@fleetless/contracts 5.2.0 → 6.0.0-next.1

package/dist/identity.js

@@ -7,9 +7,10 @@ import { z } from 'zod';
  * There are two identity spaces now and **nothing joins them**:
  *
  * - *Fleetless users*, this file. The people who configure robots in the
- *   console. Email globally unique, tier `owner | developer`, a Fleetless
- *   password, login through the auth portal. They always have MCP access, at
- *   the one central endpoint.
+ *   console. Email globally unique, tier `owner | developer`, sign-in through
+ *   the auth portal by a code mailed to them or by a passkey — **no
+ *   password** — with an optional second factor the organisation may require.
+ *   They always have MCP access, at the one central endpoint.
  * - *app users*, `app-users.ts`. The people who use a developer's app. One app
  *   each, email unique per app, authenticated through the JSON client-auth
  *   API that the developer's own UI calls.
@@ -24,25 +25,31 @@ import { z } from 'zod';
  * the two populations have different lifecycles, and every joining mechanism
  * was cost without a product reason.
  *
- * What did **not** change: the password rules, the session and token shapes,
- * and the enumeration-oracle reasoning on password reset. None of those was
- * ever a statement about which space a person lived in.
+ * What did **not** change: the session and token shapes, and the
+ * enumeration-oracle reasoning. Neither was ever a statement about which space
+ * a person lived in.
+ *
+ * **Developers have no password any more.** They sign in with a six-digit
+ * code mailed to them, or with a passkey, which proves possession and user
+ * verification at once and so completes a sign-in on its own. After a code,
+ * a developer with a second factor — a passkey or an authenticator app —
+ * gives it; ten recovery codes are the fallback. The password sign-in, the
+ * password change, the reset pages and `POST /api/auth/signup` are gone: the
+ * portal's sign-up (email, code, organisation) is the one door in.
  *
  * **Email is globally unique here** — `lower(email)` unique across all orgs, so
- * one address is exactly one Fleetless user in exactly one org. Every shape
- * that identifies a person by a bare address (`developerLoginRequest`,
- * `passwordResetRequest`) therefore resolves to at most one account with no org
- * context needed. App users are the opposite and say so on their own shape:
- * unique **per app**, so one address may be several unrelated app accounts.
+ * one address is exactly one Fleetless user in exactly one org. A bare address
+ * therefore resolves to at most one account with no org context needed. App
+ * users are the opposite and say so on their own shape: unique **per app**, so
+ * one address may be several unrelated app accounts.
  */
 /**
  * The password rule, stated once so the cloud, the console and the SDK refuse
  * the same inputs for the same reason. Length only: a rule a user cannot
  * predict is a rule they work around.
  *
- * Shared by both identity spaces on purpose. A weaker rule for app users would
- * be a second policy for one decision, and the weaker one always wins by
- * accident.
+ * App users only: Fleetless users sign in by emailed code or passkey and hold
+ * no password.
  */
 export const password = z.string().min(12).max(256);
 /** The bound on a Fleetless user's display name; `APP_USER_DISPLAY_NAME_MAX` matches it, so a rename cannot be legal in one space and refused in the other. */
@@ -70,6 +77,9 @@ export const org = z.object({
     name: z.string().min(1).max(120).meta({
         description: 'The organisation\'s display name. Free text, changed through `PATCH /api/org`.',
     }),
+    require_two_factor: z.boolean().meta({
+        description: 'Whether every member must have a second factor — a passkey or an authenticator app. A member without one sets it up at their next sign-in, before any session exists; nobody is signed out when it is switched on. It covers the console and the central MCP endpoint; server keys and robot bridges are not people and are not affected. Owners change it through `PATCH /api/org`.',
+    }),
     created_at: z.iso.datetime().meta({
         description: 'When the organisation was created, as an ISO 8601 timestamp.',
     }),
@@ -81,8 +91,8 @@ export const patchOrgResponse = z.object({
     }),
 });
 /**
- * **A member of the org's team.** Console access, a tier, a Fleetless
- * password, and no relationship whatsoever to any app's users.
+ * **A member of the org's team.** Console access, a tier, a sign-in by
+ * emailed code or passkey, and no relationship whatsoever to any app's users.
  *
  * `email` is **globally unique** — `lower(email)` unique across every org, a
  * constraint the cloud enforces in the database; a schema cannot see two rows
@@ -93,10 +103,10 @@ export const patchOrgResponse = z.object({
  * groups), `mcp_access` (a Fleetless user always has MCP access, at the
  * central endpoint), and `has_password`. The last is the interesting one — it
  * existed because a pool user might have been provisioned by an identity
- * provider and hold no Fleetless credential. A Fleetless user always holds
- * one: the console is password-only by design, which removes the
- * IdP-lockout class entirely, so a field reporting whether the credential
- * exists would have exactly one value forever.
+ * provider and hold no Fleetless credential. Every Fleetless user signs in by
+ * a code mailed to their address, so the console has no federated door and
+ * no IdP-lockout class, and a field about a password would describe nothing.
+ * What varies is the second factor, which `two_factor` reports.
  */
 export const fleetlessUser = z.object({
     id: z.uuid().meta({
@@ -114,6 +124,14 @@ export const fleetlessUser = z.object({
     tier: orgAdminTier.meta({
         description: 'The console powers this person holds. **Required** — every Fleetless user has a tier; it was optional only while the org also held people with no console powers to grade, and that pool is gone.',
     }),
+    two_factor: z
+        .object({
+        passkeys: z.number().int().min(0).meta({ description: 'How many passkeys the person has registered.' }),
+        authenticator: z.boolean().meta({ description: 'Whether the person has a confirmed authenticator app.' }),
+    })
+        .meta({
+        description: 'The person\'s second factors, as the team list shows them: none, passkeys, an authenticator, or both. No credential travels here. An owner resets them through `DELETE /api/org/users/:id/two-factor`.',
+    }),
     created_at: z.iso.datetime().meta({
         description: 'When the account was created, as an ISO 8601 timestamp.',
     }),
@@ -144,28 +162,43 @@ export const sessionTokens = z.object({
     }),
 });
 export const refreshRequest = z.object({ refresh_token: z.string().min(1) });
+/* ------------------------------------------- codes and second factors --
+ * Shared by both identity spaces, like `password` and `sessionTokens`: a
+ * six-digit code and a recovery code are the same thing whoever types them,
+ * and two spellings would be two rules for one decision.
