@fleetless/sdk 1.0.0 → 2.0.1

package/dist/index.js

@@ -319,9 +319,17 @@ function createAssetsApi(http) {
     const { body, headers } = await http.requestBinary(`/api/robots/${pathSegment(robotId)}/assets/${pathSegment(assetId)}`, { signal });
     return { body, mime: mimeFromContentType(headers) };
   }
+  async function syncStatus(robotId, syncId, signal) {
+    const response = await http.request(
+      `/api/robots/${pathSegment(robotId)}/assets/sync/${pathSegment(syncId)}`,
+      { signal }
+    );
+    return response;
+  }
   return {
     list,
     get,
+    syncStatus,
     async urdf(robotId) {
       const { body } = await http.requestBinary(`/api/robots/${pathSegment(robotId)}/urdf`);
       return new TextDecoder().decode(body);
@@ -403,7 +411,7 @@ function createAssetsApi(http) {
         if (pkg) knownPackages.add(pkg);
       }
       for (const ref of listResponse.urdf.missing) {
-        const pkg = packageNameOf(ref);
+        const pkg = packageNameOf(ref.uri);
         if (pkg) knownPackages.add(pkg);
       }
       const refusedObjectUrl = URL.createObjectURL(new Blob([]));
@@ -448,62 +456,69 @@ function createAssetsApi(http) {
   };
 }
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_367ffc97d258be510904ed62d5d477a4/node_modules/@fleetless/contracts/dist/common.js
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_1727a3f05719ef3ec49509ea01c84aa4/node_modules/@fleetless/contracts/dist/common.js
 import { z } from "zod";
-var slug = z.string().min(2).max(63).regex(/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/);
-var rosName = z.string().max(255).regex(/^\/[A-Za-z_][A-Za-z0-9_]*(?:\/[A-Za-z_][A-Za-z0-9_]*)*$/);
-var rosTypeName = z.string().max(255).regex(/^[a-z][a-z0-9_]*\/(?:msg|srv|action)\/[A-Za-z][A-Za-z0-9]*$/);
-var fieldPath = z.string().max(255).regex(/^[a-z_][a-z0-9_]*(?:\[\d+\])*(?:\.[a-z_][a-z0-9_]*(?:\[\d+\])*)*$/);
+var SLUG_RULE = "A name is lower-case: it starts with a letter, continues with letters and digits, and joins further words with a single underscore \u2014 `battery_voltage`. Capitals, dashes, dots, spaces, a leading digit and a doubled or trailing underscore are all refused.";
+var slug = z.string().min(2).max(63).regex(/^[a-z][a-z0-9]*(?:_[a-z0-9]+)*$/, SLUG_RULE);
+var ROS_NAME_RULE = "A ROS graph name is absolute: it begins with a slash, and each segment after a slash starts with a letter or an underscore and continues with letters, digits and underscores \u2014 `/camera/image_raw`. A relative name, a trailing slash, a dash or a dot is refused.";
+var rosName = z.string().max(255).regex(/^\/[A-Za-z_][A-Za-z0-9_]*(?:\/[A-Za-z_][A-Za-z0-9_]*)*$/, ROS_NAME_RULE);
+var ROS_TYPE_NAME_RULE = "A ROS 2 type name has three segments: the package, then `msg`, `srv` or `action`, then the type \u2014 `sensor_msgs/msg/BatteryState`, `std_srvs/srv/Trigger`, `nav2_msgs/action/NavigateToPose`. The middle segment is the one usually left out. The package is lower-case with underscores; the type itself is letters and digits, conventionally CamelCase.";
+var rosTypeName = z.string().max(255).regex(/^[a-z][a-z0-9_]*\/(?:msg|srv|action)\/[A-Za-z][A-Za-z0-9]*$/, ROS_TYPE_NAME_RULE);
+var FIELD_PATH_RULE = "A field path is dotted and lower-case, and each segment may index at most one array level \u2014 `voltage`, `pose.position.x`, `ranges[0]`. ROS 2 has no nested arrays, so a second index on one segment could name nothing that exists.";
+var fieldPath = z.string().max(255).regex(/^[a-z_][a-z0-9_]*(?:\[\d+\])?(?:\.[a-z_][a-z0-9_]*(?:\[\d+\])?)*$/, FIELD_PATH_RULE);
+var wireSeqCursor = z.union([z.string().regex(/^\d{1,19}$/), z.number().int()]).transform((v) => Number(v)).pipe(z.number().int().positive());
+var wireTimestampMs = z.union([z.string().regex(/^\d{1,15}$/), z.number().int()]).transform((v) => Number(v)).pipe(z.number().int().nonnegative().refine((ms) => {
+  const year = new Date(ms).getUTCFullYear();
+  return Number.isFinite(year) && year >= 1 && year <= 9999;
+}, "must fall within years 1..9999"));
+var applyErrorKind = z.enum(["datapoint", "action", "service", "publisher", "camera"]);
+var applyError = z.object({
+  slug: z.string(),
+  kind: applyErrorKind,
+  code: z.string().min(1).max(40),
+  message: z.string().min(1),
+  details: z.record(z.string(), z.unknown()).optional()
+});
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_367ffc97d258be510904ed62d5d477a4/node_modules/@fleetless/contracts/dist/mcp.js
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_1727a3f05719ef3ec49509ea01c84aa4/node_modules/@fleetless/contracts/dist/mcp.js
 import { z as z2 } from "zod";
 var mcpToolKind = z2.enum(["datapoint", "service", "action", "publisher", "camera"]);
-var MCP_TOOL_NAME_MAX = 128;
-var mcpToolNamePattern = /^[a-z0-9][a-z0-9_-]*$/;
-var mcpToolPreview = z2.object({
-  name: z2.string().min(1).max(MCP_TOOL_NAME_MAX).regex(mcpToolNamePattern),
-  /** The human-readable label — where the robot's actual name goes. */
-  title: z2.string().min(1).max(200),
-  /**
-   * **Four thousand, not two thousand, and the difference is the point.**
-   *
-   * `serviceDescription` bounds what a *developer writes* at 2000. This bounds
-   * what the *generator produces*, which is that text **plus** what it folds
-   * in — a datapoint's `Unit:` and `Plausible range:`, a camera's fixed
-   * sentence about snapshots. Measured by Kassandra-W7c and Momus-W7c
-   * independently: a maximal description came back at 2036–2068 characters
-   * against a 2000 bound, so the cloud served a document its own contract
-   * rejected — silently, because the route returns a typed literal without
-   * parsing it.
-   *
-   * **Do not "tidy" these two numbers into agreement.** They describe
-   * different things, and making them equal reintroduces the defect: either
-   * the generator truncates a developer's own words, or the response
-   * overflows again. The gap is the room the generator needs.
-   */
-  description: z2.string().min(1).max(4e3),
-  robot_id: z2.uuid(),
+var mcpExposure = z2.object({
   slug,
   kind: mcpToolKind,
-  input_schema: z2.unknown()
+  description: z2.string().max(2e3).nullable(),
+  /** A datapoint's `numeric.unit`, verbatim; `null` for every other kind and for a unitless datapoint. */
+  unit: z2.string().max(32).nullable(),
+  /**
+   * A datapoint's `numeric.decimals`, verbatim; `null` for every other kind
+   * and for a datapoint that does not set it. Required-nullable rather than
+   * optional for the same reason as `unit`: an omitted field would make a
+   * producer that forgot the datapoint's configuration indistinguishable from
+   * one reporting a datapoint that has none.
+   */
+  decimals: z2.number().int().min(0).max(6).nullable(),
+  input_schema: z2.unknown().nullable()
+});
+var mcpCapabilities = z2.object({
+  action_history: z2.boolean(),
+  assets: z2.boolean()
 });
-var mcpOmission = z2.object({
+var mcpRobotDatasheet = z2.object({
   robot_id: z2.uuid(),
-  slug,
-  /** One of `MCP_OMISSION_REASONS`; the wire allows any string, as with `ERROR_CODES`. */
-  reason: z2.string().min(1),
-  message: z2.string().min(1)
+  robot_name: z2.string().min(1).max(200),
+  capabilities: mcpCapabilities,
+  exposures: z2.array(mcpExposure).max(2e3)
 });
-var mcpToolPreviewResponse = z2.object({
+var mcpRolePreviewResponse = z2.object({
   role_id: z2.uuid(),
-  tools: z2.array(mcpToolPreview).max(500),
-  omitted: z2.array(mcpOmission).max(500)
+  robots: z2.array(mcpRobotDatasheet).max(500)
 });
+var MCP_ASSET_LINK_TTL_MS = 15 * 60 * 1e3;
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_367ffc97d258be510904ed62d5d477a4/node_modules/@fleetless/contracts/dist/protocol.js
-import { z as z7 } from "zod";
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_1727a3f05719ef3ec49509ea01c84aa4/node_modules/@fleetless/contracts/dist/protocol.js
+import { z as z8 } from "zod";
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_367ffc97d258be510904ed62d5d477a4/node_modules/@fleetless/contracts/dist/assets.js
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_1727a3f05719ef3ec49509ea01c84aa4/node_modules/@fleetless/contracts/dist/assets.js
 import { z as z3 } from "zod";
 var assetKind = z3.enum(["urdf", "mesh", "texture", "other"]);
 var asset = z3.object({
@@ -563,39 +578,24 @@ var urdfCompleteness = z3.object({
   present: z3.boolean(),
   /** How many distinct meshes the URDF references. */
   mesh_count: z3.number().int().nonnegative(),
-  missing: z3.array(z3.string().min(1))
-});
-var assetListResponse = z3.object({
-  assets: z3.array(asset),
-  urdf: urdfCompleteness,
   /**
-   * What the connected bridge says it *could* transfer, which is deliberately
-   * separate from what has been transferred (§4.6: the bridge "meldet nur
-   * Verfügbarkeit"). `null` when no bridge is connected — distinct from
-   * `false`, because "no robot is online to ask" and "the robot has no URDF"
-   * send a developer to two different places.
+   * **Was fehlt, und wovon (W9b, DEF-081).**
    *
-   * **All three states are reachable as of W7a (R7).** They were not: the bridge
-   * used to report availability from a subscription callback, which fires only
-   * when a publisher *sends* something, so it could notice presence and never
-   * absence — a robot that lost its URDF left the cloud holding the last thing
-   * it heard, forever, and `true` was sticky. The fix is an **active**
-   * `count_publishers` query on the bridge's own timer.
-   *
-   * **What a consumer still needs to know is the clock, not the gap.** An
-   * ungraceful loss — the publisher process killed rather than shut down — is
-   * noticed on **DDS's liveliness timeout**, not on the bridge's check
-   * interval. Measured against a real bridge: ~1.6 s when the publisher calls
-   * `destroy_node()`, **~19 s when it is `SIGKILL`ed**. So `true` can outlive
-   * the truth by some seconds after a crash, and no amount of polling on our
-   * side shortens it.
+   * Vorher ein blankes `string[]`. Die Console meldete daraufhin *„N meshes
+   * missing from the workspace"* — auch für eine fehlende **Textur**, während
+   * `mesh_count` daneben eine andere Zahl nannte: zwei Angaben über denselben
+   * Gegenstand, die einander widersprechen.
    *
-   * The sticky-`true` gap was found by Rosie-W7 checking her own work against
-   * the camera-health row of identical shape; the DDS clock was measured by
-   * Rosie-W7a closing it, and this comment was still describing the gap a wave
-   * after it was fixed (Momus-W7a, W7a review).
+   * Die Cloud wusste es die ganze Zeit: `extractReferencesByElement` markiert
+   * jede Referenz mit ihrem Element und `buildAssetListResponse` warf die
+   * Markierung wieder weg. **Die Antwort im Client zu raten wäre genau die
+   * „neue Kopie", die die Registerzeile ausdrücklich ablehnt** — eine zweite
+   * Herleitung derselben Tatsache, die von der ersten abweichen kann.
    */
-  urdf_available: z3.boolean().nullable()
+  missing: z3.array(z3.object({
+    uri: z3.string().min(1).max(500),
+    element: z3.enum(["mesh", "texture"])
+  }))
 });
 var assetSyncRequest = z3.object({
   source: z3.enum(["bridge"])
@@ -603,7 +603,12 @@ var assetSyncRequest = z3.object({
 var assetSyncResponse = z3.object({
   sync_id: z3.uuid()
 });
-var assetFailureKind = z3.enum(["unresolvable", "upload_failed", "refused"]);
+var ASSET_UPLOAD_MAX_BYTES = 64 * 1024 * 1024;
+var assetTooLargeDetails = z3.object({
+  limit_bytes: z3.number().int().positive(),
+  size_bytes: z3.number().int().positive()
+});
+var assetFailureKind = z3.enum(["unresolvable", "upload_failed", "refused", "too_large"]);
 var assetFailure = z3.object({
   /**
    * What could not be provided, verbatim — the same string `asset.name` would
@@ -613,7 +618,34 @@ var assetFailure = z3.object({
    * this list must not assume every entry is one.
    */
   reference: z3.string().min(1).max(500),
-  kind: assetFailureKind
+  kind: assetFailureKind,
+  /**
+   * **Die zwei Zahlen, und warum `too_large` eine eigene Art ist (W9b).**
+   *
+   * `refused` bedeutet *„nie versucht, weil eine Decke des Erzeugers erreicht
+   * wurde"* — das passt auf eine Datei, die wegen ihrer Größe gar nicht erst
+   * gelesen wurde, **und ebenso auf die Sammel-Sentinel**, mit der ein Sync
+   * aufhört, einzelne Fehler zu benennen. Beides unter eine Art zu legen wäre
+   * derselbe Fehler, den W9a eine Welle zuvor ausgeräumt hat: zwei Fakten auf
+   * einem Schlüssel, von denen jeder den anderen überschreibt.
+   *
+   * Und ein Grund ohne Zahlen ist kein Grund, mit dem jemand etwas anfangen
+   * kann. *„Zu groß"* beantwortet nicht, ob das Mesh zu verkleinern ist oder
+   * die Grenze zu heben — `limit_bytes` und `size_bytes` tun es.
+   *
+   * Abwesend für jede andere Art — ein erzwungenes `details: null` auf jedem
+   * `unresolvable` kauft nichts. Die Paarung ist unten **erzwungen**, nicht
+   * beschrieben: ein Feld, dessen Regel nur im Kommentar steht, ist eine
+   * Bitte.
+   */
+  details: assetTooLargeDetails.nullish()
+}).superRefine((f, ctx) => {
+  if (f.kind === "too_large" && f.details == null) {
+    ctx.addIssue({ code: "custom", path: ["details"], message: "`too_large` without limit_bytes/size_bytes says nothing a developer can act on" });
+  }
+  if (f.kind !== "too_large" && f.details != null) {
+    ctx.addIssue({ code: "custom", path: ["details"], message: "size details belong to `too_large` only" });
+  }
 });
 var assetSyncState = z3.enum(["running", "succeeded", "failed"]);
 var assetSyncStatus = z3.object({
@@ -672,121 +704,959 @@ var assetSyncStatus = z3.object({
   started_at: z3.iso.datetime(),
   updated_at: z3.iso.datetime()
 });
-var assetTooLargeDetails = z3.object({
-  limit_bytes: z3.number().int().positive(),
-  size_bytes: z3.number().int().positive()
+var assetListResponse = z3.object({
+  assets: z3.array(asset),
+  /**
+   * Der gerade laufende Sync, oder `null` (W9b, DEF-147).
+   *
+   * **Der Fall, für den das hier steht, ist der Neuladen-Fall.** Die Console
+   * hielt die `sync_id` nur im Speicher; ein Reload verlor die Fortschritts-
+   * anzeige, und der Zustand war serverseitig da, über
+   * `GET .../assets/sync/<id>` abfragbar — nur erreichte ihn niemand mehr, der
+   * die id nicht aufgehoben hatte. Eine Seite, die frisch lädt, drückt keinen
+   * Knopf; sie fragt diese Liste. Also muss die Liste es sagen.
+   */
+  active_sync: assetSyncStatus.nullable(),
+  urdf: urdfCompleteness,
+  /**
+   * What the connected bridge says it *could* transfer, which is deliberately
+   * separate from what has been transferred (§4.6: the bridge "meldet nur
+   * Verfügbarkeit"). `null` when no bridge is connected — distinct from
+   * `false`, because "no robot is online to ask" and "the robot has no URDF"
+   * send a developer to two different places.
+   *
+   * **All three states are reachable as of W7a (R7).** They were not: the bridge
+   * used to report availability from a subscription callback, which fires only
+   * when a publisher *sends* something, so it could notice presence and never
+   * absence — a robot that lost its URDF left the cloud holding the last thing
+   * it heard, forever, and `true` was sticky. The fix is an **active**
+   * `count_publishers` query on the bridge's own timer.
+   *
+   * **What a consumer still needs to know is the clock, not the gap.** An
+   * ungraceful loss — the publisher process killed rather than shut down — is
+   * noticed on **DDS's liveliness timeout**, not on the bridge's check
+   * interval. Measured against a real bridge: ~1.6 s when the publisher calls
+   * `destroy_node()`, **~19 s when it is `SIGKILL`ed**. So `true` can outlive
+   * the truth by some seconds after a crash, and no amount of polling on our
+   * side shortens it.
+   *
+   * The sticky-`true` gap was found by Rosie-W7 checking her own work against
+   * the camera-health row of identical shape; the DDS clock was measured by
+   * Rosie-W7a closing it, and this comment was still describing the gap a wave
+   * after it was fixed (Momus-W7a, W7a review).
