@fleetless/contracts 5.1.0 → 5.3.0-next.1

package/artifacts/schema/job-run-list-response.schema.json

@@ -142,12 +142,26 @@
                 "minLength": 1,
                 "maxLength": 200,
                 "description": "A display name taken at invoke time — the email for a Fleetless user or an app user, the key's own name for a server key. Storing it rather than joining is the point: renaming a key afterwards does not rewrite history."
+              },
+              "name": {
+                "anyOf": [
+                  {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 200
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "The person's display name when the job started: the Fleetless user's `display_name` for a developer, the app user's `display_name` for an app user. `null` for a server key, when the person had no name set, and for runs recorded before contracts 5.3.0. Show `label` when it is null."
               }
             },
             "required": [
               "kind",
               "id",
-              "label"
+              "label",
+              "name"
             ],
             "additionalProperties": false,
             "description": "Who invoked the run, and what they were acting as at the time."

package/artifacts/schema/job-run.schema.json

@@ -137,12 +137,26 @@
           "minLength": 1,
           "maxLength": 200,
           "description": "A display name taken at invoke time — the email for a Fleetless user or an app user, the key's own name for a server key. Storing it rather than joining is the point: renaming a key afterwards does not rewrite history."
+        },
+        "name": {
+          "anyOf": [
+            {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 200
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "The person's display name when the job started: the Fleetless user's `display_name` for a developer, the app user's `display_name` for an app user. `null` for a server key, when the person had no name set, and for runs recorded before contracts 5.3.0. Show `label` when it is null."
         }
       },
       "required": [
         "kind",
         "id",
-        "label"
+        "label",
+        "name"
       ],
       "additionalProperties": false,
       "description": "Who invoked the run, and what they were acting as at the time."

package/artifacts/schema/role-delete-query.schema.json

@@ -0,0 +1,13 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "move_to": {
+      "description": "Another role of the same app that takes over the deleted role's app users, pending invitations and, when it applies, the app's default. The role itself or a role of another app answers `400 validation_error`.",
+      "type": "string",
+      "format": "uuid",
+      "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+    }
+  },
+  "additionalProperties": false
+}

package/artifacts/schema/role-in-use-details.schema.json

@@ -0,0 +1,28 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "users": {
+      "type": "integer",
+      "minimum": 0,
+      "maximum": 9007199254740991,
+      "description": "App users whose role this is."
+    },
+    "invitations": {
+      "type": "integer",
+      "minimum": 0,
+      "maximum": 9007199254740991,
+      "description": "Pending invitations that would grant this role when accepted."
+    },
+    "is_default": {
+      "type": "boolean",
+      "description": "`true` when this is the app's `default_role_id`; the default then moves with the users to `move_to`."
+    }
+  },
+  "required": [
+    "users",
+    "invitations",
+    "is_default"
+  ],
+  "additionalProperties": false
+}

package/artifacts/schema/role-list-response.schema.json

@@ -27,7 +27,7 @@
           },
           "builtin": {
             "type": "boolean",
-            "description": "`true` for the two roles every app starts with. Their **rights may be re-scoped** exactly like a custom role's, through `PUT /api/apps/:id/roles/:roleId/permissions` — the flag exists so the console can explain where they came from, not to protect them. It does not make them renamable or deletable — no route does that for any role."
+            "description": "`true` for the two roles every app starts with. Their **rights may be re-scoped** exactly like a custom role's, through `PUT /api/apps/:id/roles/:roleId/permissions` — the flag exists so the console can explain where they came from, not to protect them. Built-in roles can be renamed and deleted like any other; the flag only records that the cloud seeded them."
           }
         },
         "required": [

package/artifacts/schema/role-rename-request.schema.json

@@ -0,0 +1,16 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "name": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 60,
+      "description": "The new name, trimmed, 1 to 60 characters. Unique per app: another role of this app with the same name answers `409 role_name_taken`. The role's users keep it under its new name."
+    }
+  },
+  "required": [
+    "name"
+  ],
+  "additionalProperties": false
+}