+ */
 /**
- * Registering an org creates the org and its first owner in one step: whoever
- * registers the organisation is the owner.
+ * **A six-digit code**: the emailed sign-in code (valid ten minutes, five
+ * wrong attempts) and an authenticator's time-based code alike. Exactly six
+ * digits on the wire, leading zeros included — the portal and hosted forms
+ * strip spaces before they send it, the JSON API does not.
  */
-export const signUpRequest = z.object({
-    org_name: z.string().min(1).max(120),
-    email: z.email(),
-    password,
-});
+export const loginCode = z.string().regex(/^\d{6}$/, 'must be exactly six digits');
+/** An authenticator app's code (TOTP, RFC 6238: SHA-1, six digits, thirty-second steps). The same shape as `loginCode`. */
+export const totpCode = loginCode;
 /**
- * Registering answers with the founding **Fleetless user**, tier `owner`.
- *
- * The key is `user` rather than `member` or `owner`, and it has stayed `user`
- * through two identity redesigns deliberately: a renamed shape under a
- * renamed key would typecheck in every consumer that reads `.user.id` and mean
- * something subtly different, which is the quietest way for a cut like this to
- * go wrong.
+ * **A recovery code as typed**: two groups of five base32 characters,
+ * `xxxxx-xxxxx`, in either case — the cloud lower-cases before it compares.
+ * Single use.
+ */
+export const recoveryCode = z.string().regex(/^[a-zA-Z2-7]{5}-[a-zA-Z2-7]{5}$/, 'must be two groups of five characters, xxxxx-xxxxx');
+/**
+ * **The ten recovery codes, as issued**: lowercase, shown once. Generating a
+ * new set voids the old one.
  */
-export const signUpResponse = z.object({
-    org,
-    user: fleetlessUser,
-    tokens: sessionTokens,
+export const recoveryCodesList = z.array(z.string().regex(/^[a-z2-7]{5}-[a-z2-7]{5}$/)).length(10);
+/**
+ * **An authenticator being set up**: the secret to type in, and the same
+ * secret as an `otpauth://` URL for a QR code. Nothing is stored as
+ * confirmed until a code from it is confirmed.
+ */
+export const twoFactorSetupResponse = z.object({
+    secret: z.string().min(1).meta({
+        description: 'The shared secret, base32, for an authenticator app that cannot scan a QR code. Shown once; the cloud stores it encrypted.',
+    }),
+    otpauth_url: z.string().startsWith('otpauth://totp/').meta({
+        description: 'The same secret as an `otpauth://totp/` URL, to render as a QR code. It carries the secret: never log it.',
+    }),
 });
 /**
  * The landing page's waiting list (public site, 2026-09-04): one address,
@@ -178,24 +211,6 @@ export const signUpResponse = z.object({
  * turns an unauthenticated public route into a `500`.
  */
 export const waitlistRequest = z.object({ email: z.email().max(254) });
-/**
- * Console login. Fleetless users only, always the Fleetless password — the
- * console has no federated door at all, which removes the IdP-lockout
- * class entirely.
- *
- * This resolves a person by address alone, and a Fleetless user's email is
- * **globally unique**, so a bare address names at most one account and no org
- * context is needed to disambiguate. An org selector was never needed and
- * would have told an unauthenticated caller which org an address belongs to.
- *
- * **It cannot be reached by an app user**, whatever their address: the two
- * spaces have separate tables and separate routes, and a credential from one
- * never authenticates the other.
- */
-export const developerLoginRequest = z.object({
-    email: z.email(),
-    password: z.string().min(1),
-});
 /**
  * What happened to the mail, in four words instead of one.
  *
@@ -304,14 +319,18 @@ export const pendingTeamInviteListResponse = z.object({
         description: 'Pending invitations only. An accepted invitation is history, not something to revoke.',
     }),
 });
-/** Accepting it: the token proves the invitation, the password creates the login. */
+/**
+ * Accepting it: the token proves the invitation, and the mailed link proves
+ * the address, so accepting needs no code and takes **no password** — the
+ * new member signs in by emailed code from then on.
+ */
 export const acceptTeamInviteRequest = z
     .object({
     token: z.string().min(1).meta({
         description: 'The opaque invitation token from the link. Unknown, expired and already-accepted all collapse into `410 token_spent` — telling them apart would say whether a token ever existed.',
     }),
-    password: password.meta({
-        description: 'The password the new Fleetless account will use. At least 12 characters.',
+    display_name: z.string().min(1).max(USER_DISPLAY_NAME_MAX).nullable().optional().meta({
+        description: 'An optional name, overriding whatever the invitation pre-filled. Absent keeps it.',
     }),
 })
     .strict();
@@ -366,17 +385,14 @@ export const tierRequiredDetails = z.object({
     actual: orgAdminTier,
 });
 /**
- * Changing your own password while logged in.
+ * An app user changing their own password while signed in
+ * (`POST /api/client/password/change`). Fleetless users have no password.
  *
  * `current_password` is required even though the session already proves
  * identity: it is what makes a stolen *session* insufficient to take the
  * *account*. Every other session is revoked on success; the one that made the
  * change survives, because logging someone out of the tab they just used is
  * indistinguishable from the change having failed.
- *
- * Shared with the app-user surface (`POST /api/client/password/change`): the
- * argument is about credentials and sessions, not about which space the person
- * lives in.
  */
 export const passwordChangeRequest = z.object({
     current_password: z.string().min(1).meta({
@@ -386,39 +402,6 @@ export const passwordChangeRequest = z.object({
         description: 'The replacement password. Every other session is revoked when it is accepted, while the session that made the change survives — logging somebody out of the tab they just used is indistinguishable from the change having failed.',
     }),
 });
-/**
- * Asking for a reset link, **as a Fleetless user**.
- *
- * **The response never says whether the address exists.** It is unauthenticated
- * and would otherwise be an account-enumeration oracle — the one place where
- * revealing nothing about what exists is not a preference but the whole point.
- * So this answers the same way for a known and an unknown address, in
- * status, body **and timing**, and any consumer that renders "no such account"
- * from it has reintroduced the oracle.
- *
- * A bare address resolves to at most one account: a Fleetless user's email is
- * **globally unique**, so the reset mails the one match, if any, with a token
- * bound to that account.
- *
- * The app-user equivalent is `clientPasswordResetRequest` in `client-auth.ts`
- * and carries an `app_identifier`, because on that surface a person is
- * identified by app *and* address. Two shapes rather than one, because the two
- * surfaces identify a person differently — not because the reasoning differs.
