@fleetless/contracts 5.2.0 → 5.3.0

package/CHANGELOG.md

@@ -9,6 +9,44 @@ version.
 
 ## [Unreleased]
 
+## [5.3.0] — 2026-10-02
+
+### Added
+
+- **`feedbackRequest` and `feedbackResponse`** (`FeedbackRequest`,
+  `FeedbackResponse`) for the new `POST /api/feedback`: a developer's
+  message to the people who build Fleetless, `{ kind, message, page }` with
+  `kind` one of `FEEDBACK_KINDS` (`idea`, `problem`, `question`, `other`), a
+  trimmed message of at most `FEEDBACK_MESSAGE_MAX` (5000) characters and
+  the console path it was sent from. The route answers `202` with
+  `{ id, mail }`: the message is stored before any mail is tried, so `mail`
+  (`sent`, `failed`, `not_configured`) never means it was lost. Rate
+  limited to 10 per developer per hour. Published as the artifacts
+  `feedback-request` and `feedback-response`.
+- **`jobActor.name`**: the person's display name when the job started,
+  required and nullable — `null` for a server key, a person without a name
+  and runs recorded before this version; show `label` then. `jobActor`
+  stays non-strict, so a consumer on 5.2.0 strips the new key rather than
+  refusing the run. Changes the artifacts `job-actor`, `job-run` and
+  `job-run-list-response`.
+- **`roleRenameRequest`, `roleDeleteQuery` and `roleInUseDetails`**
+  (`RoleRenameRequest`, `RoleDeleteQuery`, `RoleInUseDetails`) for the new
+  `PATCH` and `DELETE /api/apps/:id/roles/:roleId`: rename a role
+  (`409 role_name_taken` on a clash), or delete it, moving its app users,
+  pending invitations and default-role status to `move_to`. Without
+  `move_to` a held role answers `409 role_in_use` with
+  `{ users, invitations, is_default }`; the app's only role answers
+  `409 last_role`. The three codes join `ERROR_CODES`. `role.builtin` no
+  longer says built-in roles cannot be renamed or deleted, and the create
+  route's note now states the 60-character limit `role.name` always had.
+  Published as the artifacts `role-rename-request`, `role-delete-query`
+  and `role-in-use-details`.
+- **`auditQuery.target_id`**: only the events about one target — for a
+  robot also those that name it in `details.robot_id`, so a robot's log
+  includes what was started on it. A string, since target ids are not all
+  uuids. `GET /api/audit/export` takes it too. Changes the artifact
+  `audit-query`.
+
 ## [5.2.0] — 2026-09-30
 