package/artifacts/schema/role.schema.json

@@ -22,7 +22,7 @@
     },
     "builtin": {
       "type": "boolean",
-      "description": "`true` for the two roles every app starts with. Their **rights may be re-scoped** exactly like a custom role's, through `PUT /api/apps/:id/roles/:roleId/permissions` — the flag exists so the console can explain where they came from, not to protect them. It does not make them renamable or deletable — no route does that for any role."
+      "description": "`true` for the two roles every app starts with. Their **rights may be re-scoped** exactly like a custom role's, through `PUT /api/apps/:id/roles/:roleId/permissions` — the flag exists so the console can explain where they came from, not to protect them. Built-in roles can be renamed and deleted like any other; the flag only records that the cloud seeded them."
     }
   },
   "required": [

package/dist/apps.d.ts

@@ -151,8 +151,9 @@ export declare const createServerKeyResponse: z.ZodObject<{
 export type CreateServerKeyResponse = z.infer<typeof createServerKeyResponse>;
 /**
  * Every app starts with `observe` and `operate`; custom roles are allowed
- * too. `builtin` marks the two starting roles — editable like any other,
- * the flag only tells the console where they came from.
+ * too. `builtin` marks the two starting roles — editable, renamable and
+ * deletable like any other; the flag only tells the console where they came
+ * from.
  */
 export declare const role: z.ZodObject<{
     id: z.ZodUUID;
@@ -171,6 +172,41 @@ export declare const roleListResponse: z.ZodObject<{
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type RoleListResponse = z.infer<typeof roleListResponse>;
+/**
+ * The body of `PATCH /api/apps/:id/roles/:roleId`: the role's new name.
+ *
+ * The same bounds as `role.name`, trimmed. Names are unique per app, compared
+ * exactly as stored after trimming; a clash answers `409 role_name_taken`.
+ */
+export declare const roleRenameRequest: z.ZodObject<{
+    name: z.ZodString;
+}, z.core.$strict>;
+export type RoleRenameRequest = z.infer<typeof roleRenameRequest>;
+/**
+ * The query of `DELETE /api/apps/:id/roles/:roleId`.
+ *
+ * `move_to` is what makes a held role deletable: every app user and pending
+ * invitation holding the role moves to it, and so does the app's default when
+ * it pointed at the role, in the same transaction as the delete. Without it a
+ * held role answers `409 role_in_use` with `roleInUseDetails`, so a client
+ * can ask where they should go instead of guessing.
+ */
+export declare const roleDeleteQuery: z.ZodObject<{
+    move_to: z.ZodOptional<z.ZodUUID>;
+}, z.core.$strict>;
+export type RoleDeleteQuery = z.infer<typeof roleDeleteQuery>;
+/**
+ * `details` of `409 role_in_use`: what still holds the role.
+ *
+ * All three are reported, zeros included, so a client renders one sentence
+ * from one shape rather than inferring a missing key.
+ */
+export declare const roleInUseDetails: z.ZodObject<{
+    users: z.ZodNumber;
+    invitations: z.ZodNumber;
+    is_default: z.ZodBoolean;
+}, z.core.$strict>;
+export type RoleInUseDetails = z.infer<typeof roleInUseDetails>;
 /**
  * The rights matrix of one role: which slugs of which robot it may use, plus
  * the capabilities roles also govern. `capabilities`' own doc comment