- */
-export const passwordResetRequest = z.object({
-    email: z.email(),
-});
-/**
- * Using the link. The token is **single-use and expires**; spending it revokes
- * every session of that subject, because a forgotten password is one of the
- * two states where somebody else may be holding one. `token_spent` covers used
- * and expired alike — telling them apart tells a stranger whether a token ever
- * existed.
- */
-export const passwordResetConfirm = z.object({
-    token: z.string().min(1),
-    new_password: password,
-});
 /**
  * An IdP issuer URL — **an attacker-supplied string that decides where the
  * *server* connects.**
@@ -471,8 +454,8 @@ export const idpIssuer = z
  * here.** `oidcCallbackErrorCode` and `oidcCallbackError` described the page
  * `GET /mcp/oauth/idp-callback` rendered when a group's identity provider sent
  * a browser back — `jit_disabled` and `email_collision` name provisioning steps
- * only a group provider had. Fleetless users are password-only now, which deletes
- * group providers, so the flow that produced these codes cannot start; the
+ * only a group provider had. Fleetless users sign in by emailed code or
+ * passkey, with no group providers, so the flow that produced these codes cannot start; the
  * route is gone from this manifest and from the cloud.
  *
  * The per-app OIDC vocabulary is `clientOidcErrorCode` in `client-auth.ts`: a
@@ -492,7 +475,112 @@ export const idpIssuer = z
  * field required on the shape itself.
  */
 export const authMeResponse = z.object({ org, user: fleetlessUser });
-/** `PATCH /api/org` — rename the org. Owner only. Same bounds as signup's `org_name`. */
-export const patchOrgRequest = z.object({ name: z.string().min(1).max(120) }).strict();
+/**
+ * `PATCH /api/org` — rename the org, require two-factor for its members, or
+ * both. Owner only. At least one field: an empty patch is a refusal rather
+ * than a write that changed nothing.
+ */
+export const patchOrgRequest = z
+    .object({
+    name: z.string().min(1).max(120).optional().meta({
+        description: 'The organisation\'s new display name. Absent leaves it alone.',
+    }),
+    require_two_factor: z.boolean().optional().meta({
+        description: 'Whether every member must have a second factor. Turning it on signs nobody out: each member without one sets it up at their next sign-in. Absent leaves it alone.',
+    }),
+})
+    .strict()
+    .refine((b) => b.name !== undefined || b.require_two_factor !== undefined, { message: 'Send name, require_two_factor, or both.' });
 /** `PATCH /api/auth/me` — the caller updates their own display name (null clears it). */
 export const patchAuthMeRequest = z.object({ display_name: z.string().min(1).max(USER_DISPLAY_NAME_MAX).nullable() }).strict();
+/* ----------------------------------------- a developer's second factors --
+ * Settings › Profile › Security in the console. Several passkeys, at most one
+ * authenticator app, and ten recovery codes issued with the first factor.
+ * Passkeys are for Fleetless users only; app users have the authenticator.
+ */
+/**
+ * **A WebAuthn JSON document, opaque here.** The `PublicKeyCredential*JSON`
+ * shapes of the WebAuthn Level 3 specification — creation and request options
+ * going out, the browser's credential coming back. The browser API and the
+ * server library define them; a second, hand-written copy here would be one
+ * that drifts.
+ */
+export const webauthnJson = z.record(z.string(), z.unknown());
+/**
+ * **Options for a WebAuthn ceremony**, to hand to the browser as they are.
+ * The relying party is `fleetless.dev`, so the auth portal and the console
+ * both accept the same passkey; user verification is required.
+ */
+export const webauthnOptionsResponse = z.object({
+    options: webauthnJson.meta({
+        description: 'The `PublicKeyCredentialCreationOptionsJSON` or `PublicKeyCredentialRequestOptionsJSON` to pass to the browser. Its challenge is single-use and short-lived.',
+    }),
+});
+/** **One registered passkey**, as Settings › Profile lists it. No key material travels here. */
+export const developerPasskey = z.object({
+    id: z.uuid().meta({ description: 'The passkey in the API, as renamed and removed through `/api/auth/passkeys/:id`.' }),
+    name: z.string().min(1).max(80).meta({ description: 'What the person called it, such as the device it lives on.' }),
+    created_at: z.iso.datetime().meta({ description: 'When it was registered.' }),
+    last_used_at: z.iso.datetime().nullable().meta({ description: 'When it last signed the person in or confirmed a sign-in, or `null` if never.' }),
+    synced: z.boolean().nullable().meta({
+        description: 'Whether the authenticator reported the passkey as syncable across the person\'s devices (the backup-eligible flag), or `null` when it said nothing.',
+    }),
+});
+/** **`GET /api/auth/two-factor`** — the caller's own second factors, in full. */
+export const developerTwoFactor = z.object({
+    passkeys: z.array(developerPasskey).meta({ description: 'Every passkey the caller has registered, oldest first. Empty when none.' }),
+    authenticator: z
+        .object({ created_at: z.iso.datetime().meta({ description: 'When the authenticator was confirmed.' }) })
+        .nullable()
+        .meta({ description: 'The confirmed authenticator app, or `null` when there is none. At most one.' }),
+    recovery_codes_left: z.number().int().min(0).max(10).meta({
+        description: 'How many of the ten recovery codes are unspent. `0` while the caller has no second factor.',
+    }),
+    required_by_org: z.boolean().meta({
+        description: 'Whether the organisation requires a second factor. While it does, the last one cannot be removed.',
+    }),
+});
+/** **Registering a passkey**: the name, and the browser's answer to the creation options. */
+export const createPasskeyRequest = z
+    .object({
+    name: z.string().min(1).max(80).meta({ description: 'What to call the passkey, such as the device it lives on.' }),
+    credential: webauthnJson.meta({ description: 'The browser\'s `RegistrationResponseJSON` for the options `POST /api/auth/passkeys/options` answered.' }),
+})
+    .strict();
+/**
+ * **The registered passkey**, and the ten recovery codes when it is the
+ * account's first second factor — `null` otherwise, since the existing codes
+ * stay valid.