 ### Added

package/artifacts/openapi.json

@@ -525,6 +525,17 @@
               "maxLength": 40
             }
           },
+          {
+            "name": "target_id",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "description": "Events whose target is this id; for a robot also the events that name it in `details.robot_id` (`action.invoked`, `service.called`, …), so a robot's events include what was started on it.",
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 200
+            }
+          },
           {
             "name": "from_ms",
             "in": "query",
@@ -676,6 +687,17 @@
               "maxLength": 40
             }
           },
+          {
+            "name": "target_id",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "description": "Events whose target is this id; for a robot also the events that name it in `details.robot_id` (`action.invoked`, `service.called`, …), so a robot's events include what was started on it.",
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 200
+            }
+          },
           {
             "name": "from_ms",
             "in": "query",
@@ -1058,7 +1080,7 @@
             }
           }
         },
-        "description": "The body is `{ \"name\": string }` — non-empty, trimmed, at most 120 characters — and is deliberately not a contract shape: contracts define the `role` this answers with, not this one trivial request. **The answer is a bare `role`, not an envelope**, unlike the listing beside it."
+        "description": "The body is `{ \"name\": string }` — non-empty, trimmed, at most 60 characters as on `role.name` — and is deliberately not a contract shape: contracts define the `role` this answers with, not this one trivial request. **The answer is a bare `role`, not an envelope**, unlike the listing beside it."
       },
       "get": {
         "operationId": "get_api_apps_id_roles",
@@ -1285,6 +1307,132 @@
         "description": "Built by the same builder the MCP server's own `robot_describe` uses, so the two cannot drift. It answers what the role *would* be offered and consults nothing about any user's actual MCP entitlement. A robot the role grants nothing on still appears, with an empty `exposures` — dropping it would read as \"not attached\", which is a different fact."
       }
     },
+    "/api/apps/{id}/roles/{roleId}": {
+      "patch": {
+        "operationId": "patch_api_apps_id_roles_roleId",
+        "summary": "Renames a role; its users keep it.",
+        "tags": [
+          "apps"
+        ],
+        "security": [
+          {
+            "developerSession": []
+          }
+        ],
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "description": "The app's uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "roleId",
+            "in": "path",
+            "required": true,
+            "description": "The role's uuid, from `GET /api/apps/:id/roles`; a role of another app answers `404`.",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/role"
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "An error envelope. Codes this route is known to answer: `unauthorized`, `token_expired`, `token_revoked`, `invalid_uuid`, `not_found`, `validation_error`, `role_name_taken`.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/api-error"
+                }
+              }
+            }
+          }
+        },
+        "description": "Names are unique per app, compared exactly as stored after trimming. Built-in roles can be renamed.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/role-rename-request"
+              }
+            }
+          }
+        }
+      },
+      "delete": {
+        "operationId": "delete_api_apps_id_roles_roleId",
+        "summary": "Deletes a role, moving its users, pending invitations and default-role status to another role.",
+        "tags": [
+          "apps"
+        ],
+        "security": [
+          {
+            "developerSession": []
+          }
+        ],
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "description": "The app's uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "roleId",
+            "in": "path",
+            "required": true,
+            "description": "The role's uuid, from `GET /api/apps/:id/roles`; a role of another app answers `404`.",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "move_to",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "description": "Another role of the same app that takes over the deleted role's app users, pending invitations and, when it applies, the app's default. The role itself or a role of another app answers `400 validation_error`.",
+              "type": "string",
+              "format": "uuid",
+              "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Success."
+          },
+          "default": {
+            "description": "An error envelope. Codes this route is known to answer: `unauthorized`, `token_expired`, `token_revoked`, `invalid_uuid`, `not_found`, `validation_error`, `role_in_use`, `last_role`.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/api-error"
+                }
+              }
+            }
+          }
+        },
+        "description": "Without `move_to`, a role that app users or pending invitations hold, or that is the app's default, answers `409 role_in_use` with `{ users, invitations, is_default }`. With `move_to` — another role of the same app, else `400 validation_error` — one transaction moves `app_users.role_id`, pending invitations and `default_role_id`, then deletes the role and its permissions. The app's only role answers `409 last_role`. Built-in roles can be deleted like any other."
+      }
+    },
     "/api/apps/{id}/server-keys": {
       "post": {
         "operationId": "post_api_apps_id_server_keys",
@@ -8476,6 +8624,54 @@
         },
         "description": "A window longer than `USAGE_WINDOW_MAX_DAYS` is refused naming the field, not silently capped: a caller who asked for more than the platform will answer is owed a refusal, not a shorter answer they will mistake for the whole picture. `from_day <= to_day` is a cross-field rule no JSON Schema can express and is enforced here. The window is echoed back."
       }
+    },
+    "/api/feedback": {
+      "post": {
+        "operationId": "post_api_feedback",
+        "summary": "Sends a message from a developer to the people who build Fleetless.",
+        "tags": [
+          "org"
+        ],
+        "security": [
+          {
+            "developerSession": []
+          }
+        ],
+        "parameters": [],
+        "responses": {
+          "202": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/feedback-response"
+                }
+              }
+            }
+          },
+          "default": {
+            "description": "An error envelope. Codes this route is known to answer: `unauthorized`, `token_expired`, `token_revoked`, `validation_error`, `rate_limited`.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/api-error"
+                }
+              }
+            }
+          }
+        },
+        "description": "The message is stored before any mail is tried, so `202` means it is kept whatever `mail` says: `sent`, `failed`, or `not_configured` when this cloud has no feedback address. At most 10 messages per developer per hour; the 11th answers `429 rate_limited` with `retry_after_ms`. Replies come by mail, to the sender's address.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/feedback-request"
+              }
+            }
+          }
+        }
+      }
     }
   },
   "components": {
@@ -14004,6 +14200,65 @@
         ],
         "additionalProperties": false
       },
+      "feedback-request": {
+        "type": "object",
+        "properties": {
+          "kind": {
+            "type": "string",
+            "enum": [
+              "idea",
+              "problem",
+              "question",
+              "other"
+            ],
+            "description": "What the message is: an `idea`, a `problem`, a `question` or `other`. It only sorts the inbox; it changes nothing about how the message is handled."
+          },
+          "message": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 5000,
+            "description": "What the developer wrote, trimmed. At most 5000 characters; a message that is only whitespace is refused."
+          },
+          "page": {
+            "type": "string",
+            "maxLength": 512,
+            "pattern": "^\\/.*",
+            "description": "The console path the message was sent from, e.g. `/robots/:id/jobs` with its real id. A path, never a full URL, so no host and no query string reach the inbox by accident."
+          }
+        },
+        "required": [
+          "kind",
+          "message",
+          "page"
+        ],
+        "additionalProperties": false
+      },
+      "feedback-response": {
+        "type": "object",
+        "properties": {
+          "id": {
+            "type": "string",
+            "format": "uuid",
+            "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
+            "description": "The stored message. It exists whatever `mail` says."
+          },
+          "mail": {
+            "type": "string",
+            "enum": [
+              "sent",
+              "not_requested",
+              "not_configured",
+              "failed"
+            ],
+            "description": "What happened to the notification mail: `sent`, `failed`, or `not_configured` when this cloud has no feedback address. The message is stored in every case, so a client shows success for all three."
+          }
+        },
+        "required": [
+          "id",
+          "mail"
+        ],
+        "additionalProperties": false
+      },
       "fetch-types-request": {
         "type": "object",
         "properties": {
@@ -15026,12 +15281,26 @@
                       "minLength": 1,
                       "maxLength": 200,
                       "description": "A display name taken at invoke time — the email for a Fleetless user or an app user, the key's own name for a server key. Storing it rather than joining is the point: renaming a key afterwards does not rewrite history."
+                    },
+                    "name": {
+                      "anyOf": [
+                        {
+                          "type": "string",
+                          "minLength": 1,
+                          "maxLength": 200
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ],
+                      "description": "The person's display name when the job started: the Fleetless user's `display_name` for a developer, the app user's `display_name` for an app user. `null` for a server key, when the person had no name set, and for runs recorded before contracts 5.3.0. Show `label` when it is null."
                     }
                   },
                   "required": [
                     "kind",
                     "id",
-                    "label"
+                    "label",
+                    "name"
                   ],
                   "additionalProperties": false,
                   "description": "Who invoked the run, and what they were acting as at the time."
@@ -17637,7 +17906,7 @@
           },
           "builtin": {
             "type": "boolean",
-            "description": "`true` for the two roles every app starts with. Their **rights may be re-scoped** exactly like a custom role's, through `PUT /api/apps/:id/roles/:roleId/permissions` — the flag exists so the console can explain where they came from, not to protect them. It does not make them renamable or deletable — no route does that for any role."
+            "description": "`true` for the two roles every app starts with. Their **rights may be re-scoped** exactly like a custom role's, through `PUT /api/apps/:id/roles/:roleId/permissions` — the flag exists so the console can explain where they came from, not to protect them. Built-in roles can be renamed and deleted like any other; the flag only records that the cloud seeded them."
           }
         },
         "required": [
@@ -17676,7 +17945,7 @@
                 },
                 "builtin": {
                   "type": "boolean",
-                  "description": "`true` for the two roles every app starts with. Their **rights may be re-scoped** exactly like a custom role's, through `PUT /api/apps/:id/roles/:roleId/permissions` — the flag exists so the console can explain where they came from, not to protect them. It does not make them renamable or deletable — no route does that for any role."
+                  "description": "`true` for the two roles every app starts with. Their **rights may be re-scoped** exactly like a custom role's, through `PUT /api/apps/:id/roles/:roleId/permissions` — the flag exists so the console can explain where they came from, not to protect them. Built-in roles can be renamed and deleted like any other; the flag only records that the cloud seeded them."
                 }
               },
               "required": [
@@ -17755,6 +18024,21 @@
           "capabilities"
         ]
       },
+      "role-rename-request": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 60,
+            "description": "The new name, trimmed, 1 to 60 characters. Unique per app: another role of this app with the same name answers `409 role_name_taken`. The role's users keep it under its new name."
+          }
+        },
+        "required": [
+          "name"
+        ],
+        "additionalProperties": false
+      },
       "server-key-list-response": {
         "type": "object",
         "properties": {

