@fleetless/sdk 1.0.0 → 2.0.1

package/dist/index.d.ts

@@ -119,7 +119,7 @@ type BusyDetails = z.infer<typeof busyDetails>;
 /**
  * The REST read of one datapoint. For bridge-captured data `timestamp_ms`
  * is the capture time at the bridge (spec §6.3); for the cloud-observed
- * built-in `bridge-state` it is the time the cloud observed the state.
+ * built-in `bridge_state` it is the time the cloud observed the state.
  */
 declare const datapointValue: z.ZodObject<{
     slug: z.ZodString;
@@ -185,7 +185,7 @@ declare const cameraDescriptor: z.ZodObject<{
     width: z.ZodNumber;
     height: z.ZodNumber;
     fps: z.ZodNumber;
-    snapshot_interval_ms: z.ZodNumber;
+    snapshot_interval_seconds: z.ZodNumber;
 }, z.core.$strip>;
 type CameraDescriptor = z.infer<typeof cameraDescriptor>;
 /**
@@ -241,7 +241,7 @@ type HistoryBucketsResponse = z.infer<typeof historyBucketsResponse>;
 /**
  * One datapoint sample pushed to a subscriber. The current value arrives
  * immediately on subscribe, then every change. `timestamp_ms` semantics as
- * in `datapointValue` (capture time; cloud-observed for `bridge-state`).
+ * in `datapointValue` (capture time; cloud-observed for `bridge_state`).
  */
 declare const datapointEvent: z.ZodObject<{
     type: z.ZodLiteral<"datapoint">;
@@ -263,62 +263,57 @@ declare const sessionTokens: z.ZodObject<{
     expires_in: z.ZodNumber;
 }, z.core.$strip>;
 type SessionTokens = z.infer<typeof sessionTokens>;
+
 /**
- * An invitation carries its own accept URL: the link is the primary path
- * (the developer shares it), mail is the second. A cloud with no SMTP
- * configured still issues invitations — it just cannot send them, and says so
- * via `mail_sent`.
- */
-/**
- * What happened to the mail, in three words instead of one (W6c).
+ * **What logout can and cannot end, said in three separable facts (W9c,
+ * DEF-098).**
  *
- * `mail_sent: boolean` could not tell **"we have no SMTP configured"** from
- * **"we tried and the server refused"**, so the console had to pick a sentence
- * for a cause it could not know — and picked the reassuring one, because a
- * link-only invitation is a normal outcome and a bounced one is not. The two
- * need opposite actions from whoever reads them: configure a mail server, or
- * go and look at why the existing one rejected the message.
+ * Until now this route answered `204`: the Fleetless session was over and the
+ * response had nothing to say about the *other* session. For a federated user
+ * that is the larger half — they clicked "log out", the IdP's cookie survived,
+ * and the next login goes straight through without a password. The register
+ * row calls that an expectation gap, and it is: the word on the button is
+ * "log out", not "log out of this app".
  *
- * - `sent`           — the SMTP server accepted the message. Not "delivered":
- *                      no sender can promise that, and this value must never
- *                      be rendered as if it could.
- * - `not_configured` — no SMTP is set up. **An expected state, not a failure**
- *                      (spec §3.2: invitations work without mail; the link is
- *                      the primary path). The console must not show it as an
- *                      error.
- * - `failed`         — SMTP was configured, was tried, and refused or was
- *                      unreachable. This one is worth someone's attention.
- */
-declare const mailStatus: z.ZodEnum<{
-    failed: "failed";
-    sent: "sent";
-    not_configured: "not_configured";
-}>;
-type MailStatus = z.infer<typeof mailStatus>;
-/**
- * What registering answers — deliberately **the same for an address that is
- * new and one that already has an account**.
+ * **The Fleetless session is ended before this is computed, unconditionally.**
+ * Nothing below can fail in a way that leaves the caller logged in here — a
+ * logout that depends on reaching a third party is not a logout.
  *
- * Anything else is an account-enumeration oracle on an unauthenticated route,
- * the same reasoning `passwordResetRequest` carries. An address that already
- * exists still gets a mail, saying so; the caller cannot tell which mail was
- * sent, and there is nothing in this response to tell them.
+ * **Four outcomes**, and they are deliberately not collapsed into a nullable
+ * URL. *No IdP was involved* and *an IdP was involved and publishes no
+ * `end_session_endpoint`* are different things: the first needs no action and
+ * the second means a session survives that this platform cannot end. A caller
+ * that renders them identically is choosing to; a contract that cannot tell
+ * them apart makes the choice for everyone.
  *
- * `mail` is safe to return because it describes **the server's configuration**,
- * not the address: `not_configured` means this deployment has no SMTP, which
- * is true regardless of who registered. Note that a deployment with no mail
- * server cannot complete a self-registration at all — the link is the only way
- * through, unlike an invitation, where a developer can hand it over directly.
+ * **This sentence said "three" for a whole wave, directly above a four-branch
+ * union in this same file** — found by Momus-W9, along with the same number in
+ * `sdk/src/auth.ts` and `sdk/README.md`. The type is derived
+ * (`ClientLogoutResponse['idp_logout']`), so `tsc` had nothing to say, and the
+ * sweep shows the mechanism plainly: `sdk d065447` is literally titled *"logout
+ * says three separable things"* — correct when written, never carried forward
+ * when `hint_unavailable` arrived in `b417d2a`.
