@fleetless/contracts 6.1.0 → 6.2.0-next.2

package/CHANGELOG.md

@@ -9,6 +9,28 @@ version.
 
 ## [Unreleased]
 
+### Added
+
+- **`file_too_large`** (`413`): one asset file is larger than
+  `ASSET_FILE_MAX_BYTES` (one gigabyte, every plan, the URDF included).
+  `details` is `fileTooLargeDetails`: `max_bytes` and `size_bytes`, the
+  announced size or, when none (or a false one) was announced, the bytes that
+  arrived; `null` only when the body limit stopped the upload.
+  `ASSET_FILE_MAX_BYTES` is in `constants.json`. `plan_limit` and
+  `quota_exceeded` on an asset upload now mean only that the store is full.
+- **`plan_limit` in `clientOidcErrorCode`.** A federated sign-in that would
+  create an app user beyond the org's plan `app_users` limit now redirects
+  with `?error=plan_limit`, so an app can tell that the plan is full.
+  `quota_exceeded` keeps one meaning there: the `max_end_users` protection
+  ceiling, which also covers orgs still on the beta. A consumer that switches
+  exhaustively over `ClientOidcErrorCode` gains one case.
+
+### Changed
+
+- **`POST /api/bridge/assets`** lists `file_too_large` and `plan_limit` among
+  its errors, and its notes describe the per-file limit instead of a bare
+  `413`.
+
 ## [6.1.0] — 2026-10-03
 
 ### Added

package/artifacts/constants.json

@@ -23,6 +23,7 @@
     "size": "x-fleetless-asset-size"
   },
   "ROBOT_ASSET_STORE_BYTES": 1000000000,
+  "ASSET_FILE_MAX_BYTES": 1000000000,
   "SNAPSHOT_HEADERS": {
     "ageMs": "x-fleetless-age-ms",
     "timestampMs": "x-fleetless-timestamp-ms",

package/artifacts/routes.json

@@ -6488,11 +6488,13 @@
         "rate_limited",
         "validation_error",
         "not_found",
+        "file_too_large",
+        "plan_limit",
         "quota_exceeded",
         "bad_request"
       ],
       "transport": "http",
-      "notes": "The body is the **raw file bytes**, not JSON, so it has no request schema; everything about the file — its kind, its name, its sync id and its announced size — rides in the `x-fleetless-asset-*` headers `ASSET_UPLOAD_HEADERS` names. The credential is a short-lived upload token minted by `POST /api/robots/:id/assets/sync`, verified in a `preParsing` hook so a refusal precedes the work rather than following it: a `preHandler` would already have buffered the whole file. **Nothing is refused for its own size** — the robot's asset store is the only limit, so the announced size is checked there against `ROBOT_ASSET_STORE_BYTES` and a file with no room left answers `409 quota_exceeded` carrying `store_bytes`, `used_bytes` and `size_bytes`, while the sync carries on with the next file. Past that, the server's own body limit answers a bare `413 bad_request` with none of those numbers in it. Rate limited per robot inside that same hook, which is why `rateLimited` is `false`: there is no rate-limiting preHandler registered on this route. The URDF itself is never refused for the store; only meshes and textures are charged against it."
+      "notes": "The body is the **raw file bytes**, not JSON, so it has no request schema; everything about the file — its kind, its name, its sync id and its announced size — rides in the `x-fleetless-asset-*` headers `ASSET_UPLOAD_HEADERS` names. The credential is a short-lived upload token minted by `POST /api/robots/:id/assets/sync`, verified in a `preParsing` hook so a refusal precedes the work rather than following it: a `preHandler` would already have buffered the whole file. **One file can be at most `ASSET_FILE_MAX_BYTES`**, on every plan and for every kind, the URDF included: an announced size over it answers `413 file_too_large` with `max_bytes` and `size_bytes` before a byte is buffered; without a truthful size, a body over the limit answers the same code with the bytes that arrived as `size_bytes`, or with `size_bytes: null` when it ran past the server's body limit and nobody counted the bytes. Retrying does not help. A file that fits but finds the store full answers `409 plan_limit` (or `409 quota_exceeded` for an organisation still on the beta) carrying `store_bytes`, `used_bytes` and `size_bytes`, while the sync carries on with the next file. Rate limited per robot inside that same hook, which is why `rateLimited` is `false`: there is no rate-limiting preHandler registered on this route. The URDF itself is never refused for the store; only meshes and textures are charged against it."
     },
     {
       "method": "GET",

