistRequest, } from './identity.js';
 import { jobRunListResponse, jobRunQuery, jobRunSummary, jobRunSummaryQuery } from './jobs.js';
 import { MCP_APP_PATHS, mcpRobotDatasheet, mcpRolePreviewResponse } from './mcp.js';
@@ -295,6 +295,32 @@ export const ROUTES = [
         notes: 'A `default_role_id` naming a role of another app is refused: it is the one cross-app authorization check this shape can carry. ' +
             'Changing the robot set closes every live subscription the app\'s users hold, since a grant may no longer name a reachable robot.',
     },
+    {
+        method: 'GET', path: '/api/apps/:id/deletion-preview', section: 'apps',
+        summary: 'Reports what deleting the app would destroy, without destroying it.',
+        audience: 'developer', auth: 'developer', rateLimited: false, ownerTier: false, status: 200,
+        params: [{ name: 'id', description: 'The app\'s uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`.' }],
+        query: null, request: null, response: appDeletionSummary,
+        errors: [...DEVELOPER_GUARD, 'invalid_uuid', 'not_found'], transport: 'http',
+        notes: 'The same shape the delete\'s own audit event carries, computed by the same function on purpose: the confirmation dialog and the eventual ' +
+            'receipt agree by construction, and any difference between them is real drift rather than two estimates that quietly disagree. \n\n' +
+            '**No `force` parameter, unlike the robot pair this is modelled on.** A robot\'s open live session is a single nameable state whose ' +
+            'interruption is its own hazard, which is why that route makes the caller pass `force` explicitly. An app has no equivalent state to ' +
+            'force past, and inventing one would be a guess wearing a guard\'s clothes — this preview is the guard.',
+    },
+    {
+        method: 'DELETE', path: '/api/apps/:id', section: 'apps',
+        summary: 'Deletes an app and everything it produced.',
+        audience: 'developer', auth: 'developer', rateLimited: false, ownerTier: true, status: 204,
+        params: [{ name: 'id', description: 'The app\'s uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`.' }],
+        query: null, request: null, response: null,
+        errors: [...DEVELOPER_GUARD, 'tier_required', 'invalid_uuid', 'not_found'], transport: 'http',
+        notes: 'Owner tier, and the gate runs **after** the org-scoped lookup: a developer-tier admin therefore sees the same `404` a stranger would ' +
+            'for an app outside their org, rather than a tier refusal that confirms the id exists. A full cascade — its users, roles, server keys, ' +
+            'invitations, OIDC provider configuration and mail templates all go, recorded once as `app.deleted` carrying an `appDeletionSummary`. ' +
+            'Its robots are untouched: they belong to the org, not to the app. \n\n**No `force` parameter** — see ' +
+            '`GET /api/apps/:id/deletion-preview`.',
+    },
     {
         method: 'POST', path: '/api/apps/:id/roles', section: 'apps',
         summary: 'Creates a custom role on the app.',
@@ -681,22 +707,55 @@ export const ROUTES = [
         errors: [...DEVELOPER_GUARD, 'invalid_uuid', 'not_found'], transport: 'http',
         notes: 'One row per app, created with the app and never absent — an app that has configured nothing reads back the defaults rather than a ' +
             '`404`. `oidc_callback_url` is in the answer and not in the request: it is minted by the cloud from its own public base URL, is the same ' +
-            'for every app and every provider, and is the value a developer registers at their identity provider.',
+            'for every app and every provider, and is the value a developer registers at their identity provider. It stays read-only on every slice ' +
+            'write below for a second reason: a writable callback URL would let a caller point the return leg of an OIDC sign-in, which carries an ' +
+            'authorization code, at a host they own. `updated_at` is read-only for a duller one: the server stamps it on every write, and a ' +
+            'client-supplied value would be a lie about when the row last changed.',
+    },
+    {
+        method: 'PUT', path: '/api/apps/:id/auth-config/registration', section: 'apps',
+        summary: 'Replaces who may self-register, and from where.',
+        audience: 'developer', auth: 'developer', rateLimited: false, ownerTier: false, status: 200,
+        params: [{ name: 'id', description: 'The app\'s uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`.' }],
+        query: null, request: putAppAuthRegistrationRequest, response: appAuthConfig,