+ *
+ * The count is not the point. **`hint_unavailable` is precisely the case this
+ * comment warns about** — the IdP session survives — so a caller who handles
+ * the three documented branches drops it into an `else` they believe means
+ * *nothing to do*.
  */
-declare const clientRegisterResponse: z.ZodObject<{
-    mail: z.ZodEnum<{
-        failed: "failed";
-        sent: "sent";
-        not_configured: "not_configured";
-    }>;
+declare const clientLogoutResponse: z.ZodObject<{
+    idp_logout: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        status: z.ZodLiteral<"redirect">;
+        url: z.ZodURL;
+    }, z.core.$strip>, z.ZodObject<{
+        status: z.ZodLiteral<"not_federated">;
+    }, z.core.$strip>, z.ZodObject<{
+        status: z.ZodLiteral<"unsupported_by_idp">;
+    }, z.core.$strip>, z.ZodObject<{
+        status: z.ZodLiteral<"hint_unavailable">;
+    }, z.core.$strip>, z.ZodObject<{
+        status: z.ZodLiteral<"session_unknown">;
+    }, z.core.$strip>], "status">;
 }, z.core.$strip>;
-type ClientRegisterResponse = z.infer<typeof clientRegisterResponse>;
-
+type ClientLogoutResponse = z.infer<typeof clientLogoutResponse>;
 /**
  * Who the caller turned out to be. Returned by the "who am I" endpoint and by
  * the realtime `auth_ok` frame, so a client can render a session without
@@ -334,6 +329,25 @@ type ClientRegisterResponse = z.infer<typeof clientRegisterResponse>;
  * `app_id` and `role_id` are null for them, and roles do not filter what they
  * see. `kind` states this explicitly rather than leaving it to be inferred
  * from which id happens to be set.
+ *
+ * **`act` is the real admin behind an impersonation** (spec
+ * `2026-08-29-org-identity-redesign`, D4, the `act`-claim pattern of RFC
+ * 8693). An Org Admins member entering an app through the interstitial
+ * (`impersonationChoice`) gets a token whose *effective* identity is the role
+ * or user they chose — that is what the rest of this shape describes — while
+ * `act` names **the admin who is actually driving**. So every action can
+ * audit as "Admin A as User B / as role X", and a client can render the "you
+ * are acting as …" banner without decoding the token.
+ *
+ * **Optional, not a nullable actor, for `orgUser.tier`'s reason:** absence
+ * means *this is an ordinary session, nobody is delegating*, which is not the
+ * same fact as *the actor is unknown*. The overwhelming majority of sessions
+ * are ordinary and carry no `act` at all; a session that has one is a
+ * delegation and says who by. The schema cannot check that `act` is present
+ * exactly when the effective identity was impersonated — that pairing is the
+ * cloud's, minted at the authorize step. Only the admin's **id** rides here:
+ * the label is resolved by whoever renders it, not carried as a second
+ * unverified name on the wire.
  */
 declare const clientIdentity: z.ZodObject<{
     kind: z.ZodEnum<{
@@ -347,6 +361,9 @@ declare const clientIdentity: z.ZodObject<{
     app_id: z.ZodNullable<z.ZodUUID>;
     role_id: z.ZodNullable<z.ZodUUID>;
     email: z.ZodNullable<z.ZodEmail>;
+    act: z.ZodOptional<z.ZodObject<{
+        admin_user_id: z.ZodUUID;
+    }, z.core.$strict>>;
 }, z.core.$strip>;
 type ClientIdentity = z.infer<typeof clientIdentity>;
 
@@ -393,9 +410,43 @@ type Asset = z.infer<typeof asset>;
 declare const urdfCompleteness: z.ZodObject<{
     present: z.ZodBoolean;
     mesh_count: z.ZodNumber;
-    missing: z.ZodArray<z.ZodString>;
+    missing: z.ZodArray<z.ZodObject<{
+        uri: z.ZodString;
+        element: z.ZodEnum<{
+            mesh: "mesh";
+            texture: "texture";
+        }>;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 type UrdfCompleteness = z.infer<typeof urdfCompleteness>;
+declare const assetSyncStatus: z.ZodObject<{
+    sync_id: z.ZodUUID;
+    robot_id: z.ZodUUID;
+    state: z.ZodEnum<{
+        running: "running";
+        succeeded: "succeeded";
+        failed: "failed";
+    }>;
+    done: z.ZodNumber;
+    total: z.ZodNumber;
+    failed: z.ZodArray<z.ZodObject<{
+        reference: z.ZodString;
+        kind: z.ZodEnum<{
+            unresolvable: "unresolvable";
+            upload_failed: "upload_failed";
+            refused: "refused";
+            too_large: "too_large";
+        }>;
+        details: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+            limit_bytes: z.ZodNumber;
+            size_bytes: z.ZodNumber;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>;
+    reason: z.ZodNullable<z.ZodString>;
+    started_at: z.ZodISODateTime;
+    updated_at: z.ZodISODateTime;
+}, z.core.$strip>;
+type AssetSyncStatus = z.infer<typeof assetSyncStatus>;
 declare const assetListResponse: z.ZodObject<{
     assets: z.ZodArray<z.ZodObject<{