package/artifacts/schema/file-too-large-details.schema.json

@@ -0,0 +1,30 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "max_bytes": {
+      "type": "integer",
+      "exclusiveMinimum": 0,
+      "maximum": 9007199254740991,
+      "description": "The most one asset file can be, in bytes: `ASSET_FILE_MAX_BYTES`, the same on every plan."
+    },
+    "size_bytes": {
+      "anyOf": [
+        {
+          "type": "integer",
+          "exclusiveMinimum": 0,
+          "maximum": 9007199254740991
+        },
+        {
+          "type": "null"
+        }
+      ],
+      "description": "The refused file's size, in bytes: the announced size, or the bytes that arrived when none (or a false one) was announced; `null` only when the body limit stopped the upload and nobody counted the bytes."
+    }
+  },
+  "required": [
+    "max_bytes",
+    "size_bytes"
+  ],
+  "additionalProperties": false
+}

package/dist/assets.d.ts

@@ -196,6 +196,20 @@ export type AssetSyncResponse = z.infer<typeof assetSyncResponse>;
  * the receiver enforces is two numbers that agree until one of them moves.
  */
 export declare const ROBOT_ASSET_STORE_BYTES = 1000000000;
+/**
+ * **How large one asset file may be, on every plan.**
+ *
+ * Its own number, not the store's, although both are a gigabyte today: the
+ * store says how much a robot may keep, this says how much the cloud will
+ * take in one request. A file over it is refused `413 file_too_large` with
+ * `fileTooLargeDetails`, before a byte is buffered when the size was
+ * announced (`ASSET_UPLOAD_HEADERS.size`), and otherwise on the bytes that
+ * arrived, or by the server's body limit when the body ran past it. That refusal is not a store or plan limit, applies to the URDF
+ * as well, and retrying does not help.
+ *
+ * In `constants.json` for the same reason as `ROBOT_ASSET_STORE_BYTES`.
+ */
+export declare const ASSET_FILE_MAX_BYTES = 1000000000;
 /**
  * What a full store tells the caller — the same discipline as `job_queue_full`
  * and `publisher_busy`: a refusal that names a state and no number leaves the
@@ -233,9 +247,11 @@ export type AssetStoreRefusedDetails = z.infer<typeof assetStoreRefusedDetails>;
  *   unexamined.
  *
  * There was a fourth, `too_large`, for a file over a per-file ceiling. That
- * ceiling is gone — a robot has one store and nothing is refused for its own
- * size — so the kind had no producer left and one fewer thing to branch on is
- * the whole of the gain.
+ * ceiling is gone from this enum, not from the cloud: a file over
+ * `ASSET_FILE_MAX_BYTES` is refused by the cloud as `413 file_too_large`; a
+ * producer that relays it reports `refused` with no details — so the kind
+ * had no producer left here and one fewer thing to branch on is the whole of
+ * the gain.
  *
  * A consumer that cannot act on the distinction may still print `reference`
  * alone and lose nothing it had before.

package/dist/assets.js

@@ -251,6 +251,20 @@ export const assetSyncResponse = z.object({
  * the receiver enforces is two numbers that agree until one of them moves.
  */
 export const ROBOT_ASSET_STORE_BYTES = 1_000_000_000;
+/**
+ * **How large one asset file may be, on every plan.**
+ *
+ * Its own number, not the store's, although both are a gigabyte today: the
+ * store says how much a robot may keep, this says how much the cloud will
+ * take in one request. A file over it is refused `413 file_too_large` with
+ * `fileTooLargeDetails`, before a byte is buffered when the size was
+ * announced (`ASSET_UPLOAD_HEADERS.size`), and otherwise on the bytes that
+ * arrived, or by the server's body limit when the body ran past it. That refusal is not a store or plan limit, applies to the URDF
+ * as well, and retrying does not help.
+ *
+ * In `constants.json` for the same reason as `ROBOT_ASSET_STORE_BYTES`.
+ */
+export const ASSET_FILE_MAX_BYTES = 1_000_000_000;
 /**
  * What a full store tells the caller — the same discipline as `job_queue_full`
  * and `publisher_busy`: a refusal that names a state and no number leaves the
@@ -293,9 +307,11 @@ export const assetStoreRefusedDetails = z.object({
  *   unexamined.
  *
  * There was a fourth, `too_large`, for a file over a per-file ceiling. That
- * ceiling is gone — a robot has one store and nothing is refused for its own
- * size — so the kind had no producer left and one fewer thing to branch on is
- * the whole of the gain.
+ * ceiling is gone from this enum, not from the cloud: a file over
+ * `ASSET_FILE_MAX_BYTES` is refused by the cloud as `413 file_too_large`; a
+ * producer that relays it reports `refused` with no details — so the kind
+ * had no producer left here and one fewer thing to branch on is the whole of
+ * the gain.
  *
  * A consumer that cannot act on the distinction may still print `reference`
  * alone and lose nothing it had before.