package/dist/apps.js

@@ -206,8 +206,9 @@ export const createServerKeyResponse = z.object({
 });
 /**
  * Every app starts with `observe` and `operate`; custom roles are allowed
- * too. `builtin` marks the two starting roles — editable like any other,
- * the flag only tells the console where they came from.
+ * too. `builtin` marks the two starting roles — editable, renamable and
+ * deletable like any other; the flag only tells the console where they came
+ * from.
  */
 export const role = z.object({
     id: z.uuid().meta({
@@ -220,7 +221,7 @@ export const role = z.object({
         description: 'The role\'s name, shown wherever a user\'s access is chosen. The two roles every app starts with are named `observe` and `operate`.',
     }),
     builtin: z.boolean().meta({
-        description: '`true` for the two roles every app starts with. Their **rights may be re-scoped** exactly like a custom role\'s, through `PUT /api/apps/:id/roles/:roleId/permissions` — the flag exists so the console can explain where they came from, not to protect them. It does not make them renamable or deletable — no route does that for any role.',
+        description: '`true` for the two roles every app starts with. Their **rights may be re-scoped** exactly like a custom role\'s, through `PUT /api/apps/:id/roles/:roleId/permissions` — the flag exists so the console can explain where they came from, not to protect them. Built-in roles can be renamed and deleted like any other; the flag only records that the cloud seeded them.',
     }),
 });
 /** What `GET /api/apps/:id/roles` answers: the app's roles, builtin and custom alike. */
@@ -229,6 +230,48 @@ export const roleListResponse = z.object({
         description: 'The app\'s roles, built-in and custom alike, ordered by `created_at` and then by `name`. The tie-break is not cosmetic — the two built-in roles are inserted in one statement and share a creation time to the microsecond, so never read a role by position.',
     }),
 });
+/**
+ * The body of `PATCH /api/apps/:id/roles/:roleId`: the role's new name.
+ *
+ * The same bounds as `role.name`, trimmed. Names are unique per app, compared
+ * exactly as stored after trimming; a clash answers `409 role_name_taken`.
+ */
+export const roleRenameRequest = z.object({
+    name: z.string().trim().min(1).max(60).meta({
+        description: 'The new name, trimmed, 1 to 60 characters. Unique per app: another role of this app with the same name answers `409 role_name_taken`. The role\'s users keep it under its new name.',
+    }),
+}).strict();
+/**
+ * The query of `DELETE /api/apps/:id/roles/:roleId`.
+ *
+ * `move_to` is what makes a held role deletable: every app user and pending
+ * invitation holding the role moves to it, and so does the app's default when
+ * it pointed at the role, in the same transaction as the delete. Without it a
+ * held role answers `409 role_in_use` with `roleInUseDetails`, so a client
+ * can ask where they should go instead of guessing.
+ */
+export const roleDeleteQuery = z.object({
+    move_to: z.uuid().optional().meta({
+        description: 'Another role of the same app that takes over the deleted role\'s app users, pending invitations and, when it applies, the app\'s default. The role itself or a role of another app answers `400 validation_error`.',
+    }),
+}).strict();
+/**
+ * `details` of `409 role_in_use`: what still holds the role.
+ *
+ * All three are reported, zeros included, so a client renders one sentence
+ * from one shape rather than inferring a missing key.
+ */
+export const roleInUseDetails = z.object({
+    users: z.number().int().nonnegative().meta({
+        description: 'App users whose role this is.',
+    }),
+    invitations: z.number().int().nonnegative().meta({
+        description: 'Pending invitations that would grant this role when accepted.',
+    }),
+    is_default: z.boolean().meta({
+        description: '`true` when this is the app\'s `default_role_id`; the default then moves with the users to `move_to`.',
+    }),
+}).strict();
 /**
  * The rights matrix of one role: which slugs of which robot it may use, plus
  * the capabilities roles also govern. `capabilities`' own doc comment

package/dist/audit.d.ts

@@ -72,6 +72,7 @@ export declare const auditQuery: z.ZodObject<{
     action_prefix: z.ZodOptional<z.ZodString>;
     actor_id: z.ZodOptional<z.ZodUUID>;
     target_kind: z.ZodOptional<z.ZodString>;
+    target_id: z.ZodOptional<z.ZodString>;
     from_ms: z.ZodOptional<z.ZodPipe<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodTransform<number, string | number>>, z.ZodNumber>>;
     to_ms: z.ZodOptional<z.ZodPipe<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodTransform<number, string | number>>, z.ZodNumber>>;
 }, z.core.$strict>;

package/dist/audit.js

@@ -155,6 +155,19 @@ export const auditQuery = z.object({
     actor_id: z.uuid().optional(),
     /** Only events about this kind of target, e.g. `robot`. */
     target_kind: z.string().min(1).max(40).optional(),
+    /**
+     * Only events about this target — and, for a robot, also the events that
+     * name it in `details.robot_id`, so a robot's log includes what was
+     * started on it.
+     *
+     * **A string, not `z.uuid()`**, unlike `actor_id` above: `target.id` is a
+     * string in this contract and text in the cloud's table, so a uuid rule
+     * here would refuse ids the log can hold, and no value can fail a cast.
+     */
+    target_id: z.string().min(1).max(200).optional().meta({
+        description: 'Events whose target is this id; for a robot also the events that name it in `details.robot_id` (`action.invoked`, ' +
+            '`service.called`, …), so a robot\'s events include what was started on it.',
+    }),
     /**
      * Absolute bounds in unix milliseconds, **half-open `[from, to)`** — the
      * same rule the history shapes follow.