+   */
+  urdf_available: z3.boolean().nullable()
 });
+var assetSyncBusyDetails = z3.object({
+  sync_id: z3.uuid(),
+  /** Wann er begann — damit „läuft noch" von „hängt seit einer Stunde" unterscheidbar ist. */
+  started_at_ms: z3.number().int().nonnegative()
+});
+
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_1727a3f05719ef3ec49509ea01c84aa4/node_modules/@fleetless/contracts/dist/config.js
+import { z as z5 } from "zod";
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_367ffc97d258be510904ed62d5d477a4/node_modules/@fleetless/contracts/dist/config.js
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_1727a3f05719ef3ec49509ea01c84aa4/node_modules/@fleetless/contracts/dist/alerts.js
 import { z as z4 } from "zod";
-var valueRule = z4.object({
-  min: z4.number().optional(),
-  max: z4.number().optional(),
-  enum: z4.array(z4.union([z4.string(), z4.number()])).min(1).optional(),
-  pattern: z4.string().optional(),
-  required: z4.boolean().optional()
-});
-var serviceDescription = z4.string().min(1).max(2e3).optional();
-var parameterDescription = z4.string().min(1).max(500).optional();
-var parameterSpec = z4.object({
-  /** Field path into the ROS request/goal/message — same grammar as a datapoint's. */
-  name: fieldPath,
-  /** The ROS type, for the console to render an input the developer recognises. */
-  type: z4.string().min(1).max(255),
-  rule: valueRule,
-  description: parameterDescription
-});
-var datapointRate = z4.discriminatedUnion("mode", [
-  z4.object({ mode: z4.literal("max_hz"), hz: z4.number().positive().max(100) }),
-  z4.object({ mode: z4.literal("on_change") })
+var alertRowCondition = z4.discriminatedUnion("kind", [
+  z4.strictObject({
+    kind: z4.literal("above"),
+    threshold: z4.number().finite(),
+    resolve_hysteresis: z4.number().nonnegative().default(0)
+  }),
+  z4.strictObject({
+    kind: z4.literal("below"),
+    threshold: z4.number().finite(),
+    resolve_hysteresis: z4.number().nonnegative().default(0)
+  }),
+  z4.strictObject({
+    kind: z4.literal("equals"),
+    /** A JSON scalar, matching what a datapoint value actually is on the wire — never an object or array. */
+    value: z4.union([z4.number(), z4.string(), z4.boolean()])
+  })
 ]);
-var datapointRange = z4.object({
-  min: z4.number().nullable(),
-  max: z4.number().nullable()
-});
-var datapointConfig = z4.object({
+var alertSeverity = z4.enum(["warning", "error"]);
+var alertState = z4.enum(["ok", "firing"]);
+var datapointAlertRow = z4.object({
+  id: z4.uuid(),
+  robot_id: z4.uuid(),
   slug,
-  topic: rosName,
-  type: rosTypeName,
-  field: fieldPath.nullable(),
-  rate: datapointRate,
-  unit: z4.string().max(32).nullable(),
-  scale: z4.number().nullable(),
-  offset: z4.number().nullable(),
-  range: datapointRange.nullable(),
-  description: serviceDescription,
-  /**
-   * Record this datapoint (spec §8). Recorded values go to the time-series
-   * store and are queryable through the history API; everything else is
-   * live-only and leaves no trace.
-   *
-   * **Exactly one representation of "not recorded": `false`.** W5 reserved
-   * this field as `z.null().optional()`, so stored documents may carry
-   * `retention: null` — the cloud normalises that to `false` on read rather
-   * than the contract accepting both, because two spellings of one fact is
-   * the defect this project has spent two waves removing.
-   *
-   * Defaulted so a document written before W6 still parses. Note that
-   * `.default()` publishes as `required` in the generated artifact — the
-   * fourth instance, deferred to W7 with the fix identified
-   * (`io: 'input'`, split per schema).
-   */
-  retention: z4.boolean().default(false),
-  /**
-   * What happens to this datapoint's values while the bridge is disconnected
-   * (spec §6.3). Buffered values are backfilled after reconnect — **after**
-   * live telemetry and job results, at a limited rate, so closing a gap can
-   * never delay what is happening now. An unbuffered datapoint simply has a
-   * gap, which is an honest answer and often the right one.
-   */
-  buffer: z4.object({
-    enabled: z4.boolean(),
+  name: z4.string().min(1).max(120),
+  enabled: z4.boolean(),
+  severity: alertSeverity,
+  condition: alertRowCondition,
+  state: alertState,
+  /** `null` only until the first evaluation writes a state; every alert is created `ok` (D2), so in practice this is set from creation onward. */
+  state_since: z4.iso.datetime().nullable(),
+  /**
+   * The value at the alert's last state transition — written only when the
+   * alert fires or resolves, never on a per-sample basis. This is a
+   * deliberate cost trade, not an oversight: a per-sample write would turn
+   * every accepted sample into a DB write regardless of whether anything
+   * changed, which is exactly the hot-path cost the evaluator avoids
+   * everywhere else. It follows that this is NOT "the datapoint's current
+   * value" — for that, read the live snapshot (`datapointValue`, or the
+   * realtime datapoint stream), never this field. `null` before the
+   * alert's first transition, and returns to `null` when a `PATCH`
+   * replaces `condition` wholesale — the old value was judged against the
+   * old condition, and the store resets runtime state in that same write
+   * rather than let it survive a condition change it no longer means
+   * anything against.
+   */
+  last_value: z4.unknown().nullable(),
+  created_at: z4.iso.datetime()
+});
+var alertListResponse = z4.object({
+  alerts: z4.array(datapointAlertRow)
+});
+var orgFiringAlertsResponse = z4.object({
+  alerts: z4.array(datapointAlertRow.extend({ robot_name: z4.string().min(1).max(63) }))
+});
+var datapointDisplay = z4.object({
+  y_min: z4.number().finite().nullable(),
+  y_max: z4.number().finite().nullable()
+});
+var putDatapointDisplayRequest = z4.object({
+  y_min: z4.number().finite().nullable(),
+  y_max: z4.number().finite().nullable()
+}).strict();
+
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_1727a3f05719ef3ec49509ea01c84aa4/node_modules/@fleetless/contracts/dist/config.js
+var RTSP_URL_RULE = "The URL has to begin with `rtsp://` or `rtsps://` \u2014 `rtsp://cam-1.plant.local/stream1`. No other scheme is accepted: the bridge opens this with a library that would equally honour `file:`.";
+var MJPEG_URL_RULE = "The URL has to begin with `http://` or `https://` \u2014 `http://cam-1.plant.local/video.mjpg`. No other scheme is accepted: the bridge opens this with a library that would equally serve `file:`.";
+var DEVICE_PATH_RULE = "A capture device is a path under `/dev/`, and the character straight after it is a letter or a digit \u2014 `/dev/video0`, or a stable `/dev/v4l/by-id/...` symlink. Nothing outside `/dev/` is accepted: the string reaches OpenCV, which would as happily open an ordinary file.";
+var mapKey = slug.meta({ patternErrorMessage: SLUG_RULE });
+var saysItIsMissing = (field) => {
+  const meta = z5.globalRegistry.get(field);
+  const def = { ...field._zod.def };
+  const inherited = def.error;
+  const carrier = def.type === "optional" || !field.safeParse(void 0).success ? field : z5.nonoptional(field);
+  const carrierDef = carrier === field ? def : { ...carrier._zod.def };
+  carrierDef.error = (issue) => {
+    const key = issue.path?.[issue.path.length - 1];
+    if (typeof key === "string" && absent(issue, key))
+      return `Missing required key \`${key}\`.`;
+    return typeof inherited === "function" ? inherited(issue) : inherited;
+  };
+  const cloned = carrier.clone(carrierDef);
+  if (meta !== void 0)
+    z5.globalRegistry.add(cloned, meta);
+  return cloned;
+};
+var absent = (issue, key) => issue.input === void 0 || issue.code === "invalid_union" && typeof issue.input === "object" && issue.input !== null && !Object.hasOwn(issue.input, key);
+var namesItsAbsence = (shape) => Object.fromEntries(Object.entries(shape).map(([key, field]) => [key, saysItIsMissing(field)]));
+var strictObject = (shape) => z5.strictObject(namesItsAbsence(shape));
+var slugKeyed = (entry) => z5.record(mapKey, entry, {
+  error: (issue) => {
+    if (issue.code !== "invalid_key")
+      return void 0;
+    const why = issue.issues.map((inner) => inner.message).filter(Boolean).join(" ");
+    return why.length === 0 ? void 0 : `\`${String(issue.input)}\` is not a valid name. ${why}`;
+  }
+});
+var describeValues = (values, table) => values.map((value) => table[value]);
+var param = (name) => `\\\${${name}}`;
+var underSlug = (slugKey, snippet) => ({ ...snippet, body: { [slugKey]: snippet.body } });
+var serviceDescription = z5.string().min(1).max(2e3).optional();
+var parameterDescription = z5.string().min(1).max(500).optional();
+var parameterType = z5.enum([
+  "bool",
+  "byte",
+  "char",
+  "int8",
+  "uint8",
+  "int16",
+  "uint16",
+  "int32",
+  "uint32",
+  "int64",
+  "uint64",
+  "float32",
+  "float64",
+  "string",
+  "wstring"
+]);
+var INTEGER_TYPES = /* @__PURE__ */ new Set(["byte", "char", "int8", "uint8", "int16", "uint16", "int32", "uint32", "int64", "uint64"]);
+var FLOAT_TYPES = /* @__PURE__ */ new Set(["float32", "float64"]);
+var STRING_TYPES = /* @__PURE__ */ new Set(["string", "wstring"]);
+var PARAMETER_SNIPPET = {
+  label: "a parameter, with its bounds",
+  description: "One hole a caller fills: what type it is, what values it may take, and what it means. Without a `default` it is required, and the bounds are enforced in the cloud before anything reaches the robot.",
+  body: {
+    type: "${2:float64}",
+    min_value: -0.5,
+    max_value: 0.5,
+    description: "${3:What a caller is choosing when they set this.}"
+  }
+};
+var parameterSpec = strictObject({
+  type: parameterType.meta({
+    description: "The ROS 2 primitive a value of this parameter must be, spelled the way ROS 2 spells it \u2014 `float64`, not `double`. It **decides which other constraints are allowed at all**: `min_value` and `max_value` need a numeric type, `regex` needs a string one, and a constraint on the wrong type is refused rather than quietly ignored.",
     /**
-     * Zero is legal and means "no depth" — it is what a disabled buffer
-     * carries. The invariant that matters is stated below: *enabled*
-     * implies a depth greater than zero.
+     * One sentence per value. The field's own paragraph is already the
+     * hover; these answer the different question the editor asks when the
+     * cursor is on **one** offer — what is this type, and what does choosing
+     * it allow. Written for the value, so `int32` states its range and
+     * `string` says it is the type a `regex` may constrain.
      */
-    max_values: z4.number().int().nonnegative().max(1e5)
-  }).refine((b) => !b.enabled || b.max_values > 0, {
-    message: "an enabled buffer needs max_values > 0",
-    path: ["max_values"]
-  }).default({ enabled: false, max_values: 0 })
-});
-var actionConfig = z4.object({
-  slug,
-  ros_name: rosName,
-  type: rosTypeName,
-  parameters: z4.array(parameterSpec).max(50),
-  description: serviceDescription
+    enumDescriptions: describeValues(parameterType.options, {
+      bool: "A `true`/`false` flag. The one type that takes no constraint at all: no bounds, no `regex`, no `enum`.",
+      byte: "One raw octet, `0` to `255`, carrying no character meaning. It counts as an integer here, so bounds and an `enum` apply to it.",
+      char: "A single-octet character code, `0` to `255`. ROS 2 keeps it apart from `byte` although the width is the same, and it travels as a number rather than as a one-character string.",
+      int8: "A whole number from `-128` to `127`.",
+      uint8: "A whole number from `0` to `255`.",
+      int16: "A whole number from `-32768` to `32767`.",
+      uint16: "A whole number from `0` to `65535`.",
+      int32: "A whole number from `-2147483648` to `2147483647` \u2014 the usual choice for a count or an index.",
+      uint32: "A whole number from `0` to `4294967295`.",
+      int64: "A whole number from `-9223372036854775808` to `9223372036854775807`.",
+      uint64: "A whole number from `0` to `18446744073709551615`.",
+      float32: "A single-precision number, roughly seven significant digits.",
+      float64: "A double-precision number, roughly fifteen significant digits. This is what other languages call `double`; ROS 2 spells it `float64` and so does this field.",
+      string: "Text, carried as UTF-8. One of the two types a `regex` may constrain.",
+      wstring: "Text as wide characters, and rare \u2014 nearly every ROS 2 interface uses `string`. It takes a `regex` on the same terms."
+    })
+  }),
+  default: z5.union([z5.number(), z5.string(), z5.boolean()]).meta({
+    description: "The value used when a caller omits this parameter: **without a `default` the parameter is required**, because the message cannot be built without it. It must itself satisfy `min_value`, `max_value`, `enum` and `regex` \u2014 a default the constraints reject is refused here rather than becoming the one value that reaches the robot unchecked."
+  }).optional(),
+  min_value: z5.number().meta({
+    description: "The lowest value a caller may send; numeric types only. It is **enforced in the cloud, before anything reaches the robot** \u2014 this is where a speed limit actually holds, rather than in the app that is supposed to respect it.",
+    examples: [-0.5]
+  }).optional(),
+  max_value: z5.number().meta({
+    description: "The highest value a caller may send; numeric types only, and it may not sit below `min_value`. A reversed pair is refused at parse time, because nothing downstream catches it and every call would then fail against a bound no value can satisfy.",
+    examples: [0.5]
+  }).optional(),
+  enum: z5.array(z5.union([z5.string(), z5.number()])).min(1).meta({
+    description: "The complete set of values a caller may send. Integer and string types only \u2014 **never a float**, because equality on floating point is unreliable and an enumerated float list is a trap that only shows up in operation. Every entry must match `type`, and a `default` must be one of them."
+  }).optional(),
+  regex: z5.string().min(1).meta({
+    description: "A pattern the value must match; string types only. It is compiled as a JavaScript regular expression and is **not anchored**, so `[a-z]+` accepts any value that merely contains a lowercase run \u2014 a pattern meant to cover the whole value writes its own `^` and `$`.",
+    examples: ["^[a-z_]+$"]
+  }).optional(),
+  description: parameterDescription.meta({
+    description: "What this parameter means, in the developer's own words, and documentation only \u2014 the robot does nothing with it. It travels into the input schema `robot_describe` publishes for this call, beside the bounds, so `type` and the range say what the value *is* and this is the only place that says what it *does*.",
+    /** The sentence `PARAMETER_SNIPPET` already places here, verbatim. */
+    examples: ["What a caller is choosing when they set this."]
+  })
+}).superRefine((p, ctx) => {
+  const numeric = INTEGER_TYPES.has(p.type) || FLOAT_TYPES.has(p.type);
+  const refuse = (path, why, code) => ctx.addIssue({ code: "custom", path, message: why, ...code ? { params: { code } } : {} });
+  const matchesType = (v) => {
+    if (p.type === "bool")
+      return typeof v === "boolean";
+    if (STRING_TYPES.has(p.type))
+      return typeof v === "string";
+    if (INTEGER_TYPES.has(p.type))
+      return typeof v === "number" && Number.isInteger(v);
+    return typeof v === "number" && Number.isFinite(v);
+  };
+  if (!numeric && (p.min_value !== void 0 || p.max_value !== void 0))
+    refuse(["min_value"], `min_value/max_value need a numeric type, not '${p.type}'`, "constraint_not_allowed_for_type");
+  if (!STRING_TYPES.has(p.type) && p.regex !== void 0)
+    refuse(["regex"], `regex needs a string type, not '${p.type}'`, "constraint_not_allowed_for_type");
+  if (p.enum !== void 0 && !(INTEGER_TYPES.has(p.type) || STRING_TYPES.has(p.type))) {
+    refuse(["enum"], `enum needs an integer or string type, not '${p.type}'`, "constraint_not_allowed_for_type");
+  } else if (p.enum !== void 0) {
+    p.enum.forEach((v, i) => {
+      if (!matchesType(v))
+        refuse(["enum", i], `enum entry does not match type '${p.type}'`, "value_type_mismatch");
+    });
+  }
+  if (p.default !== void 0 && !matchesType(p.default))
+    refuse(["default"], `default does not match type '${p.type}'`, "value_type_mismatch");
+  if (p.min_value !== void 0 && p.max_value !== void 0 && p.min_value > p.max_value)
+    refuse(["min_value"], "min_value is greater than max_value");
+  if (p.default !== void 0 && matchesType(p.default)) {
+    const d = p.default;
+    if (typeof d === "number") {
+      if (p.min_value !== void 0 && d < p.min_value)
+        refuse(["default"], `default ${d} is below min_value ${p.min_value}`);
+      if (p.max_value !== void 0 && d > p.max_value)
+        refuse(["default"], `default ${d} is above max_value ${p.max_value}`);
+    }
+    if (p.enum !== void 0 && !p.enum.some((v) => v === d))
+      refuse(["default"], "default is not one of the enum entries");
+    if (p.regex !== void 0 && typeof d === "string") {
+      let re;
+      try {
+        re = new RegExp(p.regex);
+      } catch {
+      }
+      if (re && !re.test(d))
+        refuse(["default"], "default does not match regex");
+    }
+  }
+}).meta({ defaultSnippets: [PARAMETER_SNIPPET] });
+var parameterMap = slugKeyed(parameterSpec).refine((m) => Object.keys(m).length <= 50, { message: "at most 50 parameters per entry" }).meta({
+  description: "The holes in this entry's `message` that a caller fills, keyed by **parameter name** rather than by field path \u2014 so the name survives the field moving inside the message, and a caller sends something that means what it says. Every declared parameter must appear somewhere in the message and every `${name}` in the message must be declared; either half alone is an error.",
+  /**
+   * **One snippet reaching three positions.** `parameters:` under an action,
+   * under a service and under a publisher are all this node, so the snippet
+   * is authored once here rather than three times on the three sections.
+   * Three copies that must agree is three chances to disagree, and the
+   * export inlines this object into all three positions — which
+   * `config-snippets.test.ts` asserts rather than assumes, because the way
+   * this comes apart is somebody later giving one section a `parameters:`
+   * snippet of its own.
+   *
+   * The body is `PARAMETER_SNIPPET` under its slug key — the same skeleton
+   * the entry position below offers, and the reasons behind every value in
+   * it are written there.