+ */
+export const createPasskeyResponse = z.object({
+    passkey: developerPasskey.meta({ description: 'The passkey as it is now stored.' }),
+    recovery_codes: recoveryCodesList.nullable().meta({
+        description: 'The ten recovery codes, shown once, when this passkey is the account\'s first second factor; `null` when the account already had one and its codes stay valid.',
+    }),
+});
+/** **Renaming a passkey.** The name is the only thing about one that can change. */
+export const renamePasskeyRequest = z
+    .object({
+    name: z.string().min(1).max(80).meta({ description: 'The new name.' }),
+})
+    .strict();
+/** **Confirming a new authenticator** with a code it shows now. */
+export const totpConfirmRequest = z
+    .object({
+    code: totpCode.meta({ description: 'A code the new authenticator shows now. It proves the secret was copied correctly before anything depends on it.' }),
+})
+    .strict();
+/**
+ * **The confirmed authenticator.** Ten recovery codes when it is the
+ * account's first second factor; `null` when it replaces an authenticator or
+ * joins passkeys, whose codes stay valid.
+ */
+export const totpConfirmResponse = z.object({
+    recovery_codes: recoveryCodesList.nullable().meta({
+        description: 'The ten recovery codes, shown once, when this is the account\'s first second factor; `null` otherwise.',
+    }),
+});
+/** **A fresh set of ten recovery codes**, shown once. The previous set stops working. */
+export const recoveryCodesResponse = z.object({
+    recovery_codes: recoveryCodesList.meta({ description: 'The ten new recovery codes, lowercase, shown once. Every earlier code is void.' }),
+});

package/dist/index.d.ts

@@ -29,25 +29,25 @@ export type { UsageMetric, OrgUsageQuery, UsageRow, OrgUsageResponse } from './r
 export type { Robot, PatchRobotResponse, CreateRobotRequest, CreateRobotResponse, RobotTokenRotateResponse, JointStatePutRequest, JointStatePutResponse, ExposureCounts, ProtocolStatusValue, RobotListItem, RobotListResponse, DatapointValue, RobotDetailResponse, ConfigDraftResponse, PutConfigDraftRequest, PublishConfigResponse, ConfigVersionsResponse, ConfigVersionResponse, IntrospectionResponse, TypesResponse, FetchTypesRequest, FetchTypesResponse, DatapointDescriptor, DatapointListResponse, RobotDetailsDoc, PutRobotDetailsResponse, PutRobotDetailsRequest, InvokeRequest, InvokeResponse, CancelRequest, ReleaseLiveQuery, ServiceCallResponse, InvokeOrServiceResponse, PublishRequest, JobResponse, RobotJobsResponse, RateLimitDetails, Exposure, ExposureListResponse, CameraDescriptor, CameraListResponse, LiveSessionResponse, SnapshotMetaResponse, } from './rest.js';
 export { clientAuth, authOk, authError, clientInvoke, clientCancel, clientPublish, commandResult, errorFrame, clientSubscribe, clientUnsubscribe, subscribeError, datapointEvent, resourceHealthEvent, resourceHealthCleared, liveSessionEndReason, liveSessionEvent, ORG_EVENT_SAMPLE_INTERVAL_MS, ORG_EVENT_ORG_CEILING_PER_SECOND, ORG_EVENT_BUFFER_SIZE, ORG_EVENT_BUFFER_IDLE_MS, ORG_EVENT_DETAIL_MAX_BYTES, orgEventKind, orgEventSeverity, orgEvent, orgEventSubscribe, orgEventUnsubscribe, orgEventReplay, orgEventDropped, } from './realtime.js';
 export type { ClientAuth, AuthOk, AuthError, ClientInvoke, ClientCancel, ClientPublish, CommandResult, ErrorFrame, ClientSubscribe, ClientUnsubscribe, SubscribeError, DatapointEvent, ResourceHealthEvent, ResourceHealthCleared, LiveSessionEndReason, LiveSessionEvent, OrgEventKind, OrgEventSeverity, OrgEvent, OrgEventSubscribe, OrgEventUnsubscribe, OrgEventReplay, OrgEventDropped, } from './realtime.js';
-export { password, org, patchOrgResponse, sessionTokens, refreshRequest, signUpRequest, signUpResponse, waitlistRequest, developerLoginRequest, USER_DISPLAY_NAME_MAX, orgAdminTier, fleetlessUser, fleetlessUserListResponse, createTeamInviteRequest, teamInvite, pendingTeamInvite, pendingTeamInviteListResponse, acceptTeamInviteRequest, patchFleetlessUserRequest, tierChangeRequest, mailStatus, tierRequiredDetails, passwordChangeRequest, passwordResetRequest, passwordResetConfirm, idpIssuer, authMeResponse, patchOrgRequest, patchAuthMeRequest, } from './identity.js';
-export type { Org, PatchOrgResponse, SessionTokens, RefreshRequest, SignUpRequest, SignUpResponse, WaitlistRequest, DeveloperLoginRequest, OrgAdminTier, FleetlessUser, FleetlessUserListResponse, CreateTeamInviteRequest, TeamInvite, PendingTeamInvite, PendingTeamInviteListResponse, AcceptTeamInviteRequest, PatchFleetlessUserRequest, TierChangeRequest, MailStatus, TierRequiredDetails, PasswordChangeRequest, PasswordResetRequest, PasswordResetConfirm, IdpIssuer, AuthMeResponse, PatchOrgRequest, PatchAuthMeRequest, } from './identity.js';
+export { password, org, patchOrgResponse, sessionTokens, refreshRequest, waitlistRequest, USER_DISPLAY_NAME_MAX, orgAdminTier, fleetlessUser, fleetlessUserListResponse, createTeamInviteRequest, teamInvite, pendingTeamInvite, pendingTeamInviteListResponse, acceptTeamInviteRequest, patchFleetlessUserRequest, tierChangeRequest, mailStatus, tierRequiredDetails, passwordChangeRequest, idpIssuer, loginCode, totpCode, recoveryCode, recoveryCodesList, twoFactorSetupResponse, webauthnJson, webauthnOptionsResponse, developerPasskey, developerTwoFactor, createPasskeyRequest, createPasskeyResponse, renamePasskeyRequest, totpConfirmRequest, totpConfirmResponse, recoveryCodesResponse, authMeResponse, patchOrgRequest, patchAuthMeRequest, } from './identity.js';