package/dist/errors.d.ts

@@ -68,5 +68,5 @@ export type CancelRejectedDetails = z.infer<typeof cancelRejectedDetails>;
  * list is the shared vocabulary, not a closed set, so a new refusal never
  * needs a contracts release before it can be reported honestly.
  */
-export declare const ERROR_CODES: readonly ["not_found", "validation_error", "bad_request", "unknown_datapoint", "invalid_token", "protocol_mismatch", "bridge_too_old", "invalid_frame", "duplicate_slug", "reserved_slug", "unknown_slug", "unknown_field_path", "unknown_type", "unknown_topic", "invalid_rate", "invalid_range", "config_conflict", "no_data", "robot_offline", "bridge_timeout", "unauthorized", "forbidden", "invalid_credentials", "token_expired", "token_revoked", "email_taken", "identifier_taken", "weak_password", "account_blocked", "busy", "parameter_invalid", "cancel_rejected", "job_lost", "job_unknown_to_bridge", "action_server_lost", "action_failed", "goal_rejected", "goal_send_failed", "result_failed", "goal_uncontrollable", "bridge_disconnected", "config_changed", "publisher_busy", "unknown_command", "not_subscribable", "camera_offline", "no_snapshot_yet", "live_unavailable", "wrong_kind", "not_recorded", "not_aggregatable", "quota_exceeded", "credential_in_use", "goal_timeout", "robot_in_use", "robot_deletion_partial", "job_queue_full", "invalid_uuid", "rate_limited", "tier_required", "token_spent", "service_timeout", "asset_missing", "dynamic_registration_disabled", "client_limit_reached", "idp_unavailable", "mcp_disabled", "tool_not_available", "capability_required", "last_owner", "target_state_conflict", "signup_closed", "draft_not_a_document", "internal_error", "not_cancellable", "unsupported_media_type", "wrong_browser", "invalid_yaml", "unstorable_yaml", "registration_closed", "domain_not_allowed", "email_unverified", "origin_not_allowed", "template_invalid", "provider_disabled", "provider_misconfigured", "invalid_redirect_uri", "interaction_expired"];
+export declare const ERROR_CODES: readonly ["not_found", "validation_error", "bad_request", "unknown_datapoint", "invalid_token", "protocol_mismatch", "bridge_too_old", "invalid_frame", "duplicate_slug", "reserved_slug", "unknown_slug", "unknown_field_path", "unknown_type", "unknown_topic", "invalid_rate", "invalid_range", "config_conflict", "no_data", "robot_offline", "bridge_timeout", "unauthorized", "forbidden", "invalid_credentials", "token_expired", "token_revoked", "email_taken", "identifier_taken", "weak_password", "account_blocked", "busy", "parameter_invalid", "cancel_rejected", "job_lost", "job_unknown_to_bridge", "action_server_lost", "action_failed", "goal_rejected", "goal_send_failed", "result_failed", "goal_uncontrollable", "bridge_disconnected", "config_changed", "publisher_busy", "unknown_command", "not_subscribable", "camera_offline", "no_snapshot_yet", "live_unavailable", "wrong_kind", "not_recorded", "not_aggregatable", "quota_exceeded", "credential_in_use", "goal_timeout", "robot_in_use", "robot_deletion_partial", "job_queue_full", "invalid_uuid", "rate_limited", "tier_required", "token_spent", "service_timeout", "asset_missing", "dynamic_registration_disabled", "client_limit_reached", "idp_unavailable", "mcp_disabled", "tool_not_available", "capability_required", "last_owner", "role_name_taken", "role_in_use", "last_role", "target_state_conflict", "signup_closed", "draft_not_a_document", "internal_error", "not_cancellable", "unsupported_media_type", "wrong_browser", "invalid_yaml", "unstorable_yaml", "registration_closed", "domain_not_allowed", "email_unverified", "origin_not_allowed", "template_invalid", "provider_disabled", "provider_misconfigured", "invalid_redirect_uri", "interaction_expired"];
 export type ErrorCode = (typeof ERROR_CODES)[number];

