@fleetless/contracts 6.0.0-next.1 → 6.0.0-next.3

package/dist/apps.d.ts

@@ -151,8 +151,9 @@ export declare const createServerKeyResponse: z.ZodObject<{
 export type CreateServerKeyResponse = z.infer<typeof createServerKeyResponse>;
 /**
  * Every app starts with `observe` and `operate`; custom roles are allowed
- * too. `builtin` marks the two starting roles — editable like any other,
- * the flag only tells the console where they came from.
+ * too. `builtin` marks the two starting roles — editable, renamable and
+ * deletable like any other; the flag only tells the console where they came
+ * from.
  */
 export declare const role: z.ZodObject<{
     id: z.ZodUUID;
@@ -171,6 +172,41 @@ export declare const roleListResponse: z.ZodObject<{
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type RoleListResponse = z.infer<typeof roleListResponse>;
+/**
+ * The body of `PATCH /api/apps/:id/roles/:roleId`: the role's new name.
+ *
+ * The same bounds as `role.name`, trimmed. Names are unique per app, compared
+ * exactly as stored after trimming; a clash answers `409 role_name_taken`.
+ */
+export declare const roleRenameRequest: z.ZodObject<{
+    name: z.ZodString;
+}, z.core.$strict>;
+export type RoleRenameRequest = z.infer<typeof roleRenameRequest>;
+/**
+ * The query of `DELETE /api/apps/:id/roles/:roleId`.
+ *
+ * `move_to` is what makes a held role deletable: every app user and pending
+ * invitation holding the role moves to it, and so does the app's default when
+ * it pointed at the role, in the same transaction as the delete. Without it a
+ * held role answers `409 role_in_use` with `roleInUseDetails`, so a client
+ * can ask where they should go instead of guessing.
+ */
+export declare const roleDeleteQuery: z.ZodObject<{
+    move_to: z.ZodOptional<z.ZodUUID>;
+}, z.core.$strict>;
+export type RoleDeleteQuery = z.infer<typeof roleDeleteQuery>;
+/**
+ * `details` of `409 role_in_use`: what still holds the role.
+ *
+ * All three are reported, zeros included, so a client renders one sentence
+ * from one shape rather than inferring a missing key.
+ */
+export declare const roleInUseDetails: z.ZodObject<{
+    users: z.ZodNumber;
+    invitations: z.ZodNumber;
+    is_default: z.ZodBoolean;
+}, z.core.$strict>;
+export type RoleInUseDetails = z.infer<typeof roleInUseDetails>;
 /**
  * The rights matrix of one role: which slugs of which robot it may use, plus
  * the capabilities roles also govern. `capabilities`' own doc comment