+   */
+  defaultSnippets: [underSlug("${1:speed}", PARAMETER_SNIPPET)]
 });
-var serviceConfig = z4.object({
-  slug,
-  ros_name: rosName,
-  type: rosTypeName,
-  parameters: z4.array(parameterSpec).max(50),
-  description: serviceDescription
+var alertCondition = strictObject({
+  fire_at: z5.union([z5.number().finite(), z5.string(), z5.boolean()]).meta({
+    description: "The value at which the alert starts firing. Alone it is an **equality**: it fires while the value equals `fire_at` and is ok again as soon as it differs, which is what makes a boolean or a string condition meaningful. Adding `resolve_at` turns it into a threshold instead.",
+    examples: [15, true]
+  }),
+  resolve_at: z5.number().finite().meta({
+    description: "The value at which a firing alert becomes ok again \u2014 allowed only when `fire_at` is a number, and it **must differ from it**. That gap is the hysteresis, and it makes the condition a threshold whose direction follows from which of the two values is higher. Without a gap a value sitting on the line flips on every sample.",
+    examples: [18]
+  }).optional()
+}).superRefine((c, ctx) => {
+  if (c.resolve_at === void 0)
+    return;
+  if (typeof c.fire_at !== "number")
+    ctx.addIssue({
+      code: "custom",
+      path: ["resolve_at"],
+      message: "resolve_at is only allowed when fire_at is a number",
+      params: { code: "invalid_condition" }
+    });
+  else if (c.resolve_at === c.fire_at)
+    ctx.addIssue({
+      code: "custom",
+      path: ["resolve_at"],
+      message: "resolve_at must differ from fire_at",
+      params: { code: "invalid_condition" }
+    });
 });
-var publisherConfig = z4.object({
-  slug,
-  topic: rosName,
-  type: rosTypeName,
-  parameters: z4.array(parameterSpec).max(50),
-  timeout_ms: z4.number().int().positive().max(6e4),
-  /** The message the bridge publishes on timeout. Shape is the ROS type's. */
-  failsafe: z4.unknown(),
-  quiet_timeout_ms: z4.number().int().nonnegative().max(6e5),
-  description: serviceDescription
-});
-var credentialRef = z4.string().min(1).max(64);
-var cameraSource = z4.discriminatedUnion("kind", [
-  z4.object({
-    kind: z4.literal("ros"),
-    topic: rosName,
-    /** `sensor_msgs/msg/Image` or `sensor_msgs/msg/CompressedImage`. */
-    type: rosTypeName
+var ALERT_SNIPPET = {
+  label: "an alert, with its condition",
+  description: "One whole alert: the label shown in place of its key, and the threshold with the gap that keeps it from flipping on every sample.",
+  body: {
+    condition: { fire_at: 15, resolve_at: 18 },
+    name: "${2:Battery low}"
+  }
+};
+var datapointAlert = strictObject({
+  condition: alertCondition.meta({
+    description: "When this alert fires and when it is ok again. It carries **no discriminator**: upper threshold, lower threshold or equality all follow from the two values in it. Editing it resets the alert to `ok` on the next publish, while a publish that leaves it untouched keeps the running state.",
+    /**
+     * **Two snippets, and the reason is the missing discriminator.** A
+     * threshold and an equality are the same shape here — one field apart —
+     * so a single skeleton would not merely be incomplete, it would hide one
+     * of the two things this field exists to express behind a `resolve_at`
+     * the developer has to know to delete. Offering both makes the choice the
+     * schema deliberately does not name into a choice the editor does.
+     *
+     * Both values come from `fire_at`'s own `examples`, which carry exactly
+     * this pair: `15` for the threshold and `true` for the equality.
+     *
+     * **The second snippet costs the `condition:` *key* completion its body,
+     * and that price is paid knowingly.** monaco-yaml's
+     * `getInsertTextForProperty` (`yaml.worker.js:8520`) takes
+     * `defaultSnippets[0].body` only when a node carries **exactly one**
+     * snippet, so accepting `condition` from the key list writes the bare key
+     * here where every other node this wave touched writes its whole block.
+     * The two stay anyway: the value position — a developer who has written
+     * `condition:` and pressed ⏎ — is where the question "what goes here?" is
+     * actually asked, and that is the position this wave exists to answer.
+     * Merging them into one would buy back the key completion by deleting the
+     * choice the schema deliberately does not name, which is the worse trade;
+     * anyone tempted to make it should change the key-completion behaviour
+     * knowingly rather than as a side effect of tidying two snippets into one.
+     */
+    defaultSnippets: [
+      {
+        label: "a threshold, with its hysteresis",
+        description: "Fires below 15 and is ok again above 18. The gap is what keeps a value sitting on the line from flipping on every sample; the direction follows from which of the two is higher, and nothing else declares it.",
+        body: { fire_at: 15, resolve_at: 18 }
+      },
+      {
+        label: "an equality",
+        description: "Fires while the value equals `fire_at` and is ok as soon as it differs \u2014 the only form a boolean or a string condition can take. No `resolve_at`: adding one would turn this into a threshold, and is refused unless `fire_at` is a number.",
+        body: { fire_at: true }
+      }
+    ]
+  }),
+  severity: alertSeverity.meta({
+    description: "How bad it is when this alert fires; absent means `warning`. It changes no behaviour \u2014 nothing is escalated, retried or delivered differently \u2014 it travels with the org event and colours the alert wherever it is shown.",
+    enumDescriptions: describeValues(alertSeverity.options, {
+      warning: "Worth seeing. This is what an alert that names no severity gets.",
+      error: "Worth acting on. The only difference from `warning` is how the alert is shown: the same event is written, at the same moment, to the same places."
+    })
+  }).optional(),
+  name: z5.string().min(1).max(120).meta({
+    description: "A human-readable label shown wherever this alert appears, in place of its bare key. It is not the alert's identity \u2014 the key is \u2014 so the label can be reworded freely, while changing the key deletes one alert and creates another.",
+    examples: ["Battery low"]
+  }).optional(),
+  enabled: z5.boolean().meta({
+    description: "Whether this alert is evaluated at all. Absent means on, the opposite of `retention.enabled`: an alert that is written down watches unless it is explicitly switched off, which is how one is silenced without losing the key that identifies it."
+  }).optional()
+}).meta({
+  /**
+   * The value position of one entry — `battery_low: ▮` under `alerts:`, which
+   * is where a developer adding a **second** alert by hand stands. The section
+   * snippet fires on the empty `alerts:` and never again.
+   */
+  defaultSnippets: [ALERT_SNIPPET]
+});
+var datapointNumeric = strictObject({
+  scale: z5.number().meta({
+    description: "A factor the robot multiplies the raw value by before sending it (`value * scale + offset`). The arithmetic happens once, at the source, so REST, realtime and history can never disagree about a number.",
+    examples: [100]
+  }).optional(),
+  offset: z5.number().meta({
+    description: "A constant the robot adds after `scale` (`value * scale + offset`), for a value whose zero sits in the wrong place. Like `scale` it is applied before sending, so history stores the converted value and a later correction cannot reach what is already stored.",
+    examples: [-273.15]
+  }).optional(),
+  unit: z5.string().max(32).meta({
+    description: "The unit of the value **after** `scale` and `offset`, not the robot's own. It is shown beside the value and carried by `robot_describe` as its own field, so a model does not have to guess whether 15 means percent, volts or minutes.",
+    examples: ["%"]
+  }).optional(),
+  decimals: z5.number().int().min(0).max(6).meta({
+    description: "How many fraction digits the console shows the value with \u2014 value tile, chart axis and tooltip, and the datapoint detail page \u2014 and the number `robot_describe` reports as its own field, so a model formats the value the way the console does. Presentation only: the stored value keeps the precision it arrived with, and absent means the console's own default rather than zero.",
+    examples: [1]
+  }).optional()
+});
+var datapointRetention = strictObject({
+  enabled: z5.boolean().meta({
+    description: "Whether values are written to the time series and become queryable. Off by default: without it the value is live only, and nobody who was not watching will ever see it."
+  }).optional(),
+  interval_seconds: z5.number().int().min(1).max(3600).meta({
+    description: "How often a value is written to history, in seconds; absent means `300`. **Not** how often it is sent \u2014 that is `rate_throttle_hz`. Stored points are billed, so this is the direct lever on what a robot costs, and a bumper that is true for 200 ms does not appear unless a write falls inside it.",
+    examples: [300, 60]
+  }).optional(),
+  max_buffer_values: z5.number().int().min(1).max(1e5).meta({
+    description: "How many values the robot holds while the bridge is disconnected, to be pushed once it reconnects. The catch-up runs behind live telemetry and job results at a limited rate, so closing a gap never delays the present; without it the series simply has a gap, which is an honest answer.",
+    examples: [5e3]
+  }).optional()
+});
+var chartStyle = z5.enum(["line", "step"]);
+var datapointChart = strictObject({
+  y_min: z5.number().finite().meta({
+    description: "A fixed floor for the chart's y axis; omitted, the axis scales to the data. `0` is a real floor and is read as `0`, never as unset.",
+    examples: [0]
+  }).optional(),
+  y_max: z5.number().finite().meta({
+    description: "A fixed ceiling for the chart's y axis; omitted, the axis scales to the data. It may not sit below `y_min`: a reversed pair is refused here because nothing downstream catches it, and the chart would render empty.",
+    examples: [100]
+  }).optional(),
+  style: chartStyle.meta({
+    description: "How the drawing joins two samples, which is not a matter of taste. `line` claims the value moved evenly between them, roughly true of a temperature or a charge; `step` holds and then jumps, the only honest drawing for a mode, a switch or a counter, where a straight line would show values that never existed.",
+    enumDescriptions: describeValues(chartStyle.options, {
+      line: "Straight lines between samples, so the drawing claims the value moved evenly from one to the next. Right for a quantity that really is continuous \u2014 a temperature, a charge level \u2014 where a reading taken between two samples would have landed somewhere on that line.",
+      step: "Each value is held until the next one arrives, then jumps to it. Right for anything that does not slide between its values \u2014 a mode, a state, a switch, a counter \u2014 where a sloped line would draw readings the robot never reported."
+    })
+  }).optional(),
+  default_window_minutes: z5.number().int().min(1).max(43200).meta({
+    description: "How far back the chart reaches when it is first opened, in minutes; absent means `60`. Only the starting zoom: a viewer may look further, and nothing about what is stored follows from it.",
+    examples: [1440]
+  }).optional()
+}).superRefine((c, ctx) => {
+  if (c.y_min !== void 0 && c.y_max !== void 0 && c.y_min > c.y_max)
+    ctx.addIssue({ code: "custom", path: ["y_min"], message: "y_min is greater than y_max" });
+});
+var rateThrottleHz = z5.number().nonnegative().max(20);
+var DATAPOINT_SNIPPET = {
+  label: "a datapoint",
+  description: "One value the robot publishes: one field of one topic.",
+  body: {
+    topic: "${2:/battery}",
+    type: "${3:sensor_msgs/msg/BatteryState}",
+    field: "${4:voltage}",
+    description: "${5:What this value is, for whoever meets it in the console.}"
+  }
+};
+var NUMERIC_DATAPOINT_SNIPPET = {
+  label: "a numeric datapoint, with history and a chart",
+  description: "A number with its unit, what is kept of it and how it is drawn \u2014 the blocks a plain datapoint leaves out.",
+  body: {
+    topic: "${2:/battery}",
+    type: "${3:sensor_msgs/msg/BatteryState}",
+    field: "${4:percentage}",
+    description: "${5:What this value is, for whoever meets it in the console.}",
+    /**
+     * The quotes inside `unit` are part of the inserted text and are not
+     * decoration. A body string is written into the document verbatim, and `%`
+     * is a YAML directive indicator: measured with `yaml` 2.9.0, `unit: %` is a
+     * **syntax error** ("Plain value cannot start with directive indicator
+     * character %") while `unit: "%"` parses to `%`. Nothing between here and
+     * the buffer quotes a scalar for us.
+     */
+    numeric: { scale: 100, unit: '"%"', decimals: 1 },
+    retention: { enabled: true, interval_seconds: 300 },
+    chart: { y_min: 0, y_max: 100, style: "line" }
+  }
+};
+var datapointConfig = strictObject({
+  topic: rosName.meta({
+    description: "The ROS topic this datapoint reads, as an absolute graph name. One datapoint reads **one** topic: a value assembled from two topics is not expressible here.",
+    patternErrorMessage: ROS_NAME_RULE,
+    examples: ["/battery"]
+  }),
+  type: rosTypeName.meta({
+    description: "The message type carried by `topic`, spelled the way ROS 2 spells it, with the `msg` segment in the middle \u2014 `sensor_msgs/msg/BatteryState`, never `sensor_msgs/BatteryState`. It is declared here rather than discovered, so a configuration can be written for a robot that has never been connected; the cloud checks it against the robot's own message definitions only once one is there.",
+    patternErrorMessage: ROS_TYPE_NAME_RULE,
+    examples: ["sensor_msgs/msg/BatteryState"]
   }),
-  z4.object({
-    kind: z4.literal("rtsp"),
+  field: fieldPath.meta({
+    description: "A dotted path into the message naming the single value this datapoint carries, each segment indexing at most one array level \u2014 `ranges[0]`, never `ranges[0][1]`, because ROS 2 has no nested arrays. Without it the datapoint is the whole message, and `numeric`, `chart` and `alerts` are then refused.",
+    patternErrorMessage: FIELD_PATH_RULE,
+    examples: ["voltage", "pose.position.x", "ranges[0]"]
+  }).optional(),
+  rate_throttle_hz: rateThrottleHz.meta({
+    description: "A ceiling on how often this datapoint is sent, in hertz. Omitted or `0` means no throttling. It is **a ceiling, not a clock**: a slow topic stays slow, a value is never repeated to manufacture a rate, and within a window the newest value wins. The bridge enforces it, so the robot's bandwidth is genuinely saved.",
+    examples: [2, 0.5]
+  }).optional(),
+  description: serviceDescription.meta({
+    description: "Prose about what this value is, for whoever meets it in the console later. It changes nothing the robot does, so a publish that touches only it pushes no configuration at all \u2014 but it is carried verbatim into `robot_describe`, where a model that has never seen this robot reads it. The datapoint is offered whenever the role grants it; without one it is offered with `description: null` and the model has less to go on, as for actions, services, publishers and cameras. Omission is the only way to say nothing; an empty string is refused, here and on all five.",
+    /**
+     * The sentence both datapoint snippets already place here, verbatim. Its
+     * four siblings — an action's, a service's, a publisher's, a camera's —
+     * each carry the sentence from their own snippet body, so this position
+     * was the one description in the format offering nothing; a second wording
+     * invented here would have been the drift instead.
+     */
+    examples: ["What this value is, for whoever meets it in the console."]
+  }),
+  numeric: datapointNumeric.meta({
+    description: "Arithmetic and formatting for a numeric value. `scale` and `offset` are applied **on the robot**, before sending, which is why REST, realtime and history all carry identical numbers. `unit` and `decimals` change nothing the robot does, so a publish that touches only those pushes no configuration.",
+    /**
+     * The quotes inside `unit` are inserted text, not decoration, for the
+     * reason spelled out on the `datapoints` snippet below: a body string is
+     * written to the buffer verbatim and a bare `%` is a YAML directive
+     * indicator, so `unit: %` is a syntax error where `unit: "%"` parses.
+     *
+     * **`offset` is not in the body, and that is a choice rather than an
+     * oversight.** All four fields carry `examples`, but they were authored
+     * per field and from two different conversions: `scale: 100` with
+     * `unit: '%'` is a 0..1 fraction shown as a percentage, while
+     * `offset: -273.15` is kelvin as celsius. A body holding both would
+     * insert arithmetic that means nothing and that a developer has to
+     * unpick before it means anything. The rule this file follows is that a
+     * skeleton carries what a developer opening the block almost certainly
+     * wants, at the node's own example values; the remaining keys arrive by
+     * ordinary key completion, which works here and never stopped working —
+     * the position that was silent is the *value* after `numeric:`.
+     */
+    defaultSnippets: [{
+      label: "a unit, and the arithmetic that produces it",
+      description: "A 0..1 fraction sent as a percentage to one decimal. `scale` is applied on the robot before sending, so history stores the converted value and a later correction cannot reach what is already stored.",
+      body: { scale: 100, unit: '"%"', decimals: 1 }
+    }]
+  }).optional(),
+  retention: datapointRetention.meta({
+    description: "What outlives the moment: whether this value is written to the time series, how often, and how many points the robot buffers while the bridge is away. Absent means no history at all \u2014 the value is live only.",
+    /**
+     * `enabled: true` is the only value that makes opening this block mean
+     * anything — absent already means off, so a skeleton inserting `false`
+     * would be a block that does nothing. It is a boolean and carries no
+     * `examples`; the direction comes from the schema comment above, which
+     * says why absent-means-off is the deliberate one.
+     *
+     * `interval_seconds: 300` restates the format's own default, on purpose:
+     * stored points are what a customer is billed for, so this is the direct
+     * lever on what a robot costs, and a developer who never sees the field
+     * never tunes it.
+     *
+     * **This body carries `max_buffer_values` and the composite `datapoints`
+     * snippet's `retention:` does not, deliberately.** The two answer
+     * different questions and the difference is the answer to each: the
+     * composite says *what a datapoint looks like*, where retention is one
+     * of three sub-blocks and the robot-side buffer is a tuning detail that
+     * would bury the shape it is there to show; this node is reached only by
+     * a developer who has written `retention:` and asked what goes in it, and
+     * for that question the buffer is a third of the answer. Neither is the
+     * corrected version of the other.
+     */
+    defaultSnippets: [{
+      label: "history, on, with its interval and buffer",
+      description: "Writes this value to the time series every 300 seconds and holds 5000 points on the robot while the bridge is away. Stored points are billed, so both numbers are worth choosing rather than inheriting.",
+      body: { enabled: true, interval_seconds: 300, max_buffer_values: 5e3 }
+    }]
+  }).optional(),
+  chart: datapointChart.meta({
+    description: "How the console draws this value over time: axis bounds, whether the line interpolates or steps, and the window a chart opens on. **Display only** \u2014 it changes no stored value, no alert and nothing the robot does, so a publish that touches only it pushes no configuration.",
+    /**
+     * `style` is a **choice**, not a literal, for the reason the camera
+     * source's `type` is one: the format offers a closed pair, the right
+     * answer depends on what the datapoint is, and the snippet cannot know.