         id: z.ZodUUID;
@@ -412,10 +463,43 @@ declare const assetListResponse: z.ZodObject<{
         sha256: z.ZodString;
         created_at: z.ZodISODateTime;
     }, z.core.$strip>>;
+    active_sync: z.ZodNullable<z.ZodObject<{
+        sync_id: z.ZodUUID;
+        robot_id: z.ZodUUID;
+        state: z.ZodEnum<{
+            running: "running";
+            succeeded: "succeeded";
+            failed: "failed";
+        }>;
+        done: z.ZodNumber;
+        total: z.ZodNumber;
+        failed: z.ZodArray<z.ZodObject<{
+            reference: z.ZodString;
+            kind: z.ZodEnum<{
+                unresolvable: "unresolvable";
+                upload_failed: "upload_failed";
+                refused: "refused";
+                too_large: "too_large";
+            }>;
+            details: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+                limit_bytes: z.ZodNumber;
+                size_bytes: z.ZodNumber;
+            }, z.core.$strip>>>;
+        }, z.core.$strip>>;
+        reason: z.ZodNullable<z.ZodString>;
+        started_at: z.ZodISODateTime;
+        updated_at: z.ZodISODateTime;
+    }, z.core.$strip>>;
     urdf: z.ZodObject<{
         present: z.ZodBoolean;
         mesh_count: z.ZodNumber;
-        missing: z.ZodArray<z.ZodString>;
+        missing: z.ZodArray<z.ZodObject<{
+            uri: z.ZodString;
+            element: z.ZodEnum<{
+                mesh: "mesh";
+                texture: "texture";
+            }>;
+        }, z.core.$strip>>;
     }, z.core.$strip>;
     urdf_available: z.ZodNullable<z.ZodBoolean>;
 }, z.core.$strip>;
@@ -459,9 +543,79 @@ type ParameterInvalidDetails = z.infer<typeof parameterInvalidDetails>;
  * list is the shared vocabulary, not a closed set, so a new refusal never
  * needs a contracts release before it can be reported honestly.
  */
-declare const ERROR_CODES: readonly ["not_found", "validation_error", "bad_request", "unknown_datapoint", "invalid_token", "protocol_mismatch", "invalid_frame", "duplicate_slug", "reserved_slug", "unknown_field_path", "unknown_type", "unknown_topic", "invalid_rate", "invalid_range", "config_conflict", "no_data", "robot_offline", "bridge_timeout", "unauthorized", "forbidden", "invalid_credentials", "token_expired", "token_revoked", "invite_expired", "invite_used", "email_taken", "identifier_taken", "weak_password", "not_a_member", "account_blocked", "busy", "parameter_invalid", "job_lost", "publisher_busy", "unknown_command", "not_subscribable", "camera_offline", "no_snapshot_yet", "live_unavailable", "wrong_kind", "not_recorded", "not_aggregatable", "quota_exceeded", "credential_in_use", "goal_timeout", "robot_in_use", "robot_deletion_partial", "job_queue_full", "invalid_uuid", "rate_limited", "tier_required", "token_spent", "service_timeout", "asset_missing", "asset_too_large", "dynamic_registration_disabled", "client_limit_reached", "identity_conflict", "identity_not_provisioned", "idp_unavailable", "mcp_disabled", "tool_not_available"];
+declare const ERROR_CODES: readonly ["not_found", "validation_error", "bad_request", "unknown_datapoint", "invalid_token", "protocol_mismatch", "invalid_frame", "duplicate_slug", "reserved_slug", "unknown_slug", "unknown_field_path", "unknown_type", "unknown_topic", "invalid_rate", "invalid_range", "config_conflict", "no_data", "robot_offline", "bridge_timeout", "unauthorized", "forbidden", "invalid_credentials", "token_expired", "token_revoked", "invite_expired", "invite_used", "email_taken", "identifier_taken", "weak_password", "account_blocked", "busy", "parameter_invalid", "job_lost", "publisher_busy", "unknown_command", "not_subscribable", "camera_offline", "no_snapshot_yet", "live_unavailable", "wrong_kind", "not_recorded", "not_aggregatable", "quota_exceeded", "credential_in_use", "goal_timeout", "robot_in_use", "robot_deletion_partial", "job_queue_full", "invalid_uuid", "rate_limited", "tier_required", "token_spent", "service_timeout", "asset_missing", "asset_too_large", "dynamic_registration_disabled", "client_limit_reached", "identity_conflict", "identity_not_provisioned", "idp_unavailable", "mcp_disabled", "tool_not_available", "capability_required", "last_owner", "group_not_deletable", "group_in_use", "target_state_conflict", "mcp_access_denied", "signup_closed"];
 type ErrorCode = (typeof ERROR_CODES)[number];
 
+/**
+ * **What an end user sees about their own consents, and why it is not
+ * `consentGrant` (W9c, DEF-099).**
+ *
+ * `consentGrant` is the *record* — four ids and a scope string. A person
+ * deciding whether to revoke something needs to recognise it, and an id is
+ * not recognisable. So this carries the names that were on the screen when
+ * they consented: the client's, the app's, and the role's.