package/dist/apps.js

@@ -206,8 +206,9 @@ export const createServerKeyResponse = z.object({
 });
 /**
  * Every app starts with `observe` and `operate`; custom roles are allowed
- * too. `builtin` marks the two starting roles — editable like any other,
- * the flag only tells the console where they came from.
+ * too. `builtin` marks the two starting roles — editable, renamable and
+ * deletable like any other; the flag only tells the console where they came
+ * from.
  */
 export const role = z.object({
     id: z.uuid().meta({
@@ -220,7 +221,7 @@ export const role = z.object({
         description: 'The role\'s name, shown wherever a user\'s access is chosen. The two roles every app starts with are named `observe` and `operate`.',
     }),
     builtin: z.boolean().meta({
-        description: '`true` for the two roles every app starts with. Their **rights may be re-scoped** exactly like a custom role\'s, through `PUT /api/apps/:id/roles/:roleId/permissions` — the flag exists so the console can explain where they came from, not to protect them. It does not make them renamable or deletable — no route does that for any role.',
+        description: '`true` for the two roles every app starts with. Their **rights may be re-scoped** exactly like a custom role\'s, through `PUT /api/apps/:id/roles/:roleId/permissions` — the flag exists so the console can explain where they came from, not to protect them. Built-in roles can be renamed and deleted like any other; the flag only records that the cloud seeded them.',
     }),
 });
 /** What `GET /api/apps/:id/roles` answers: the app's roles, builtin and custom alike. */
@@ -229,6 +230,48 @@ export const roleListResponse = z.object({
         description: 'The app\'s roles, built-in and custom alike, ordered by `created_at` and then by `name`. The tie-break is not cosmetic — the two built-in roles are inserted in one statement and share a creation time to the microsecond, so never read a role by position.',
     }),
 });
+/**
+ * The body of `PATCH /api/apps/:id/roles/:roleId`: the role's new name.
+ *
+ * The same bounds as `role.name`, trimmed. Names are unique per app, compared
+ * exactly as stored after trimming; a clash answers `409 role_name_taken`.
+ */
+export const roleRenameRequest = z.object({
+    name: z.string().trim().min(1).max(60).meta({
+        description: 'The new name, trimmed, 1 to 60 characters. Unique per app: another role of this app with the same name answers `409 role_name_taken`. The role\'s users keep it under its new name.',
+    }),
+}).strict();
+/**
+ * The query of `DELETE /api/apps/:id/roles/:roleId`.
+ *
+ * `move_to` is what makes a held role deletable: every app user and pending
+ * invitation holding the role moves to it, and so does the app's default when
+ * it pointed at the role, in the same transaction as the delete. Without it a
+ * held role answers `409 role_in_use` with `roleInUseDetails`, so a client
+ * can ask where they should go instead of guessing.
+ */
+export const roleDeleteQuery = z.object({
+    move_to: z.uuid().optional().meta({
+        description: 'Another role of the same app that takes over the deleted role\'s app users, pending invitations and, when it applies, the app\'s default. The role itself or a role of another app answers `400 validation_error`.',
+    }),
+}).strict();
+/**
+ * `details` of `409 role_in_use`: what still holds the role.
+ *
+ * All three are reported, zeros included, so a client renders one sentence
+ * from one shape rather than inferring a missing key.
+ */
+export const roleInUseDetails = z.object({
+    users: z.number().int().nonnegative().meta({
+        description: 'App users whose role this is.',
+    }),
+    invitations: z.number().int().nonnegative().meta({
+        description: 'Pending invitations that would grant this role when accepted.',
+    }),
+    is_default: z.boolean().meta({
+        description: '`true` when this is the app\'s `default_role_id`; the default then moves with the users to `move_to`.',
+    }),
+}).strict();
 /**
  * The rights matrix of one role: which slugs of which robot it may use, plus
  * the capabilities roles also govern. `capabilities`' own doc comment

package/dist/audit.d.ts

@@ -72,6 +72,7 @@ export declare const auditQuery: z.ZodObject<{
     action_prefix: z.ZodOptional<z.ZodString>;
     actor_id: z.ZodOptional<z.ZodUUID>;
     target_kind: z.ZodOptional<z.ZodString>;
+    target_id: z.ZodOptional<z.ZodString>;
     from_ms: z.ZodOptional<z.ZodPipe<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodTransform<number, string | number>>, z.ZodNumber>>;
     to_ms: z.ZodOptional<z.ZodPipe<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodTransform<number, string | number>>, z.ZodNumber>>;
 }, z.core.$strict>;

package/dist/audit.js

@@ -155,6 +155,19 @@ export const auditQuery = z.object({
     actor_id: z.uuid().optional(),
     /** Only events about this kind of target, e.g. `robot`. */
     target_kind: z.string().min(1).max(40).optional(),
+    /**
+     * Only events about this target — and, for a robot, also the events that
+     * name it in `details.robot_id`, so a robot's log includes what was
+     * started on it.
+     *
+     * **A string, not `z.uuid()`**, unlike `actor_id` above: `target.id` is a
+     * string in this contract and text in the cloud's table, so a uuid rule
+     * here would refuse ids the log can hold, and no value can fail a cast.
+     */
+    target_id: z.string().min(1).max(200).optional().meta({
+        description: 'Events whose target is this id; for a robot also the events that name it in `details.robot_id` (`action.invoked`, ' +
+            '`service.called`, …), so a robot\'s events include what was started on it.',
+    }),
     /**
      * Absolute bounds in unix milliseconds, **half-open `[from, to)`** — the
      * same rule the history shapes follow.