package/artifacts/routes.json

@@ -574,7 +574,7 @@
         "validation_error"
       ],
       "transport": "http",
-      "notes": "The body is `{ \"name\": string }` — non-empty, trimmed, at most 120 characters — and is deliberately not a contract shape: contracts define the `role` this answers with, not this one trivial request. **The answer is a bare `role`, not an envelope**, unlike the listing beside it."
+      "notes": "The body is `{ \"name\": string }` — non-empty, trimmed, at most 60 characters as on `role.name` — and is deliberately not a contract shape: contracts define the `role` this answers with, not this one trivial request. **The answer is a bare `role`, not an envelope**, unlike the listing beside it."
     },
     {
       "method": "GET",
@@ -704,6 +704,77 @@
       "transport": "http",
       "notes": "Built by the same builder the MCP server's own `robot_describe` uses, so the two cannot drift. It answers what the role *would* be offered and consults nothing about any user's actual MCP entitlement. A robot the role grants nothing on still appears, with an empty `exposures` — dropping it would read as \"not attached\", which is a different fact."
     },
+    {
+      "method": "PATCH",
+      "path": "/api/apps/:id/roles/:roleId",
+      "section": "apps",
+      "summary": "Renames a role; its users keep it.",
+      "audience": "developer",
+      "auth": "developer",
+      "rateLimited": false,
+      "ownerTier": false,
+      "status": 200,
+      "params": [
+        {
+          "name": "id",
+          "description": "The app's uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`."
+        },
+        {
+          "name": "roleId",
+          "description": "The role's uuid, from `GET /api/apps/:id/roles`; a role of another app answers `404`."
+        }
+      ],
+      "query": null,
+      "request": "role-rename-request",
+      "response": "role",
+      "errors": [
+        "unauthorized",
+        "token_expired",
+        "token_revoked",
+        "invalid_uuid",
+        "not_found",
+        "validation_error",
+        "role_name_taken"
+      ],
+      "transport": "http",
+      "notes": "Names are unique per app, compared exactly as stored after trimming. Built-in roles can be renamed."
+    },
+    {
+      "method": "DELETE",
+      "path": "/api/apps/:id/roles/:roleId",
+      "section": "apps",
+      "summary": "Deletes a role, moving its users, pending invitations and default-role status to another role.",
+      "audience": "developer",
+      "auth": "developer",
+      "rateLimited": false,
+      "ownerTier": false,
+      "status": 204,
+      "params": [
+        {
+          "name": "id",
+          "description": "The app's uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`."
+        },
+        {
+          "name": "roleId",
+          "description": "The role's uuid, from `GET /api/apps/:id/roles`; a role of another app answers `404`."
+        }
+      ],
+      "query": "role-delete-query",
+      "request": null,
+      "response": null,
+      "errors": [
+        "unauthorized",
+        "token_expired",
+        "token_revoked",
+        "invalid_uuid",
+        "not_found",
+        "validation_error",
+        "role_in_use",
+        "last_role"
+      ],
+      "transport": "http",
+      "notes": "Without `move_to`, a role that app users or pending invitations hold, or that is the app's default, answers `409 role_in_use` with `{ users, invitations, is_default }`. With `move_to` — another role of the same app, else `400 validation_error` — one transaction moves `app_users.role_id`, pending invitations and `default_role_id`, then deletes the role and its permissions. The app's only role answers `409 last_role`. Built-in roles can be deleted like any other."
+    },
     {
       "method": "POST",
       "path": "/api/apps/:id/server-keys",
@@ -4821,6 +4892,30 @@
       "transport": "http",
       "notes": "A window longer than `USAGE_WINDOW_MAX_DAYS` is refused naming the field, not silently capped: a caller who asked for more than the platform will answer is owed a refusal, not a shorter answer they will mistake for the whole picture. `from_day <= to_day` is a cross-field rule no JSON Schema can express and is enforced here. The window is echoed back."
     },
+    {
+      "method": "POST",
+      "path": "/api/feedback",
+      "section": "org",
+      "summary": "Sends a message from a developer to the people who build Fleetless.",
+      "audience": "developer",
+      "auth": "developer",
+      "rateLimited": true,
+      "ownerTier": false,
+      "status": 202,
+      "params": [],
+      "query": null,
+      "request": "feedback-request",
+      "response": "feedback-response",
+      "errors": [
+        "unauthorized",
+        "token_expired",
+        "token_revoked",
+        "validation_error",
+        "rate_limited"
+      ],
+      "transport": "http",
+      "notes": "The message is stored before any mail is tried, so `202` means it is kept whatever `mail` says: `sent`, `failed`, or `not_configured` when this cloud has no feedback address. At most 10 messages per developer per hour; the 11th answers `429 rate_limited` with `retry_after_ms`. Replies come by mail, to the sender's address."
+    },
     {
       "method": "POST",
       "path": "/api/bridge/assets",

package/artifacts/schema/audit-query.schema.json

@@ -48,6 +48,12 @@
       "minLength": 1,
       "maxLength": 40
     },
+    "target_id": {
+      "description": "Events whose target is this id; for a robot also the events that name it in `details.robot_id` (`action.invoked`, `service.called`, …), so a robot's events include what was started on it.",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 200
+    },
     "from_ms": {
       "anyOf": [
         {

package/artifacts/schema/feedback-request.schema.json

@@ -0,0 +1,34 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "kind": {
+      "type": "string",
+      "enum": [
+        "idea",
+        "problem",
+        "question",
+        "other"
+      ],
+      "description": "What the message is: an `idea`, a `problem`, a `question` or `other`. It only sorts the inbox; it changes nothing about how the message is handled."
+    },
+    "message": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 5000,
+      "description": "What the developer wrote, trimmed. At most 5000 characters; a message that is only whitespace is refused."
+    },
+    "page": {
+      "type": "string",
+      "maxLength": 512,
+      "pattern": "^\\/.*",
+      "description": "The console path the message was sent from, e.g. `/robots/:id/jobs` with its real id. A path, never a full URL, so no host and no query string reach the inbox by accident."
+    }
+  },
+  "required": [
+    "kind",
+    "message",
+    "page"
+  ],
+  "additionalProperties": false
+}

package/artifacts/schema/feedback-response.schema.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "id": {
+      "type": "string",
+      "format": "uuid",
+      "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$",
+      "description": "The stored message. It exists whatever `mail` says."
+    },
+    "mail": {
+      "type": "string",
+      "enum": [
+        "sent",
+        "not_requested",
+        "not_configured",
+        "failed"
+      ],
+      "description": "What happened to the notification mail: `sent`, `failed`, or `not_configured` when this cloud has no feedback address. The message is stored in every case, so a client shows success for all three."
+    }
+  },
+  "required": [
+    "id",
+    "mail"
+  ],
+  "additionalProperties": false
+}

package/artifacts/schema/job-actor.schema.json

@@ -23,12 +23,26 @@
       "minLength": 1,
       "maxLength": 200,
       "description": "A display name taken at invoke time — the email for a Fleetless user or an app user, the key's own name for a server key. Storing it rather than joining is the point: renaming a key afterwards does not rewrite history."
+    },
+    "name": {
+      "anyOf": [
+        {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 200
+        },
+        {
+          "type": "null"
+        }
+      ],
+      "description": "The person's display name when the job started: the Fleetless user's `display_name` for a developer, the app user's `display_name` for an app user. `null` for a server key, when the person had no name set, and for runs recorded before contracts 5.3.0. Show `label` when it is null."
     }
   },
   "required": [
     "kind",
     "id",
-    "label"
+    "label",
+    "name"
   ],
   "additionalProperties": false
 }

package/artifacts/schema/job-run-list-response.schema.json

@@ -142,12 +142,26 @@
                 "minLength": 1,
                 "maxLength": 200,
                 "description": "A display name taken at invoke time — the email for a Fleetless user or an app user, the key's own name for a server key. Storing it rather than joining is the point: renaming a key afterwards does not rewrite history."
+              },
+              "name": {
+                "anyOf": [
+                  {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 200
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "The person's display name when the job started: the Fleetless user's `display_name` for a developer, the app user's `display_name` for an app user. `null` for a server key, when the person had no name set, and for runs recorded before contracts 5.3.0. Show `label` when it is null."
               }
             },
             "required": [
               "kind",
               "id",
-              "label"
+              "label",
+              "name"
             ],
             "additionalProperties": false,
             "description": "Who invoked the run, and what they were acting as at the time."

package/artifacts/schema/job-run.schema.json

@@ -137,12 +137,26 @@
           "minLength": 1,
           "maxLength": 200,
           "description": "A display name taken at invoke time — the email for a Fleetless user or an app user, the key's own name for a server key. Storing it rather than joining is the point: renaming a key afterwards does not rewrite history."
+        },
+        "name": {
+          "anyOf": [
+            {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 200
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "The person's display name when the job started: the Fleetless user's `display_name` for a developer, the app user's `display_name` for an app user. `null` for a server key, when the person had no name set, and for runs recorded before contracts 5.3.0. Show `label` when it is null."
         }
       },
       "required": [
         "kind",
         "id",
-        "label"
+        "label",
+        "name"
       ],
       "additionalProperties": false,
       "description": "Who invoked the run, and what they were acting as at the time."