+ *
+ * `client_id` stays, because it is what a revocation addresses — the names
+ * are for reading, the id is for acting.
+ */
+declare const consentGrantSummary: z.ZodObject<{
+    client_id: z.ZodString;
+    client_name: z.ZodString;
+    app_id: z.ZodUUID;
+    app_name: z.ZodString;
+    role_id: z.ZodUUID;
+    role_name: z.ZodString;
+    scope: z.ZodString;
+    granted_at: z.ZodISODateTime;
+}, z.core.$strip>;
+type ConsentGrantSummary = z.infer<typeof consentGrantSummary>;
+/**
+ * **Revoking one grant must end the access it authorised, not merely forget
+ * that it happened (W9c, DEF-099).**
+ *
+ * The register row is about a user who wants a specific client to stop, and
+ * the failure mode to avoid is a revocation that deletes the consent row
+ * while every already-issued token keeps working until it expires. So the
+ * response says what was actually ended, and a caller can tell *nothing
+ * matched* from *matched and ended*.
+ *
+ * `tokens_revoked` is the count of refresh **families** ended. It is not a
+ * count of access tokens, and deliberately so: an access token is stateless
+ * and short-lived, and a number that claimed to have revoked one would be the
+ * kind of sentence this project keeps having to take back.
+ *
+ * **What actually happens to the access token is stronger than this comment
+ * first claimed, and narrower than its correction (W9c, 2026-08-19).** The
+ * first version said *"let the access token expire"*. It does not. The
+ * correction then said *"the same access token dies"*, which is true and
+ * under-specified — Data-W9c read `resolveAnyToken` instead of copying the
+ * sentence and found what the check is actually bound to:
+ *
+ *   `if (claims.client_id) { ...consent-grant lookup... }`
+ *
+ * So the immediate death is scoped to **`client_id`, not to a session and not
+ * to the end user.** Every currently-valid token issued through *this
+ * client's* OAuth flow for this end user dies at once — including a second
+ * tab holding a different token from the same client. A plain `auth.login()`
+ * session is untouched, because it carries no `client_id` for the check to
+ * read, and a token bound to a *different* client is untouched too.
+ *
+ * That distinction is the whole point of revoking one grant rather than
+ * logging somebody out: *"without touching any other client's access"* is
+ * what this route promises, and the check is what makes it true.
+ *
+ * That is a better outcome than the contract promised, and it is written down
+ * here for one reason: **a caller must not build on the weaker sentence.** If
+ * this platform ever moves to stateless verification without the revocation
+ * re-check, the access token would start living out its TTL again, and
+ * anything that quietly relied on immediate death would break silently.
+ */
+declare const consentRevokeResponse: z.ZodObject<{
+    revoked: z.ZodBoolean;
+    tokens_revoked: z.ZodNumber;
+}, z.core.$strip>;
+type ConsentRevokeResponse = z.infer<typeof consentRevokeResponse>;
+
 /**
  * Codes the SDK produces itself rather than relaying from the server. Kept
  * out of `@fleetless/contracts`' `ERROR_CODES` deliberately — that list is
@@ -771,7 +925,15 @@ interface UrdfSceneResources {
      */
     urdfText: string;
     /**
-     * The same reference strings `assets.list()`'s `urdf.missing` reports.
+     * The same entries `assets.list()`'s `urdf.missing` reports — verbatim,
+     * not reduced to bare strings (W9b, DEF-081). Each carries `element`
+     * (`'mesh' | 'texture'`) alongside `uri`: before this, both kinds arrived
+     * as an undifferentiated `string[]` and a caller could only ever say "N
+     * meshes missing", wrongly, for a URDF whose gap was actually a texture —
+     * the same defect W9b fixed one layer up, in the console. Reducing this
+     * field back to `string[]` here would throw the distinction away again at
+     * exactly the point a caller would render it. If you only need the URIs,
+     * `missing.map(m => m.uri)`.
      *
      * **Top-level only — not a `.dae`'s internal references (Kassandra-W7a
      * review correction).** The cloud builds this list from the URDF text
@@ -791,7 +953,7 @@ interface UrdfSceneResources {
      * reference NOT in this list that still fails to load at render time is a
      * different failure — the store answered but the fetch itself did not.
      */
-    missing: string[];
+    missing: UrdfCompleteness['missing'];
     /**
      * Revokes every `blob:` URL this call created. Call once the scene has
      * finished loading (success or failure) or on unmount — safe to call more
@@ -816,6 +978,28 @@ interface AssetsApi {
      * workspace by hand, the URIs are what they can act on.
      */
     list(robotId: string): Promise<AssetListResponse>;
+    /**
+     * The status of one sync by id — for **reconnecting** to a sync already in
+     * flight, not for starting one (W9b, DEF-147).