package/dist/client-auth.d.ts

@@ -373,14 +373,23 @@ export type ClientOidcExchangeRequest = z.infer<typeof clientOidcExchangeRequest
  *   `provider_misconfigured`, `provider_disabled` — the provider's or the
  *   developer's to fix, and the app can say so.
  * - `invalid_request` — the start parameters did not hold up.
- * - `quota_exceeded` — the org has as many app users as its `max_end_users`
- *   quota allows, so no account can be created for this identity. Named rather
- *   than folded into `no_access`, for `domain_not_allowed`'s reason: it is not
- *   about the person, the app can say what happened, and the remedy belongs to
- *   the developer rather than to whoever is trying to sign in. It is raised
+ * - `quota_exceeded` — the org is at the protection ceiling: it has as many
+ *   app users as its `max_end_users` quota allows, so no account can be
+ *   created for this identity. This also covers an org still on the beta,
+ *   whose plan is not enforced yet. Named rather than folded into
+ *   `no_access`, for `domain_not_allowed`'s reason: it is not about the
+ *   person, the app can say what happened, and the remedy belongs to the
+ *   developer rather than to whoever is trying to sign in. It is raised
  *   **only where an account would be created** — an identity that already has
  *   one signs in at the quota exactly as it does under it, because refusing a
  *   sign-in would turn a protection limit into an outage.
+ * - `plan_limit` — the org's plan has no room for another app user: it is at
+ *   its plan's `app_users` limit (fleetless/fleetless#103), counted across
+ *   every app of the org with pending invitations included. Checked before
+ *   the protection ceiling, and raised, like `quota_exceeded`, **only where
+ *   an account would be created**. The remedy is a higher plan or an add-on,
+ *   which is why it is not `quota_exceeded`. It is the same code the other
+ *   app-user doors answer as `409 plan_limit`.
  */
 export declare const clientOidcErrorCode: z.ZodEnum<{
     no_access: "no_access";
@@ -395,6 +404,7 @@ export declare const clientOidcErrorCode: z.ZodEnum<{
     provider_disabled: "provider_disabled";
     invalid_request: "invalid_request";
     quota_exceeded: "quota_exceeded";
+    plan_limit: "plan_limit";
 }>;
 export type ClientOidcErrorCode = z.infer<typeof clientOidcErrorCode>;
 /**

package/dist/client-auth.js

@@ -435,14 +435,23 @@ export const clientOidcExchangeRequest = z
  *   `provider_misconfigured`, `provider_disabled` — the provider's or the
  *   developer's to fix, and the app can say so.
  * - `invalid_request` — the start parameters did not hold up.
- * - `quota_exceeded` — the org has as many app users as its `max_end_users`
- *   quota allows, so no account can be created for this identity. Named rather
- *   than folded into `no_access`, for `domain_not_allowed`'s reason: it is not
- *   about the person, the app can say what happened, and the remedy belongs to
- *   the developer rather than to whoever is trying to sign in. It is raised
+ * - `quota_exceeded` — the org is at the protection ceiling: it has as many
+ *   app users as its `max_end_users` quota allows, so no account can be
+ *   created for this identity. This also covers an org still on the beta,
+ *   whose plan is not enforced yet. Named rather than folded into
+ *   `no_access`, for `domain_not_allowed`'s reason: it is not about the
+ *   person, the app can say what happened, and the remedy belongs to the
+ *   developer rather than to whoever is trying to sign in. It is raised
  *   **only where an account would be created** — an identity that already has
  *   one signs in at the quota exactly as it does under it, because refusing a
  *   sign-in would turn a protection limit into an outage.
+ * - `plan_limit` — the org's plan has no room for another app user: it is at
+ *   its plan's `app_users` limit (fleetless/fleetless#103), counted across
+ *   every app of the org with pending invitations included. Checked before
+ *   the protection ceiling, and raised, like `quota_exceeded`, **only where
+ *   an account would be created**. The remedy is a higher plan or an add-on,
+ *   which is why it is not `quota_exceeded`. It is the same code the other
+ *   app-user doors answer as `409 plan_limit`.
  */
 export const clientOidcErrorCode = z.enum([
     'no_access',
@@ -457,6 +466,7 @@ export const clientOidcErrorCode = z.enum([
     'provider_disabled',
     'invalid_request',
     'quota_exceeded',
+    'plan_limit',
 ]);
 /* ------------------------------------------------ MCP, delegated login -- */
 /**

