@fleetless/contracts 5.3.0-next.1 → 6.0.0-next.2

package/artifacts/schema/org.schema.json

@@ -14,6 +14,10 @@
       "maxLength": 120,
       "description": "The organisation's display name. Free text, changed through `PATCH /api/org`."
     },
+    "require_two_factor": {
+      "type": "boolean",
+      "description": "Whether every member must have a second factor — a passkey or an authenticator app. A member without one sets it up at their next sign-in, before any session exists; nobody is signed out when it is switched on. It covers the console and the central MCP endpoint; server keys and robot bridges are not people and are not affected. Owners change it through `PATCH /api/org`."
+    },
     "created_at": {
       "type": "string",
       "format": "date-time",
@@ -24,6 +28,7 @@
   "required": [
     "id",
     "name",
+    "require_two_factor",
     "created_at"
   ],
   "additionalProperties": false

package/artifacts/schema/patch-org-request.schema.json

@@ -3,13 +3,15 @@
   "type": "object",
   "properties": {
     "name": {
+      "description": "The organisation's new display name. Absent leaves it alone.",
       "type": "string",
       "minLength": 1,
       "maxLength": 120
+    },
+    "require_two_factor": {
+      "description": "Whether every member must have a second factor. Turning it on signs nobody out: each member without one sets it up at their next sign-in. Absent leaves it alone.",
+      "type": "boolean"
     }
   },
-  "required": [
-    "name"
-  ],
   "additionalProperties": false
 }

package/artifacts/schema/patch-org-response.schema.json

@@ -17,6 +17,10 @@
           "maxLength": 120,
           "description": "The organisation's display name. Free text, changed through `PATCH /api/org`."
         },
+        "require_two_factor": {
+          "type": "boolean",
+          "description": "Whether every member must have a second factor — a passkey or an authenticator app. A member without one sets it up at their next sign-in, before any session exists; nobody is signed out when it is switched on. It covers the console and the central MCP endpoint; server keys and robot bridges are not people and are not affected. Owners change it through `PATCH /api/org`."
+        },
         "created_at": {
           "type": "string",
           "format": "date-time",
@@ -27,6 +31,7 @@
       "required": [
         "id",
         "name",
+        "require_two_factor",
         "created_at"
       ],
       "additionalProperties": false,

package/artifacts/schema/put-app-auth-look-request.schema.json

@@ -0,0 +1,22 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "hosted_accent": {
+      "anyOf": [
+        {
+          "type": "string",
+          "pattern": "^#[0-9a-f]{6}$"
+        },
+        {
+          "type": "null"
+        }
+      ],
+      "description": "The accent colour of the hosted pages, `#rrggbb` in lowercase, or `null` for the neutral shell's own."
+    }
+  },
+  "required": [
+    "hosted_accent"
+  ],
+  "additionalProperties": false
+}

package/artifacts/schema/put-app-auth-mcp-request.schema.json

@@ -5,23 +5,10 @@
     "mcp_enabled": {
       "type": "boolean",
       "description": "Whether this app serves an MCP endpoint at `/mcp/<identifier>`. Off refuses the whole OAuth surface for the app, not merely the tool calls, and is re-read on every request rather than cached off a token."
-    },
-    "mcp_login_url": {
-      "anyOf": [
-        {
-          "type": "string",
-          "maxLength": 500
-        },
-        {
-          "type": "null"
-        }
-      ],
-      "description": "The page an MCP authorization redirects to, with `{interaction}` where the interaction id goes. Not a token: the id names a pending request the server already holds, and the app authenticates the user itself before approving it."
     }
   },
   "required": [
-    "mcp_enabled",
-    "mcp_login_url"
+    "mcp_enabled"
   ],
   "additionalProperties": false
 }