package/artifacts/schema/role-delete-query.schema.json

@@ -0,0 +1,13 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "move_to": {
+      "description": "Another role of the same app that takes over the deleted role's app users, pending invitations and, when it applies, the app's default. The role itself or a role of another app answers `400 validation_error`.",
+      "type": "string",
+      "format": "uuid",
+      "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+    }
+  },
+  "additionalProperties": false
+}

package/artifacts/schema/role-in-use-details.schema.json

@@ -0,0 +1,28 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "users": {
+      "type": "integer",
+      "minimum": 0,
+      "maximum": 9007199254740991,
+      "description": "App users whose role this is."
+    },
+    "invitations": {
+      "type": "integer",
+      "minimum": 0,
+      "maximum": 9007199254740991,
+      "description": "Pending invitations that would grant this role when accepted."
+    },
+    "is_default": {
+      "type": "boolean",
+      "description": "`true` when this is the app's `default_role_id`; the default then moves with the users to `move_to`."
+    }
+  },
+  "required": [
+    "users",
+    "invitations",
+    "is_default"
+  ],
+  "additionalProperties": false
+}

package/artifacts/schema/role-list-response.schema.json

@@ -27,7 +27,7 @@
           },
           "builtin": {
             "type": "boolean",
-            "description": "`true` for the two roles every app starts with. Their **rights may be re-scoped** exactly like a custom role's, through `PUT /api/apps/:id/roles/:roleId/permissions` — the flag exists so the console can explain where they came from, not to protect them. It does not make them renamable or deletable — no route does that for any role."
+            "description": "`true` for the two roles every app starts with. Their **rights may be re-scoped** exactly like a custom role's, through `PUT /api/apps/:id/roles/:roleId/permissions` — the flag exists so the console can explain where they came from, not to protect them. Built-in roles can be renamed and deleted like any other; the flag only records that the cloud seeded them."
           }
         },
         "required": [

package/artifacts/schema/role-rename-request.schema.json

@@ -0,0 +1,16 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "name": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 60,
+      "description": "The new name, trimmed, 1 to 60 characters. Unique per app: another role of this app with the same name answers `409 role_name_taken`. The role's users keep it under its new name."
+    }
+  },
+  "required": [
+    "name"
+  ],
+  "additionalProperties": false
+}

package/artifacts/schema/role.schema.json

@@ -22,7 +22,7 @@
     },
     "builtin": {
       "type": "boolean",
-      "description": "`true` for the two roles every app starts with. Their **rights may be re-scoped** exactly like a custom role's, through `PUT /api/apps/:id/roles/:roleId/permissions` — the flag exists so the console can explain where they came from, not to protect them. It does not make them renamable or deletable — no route does that for any role."
+      "description": "`true` for the two roles every app starts with. Their **rights may be re-scoped** exactly like a custom role's, through `PUT /api/apps/:id/roles/:roleId/permissions` — the flag exists so the console can explain where they came from, not to protect them. Built-in roles can be renamed and deleted like any other; the flag only records that the cloud seeded them."
     }
   },
   "required": [

package/dist/apps.d.ts

@@ -151,8 +151,9 @@ export declare const createServerKeyResponse: z.ZodObject<{
 export type CreateServerKeyResponse = z.infer<typeof createServerKeyResponse>;
 /**
  * Every app starts with `observe` and `operate`; custom roles are allowed
- * too. `builtin` marks the two starting roles — editable like any other,
- * the flag only tells the console where they came from.
+ * too. `builtin` marks the two starting roles — editable, renamable and
+ * deletable like any other; the flag only tells the console where they came
+ * from.
  */
 export declare const role: z.ZodObject<{
     id: z.ZodUUID;
@@ -171,6 +172,41 @@ export declare const roleListResponse: z.ZodObject<{
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type RoleListResponse = z.infer<typeof roleListResponse>;
+/**
+ * The body of `PATCH /api/apps/:id/roles/:roleId`: the role's new name.
+ *
+ * The same bounds as `role.name`, trimmed. Names are unique per app, compared
+ * exactly as stored after trimming; a clash answers `409 role_name_taken`.
+ */
+export declare const roleRenameRequest: z.ZodObject<{
+    name: z.ZodString;
+}, z.core.$strict>;
+export type RoleRenameRequest = z.infer<typeof roleRenameRequest>;
+/**
+ * The query of `DELETE /api/apps/:id/roles/:roleId`.
+ *
+ * `move_to` is what makes a held role deletable: every app user and pending
+ * invitation holding the role moves to it, and so does the app's default when
+ * it pointed at the role, in the same transaction as the delete. Without it a
+ * held role answers `409 role_in_use` with `roleInUseDetails`, so a client
+ * can ask where they should go instead of guessing.
+ */
+export declare const roleDeleteQuery: z.ZodObject<{
+    move_to: z.ZodOptional<z.ZodUUID>;
+}, z.core.$strict>;
+export type RoleDeleteQuery = z.infer<typeof roleDeleteQuery>;
+/**
+ * `details` of `409 role_in_use`: what still holds the role.
+ *
+ * All three are reported, zeros included, so a client renders one sentence
+ * from one shape rather than inferring a missing key.
+ */
+export declare const roleInUseDetails: z.ZodObject<{
+    users: z.ZodNumber;
+    invitations: z.ZodNumber;
+    is_default: z.ZodBoolean;
+}, z.core.$strict>;
+export type RoleInUseDetails = z.infer<typeof roleInUseDetails>;
 /**
  * The rights matrix of one role: which slugs of which robot it may use, plus
  * the capabilities roles also govern. `capabilities`' own doc comment