package/dist/errors.d.ts

@@ -77,5 +77,5 @@ export type InvalidCodeDetails = z.infer<typeof invalidCodeDetails>;
  * list is the shared vocabulary, not a closed set, so a new refusal never
  * needs a contracts release before it can be reported honestly.
  */
-export declare const ERROR_CODES: readonly ["not_found", "validation_error", "bad_request", "unknown_datapoint", "invalid_token", "protocol_mismatch", "bridge_too_old", "invalid_frame", "duplicate_slug", "reserved_slug", "unknown_slug", "unknown_field_path", "unknown_type", "unknown_topic", "invalid_rate", "invalid_range", "config_conflict", "no_data", "robot_offline", "bridge_timeout", "unauthorized", "forbidden", "invalid_credentials", "token_expired", "token_revoked", "email_taken", "identifier_taken", "weak_password", "account_blocked", "busy", "parameter_invalid", "cancel_rejected", "job_lost", "job_unknown_to_bridge", "action_server_lost", "action_failed", "goal_rejected", "goal_send_failed", "result_failed", "goal_uncontrollable", "bridge_disconnected", "config_changed", "publisher_busy", "unknown_command", "not_subscribable", "camera_offline", "no_snapshot_yet", "live_unavailable", "wrong_kind", "not_recorded", "not_aggregatable", "quota_exceeded", "credential_in_use", "goal_timeout", "robot_in_use", "robot_deletion_partial", "job_queue_full", "invalid_uuid", "rate_limited", "tier_required", "token_spent", "service_timeout", "asset_missing", "dynamic_registration_disabled", "client_limit_reached", "idp_unavailable", "mcp_disabled", "tool_not_available", "capability_required", "last_owner", "target_state_conflict", "signup_closed", "draft_not_a_document", "internal_error", "not_cancellable", "unsupported_media_type", "wrong_browser", "invalid_yaml", "unstorable_yaml", "registration_closed", "domain_not_allowed", "email_unverified", "origin_not_allowed", "template_invalid", "provider_disabled", "provider_misconfigured", "invalid_redirect_uri", "interaction_expired", "invalid_code", "method_not_allowed"];
+export declare const ERROR_CODES: readonly ["not_found", "validation_error", "bad_request", "unknown_datapoint", "invalid_token", "protocol_mismatch", "bridge_too_old", "invalid_frame", "duplicate_slug", "reserved_slug", "unknown_slug", "unknown_field_path", "unknown_type", "unknown_topic", "invalid_rate", "invalid_range", "config_conflict", "no_data", "robot_offline", "bridge_timeout", "unauthorized", "forbidden", "invalid_credentials", "token_expired", "token_revoked", "email_taken", "identifier_taken", "weak_password", "account_blocked", "busy", "parameter_invalid", "cancel_rejected", "job_lost", "job_unknown_to_bridge", "action_server_lost", "action_failed", "goal_rejected", "goal_send_failed", "result_failed", "goal_uncontrollable", "bridge_disconnected", "config_changed", "publisher_busy", "unknown_command", "not_subscribable", "camera_offline", "no_snapshot_yet", "live_unavailable", "wrong_kind", "not_recorded", "not_aggregatable", "quota_exceeded", "credential_in_use", "goal_timeout", "robot_in_use", "robot_deletion_partial", "job_queue_full", "invalid_uuid", "rate_limited", "tier_required", "token_spent", "service_timeout", "asset_missing", "dynamic_registration_disabled", "client_limit_reached", "idp_unavailable", "mcp_disabled", "tool_not_available", "capability_required", "last_owner", "role_name_taken", "role_in_use", "last_role", "target_state_conflict", "signup_closed", "draft_not_a_document", "internal_error", "not_cancellable", "unsupported_media_type", "wrong_browser", "invalid_yaml", "unstorable_yaml", "registration_closed", "domain_not_allowed", "email_unverified", "origin_not_allowed", "template_invalid", "provider_disabled", "provider_misconfigured", "invalid_redirect_uri", "interaction_expired", "invalid_code", "method_not_allowed"];
 export type ErrorCode = (typeof ERROR_CODES)[number];