+     * Its own description says the two are not a matter of taste — `line`
+     * claims the value moved evenly between two samples, `step` holds and
+     * jumps, and `step` is the only honest drawing for a mode, a switch or a
+     * counter. A snippet that picked `line` would draw values that never
+     * existed, and nothing would object: both are valid, no diagnostic
+     * fires, and the chart looks plausible.
+     *
+     * `Choice.toString()` is the first option, so a developer who tabs past
+     * this gets `line`, which is right for the continuous values most charts
+     * carry; one who opens the picker sees that `step` exists at all.
+     *
+     * The composite snippet on `datapoints` writes `style: 'line'` as a
+     * literal and stays that way — its body is a battery percentage, where
+     * `line` is not a guess.
+     *
+     * **`default_window_minutes` is left out, on the same rule that leaves
+     * `offset` out of `numeric` above**, and it is said here so that the two
+     * omissions read alike: it has its own `examples` (`1440`) and this
+     * node's description names it, but it is the one field of the four that
+     * decides nothing about the drawing — absent means 60, a viewer may look
+     * further whatever it says, and nothing about what is stored follows from
+     * it. Key completion offers it inside the block the moment anyone wants
+     * it; the position that was silent is the *value* after `chart:`.
+     */
+    defaultSnippets: [{
+      label: "axis bounds, and how two samples are joined",
+      description: "A fixed 0..100 axis rather than one that scales to the data, and a choice between interpolating and stepping between samples \u2014 which is not a matter of taste.",
+      body: { y_min: 0, y_max: 100, style: "${1|line,step|}" }
+    }]
+  }).optional(),
+  alerts: slugKeyed(datapointAlert).meta({
+    description: "Alerts watching this value, keyed by slug; each moves between `ok` and `firing` and writes an org event on every transition. No mail is sent. **The key is the identity**, so renaming an alert is a delete plus a create: its runtime state is lost, and an alert that is still true fires again.",
+    /**
+     * The body is `ALERT_SNIPPET` under its slug key — the same skeleton the
+     * entry position offers, and the reasons behind every value in it are
+     * written there. **The key is in the wrapper**, and it is the alert's
+     * identity: renaming it is a delete plus a create.
+     */
+    defaultSnippets: [underSlug("${1:battery_low}", ALERT_SNIPPET)]
+  }).optional()
+}).superRefine((d, ctx) => {
+  if (d.field !== void 0)
+    return;
+  for (const group of ["numeric", "chart", "alerts"]) {
+    if (d[group] !== void 0)
+      ctx.addIssue({
+        code: "custom",
+        path: [group],
+        message: `${group} needs a single field; without 'field' the value is the whole message`,
+        params: { code: "requires_single_field" }
+      });
+  }
+}).meta({ defaultSnippets: [DATAPOINT_SNIPPET, NUMERIC_DATAPOINT_SNIPPET] });
+function holdsExplicitNull(node) {
+  const stack = [node];
+  const seen = /* @__PURE__ */ new WeakSet();
+  while (stack.length > 0) {
+    const current = stack.pop();
+    if (current === null)
+      return true;
+    if (typeof current !== "object")
+      continue;
+    if (seen.has(current))
+      continue;
+    seen.add(current);
+    stack.push(...Array.isArray(current) ? current : Object.values(current));
+  }
+  return false;
+}
+var messageTemplate = z5.unknown().refine((v) => !holdsExplicitNull(v), {
+  message: "null is not a value; omit the key instead",
+  params: { code: "explicit_null" }
+}).meta({
+  description: 'The message as it will be sent, written out in full: literals are fixed, `${name}` is a hole a caller fills, and a field written `0.0` is one no client can change. Directly after `message:` a `${name}` standing alone names a shared message instead; anywhere inside a body it is a parameter. `null` is refused **at every depth** \u2014 omitting a key is the only spelling of "not set".'
+});
+var PLACEHOLDER_RE = /^\$\{([a-z][a-z0-9]*(?:_[a-z0-9]+)*)\}$/;
+var messageRef = z5.string().regex(PLACEHOLDER_RE).meta({
+  description: "A reference to a shared message: `${name}` and nothing else, which is what separates a reference from a literal \u2014 a bare word stays a literal even when it happens to match a declared name. Whether that name is declared, and whether it points at a body holding a second reference, are questions about the whole document and are answered in the cloud."
+});
+var messageBody = messageTemplate;
+function placeholderNames(node, found = /* @__PURE__ */ new Set()) {
+  const stack = [node];
+  const seen = /* @__PURE__ */ new WeakSet();
+  while (stack.length > 0) {
+    const current = stack.pop();
+    if (typeof current === "string") {
+      const m = PLACEHOLDER_RE.exec(current);
+      if (m)
+        found.add(m[1]);
+      continue;
+    }
+    if (!current || typeof current !== "object")
+      continue;
+    if (seen.has(current))
+      continue;
+    seen.add(current);
+    if (Array.isArray(current)) {
+      for (const item of current)
+        stack.push(item);
+    } else {
+      for (const value of Object.values(current))
+        stack.push(value);
+    }
+  }
+  return found;
+}
+var SHARED_MESSAGE_SNIPPET = {
+  label: "a shared message",
+  description: "One reusable body, with one parameter hole in it.",
+  body: {
+    linear: { x: param("speed") },
+    angular: { z: 0 }
+  }
+};
+var sharedMessageBody = messageTemplate.meta({ defaultSnippets: [SHARED_MESSAGE_SNIPPET] });
+var messageMap = slugKeyed(sharedMessageBody).refine((m) => Object.keys(m).length <= 200, { message: "at most 200 shared messages" }).meta({
+  description: "Reusable message bodies, keyed by name. A body is inserted by writing `${name}` directly after `message:`, may hold placeholders of its own, and **may not insert another** \u2014 which rules out cycles and lets every check look at exactly one body."
+});
+var ACTION_SNIPPET = {
+  label: "an action",
+  description: "One thing the robot does on request, reported as a job with progress.",
+  body: {
+    ros_name: "${2:/navigate_to_pose}",
+    type: "${3:nav2_msgs/action/NavigateToPose}",
+    description: "${4:Drives to a target pose on the map.}"
+  }
+};
+var actionConfig = strictObject({
+  ros_name: rosName.meta({
+    description: "The action server on the robot, as an absolute graph name \u2014 this is what the bridge sends the goal to. Clients never see it: they address this entry by its slug, so a server can be renamed on the robot without a single app changing.",
+    patternErrorMessage: ROS_NAME_RULE,
+    examples: ["/navigate_to_pose"]
+  }),
+  type: rosTypeName.meta({
+    description: "The action type `ros_name` implements, with the `action` segment in the middle \u2014 `nav2_msgs/action/NavigateToPose`, never `nav2_msgs/NavigateToPose`. Declared rather than introspected, so an action can be configured for a robot that has never connected; the cloud checks it against the robot's own definitions only once one is there.",
+    patternErrorMessage: ROS_TYPE_NAME_RULE,
+    examples: ["nav2_msgs/action/NavigateToPose"]
+  }),
+  message: messageBody.optional(),
+  parameters: parameterMap.optional(),
+  description: serviceDescription.meta({
+    description: "What this action does, in the developer's own words \u2014 documentation for the console and for MCP clients, which is all it is: the robot does nothing with it. It is carried verbatim into `robot_describe` and read by a model that has never seen this robot. The action is offered whenever the role grants it; without one it is offered with `description: null`, and the model has nothing but the slug.",
+    examples: ["Drives to a target pose on the map."]
+  })
+}).meta({
+  /** The value position of one entry — `navigate: ▮` under `actions:`. */
+  defaultSnippets: [ACTION_SNIPPET]
+});
+var SERVICE_SNIPPET = {
+  label: "a service",
+  description: "One request, one reply, no progress in between.",
+  body: {
+    ros_name: "${2:/reset_odometry}",
+    type: "${3:std_srvs/srv/Trigger}",
+    description: "${4:Resets odometry to the origin.}"
+  }
+};
+var serviceConfig = strictObject({
+  ros_name: rosName.meta({
+    description: "The ROS service the robot answers on, as an absolute graph name. The call is one request and one reply with no progress in between, so whatever this service does has to finish inside that reply; anything long-running belongs in `actions`.",
+    patternErrorMessage: ROS_NAME_RULE,
+    examples: ["/reset_odometry"]
+  }),
+  type: rosTypeName.meta({
+    description: "The service type `ros_name` implements, with the `srv` segment in the middle \u2014 `std_srvs/srv/Trigger`. A type whose request has no fields, like `Trigger`, needs neither `message` nor `parameters`: there is nothing to fill.",
+    patternErrorMessage: ROS_TYPE_NAME_RULE,
+    examples: ["std_srvs/srv/Trigger"]
+  }),
+  message: messageBody.optional(),
+  parameters: parameterMap.optional(),
+  description: serviceDescription.meta({
+    description: "What this service does, in the developer's own words. The robot does nothing with it \u2014 the readers are the console and MCP clients, and without one the service is still offered, with `description: null`, exactly as for an action. It sits on the configuration rather than on the app, so one wording is true for every app that reaches this robot.",
+    examples: ["Resets odometry to the origin."]
+  })
+}).meta({
+  /** The value position of one entry — `reset_odometry: ▮` under `services:`. */
+  defaultSnippets: [SERVICE_SNIPPET]
+});
+var PUBLISHER_SNIPPET = {
+  label: "a publisher, with its parameters and its failsafe",
+  description: "A topic clients may send to: what is fixed, what a caller fills, and what the bridge sends by itself once the caller falls silent.",
+  body: {
+    topic: "${2:/cmd_vel}",
+    type: "${3:geometry_msgs/msg/Twist}",
+    message: {
+      linear: { x: param("speed") },
+      angular: { z: param("turn") }
+    },
+    parameters: {
+      speed: { type: "float64", min_value: -0.5, max_value: 0.5, default: 0 },
+      turn: { type: "float64", min_value: -0.5, max_value: 0.5, default: 0 }
+    },
+    failsafe: {
+      timeout_ms: 500,
+      message: {
+        linear: { x: 0 },
+        angular: { z: 0 }
+      }
+    },
+    quiet_timeout_ms: 2e3,
+    description: "${4:Velocity command. If sending stops, the robot stops.}"
+  }
+};
+var publisherConfig = strictObject({
+  topic: rosName.meta({
+    description: "The ROS topic the message is published onto, as an absolute graph name. **No client ever names a topic**: a caller addresses this entry by its slug, so the topics an app can write to are exactly the ones written in this file.",
+    patternErrorMessage: ROS_NAME_RULE,
+    examples: ["/cmd_vel"]
+  }),
+  type: rosTypeName.meta({
+    description: "The message type of `topic`, spelled the way ROS 2 spells it, with the `msg` segment. It fixes the shape that `message` and `failsafe.message` must both fill, which is why one publisher carries one type and a second type needs a second publisher.",
+    patternErrorMessage: ROS_TYPE_NAME_RULE,
+    examples: ["geometry_msgs/msg/Twist"]
+  }),
+  message: messageBody,
+  parameters: parameterMap.optional(),
+  failsafe: strictObject({
+    timeout_ms: z5.number().int().positive().max(6e4).meta({
+      description: "How long the bridge waits for the client's next send before sending the failsafe message itself, in milliseconds. The deadline runs **on the robot**, so it still fires when the link to the cloud is what failed \u2014 which is the case it exists for.",
+      examples: [500, 1e3]
+    }),
+    message: messageBody.meta({
+      description: "What the bridge sends once `timeout_ms` runs out \u2014 for a drive command, a zero twist. It must be safe in **every** state, because it is sent precisely when nobody is watching any more, and it may hold no placeholder: there is no caller left to fill one."
+    })
+  }).refine((f) => typeof f.message === "string" || placeholderNames(f.message).size === 0, {
+    message: "the failsafe message must contain no placeholder: it is sent with no caller to fill one",
+    path: ["message"],
+    params: { code: "failsafe_has_parameters" }
+  }).meta({
+    description: "What the bridge sends **by itself** once a client stops sending, and how long it waits first. This is the format's safety story in one field: a client that crashes, loses its connection or whose operator closes the window does not leave a robot driving. The message may hold no placeholder, inline or through a shared message \u2014 there is nobody left to fill one.",
+    /**
+     * Both fields are required, so the body carries both: a `failsafe:` with
+     * only one of them is a publisher the format refuses, and this is the
+     * field where a document that does not publish is the least useful thing
+     * to hand somebody.
+     *
+     * The zero twist is the message this field's own description names, and
+     * the same body the composite `publishers` snippet inserts. Neither
+     * knows the publisher's ROS type — nothing at this position does — so
+     * the snippet offers the format's canonical safe message rather than
+     * guessing a shape. Every value in it is a literal: a placeholder here
+     * is refused outright (`failsafe_has_parameters`), because the message
+     * is sent with no caller left to fill one.
+     */
+    defaultSnippets: [{
+      label: "a deadline, and the message it sends",
+      description: "Half a second of silence and then a zero twist. The deadline runs on the robot, so it still fires when the link to the cloud is what failed \u2014 which is the case it exists for.",
+      body: {
+        timeout_ms: 500,
+        message: {
+          linear: { x: 0 },
+          angular: { z: 0 }
+        }
+      }
+    }]
+  }),
+  quiet_timeout_ms: z5.number().int().nonnegative().max(6e5).meta({
+    description: "How long this publisher must stay silent before a **different** user may send to it. Whoever sends holds it implicitly exclusive, with no session and no lock, so this one number is the whole handover policy: too short and two operators fight over one robot, too long and a crashed client blocks it for everyone.",
+    examples: [2e3]
+  }),
+  description: serviceDescription.meta({
+    description: "What sending to this publisher does, in the developer's own words. It is documentation for the console and for MCP clients \u2014 the robot does nothing with it \u2014 and as for actions and services, the publisher is offered whether or not one is written, with `description: null` when it is not. A caller sends here repeatedly and continuously rather than once, which is why this kind alone carries `failsafe` and `quiet_timeout_ms`.",
+    examples: ["Velocity command. If sending stops, the robot stops."]
+  })
+}).meta({
+  /** The value position of one entry — `drive: ▮` under `publishers:`. */
+  defaultSnippets: [PUBLISHER_SNIPPET]
+});
+var cameraCredentials = strictObject({
+  username: z5.string().min(1).max(128).optional().meta({
+    description: "The account name the camera expects. For MJPEG the bridge sends a real HTTP `Authorization: Basic` header and leaves the URL untouched. RTSP offers no such channel through ffmpeg, so there the name goes inside the connect URL instead \u2014 built fresh for that one call and never written back into the stored document.",
+    examples: ["ops"]
+  }),
+  password: z5.string().min(1).max(128).optional().meta({
+    description: "The password for `username`. **There is no secret store behind this**: the value written here is the value stored, so treat it as readable by everyone who may read this robot's configuration, now and in its history."
+  })
+}).meta({
+  description: "Username and password for the stream, standing **in clear text in the document**. A published version is immutable, so a password here cannot be removed from history or rotated without republishing \u2014 which is why the publish audit event carries only the version number and never the document body. Userinfo in the `url` works too; an explicit block here wins over it.",
+  defaultSnippets: [{
+    label: "username and password",
+    description: "Both fields, in clear text \u2014 which is what this block is. The password default is deliberately not a password: `CHANGE-ME` is stored like any other value, but it is **visible** rather than plausible, so a reviewer reading the diff sees it and the camera rejects it at connect time \u2014 where a default that looked like a password would simply be published and kept.",
+    /**
+     * `CHANGE-ME`, and not a plausible-looking password, because of what the
+     * comment above this schema records: a published version is immutable,
+     * so a password written here cannot be removed from history or rotated
+     * without republishing. This snippet is the one thing in the file that
+     * could manufacture such a version by itself — a developer who tabs past
+     * the placeholder publishes whatever the default was.
+     *
+     * What `CHANGE-ME` buys is **visibility, not a refusal**. It is stored
+     * exactly like any other value; nothing at publish time objects. What it
+     * does is fail at the camera, at connect time, and read wrong to anyone
+     * looking at the diff — where a plausible default is published and kept.
+     *
+     * The two alternatives were both worse. A plausible default (`secret`)
+     * reads in a diff like a value somebody chose, so nobody looks twice. A
+     * bare `$2` inserts the empty string, which `min(1)` refuses — that is
+     * loud, but it makes this the only snippet in the format that knowingly
+     * inserts an invalid document, and the guard that says none of them do
+     * would need an exception carved for it. A guard with an exception is not
+     * a guard. So the default stays valid and stays obviously wrong: no
+     * camera accepts it, and no reviewer reads past it.
+     *
+     * Both fields are `.optional()` — a bare `{}` parses — so nothing forces
+     * a default here at all. It is offered because a developer who opened
+     * this block wants both fields, and the snippet exists to save them the
+     * typing, not to decide anything.
+     */
+    body: {
+      username: "${1:ops}",
+      password: "${2:CHANGE-ME}"
+    }
+  }]
+});
+var rtspTransport = z5.enum(["tcp", "udp"]);
+var cameraSource = z5.discriminatedUnion("kind", [
+  strictObject({
+    kind: z5.literal("ros").meta({
+      description: "Selects the ROS image-topic source: this camera then carries `topic` and `type`, and no field of another kind."