+     *
+     * **Starting a sync stays out of this SDK, on purpose (spec §4.6):**
+     * "übertragen wird ausschließlich auf explizite Anforderung des
+     * Entwicklers über die Console" — a developer action, Owner-tier, done
+     * once, from the console. This method is a different thing: `list()`'s
+     * `active_sync` (or a `busy` refusal's `assetSyncBusyDetails`) hands a
+     * caller a `sync_id` for a sync that is **already running**, and before
+     * this method existed there was no way for anything built on this SDK to
+     * do anything with that id except throw it away. That was the actual
+     * shape of DEF-147: the id was recoverable server-side the whole time
+     * (`GET .../assets/sync/{id}` has existed since W7) — nothing reachable
+     * from this SDK ever called it.
+     *
+     * A page reload is the case this exists for: whatever held the `sync_id`
+     * in memory is gone, `list()` (or a fresh `busy` refusal) hands it back,
+     * and this is how a caller resumes watching the same sync instead of
+     * either losing the progress bar or being told to start a second one.
+     */
+    syncStatus(robotId: string, syncId: string): Promise<AssetSyncStatus>;
     /** One asset's bytes by id — a mesh, or any asset directly, addressed the same way `createMeshLoader` reaches one internally. */
     get(robotId: string, assetId: string): Promise<AssetBytes>;
     /**
@@ -1026,17 +1210,46 @@ interface BeginHostedLoginOptions {
     redirectUri: string;
     scope?: string;
     /**
-     * RFC 8707 audience binding (register row, W7b→W7c): the resource this
-     * session's token should be usable against — an MCP endpoint
-     * (`/mcp/<app>`, W7c) or another audience-checking resource this
-     * deployment validates. **Omit it for an ordinary app login.** A token
-     * with no `resource` carries no `aud` and works unrestricted against this
-     * app's own REST surface exactly as it always has; that path is
-     * unaffected by this field's existence. Only a caller that is itself
-     * going to present the token to an audience-checking resource needs to
-     * ask for one — and must ask for the *right* one, because `/mcp/<app>`
-     * refuses a token whose `aud` names a different app exactly as hard as it
-     * refuses a token with none at all.
+     * RFC 8707 audience binding (register row, W7b): the resource this
+     * session's token should be usable against. **Omit it for an ordinary app
+     * login.** A token with no `resource` carries no `aud` and works
+     * unrestricted against this app's own REST surface exactly as it always
+     * has; that path is unaffected by this field's existence. Only a caller
+     * that is itself going to present the token to an audience-checking
+     * resource needs to ask for one.
+     *
+     * **`/oauth/authorize` accepts exactly two shapes** — anything else is
+     * refused with `invalid_target` on the redirect back, before a code is
+     * ever issued (`cloud/src/routes/oauth.ts`, `isKnownResource`):
+     *
+     * - `<base>/mcp-stub/resource` — the global OAuth resource stub, matched
+     *   byte-for-byte.
+     * - `<base>/mcp-stub/resource/<app_identifier>` — the per-app stub, and
+     *   only for **the calling client's own app**. This is an existence check
+     *   plus an ownership check, not a shape check: the app must exist *and*
+     *   be the one this `clientId` is registered to, so a client on app A can
+     *   never be minted a token whose `aud` names app B.
+     *
+     * Both are served and validated by
+     * `cloud/src/routes/oauth-resource-stub.ts`, whose validator refuses a
+     * token with **no** `aud` exactly as hard as one with the wrong `aud` —
+     * "unscoped" must never read as "for me" — comparing by equality, never
+     * by prefix.
+     *
+     * **`<base>/mcp/<app_identifier>` is not a resource any more.** There is
+     * no per-app MCP endpoint: the cloud registers one central, non-parametric
+     * `POST /mcp` (`cloud/src/routes/mcp.ts`, contracts'
+     * `MCP_ENDPOINT_PATH`), and the `/oauth/authorize` branch that used to
+     * accept a `/mcp/<app>` resource was deleted along with the app-level
+     * `mcp_enabled` flag. Asking for one now yields `invalid_target` for
+     * every app, **including your own**. The central MCP endpoint has its own
+     * OAuth flow (`cloud/src/routes/mcp-oauth.ts`) which this SDK's hosted
+     * login does not drive — `beginHostedLogin` always targets
+     * `OAUTH_PATHS.authorize`.
+     *
+     * Whatever you name here is re-checked at the token exchange: it must
+     * match what the code was authorized for, and it must still name a
+     * resource this client may be issued a token for.
      */
     resource?: string;
 }
@@ -1089,6 +1302,54 @@ interface CompleteHostedLoginOptions {
      */
     resource?: string;
 }
+/**
+ * What `logout()` resolves with (W9c, DEF-098) — five separable facts, not
+ * one nullable URL, mirroring the wire's `clientLogoutResponse`.
+ *
+ * `idp_logout` is `null` exactly when `revoked` is `false`: the server call
+ * that would have produced it never got a chance to answer (no local
+ * session, or the request itself failed), so there is nothing to report —
+ * not even "not federated", because this client never learned that either.
+ * When `revoked` is `true` and a real response came back, `idp_logout` is
+ * one of:
+ *
+ * - `{ status: 'redirect', url }` — send the browser here to end the
+ *   session at the IdP too. Nothing else in this SDK does that navigation
+ *   for you (same "this SDK is thin" reasoning as `cameras.live`).