package/dist/apps.js

@@ -206,8 +206,9 @@ export const createServerKeyResponse = z.object({
 });
 /**
  * Every app starts with `observe` and `operate`; custom roles are allowed
- * too. `builtin` marks the two starting roles — editable like any other,
- * the flag only tells the console where they came from.
+ * too. `builtin` marks the two starting roles — editable, renamable and
+ * deletable like any other; the flag only tells the console where they came
+ * from.
  */
 export const role = z.object({
     id: z.uuid().meta({
@@ -220,7 +221,7 @@ export const role = z.object({
         description: 'The role\'s name, shown wherever a user\'s access is chosen. The two roles every app starts with are named `observe` and `operate`.',
     }),
     builtin: z.boolean().meta({
-        description: '`true` for the two roles every app starts with. Their **rights may be re-scoped** exactly like a custom role\'s, through `PUT /api/apps/:id/roles/:roleId/permissions` — the flag exists so the console can explain where they came from, not to protect them. It does not make them renamable or deletable — no route does that for any role.',
+        description: '`true` for the two roles every app starts with. Their **rights may be re-scoped** exactly like a custom role\'s, through `PUT /api/apps/:id/roles/:roleId/permissions` — the flag exists so the console can explain where they came from, not to protect them. Built-in roles can be renamed and deleted like any other; the flag only records that the cloud seeded them.',
     }),
 });
 /** What `GET /api/apps/:id/roles` answers: the app's roles, builtin and custom alike. */
@@ -229,6 +230,48 @@ export const roleListResponse = z.object({
         description: 'The app\'s roles, built-in and custom alike, ordered by `created_at` and then by `name`. The tie-break is not cosmetic — the two built-in roles are inserted in one statement and share a creation time to the microsecond, so never read a role by position.',
     }),
 });
+/**
+ * The body of `PATCH /api/apps/:id/roles/:roleId`: the role's new name.
+ *
+ * The same bounds as `role.name`, trimmed. Names are unique per app, compared
+ * exactly as stored after trimming; a clash answers `409 role_name_taken`.
+ */
+export const roleRenameRequest = z.object({
+    name: z.string().trim().min(1).max(60).meta({
+        description: 'The new name, trimmed, 1 to 60 characters. Unique per app: another role of this app with the same name answers `409 role_name_taken`. The role\'s users keep it under its new name.',
+    }),
+}).strict();
+/**
+ * The query of `DELETE /api/apps/:id/roles/:roleId`.
+ *
+ * `move_to` is what makes a held role deletable: every app user and pending
+ * invitation holding the role moves to it, and so does the app's default when
+ * it pointed at the role, in the same transaction as the delete. Without it a
+ * held role answers `409 role_in_use` with `roleInUseDetails`, so a client
+ * can ask where they should go instead of guessing.
+ */
+export const roleDeleteQuery = z.object({
+    move_to: z.uuid().optional().meta({
+        description: 'Another role of the same app that takes over the deleted role\'s app users, pending invitations and, when it applies, the app\'s default. The role itself or a role of another app answers `400 validation_error`.',
+    }),
+}).strict();
+/**
+ * `details` of `409 role_in_use`: what still holds the role.
+ *
+ * All three are reported, zeros included, so a client renders one sentence
+ * from one shape rather than inferring a missing key.
+ */
+export const roleInUseDetails = z.object({
+    users: z.number().int().nonnegative().meta({
+        description: 'App users whose role this is.',
+    }),
+    invitations: z.number().int().nonnegative().meta({
+        description: 'Pending invitations that would grant this role when accepted.',
+    }),
+    is_default: z.boolean().meta({
+        description: '`true` when this is the app\'s `default_role_id`; the default then moves with the users to `move_to`.',
+    }),
+}).strict();
 /**
  * The rights matrix of one role: which slugs of which robot it may use, plus
  * the capabilities roles also govern. `capabilities`' own doc comment

package/dist/audit.d.ts

@@ -72,6 +72,7 @@ export declare const auditQuery: z.ZodObject<{
     action_prefix: z.ZodOptional<z.ZodString>;
     actor_id: z.ZodOptional<z.ZodUUID>;
     target_kind: z.ZodOptional<z.ZodString>;
+    target_id: z.ZodOptional<z.ZodString>;
     from_ms: z.ZodOptional<z.ZodPipe<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodTransform<number, string | number>>, z.ZodNumber>>;
     to_ms: z.ZodOptional<z.ZodPipe<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodTransform<number, string | number>>, z.ZodNumber>>;
 }, z.core.$strict>;

package/dist/audit.js

@@ -155,6 +155,19 @@ export const auditQuery = z.object({
     actor_id: z.uuid().optional(),
     /** Only events about this kind of target, e.g. `robot`. */
     target_kind: z.string().min(1).max(40).optional(),
+    /**
+     * Only events about this target — and, for a robot, also the events that
+     * name it in `details.robot_id`, so a robot's log includes what was
+     * started on it.
+     *
+     * **A string, not `z.uuid()`**, unlike `actor_id` above: `target.id` is a
+     * string in this contract and text in the cloud's table, so a uuid rule
+     * here would refuse ids the log can hold, and no value can fail a cast.
+     */
+    target_id: z.string().min(1).max(200).optional().meta({
+        description: 'Events whose target is this id; for a robot also the events that name it in `details.robot_id` (`action.invoked`, ' +
+            '`service.called`, …), so a robot\'s events include what was started on it.',
+    }),
     /**
      * Absolute bounds in unix milliseconds, **half-open `[from, to)`** — the
      * same rule the history shapes follow.

package/dist/errors.d.ts

@@ -68,5 +68,5 @@ export type CancelRejectedDetails = z.infer<typeof cancelRejectedDetails>;
  * list is the shared vocabulary, not a closed set, so a new refusal never
  * needs a contracts release before it can be reported honestly.
  */
-export declare const ERROR_CODES: readonly ["not_found", "validation_error", "bad_request", "unknown_datapoint", "invalid_token", "protocol_mismatch", "bridge_too_old", "invalid_frame", "duplicate_slug", "reserved_slug", "unknown_slug", "unknown_field_path", "unknown_type", "unknown_topic", "invalid_rate", "invalid_range", "config_conflict", "no_data", "robot_offline", "bridge_timeout", "unauthorized", "forbidden", "invalid_credentials", "token_expired", "token_revoked", "email_taken", "identifier_taken", "weak_password", "account_blocked", "busy", "parameter_invalid", "cancel_rejected", "job_lost", "job_unknown_to_bridge", "action_server_lost", "action_failed", "goal_rejected", "goal_send_failed", "result_failed", "goal_uncontrollable", "bridge_disconnected", "config_changed", "publisher_busy", "unknown_command", "not_subscribable", "camera_offline", "no_snapshot_yet", "live_unavailable", "wrong_kind", "not_recorded", "not_aggregatable", "quota_exceeded", "credential_in_use", "goal_timeout", "robot_in_use", "robot_deletion_partial", "job_queue_full", "invalid_uuid", "rate_limited", "tier_required", "token_spent", "service_timeout", "asset_missing", "dynamic_registration_disabled", "client_limit_reached", "idp_unavailable", "mcp_disabled", "tool_not_available", "capability_required", "last_owner", "target_state_conflict", "signup_closed", "draft_not_a_document", "internal_error", "not_cancellable", "unsupported_media_type", "wrong_browser", "invalid_yaml", "unstorable_yaml", "registration_closed", "domain_not_allowed", "email_unverified", "origin_not_allowed", "template_invalid", "provider_disabled", "provider_misconfigured", "invalid_redirect_uri", "interaction_expired"];
+export declare const ERROR_CODES: readonly ["not_found", "validation_error", "bad_request", "unknown_datapoint", "invalid_token", "protocol_mismatch", "bridge_too_old", "invalid_frame", "duplicate_slug", "reserved_slug", "unknown_slug", "unknown_field_path", "unknown_type", "unknown_topic", "invalid_rate", "invalid_range", "config_conflict", "no_data", "robot_offline", "bridge_timeout", "unauthorized", "forbidden", "invalid_credentials", "token_expired", "token_revoked", "email_taken", "identifier_taken", "weak_password", "account_blocked", "busy", "parameter_invalid", "cancel_rejected", "job_lost", "job_unknown_to_bridge", "action_server_lost", "action_failed", "goal_rejected", "goal_send_failed", "result_failed", "goal_uncontrollable", "bridge_disconnected", "config_changed", "publisher_busy", "unknown_command", "not_subscribable", "camera_offline", "no_snapshot_yet", "live_unavailable", "wrong_kind", "not_recorded", "not_aggregatable", "quota_exceeded", "credential_in_use", "goal_timeout", "robot_in_use", "robot_deletion_partial", "job_queue_full", "invalid_uuid", "rate_limited", "tier_required", "token_spent", "service_timeout", "asset_missing", "dynamic_registration_disabled", "client_limit_reached", "idp_unavailable", "mcp_disabled", "tool_not_available", "capability_required", "last_owner", "role_name_taken", "role_in_use", "last_role", "target_state_conflict", "signup_closed", "draft_not_a_document", "internal_error", "not_cancellable", "unsupported_media_type", "wrong_browser", "invalid_yaml", "unstorable_yaml", "registration_closed", "domain_not_allowed", "email_unverified", "origin_not_allowed", "template_invalid", "provider_disabled", "provider_misconfigured", "invalid_redirect_uri", "interaction_expired"];
 export type ErrorCode = (typeof ERROR_CODES)[number];