package/dist/errors.d.ts

@@ -209,10 +209,26 @@ export declare const orgLockedDetails: z.ZodObject<{
     }>;
 }, z.core.$strip>;
 export type OrgLockedDetails = z.infer<typeof orgLockedDetails>;
+/**
+ * The `details` of a `413 file_too_large` refusal (2026-10-03,
+ * fleetless/fleetless#136): one file is larger than `ASSET_FILE_MAX_BYTES`.
+ * Not a store and not a plan limit — those are `409 plan_limit` and
+ * `409 quota_exceeded`, and mean only "the store is full". `size_bytes` is
+ * the file's size: the announced one when the refusal came before the body
+ * was read, or the bytes that arrived when no size (or a false one) was
+ * announced and the body still fit the server's body limit. It is `null` only
+ * when the body limit stopped the upload, because then nobody counted the
+ * bytes.
+ */
+export declare const fileTooLargeDetails: z.ZodObject<{
+    max_bytes: z.ZodNumber;
+    size_bytes: z.ZodNullable<z.ZodNumber>;
+}, z.core.$strip>;
+export type FileTooLargeDetails = z.infer<typeof fileTooLargeDetails>;
 /**
  * The codes in use today. The wire deliberately allows any string — this
  * list is the shared vocabulary, not a closed set, so a new refusal never
  * needs a contracts release before it can be reported honestly.
  */
-export declare const ERROR_CODES: readonly ["not_found", "validation_error", "bad_request", "unknown_datapoint", "invalid_token", "protocol_mismatch", "bridge_too_old", "invalid_frame", "duplicate_slug", "reserved_slug", "unknown_slug", "unknown_field_path", "unknown_type", "unknown_topic", "invalid_rate", "invalid_range", "config_conflict", "no_data", "robot_offline", "bridge_timeout", "unauthorized", "forbidden", "invalid_credentials", "token_expired", "token_revoked", "email_taken", "identifier_taken", "weak_password", "account_blocked", "busy", "parameter_invalid", "cancel_rejected", "job_lost", "job_unknown_to_bridge", "action_server_lost", "action_failed", "goal_rejected", "goal_send_failed", "result_failed", "goal_uncontrollable", "bridge_disconnected", "config_changed", "publisher_busy", "unknown_command", "not_subscribable", "camera_offline", "no_snapshot_yet", "live_unavailable", "wrong_kind", "not_recorded", "not_aggregatable", "quota_exceeded", "credential_in_use", "goal_timeout", "robot_in_use", "robot_deletion_partial", "job_queue_full", "invalid_uuid", "rate_limited", "tier_required", "token_spent", "service_timeout", "asset_missing", "dynamic_registration_disabled", "client_limit_reached", "idp_unavailable", "mcp_disabled", "tool_not_available", "capability_required", "last_owner", "role_name_taken", "role_in_use", "last_role", "target_state_conflict", "signup_closed", "draft_not_a_document", "internal_error", "not_cancellable", "unsupported_media_type", "wrong_browser", "invalid_yaml", "unstorable_yaml", "registration_closed", "domain_not_allowed", "email_unverified", "origin_not_allowed", "template_invalid", "provider_disabled", "provider_misconfigured", "invalid_redirect_uri", "interaction_expired", "invalid_code", "method_not_allowed", "plan_limit", "plan_required", "org_locked"];
+export declare const ERROR_CODES: readonly ["not_found", "validation_error", "bad_request", "unknown_datapoint", "invalid_token", "protocol_mismatch", "bridge_too_old", "invalid_frame", "duplicate_slug", "reserved_slug", "unknown_slug", "unknown_field_path", "unknown_type", "unknown_topic", "invalid_rate", "invalid_range", "config_conflict", "no_data", "robot_offline", "bridge_timeout", "unauthorized", "forbidden", "invalid_credentials", "token_expired", "token_revoked", "email_taken", "identifier_taken", "weak_password", "account_blocked", "busy", "parameter_invalid", "cancel_rejected", "job_lost", "job_unknown_to_bridge", "action_server_lost", "action_failed", "goal_rejected", "goal_send_failed", "result_failed", "goal_uncontrollable", "bridge_disconnected", "config_changed", "publisher_busy", "unknown_command", "not_subscribable", "camera_offline", "no_snapshot_yet", "live_unavailable", "wrong_kind", "not_recorded", "not_aggregatable", "quota_exceeded", "credential_in_use", "goal_timeout", "robot_in_use", "robot_deletion_partial", "job_queue_full", "invalid_uuid", "rate_limited", "tier_required", "token_spent", "service_timeout", "asset_missing", "dynamic_registration_disabled", "client_limit_reached", "idp_unavailable", "mcp_disabled", "tool_not_available", "capability_required", "last_owner", "role_name_taken", "role_in_use", "last_role", "target_state_conflict", "signup_closed", "draft_not_a_document", "internal_error", "not_cancellable", "unsupported_media_type", "wrong_browser", "invalid_yaml", "unstorable_yaml", "registration_closed", "domain_not_allowed", "email_unverified", "origin_not_allowed", "template_invalid", "provider_disabled", "provider_misconfigured", "invalid_redirect_uri", "interaction_expired", "invalid_code", "method_not_allowed", "plan_limit", "plan_required", "org_locked", "file_too_large"];
 export type ErrorCode = (typeof ERROR_CODES)[number];