+    }),
+    topic: rosName.meta({
+      description: "The ROS image topic the bridge subscribes to, as an absolute graph name. Clients never name it \u2014 they address the camera by its slug \u2014 so the topic can be renamed on the robot without an app changing.",
+      patternErrorMessage: ROS_NAME_RULE,
+      examples: ["/camera/image_raw"]
+    }),
+    type: rosTypeName.meta({
+      description: "The message type of `topic`: `sensor_msgs/msg/Image` for raw frames, `sensor_msgs/msg/CompressedImage` for a camera that already encodes. Declared here rather than introspected, so a camera can be configured for a robot that has never connected.",
+      patternErrorMessage: ROS_TYPE_NAME_RULE,
+      examples: ["sensor_msgs/msg/Image"]
+    })
+  }).meta({
+    description: "Frames come from an image topic the robot already publishes. It is the only source the bridge **subscribes** to rather than opens, so it needs no URL, no device and nobody to authenticate to.",
+    defaultSnippets: [{
+      label: "ros \u2014 an image topic the robot already publishes",
+      description: "Subscribes to a topic that is already there; nothing is opened and there is nobody to authenticate to.",
+      /**
+       * `type` is a **choice**, not a literal, and that is a correction: it was
+       * written out on the rule that a field the format fixes is written out,
+       * and `type` is not such a field. Its own description names two values
+       * and says which applies when — `Image` for raw frames,
+       * `CompressedImage` for a camera that encodes itself. A snippet that
+       * picks one picks wrong for half the cameras, and picks it invisibly:
+       * `rosTypeName` accepts either, publish accepts either, no diagnostic
+       * fires anywhere, and the bridge then subscribes with the wrong type and
+       * delivers no frames. A snippet supplying a wrong answer where it could
+       * have supplied a question is this project's *check that cannot fire*,
+       * arriving through a hint the developer trusts.
+       *
+       * `kind: 'ros'` stays a literal, because the branch really does fix it.
+       *
+       * Measured through the actual pipeline rather than assumed, because
+       * choice syntax is the one construct here that three layers must each
+       * pass through unharmed: yaml-language-server's `stringifyObject` emits
+       * the body verbatim, and monaco-editor 0.52.2's `SnippetParser` parses
+       * `${2|a,b|}` into a placeholder carrying both options whose
+       * `toString()` — the text on the buffer before anyone chooses — is the
+       * first one. So a developer who tabs past this gets a document
+       * byte-identical to the literal it replaced, and one who opens the
+       * picker gets `CompressedImage`; both parse.
+       */
+      body: {
+        kind: "ros",
+        topic: "${1:/camera/image_raw}",
+        type: "${2|sensor_msgs/msg/Image,sensor_msgs/msg/CompressedImage|}"
+      }
+    }]
+  }),
+  strictObject({
+    kind: z5.literal("rtsp").meta({
+      description: "Selects the RTSP source: this camera then carries `url`, and optionally `transport` and `credentials`."
+    }),
     /**
      * Scheme-constrained deliberately. The playbook drafted `z.string().url()`
      * here and the shipped contract was `z.string().min(1).max(2048)` — nobody
@@ -799,19 +1669,63 @@ var cameraSource = z4.discriminatedUnion("kind", [
      * by intent. The bridge re-checks this too — a robot must not become a
      * file server because a validator changed.
      */
-    url: z4.string().min(1).max(2048).regex(/^rtsps?:\/\//i, "must be an rtsp:// or rtsps:// URL"),
+    url: z5.string().min(1).max(2048).regex(/^rtsps?:\/\//i, RTSP_URL_RULE).meta({
+      description: "Where the stream lives, reached from the robot rather than from the cloud. **`rtsp://` or `rtsps://` only** \u2014 the bridge opens this with a library that would equally honour `file:`, so an unconstrained URL would turn a configuration document into arbitrary file access on the robot. The bridge re-checks the scheme itself, so a validator that changed could not make a robot serve files.",
+      patternErrorMessage: RTSP_URL_RULE,
+      examples: ["rtsp://cam-1.plant.local/stream1"]
+    }),
     /** TCP by default: UDP loses frames on a congested link, silently. */
-    transport: z4.enum(["tcp", "udp"]).default("tcp"),
-    credentials_ref: credentialRef.nullable().default(null)
+    transport: rtspTransport.optional().meta({
+      description: "How the RTSP payload is carried. Omitted means `tcp`: `udp` loses frames on a congested link and loses them silently, so the result looks like a failing camera rather than like a choice made here.",
+      enumDescriptions: describeValues(rtspTransport.options, {
+        tcp: "The frames are interleaved into the RTSP connection itself, which is what a congested or lossy link needs \u2014 nothing is dropped on the way. This is what an omitted `transport` means.",
+        udp: "The frames travel in their own UDP stream: lower latency on a quiet network, and silent frame loss on any other."
+      })
+    }),
+    credentials: cameraCredentials.optional()
+  }).meta({
+    description: "Frames come from an RTSP stream the robot itself can reach \u2014 a network camera on its own LAN. The bridge opens the connection; the cloud never does, and never needs a route to the camera.",
+    defaultSnippets: [{
+      label: "rtsp \u2014 a network camera the robot itself can reach",
+      description: "A stream the bridge opens over RTSP. The scheme is written out because the format constrains it; the host and the path are what vary.",
+      body: {
+        kind: "rtsp",
+        url: "rtsp://${1:cam-1.plant.local}/${2:stream1}"
+      }
+    }]
   }),
-  z4.object({
-    kind: z4.literal("mjpeg"),
+  strictObject({
+    kind: z5.literal("mjpeg").meta({
+      description: "Selects the MJPEG-over-HTTP source: this camera then carries `url`, and optionally `credentials`."
+    }),
     /** `http:`/`https:` only — see the `rtsp` variant above for why. */
-    url: z4.string().min(1).max(2048).regex(/^https?:\/\//i, "must be an http:// or https:// URL"),
-    credentials_ref: credentialRef.nullable().default(null)
+    url: z5.string().min(1).max(2048).regex(/^https?:\/\//i, MJPEG_URL_RULE).meta({
+      description: "Where the stream lives. **`http://` or `https://` only** \u2014 as for the `rtsp` URL, the bridge opens it with a library that would also serve `file:`. Plain `http://` is permitted because these cameras usually sit on the robot's own network, but Basic credentials on such a URL then travel in the clear.",
+      patternErrorMessage: MJPEG_URL_RULE,
+      /**
+       * The host and the path this branch's own snippet body inserts, and the
+       * URL its rule sentence names — one answer to "what goes here?", not a
+       * third. The sibling `rtsp` url had an `examples` from the first day and
+       * this position was the format's only silent URL (§1.1).
+       */
+      examples: ["http://cam-1.plant.local/video.mjpg"]
+    }),
+    credentials: cameraCredentials.optional()
+  }).meta({
+    description: "Frames come from an MJPEG stream over HTTP \u2014 one JPEG after another, the simplest network source there is. Unlike `rtsp` there is no `transport` to choose: it is HTTP, and any `credentials` therefore travel as HTTP Basic.",
+    defaultSnippets: [{
+      label: "mjpeg \u2014 one JPEG after another over HTTP",
+      description: "The simplest network source there is. `https://` is accepted too, and is what any credentials on this URL need.",
+      body: {
+        kind: "mjpeg",
+        url: "http://${1:cam-1.plant.local}/${2:video.mjpg}"
+      }
+    }]
   }),
-  z4.object({
-    kind: z4.literal("v4l2"),
+  strictObject({
+    kind: z5.literal("v4l2").meta({
+      description: "Selects the local capture-device source: this camera then carries `device` and nothing else."
+    }),
     /**
      * e.g. `/dev/video0`, or a stable `/dev/v4l/by-id/...` symlink. Resolved
      * on the robot, never by the cloud.
@@ -835,103 +1749,182 @@ var cameraSource = z4.discriminatedUnion("kind", [
      * The bridge re-derives this constraint rather than trusting the wire
      * (`validate_device_path`), exactly as it re-derives the URL scheme.
      */
-    device: z4.string().min(1).max(128).regex(/^\/dev\/[A-Za-z0-9][A-Za-z0-9._/-]*$/, "must be a device path under /dev/").refine((v) => !v.split("/").includes(".."), "must not contain a `..` path segment").refine((v) => !v.endsWith("/"), "must name a device, not a directory")
+    device: z5.string().min(1).max(128).regex(/^\/dev\/[A-Za-z0-9][A-Za-z0-9._/-]*$/, DEVICE_PATH_RULE).refine((v) => !v.split("/").includes(".."), "must not contain a `..` path segment").refine((v) => !v.endsWith("/"), "must name a device, not a directory").meta({
+      description: "The capture device, resolved on the robot and never by the cloud; a `/dev/v4l/by-id/...` symlink survives a reboot that renumbers `/dev/video0`. **Constrained to `/dev/`** \u2014 the string reaches OpenCV, which will just as happily open an ordinary video file or an `http://` URL and publish its pixels to the cloud. The bridge re-derives the same constraint rather than trusting the wire.",
+      patternErrorMessage: DEVICE_PATH_RULE,
+      examples: ["/dev/video0"]
+    })
+  }).meta({
+    description: "Frames come from a capture device attached to the robot itself, such as a USB camera on `/dev/video0`. Nothing leaves the robot to fetch them, and there is nothing to authenticate to, so this source takes no `credentials`.",
+    defaultSnippets: [{
+      label: "v4l2 \u2014 a capture device attached to the robot",
+      description: "A USB camera on the robot itself. A `/dev/v4l/by-id/...` symlink survives a reboot that renumbers `/dev/video0`.",
+      /**
+       * The default is not decoration. `device` is required and the path is
+       * constrained to `/dev/`, so a bare `$1` would insert the empty string
+       * and offer a camera the format refuses.
+       */
+      body: {
+        kind: "v4l2",
+        device: "${1:/dev/video0}"
+      }
+    }]
   })
 ]);
-var cameraConfig = z4.object({
-  slug,
-  source: cameraSource,
-  width: z4.number().int().positive().max(7680),
-  height: z4.number().int().positive().max(4320),
-  fps: z4.number().int().positive().max(60),
-  bitrate_kbps: z4.number().int().positive().max(5e4),
-  /**
-   * How often a snapshot is captured. Bounded below at one second because a
-   * snapshot is the *cheap* mode — a developer who wants motion wants live,
-   * and an interval faster than this is a live stream wearing a disguise.
-   */
-  snapshot_interval_ms: z4.number().int().min(1e3).max(36e5),
-  description: serviceDescription
-});
-var robotConfigDoc = z4.object({
-  datapoints: z4.array(datapointConfig).max(200),
-  /**
-   * The three kinds W4 adds default to empty so that **every configuration
-   * published before W4 still parses**. Stored documents are jsonb; a
-   * required field here would have invalidated live robots' published
-   * versions on the first read after deploy.
-   */
-  actions: z4.array(actionConfig).max(200).default([]),
-  services: z4.array(serviceConfig).max(200).default([]),
-  publishers: z4.array(publisherConfig).max(200).default([]),
-  /** W5, defaulted for the same reason the W4 kinds were: stored jsonb. */
-  cameras: z4.array(cameraConfig).max(50).default([])
-});
-var validationIssue = z4.object({
-  path: z4.string().min(1),
-  slug: z4.string().nullable(),
-  code: z4.string().min(1),
-  message: z4.string().min(1),
-  severity: z4.enum(["error", "warning"])
-});
-var configState = z4.object({
-  published_version: z4.number().int().positive().nullable(),
-  published_at: z4.iso.datetime().nullable(),
-  draft_updated_at: z4.iso.datetime().nullable(),
-  applied_version: z4.number().int().nonnegative().nullable(),
-  applied_ok: z4.boolean().nullable(),
-  applied_errors: z4.array(z4.object({ slug: z4.string(), message: z4.string() })).nullable()
+var snapshotIntervalSeconds = z5.number().int().min(1).max(3600);
+var CAMERA_SNIPPET = {
+  label: "a camera",
+  description: "A complete camera entry with every required field.",
+  body: {
+    source: { kind: "v4l2", device: "${2:/dev/video0}" },
+    width: 1280,
+    height: 720,
+    fps: 15,
+    bitrate_kbps: 2e3,
+    snapshot_interval_seconds: 5,
+    description: "${3:Forward-facing camera on the mast.}"
+  }
+};
+var cameraConfig = strictObject({
+  source: cameraSource.meta({
+    description: "Where this camera's frames come from. `kind` picks one of four sources and fixes which other fields the source may carry, so an impossible camera is unrepresentable rather than merely invalid \u2014 there is no way to write an RTSP camera with a ROS topic."
+  }),
+  width: z5.number().int().positive().max(7680).meta({
+    description: "The width the bridge scales frames to before sending, in pixels \u2014 what the bridge produces, not what the sensor captures; a snapshot can arrive narrower, since the bridge reduces both dimensions together to fit its JPEG byte ceiling. It stands in the configuration and never in a viewer's request, so no client can make the robot encode a larger frame than the developer allowed.",
+    examples: [1280]
+  }),
+  height: z5.number().int().positive().max(4320).meta({
+    description: "The height the bridge scales every frame to, in pixels; with `width` it is the size the live stream carries. A snapshot can arrive **smaller** than this \u2014 its JPEG has a byte ceiling, and the bridge gives up quality first and then resolution to fit, reporting the size it actually encoded.",
+    examples: [720]
+  }),
+  fps: z5.number().int().positive().max(60).meta({
+    description: "How many frames a second the bridge forwards, at most. It is a ceiling, not a clock: a camera that delivers ten frames a second stays at ten. Both modes read the same throttled pipeline, so this also bounds how fresh a snapshot can be.",
+    examples: [15]
+  }),
+  bitrate_kbps: z5.number().int().positive().max(5e4).meta({
+    description: "The ceiling for the **live** encoding, in kilobits per second \u2014 this is what bounds a watched camera against the robot's uplink. Snapshots are not covered by it: they are JPEGs under their own byte ceiling. Raising `width`, `height` or `fps` against a fixed bitrate buys blur, not detail.",
+    examples: [2e3]
+  }),
+  snapshot_interval_seconds: snapshotIntervalSeconds.meta({
+    description: "How often a still frame is captured, in seconds. **It runs whether or not anyone is watching**, unlike the live stream, which the cloud refcounts \u2014 first viewer starts it, last one ends it. The cloud caches the one frame and serves every reader from it, so a hundred pollers cost the robot exactly one image per interval.",
+    examples: [5]
+  }),
+  description: serviceDescription.meta({
+    description: "What this camera shows, in the developer's own words \u2014 documentation for whoever reads the configuration, for the console and for MCP clients; the robot does nothing with it. A camera without one is still offered, with `description: null`, as for actions, services and publishers. What `camera_snapshot` serves is the latest snapshot with its age; a live session is never a tool.",
+    examples: ["Forward-facing camera on the mast."]
+  })
+}).meta({
+  /** The value position of one entry — `front: ▮` under `cameras:`. */
+  defaultSnippets: [CAMERA_SNIPPET]
+});
+var FLEETLESS_FORMAT_VERSION = 1;
+var capped = (entry, max, what) => slugKeyed(entry).refine((m) => Object.keys(m).length <= max, { message: `at most ${max} ${what}` });
+var robotConfigDoc = strictObject({
+  fleetless: z5.literal(FLEETLESS_FORMAT_VERSION).meta({
+    description: "The format version, and the first line of the file. It decides how everything below is read, so a file that omits it \u2014 or names a version this cloud does not know \u2014 is **refused rather than half understood**."
+  }),
+  messages: messageMap.meta({
+    description: "Reusable message bodies, keyed by name, inserted elsewhere by writing `${name}` directly after `message:`. A shared body may hold placeholders and whoever inserts it declares the parameters, so two publishers can send the same message under different bounds. **A shared message may not insert another**, so a `${name}` inside a body is always a parameter and never a second message.",
+    defaultSnippets: [underSlug("${1:drive}", SHARED_MESSAGE_SNIPPET)]
+  }).optional(),
+  datapoints: capped(datapointConfig, 200, "datapoints").meta({
+    description: "Values the robot publishes, each one field of one topic or a whole topic, and **never several topics**. Keys are slugs, one namespace across all five exposure sections, which is what lets a role grant say `{robot, slug}` without naming a kind; `bridge_state`, `robot_details` and `bridge_pressure` are built-in and refused here.",
+    defaultSnippets: [
+      underSlug("${1:battery_voltage}", DATAPOINT_SNIPPET),
+      underSlug("${1:battery}", NUMERIC_DATAPOINT_SNIPPET)
+    ]
+  }).optional(),
+  actions: capped(actionConfig, 200, "actions").meta({
+    description: "Things the robot does on request that take time, each reported as a job with progress. **At most one job runs per action slug**: a second call is refused `busy`, and every observer of that slug watches the same job. Keys are slugs, one namespace across all five exposure sections, which is what lets a role grant say `{robot, slug}` without naming a kind; `bridge_state`, `robot_details` and `bridge_pressure` are built-in and refused here.",
+    defaultSnippets: [underSlug("${1:navigate}", ACTION_SNIPPET)]
+  }).optional(),
+  services: capped(serviceConfig, 200, "services").meta({
+    description: "ROS service calls the robot answers \u2014 one request, one reply. Unlike an action a service reports **no progress** and the call returns with its result already on the job, so there is nothing left to observe; a second concurrent call is still refused `busy`, exactly as for an action. Keys are slugs, one namespace across all five exposure sections, which is what lets a role grant say `{robot, slug}` without naming a kind; `bridge_state`, `robot_details` and `bridge_pressure` are built-in and refused here.",
+    defaultSnippets: [underSlug("${1:reset_odometry}", SERVICE_SNIPPET)]
+  }).optional(),
+  publishers: capped(publisherConfig, 200, "publishers").meta({
+    description: "Topics clients may send to, and where the format's whole safety story lives. The `message` template fixes every value a caller cannot change, and **`failsafe` is required**: once a client falls silent the bridge sends the failsafe message itself, so an operator whose window closed does not leave a robot driving. Keys are slugs, one namespace across all five exposure sections, which is what lets a role grant say `{robot, slug}` without naming a kind; `bridge_state`, `robot_details` and `bridge_pressure` are built-in and refused here.",
+    defaultSnippets: [underSlug("${1:drive}", PUBLISHER_SNIPPET)]
+  }).optional(),
+  cameras: capped(cameraConfig, 50, "cameras").meta({
+    description: "Video the robot streams, and the still frames the cloud serves from it. `width`, `height`, `fps` and `bitrate_kbps` are what **the bridge produces before sending**, not what the camera captures \u2014 they live in the configuration rather than in a viewer's request precisely so that no viewer can make a robot send more. Keys are slugs, one namespace across all five exposure sections, which is what lets a role grant say `{robot, slug}` without naming a kind; `bridge_state`, `robot_details` and `bridge_pressure` are built-in and refused here.",
+    defaultSnippets: [underSlug("${1:front}", CAMERA_SNIPPET)]
+  }).optional()
+});
+var validationIssue = z5.object({
+  path: z5.string().min(1),
+  slug: z5.string().nullable(),
+  code: z5.string().min(1),
+  message: z5.string().min(1),
+  severity: z5.enum(["error", "warning"])
+});
+var configState = z5.object({
+  published_version: z5.number().int().positive().nullable(),
+  published_at: z5.iso.datetime().nullable(),
+  draft_updated_at: z5.iso.datetime().nullable(),
+  applied_version: z5.number().int().nonnegative().nullable(),
+  applied_ok: z5.boolean().nullable(),
+  /**
+   * The bridge's own `bridgeConfigApplied.errors` (`protocol.ts`), read back
+   * verbatim. **Reuses `applyError` rather than restating `{ slug, message
+   * }`** — a narrower local copy here used to silently strip `kind`, `code`
+   * and `details` on every read: `configState.safeParse` dropped every field
+   * a caller did not ask for, and `robotDetailResponse` embeds `configState`
+   * (`useCloudApi.ts`'s `getRobot`), so the console lost the fields one
+   * layer before anyone could see them.