package/dist/errors.js

@@ -562,6 +562,35 @@ export const ERROR_CODES = [
      * caller could infer from a silence about existence.
      */
     'last_owner',
+    // App roles.
+    /**
+     * **Another role of this app already has that name.** 409, on
+     * `PATCH /api/apps/:id/roles/:roleId`. Names are unique per app, compared
+     * exactly as stored after trimming.
+     *
+     * Not `validation_error`: the name is well-formed, and the remedy — pick
+     * another — depends on the app's other roles, not on the body.
+     */
+    'role_name_taken',
+    /**
+     * **The role is still held**, by app users, by pending invitations, or as
+     * the app's default role. 409, on `DELETE /api/apps/:id/roles/:roleId`
+     * without `move_to`. `details` is `roleInUseDetails`:
+     * `{ users, invitations, is_default }`.
+     *
+     * Not `conflict`: the details tell the console what to offer — a role to
+     * move them to — and a generic code would leave it guessing.
+     */
+    'role_in_use',
+    /**
+     * **An app must keep at least one role.** 409, on
+     * `DELETE /api/apps/:id/roles/:roleId` for the app's only role: every app
+     * user holds exactly one role, so an app without roles could hold no users.
+     *
+     * The same shape of refusal as `last_owner`: the caller may delete roles;
+     * the app's remaining state is what refuses this one.
+     */
+    'last_role',
     // OIDC federation.
     /**
      * **The target is in a state that refuses the operation** — not the caller's

package/dist/feedback.d.ts

@@ -0,0 +1,42 @@
+// SPDX-License-Identifier: Apache-2.0
+import { z } from 'zod';
+/**
+ * **Feedback: a message from a developer to the people who build Fleetless.**
+ *
+ * The console's feedback modal sends it; the cloud stores it first and mails
+ * it afterwards, so a message is never lost to a mail failure. Who sent it and
+ * from which org is the caller's session, never the body: the body carries
+ * only what the developer chose to say and the page they said it on.
+ */
+/** The four kinds the console's modal offers. */
+export declare const FEEDBACK_KINDS: readonly ["idea", "problem", "question", "other"];
+export declare const feedbackKind: z.ZodEnum<{
+    idea: "idea";
+    problem: "problem";
+    question: "question";
+    other: "other";
+}>;
+/** Longest message the cloud stores; the console's counter starts at 4 500. */
+export declare const FEEDBACK_MESSAGE_MAX = 5000;
+export declare const feedbackRequest: z.ZodObject<{
+    kind: z.ZodEnum<{
+        idea: "idea";
+        problem: "problem";
+        question: "question";
+        other: "other";
+    }>;
+    message: z.ZodString;
+    page: z.ZodString;
+}, z.core.$strict>;
+export declare const feedbackResponse: z.ZodObject<{
+    id: z.ZodUUID;
+    mail: z.ZodEnum<{
+        sent: "sent";
+        not_requested: "not_requested";
+        not_configured: "not_configured";
+        failed: "failed";
+    }>;
+}, z.core.$strict>;
+export type FeedbackKind = z.infer<typeof feedbackKind>;
+export type FeedbackRequest = z.infer<typeof feedbackRequest>;
+export type FeedbackResponse = z.infer<typeof feedbackResponse>;

package/dist/feedback.js

@@ -0,0 +1,35 @@
+// SPDX-License-Identifier: Apache-2.0
+import { z } from 'zod';
+import { mailStatus } from './identity.js';
+/**
+ * **Feedback: a message from a developer to the people who build Fleetless.**
+ *
+ * The console's feedback modal sends it; the cloud stores it first and mails
+ * it afterwards, so a message is never lost to a mail failure. Who sent it and
+ * from which org is the caller's session, never the body: the body carries
+ * only what the developer chose to say and the page they said it on.
+ */
+/** The four kinds the console's modal offers. */
+export const FEEDBACK_KINDS = ['idea', 'problem', 'question', 'other'];
+export const feedbackKind = z.enum(FEEDBACK_KINDS);
+/** Longest message the cloud stores; the console's counter starts at 4 500. */
+export const FEEDBACK_MESSAGE_MAX = 5000;
+export const feedbackRequest = z.object({
+    kind: feedbackKind.meta({
+        description: 'What the message is: an `idea`, a `problem`, a `question` or `other`. It only sorts the inbox; it changes nothing about how the message is handled.',
+    }),
+    message: z.string().trim().min(1).max(FEEDBACK_MESSAGE_MAX).meta({
+        description: 'What the developer wrote, trimmed. At most 5000 characters; a message that is only whitespace is refused.',
+    }),
+    page: z.string().startsWith('/').max(512).meta({
+        description: 'The console path the message was sent from, e.g. `/robots/:id/jobs` with its real id. A path, never a full URL, so no host and no query string reach the inbox by accident.',
+    }),
+}).strict();
+export const feedbackResponse = z.object({
+    id: z.uuid().meta({
+        description: 'The stored message. It exists whatever `mail` says.',
+    }),
+    mail: mailStatus.meta({
+        description: 'What happened to the notification mail: `sent`, `failed`, or `not_configured` when this cloud has no feedback address. The message is stored in every case, so a client shows success for all three.',
+    }),
+}).strict();