package/dist/errors.js

@@ -576,6 +576,35 @@ export const ERROR_CODES = [
      * caller could infer from a silence about existence.
      */
     'last_owner',
+    // App roles.
+    /**
+     * **Another role of this app already has that name.** 409, on
+     * `PATCH /api/apps/:id/roles/:roleId`. Names are unique per app, compared
+     * exactly as stored after trimming.
+     *
+     * Not `validation_error`: the name is well-formed, and the remedy — pick
+     * another — depends on the app's other roles, not on the body.
+     */
+    'role_name_taken',
+    /**
+     * **The role is still held**, by app users, by pending invitations, or as
+     * the app's default role. 409, on `DELETE /api/apps/:id/roles/:roleId`
+     * without `move_to`. `details` is `roleInUseDetails`:
+     * `{ users, invitations, is_default }`.
+     *
+     * Not `conflict`: the details tell the console what to offer — a role to
+     * move them to — and a generic code would leave it guessing.
+     */
+    'role_in_use',
+    /**
+     * **An app must keep at least one role.** 409, on
+     * `DELETE /api/apps/:id/roles/:roleId` for the app's only role: every app
+     * user holds exactly one role, so an app without roles could hold no users.
+     *
+     * The same shape of refusal as `last_owner`: the caller may delete roles;
+     * the app's remaining state is what refuses this one.
+     */
+    'last_role',
     // OIDC federation.
     /**
      * **The target is in a state that refuses the operation** — not the caller's
@@ -589,10 +618,9 @@ export const ERROR_CODES = [
      * string on the validation envelope is not a code a consumer can switch on.
      *
      * Its producers in the two-space model are the ones about an app or an
-     * account rather than about a caller: `send_mail: true` on an app that has
-     * configured no `invite_url` (the `details` name the field), and a password
-     * change on an app user who has no password at all — an OIDC-only account,
-     * where the session is live and it is the target's state that refuses.
+     * account rather than about a caller — for example a password change on an
+     * app user who has no password at all, an OIDC-only account, where the
+     * session is live and it is the target's state that refuses.
      *
      * **A tier change aimed at somebody who is not a Fleetless user of this org
      * was listed here and stopped being a producer at the cut.** That refusal
@@ -857,10 +885,10 @@ export const ERROR_CODES = [
      */
     'invalid_code',
     /**
-     * `403`: the app does not offer this sign-in method — a password login on a
-     * code-only app, a code request on a password-only one, or a password where
-     * the app takes none. It names the app's policy, never a person, so it is
-     * no enumeration oracle.
+     * `403`: the app does not offer this sign-in method — a password login, a
+     * password reset or a password change on a code-only app, or a code request
+     * on a password-only one. It names the app's policy, never a person, so it
+     * is no enumeration oracle.
      */
     'method_not_allowed',
 ];

package/dist/feedback.d.ts

@@ -0,0 +1,42 @@
+// SPDX-License-Identifier: Apache-2.0
+import { z } from 'zod';
+/**
+ * **Feedback: a message from a developer to the people who build Fleetless.**
+ *
+ * The console's feedback modal sends it; the cloud stores it first and mails
+ * it afterwards, so a message is never lost to a mail failure. Who sent it and
+ * from which org is the caller's session, never the body: the body carries
+ * only what the developer chose to say and the page they said it on.
+ */
+/** The four kinds the console's modal offers. */
+export declare const FEEDBACK_KINDS: readonly ["idea", "problem", "question", "other"];
+export declare const feedbackKind: z.ZodEnum<{
+    idea: "idea";
+    problem: "problem";
+    question: "question";
+    other: "other";
+}>;
+/** Longest message the cloud stores; the console's counter starts at 4 500. */
+export declare const FEEDBACK_MESSAGE_MAX = 5000;
+export declare const feedbackRequest: z.ZodObject<{
+    kind: z.ZodEnum<{
+        idea: "idea";
+        problem: "problem";
+        question: "question";
+        other: "other";
+    }>;
+    message: z.ZodString;
+    page: z.ZodString;
+}, z.core.$strict>;
+export declare const feedbackResponse: z.ZodObject<{
+    id: z.ZodUUID;
+    mail: z.ZodEnum<{
+        sent: "sent";
+        not_requested: "not_requested";
+        not_configured: "not_configured";
+        failed: "failed";
+    }>;
+}, z.core.$strict>;
+export type FeedbackKind = z.infer<typeof feedbackKind>;
+export type FeedbackRequest = z.infer<typeof feedbackRequest>;
+export type FeedbackResponse = z.infer<typeof feedbackResponse>;