package/artifacts/schema/put-app-auth-sign-in-request.schema.json

@@ -0,0 +1,39 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "sign_in_methods": {
+      "type": "object",
+      "properties": {
+        "password": {
+          "type": "boolean",
+          "description": "Whether app users may sign in with a password. Off refuses `POST /api/client/login` with `method_not_allowed`, and registration and invitations then take no password."
+        },
+        "email_code": {
+          "type": "boolean",
+          "description": "Whether app users may sign in with a six-digit code mailed to them, valid ten minutes. A code needs no URL, so it works in local development and in an app with no web UI."
+        }
+      },
+      "required": [
+        "password",
+        "email_code"
+      ],
+      "additionalProperties": false,
+      "description": "Which sign-in methods the app offers: password, emailed code, or both — at least one. Identity providers stay on top of either. The default is password only."
+    },
+    "two_factor": {
+      "type": "string",
+      "enum": [
+        "off",
+        "optional",
+        "required"
+      ],
+      "description": "Whether the app asks for an authenticator code: `off` (the default), `optional` or `required`. A person with a confirmed authenticator is asked at every sign-in whatever the policy; a sign-in through an identity provider is never asked."
+    }
+  },
+  "required": [
+    "sign_in_methods",
+    "two_factor"
+  ],
+  "additionalProperties": false
+}

package/artifacts/schema/put-app-auth-urls-request.schema.json

@@ -2,6 +2,19 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "type": "object",
   "properties": {
+    "app_url": {
+      "anyOf": [
+        {
+          "type": "string",
+          "maxLength": 500,
+          "format": "uri"
+        },
+        {
+          "type": "null"
+        }
+      ],
+      "description": "The app's own home page, linked as `Open <app>` when a hosted flow is done. `null` makes the hosted done page say `You can close this tab`."
+    },
     "invite_url": {
       "anyOf": [
         {
@@ -12,7 +25,7 @@
           "type": "null"
         }
       ],
-      "description": "The page in the developer's app that accepts an invitation, with `{token}` where the token goes. `null` when unconfigured, and then an invitation still issues but `send_mail` is refused with `409 target_state_conflict` — there would be nowhere for the link to point."
+      "description": "The page in the developer's app that accepts an invitation, with `{token}` where the token goes. `null` means the hosted page in `hosted_pages` is used."
     },
     "verify_url": {
       "anyOf": [
@@ -24,7 +37,7 @@
           "type": "null"
         }
       ],
-      "description": "The page that confirms a new address, with `{token}` where the token goes. Self-registration needs it: without a page to send people to, a registration would leave an account nobody can activate."
+      "description": "The page that confirms a new address, with `{token}` where the token goes. `null` means the hosted page in `hosted_pages` is used."
     },
     "reset_url": {
       "anyOf": [
@@ -36,13 +49,27 @@
           "type": "null"
         }
       ],
-      "description": "The page that takes a new password, with `{token}` where the token goes."
+      "description": "The page that takes a new password, with `{token}` where the token goes. `null` means the hosted page in `hosted_pages` is used."
+    },
+    "mcp_login_url": {
+      "anyOf": [
+        {
+          "type": "string",
+          "maxLength": 500
+        },
+        {
+          "type": "null"
+        }
+      ],
+      "description": "The page an MCP authorization redirects to, with `{interaction}` where the interaction id goes. Not a token: the id names a pending request the server already holds, and the app authenticates the user itself before approving it. `null` means the hosted MCP sign-in in `hosted_pages` is used."
     }
   },
   "required": [
+    "app_url",
     "invite_url",
     "verify_url",
-    "reset_url"
+    "reset_url",
+    "mcp_login_url"
   ],
   "additionalProperties": false
 }

package/artifacts/schema/recovery-codes-response.schema.json

@@ -0,0 +1,20 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "recovery_codes": {
+      "minItems": 10,
+      "maxItems": 10,
+      "type": "array",
+      "items": {
+        "type": "string",
+        "pattern": "^[a-z2-7]{5}-[a-z2-7]{5}$"
+      },
+      "description": "The ten new recovery codes, lowercase, shown once. Every earlier code is void."
+    }
+  },
+  "required": [
+    "recovery_codes"
+  ],
+  "additionalProperties": false
+}

package/artifacts/schema/{role-rename-request.schema.json → rename-passkey-request.schema.json}