+   */
+  applied_errors: z5.array(applyError).nullable()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_367ffc97d258be510904ed62d5d477a4/node_modules/@fleetless/contracts/dist/introspection.js
-import { z as z5 } from "zod";
-var rosGraphEntry = z5.object({
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_1727a3f05719ef3ec49509ea01c84aa4/node_modules/@fleetless/contracts/dist/introspection.js
+import { z as z6 } from "zod";
+var rosGraphEntry = z6.object({
   name: rosName,
-  types: z5.array(rosTypeName).min(1)
-});
-var rosGraph = z5.object({
-  topics: z5.array(rosGraphEntry),
-  services: z5.array(rosGraphEntry),
-  actions: z5.array(rosGraphEntry),
-  captured_at_ms: z5.number().int().nonnegative()
-});
-var typeField = z5.lazy(() => z5.object({
-  name: z5.string().min(1).max(128),
-  type: z5.string().min(1).max(255),
-  array: z5.boolean(),
-  fields: z5.array(typeField).nullable()
+  types: z6.array(rosTypeName).min(1)
+});
+var rosGraph = z6.object({
+  topics: z6.array(rosGraphEntry),
+  services: z6.array(rosGraphEntry),
+  actions: z6.array(rosGraphEntry),
+  captured_at_ms: z6.number().int().nonnegative()
+});
+var typeField = z6.lazy(() => z6.object({
+  name: z6.string().min(1).max(128),
+  type: z6.string().min(1).max(255),
+  array: z6.boolean(),
+  fields: z6.array(typeField).nullable()
 }));
-var typeDefinition = z5.discriminatedUnion("kind", [
-  z5.object({
+var typeDefinition = z6.discriminatedUnion("kind", [
+  z6.object({
     name: rosTypeName,
-    kind: z5.literal("msg"),
-    fields: z5.array(typeField)
+    kind: z6.literal("msg"),
+    fields: z6.array(typeField)
   }),
-  z5.object({
+  z6.object({
     name: rosTypeName,
-    kind: z5.literal("srv"),
-    request: z5.array(typeField),
-    response: z5.array(typeField)
+    kind: z6.literal("srv"),
+    request: z6.array(typeField),
+    response: z6.array(typeField)
   }),
-  z5.object({
+  z6.object({
     name: rosTypeName,
-    kind: z5.literal("action"),
-    goal: z5.array(typeField),
-    result: z5.array(typeField),
-    feedback: z5.array(typeField)
+    kind: z6.literal("action"),
+    goal: z6.array(typeField),
+    result: z6.array(typeField),
+    feedback: z6.array(typeField)
   })
 ]);
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_367ffc97d258be510904ed62d5d477a4/node_modules/@fleetless/contracts/dist/jobs.js
-import { z as z6 } from "zod";
-var jobState = z6.enum(["running", "succeeded", "failed", "cancelled", "lost"]);
-var job = z6.object({
-  id: z6.uuid(),
-  robot_id: z6.uuid(),
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_1727a3f05719ef3ec49509ea01c84aa4/node_modules/@fleetless/contracts/dist/jobs.js
+import { z as z7 } from "zod";
+var jobState = z7.enum(["running", "succeeded", "failed", "cancelled", "lost"]);
+var job = z7.object({
+  id: z7.uuid(),
+  robot_id: z7.uuid(),
   slug,
   state: jobState,
-  started_at: z6.iso.datetime(),
-  updated_at: z6.iso.datetime(),
+  started_at: z7.iso.datetime(),
+  updated_at: z7.iso.datetime(),
   /**
    * A monotonic counter, ascending in mint order (W7), and the **named**
    * tiebreaker for any listing that claims an order.
@@ -948,9 +1941,9 @@ var job = z6.object({
    * orders jobs that coexist in one registry — and stated, because a reader
    * who assumed `auditEvent.seq`'s durable semantics would be wrong.
    */
-  seq: z6.number().int().positive(),
+  seq: z7.number().int().positive(),
   /** Present once the job succeeded; shape is the ROS result's. */
-  result: z6.unknown().nullable(),
+  result: z7.unknown().nullable(),
   /**
    * Present on `failed`; a human message, plus a code where one exists.
    *
@@ -968,52 +1961,122 @@ var job = z6.object({
    * code has a documented payload — `job_queue_full` has
    * `jobQueueFullDetails` — it belongs here, not in the sentence.
    */
-  error: z6.object({
-    code: z6.string().min(1),
-    message: z6.string().min(1),
-    details: z6.unknown().optional()
+  error: z7.object({
+    code: z7.string().min(1),
+    message: z7.string().min(1),
+    details: z7.unknown().optional()
   }).nullable()
 });
-var jobEvent = z6.object({
-  type: z6.literal("job"),
-  robot_id: z6.uuid(),
+var jobEvent = z7.object({
+  type: z7.literal("job"),
+  robot_id: z7.uuid(),
   slug,
   job,
   /** Action feedback, if this update carries any. */
-  feedback: z6.unknown().nullable(),
+  feedback: z7.unknown().nullable(),
   /** 0..1 when the action reports progress; null when it does not. */
-  progress: z6.number().min(0).max(1).nullable(),
-  timestamp_ms: z6.number().int().nonnegative()
+  progress: z7.number().min(0).max(1).nullable(),
+  timestamp_ms: z7.number().int().nonnegative()
 });
-var busyDetails = z6.object({
+var busyDetails = z7.object({
   running: job
 });
-var publisherBusyDetails = z6.object({
+var publisherBusyDetails = z7.object({
   /** The configured silence a holder must leave before anyone else may publish. */
-  quiet_timeout_ms: z6.number().int().nonnegative(),
+  quiet_timeout_ms: z7.number().int().nonnegative(),
   /** How much of that silence is still outstanding, now. */
-  retry_after_ms: z6.number().int().nonnegative()
+  retry_after_ms: z7.number().int().nonnegative()
 });
-var jobQueueFullDetails = z6.object({
+var jobQueueFullDetails = z7.object({
   /** The bridge's bound on queued jobs. */
-  limit: z6.number().int().positive(),
+  limit: z7.number().int().positive(),
   /** How many are queued right now — `>= limit` when this refusal is sent. */
-  queued: z6.number().int().nonnegative()
+  queued: z7.number().int().nonnegative()
+});
+var JOB_RUN_PAGE_MAX = 200;
+var jobActor = z7.object({
+  kind: z7.enum(["developer", "end_user", "server_key"]),
+  id: z7.uuid(),
+  /**
+   * The email for a developer or end user, the key's `name` for a server key.
+   * A display snapshot taken at invoke time: renaming a key afterwards does not
+   * rewrite history, which is the point of storing it rather than joining.
+   */
+  label: z7.string().min(1).max(200)
+});
+var jobRunKind = z7.enum(["action", "service"]);
+var jobRun = z7.object({
+  id: z7.uuid(),
+  robot_id: z7.uuid(),
+  slug,
+  kind: jobRunKind,
+  state: jobState,
+  started_at: z7.iso.datetime(),
+  /** `null` while `running` — a run has an end only once it has one. */
+  ended_at: z7.iso.datetime().nullable(),
+  /** `null` while `running`. Not "0 so far". */
+  duration_ms: z7.number().int().nonnegative().nullable(),
+  result: z7.unknown().nullable(),
+  error: z7.object({ code: z7.string().min(1), message: z7.string().min(1), details: z7.unknown().optional() }).nullable(),
+  actor: jobActor,
+  /**
+   * **Durable, unlike `job.seq`.** That one is a per-process counter that
+   * restarts with the cloud; this is a postgres `bigserial` and is the cursor
+   * `before_seq` walks.
+   */
+  seq: z7.number().int().positive(),
+  /**
+   * Live-only, read from the in-memory registry for rows that are still
+   * running. `null` means **"not known right now"** — after a cloud restart,
+   * before the bridge reconnects — and never "0 %". A fraction, as in
+   * `jobEvent.progress`, not a percentage.
+   */
+  progress: z7.number().min(0).max(1).nullable(),
+  feedback: z7.unknown().nullable()
+});
+var jobRunQuery = z7.object({
+  /** Only runs with a smaller `seq` — the next, older page. */
+  before_seq: wireSeqCursor.optional(),
+  limit: z7.union([z7.string().regex(/^\d{1,4}$/), z7.number().int()]).transform((v) => Number(v)).pipe(z7.number().int().positive().max(JOB_RUN_PAGE_MAX)).optional(),
+  robot_id: z7.uuid().optional(),
+  slug: slug.optional(),
+  state: jobState.optional(),
+  kind: jobRunKind.optional(),
+  /** Half-open `[from, to)`, the same rule the history shapes follow (DEF-062). */
+  from_ms: wireTimestampMs.optional(),
+  to_ms: wireTimestampMs.optional()
+}).strict();
+var jobRunListResponse = z7.object({
+  runs: z7.array(jobRun),
+  /**
+   * The `seq` a caller sends as `before_seq` to keep reading — or `null` when
+   * there is nothing further. **`null` means the end, and that is a promise
+   * rather than an observation.** A caller who instead compares `runs.length`
+   * against `limit` is wrong the moment a filter makes a page thin.
+   */
+  next_cursor: z7.number().int().positive().nullable()
+});
+var jobRunSummaryQuery = z7.object({ since_ms: wireTimestampMs }).strict();
+var jobRunSummary = z7.object({
+  running: z7.number().int().nonnegative(),
+  started: z7.number().int().nonnegative(),
+  failed: z7.number().int().nonnegative(),
+  since_ms: z7.number().int().nonnegative()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_367ffc97d258be510904ed62d5d477a4/node_modules/@fleetless/contracts/dist/protocol.js
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_1727a3f05719ef3ec49509ea01c84aa4/node_modules/@fleetless/contracts/dist/protocol.js
 var MAX_PATIENCE_MS = 12e4;
 var MIN_PATIENCE_MS = 1e3;
-var activeJob = z7.object({
-  job_id: z7.uuid(),
+var activeJob = z8.object({
+  job_id: z8.uuid(),
   slug,
   state: jobState
 });
-var bridgeHello = z7.object({
-  type: z7.literal("hello"),
-  protocol_version: z7.number().int().positive(),
-  token: z7.string().min(1),
-  bridge_version: z7.string().min(1),
+var bridgeHello = z8.object({
+  type: z8.literal("hello"),
+  protocol_version: z8.number().int().positive(),
+  token: z8.string().min(1),
+  bridge_version: z8.string().min(1),
   /**
    * Every job this bridge still knows about, right now (spec §6.1, W4).
    *
@@ -1041,60 +2104,68 @@ var bridgeHello = z7.object({
    * accepted alongside the new one: two accepted spellings would have to be
    * supported and reconciled forever, and nobody is asking for that.
    */
-  active_jobs: z7.array(activeJob).max(500).default([])
+  active_jobs: z8.array(activeJob).max(500).default([])
 });
-var cloudHelloOk = z7.object({
-  type: z7.literal("hello_ok"),
-  robot_id: z7.uuid()
+var cloudHelloOk = z8.object({
+  type: z8.literal("hello_ok"),
+  robot_id: z8.uuid()
 });
-var cloudHelloError = z7.object({
-  type: z7.literal("hello_error"),
-  code: z7.string().min(1),
-  message: z7.string().min(1)
+var cloudHelloError = z8.object({
+  type: z8.literal("hello_error"),
+  code: z8.string().min(1),
+  message: z8.string().min(1)
 });
-var datapointFrame = z7.object({
-  type: z7.literal("datapoint"),
+var datapointFrame = z8.object({
+  type: z8.literal("datapoint"),
   slug,
-  value: z7.unknown(),
-  timestamp_ms: z7.number().int().nonnegative()
+  value: z8.unknown(),
+  timestamp_ms: z8.number().int().nonnegative()
 });
-var cloudPing = z7.object({
-  type: z7.literal("ping"),
-  ts_ms: z7.number().int().nonnegative()
+var cloudPing = z8.object({
+  type: z8.literal("ping"),
+  ts_ms: z8.number().int().nonnegative()
 });
-var bridgePong = z7.object({
-  type: z7.literal("pong"),
-  ts_ms: z7.number().int().nonnegative()
+var bridgePong = z8.object({
+  type: z8.literal("pong"),
+  ts_ms: z8.number().int().nonnegative()
 });
-var cloudConfig = z7.object({
-  type: z7.literal("config"),
-  version: z7.number().int().nonnegative(),
-  doc: robotConfigDoc,
-  credentials: z7.record(credentialRef, z7.object({ username: z7.string(), password: z7.string() })).default({})
+var cloudConfig = z8.object({
+  type: z8.literal("config"),
+  version: z8.number().int().nonnegative(),
+  doc: robotConfigDoc
 });
-var bridgeConfigApplied = z7.object({
-  type: z7.literal("config_applied"),
-  version: z7.number().int().nonnegative(),
-  ok: z7.boolean(),
-  errors: z7.array(z7.object({ slug: z7.string(), message: z7.string().min(1) }))
+var bridgeConfigApplied = z8.object({
+  type: z8.literal("config_applied"),
+  version: z8.number().int().nonnegative(),
+  ok: z8.boolean(),
+  errors: z8.array(applyError)
 });
-var cloudInvoke = z7.object({
-  type: z7.literal("invoke"),
-  job_id: z7.uuid(),
+var cloudInvoke = z8.object({
+  type: z8.literal("invoke"),
+  job_id: z8.uuid(),
   slug,
   /**
    * Already validated against §4.4 rules; the bridge validates structurally.
    *
-   * **Flat, keyed by `parameterSpec.name`** — `{"target_pose.position.x": 1}`,
-   * not a nested message tree. Three things follow from that and none of them
-   * survive the nested form: the key a caller sends is the key a rule names,
-   * so a `parameter_invalid` can report a `field` the caller can actually
-   * find; the console binds one form input per spec; and a goal field that no
-   * `parameterSpec` declares simply cannot be set, which is what §4.4 means by
-   * the developer deciding what a client may pass. The bridge unflattens once,
-   * on the way into the ROS goal or request.
+   * **Flat, keyed by parameter name** — `{"target_x": 1}`. The key is a key of
+   * the entry's `parameters` mapping, not a path into the message. Those were
+   * the same thing until FL-002 and are now deliberately decoupled: a
+   * parameter keeps its name when the field it fills moves in the message
+   * tree, which is the same reason a slug is not a topic name.
+   *
+   * Three things follow, and the last one got stronger rather than weaker:
+   * the key a caller sends is the key a rule names, so a `parameter_invalid`
+   * reports something the caller can find; the console binds one input per
+   * parameter; and a position the template does not mark with `${…}` cannot
+   * be set by any caller at all. That last one used to be a rule about what
+   * no `parameterSpec` declared. It is now structural — the value has nowhere
+   * to go.
+   *
+   * The bridge substitutes these values into the entry's `message` template
+   * at its placeholder positions. It no longer unflattens a dotted path;
+   * there is no dotted path to unflatten.
    */
-  params: z7.record(z7.string(), z7.unknown()),
+  params: z8.record(z8.string(), z8.unknown()),
   /**
    * How long this one call is worth waiting for (W6b), already resolved by
    * the cloud — the caller's `invokeRequest.patience_ms`, or
@@ -1109,81 +2180,151 @@ var cloudInvoke = z7.object({
    * 15.0 s, agreeing only by accident, with no way to tell whose deadline a
    * caller had actually hit.
    */
-  patience_ms: z7.number().int().min(MIN_PATIENCE_MS).max(MAX_PATIENCE_MS)
+  patience_ms: z8.number().int().min(MIN_PATIENCE_MS).max(MAX_PATIENCE_MS)
 });
-var cloudCancel = z7.object({
-  type: z7.literal("cancel"),
+var cloudCancel = z8.object({
+  type: z8.literal("cancel"),
   slug,
-  job_id: z7.uuid().nullable()
+  job_id: z8.uuid().nullable()
 });
-var cloudPublish = z7.object({
-  type: z7.literal("publish"),
+var cloudPublish = z8.object({
+  type: z8.literal("publish"),
   slug,
   /**
-   * Flat and keyed by `parameterSpec.name`, exactly like `cloudInvoke.params`
-   * — a publisher carries parameter specs and the same §4.4 validation, so it
-   * must carry the same shape. Note this is *not* the shape of
-   * `publisherConfig.failsafe`, which is a complete nested ROS message: the
-   * failsafe is authored once by the developer against the type, never sent
-   * by a caller and never rule-checked per field.
+   * Flat and keyed by parameter name, exactly like `cloudInvoke.params` — a
+   * publisher declares parameters and takes the same validation, so it takes
+   * the same shape.
+   *
+   * This is *not* the shape of `publisherConfig.failsafe.message`, which is a
+   * complete ROS message template. The failsafe is authored once against the
+   * type, sent by the bridge with no caller present, and refused outright if
+   * it contains a placeholder — there would be nobody to fill it.