+export type { Org, PatchOrgResponse, SessionTokens, RefreshRequest, WaitlistRequest, OrgAdminTier, FleetlessUser, FleetlessUserListResponse, CreateTeamInviteRequest, TeamInvite, PendingTeamInvite, PendingTeamInviteListResponse, AcceptTeamInviteRequest, PatchFleetlessUserRequest, TierChangeRequest, MailStatus, TierRequiredDetails, PasswordChangeRequest, IdpIssuer, TwoFactorSetupResponse, WebauthnOptionsResponse, DeveloperPasskey, DeveloperTwoFactor, CreatePasskeyRequest, CreatePasskeyResponse, RenamePasskeyRequest, TotpConfirmRequest, TotpConfirmResponse, RecoveryCodesResponse, AuthMeResponse, PatchOrgRequest, PatchAuthMeRequest, } from './identity.js';
 export { appIdentifier, app, appListResponse, appDeletionSummary, createAppRequest, updateAppRequest, serverKeyToken, serverKey, serverKeyListResponse, createServerKeyResponse, role, roleListResponse, rolePermissions, } from './apps.js';
 export type { App, AppListResponse, AppDeletionSummary, CreateAppRequest, UpdateAppRequest, ServerKey, ServerKeyListResponse, CreateServerKeyResponse, Role, RoleListResponse, RolePermissions, } from './apps.js';
-export { clientLoginRequest, clientRefreshRequest, clientLogoutRequest, clientRegisterRequest, clientVerifyEmailRequest, clientResendVerificationRequest, clientPasswordResetRequest, clientPasswordResetConfirmRequest, clientAcceptInvitationRequest, CLIENT_OIDC_CALLBACK_PATH, clientProviderListQuery, clientProviderListResponse, clientOidcStartQuery, clientOidcCallbackQuery, clientOidcExchangeRequest, clientOidcErrorCode, clientMcpInteraction, clientMcpInteractionDecisionResponse, mcpConsentGrant, mcpConsentGrantListResponse, clientIdentity, } from './client-auth.js';
-export type { ClientLoginRequest, ClientRefreshRequest, ClientLogoutRequest, ClientRegisterRequest, ClientVerifyEmailRequest, ClientResendVerificationRequest, ClientPasswordResetRequest, ClientPasswordResetConfirmRequest, ClientAcceptInvitationRequest, ClientProviderListQuery, ClientProviderListResponse, ClientOidcStartQuery, ClientOidcCallbackQuery, ClientOidcExchangeRequest, ClientOidcErrorCode, ClientMcpInteraction, ClientMcpInteractionDecisionResponse, McpConsentGrant, McpConsentGrantListResponse, ClientIdentity, } from './client-auth.js';
+export { clientLoginRequest, clientRefreshRequest, clientLogoutRequest, clientRegisterRequest, clientVerifyEmailRequest, clientResendVerificationRequest, clientPasswordResetRequest, clientPasswordResetConfirmRequest, clientAcceptInvitationRequest, CLIENT_OIDC_CALLBACK_PATH, clientProviderListQuery, clientProviderListResponse, clientOidcStartQuery, clientOidcCallbackQuery, clientOidcExchangeRequest, clientOidcErrorCode, clientMcpInteraction, clientMcpInteractionDecisionResponse, mcpConsentGrant, mcpConsentGrantListResponse, clientIdentity, clientLoginCodeRequest, clientLoginCodeVerifyRequest, twoFactorChallenge, clientSignInResult, clientTwoFactorVerifyRequest, clientTwoFactorSetupRequest, clientTwoFactorSetupConfirmRequest, clientTwoFactorSetupConfirmResponse, clientTwoFactorDisableRequest, } from './client-auth.js';
+export type { ClientLoginRequest, ClientRefreshRequest, ClientLogoutRequest, ClientRegisterRequest, ClientVerifyEmailRequest, ClientResendVerificationRequest, ClientPasswordResetRequest, ClientPasswordResetConfirmRequest, ClientAcceptInvitationRequest, ClientProviderListQuery, ClientProviderListResponse, ClientOidcStartQuery, ClientOidcCallbackQuery, ClientOidcExchangeRequest, ClientOidcErrorCode, ClientMcpInteraction, ClientMcpInteractionDecisionResponse, McpConsentGrant, McpConsentGrantListResponse, ClientIdentity, ClientLoginCodeRequest, ClientLoginCodeVerifyRequest, TwoFactorChallenge, ClientSignInResult, ClientTwoFactorVerifyRequest, ClientTwoFactorSetupRequest, ClientTwoFactorSetupConfirmRequest, ClientTwoFactorSetupConfirmResponse, ClientTwoFactorDisableRequest, } from './client-auth.js';
 export { clientRobotListItem, clientRobotListResponse } from './client-robots.js';
 export type { ClientRobotListItem, ClientRobotListResponse } from './client-robots.js';
-export { APP_USER_DISPLAY_NAME_MAX, APP_URL_PLACEHOLDERS, MAIL_TEMPLATE_VARIABLES, DEFAULT_MAIL_TEMPLATES, providerSlug, appUserStatus, appUser, appUserListResponse, createAppUserRequest, patchAppUserRequest, createAppInvitationRequest, appInvitation, pendingAppInvitation, appInvitationListResponse, appOidcProvider, appOidcProviderListResponse, createAppOidcProviderRequest, patchAppOidcProviderRequest, appUrlTemplate, allowedOrigin, emailDomain, appAuthConfig, putAppAuthRegistrationRequest, putAppAuthUrlsRequest, putAppAuthMcpRequest, mailTemplateKind, appMailTemplate, appMailTemplateListResponse, putAppMailTemplateRequest, mailTemplatePreviewRequest, mailTemplatePreviewResponse, mailTemplateProblemDetails, mailOutcome, } from './app-users.js';
-export type { AppUserStatus, AppUser, AppUserListResponse, CreateAppUserRequest, PatchAppUserRequest, CreateAppInvitationRequest, AppInvitation, PendingAppInvitation, AppInvitationListResponse, AppOidcProvider, AppOidcProviderListResponse, CreateAppOidcProviderRequest, PatchAppOidcProviderRequest, AppAuthConfig, PutAppAuthRegistrationRequest, PutAppAuthUrlsRequest, PutAppAuthMcpRequest, MailTemplateKind, AppMailTemplate, AppMailTemplateListResponse, PutAppMailTemplateRequest, MailTemplatePreviewRequest, MailTemplatePreviewResponse, MailTemplateProblemDetails, MailOutcome, } from './app-users.js';