package/dist/errors.js

@@ -562,6 +562,35 @@ export const ERROR_CODES = [
      * caller could infer from a silence about existence.
      */
     'last_owner',
+    // App roles.
+    /**
+     * **Another role of this app already has that name.** 409, on
+     * `PATCH /api/apps/:id/roles/:roleId`. Names are unique per app, compared
+     * exactly as stored after trimming.
+     *
+     * Not `validation_error`: the name is well-formed, and the remedy — pick
+     * another — depends on the app's other roles, not on the body.
+     */
+    'role_name_taken',
+    /**
+     * **The role is still held**, by app users, by pending invitations, or as
+     * the app's default role. 409, on `DELETE /api/apps/:id/roles/:roleId`
+     * without `move_to`. `details` is `roleInUseDetails`:
+     * `{ users, invitations, is_default }`.
+     *
+     * Not `conflict`: the details tell the console what to offer — a role to
+     * move them to — and a generic code would leave it guessing.
+     */
+    'role_in_use',
+    /**
+     * **An app must keep at least one role.** 409, on
+     * `DELETE /api/apps/:id/roles/:roleId` for the app's only role: every app
+     * user holds exactly one role, so an app without roles could hold no users.
+     *
+     * The same shape of refusal as `last_owner`: the caller may delete roles;
+     * the app's remaining state is what refuses this one.
+     */
+    'last_role',
     // OIDC federation.
     /**
      * **The target is in a state that refuses the operation** — not the caller's

package/dist/feedback.d.ts

@@ -0,0 +1,42 @@
+// SPDX-License-Identifier: Apache-2.0
+import { z } from 'zod';
+/**
+ * **Feedback: a message from a developer to the people who build Fleetless.**
+ *
+ * The console's feedback modal sends it; the cloud stores it first and mails
+ * it afterwards, so a message is never lost to a mail failure. Who sent it and
+ * from which org is the caller's session, never the body: the body carries
+ * only what the developer chose to say and the page they said it on.
+ */
+/** The four kinds the console's modal offers. */
+export declare const FEEDBACK_KINDS: readonly ["idea", "problem", "question", "other"];
+export declare const feedbackKind: z.ZodEnum<{
+    idea: "idea";
+    problem: "problem";
+    question: "question";
+    other: "other";
+}>;
+/** Longest message the cloud stores; the console's counter starts at 4 500. */
+export declare const FEEDBACK_MESSAGE_MAX = 5000;
+export declare const feedbackRequest: z.ZodObject<{
+    kind: z.ZodEnum<{
+        idea: "idea";
+        problem: "problem";
+        question: "question";
+        other: "other";
+    }>;
+    message: z.ZodString;
+    page: z.ZodString;
+}, z.core.$strict>;
+export declare const feedbackResponse: z.ZodObject<{
+    id: z.ZodUUID;
+    mail: z.ZodEnum<{
+        sent: "sent";
+        not_requested: "not_requested";
+        not_configured: "not_configured";
+        failed: "failed";
+    }>;
+}, z.core.$strict>;
+export type FeedbackKind = z.infer<typeof feedbackKind>;
+export type FeedbackRequest = z.infer<typeof feedbackRequest>;
+export type FeedbackResponse = z.infer<typeof feedbackResponse>;

package/dist/feedback.js

@@ -0,0 +1,35 @@
+// SPDX-License-Identifier: Apache-2.0
+import { z } from 'zod';
+import { mailStatus } from './identity.js';
+/**
+ * **Feedback: a message from a developer to the people who build Fleetless.**
+ *
+ * The console's feedback modal sends it; the cloud stores it first and mails
+ * it afterwards, so a message is never lost to a mail failure. Who sent it and
+ * from which org is the caller's session, never the body: the body carries
+ * only what the developer chose to say and the page they said it on.
+ */
+/** The four kinds the console's modal offers. */
+export const FEEDBACK_KINDS = ['idea', 'problem', 'question', 'other'];
+export const feedbackKind = z.enum(FEEDBACK_KINDS);
+/** Longest message the cloud stores; the console's counter starts at 4 500. */
+export const FEEDBACK_MESSAGE_MAX = 5000;
+export const feedbackRequest = z.object({
+    kind: feedbackKind.meta({
+        description: 'What the message is: an `idea`, a `problem`, a `question` or `other`. It only sorts the inbox; it changes nothing about how the message is handled.',
+    }),
+    message: z.string().trim().min(1).max(FEEDBACK_MESSAGE_MAX).meta({
+        description: 'What the developer wrote, trimmed. At most 5000 characters; a message that is only whitespace is refused.',
+    }),
+    page: z.string().startsWith('/').max(512).meta({
+        description: 'The console path the message was sent from, e.g. `/robots/:id/jobs` with its real id. A path, never a full URL, so no host and no query string reach the inbox by accident.',
+    }),
+}).strict();
+export const feedbackResponse = z.object({
+    id: z.uuid().meta({
+        description: 'The stored message. It exists whatever `mail` says.',
+    }),
+    mail: mailStatus.meta({
+        description: 'What happened to the notification mail: `sent`, `failed`, or `not_configured` when this cloud has no feedback address. The message is stored in every case, so a client shows success for all three.',
+    }),
+}).strict();