package/dist/feedback.js

@@ -0,0 +1,35 @@
+// SPDX-License-Identifier: Apache-2.0
+import { z } from 'zod';
+import { mailStatus } from './identity.js';
+/**
+ * **Feedback: a message from a developer to the people who build Fleetless.**
+ *
+ * The console's feedback modal sends it; the cloud stores it first and mails
+ * it afterwards, so a message is never lost to a mail failure. Who sent it and
+ * from which org is the caller's session, never the body: the body carries
+ * only what the developer chose to say and the page they said it on.
+ */
+/** The four kinds the console's modal offers. */
+export const FEEDBACK_KINDS = ['idea', 'problem', 'question', 'other'];
+export const feedbackKind = z.enum(FEEDBACK_KINDS);
+/** Longest message the cloud stores; the console's counter starts at 4 500. */
+export const FEEDBACK_MESSAGE_MAX = 5000;
+export const feedbackRequest = z.object({
+    kind: feedbackKind.meta({
+        description: 'What the message is: an `idea`, a `problem`, a `question` or `other`. It only sorts the inbox; it changes nothing about how the message is handled.',
+    }),
+    message: z.string().trim().min(1).max(FEEDBACK_MESSAGE_MAX).meta({
+        description: 'What the developer wrote, trimmed. At most 5000 characters; a message that is only whitespace is refused.',
+    }),
+    page: z.string().startsWith('/').max(512).meta({
+        description: 'The console path the message was sent from, e.g. `/robots/:id/jobs` with its real id. A path, never a full URL, so no host and no query string reach the inbox by accident.',
+    }),
+}).strict();
+export const feedbackResponse = z.object({
+    id: z.uuid().meta({
+        description: 'The stored message. It exists whatever `mail` says.',
+    }),
+    mail: mailStatus.meta({
+        description: 'What happened to the notification mail: `sent`, `failed`, or `not_configured` when this cloud has no feedback address. The message is stored in every case, so a client shows success for all three.',
+    }),
+}).strict();

package/dist/identity.d.ts

@@ -220,11 +220,9 @@ export type WaitlistRequest = z.infer<typeof waitlistRequest>;
  *                      no sender can promise that, and this value must never
  *                      be rendered as if it could.
  * - `not_requested`  — no mail was attempted: the caller asked for none
- *                      (`send_mail: false`), or there was no link for one to
- *                      carry (the app has configured no `invite_url`, which
- *                      the `null` `accept_url` beside it says). **A fourth
- *                      word rather than a reuse of `not_configured`**: the
- *                      deployment's mailer is irrelevant in both cases, and a
+ *                      (`send_mail: false`). **A fourth word rather than a
+ *                      reuse of `not_configured`**: the deployment's mailer
+ *                      is irrelevant there, and a
  *                      console reading "mail server not configured" beside an
  *                      invitation whose mail checkbox was off would send a
  *                      developer to fix something that is not broken.

package/dist/identity.js

@@ -225,11 +225,9 @@ export const waitlistRequest = z.object({ email: z.email().max(254) });
  *                      no sender can promise that, and this value must never
  *                      be rendered as if it could.
  * - `not_requested`  — no mail was attempted: the caller asked for none
- *                      (`send_mail: false`), or there was no link for one to
- *                      carry (the app has configured no `invite_url`, which
- *                      the `null` `accept_url` beside it says). **A fourth
- *                      word rather than a reuse of `not_configured`**: the
- *                      deployment's mailer is irrelevant in both cases, and a
+ *                      (`send_mail: false`). **A fourth word rather than a
+ *                      reuse of `not_configured`**: the deployment's mailer
+ *                      is irrelevant there, and a
  *                      console reading "mail server not configured" beside an
  *                      invitation whose mail checkbox was off would send a
  *                      developer to fix something that is not broken.