+export { APP_USER_DISPLAY_NAME_MAX, APP_URL_PLACEHOLDERS, MAIL_TEMPLATE_VARIABLES, DEFAULT_MAIL_TEMPLATES, providerSlug, appUserStatus, appUser, appUserListResponse, createAppUserRequest, patchAppUserRequest, createAppInvitationRequest, appInvitation, pendingAppInvitation, appInvitationListResponse, appOidcProvider, appOidcProviderListResponse, createAppOidcProviderRequest, patchAppOidcProviderRequest, appUrlTemplate, allowedOrigin, emailDomain, appAuthConfig, appSignInMethods, appTwoFactorPolicy, appHomeUrl, hostedAccent, HOSTED_LOGO_MAX_BYTES, HOSTED_LOGO_TYPES, appHostedPages, putAppAuthRegistrationRequest, putAppAuthSignInRequest, putAppAuthUrlsRequest, putAppAuthMcpRequest, putAppAuthLookRequest, mailTemplateKind, appMailTemplate, appMailTemplateListResponse, putAppMailTemplateRequest, mailTemplatePreviewRequest, mailTemplatePreviewResponse, mailTemplateProblemDetails, mailOutcome, } from './app-users.js';
+export type { AppUserStatus, AppUser, AppUserListResponse, CreateAppUserRequest, PatchAppUserRequest, CreateAppInvitationRequest, AppInvitation, PendingAppInvitation, AppInvitationListResponse, AppOidcProvider, AppOidcProviderListResponse, CreateAppOidcProviderRequest, PatchAppOidcProviderRequest, AppAuthConfig, AppSignInMethods, AppTwoFactorPolicy, AppHostedPages, PutAppAuthRegistrationRequest, PutAppAuthSignInRequest, PutAppAuthUrlsRequest, PutAppAuthMcpRequest, PutAppAuthLookRequest, MailTemplateKind, AppMailTemplate, AppMailTemplateListResponse, PutAppMailTemplateRequest, MailTemplatePreviewRequest, MailTemplatePreviewResponse, MailTemplateProblemDetails, MailOutcome, } from './app-users.js';
 export { assetKind, URDF_ASSET_NAME, asset, urdfCompleteness, assetListResponse, assetsClearResponse, missingAssetQuery, assetSyncRequest, assetSyncResponse, assetSyncState, assetSyncStatus, assetFailure, assetFailureKind, assetStoreRefusedDetails, assetSyncBusyDetails, ROBOT_ASSET_STORE_BYTES, } from './assets.js';
 export type { AssetKind, Asset, UrdfCompleteness, AssetListResponse, AssetsClearResponse, MissingAssetQuery, AssetSyncRequest, AssetSyncResponse, AssetSyncState, AssetSyncStatus, AssetFailure, AssetFailureKind, AssetStoreRefusedDetails, AssetSyncBusyDetails, } from './assets.js';
 export { auditActor, auditEvent, auditQuery, auditListResponse, AUDIT_CSV_COLUMNS, AUDIT_RETENTION_DAYS } from './audit.js';
 export type { AuditActor, AuditEvent, AuditQuery, AuditListResponse } from './audit.js';
 export { alertRowCondition, alertSeverity, alertState, datapointAlertRow, alertListResponse, orgFiringAlertsResponse, orgAlertsQuery, datapointDisplay, putDatapointDisplayRequest, } from './alerts.js';
 export type { AlertRowCondition, AlertSeverity, AlertState, DatapointAlertRow, AlertListResponse, OrgFiringAlertsResponse, OrgAlertsQuery, DatapointDisplay, PutDatapointDisplayRequest, } from './alerts.js';
-export { apiError, parameterViolation, parameterInvalidDetails, cancelRejectedDetails, ERROR_CODES } from './errors.js';
-export type { ApiError, ParameterViolation, ParameterInvalidDetails, CancelRejectedDetails, ErrorCode } from './errors.js';
+export { apiError, parameterViolation, parameterInvalidDetails, cancelRejectedDetails, invalidCodeDetails, ERROR_CODES } from './errors.js';
+export type { ApiError, ParameterViolation, ParameterInvalidDetails, CancelRejectedDetails, InvalidCodeDetails, ErrorCode } from './errors.js';
 export { oauthErrorCode, oauthError, oauthRedirectResponse, oauthCodeTokenRequest, oauthRefreshTokenRequest, oauthTokenRequest, oauthTokenResponse, redirectUri, codeChallengeMethod, oauthAuthorizeQuery, dynamicClientRegistrationRequest, MCP_DCR_MAX_REDIRECT_URIS, dynamicClientRegistrationResponse, authorizationServerMetadata, protectedResourceMetadata, } from './oauth.js';
 export type { OauthErrorCode, OauthError, OauthRedirectResponse, OauthCodeTokenRequest, OauthRefreshTokenRequest, OauthTokenRequest, OauthTokenResponse, RedirectUri, OauthAuthorizeQuery, DynamicClientRegistrationRequest, DynamicClientRegistrationResponse, AuthorizationServerMetadata, ProtectedResourceMetadata, } from './oauth.js';
-export { ROUTES, ROUTE_SECTIONS, IN_HANDLER_ROUTES } from './routes.js';
+export { ROUTES, ROUTE_SECTIONS, IN_HANDLER_ROUTES, developerSignInRoutes } from './routes.js';
 export type { RouteEntry, RouteParam, RouteAudience, RouteAuth, RouteSection, RouteMethod, RouteTransport, } from './routes.js';

package/dist/index.js

@@ -29,23 +29,27 @@ historyQuery, historySamplesResponse, historyBucketsResponse, historyResponse, o
 patchRobotRequest, renameSlugRequest, renameSlugResponse, slugUsageResponse, } from './rest.js';
 export { LATENCY_BUCKET_MS, BRIDGE_LATENCY_RETENTION_DAYS, MAX_LATENCY_BUCKETS_PER_RESPONSE, latencyBucket, robotLatencySeries, orgLatencyQuery, orgLatencyResponse, USAGE_WINDOW_MAX_DAYS, usageMetric, usageDay, orgUsageQuery, usageRow, orgUsageResponse, } from './rest.js';
 export { clientAuth, authOk, authError, clientInvoke, clientCancel, clientPublish, commandResult, errorFrame, clientSubscribe, clientUnsubscribe, subscribeError, datapointEvent, resourceHealthEvent, resourceHealthCleared, liveSessionEndReason, liveSessionEvent, ORG_EVENT_SAMPLE_INTERVAL_MS, ORG_EVENT_ORG_CEILING_PER_SECOND, ORG_EVENT_BUFFER_SIZE, ORG_EVENT_BUFFER_IDLE_MS, ORG_EVENT_DETAIL_MAX_BYTES, orgEventKind, orgEventSeverity, orgEvent, orgEventSubscribe, orgEventUnsubscribe, orgEventReplay, orgEventDropped, } from './realtime.js';
-export { password, org, patchOrgResponse, sessionTokens, refreshRequest, signUpRequest, signUpResponse, 
+export { password, org, patchOrgResponse, sessionTokens, refreshRequest, 
 // 2026-09-04 — the public site (closed beta).