package/dist/index.d.ts

@@ -31,8 +31,10 @@ export { clientAuth, authOk, authError, clientInvoke, clientCancel, clientPublis
 export type { ClientAuth, AuthOk, AuthError, ClientInvoke, ClientCancel, ClientPublish, CommandResult, ErrorFrame, ClientSubscribe, ClientUnsubscribe, SubscribeError, DatapointEvent, ResourceHealthEvent, ResourceHealthCleared, LiveSessionEndReason, LiveSessionEvent, OrgEventKind, OrgEventSeverity, OrgEvent, OrgEventSubscribe, OrgEventUnsubscribe, OrgEventReplay, OrgEventDropped, } from './realtime.js';
 export { password, org, patchOrgResponse, sessionTokens, refreshRequest, signUpRequest, signUpResponse, waitlistRequest, developerLoginRequest, USER_DISPLAY_NAME_MAX, orgAdminTier, fleetlessUser, fleetlessUserListResponse, createTeamInviteRequest, teamInvite, pendingTeamInvite, pendingTeamInviteListResponse, acceptTeamInviteRequest, patchFleetlessUserRequest, tierChangeRequest, mailStatus, tierRequiredDetails, passwordChangeRequest, passwordResetRequest, passwordResetConfirm, idpIssuer, authMeResponse, patchOrgRequest, patchAuthMeRequest, } from './identity.js';
 export type { Org, PatchOrgResponse, SessionTokens, RefreshRequest, SignUpRequest, SignUpResponse, WaitlistRequest, DeveloperLoginRequest, OrgAdminTier, FleetlessUser, FleetlessUserListResponse, CreateTeamInviteRequest, TeamInvite, PendingTeamInvite, PendingTeamInviteListResponse, AcceptTeamInviteRequest, PatchFleetlessUserRequest, TierChangeRequest, MailStatus, TierRequiredDetails, PasswordChangeRequest, PasswordResetRequest, PasswordResetConfirm, IdpIssuer, AuthMeResponse, PatchOrgRequest, PatchAuthMeRequest, } from './identity.js';
-export { appIdentifier, app, appListResponse, appDeletionSummary, createAppRequest, updateAppRequest, serverKeyToken, serverKey, serverKeyListResponse, createServerKeyResponse, role, roleListResponse, rolePermissions, } from './apps.js';
-export type { App, AppListResponse, AppDeletionSummary, CreateAppRequest, UpdateAppRequest, ServerKey, ServerKeyListResponse, CreateServerKeyResponse, Role, RoleListResponse, RolePermissions, } from './apps.js';
+export { FEEDBACK_KINDS, FEEDBACK_MESSAGE_MAX, feedbackKind, feedbackRequest, feedbackResponse } from './feedback.js';
+export type { FeedbackKind, FeedbackRequest, FeedbackResponse } from './feedback.js';
+export { appIdentifier, app, appListResponse, appDeletionSummary, createAppRequest, updateAppRequest, serverKeyToken, serverKey, serverKeyListResponse, createServerKeyResponse, role, roleListResponse, rolePermissions, roleRenameRequest, roleDeleteQuery, roleInUseDetails, } from './apps.js';
+export type { App, AppListResponse, AppDeletionSummary, CreateAppRequest, UpdateAppRequest, ServerKey, ServerKeyListResponse, CreateServerKeyResponse, Role, RoleListResponse, RolePermissions, RoleRenameRequest, RoleDeleteQuery, RoleInUseDetails, } from './apps.js';
 export { clientLoginRequest, clientRefreshRequest, clientLogoutRequest, clientRegisterRequest, clientVerifyEmailRequest, clientResendVerificationRequest, clientPasswordResetRequest, clientPasswordResetConfirmRequest, clientAcceptInvitationRequest, CLIENT_OIDC_CALLBACK_PATH, clientProviderListQuery, clientProviderListResponse, clientOidcStartQuery, clientOidcCallbackQuery, clientOidcExchangeRequest, clientOidcErrorCode, clientMcpInteraction, clientMcpInteractionDecisionResponse, mcpConsentGrant, mcpConsentGrantListResponse, clientIdentity, } from './client-auth.js';
 export type { ClientLoginRequest, ClientRefreshRequest, ClientLogoutRequest, ClientRegisterRequest, ClientVerifyEmailRequest, ClientResendVerificationRequest, ClientPasswordResetRequest, ClientPasswordResetConfirmRequest, ClientAcceptInvitationRequest, ClientProviderListQuery, ClientProviderListResponse, ClientOidcStartQuery, ClientOidcCallbackQuery, ClientOidcExchangeRequest, ClientOidcErrorCode, ClientMcpInteraction, ClientMcpInteractionDecisionResponse, McpConsentGrant, McpConsentGrantListResponse, ClientIdentity, } from './client-auth.js';
 export { clientRobotListItem, clientRobotListResponse } from './client-robots.js';