package/dist/index.d.ts

@@ -31,8 +31,10 @@ export { clientAuth, authOk, authError, clientInvoke, clientCancel, clientPublis
 export type { ClientAuth, AuthOk, AuthError, ClientInvoke, ClientCancel, ClientPublish, CommandResult, ErrorFrame, ClientSubscribe, ClientUnsubscribe, SubscribeError, DatapointEvent, ResourceHealthEvent, ResourceHealthCleared, LiveSessionEndReason, LiveSessionEvent, OrgEventKind, OrgEventSeverity, OrgEvent, OrgEventSubscribe, OrgEventUnsubscribe, OrgEventReplay, OrgEventDropped, } from './realtime.js';
 export { password, org, patchOrgResponse, sessionTokens, refreshRequest, waitlistRequest, USER_DISPLAY_NAME_MAX, orgAdminTier, fleetlessUser, fleetlessUserListResponse, createTeamInviteRequest, teamInvite, pendingTeamInvite, pendingTeamInviteListResponse, acceptTeamInviteRequest, patchFleetlessUserRequest, tierChangeRequest, mailStatus, tierRequiredDetails, passwordChangeRequest, idpIssuer, loginCode, totpCode, recoveryCode, recoveryCodesList, twoFactorSetupResponse, webauthnJson, webauthnOptionsResponse, developerPasskey, developerTwoFactor, createPasskeyRequest, createPasskeyResponse, renamePasskeyRequest, totpConfirmRequest, totpConfirmResponse, recoveryCodesResponse, authMeResponse, patchOrgRequest, patchAuthMeRequest, } from './identity.js';
 export type { Org, PatchOrgResponse, SessionTokens, RefreshRequest, WaitlistRequest, OrgAdminTier, FleetlessUser, FleetlessUserListResponse, CreateTeamInviteRequest, TeamInvite, PendingTeamInvite, PendingTeamInviteListResponse, AcceptTeamInviteRequest, PatchFleetlessUserRequest, TierChangeRequest, MailStatus, TierRequiredDetails, PasswordChangeRequest, IdpIssuer, TwoFactorSetupResponse, WebauthnOptionsResponse, DeveloperPasskey, DeveloperTwoFactor, CreatePasskeyRequest, CreatePasskeyResponse, RenamePasskeyRequest, TotpConfirmRequest, TotpConfirmResponse, RecoveryCodesResponse, AuthMeResponse, PatchOrgRequest, PatchAuthMeRequest, } from './identity.js';
-export { appIdentifier, app, appListResponse, appDeletionSummary, createAppRequest, updateAppRequest, serverKeyToken, serverKey, serverKeyListResponse, createServerKeyResponse, role, roleListResponse, rolePermissions, } from './apps.js';
-export type { App, AppListResponse, AppDeletionSummary, CreateAppRequest, UpdateAppRequest, ServerKey, ServerKeyListResponse, CreateServerKeyResponse, Role, RoleListResponse, RolePermissions, } from './apps.js';
+export { FEEDBACK_KINDS, FEEDBACK_MESSAGE_MAX, feedbackKind, feedbackRequest, feedbackResponse } from './feedback.js';
+export type { FeedbackKind, FeedbackRequest, FeedbackResponse } from './feedback.js';
+export { appIdentifier, app, appListResponse, appDeletionSummary, createAppRequest, updateAppRequest, serverKeyToken, serverKey, serverKeyListResponse, createServerKeyResponse, role, roleListResponse, rolePermissions, roleRenameRequest, roleDeleteQuery, roleInUseDetails, } from './apps.js';
+export type { App, AppListResponse, AppDeletionSummary, CreateAppRequest, UpdateAppRequest, ServerKey, ServerKeyListResponse, CreateServerKeyResponse, Role, RoleListResponse, RolePermissions, RoleRenameRequest, RoleDeleteQuery, RoleInUseDetails, } from './apps.js';
 export { clientLoginRequest, clientRefreshRequest, clientLogoutRequest, clientRegisterRequest, clientVerifyEmailRequest, clientResendVerificationRequest, clientPasswordResetRequest, clientPasswordResetConfirmRequest, clientAcceptInvitationRequest, CLIENT_OIDC_CALLBACK_PATH, clientProviderListQuery, clientProviderListResponse, clientOidcStartQuery, clientOidcCallbackQuery, clientOidcExchangeRequest, clientOidcErrorCode, clientMcpInteraction, clientMcpInteractionDecisionResponse, mcpConsentGrant, mcpConsentGrantListResponse, clientIdentity, clientLoginCodeRequest, clientLoginCodeVerifyRequest, twoFactorChallenge, clientSignInResult, clientTwoFactorVerifyRequest, clientTwoFactorSetupRequest, clientTwoFactorSetupConfirmRequest, clientTwoFactorSetupConfirmResponse, clientTwoFactorDisableRequest, } from './client-auth.js';
 export type { ClientLoginRequest, ClientRefreshRequest, ClientLogoutRequest, ClientRegisterRequest, ClientVerifyEmailRequest, ClientResendVerificationRequest, ClientPasswordResetRequest, ClientPasswordResetConfirmRequest, ClientAcceptInvitationRequest, ClientProviderListQuery, ClientProviderListResponse, ClientOidcStartQuery, ClientOidcCallbackQuery, ClientOidcExchangeRequest, ClientOidcErrorCode, ClientMcpInteraction, ClientMcpInteractionDecisionResponse, McpConsentGrant, McpConsentGrantListResponse, ClientIdentity, ClientLoginCodeRequest, ClientLoginCodeVerifyRequest, TwoFactorChallenge, ClientSignInResult, ClientTwoFactorVerifyRequest, ClientTwoFactorSetupRequest, ClientTwoFactorSetupConfirmRequest, ClientTwoFactorSetupConfirmResponse, ClientTwoFactorDisableRequest, } from './client-auth.js';
 export { clientRobotListItem, clientRobotListResponse } from './client-robots.js';