package/dist/errors.js

@@ -135,6 +135,25 @@ export const orgLockedDetails = z.object({
         description: '`payment`: a payment is missing. `migration`: the org did not choose what stays when the beta ended.',
     }),
 });
+/**
+ * The `details` of a `413 file_too_large` refusal (2026-10-03,
+ * fleetless/fleetless#136): one file is larger than `ASSET_FILE_MAX_BYTES`.
+ * Not a store and not a plan limit — those are `409 plan_limit` and
+ * `409 quota_exceeded`, and mean only "the store is full". `size_bytes` is
+ * the file's size: the announced one when the refusal came before the body
+ * was read, or the bytes that arrived when no size (or a false one) was
+ * announced and the body still fit the server's body limit. It is `null` only
+ * when the body limit stopped the upload, because then nobody counted the
+ * bytes.
+ */
+export const fileTooLargeDetails = z.object({
+    max_bytes: z.number().int().positive().meta({
+        description: 'The most one asset file can be, in bytes: `ASSET_FILE_MAX_BYTES`, the same on every plan.',
+    }),
+    size_bytes: z.number().int().positive().nullable().meta({
+        description: 'The refused file\'s size, in bytes: the announced size, or the bytes that arrived when none (or a false one) was announced; `null` only when the body limit stopped the upload and nobody counted the bytes.',
+    }),
+});
 /**
  * The codes in use today. The wire deliberately allows any string — this
  * list is the shared vocabulary, not a closed set, so a new refusal never
@@ -975,6 +994,10 @@ export const ERROR_CODES = [
      * The existing `quota_exceeded` protection ceiling is still checked, and
      * only after this one: it exists to stop runaway consumption, not to tell
      * a developer what their plan allows.
+     *
+     * At an OIDC callback the same refusal reaches the app as the
+     * `clientOidcErrorCode` of the same name, redirected rather than answered
+     * as JSON.
      */
     'plan_limit',
     /**
@@ -995,4 +1018,14 @@ export const ERROR_CODES = [
      * payment, or the platform's own move off the beta.
      */
     'org_locked',
+    // 2026-10-03 — the per-file asset limit (#136).
+    /**
+     * `413`: one asset file is larger than `ASSET_FILE_MAX_BYTES`. Refused on
+     * the announced size before the body is read, for every kind including the
+     * URDF, otherwise on the bytes that arrived, or by the body limit when the
+     * body ran past it. `details` is
+     * `fileTooLargeDetails`. Not a store or plan limit, on any plan; retrying
+     * does not help, only a smaller file does.
+     */
+    'file_too_large',
 ];