package/dist/index.js

@@ -38,7 +38,9 @@ USER_DISPLAY_NAME_MAX, orgAdminTier, fleetlessUser, fleetlessUserListResponse, c
 mailStatus, tierRequiredDetails, passwordChangeRequest, passwordResetRequest, passwordResetConfirm, idpIssuer, 
 // auth/me, org and member patches.
 authMeResponse, patchOrgRequest, patchAuthMeRequest, } from './identity.js';
-export { appIdentifier, app, appListResponse, appDeletionSummary, createAppRequest, updateAppRequest, serverKeyToken, serverKey, serverKeyListResponse, createServerKeyResponse, role, roleListResponse, rolePermissions, } from './apps.js';
+// 2026-09-30 — the console's feedback modal.
+export { FEEDBACK_KINDS, FEEDBACK_MESSAGE_MAX, feedbackKind, feedbackRequest, feedbackResponse } from './feedback.js';
+export { appIdentifier, app, appListResponse, appDeletionSummary, createAppRequest, updateAppRequest, serverKeyToken, serverKey, serverKeyListResponse, createServerKeyResponse, role, roleListResponse, rolePermissions, roleRenameRequest, roleDeleteQuery, roleInUseDetails, } from './apps.js';
 export { clientLoginRequest, clientRefreshRequest, clientLogoutRequest, clientRegisterRequest, clientVerifyEmailRequest, clientResendVerificationRequest, clientPasswordResetRequest, clientPasswordResetConfirmRequest, clientAcceptInvitationRequest, CLIENT_OIDC_CALLBACK_PATH, clientProviderListQuery, clientProviderListResponse, clientOidcStartQuery, clientOidcCallbackQuery, clientOidcExchangeRequest, clientOidcErrorCode, clientMcpInteraction, clientMcpInteractionDecisionResponse, mcpConsentGrant, mcpConsentGrantListResponse, clientIdentity, } from './client-auth.js';
 export { clientRobotListItem, clientRobotListResponse } from './client-robots.js';
 // The per-app identity space.

package/dist/jobs.d.ts

@@ -241,6 +241,7 @@ export declare const jobActor: z.ZodObject<{
     }>;
     id: z.ZodUUID;
     label: z.ZodString;
+    name: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
 export type JobActor = z.infer<typeof jobActor>;
 export declare const jobRunKind: z.ZodEnum<{
@@ -289,6 +290,7 @@ export declare const jobRun: z.ZodObject<{
         }>;
         id: z.ZodUUID;
         label: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
     }, z.core.$strip>;
     seq: z.ZodNumber;
     progress: z.ZodNullable<z.ZodNumber>;
@@ -351,6 +353,7 @@ export declare const jobRunListResponse: z.ZodObject<{
             }>;
             id: z.ZodUUID;
             label: z.ZodString;
+            name: z.ZodNullable<z.ZodString>;
         }, z.core.$strip>;
         seq: z.ZodNumber;
         progress: z.ZodNullable<z.ZodNumber>;

package/dist/jobs.js

@@ -226,6 +226,22 @@ export const jobActor = z.object({
     label: z.string().min(1).max(200).meta({
         description: 'A display name taken at invoke time — the email for a Fleetless user or an app user, the key\'s own name for a server key. Storing it rather than joining is the point: renaming a key afterwards does not rewrite history.',
     }),
+    /**
+     * The person's display name, snapshotted beside `label` for the same
+     * reason. **Required and nullable**, so a consumer never has to tell
+     * "absent" from "null": every run a 5.3.0 cloud answers carries it, and
+     * `null` means there is no name to show — a server key, a person without
+     * one, or a run recorded before the field existed.
+     *
+     * `jobActor` stays a plain object, not `.strict()`: a consumer still on an
+     * older contracts version then parses a newer cloud's answer by stripping
+     * the key instead of refusing the whole run.
+     */
+    name: z.string().min(1).max(200).nullable().meta({
+        description: 'The person\'s display name when the job started: the Fleetless user\'s `display_name` for a developer, the app user\'s ' +
+            '`display_name` for an app user. `null` for a server key, when the person had no name set, and for runs recorded before ' +
+            'contracts 5.3.0. Show `label` when it is null.',
+    }),
 });
 export const jobRunKind = z.enum(['action', 'service']);
 /**