package/dist/index.js

@@ -42,7 +42,9 @@ loginCode, totpCode, recoveryCode, recoveryCodesList, twoFactorSetupResponse,
 webauthnJson, webauthnOptionsResponse, developerPasskey, developerTwoFactor, createPasskeyRequest, createPasskeyResponse, renamePasskeyRequest, totpConfirmRequest, totpConfirmResponse, recoveryCodesResponse, 
 // auth/me, org and member patches.
 authMeResponse, patchOrgRequest, patchAuthMeRequest, } from './identity.js';
-export { appIdentifier, app, appListResponse, appDeletionSummary, createAppRequest, updateAppRequest, serverKeyToken, serverKey, serverKeyListResponse, createServerKeyResponse, role, roleListResponse, rolePermissions, } from './apps.js';
+// 2026-09-30 — the console's feedback modal.
+export { FEEDBACK_KINDS, FEEDBACK_MESSAGE_MAX, feedbackKind, feedbackRequest, feedbackResponse } from './feedback.js';
+export { appIdentifier, app, appListResponse, appDeletionSummary, createAppRequest, updateAppRequest, serverKeyToken, serverKey, serverKeyListResponse, createServerKeyResponse, role, roleListResponse, rolePermissions, roleRenameRequest, roleDeleteQuery, roleInUseDetails, } from './apps.js';
 export { clientLoginRequest, clientRefreshRequest, clientLogoutRequest, clientRegisterRequest, clientVerifyEmailRequest, clientResendVerificationRequest, clientPasswordResetRequest, clientPasswordResetConfirmRequest, clientAcceptInvitationRequest, CLIENT_OIDC_CALLBACK_PATH, clientProviderListQuery, clientProviderListResponse, clientOidcStartQuery, clientOidcCallbackQuery, clientOidcExchangeRequest, clientOidcErrorCode, clientMcpInteraction, clientMcpInteractionDecisionResponse, mcpConsentGrant, mcpConsentGrantListResponse, clientIdentity, clientLoginCodeRequest, clientLoginCodeVerifyRequest, twoFactorChallenge, clientSignInResult, clientTwoFactorVerifyRequest, clientTwoFactorSetupRequest, clientTwoFactorSetupConfirmRequest, clientTwoFactorSetupConfirmResponse, clientTwoFactorDisableRequest, } from './client-auth.js';
 export { clientRobotListItem, clientRobotListResponse } from './client-robots.js';
 // The per-app identity space.