-waitlistRequest, developerLoginRequest, 
+waitlistRequest, 
 // The two identity spaces.
 USER_DISPLAY_NAME_MAX, orgAdminTier, fleetlessUser, fleetlessUserListResponse, createTeamInviteRequest, teamInvite, pendingTeamInvite, pendingTeamInviteListResponse, acceptTeamInviteRequest, patchFleetlessUserRequest, tierChangeRequest, 
 // Identity.
-mailStatus, tierRequiredDetails, passwordChangeRequest, passwordResetRequest, passwordResetConfirm, idpIssuer, 
+mailStatus, tierRequiredDetails, passwordChangeRequest, idpIssuer, 
+// Codes and second factors, shared by both identity spaces.
+loginCode, totpCode, recoveryCode, recoveryCodesList, twoFactorSetupResponse, 
+// A developer's second factors.
+webauthnJson, webauthnOptionsResponse, developerPasskey, developerTwoFactor, createPasskeyRequest, createPasskeyResponse, renamePasskeyRequest, totpConfirmRequest, totpConfirmResponse, recoveryCodesResponse, 
 // auth/me, org and member patches.
 authMeResponse, patchOrgRequest, patchAuthMeRequest, } from './identity.js';
 export { appIdentifier, app, appListResponse, appDeletionSummary, createAppRequest, updateAppRequest, serverKeyToken, serverKey, serverKeyListResponse, createServerKeyResponse, role, roleListResponse, rolePermissions, } from './apps.js';
-export { clientLoginRequest, clientRefreshRequest, clientLogoutRequest, clientRegisterRequest, clientVerifyEmailRequest, clientResendVerificationRequest, clientPasswordResetRequest, clientPasswordResetConfirmRequest, clientAcceptInvitationRequest, CLIENT_OIDC_CALLBACK_PATH, clientProviderListQuery, clientProviderListResponse, clientOidcStartQuery, clientOidcCallbackQuery, clientOidcExchangeRequest, clientOidcErrorCode, clientMcpInteraction, clientMcpInteractionDecisionResponse, mcpConsentGrant, mcpConsentGrantListResponse, clientIdentity, } from './client-auth.js';
+export { clientLoginRequest, clientRefreshRequest, clientLogoutRequest, clientRegisterRequest, clientVerifyEmailRequest, clientResendVerificationRequest, clientPasswordResetRequest, clientPasswordResetConfirmRequest, clientAcceptInvitationRequest, CLIENT_OIDC_CALLBACK_PATH, clientProviderListQuery, clientProviderListResponse, clientOidcStartQuery, clientOidcCallbackQuery, clientOidcExchangeRequest, clientOidcErrorCode, clientMcpInteraction, clientMcpInteractionDecisionResponse, mcpConsentGrant, mcpConsentGrantListResponse, clientIdentity, clientLoginCodeRequest, clientLoginCodeVerifyRequest, twoFactorChallenge, clientSignInResult, clientTwoFactorVerifyRequest, clientTwoFactorSetupRequest, clientTwoFactorSetupConfirmRequest, clientTwoFactorSetupConfirmResponse, clientTwoFactorDisableRequest, } from './client-auth.js';
 export { clientRobotListItem, clientRobotListResponse } from './client-robots.js';
 // The per-app identity space.
-export { APP_USER_DISPLAY_NAME_MAX, APP_URL_PLACEHOLDERS, MAIL_TEMPLATE_VARIABLES, DEFAULT_MAIL_TEMPLATES, providerSlug, appUserStatus, appUser, appUserListResponse, createAppUserRequest, patchAppUserRequest, createAppInvitationRequest, appInvitation, pendingAppInvitation, appInvitationListResponse, appOidcProvider, appOidcProviderListResponse, createAppOidcProviderRequest, patchAppOidcProviderRequest, appUrlTemplate, allowedOrigin, emailDomain, appAuthConfig, putAppAuthRegistrationRequest, putAppAuthUrlsRequest, putAppAuthMcpRequest, mailTemplateKind, appMailTemplate, appMailTemplateListResponse, putAppMailTemplateRequest, mailTemplatePreviewRequest, mailTemplatePreviewResponse, mailTemplateProblemDetails, mailOutcome, } from './app-users.js';
+export { APP_USER_DISPLAY_NAME_MAX, APP_URL_PLACEHOLDERS, MAIL_TEMPLATE_VARIABLES, DEFAULT_MAIL_TEMPLATES, providerSlug, appUserStatus, appUser, appUserListResponse, createAppUserRequest, patchAppUserRequest, createAppInvitationRequest, appInvitation, pendingAppInvitation, appInvitationListResponse, appOidcProvider, appOidcProviderListResponse, createAppOidcProviderRequest, patchAppOidcProviderRequest, appUrlTemplate, allowedOrigin, emailDomain, appAuthConfig, appSignInMethods, appTwoFactorPolicy, appHomeUrl, hostedAccent, HOSTED_LOGO_MAX_BYTES, HOSTED_LOGO_TYPES, appHostedPages, putAppAuthRegistrationRequest, putAppAuthSignInRequest, putAppAuthUrlsRequest, putAppAuthMcpRequest, putAppAuthLookRequest, mailTemplateKind, appMailTemplate, appMailTemplateListResponse, putAppMailTemplateRequest, mailTemplatePreviewRequest, mailTemplatePreviewResponse, mailTemplateProblemDetails, mailOutcome, } from './app-users.js';
 export { assetKind, URDF_ASSET_NAME, asset, urdfCompleteness, assetListResponse, assetsClearResponse, missingAssetQuery, assetSyncRequest, assetSyncResponse, assetSyncState, assetSyncStatus, assetFailure, assetFailureKind, assetStoreRefusedDetails, assetSyncBusyDetails, ROBOT_ASSET_STORE_BYTES, } from './assets.js';
 export { auditActor, auditEvent, auditQuery, auditListResponse, AUDIT_CSV_COLUMNS, AUDIT_RETENTION_DAYS } from './audit.js';
 export { alertRowCondition, alertSeverity, alertState, datapointAlertRow, alertListResponse, orgFiringAlertsResponse, orgAlertsQuery, datapointDisplay, putDatapointDisplayRequest, } from './alerts.js';
-export { apiError, parameterViolation, parameterInvalidDetails, cancelRejectedDetails, ERROR_CODES } from './errors.js';
+export { apiError, parameterViolation, parameterInvalidDetails, cancelRejectedDetails, invalidCodeDetails, ERROR_CODES } from './errors.js';
 export { oauthErrorCode, oauthError, oauthRedirectResponse, oauthCodeTokenRequest, oauthRefreshTokenRequest, oauthTokenRequest, oauthTokenResponse, redirectUri, codeChallengeMethod, oauthAuthorizeQuery, dynamicClientRegistrationRequest, MCP_DCR_MAX_REDIRECT_URIS, dynamicClientRegistrationResponse, authorizationServerMetadata, protectedResourceMetadata, } from './oauth.js';