package/dist/index.d.ts

@@ -41,14 +41,14 @@ export { clientRobotListItem, clientRobotListResponse } from './client-robots.js
 export type { ClientRobotListItem, ClientRobotListResponse } from './client-robots.js';
 export { APP_USER_DISPLAY_NAME_MAX, APP_URL_PLACEHOLDERS, MAIL_TEMPLATE_VARIABLES, DEFAULT_MAIL_TEMPLATES, providerSlug, appUserStatus, appUser, appUserListResponse, createAppUserRequest, patchAppUserRequest, createAppInvitationRequest, appInvitation, pendingAppInvitation, appInvitationListResponse, appOidcProvider, appOidcProviderListResponse, createAppOidcProviderRequest, patchAppOidcProviderRequest, appUrlTemplate, allowedOrigin, emailDomain, appAuthConfig, appSignInMethods, appTwoFactorPolicy, appHomeUrl, hostedAccent, HOSTED_LOGO_MAX_BYTES, HOSTED_LOGO_TYPES, appHostedPages, putAppAuthRegistrationRequest, putAppAuthSignInRequest, putAppAuthUrlsRequest, putAppAuthMcpRequest, putAppAuthLookRequest, mailTemplateKind, appMailTemplate, appMailTemplateListResponse, putAppMailTemplateRequest, mailTemplatePreviewRequest, mailTemplatePreviewResponse, mailTemplateProblemDetails, mailOutcome, } from './app-users.js';
 export type { AppUserStatus, AppUser, AppUserListResponse, CreateAppUserRequest, PatchAppUserRequest, CreateAppInvitationRequest, AppInvitation, PendingAppInvitation, AppInvitationListResponse, AppOidcProvider, AppOidcProviderListResponse, CreateAppOidcProviderRequest, PatchAppOidcProviderRequest, AppAuthConfig, AppSignInMethods, AppTwoFactorPolicy, AppHostedPages, PutAppAuthRegistrationRequest, PutAppAuthSignInRequest, PutAppAuthUrlsRequest, PutAppAuthMcpRequest, PutAppAuthLookRequest, MailTemplateKind, AppMailTemplate, AppMailTemplateListResponse, PutAppMailTemplateRequest, MailTemplatePreviewRequest, MailTemplatePreviewResponse, MailTemplateProblemDetails, MailOutcome, } from './app-users.js';
-export { assetKind, URDF_ASSET_NAME, asset, urdfCompleteness, assetListResponse, assetsClearResponse, missingAssetQuery, assetSyncRequest, assetSyncResponse, assetSyncState, assetSyncStatus, assetFailure, assetFailureKind, assetStoreRefusedDetails, assetSyncBusyDetails, ROBOT_ASSET_STORE_BYTES, } from './assets.js';
+export { assetKind, URDF_ASSET_NAME, asset, urdfCompleteness, assetListResponse, assetsClearResponse, missingAssetQuery, assetSyncRequest, assetSyncResponse, assetSyncState, assetSyncStatus, assetFailure, assetFailureKind, assetStoreRefusedDetails, assetSyncBusyDetails, ROBOT_ASSET_STORE_BYTES, ASSET_FILE_MAX_BYTES, } from './assets.js';
 export type { AssetKind, Asset, UrdfCompleteness, AssetListResponse, AssetsClearResponse, MissingAssetQuery, AssetSyncRequest, AssetSyncResponse, AssetSyncState, AssetSyncStatus, AssetFailure, AssetFailureKind, AssetStoreRefusedDetails, AssetSyncBusyDetails, } from './assets.js';
 export { auditActor, auditEvent, auditQuery, auditListResponse, AUDIT_CSV_COLUMNS, AUDIT_RETENTION_DAYS } from './audit.js';
 export type { AuditActor, AuditEvent, AuditQuery, AuditListResponse } from './audit.js';
 export { alertRowCondition, alertSeverity, alertState, datapointAlertRow, alertListResponse, orgFiringAlertsResponse, orgAlertsQuery, datapointDisplay, putDatapointDisplayRequest, } from './alerts.js';
 export type { AlertRowCondition, AlertSeverity, AlertState, DatapointAlertRow, AlertListResponse, OrgFiringAlertsResponse, OrgAlertsQuery, DatapointDisplay, PutDatapointDisplayRequest, } from './alerts.js';
-export { apiError, parameterViolation, parameterInvalidDetails, cancelRejectedDetails, invalidCodeDetails, ERROR_CODES, planLimitDetails, assetPlanLimitDetails, planRequiredDetails, orgLockedDetails, } from './errors.js';
-export type { ApiError, ParameterViolation, ParameterInvalidDetails, CancelRejectedDetails, InvalidCodeDetails, ErrorCode, PlanLimitDetails, AssetPlanLimitDetails, PlanRequiredDetails, OrgLockedDetails, } from './errors.js';
+export { apiError, parameterViolation, parameterInvalidDetails, cancelRejectedDetails, invalidCodeDetails, ERROR_CODES, planLimitDetails, assetPlanLimitDetails, planRequiredDetails, orgLockedDetails, fileTooLargeDetails, } from './errors.js';
+export type { ApiError, ParameterViolation, ParameterInvalidDetails, CancelRejectedDetails, InvalidCodeDetails, ErrorCode, PlanLimitDetails, AssetPlanLimitDetails, PlanRequiredDetails, OrgLockedDetails, FileTooLargeDetails, } from './errors.js';
 export { oauthErrorCode, oauthError, oauthRedirectResponse, oauthCodeTokenRequest, oauthRefreshTokenRequest, oauthTokenRequest, oauthTokenResponse, redirectUri, codeChallengeMethod, oauthAuthorizeQuery, dynamicClientRegistrationRequest, MCP_DCR_MAX_REDIRECT_URIS, dynamicClientRegistrationResponse, authorizationServerMetadata, protectedResourceMetadata, } from './oauth.js';
 export type { OauthErrorCode, OauthError, OauthRedirectResponse, OauthCodeTokenRequest, OauthRefreshTokenRequest, OauthTokenRequest, OauthTokenResponse, RedirectUri, OauthAuthorizeQuery, DynamicClientRegistrationRequest, DynamicClientRegistrationResponse, AuthorizationServerMetadata, ProtectedResourceMetadata, } from './oauth.js';
 export { ROUTES, ROUTE_SECTIONS, IN_HANDLER_ROUTES, developerSignInRoutes } from './routes.js';