+        errors: [...DEVELOPER_GUARD, 'invalid_uuid', 'validation_error', 'not_found'], transport: 'http',
+        notes: '**A replace, not a merge, and `.strict()`**: `self_registration`, `allowed_domains` and `allowed_origins` all arrive or the write is ' +
+            'refused, so a client built against an older shape cannot silently clear a setting it does not know about. `oidc_callback_url` and ' +
+            '`updated_at` are the server\'s, refused in this body as in every slice\'s — see `GET`\'s notes for why. ' +
+            '\n\n`400 validation_error` is where the two field rules land: an entry in `allowed_domains` must be lowercase, since a capitalised one ' +
+            'can never match a lowercased address, and an entry in `allowed_origins` must be a bare scheme-host-port with no path, since a browser ' +
+            'sends nothing longer in its `Origin` header. Each refuses at configuration time rather than failing silently later. ' +
+            '\n\nThe merge is server-side against the stored row, so this write never disturbs the urls or mcp slice.',
+    },
+    {
+        method: 'PUT', path: '/api/apps/:id/auth-config/urls', section: 'apps',
+        summary: "Replaces the three pages Fleetless's mails point at.",
+        audience: 'developer', auth: 'developer', rateLimited: false, ownerTier: false, status: 200,
+        params: [{ name: 'id', description: 'The app\'s uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`.' }],
+        query: null, request: putAppAuthUrlsRequest, response: appAuthConfig,
+        errors: [...DEVELOPER_GUARD, 'invalid_uuid', 'validation_error', 'not_found'], transport: 'http',
+        notes: '**A replace, not a merge, and `.strict()`**: `invite_url`, `verify_url` and `reset_url` all arrive or the write is refused, so a ' +
+            'client built against an older shape cannot silently clear a setting it does not know about. `oidc_callback_url` and `updated_at` are ' +
+            'the server\'s, refused in this body as in every slice\'s — see `GET`\'s notes for why. ' +
+            '\n\n`400 validation_error` is where the field rule lands: a URL template must be https (or `http` on `localhost`) and carry its ' +
+            'placeholder exactly once — a second occurrence leaves one literal in a mailed link, refused here rather than failing silently once ' +
+            'the mail is sent. ' +
+            '\n\nThe merge is server-side against the stored row, so this write never disturbs the registration or mcp slice.',
     },
     {
-        method: 'PUT', path: '/api/apps/:id/auth-config', section: 'apps',
-        summary: "Replaces the app's auth settings in one write.",
+        method: 'PUT', path: '/api/apps/:id/auth-config/mcp', section: 'apps',
+        summary: 'Replaces the MCP switch and its login URL together.',
         audience: 'developer', auth: 'developer', rateLimited: false, ownerTier: false, status: 200,
         params: [{ name: 'id', description: 'The app\'s uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`.' }],
-        query: null, request: putAppAuthConfigRequest, response: appAuthConfig,
+        query: null, request: putAppAuthMcpRequest, response: appAuthConfig,
         errors: [...DEVELOPER_GUARD, 'invalid_uuid', 'validation_error', 'not_found'], transport: 'http',
-        notes: '**A replace, not a merge, and `.strict()`**: every field arrives or the write is refused, so a client built against an older shape ' +
-            'cannot silently clear a setting it does not know about. `oidc_callback_url` and `updated_at` are refused in the body — a writable ' +
-            'callback URL would let a caller point the return leg of an OIDC sign-in, which carries an authorization code, at a host they own. ' +
-            '\n\n`400 validation_error` is where the three field rules land: a URL template must be https (or `http` on `localhost`) and carry its ' +
-            'placeholder exactly once, an origin must be a bare scheme-host-port with no path, and a domain must be lowercase. Each refuses at ' +
-            'configuration time because each would otherwise fail silently later — a second placeholder leaves one occurrence literal in a mailed ' +
-            'link, an origin with a path can never equal a browser\'s `Origin` header, and a capitalised domain can never match a lowercased address.',
+        notes: '**A replace, not a merge, and `.strict()`**: `mcp_enabled` and `mcp_login_url` both arrive or the write is refused, so a client built ' +
+            'against an older shape cannot silently clear a setting it does not know about. `oidc_callback_url` and `updated_at` are the server\'s, ' +