package/dist/jobs.d.ts

@@ -241,6 +241,7 @@ export declare const jobActor: z.ZodObject<{
     }>;
     id: z.ZodUUID;
     label: z.ZodString;
+    name: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
 export type JobActor = z.infer<typeof jobActor>;
 export declare const jobRunKind: z.ZodEnum<{
@@ -289,6 +290,7 @@ export declare const jobRun: z.ZodObject<{
         }>;
         id: z.ZodUUID;
         label: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
     }, z.core.$strip>;
     seq: z.ZodNumber;
     progress: z.ZodNullable<z.ZodNumber>;
@@ -351,6 +353,7 @@ export declare const jobRunListResponse: z.ZodObject<{
             }>;
             id: z.ZodUUID;
             label: z.ZodString;
+            name: z.ZodNullable<z.ZodString>;
         }, z.core.$strip>;
         seq: z.ZodNumber;
         progress: z.ZodNullable<z.ZodNumber>;

package/dist/jobs.js

@@ -226,6 +226,22 @@ export const jobActor = z.object({
     label: z.string().min(1).max(200).meta({
         description: 'A display name taken at invoke time — the email for a Fleetless user or an app user, the key\'s own name for a server key. Storing it rather than joining is the point: renaming a key afterwards does not rewrite history.',
     }),
+    /**
+     * The person's display name, snapshotted beside `label` for the same
+     * reason. **Required and nullable**, so a consumer never has to tell
+     * "absent" from "null": every run a 5.3.0 cloud answers carries it, and
+     * `null` means there is no name to show — a server key, a person without
+     * one, or a run recorded before the field existed.
+     *
+     * `jobActor` stays a plain object, not `.strict()`: a consumer still on an
+     * older contracts version then parses a newer cloud's answer by stripping
+     * the key instead of refusing the whole run.
+     */
+    name: z.string().min(1).max(200).nullable().meta({
+        description: 'The person\'s display name when the job started: the Fleetless user\'s `display_name` for a developer, the app user\'s ' +
+            '`display_name` for an app user. `null` for a server key, when the person had no name set, and for runs recorded before ' +
+            'contracts 5.3.0. Show `label` when it is null.',
+    }),
 });
 export const jobRunKind = z.enum(['action', 'service']);
 /**

package/dist/routes.d.ts

@@ -103,9 +103,16 @@ export declare const IN_HANDLER_ROUTES: readonly string[];
  *
  * Every step is a page the auth portal serves to itself: `audience:
  * 'internal'`, no request schema — the handlers read form fields by hand — and
- * HTML for a browser form post, JSON for a JSON caller. Every step after
- * `identify` needs the browser-proof cookie set there, so a step posted from
- * another browser renders the `wrong_browser` page. The interaction's ten
+ * HTML for a browser form post, JSON for a JSON caller.
+ *
+ * **The browser-proof cookie binds the interaction to one browser**, and it
+ * is set by whichever of these comes first for the interaction: the email
+ * card (`GET <prefix>/interaction/:id`), `POST <prefix>/identify`, or `POST
+ * <prefix>/passkey/options`. The email card is what a browser normally opens
+ * first; the two steps set it for a caller that never loaded the page, so
+ * `Sign in with a passkey` works without an email step. Once the interaction
+ * is bound, every step — those three included — without the matching cookie
+ * renders the `wrong_browser` page. The interaction's ten
  * minutes cover every step; only when the last one is done is anything
  * minted. **For `/mcp/oauth`, "done" means the consent step**, as the
  * password did before.