+ * - `{ status: 'not_federated' }` — this session never came from an IdP;
+ *   there is nothing else to end.
+ * - `{ status: 'unsupported_by_idp' }` — it did, and the IdP publishes no
+ *   `end_session_endpoint` (RP-initiated logout is optional in OIDC).
+ * - `{ status: 'hint_unavailable' }` — it did, the IdP *can* end the
+ *   session, and Fleetless has nothing to ask it with: the stored
+ *   `id_token_hint` could not be decrypted, or the session predates the fix
+ *   that started keeping one.
+ * - `{ status: 'session_unknown' }` — the server did not find this session at
+ *   all (the token was unknown, already superseded, revoked, or expired), so
+ *   it can say **nothing** about an IdP.
+ *
+ * **`unsupported_by_idp` and `hint_unavailable` both mean the IdP session
+ * survives and this platform cannot end it** — do not render either one the
+ * same as `not_federated`; that reports a session as fully ended when it
+ * isn't.
+ *
+ * **`session_unknown` is a different kind of nothing, and the reason it
+ * exists is a second logout** (W9 review). A double click, a repeated POST, an
+ * app that logs out on unmount *and* on a route change: the last call wins,
+ * and before this outcome existed it answered `not_federated` — a positive
+ * claim about an IdP the server had never looked up. An app that treats it as
+ * *"fully logged out"* skips a redirect the **first** call may well have
+ * returned, and the user stays signed in at the IdP after clicking log out.
+ *
+ * Note that `revoked` cannot help you here: it reports whether the HTTP call
+ * succeeded, not whether a session was found — so this case arrives as
+ * `{ revoked: true, idp_logout: { status: 'session_unknown' } }`, never as the
+ * `null` below.
+ */
+interface LogoutResult {
+    revoked: boolean;
+    idp_logout: ClientLogoutResponse['idp_logout'] | null;
+}
 interface AuthApi {
     /** Exchanges email + password, and the client's configured app identifier, for a session. */
     login(email: string, password: string): Promise<void>;
@@ -1197,64 +1458,40 @@ interface AuthApi {
      * change, a block, or a membership removal take effect on the very next
      * request without a fresh token), not a bug — but a kiosk or shared
      * workstation needs to know that number.
-     */
-    logout(): Promise<{
-        revoked: boolean;
-    }>;
-    /** Who the caller turned out to be, without decoding a token client-side. */
-    me(): Promise<ClientIdentity>;
-    /**
-     * Starts self-registration into this app's pool (spec §3.2, W6c) — the
-     * second of the pool's two entry paths, alongside a console invitation.
-     * Sets the password here; `confirmRegistration` below only ever sees a
-     * token.
-     *
-     * **This does not log the caller in — there is no session yet.** A domain
-     * filter says *which* domains may register, never *whether the caller
-     * owns the address*, so minting a session here would let anybody who
-     * knows an allowed domain register as somebody else at it and receive
-     * whatever role the app assigns — which on this platform can mean
-     * permission to move a robot. So this mails a confirmation link and waits;
-     * `confirmRegistration(token)` is what proves the address and returns a
-     * session, the same two-step shape as `requestPasswordReset` /
-     * `confirmPasswordReset` below.
      *
-     * **Resolves identically for an address that is new and one that already
-     * has an account** — same account-enumeration reasoning as
-     * `requestPasswordReset`. `mail` in the resolved value describes this
-     * deployment's mail configuration, not the address, so it is safe to
-     * read — but note that a deployment with no SMTP (`mail:
-     * 'not_configured'`) cannot complete a self-registration at all: unlike
-     * an invitation, where a developer can hand the link over directly, the
-     * confirmation link has no other channel.
+     * **Nor does it end a federated session at the identity provider (W9c,
+     * DEF-098).** Ending the Fleetless session and ending the IdP session are
+     * two different things — see `LogoutResult.idp_logout`. This method does
+     * not act on that information itself (no redirect, no fetch to the IdP);
+     * it only reports what the server found, the same "this SDK stays thin"
+     * boundary as everywhere else (`cameras.live` hands back a URL and a
+     * token and stops there too).
      *
-     * **The role is not yours to choose.** There is no `role` parameter: the
-     * app's own `selfRegistration.role_id` decides it (§3.2 — a pool member
-     * has exactly one role per app), and a signature that accepted one would
-     * be offering a choice the platform has to refuse anyway.
+     * **`idp_logout` is `null` when there was no server answer to report** —
+     * and that is *not* the same as `revoked === false`.
      *
-     * **Fails the same way whether self-registration is off or the address's
-     * domain is not permitted.** Those two refusals are deliberately
-     * indistinguishable, for the same reason as above: telling them apart
-     * would let a caller probe configuration that is not theirs to see. Do
-     * not build a UI that tries to tell "this app doesn't allow sign-ups"
-     * apart from "your email domain isn't allowed" from the error alone.