+            'refused in this body as in every slice\'s — see `GET`\'s notes for why. ' +
+            '\n\n`mcp_login_url` answers to the same rule as the `urls` slice\'s three templates — https (or `http` on `localhost`), its placeholder ' +
+            'exactly once — refused as `400 validation_error` rather than left to fail mid-OAuth, in a client\'s browser where no console screen ' +
+            'is watching. ' +
+            '\n\nThe merge is server-side against the stored row, so this write never disturbs the registration or urls slice.',
     },
     {
         method: 'GET', path: '/api/apps/:id/mail-templates', section: 'apps',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fleetless/contracts",
-  "version": "2.0.0",
+  "version": "4.0.0-next.1",
   "description": "Fleetless wire contracts: the bridge-cloud protocol, the REST API schemas and the error codes, as zod schemas with generated JSON Schema and OpenAPI artifacts.",
   "license": "Apache-2.0",
   "author": "Dehne Robotik GmbH",

package/artifacts/schema/put-app-auth-config-request.schema.json

@@ -1,93 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "type": "object",
-  "properties": {
-    "self_registration": {
-      "type": "boolean",
-      "description": "Whether a stranger may create an account in this app. Off refuses `POST /api/client/register` with `403 registration_closed`, and refuses an unknown identity at an OIDC callback with the same reasoning — one switch for one decision, whichever door the person arrives at."
-    },
-    "allowed_domains": {
-      "maxItems": 50,
-      "type": "array",
-      "items": {
-        "type": "string",
-        "minLength": 1,
-        "maxLength": 253,
-        "pattern": "^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z]{2,63}$"
-      },
-      "description": "The email domains self-registration accepts, lowercase. An empty list means no domain restriction, not \"nobody\" — the switch above is what closes the door. **An invitation always bypasses this**, by password and through a provider alike."
-    },
-    "allowed_origins": {
-      "maxItems": 20,
-      "type": "array",
-      "items": {
-        "type": "string",
-        "maxLength": 200
-      },
-      "description": "The origins the client auth API answers CORS for, and the only origins an OIDC `redirect_uri` may name. Bare origins: scheme, host and port, with no path — a browser sends nothing longer, so an entry carrying one could never match."
-    },
-    "mcp_enabled": {
-      "type": "boolean",
-      "description": "Whether this app serves an MCP endpoint at `/mcp/<identifier>`. Off refuses the whole OAuth surface for the app, not merely the tool calls, and is re-read on every request rather than cached off a token."
-    },
-    "invite_url": {
-      "anyOf": [
-        {
-          "type": "string",
-          "maxLength": 500
-        },
-        {
-          "type": "null"
-        }
-      ],
-      "description": "The page in the developer's app that accepts an invitation, with `{token}` where the token goes. `null` when unconfigured, and then an invitation still issues but `send_mail` is refused with `409 target_state_conflict` — there would be nowhere for the link to point."
-    },
-    "verify_url": {
-      "anyOf": [
-        {
-          "type": "string",
-          "maxLength": 500
-        },
-        {
-          "type": "null"
-        }
-      ],
-      "description": "The page that confirms a new address, with `{token}` where the token goes. Self-registration needs it: without a page to send people to, a registration would leave an account nobody can activate."
-    },
-    "reset_url": {
-      "anyOf": [
-        {
-          "type": "string",
-          "maxLength": 500
-        },
-        {
-          "type": "null"
-        }
-      ],
-      "description": "The page that takes a new password, with `{token}` where the token goes."
-    },
-    "mcp_login_url": {
-      "anyOf": [
-        {
-          "type": "string",
-          "maxLength": 500
-        },
-        {
-          "type": "null"
-        }
-      ],
-      "description": "The page an MCP authorization redirects to, with `{interaction}` where the interaction id goes. Not a token: the id names a pending request the server already holds, and the app authenticates the user itself before approving it."
-    }
-  },
-  "required": [
-    "self_registration",
-    "allowed_domains",
-    "allowed_origins",
-    "mcp_enabled",
-    "invite_url",
-    "verify_url",
-    "reset_url",
-    "mcp_login_url"
-  ],
-  "additionalProperties": false
-}