package/dist/protocol.d.ts

@@ -78,7 +78,7 @@ export interface ProtocolVersionEntry {
  */
 export declare const PROTOCOL_VERSIONS: readonly ProtocolVersionEntry[];
 /** The newest bridge package. The cloud mails organisations still below it. */
-export declare const LATEST_BRIDGE_VERSION = "6.0.0";
+export declare const LATEST_BRIDGE_VERSION = "6.1.0";
 export interface ProtocolStatus {
     status: 'current' | 'deprecated' | 'unsupported';
     /** ISO date, or null for a current or unknown version. */
@@ -642,12 +642,24 @@ export type CloudInvoke = z.infer<typeof cloudInvoke>;
  * `request_id` correlates the bridge's `cancel_result`, which carries each
  * goal's `CancelGoal` return code; the cloud answers its caller only from
  * that.
+ *
+ * `own_only` (fleetless#84) limits a cancel to a job the bridge started
+ * itself and holds. `true`: the bridge cancels the named job only if it is
+ * its own; a `job_id` it does not hold, or holds as an external goal,
+ * cancels **nothing** and is answered `goals: []`. The cloud sets it on the
+ * cancels it sends on its own — a republish's reset and that reset's resend
+ * at the next hello — so a republish never stops a goal Fleetless did not
+ * start. A user's cancel never sets it: only an explicit cancel may reach
+ * external goals. Absent means `false`, today's meaning. `true` needs a
+ * `job_id`: the bridge refuses `own_only: true` with `job_id: null` as
+ * unusable. Bridges before 6.1.0 ignore the key.
  */
 export declare const cloudCancel: z.ZodObject<{
     type: z.ZodLiteral<"cancel">;
     request_id: z.ZodString;
     slug: z.ZodString;
     job_id: z.ZodNullable<z.ZodUUID>;
+    own_only: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 export type CloudCancel = z.infer<typeof cloudCancel>;
 /**

package/dist/protocol.js

@@ -79,7 +79,7 @@ export const PROTOCOL_VERSIONS = [
     { version: 5, bridge_from: '6.0.0', deprecated_at: null },
 ];
 /** The newest bridge package. The cloud mails organisations still below it. */
-export const LATEST_BRIDGE_VERSION = '6.0.0';
+export const LATEST_BRIDGE_VERSION = '6.1.0';
 const DAY_MS = 24 * 60 * 60 * 1000;
 function isoDate(date) {
     return date.toISOString().slice(0, 10);
@@ -481,12 +481,24 @@ export const cloudInvoke = z.object({
  * `request_id` correlates the bridge's `cancel_result`, which carries each
  * goal's `CancelGoal` return code; the cloud answers its caller only from
  * that.
+ *
+ * `own_only` (fleetless#84) limits a cancel to a job the bridge started
+ * itself and holds. `true`: the bridge cancels the named job only if it is
+ * its own; a `job_id` it does not hold, or holds as an external goal,
+ * cancels **nothing** and is answered `goals: []`. The cloud sets it on the
+ * cancels it sends on its own — a republish's reset and that reset's resend
+ * at the next hello — so a republish never stops a goal Fleetless did not
+ * start. A user's cancel never sets it: only an explicit cancel may reach
+ * external goals. Absent means `false`, today's meaning. `true` needs a
+ * `job_id`: the bridge refuses `own_only: true` with `job_id: null` as
+ * unusable. Bridges before 6.1.0 ignore the key.
  */
 export const cloudCancel = z.object({
     type: z.literal('cancel'),
     request_id: z.string().min(1).max(64),
     slug,
     job_id: z.uuid().nullable(),
+    own_only: z.boolean().optional(),
 });
 /**
  * The ROS 2 `action_msgs/srv/CancelGoal` return codes: `0` `ERROR_NONE` (the