package/dist/index.js

@@ -49,12 +49,14 @@ export { clientLoginRequest, clientRefreshRequest, clientLogoutRequest, clientRe
 export { clientRobotListItem, clientRobotListResponse } from './client-robots.js';
 // The per-app identity space.
 export { APP_USER_DISPLAY_NAME_MAX, APP_URL_PLACEHOLDERS, MAIL_TEMPLATE_VARIABLES, DEFAULT_MAIL_TEMPLATES, providerSlug, appUserStatus, appUser, appUserListResponse, createAppUserRequest, patchAppUserRequest, createAppInvitationRequest, appInvitation, pendingAppInvitation, appInvitationListResponse, appOidcProvider, appOidcProviderListResponse, createAppOidcProviderRequest, patchAppOidcProviderRequest, appUrlTemplate, allowedOrigin, emailDomain, appAuthConfig, appSignInMethods, appTwoFactorPolicy, appHomeUrl, hostedAccent, HOSTED_LOGO_MAX_BYTES, HOSTED_LOGO_TYPES, appHostedPages, putAppAuthRegistrationRequest, putAppAuthSignInRequest, putAppAuthUrlsRequest, putAppAuthMcpRequest, putAppAuthLookRequest, mailTemplateKind, appMailTemplate, appMailTemplateListResponse, putAppMailTemplateRequest, mailTemplatePreviewRequest, mailTemplatePreviewResponse, mailTemplateProblemDetails, mailOutcome, } from './app-users.js';
-export { assetKind, URDF_ASSET_NAME, asset, urdfCompleteness, assetListResponse, assetsClearResponse, missingAssetQuery, assetSyncRequest, assetSyncResponse, assetSyncState, assetSyncStatus, assetFailure, assetFailureKind, assetStoreRefusedDetails, assetSyncBusyDetails, ROBOT_ASSET_STORE_BYTES, } from './assets.js';
+export { assetKind, URDF_ASSET_NAME, asset, urdfCompleteness, assetListResponse, assetsClearResponse, missingAssetQuery, assetSyncRequest, assetSyncResponse, assetSyncState, assetSyncStatus, assetFailure, assetFailureKind, assetStoreRefusedDetails, assetSyncBusyDetails, ROBOT_ASSET_STORE_BYTES, ASSET_FILE_MAX_BYTES, } from './assets.js';
 export { auditActor, auditEvent, auditQuery, auditListResponse, AUDIT_CSV_COLUMNS, AUDIT_RETENTION_DAYS } from './audit.js';
 export { alertRowCondition, alertSeverity, alertState, datapointAlertRow, alertListResponse, orgFiringAlertsResponse, orgAlertsQuery, datapointDisplay, putDatapointDisplayRequest, } from './alerts.js';
 export { apiError, parameterViolation, parameterInvalidDetails, cancelRejectedDetails, invalidCodeDetails, ERROR_CODES, 
 // 2026-10-02 — plans (#103). The plan errors (I-3).
-planLimitDetails, assetPlanLimitDetails, planRequiredDetails, orgLockedDetails, } from './errors.js';
+planLimitDetails, assetPlanLimitDetails, planRequiredDetails, orgLockedDetails, 
+// 2026-10-03 — the per-file asset limit (#136).
+fileTooLargeDetails, } from './errors.js';
 export { oauthErrorCode, oauthError, oauthRedirectResponse, oauthCodeTokenRequest, oauthRefreshTokenRequest, oauthTokenRequest, oauthTokenResponse, redirectUri, codeChallengeMethod, oauthAuthorizeQuery, dynamicClientRegistrationRequest, MCP_DCR_MAX_REDIRECT_URIS, dynamicClientRegistrationResponse, authorizationServerMetadata, protectedResourceMetadata, } from './oauth.js';
 export { ROUTES, ROUTE_SECTIONS, IN_HANDLER_ROUTES, developerSignInRoutes } from './routes.js';
 // 2026-10-02 — plans (#103). The catalogue (I-1) only: `PLANS` and `ADDONS`