+     * This block used to state the biconditional (*"`null` exactly when
+     * `revoked` is `false`"*), and **it is measurably wrong** (Argus-W9, W9
+     * review): calling `logout()` with **no local session** returns
+     * `{ revoked: true, idp_logout: null }`. The implementation says so six
+     * lines above itself — *"Nothing to revoke: no server-side session lingers,
+     * so this counts as revoked — but there is no IdP fact to report either"* —
+     * so the public docblock and the code contradicted each other in one file.
      *
-     * Behind the same limiter as `login` (`rate_limited`, W6c) — creating a
-     * row is the cheapest attack this platform has to defend against, so
-     * expect this to be throttled first under load, not last.
-     */
-    register(email: string, password: string): Promise<ClientRegisterResponse>;
-    /**
-     * Spends a self-registration confirmation token and returns the new
-     * session — the counterpart to `register` above. Stores the session
-     * exactly like `login`, so a caller who has just confirmed is not then
-     * told to log in separately.
+     * That mattered more than a wrong sentence usually does, because **this is
+     * the rule the text tells a caller to branch on**. Someone who reads
+     * `revoked === true` and trusts the promise does not expect `null`.
+     * TypeScript catches it (the type is `| null`); a JavaScript caller does
+     * not.
      *
-     * The token is single-use and expires; using it twice, or too late,
-     * answers `token_spent` either way, same as `confirmPasswordReset` below.
+     * So: **`null` means this client had nothing to send or the request never
+     * answered.** It is not `not_federated`, which is a real finding about a
+     * real session — conflating the two is the ambiguity this shape exists to
+     * remove, and it is still the reason to read both fields rather than one.
      */
-    confirmRegistration(token: string): Promise<void>;
+    logout(): Promise<LogoutResult>;
+    /** Who the caller turned out to be, without decoding a token client-side. */
+    me(): Promise<ClientIdentity>;
     /**
      * Changes the current end user's password (spec §3, W6c).
      *
@@ -1280,33 +1517,17 @@ interface AuthApi {
      */
     changePassword(currentPassword: string, newPassword: string): Promise<void>;
     /**
-     * Requests a password-reset link for `email` (spec §3, W6c) — sent by
-     * mail; the console-issued link is the primary path, this is the
-     * self-service one.
-     *
-     * **Resolves the same way whether or not `email` belongs to an account,
-     * and always did — this is not a bug to work around.** It is the one
-     * unauthenticated route in this SDK where revealing existence would be an
-     * account-enumeration oracle (see `passwordResetRequest`'s doc comment in
-     * `@fleetless/contracts`). There is nothing in this method's return value
-     * or its error codes that distinguishes "sent" from "no such account" —
-     * do not build a UI branch for "no such account" here, because there is
-     * nothing to branch on, on purpose.
-     */
-    requestPasswordReset(email: string): Promise<void>;
-    /**
-     * Completes a password reset using the token from the emailed link (spec
-     * §3, W6c).
+     * The hosted password-reset page, served by the platform on the API
+     * origin (`/reset-password`). An app links a user there; nothing is
+     * called. The two former methods that posted to `/api/client/password/…`
+     * are gone with the routes they named (2.0.0).
      *
-     * The token is single-use and expires; using it twice, or too late,
-     * answers `token_spent` either way — deliberately one code for both (see
-     * `ERROR_CODES` in `@fleetless/contracts`): telling them apart would tell
-     * a stranger whether a token ever existed, and the recovery is the same
-     * regardless — request a new link. Succeeding revokes every session of
-     * that identity, the same as `changePassword` — a forgotten password is
-     * one of the two states where somebody else may be holding a session.
+     * The page owns the whole flow — it takes the address, mails a
+     * single-use link, and takes the new password on the way back — so there
+     * is nothing for an app to sequence and nothing here that could reveal
+     * whether an address belongs to an account.
      */
-    confirmPasswordReset(token: string, newPassword: string): Promise<void>;
+    passwordResetUrl(): string;
 }
 
 /**
@@ -1531,6 +1752,58 @@ interface DatapointsApi {
     }): Promise<HistorySamplesResponse>;
 }
 
+/**
+ * An end user's own consent grants (spec §3.4/§17, W9c, DEF-099) — every
+ * client this identity has ever authorized, and the means to take one back
+ * without touching any of the others.
+ *
+ * **End-user only.** A server key acts with the app's own full rights and
+ * never went through a consent screen itself — there is no "self" here for
+ * it to list or revoke, same reasoning as `auth.login`/`auth.register` on a
+ * `serverKey` client.
+ */
+interface GrantsApi {
+    /**
+     * Every client this end user has consented to, most-recently-granted
+     * first. Each entry carries names, not only ids (`client_name`, `app_name`,
+     * `role_name`) — the id is what `revoke()` addresses, but a person
+     * deciding whether to revoke something needs to *recognise* it first, and
+     * an id is not recognisable. **`client_name` is not trusted** — a
+     * self-registered client chooses its own display name (W7c already
+     * measured what that buys: one called itself "Fleetless Official
+     * Helper") — do not render it as if Fleetless vouched for it.
+     */
+    list(): Promise<ConsentGrantSummary[]>;
+    /**
+     * Revokes one grant by the client's id — the `client_id` from a
+     * `list()` entry — without touching any other client's access.