package/dist/index.d.ts

@@ -31,8 +31,10 @@ export { clientAuth, authOk, authError, clientInvoke, clientCancel, clientPublis
 export type { ClientAuth, AuthOk, AuthError, ClientInvoke, ClientCancel, ClientPublish, CommandResult, ErrorFrame, ClientSubscribe, ClientUnsubscribe, SubscribeError, DatapointEvent, ResourceHealthEvent, ResourceHealthCleared, LiveSessionEndReason, LiveSessionEvent, OrgEventKind, OrgEventSeverity, OrgEvent, OrgEventSubscribe, OrgEventUnsubscribe, OrgEventReplay, OrgEventDropped, } from './realtime.js';
 export { password, org, patchOrgResponse, sessionTokens, refreshRequest, signUpRequest, signUpResponse, waitlistRequest, developerLoginRequest, USER_DISPLAY_NAME_MAX, orgAdminTier, fleetlessUser, fleetlessUserListResponse, createTeamInviteRequest, teamInvite, pendingTeamInvite, pendingTeamInviteListResponse, acceptTeamInviteRequest, patchFleetlessUserRequest, tierChangeRequest, mailStatus, tierRequiredDetails, passwordChangeRequest, passwordResetRequest, passwordResetConfirm, idpIssuer, authMeResponse, patchOrgRequest, patchAuthMeRequest, } from './identity.js';
 export type { Org, PatchOrgResponse, SessionTokens, RefreshRequest, SignUpRequest, SignUpResponse, WaitlistRequest, DeveloperLoginRequest, OrgAdminTier, FleetlessUser, FleetlessUserListResponse, CreateTeamInviteRequest, TeamInvite, PendingTeamInvite, PendingTeamInviteListResponse, AcceptTeamInviteRequest, PatchFleetlessUserRequest, TierChangeRequest, MailStatus, TierRequiredDetails, PasswordChangeRequest, PasswordResetRequest, PasswordResetConfirm, IdpIssuer, AuthMeResponse, PatchOrgRequest, PatchAuthMeRequest, } from './identity.js';
-export { appIdentifier, app, appListResponse, appDeletionSummary, createAppRequest, updateAppRequest, serverKeyToken, serverKey, serverKeyListResponse, createServerKeyResponse, role, roleListResponse, rolePermissions, } from './apps.js';
-export type { App, AppListResponse, AppDeletionSummary, CreateAppRequest, UpdateAppRequest, ServerKey, ServerKeyListResponse, CreateServerKeyResponse, Role, RoleListResponse, RolePermissions, } from './apps.js';
+export { FEEDBACK_KINDS, FEEDBACK_MESSAGE_MAX, feedbackKind, feedbackRequest, feedbackResponse } from './feedback.js';
+export type { FeedbackKind, FeedbackRequest, FeedbackResponse } from './feedback.js';
+export { appIdentifier, app, appListResponse, appDeletionSummary, createAppRequest, updateAppRequest, serverKeyToken, serverKey, serverKeyListResponse, createServerKeyResponse, role, roleListResponse, rolePermissions, roleRenameRequest, roleDeleteQuery, roleInUseDetails, } from './apps.js';
+export type { App, AppListResponse, AppDeletionSummary, CreateAppRequest, UpdateAppRequest, ServerKey, ServerKeyListResponse, CreateServerKeyResponse, Role, RoleListResponse, RolePermissions, RoleRenameRequest, RoleDeleteQuery, RoleInUseDetails, } from './apps.js';
 export { clientLoginRequest, clientRefreshRequest, clientLogoutRequest, clientRegisterRequest, clientVerifyEmailRequest, clientResendVerificationRequest, clientPasswordResetRequest, clientPasswordResetConfirmRequest, clientAcceptInvitationRequest, CLIENT_OIDC_CALLBACK_PATH, clientProviderListQuery, clientProviderListResponse, clientOidcStartQuery, clientOidcCallbackQuery, clientOidcExchangeRequest, clientOidcErrorCode, clientMcpInteraction, clientMcpInteractionDecisionResponse, mcpConsentGrant, mcpConsentGrantListResponse, clientIdentity, } from './client-auth.js';
 export type { ClientLoginRequest, ClientRefreshRequest, ClientLogoutRequest, ClientRegisterRequest, ClientVerifyEmailRequest, ClientResendVerificationRequest, ClientPasswordResetRequest, ClientPasswordResetConfirmRequest, ClientAcceptInvitationRequest, ClientProviderListQuery, ClientProviderListResponse, ClientOidcStartQuery, ClientOidcCallbackQuery, ClientOidcExchangeRequest, ClientOidcErrorCode, ClientMcpInteraction, ClientMcpInteractionDecisionResponse, McpConsentGrant, McpConsentGrantListResponse, ClientIdentity, } from './client-auth.js';
 export { clientRobotListItem, clientRobotListResponse } from './client-robots.js';

package/dist/index.js

@@ -38,7 +38,9 @@ USER_DISPLAY_NAME_MAX, orgAdminTier, fleetlessUser, fleetlessUserListResponse, c
 mailStatus, tierRequiredDetails, passwordChangeRequest, passwordResetRequest, passwordResetConfirm, idpIssuer, 
 // auth/me, org and member patches.
 authMeResponse, patchOrgRequest, patchAuthMeRequest, } from './identity.js';
-export { appIdentifier, app, appListResponse, appDeletionSummary, createAppRequest, updateAppRequest, serverKeyToken, serverKey, serverKeyListResponse, createServerKeyResponse, role, roleListResponse, rolePermissions, } from './apps.js';
+// 2026-09-30 — the console's feedback modal.
+export { FEEDBACK_KINDS, FEEDBACK_MESSAGE_MAX, feedbackKind, feedbackRequest, feedbackResponse } from './feedback.js';
+export { appIdentifier, app, appListResponse, appDeletionSummary, createAppRequest, updateAppRequest, serverKeyToken, serverKey, serverKeyListResponse, createServerKeyResponse, role, roleListResponse, rolePermissions, roleRenameRequest, roleDeleteQuery, roleInUseDetails, } from './apps.js';
 export { clientLoginRequest, clientRefreshRequest, clientLogoutRequest, clientRegisterRequest, clientVerifyEmailRequest, clientResendVerificationRequest, clientPasswordResetRequest, clientPasswordResetConfirmRequest, clientAcceptInvitationRequest, CLIENT_OIDC_CALLBACK_PATH, clientProviderListQuery, clientProviderListResponse, clientOidcStartQuery, clientOidcCallbackQuery, clientOidcExchangeRequest, clientOidcErrorCode, clientMcpInteraction, clientMcpInteractionDecisionResponse, mcpConsentGrant, mcpConsentGrantListResponse, clientIdentity, } from './client-auth.js';
 export { clientRobotListItem, clientRobotListResponse } from './client-robots.js';
 // The per-app identity space.

package/dist/jobs.d.ts

@@ -241,6 +241,7 @@ export declare const jobActor: z.ZodObject<{
     }>;
     id: z.ZodUUID;
     label: z.ZodString;
+    name: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
 export type JobActor = z.infer<typeof jobActor>;
 export declare const jobRunKind: z.ZodEnum<{
@@ -289,6 +290,7 @@ export declare const jobRun: z.ZodObject<{
         }>;
         id: z.ZodUUID;
         label: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
     }, z.core.$strip>;
     seq: z.ZodNumber;
     progress: z.ZodNullable<z.ZodNumber>;
@@ -351,6 +353,7 @@ export declare const jobRunListResponse: z.ZodObject<{
             }>;
             id: z.ZodUUID;
             label: z.ZodString;
+            name: z.ZodNullable<z.ZodString>;
         }, z.core.$strip>;
         seq: z.ZodNumber;
         progress: z.ZodNullable<z.ZodNumber>;

package/dist/jobs.js

@@ -226,6 +226,22 @@ export const jobActor = z.object({
     label: z.string().min(1).max(200).meta({
         description: 'A display name taken at invoke time — the email for a Fleetless user or an app user, the key\'s own name for a server key. Storing it rather than joining is the point: renaming a key afterwards does not rewrite history.',
     }),
+    /**
+     * The person's display name, snapshotted beside `label` for the same
+     * reason. **Required and nullable**, so a consumer never has to tell
+     * "absent" from "null": every run a 5.3.0 cloud answers carries it, and
+     * `null` means there is no name to show — a server key, a person without
+     * one, or a run recorded before the field existed.
+     *
+     * `jobActor` stays a plain object, not `.strict()`: a consumer still on an
+     * older contracts version then parses a newer cloud's answer by stripping
+     * the key instead of refusing the whole run.
+     */
+    name: z.string().min(1).max(200).nullable().meta({
+        description: 'The person\'s display name when the job started: the Fleetless user\'s `display_name` for a developer, the app user\'s ' +
+            '`display_name` for an app user. `null` for a server key, when the person had no name set, and for runs recorded before ' +
+            'contracts 5.3.0. Show `label` when it is null.',
+    }),
 });
 export const jobRunKind = z.enum(['action', 'service']);
 /**