    */
-  message: z7.record(z7.string(), z7.unknown())
+  message: z8.record(z8.string(), z8.unknown())
 });
-var bridgeJobUpdate = z7.object({
-  type: z7.literal("job_update"),
-  job_id: z7.uuid(),
+var bridgeJobUpdate = z8.object({
+  type: z8.literal("job_update"),
+  job_id: z8.uuid(),
   slug,
   state: jobState,
-  feedback: z7.unknown().nullable(),
-  progress: z7.number().min(0).max(1).nullable(),
-  result: z7.unknown().nullable(),
+  feedback: z8.unknown().nullable(),
+  progress: z8.number().min(0).max(1).nullable(),
+  result: z8.unknown().nullable(),
   /** Same shape as `job.error`, `details` included — see `jobs.ts`. */
-  error: z7.object({ code: z7.string().min(1), message: z7.string().min(1), details: z7.unknown().optional() }).nullable(),
-  timestamp_ms: z7.number().int().nonnegative()
+  error: z8.object({ code: z8.string().min(1), message: z8.string().min(1), details: z8.unknown().optional() }).nullable(),
+  timestamp_ms: z8.number().int().nonnegative()
 });
-var bridgeJobLost = z7.object({
-  type: z7.literal("job_lost"),
-  job_ids: z7.array(z7.uuid())
+var bridgeJobLost = z8.object({
+  type: z8.literal("job_lost"),
+  job_ids: z8.array(z8.uuid())
 });
-var cloudIntrospectRequest = z7.object({
-  type: z7.literal("introspect_request"),
-  request_id: z7.string().min(1).max(64)
+var cloudIntrospectRequest = z8.object({
+  type: z8.literal("introspect_request"),
+  request_id: z8.string().min(1).max(64)
 });
-var bridgeIntrospect = z7.object({
-  type: z7.literal("introspect"),
-  request_id: z7.string().min(1).max(64),
+var bridgeIntrospect = z8.object({
+  type: z8.literal("introspect"),
+  request_id: z8.string().min(1).max(64),
   graph: rosGraph
 });
-var cloudTypeRequest = z7.object({
-  type: z7.literal("type_request"),
-  request_id: z7.string().min(1).max(64),
-  type_names: z7.array(rosTypeName).min(1).max(50)
+var cloudTypeRequest = z8.object({
+  type: z8.literal("type_request"),
+  request_id: z8.string().min(1).max(64),
+  type_names: z8.array(rosTypeName).min(1).max(50)
 });
-var bridgeTypeDefinitions = z7.object({
-  type: z7.literal("type_definitions"),
-  request_id: z7.string().min(1).max(64),
-  definitions: z7.array(typeDefinition),
-  unresolved: z7.array(z7.string())
+var bridgeTypeDefinitions = z8.object({
+  type: z8.literal("type_definitions"),
+  request_id: z8.string().min(1).max(64),
+  definitions: z8.array(typeDefinition),
+  unresolved: z8.array(z8.string())
 });
-var bridgeState = z7.object({
-  online: z7.boolean(),
-  latency_ms: z7.number().nonnegative().nullable()
+var bridgeState = z8.object({
+  online: z8.boolean(),
+  latency_ms: z8.number().nonnegative().nullable()
+});
+var bridgePressureTier = z8.object({
+  sent: z8.number().int().nonnegative(),
+  bytes: z8.number().int().nonnegative(),
+  drops: z8.number().int().nonnegative(),
+  high_water: z8.number().int().nonnegative()
+});
+var bridgePressure = z8.object({
+  link: z8.object({
+    /** bytes/s the socket demonstrably drains, from sends >= 64 KiB
+     *  only; null until the first large send of the session. */
+    rate_bps: z8.number().nonnegative().nullable(),
+    /**
+     * the byte target snapshots are currently encoded to fit.
+     *
+     * `.nonnegative()`, not `.positive()`: the target is derived from
+     * `rate_bps`, and a link measured below 0.5 B/s floors to 0 here. A
+     * schema that rejects 0 does not prevent that link — it only makes the
+     * frame reporting it unparseable, and a console that cannot parse a
+     * pressure frame shows "no feed", i.e. reports a struggling robot as an
+     * *old* one. Zero is a legitimate reading and says something true.
+     */
+    snapshot_max_bytes: z8.number().int().nonnegative()
+  }),
+  /**
+   * String keys "0".."5" because JSON has no integer keys. Counters are
+   * cumulative per session and reset on reconnect; clients window by
+   * differencing two samples.
+   *
+   * **What this schema does not decide:** it does not guarantee all six
+   * keys are present (`z.record` over the six literals is exhaustive in
+   * zod 4 — tested here, it required every key and rejected none, the
+   * opposite of what a partial sample needs — so this is a
+   * `.strictObject().partial()` over the same six literal keys instead, a
+   * deliberate deviation from the originally sketched `z.record` shape with
+   * the same runtime behaviour). A missing tier key reads as zeros; the
+   * schema names what it cannot decide rather than implying a completeness
+   * it cannot check.
+   */
+  tiers: z8.strictObject({
+    "0": bridgePressureTier,
+    "1": bridgePressureTier,
+    "2": bridgePressureTier,
+    "3": bridgePressureTier,
+    "4": bridgePressureTier,
+    "5": bridgePressureTier
+  }).partial(),
+  video: z8.object({
+    active_streams: z8.number().int().nonnegative(),
+    bitrate_sum_kbps: z8.number().int().nonnegative(),
+    /**
+     * The uplink budget the bridge was configured with
+     * (`FLEETLESS_UPLINK_KBPS`), or `null` when none was set.
+     *
+     * `.nonnegative()`, not `.positive()`: `FLEETLESS_UPLINK_KBPS=0` is a
+     * documented setting meaning "no video budget at all", and the bridge
+     * emits that 0 verbatim. `.positive()` made every frame from such a
+     * robot fail the console's `safeParse`, which renders an unparseable
+     * frame as "no pressure feed" — so the one robot that had *deliberately*
+     * turned video off was the one diagnosed as running a bridge too old to
+     * report pressure. A value the producer legitimately sends must parse;
+     * `null` is the only "not set" this field has.
+     */
+    uplink_kbps: z8.number().int().nonnegative().nullable(),
+    override_kbps: z8.number().int().nonnegative().nullable(),
+    video_budget_kbps: z8.number().int().nonnegative().nullable(),
+    reserve_kbps: z8.number().int().nonnegative()
+  })
 });
-var snapshotHeader = z7.object({
-  type: z7.literal("snapshot"),
+var snapshotHeader = z8.object({
+  type: z8.literal("snapshot"),
   slug,
   /** `image/jpeg` in practice; stated so nothing has to sniff the bytes. */
-  mime: z7.string().min(1).max(64),
-  width: z7.number().int().positive(),
-  height: z7.number().int().positive(),
-  timestamp_ms: z7.number().int().nonnegative()
+  mime: z8.string().min(1).max(64),
+  width: z8.number().int().positive(),
+  height: z8.number().int().positive(),
+  timestamp_ms: z8.number().int().nonnegative()
 });
-var cloudCameraStart = z7.object({
-  type: z7.literal("camera_start"),
+var cloudCameraStart = z8.object({
+  type: z8.literal("camera_start"),
   slug,
-  url: z7.string().min(1),
-  room: z7.string().min(1),
-  token: z7.string().min(1),
+  url: z8.string().min(1),
+  room: z8.string().min(1),
+  token: z8.string().min(1),
   /**
    * Names **this attempt** (W6b), and is echoed in the `camera_state` that
    * answers it.
@@ -1195,33 +2336,33 @@ var cloudCameraStart = z7.object({
    * knows nothing about. The viewer is then told the running stream failed,
    * for a reason belonging to an attempt that is already over.
    */
-  request_id: z7.string().min(1).max(64)
+  request_id: z8.string().min(1).max(64)
 });
-var bridgeAssetsAvailable = z7.object({
-  type: z7.literal("assets_available"),
+var bridgeAssetsAvailable = z8.object({
+  type: z8.literal("assets_available"),
   /** Whether `/robot_description` (or the configured source) yielded a URDF. */
-  urdf: z7.boolean(),
+  urdf: z8.boolean(),
   /**
    * Every `package://` URI the URDF references, verbatim and unresolved —
    * including the ones this bridge cannot find in its workspace. Reporting
    * only the resolvable ones would make an incomplete workspace look like a
    * complete robot, and the cloud would have nothing to show as missing.
    */
-  meshes: z7.array(z7.string().min(1))
+  meshes: z8.array(z8.string().min(1))
 });
-var cloudAssetRequest = z7.object({
-  type: z7.literal("asset_request"),
-  sync_id: z7.uuid(),
-  upload_url: z7.url(),
-  token: z7.string().min(1),
+var cloudAssetRequest = z8.object({
+  type: z8.literal("asset_request"),
+  sync_id: z8.uuid(),
+  upload_url: z8.url(),
+  token: z8.string().min(1),
   /** Which URIs to send. Empty means the URDF only. */
-  meshes: z7.array(z7.string().min(1))
+  meshes: z8.array(z8.string().min(1))
 });
-var bridgeAssetProgress = z7.object({
-  type: z7.literal("asset_progress"),
-  sync_id: z7.uuid(),
-  done: z7.number().int().nonnegative(),
-  total: z7.number().int().nonnegative(),
+var bridgeAssetProgress = z8.object({
+  type: z8.literal("asset_progress"),
+  sync_id: z8.uuid(),
+  done: z8.number().int().nonnegative(),
+  total: z8.number().int().nonnegative(),
   /**
    * **Each entry says why** — see `assetFailure` in `assets.ts` for the three
    * kinds and why one word was not enough. The bound is `assets.ts`'s too: a
@@ -1231,7 +2372,7 @@ var bridgeAssetProgress = z7.object({
    * a file in its workspace (Kassandra-W7a). A producer at its own ceiling
    * reports **one** `refused` entry naming the file, not one per reference.
    */
-  failed: z7.array(assetFailure).max(1e3),
+  failed: z8.array(assetFailure).max(1e3),
   /**
    * Three values, because a boolean `finished` had nowhere to put a refusal.
    *
@@ -1253,19 +2394,19 @@ var bridgeAssetProgress = z7.object({
    * Raised by Rosie-W7, who found the gap by asking what a second request
    * should do rather than picking the silent option.
    */
-  state: z7.enum(["running", "finished", "refused_busy"])
+  state: z8.enum(["running", "finished", "refused_busy"])
 });
-var cloudCameraStop = z7.object({
-  type: z7.literal("camera_stop"),
+var cloudCameraStop = z8.object({
+  type: z8.literal("camera_stop"),
   slug,
   /** Names this stop, echoed by the `camera_state` that answers it — see `cloudCameraStart.request_id`. */
-  request_id: z7.string().min(1).max(64)
+  request_id: z8.string().min(1).max(64)
 });
-var bridgeCameraState = z7.object({
-  type: z7.literal("camera_state"),
+var bridgeCameraState = z8.object({
+  type: z8.literal("camera_state"),
   slug,
-  publishing: z7.boolean(),
-  error: z7.object({ code: z7.string().min(1), message: z7.string().min(1) }).nullable(),
+  publishing: z8.boolean(),
+  error: z8.object({ code: z8.string().min(1), message: z8.string().min(1) }).nullable(),
   /**
    * Why this frame was sent (W6a).
    *
@@ -1295,7 +2436,7 @@ var bridgeCameraState = z7.object({
    * reason. Old bridges fail validation on this frame — acceptable while
    * nothing is deployed, and W8 is the first deployment.
    */
-  cause: z7.enum(["command", "source", "config_change", "live_lost"]),
+  cause: z8.enum(["command", "source", "config_change", "live_lost"]),
   /**
    * When the **robot** observed this state — bridge capture time, never
    * receive time, the same discipline `timestamp_ms` follows for samples
@@ -1313,7 +2454,7 @@ var bridgeCameraState = z7.object({
    * when the frame was sent. A bridge that re-states a failure it has held for
    * an hour says so.
    */
-  observed_at_ms: z7.number().int().nonnegative(),
+  observed_at_ms: z8.number().int().nonnegative(),
   /**
    * Which request this frame answers (W6b), or `null` when it answers none.
    *
@@ -1339,96 +2480,122 @@ var bridgeCameraState = z7.object({
    * where the correlation is used, in the cloud's bridge frame handler, and
    * stated here so nobody has to derive it from that code.
    */
-  request_id: z7.string().min(1).max(64).nullable()
+  request_id: z8.string().min(1).max(64).nullable()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_367ffc97d258be510904ed62d5d477a4/node_modules/@fleetless/contracts/dist/rest.js
-import { z as z8 } from "zod";
-var robot = z8.object({
-  id: z8.uuid(),
-  name: z8.string().min(1).max(63),
-  created_at: z8.iso.datetime()
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_1727a3f05719ef3ec49509ea01c84aa4/node_modules/@fleetless/contracts/dist/config-issues.js
+var EXPOSURE_SECTIONS = ["datapoints", "actions", "services", "publishers", "cameras"];
+var EXPOSURE_SECTION_NAMES = new Set(EXPOSURE_SECTIONS);
+
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_1727a3f05719ef3ec49509ea01c84aa4/node_modules/@fleetless/contracts/dist/rest.js
+import { z as z9 } from "zod";
+var robot = z9.object({
+  id: z9.uuid(),
+  name: z9.string().min(1).max(63),
+  created_at: z9.iso.datetime()
 });
-var createRobotRequest = z8.object({
-  name: z8.string().min(1).max(63)
+var createRobotRequest = z9.object({
+  name: z9.string().min(1).max(63)
 });
-var robotToken = z8.string().regex(/^frt_[0-9a-f]{32}$/);
-var createRobotResponse = z8.object({
+var robotToken = z9.string().regex(/^frt_[0-9a-f]{32}$/);
+var createRobotResponse = z9.object({
   robot,
   token: robotToken
 });
-var robotListItem = z8.object({
+var exposureCounts = z9.object({
+  datapoints: z9.number().int().nonnegative(),
+  actions: z9.number().int().nonnegative(),
+  services: z9.number().int().nonnegative(),
+  publishers: z9.number().int().nonnegative(),
+  cameras: z9.number().int().nonnegative()
+});
+var robotListItem = z9.object({
   ...robot.shape,
-  bridge_state: bridgeState
+  bridge_state: bridgeState,
+  /** Required, not optional: "we did not look" and "it exposes nothing" must not render the same. */
+  exposes: exposureCounts
 });
-var robotListResponse = z8.object({
-  robots: z8.array(robotListItem)
+var robotListResponse = z9.object({
+  robots: z9.array(robotListItem)
 });
-var datapointValue = z8.object({
+var datapointValue = z9.object({
   slug,
-  value: z8.unknown(),
-  timestamp_ms: z8.number().int().nonnegative()
+  value: z9.unknown(),
+  timestamp_ms: z9.number().int().nonnegative()
 });
-var robotDetailResponse = z8.object({
+var robotDetailResponse = z9.object({
   ...robotListItem.shape,
-  bridge_version: z8.string().min(1).nullable(),
-  last_hello_error: z8.object({
-    code: z8.string().min(1),
-    message: z8.string().min(1),
-    at: z8.iso.datetime()
+  bridge_version: z9.string().min(1).nullable(),
+  /**
+   * Cleared (set back to null) by the next successful hello from this
+   * robot's bridge — a warning that outlives the condition it warns
+   * about would be read as current state, and was.
+   */
+  last_hello_error: z9.object({
+    code: z9.string().min(1),
+    message: z9.string().min(1),
+    at: z9.iso.datetime()
   }).nullable(),
   config: configState
 });
-var configDraftResponse = z8.object({
-  doc: robotConfigDoc,
-  updated_at: z8.iso.datetime().nullable(),
-  issues: z8.array(validationIssue)
-});
-var putConfigDraftRequest = z8.object({ doc: robotConfigDoc });
-var publishConfigResponse = z8.object({
-  version: z8.number().int().positive(),
-  published_at: z8.iso.datetime()
-});
-var configVersionsResponse = z8.object({
-  versions: z8.array(z8.object({
-    version: z8.number().int().positive(),
-    published_at: z8.iso.datetime()
+var configDraftResponse = z9.object({
+  doc: robotConfigDoc.nullable(),
+  source: z9.string(),
+  updated_at: z9.iso.datetime().nullable(),
+  issues: z9.array(validationIssue)
+});
+var putConfigDraftRequest = z9.object({ source: z9.string().max(1e6) });
+var publishConfigResponse = z9.object({
+  version: z9.number().int().positive(),
+  published_at: z9.iso.datetime()
+});
+var configVersionsResponse = z9.object({
+  versions: z9.array(z9.object({
+    version: z9.number().int().positive(),
+    published_at: z9.iso.datetime()
   }))
 });
-var configVersionResponse = z8.object({
-  version: z8.number().int().positive(),
-  published_at: z8.iso.datetime(),
-  doc: robotConfigDoc
+var configVersionResponse = z9.object({
+  version: z9.number().int().positive(),
+  published_at: z9.iso.datetime(),
+  doc: robotConfigDoc,
+  source: z9.string()
 });
-var introspectionResponse = z8.object({
+var introspectionResponse = z9.object({
   graph: rosGraph,
-  fetched_at: z8.iso.datetime(),
-  stale: z8.boolean()
+  fetched_at: z9.iso.datetime(),
+  stale: z9.boolean()
 });
-var typesResponse = z8.object({
-  types: z8.array(typeDefinition)
+var typesResponse = z9.object({
+  types: z9.array(typeDefinition)
 });
-var fetchTypesRequest = z8.object({
-  type_names: z8.array(rosTypeName).min(1).max(50)
+var fetchTypesRequest = z9.object({
+  type_names: z9.array(rosTypeName).min(1).max(50)
 });
-var fetchTypesResponse = z8.object({
-  types: z8.array(typeDefinition),
-  unresolved: z8.array(z8.string())
+var fetchTypesResponse = z9.object({
+  types: z9.array(typeDefinition),
+  unresolved: z9.array(z9.string())
 });
-var datapointDescriptor = z8.object({
+var datapointDescriptor = z9.object({
   slug,
-  builtin: z8.boolean(),
-  unit: z8.string().nullable(),
-  range: datapointRange.nullable(),
-  rate: datapointRate.nullable()
+  builtin: z9.boolean(),
+  unit: z9.string().nullable(),
+  /**
+   * `null` for a built-in and for a datapoint published with no throttle —
+   * the same "no ceiling configured" fact `datapointConfig.rate_throttle_hz`
+   * itself carries as `0` or absence, just re-spelled nullable rather than
+   * optional because this shape is a read response, not a document a caller
+   * writes. Reuses `rateThrottleHz` so the 20 Hz ceiling is written once.