+     *
+     * `revoked` tells "nothing matched" (`false`) from "matched and ended"
+     * (`true`) — revoking a grant that is already gone (a stale id, a double
+     * click) is not an error, just a no-op the caller can still tell apart
+     * from a real revocation. `tokens_revoked` counts refresh **families**
+     * ended, not access tokens — that count is deliberately never a claim
+     * about access tokens, which are stateless and short-lived by design.
+     *
+     * **What actually happens to an already-issued access token is stronger
+     * than that count implies, and it was measured, not assumed (W9c gate
+     * step 1, 2026-08-19, end to end through this SDK against a real
+     * cloud).** It does not simply expire on its own: the cloud re-checks
+     * every request for a revoked grant, so **any** currently-valid access
+     * token minted through this same client's OAuth flow for this end user
+     * — not only the one used to call `revoke()` — answers `401
+     * token_revoked` on its very next request, no wait for its TTL. This is
+     * scoped to that one client: a session that never went through this
+     * client's consent (a plain `auth.login()` session, or one bound to a
+     * different client) carries no trace of this client's id and is
+     * unaffected. Do not build on the weaker "it will expire eventually" —
+     * if this platform ever moves to stateless verification without that
+     * re-check, this immediacy would go away silently, which is exactly why
+     * it is written down here instead of left implied.
+     */
+    revoke(clientId: string): Promise<ConsentRevokeResponse>;
+}
+
 interface JobsApi {
     /**
      * Every job the platform currently believes this robot has — `GET
@@ -1653,6 +1926,8 @@ interface FleetlessClientConfig {
 interface FleetlessClient {
     readonly config: FleetlessClientConfig;
     readonly auth: AuthApi;
+    /** An end user's own consent grants (spec §3.4/§17, W9c) — not available on a `serverKey` client, same reasoning as `auth`'s session-only methods. */
+    readonly grants: GrantsApi;
     readonly datapoints: DatapointsApi;
     readonly actions: ActionsApi;
     readonly services: ServicesApi;
@@ -1678,4 +1953,4 @@ interface FleetlessClient {
 }
 declare function createClient(options: FleetlessClientOptions): FleetlessClient;
 
-export { type ActionsApi, type Asset, type AssetBytes, type AssetListResponse, type AssetsApi, type AuthApi, type BeginHostedLoginOptions, type BusyDetails, type CameraDescriptor, type CameraLiveSession, type CameraSnapshot, type CameraSnapshotMeta, type CamerasApi, type ClientIdentity, type ClientRegisterResponse, type CompleteHostedLoginOptions, type CreateMeshLoaderOptions, type DatapointEvent, type DatapointSubscription, type DatapointSubscriptionHandlers, type DatapointValue, type DatapointsApi, type FleetlessClient, type FleetlessClientConfig, type FleetlessClientOptions, FleetlessError, type FleetlessErrorCode, type FleetlessErrorOptions, type HistoryAggregation, type HistoryBucketsResponse, type HistoryOptions, type HistorySamplesResponse, type HostedLoginRequest, InMemoryTokenStore, type Job, type JobEvent, type JobState, type JobSubscription, type JobSubscriptionHandlers, type JobsApi, type MailStatus, type MeshLoaderDelegate, type ParameterInvalidDetails, type ParameterViolation, type PrepareUrdfSceneOptions, type PublishersApi, type RateLimitDetails, SDK_ERROR_CODES, type SdkErrorCode, type SendCommandOptions, type ServicesApi, type StoredSession, type TokenStore, type UrdfCompleteness, type UrdfSceneManager, type UrdfSceneResources, createClient, parameterInvalidDetails };
+export { type ActionsApi, type Asset, type AssetBytes, type AssetListResponse, type AssetsApi, type AuthApi, type BeginHostedLoginOptions, type BusyDetails, type CameraDescriptor, type CameraLiveSession, type CameraSnapshot, type CameraSnapshotMeta, type CamerasApi, type ClientIdentity, type CompleteHostedLoginOptions, type ConsentGrantSummary, type ConsentRevokeResponse, type CreateMeshLoaderOptions, type DatapointEvent, type DatapointSubscription, type DatapointSubscriptionHandlers, type DatapointValue, type DatapointsApi, type FleetlessClient, type FleetlessClientConfig, type FleetlessClientOptions, FleetlessError, type FleetlessErrorCode, type FleetlessErrorOptions, type GrantsApi, type HistoryAggregation, type HistoryBucketsResponse, type HistoryOptions, type HistorySamplesResponse, type HostedLoginRequest, InMemoryTokenStore, type Job, type JobEvent, type JobState, type JobSubscription, type JobSubscriptionHandlers, type JobsApi, type LogoutResult, type MeshLoaderDelegate, type ParameterInvalidDetails, type ParameterViolation, type PrepareUrdfSceneOptions, type PublishersApi, type RateLimitDetails, SDK_ERROR_CODES, type SdkErrorCode, type SendCommandOptions, type ServicesApi, type StoredSession, type TokenStore, type UrdfCompleteness, type UrdfSceneManager, type UrdfSceneResources, createClient, parameterInvalidDetails };