package/dist/routes.js

@@ -1,8 +1,9 @@
 // SPDX-License-Identifier: Apache-2.0
-import { appListResponse, appDeletionSummary, createAppRequest, createServerKeyResponse, app as appSchema, role, roleListResponse, rolePermissions, serverKeyListResponse, updateAppRequest, } from './apps.js';
+import { appListResponse, appDeletionSummary, createAppRequest, createServerKeyResponse, app as appSchema, role, roleListResponse, roleDeleteQuery, rolePermissions, roleRenameRequest, serverKeyListResponse, updateAppRequest, } from './apps.js';
 import { alertListResponse, orgAlertsQuery, orgFiringAlertsResponse } from './alerts.js';
 import { asset, assetListResponse, assetsClearResponse, assetSyncRequest, assetSyncResponse, assetSyncStatus, missingAssetQuery } from './assets.js';
 import { auditListResponse, auditQuery } from './audit.js';
+import { feedbackRequest, feedbackResponse } from './feedback.js';
 import { CLIENT_OIDC_CALLBACK_PATH, clientAcceptInvitationRequest, clientIdentity, clientLoginRequest, clientLogoutRequest, clientMcpInteraction, clientMcpInteractionDecisionResponse, clientOidcCallbackQuery, clientOidcExchangeRequest, clientOidcStartQuery, clientPasswordResetConfirmRequest, clientPasswordResetRequest, clientProviderListQuery, clientProviderListResponse, clientRefreshRequest, clientRegisterRequest, clientResendVerificationRequest, clientVerifyEmailRequest, mcpConsentGrantListResponse, } from './client-auth.js';
 import { clientRobotListResponse } from './client-robots.js';
 import { appAuthConfig, appInvitation, appInvitationListResponse, appMailTemplate, appMailTemplateListResponse, appOidcProvider, appOidcProviderListResponse, appUser, appUserListResponse, createAppInvitationRequest, createAppOidcProviderRequest, createAppUserRequest, mailOutcome, mailTemplatePreviewRequest, mailTemplatePreviewResponse, patchAppOidcProviderRequest, patchAppUserRequest, putAppAuthMcpRequest, putAppAuthRegistrationRequest, putAppAuthUrlsRequest, putAppMailTemplateRequest, } from './app-users.js';
@@ -328,7 +329,7 @@ export const ROUTES = [
         params: [{ name: 'id', description: 'The app\'s uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`.' }],
         query: null, request: null, response: role,
         errors: [...DEVELOPER_GUARD, 'invalid_uuid', 'not_found', 'validation_error'], transport: 'http',
-        notes: 'The body is `{ "name": string }` — non-empty, trimmed, at most 120 characters — and is deliberately not a contract shape: contracts ' +
+        notes: 'The body is `{ "name": string }` — non-empty, trimmed, at most 60 characters as on `role.name` — and is deliberately not a contract shape: contracts ' +
             'define the `role` this answers with, not this one trivial request. **The answer is a bare `role`, not an envelope**, unlike the ' +
             'listing beside it.',
     },
@@ -381,6 +382,33 @@ export const ROUTES = [
             'offered and consults nothing about any user\'s actual MCP entitlement. A robot the role grants nothing on still appears, with an empty ' +
             '`exposures` — dropping it would read as "not attached", which is a different fact.',
     },
+    {
+        method: 'PATCH', path: '/api/apps/:id/roles/:roleId', section: 'apps',
+        summary: 'Renames a role; its users keep it.',
+        audience: 'developer', auth: 'developer', rateLimited: false, ownerTier: false, status: 200,
+        params: [
+            { name: 'id', description: 'The app\'s uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`.' },
+            { name: 'roleId', description: 'The role\'s uuid, from `GET /api/apps/:id/roles`; a role of another app answers `404`.' },
+        ],
+        query: null, request: roleRenameRequest, response: role,
+        errors: [...DEVELOPER_GUARD, 'invalid_uuid', 'not_found', 'validation_error', 'role_name_taken'], transport: 'http',
+        notes: 'Names are unique per app, compared exactly as stored after trimming. Built-in roles can be renamed.',
+    },
+    {
+        method: 'DELETE', path: '/api/apps/:id/roles/:roleId', section: 'apps',
+        summary: 'Deletes a role, moving its users, pending invitations and default-role status to another role.',
+        audience: 'developer', auth: 'developer', rateLimited: false, ownerTier: false, status: 204,
+        params: [
+            { name: 'id', description: 'The app\'s uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`.' },
+            { name: 'roleId', description: 'The role\'s uuid, from `GET /api/apps/:id/roles`; a role of another app answers `404`.' },
+        ],
+        query: roleDeleteQuery, request: null, response: null,
+        errors: [...DEVELOPER_GUARD, 'invalid_uuid', 'not_found', 'validation_error', 'role_in_use', 'last_role'], transport: 'http',
+        notes: 'Without `move_to`, a role that app users or pending invitations hold, or that is the app\'s default, answers ' +
+            '`409 role_in_use` with `{ users, invitations, is_default }`. With `move_to` — another role of the same app, else ' +
+            '`400 validation_error` — one transaction moves `app_users.role_id`, pending invitations and `default_role_id`, then deletes ' +
+            'the role and its permissions. The app\'s only role answers `409 last_role`. Built-in roles can be deleted like any other.',
+    },
     {
         method: 'POST', path: '/api/apps/:id/server-keys', section: 'apps',
         summary: 'Mints a server key for the app and returns the raw secret once.',
@@ -2417,6 +2445,16 @@ export const ROUTES = [
             'platform will answer is owed a refusal, not a shorter answer they will mistake for the whole picture. `from_day <= to_day` is a ' +
             'cross-field rule no JSON Schema can express and is enforced here. The window is echoed back.',
     },
+    {
+        method: 'POST', path: '/api/feedback', section: 'org',
+        summary: 'Sends a message from a developer to the people who build Fleetless.',
+        audience: 'developer', auth: 'developer', rateLimited: true, ownerTier: false, status: 202,
+        params: [], query: null, request: feedbackRequest, response: feedbackResponse,
+        errors: [...DEVELOPER_GUARD, 'validation_error', 'rate_limited'], transport: 'http',
+        notes: 'The message is stored before any mail is tried, so `202` means it is kept whatever `mail` says: `sent`, `failed`, or ' +
+            '`not_configured` when this cloud has no feedback address. At most 10 messages per developer per hour; the 11th answers ' +
+            '`429 rate_limited` with `retry_after_ms`. Replies come by mail, to the sender\'s address.',
+    },
     /* ------------------------------------------------- assets (robot upload) */
     {
         method: 'POST', path: '/api/bridge/assets', section: 'assets',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fleetless/contracts",
-  "version": "5.2.0",
+  "version": "5.3.0",
   "description": "Fleetless wire contracts: the bridge-cloud protocol, the REST API schemas and the error codes, as zod schemas with generated JSON Schema and OpenAPI artifacts.",
   "license": "Apache-2.0",
   "author": "Dehne Robotik GmbH",