-export { ROUTES, ROUTE_SECTIONS, IN_HANDLER_ROUTES } from './routes.js';
+export { ROUTES, ROUTE_SECTIONS, IN_HANDLER_ROUTES, developerSignInRoutes } from './routes.js';

package/dist/protocol.d.ts

@@ -559,9 +559,9 @@ export declare const cloudConfig: z.ZodObject<{
         }, z.core.$strict>>>;
         low_bandwidth: z.ZodOptional<z.ZodObject<{
             mode: z.ZodOptional<z.ZodEnum<{
+                off: "off";
                 auto: "auto";
                 on: "on";
-                off: "off";
             }>>;
             enter_lag_ms: z.ZodOptional<z.ZodNumber>;
             enter_after_s: z.ZodOptional<z.ZodNumber>;

package/dist/realtime.d.ts

@@ -41,6 +41,7 @@ export declare const authOk: z.ZodObject<{
         app_id: z.ZodNullable<z.ZodUUID>;
         role_id: z.ZodNullable<z.ZodUUID>;
         email: z.ZodNullable<z.ZodEmail>;
+        two_factor_enabled: z.ZodNullable<z.ZodBoolean>;
     }, z.core.$strip>;
 }, z.core.$strip>;
 export type AuthOk = z.infer<typeof authOk>;

package/dist/rest.d.ts

@@ -444,9 +444,9 @@ export declare const configDraftResponse: z.ZodObject<{
         }, z.core.$strict>>>;
         low_bandwidth: z.ZodOptional<z.ZodObject<{
             mode: z.ZodOptional<z.ZodEnum<{
+                off: "off";
                 auto: "auto";
                 on: "on";
-                off: "off";
             }>>;
             enter_lag_ms: z.ZodOptional<z.ZodNumber>;
             enter_after_s: z.ZodOptional<z.ZodNumber>;
@@ -698,9 +698,9 @@ export declare const configVersionResponse: z.ZodObject<{
         }, z.core.$strict>>>;
         low_bandwidth: z.ZodOptional<z.ZodObject<{
             mode: z.ZodOptional<z.ZodEnum<{
+                off: "off";
                 auto: "auto";
                 on: "on";
-                off: "off";
             }>>;
             enter_lag_ms: z.ZodOptional<z.ZodNumber>;
             enter_after_s: z.ZodOptional<z.ZodNumber>;

package/dist/rest.js

@@ -567,23 +567,17 @@ export const jobResponse = z.object({
  * There are no compatibility aliases, because an alias here is how a deleted
  * model survives in production while the contract says otherwise.
  *
- * **`POST /api/auth/password/reset` answers `202` for every well-formed
- * address**, known or not. It is the one route where saying nothing about
- * whether an account exists is not a preference but the entire point: any
- * status, body or timing difference between the two cases is an
+ * **Every route that mails a code or a link answers the same for a known and
+ * an unknown address** — the portal's identify step, `POST
+ * /api/client/login/code`, `POST /api/client/password/reset`. Saying nothing
+ * about whether an account exists is not a preference there but the entire
+ * point: any status, body or timing difference between the two cases is an
  * account-enumeration oracle. Note *timing* — a route that only sends mail for
- * a real address must not become measurably faster for an unknown one. Email is
- * **globally unique**, so a bare address names at most one account and the
- * route mails the one match, if any. See `passwordResetRequest`.
- *
- * **Both surfaces get the password routes, mirrored.** An end user and a
- * console user each need a way to change and to reset a password.
- * `passwordChangeRequest` is shared because the operation is identical; the
- * **prefix** is what says
- * which session is being spent, exactly as it does for `login`. The two *reset*
- * requests are separate shapes rather than one, because the surfaces identify a
- * person differently: a Fleetless user by a globally unique address, an app
- * user by app **and** address.
+ * a real address must not become measurably faster for an unknown one.
+ *
+ * **Only app users hold a password.** Fleetless users sign in by emailed code
+ * or passkey, so the password change and reset routes are the app user's
+ * alone, under `/api/client`.
  *
  * **A password change answers with fresh `sessionTokens`, not `204`.** The
  * promise is that the session which made the change survives while every other
@@ -611,20 +605,15 @@ export const jobResponse = z.object({
  *
  * | purpose | URL |
  * |---|---|
- * | password reset, Fleetless user | `{portal}/reset-password/{token}` |
  * | team invitation                | `{portal}/accept-invite/{token}` |
  *
- * **An app user's links are not in this table, and cannot be** (2026-09-05,
- * Fleetless renders an app user no page, so there is no `{portal}` path
- * to name: the link points into the **developer's own app**, at the template
- * they configured (`appAuthConfig.invite_url`, `verify_url`, `reset_url`), with
- * the token substituted for `{token}`. That is why those fields are validated
- * as templates rather than as URLs, and why an app with none configured is
- * refused a `send_mail` instead of being mailed a link to nowhere.
- *
- * The paragraph this replaces said an app-user reset *"is a feature to design,
- * not a row to restore"*. It was designed; the answer was that the row belongs
- * to the developer and not to this table.
+ * **An app user's links point into the developer's own app** where it has
+ * configured one — the template in `appAuthConfig.invite_url`, `verify_url` or
+ * `reset_url`, with the token substituted for `{token}`. That is why those
+ * fields are validated as templates rather than as URLs. Where the app has
+ * configured none, the link points at the Fleetless-hosted page the cloud
+ * reports in `appAuthConfig.hosted_pages` (`{portal}/app/<identifier>/…`), so
+ * no mail is refused for a missing URL.
  *
  * The strings themselves live server-side, read by the
  * route that serves each page AND by the builder that mails it — one constant,