@@ -5,8 +5,8 @@
     "name": {
       "type": "string",
       "minLength": 1,
-      "maxLength": 60,
-      "description": "The new name, trimmed, 1 to 60 characters. Unique per app: another role of this app with the same name answers `409 role_name_taken`. The role's users keep it under its new name."
+      "maxLength": 80,
+      "description": "The new name."
     }
   },
   "required": [

package/artifacts/schema/role-list-response.schema.json

@@ -27,7 +27,7 @@
           },
           "builtin": {
             "type": "boolean",
-            "description": "`true` for the two roles every app starts with. Their **rights may be re-scoped** exactly like a custom role's, through `PUT /api/apps/:id/roles/:roleId/permissions` — the flag exists so the console can explain where they came from, not to protect them. Built-in roles can be renamed and deleted like any other; the flag only records that the cloud seeded them."
+            "description": "`true` for the two roles every app starts with. Their **rights may be re-scoped** exactly like a custom role's, through `PUT /api/apps/:id/roles/:roleId/permissions` — the flag exists so the console can explain where they came from, not to protect them. It does not make them renamable or deletable — no route does that for any role."
           }
         },
         "required": [

package/artifacts/schema/role.schema.json

@@ -22,7 +22,7 @@
     },
     "builtin": {
       "type": "boolean",
-      "description": "`true` for the two roles every app starts with. Their **rights may be re-scoped** exactly like a custom role's, through `PUT /api/apps/:id/roles/:roleId/permissions` — the flag exists so the console can explain where they came from, not to protect them. Built-in roles can be renamed and deleted like any other; the flag only records that the cloud seeded them."
+      "description": "`true` for the two roles every app starts with. Their **rights may be re-scoped** exactly like a custom role's, through `PUT /api/apps/:id/roles/:roleId/permissions` — the flag exists so the console can explain where they came from, not to protect them. It does not make them renamable or deletable — no route does that for any role."
     }
   },
   "required": [

package/artifacts/schema/totp-confirm-request.schema.json

@@ -0,0 +1,15 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "code": {
+      "type": "string",
+      "pattern": "^\\d{6}$",
+      "description": "A code the new authenticator shows now. It proves the secret was copied correctly before anything depends on it."
+    }
+  },
+  "required": [
+    "code"
+  ],
+  "additionalProperties": false
+}

package/artifacts/schema/totp-confirm-response.schema.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "recovery_codes": {
+      "anyOf": [
+        {
+          "minItems": 10,
+          "maxItems": 10,
+          "type": "array",
+          "items": {
+            "type": "string",
+            "pattern": "^[a-z2-7]{5}-[a-z2-7]{5}$"
+          }
+        },
+        {
+          "type": "null"
+        }
+      ],
+      "description": "The ten recovery codes, shown once, when this is the account's first second factor; `null` otherwise."
+    }
+  },
+  "required": [
+    "recovery_codes"
+  ],
+  "additionalProperties": false
+}

package/artifacts/schema/two-factor-challenge.schema.json

@@ -0,0 +1,24 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "status": {
+      "type": "string",
+      "enum": [
+        "two_factor_required",
+        "two_factor_setup_required"
+      ],
+      "description": "`two_factor_required`: ask for the authenticator code. `two_factor_setup_required`: the app requires two-factor and the person has none yet, so set one up before any session exists."
+    },
+    "challenge": {
+      "type": "string",
+      "minLength": 1,
+      "description": "The handle the next step spends. Valid five minutes; afterwards it answers `410 token_spent` and the sign-in starts over."
+    }
+  },
+  "required": [
+    "status",
+    "challenge"
+  ],
+  "additionalProperties": false
+}

package/artifacts/schema/two-factor-setup-response.schema.json

@@ -0,0 +1,21 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "secret": {
+      "type": "string",
+      "minLength": 1,
+      "description": "The shared secret, base32, for an authenticator app that cannot scan a QR code. Shown once; the cloud stores it encrypted."
+    },
+    "otpauth_url": {
+      "type": "string",
+      "pattern": "^otpauth:\\/\\/totp\\/.*",
+      "description": "The same secret as an `otpauth://totp/` URL, to render as a QR code. It carries the secret: never log it."
+    }
+  },
+  "required": [
+    "secret",
+    "otpauth_url"
+  ],
+  "additionalProperties": false
+}

package/artifacts/schema/webauthn-options-response.schema.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "options": {
+      "type": "object",
+      "propertyNames": {
+        "type": "string"
+      },
+      "additionalProperties": {},
+      "description": "The `PublicKeyCredentialCreationOptionsJSON` or `PublicKeyCredentialRequestOptionsJSON` to pass to the browser. Its challenge is single-use and short-lived."
+    }
+  },
+  "required": [
+    "options"
+  ],
+  "additionalProperties": false
+}