package/dist/realtime.d.ts

@@ -260,10 +260,10 @@ export type DatapointEvent = z.infer<typeof datapointEvent>;
  */
 export declare const liveSessionEndReason: z.ZodEnum<{
     unknown: "unknown";
+    plan_limit: "plan_limit";
     publish_failed: "publish_failed";
     robot_offline: "robot_offline";
     config_changed: "config_changed";
-    plan_limit: "plan_limit";
     released_by_peer: "released_by_peer";
     revoked: "revoked";
     expired: "expired";
@@ -292,10 +292,10 @@ export declare const liveSessionEvent: z.ZodObject<{
     state: z.ZodLiteral<"ended">;
     reason: z.ZodEnum<{
         unknown: "unknown";
+        plan_limit: "plan_limit";
         publish_failed: "publish_failed";
         robot_offline: "robot_offline";
         config_changed: "config_changed";
-        plan_limit: "plan_limit";
         released_by_peer: "released_by_peer";
         revoked: "revoked";
         expired: "expired";

package/dist/routes.js

@@ -2852,16 +2852,18 @@ export const ROUTES = [
         summary: 'Takes one asset file from a robot during a sync.',
         audience: 'internal', auth: 'robot_upload', rateLimited: false, ownerTier: false, status: 201,
         params: [], query: null, request: null, response: asset,
-        errors: ['unauthorized', 'rate_limited', 'validation_error', 'not_found', 'quota_exceeded', 'bad_request'], transport: 'http',
+        errors: ['unauthorized', 'rate_limited', 'validation_error', 'not_found', 'file_too_large', 'plan_limit', 'quota_exceeded', 'bad_request'], transport: 'http',
         notes: 'The body is the **raw file bytes**, not JSON, so it has no request schema; everything about the file — its kind, its name, its sync id ' +
             'and its announced size — rides in the `x-fleetless-asset-*` headers `ASSET_UPLOAD_HEADERS` names. The credential is a short-lived ' +
             'upload token minted by `POST /api/robots/:id/assets/sync`, verified in a `preParsing` hook so a refusal precedes the work rather than ' +
-            'following it: a `preHandler` would already have buffered the whole file. **Nothing is refused for its own size** — the robot\'s asset ' +
-            'store is the only limit, so the announced size is checked there against `ROBOT_ASSET_STORE_BYTES` and a file with no room left answers ' +
-            '`409 quota_exceeded` carrying `store_bytes`, `used_bytes` and `size_bytes`, while the sync carries on with the next file. Past that, ' +
-            'the server\'s own body limit answers a bare `413 bad_request` with none of those numbers in it. Rate limited per robot inside that same ' +
-            'hook, which is why `rateLimited` is `false`: there is no rate-limiting preHandler registered on this route. The URDF itself is never ' +
-            'refused for the store; only meshes and textures are charged against it.',
+            'following it: a `preHandler` would already have buffered the whole file. **One file can be at most `ASSET_FILE_MAX_BYTES`**, on every ' +
+            'plan and for every kind, the URDF included: an announced size over it answers `413 file_too_large` with `max_bytes` and `size_bytes` ' +
+            'before a byte is buffered; without a truthful size, a body over the limit answers the same code with the bytes that arrived as `size_bytes`, ' +
+            'or with `size_bytes: null` when it ran past the server\'s body limit and nobody counted the bytes. ' +
+            'Retrying does not help. A file that fits but finds the store full answers `409 plan_limit` (or `409 quota_exceeded` for an organisation ' +
+            'still on the beta) carrying `store_bytes`, `used_bytes` and `size_bytes`, while the sync carries on with the next file. Rate limited per ' +
+            'robot inside that same hook, which is why `rateLimited` is `false`: there is no rate-limiting preHandler registered on this route. The ' +
+            'URDF itself is never refused for the store; only meshes and textures are charged against it.',
     },
     /* ------------------------------------ realtime and bridge transports */
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fleetless/contracts",
-  "version": "6.1.0",
+  "version": "6.2.0-next.2",
   "description": "Fleetless wire contracts: the bridge-cloud protocol, the REST API schemas and the error codes, as zod schemas with generated JSON Schema and OpenAPI artifacts.",
   "license": "Apache-2.0",
   "author": "Dehne Robotik GmbH",