+   */
+  rate_throttle_hz: rateThrottleHz.nullable()
 });
-var datapointListResponse = z8.object({
-  datapoints: z8.array(datapointDescriptor)
+var datapointListResponse = z9.object({
+  datapoints: z9.array(datapointDescriptor)
 });
-var robotDetailsDoc = z8.record(z8.string().regex(/^[a-z][a-z0-9_-]{0,63}$/), z8.union([z8.string().max(4096), z8.number(), z8.boolean(), z8.array(z8.unknown()), z8.record(z8.string(), z8.unknown())]));
-var putRobotDetailsRequest = z8.object({ details: robotDetailsDoc });
-var invokeRequest = z8.object({
-  params: z8.record(z8.string(), z8.unknown()),
+var robotDetailsDoc = z9.record(z9.string().regex(/^[a-z][a-z0-9_-]{0,63}$/), z9.union([z9.string().max(4096), z9.number(), z9.boolean(), z9.array(z9.unknown()), z9.record(z9.string(), z9.unknown())]));
+var putRobotDetailsRequest = z9.object({ details: robotDetailsDoc });
+var invokeRequest = z9.object({
+  params: z9.record(z9.string(), z9.unknown()),
   /**
    * How long **this call** is worth waiting for, in milliseconds (W6b).
    *
@@ -1455,39 +2622,39 @@ var invokeRequest = z8.object({
    * *acceptance* — once a goal is accepted the job runs as long as it runs,
    * and is observed, not awaited.
    */
-  patience_ms: z8.number().int().min(MIN_PATIENCE_MS).max(MAX_PATIENCE_MS).optional()
+  patience_ms: z9.number().int().min(MIN_PATIENCE_MS).max(MAX_PATIENCE_MS).optional()
 });
-var cancelRequest = z8.object({
-  job_id: z8.uuid().nullable().optional()
+var cancelRequest = z9.object({
+  job_id: z9.uuid().nullable().optional()
 }).strict();
-var releaseLiveQuery = z8.object({
-  session_id: z8.uuid().optional()
+var releaseLiveQuery = z9.object({
+  session_id: z9.uuid().optional()
 }).strict();
-var invokeResponse = z8.object({
+var invokeResponse = z9.object({
   job,
   /** The slug's kind — see `commandResult.kind` for why the caller needs it. */
-  kind: z8.enum(["action", "service"])
+  kind: z9.enum(["action", "service"])
 });
-var serviceCallResponse = z8.object({
-  result: z8.unknown()
+var serviceCallResponse = z9.object({
+  result: z9.unknown()
 });
-var publishRequest = z8.object({
-  message: z8.record(z8.string(), z8.unknown())
+var publishRequest = z9.object({
+  message: z9.record(z9.string(), z9.unknown())
 });
-var jobResponse = z8.object({ job: job.nullable() });
-var rateLimitDetails = z8.object({
-  retry_after_ms: z8.number().int().nonnegative()
+var jobResponse = z9.object({ job: job.nullable() });
+var rateLimitDetails = z9.object({
+  retry_after_ms: z9.number().int().nonnegative()
 });
-var robotJobsResponse = z8.object({
-  jobs: z8.array(job)
+var robotJobsResponse = z9.object({
+  jobs: z9.array(job)
 });
-var exposure = z8.object({
+var exposure = z9.object({
   slug,
-  kind: z8.enum(["datapoint", "action", "service", "publisher", "camera"]),
-  builtin: z8.boolean()
+  kind: z9.enum(["datapoint", "action", "service", "publisher", "camera"]),
+  builtin: z9.boolean()
 });
-var exposureListResponse = z8.object({
-  exposures: z8.array(exposure)
+var exposureListResponse = z9.object({
+  exposures: z9.array(exposure)
 });
 var SNAPSHOT_HEADERS = {
   ageMs: "x-fleetless-age-ms",
@@ -1495,15 +2662,22 @@ var SNAPSHOT_HEADERS = {
   width: "x-fleetless-width",
   height: "x-fleetless-height"
 };
-var cameraDescriptor = z8.object({
+var cameraDescriptor = z9.object({
   slug,
-  width: z8.number().int().positive(),
-  height: z8.number().int().positive(),
-  fps: z8.number().int().positive(),
-  snapshot_interval_ms: z8.number().int().positive()
+  width: z9.number().int().positive(),
+  height: z9.number().int().positive(),
+  fps: z9.number().int().positive(),
+  /**
+   * Seconds, as the document spells it, reusing `snapshotIntervalSeconds` so
+   * the 1–3600 bound is written once. It was `snapshot_interval_ms` after the
+   * document moved to seconds, which left the cloud converting the unit on
+   * this descriptor and not on `datapointDescriptor` beside it — the same
+   * drift `rateThrottleHz` was extracted to stop.
+   */
+  snapshot_interval_seconds: snapshotIntervalSeconds
 });
-var cameraListResponse = z8.object({ cameras: z8.array(cameraDescriptor) });
-var liveSessionResponse = z8.object({
+var cameraListResponse = z9.object({ cameras: z9.array(cameraDescriptor) });
+var liveSessionResponse = z9.object({
   /**
    * This viewer's hold, and the **only** thing `DELETE` should be given
    * (W6b).
@@ -1521,43 +2695,76 @@ var liveSessionResponse = z8.object({
    * is going away entirely, still needs a way to let go. It is the blunt
    * form, and it is the one that strands other tabs; new callers pass the id.
    */
-  session_id: z8.uuid(),
-  url: z8.string().min(1),
-  room: z8.string().min(1),
-  token: z8.string().min(1),
-  expires_at: z8.iso.datetime()
+  session_id: z9.uuid(),
+  url: z9.string().min(1),
+  room: z9.string().min(1),
+  token: z9.string().min(1),
+  expires_at: z9.iso.datetime()
 });
-var snapshotMetaResponse = z8.object({
+var snapshotMetaResponse = z9.object({
   slug,
-  timestamp_ms: z8.number().int().nonnegative().nullable(),
-  age_ms: z8.number().int().nonnegative().nullable(),
-  width: z8.number().int().positive().nullable(),
-  height: z8.number().int().positive().nullable(),
-  mime: z8.string().nullable()
-});
-var historyQuery = z8.object({
-  from: z8.string().min(1).max(32),
+  timestamp_ms: z9.number().int().nonnegative().nullable(),
+  age_ms: z9.number().int().nonnegative().nullable(),
+  width: z9.number().int().positive().nullable(),
+  height: z9.number().int().positive().nullable(),
+  mime: z9.string().nullable()
+});
+var historyQuery = z9.object({
+  from: z9.string().min(1).max(32),
   /** Defaults to now. */
-  to: z8.string().min(1).max(32).optional(),
+  to: z9.string().min(1).max(32).optional(),
   /** Bucket width, e.g. `10s`, `1m`. Absent means raw samples. */
-  window: z8.string().min(2).max(16).optional(),
-  agg: z8.enum(["min", "max", "avg"]).optional(),
+  window: z9.string().min(2).max(16).optional(),
+  agg: z9.enum(["min", "max", "avg"]).optional(),
   /** A numeric field inside an object value, e.g. `pose.x` (§4.4 paths). */
-  field: z8.string().min(1).max(128).optional(),
+  field: z9.string().min(1).max(128).optional(),
   /**
-   * `z.coerce` because this schema describes a **query string**, where every
-   * value arrives as text. A bare `z.number()` would make each route coerce
-   * `limit` by hand before parsing — Nimbus had to, and flagged that the next
-   * query-taking route would have to as well. A schema that does not match
-   * the wire it describes exports its problem to every consumer.
+   * **A union whose input branch IS the wire, not a coercion (W9d, DEF-059).**
+   *
+   * This was `z.coerce.number()`, for a good reason that stayed true: the
+   * schema describes a **query string**, where every value arrives as text,
+   * and a bare `z.number()` would make each route coerce by hand. What was
+   * measured afterwards is that a coercion cannot be *published*: zod renders
+   * a coercion's **result** in either `io` mode, so `io: 'input'` and
+   * `io: 'output'` both emit `{"type":"integer"}` — an artifact describing a
+   * shape a query string can never carry. Anyone validating a real request
+   * against it rejects every one that sets `limit`.
+   *
+   * That is a **different** defect from the `.default()` class, which
+   * `io: 'input'` genuinely does fix; `export-schemas.ts` once claimed one
+   * remedy for both and has been corrected.
+   *
+   * A union states both truths honestly: the wire carries a numeric string,
+   * a programmatic caller may pass a number, and the artifact can render the
+   * input branch because there is one to render.
+   *
+   * **What the artifact no longer says, named here rather than left silent.**
+   * The `1..10000` bound lives in the `.pipe()`, which is the *output* half, so
+   * no input-mode artifact can express it as a constraint: the published shape
+   * is `^\d{1,5}$` or a bare integer, and five digits is a weak echo of the
+   * real ceiling. That is honest about the wire — the bound is enforced after
+   * parsing, not by the shape of the text — but it is a **reduction**, and an
+   * artifact that stops naming a bound reads as if there were none.
+   *
+   * So both branches carry the number in a `.describe()` (Nimbus-W9d's
+   * proposal). It is **not** a constraint and nothing validates against it; it
+   * means a generator, or a person reading only the published schema, sees the
+   * actual ceiling instead of nothing. The gap is narrowed and named rather
+   * than closed.
    */
-  limit: z8.coerce.number().int().positive().max(1e4).optional()
-});
-var historySamplesResponse = z8.object({
+  limit: z9.union([
+    z9.string().regex(/^\d{1,5}$/).describe("Positive integer, 1-10000. The pattern only bounds digit count; the real ceiling is enforced after parsing."),
+    // The same sentence on the numeric branch, for the same reason and one
+    // that is arguably stronger: without it the artifact publishes the full
+    // safe-integer range, which reads as *nine quadrillion is fine*.
+    z9.number().int().describe("Positive integer, 1-10000. The ceiling is enforced after parsing, not by this type.")
+  ]).transform((v) => Number(v)).pipe(z9.number().int().positive().max(1e4)).optional()
+});
+var historySamplesResponse = z9.object({
   slug,
-  kind: z8.literal("samples"),
-  samples: z8.array(z8.object({ timestamp_ms: z8.number().int().nonnegative(), value: z8.unknown() })),
-  truncated: z8.boolean(),
+  kind: z9.literal("samples"),
+  samples: z9.array(z9.object({ timestamp_ms: z9.number().int().nonnegative(), value: z9.unknown() })),
+  truncated: z9.boolean(),
   /**
    * Why it was cut, `null` when it was not — because the two causes have
    * **different remedies** and a single boolean cannot tell them apart:
@@ -1576,15 +2783,15 @@ var historySamplesResponse = z8.object({
    * `required` in the JSON Schema artifacts, which is the contradiction this
    * project has now hit five times.
    */
-  truncated_by: z8.enum(["limit", "bytes"]).nullable()
+  truncated_by: z9.enum(["limit", "bytes"]).nullable()
 });
-var historyBucketsResponse = z8.object({
+var historyBucketsResponse = z9.object({
   slug,
-  kind: z8.literal("buckets"),
-  window_ms: z8.number().int().positive(),
-  agg: z8.enum(["min", "max", "avg"]),
-  buckets: z8.array(z8.object({
-    bucket_start_ms: z8.number().int().nonnegative(),
+  kind: z9.literal("buckets"),
+  window_ms: z9.number().int().positive(),
+  agg: z9.enum(["min", "max", "avg"]),
+  buckets: z9.array(z9.object({
+    bucket_start_ms: z9.number().int().nonnegative(),
     /**
      * The aggregate over this bucket's **numeric** samples — or `null` when
      * none of them were numeric, which is **not** the same as the bucket
@@ -1602,7 +2809,7 @@ var historyBucketsResponse = z8.object({
      * so the second row above was indistinguishable from the first and the
      * console rendered "empty — no samples" over live data.
      */
-    value: z8.number().nullable(),
+    value: z9.number().nullable(),
     /**
      * Every sample that landed in this bucket and inside the queried range,
      * whether or not it contributed to `value` — which is the point of the
@@ -1619,10 +2826,10 @@ var historyBucketsResponse = z8.object({
      *   and only in-range samples are counted. A low edge count is a
      *   boundary effect, not a quiet period.
      */
-    sample_count: z8.number().int().nonnegative()
+    sample_count: z9.number().int().nonnegative()
   }))
 });
-var robotDeletionSummary = z8.object({
+var robotDeletionSummary = z9.object({
   /**
    * Datapoints, actions, services and publishers in the **published**
    * configuration — what the robot was actually running. **Cameras are not
@@ -1639,10 +2846,10 @@ var robotDeletionSummary = z8.object({
    * rather than by either of these: describing three things with two numbers
    * would make each of them mean something else.
    */
-  slug_count: z8.number().int().nonnegative(),
-  sample_rows: z8.number().int().nonnegative(),
-  bytes_freed: z8.number().int().nonnegative(),
-  cameras: z8.array(slug),
+  slug_count: z9.number().int().nonnegative(),
+  sample_rows: z9.number().int().nonnegative(),
+  bytes_freed: z9.number().int().nonnegative(),
+  cameras: z9.array(slug),
   /**
    * Assets destroyed with the robot (W7), and **`asset_bytes_freed` is what
    * this org actually gets back** — not the sum of the assets' sizes.
@@ -1658,9 +2865,40 @@ var robotDeletionSummary = z8.object({
    * `asset_count` is the plain count of the robot's asset rows, all of which
    * do go away.
    */
-  asset_count: z8.number().int().nonnegative(),
-  asset_bytes_freed: z8.number().int().nonnegative(),
-  had_live_session: z8.boolean(),
+  asset_count: z9.number().int().nonnegative(),
+  asset_bytes_freed: z9.number().int().nonnegative(),
+  /**
+   * How many rows of run history go with the robot — every recorded
+   * invocation of one of its actions or services, up to
+   * `JOB_RUN_RETENTION_DAYS`.
+   *
+   * Its own number, never folded into `slug_count`, for the same reason
+   * `cameras` is not: `slug_count` counts *configuration* — what the robot
+   * was set up to do — and this counts *what was actually done*, over as
+   * much as 90 days. One robot with four slugs can carry forty thousand
+   * runs, and a sentence that added them would describe two unrelated
+   * magnitudes with one number on the one screen whose entire justification
+   * is naming what an irreversible click destroys.
+   *
+   * It is also the only field here that names *people*: a run row carries
+   * the `jobActor` who invoked it — a developer's or end user's email,
+   * snapshotted at invoke time. So this deletion destroys attributed history
+   * of who asked the machine to do what, which is a different kind of loss
+   * from a count of sample rows and deserves to be said out loud rather than
+   * inferred.
+   *
+   * **Bridge latency buckets are deliberately not counted here, and this is
+   * the note saying so** rather than leaving the asymmetry to be
+   * rediscovered as an omission. They are platform telemetry with a seven-day
+   * life (`BRIDGE_LATENCY_RETENTION_DAYS`), produced by the cloud's own
+   * pinging rather than by anything the developer did, counted against no
+   * retention quota, and worth nothing to anybody after the robot is gone.
+   * This summary is read aloud to a human deciding whether to click, and its
+   * value comes from naming what the *developer* loses; a number for
+   * telemetry they never asked for and cannot use would dilute exactly that.
+   */
+  job_run_count: z9.number().int().nonnegative(),
+  had_live_session: z9.boolean(),
   /**
    * Whether an unpublished draft went with it — separately, because the
    * counts above deliberately do not include it and a record that silently
@@ -1670,7 +2908,7 @@ var robotDeletionSummary = z8.object({
    * there the counts are zero and this is the only field saying anything
    * was there at all.
    */
-  had_unpublished_draft: z8.boolean()
+  had_unpublished_draft: z9.boolean()
 });
 var RESOURCE_HEALTH_STATES = [
   "ok",
@@ -1691,9 +2929,12 @@ var RESOURCE_HEALTH_STATES = [
    * `unknown`, which means "the robot reported a failure we cannot classify"
    * — a different fact with a different fix.
    *
-   * It is reachable by a typo: `cloud-config-frame.ts` deliberately tolerates
-   * an unresolved `credentials_ref` at publish time, so this is an ordinary
-   * developer mistake rather than an edge case.
+   * **Retiring with the credential store**, and not live behaviour to build
+   * against. Its one producer was `cloud-config-frame.ts` tolerating an
+   * unresolved `credentials_ref` at publish time; FL-002 deleted that field,
+   * so nothing emits this today. It is kept only until the wave that removes
+   * the store also removes these three credential states — `unreadable_credential`
+   * and the `readable` fact on `credentialSummary` go the same way.
    */
   "credential_missing",
   /** A configuration change stopped this stream, deliberately. */
@@ -1712,31 +2953,50 @@ var RESOURCE_HEALTH_STATES = [
    */
   "unknown"
 ];
-var resourceHealthState = z8.object({
-  robot_id: z8.uuid(),
-  kind: z8.enum(["camera", "credential"]),
+var resourceHealthState = z9.object({
+  robot_id: z9.uuid(),
+  kind: z9.enum(["camera"]),
   /** The camera slug, or the credential name. */
-  ref: z8.string().min(1).max(64),
-  state: z8.enum(RESOURCE_HEALTH_STATES),
+  ref: z9.string().min(1).max(64),
+  /**
+   * **Which of two questions this entry answers (W9a, DEF-072).**
+   *
+   * `'source'`  — can the source be read at all? (`unreachable`, `auth_failed`,
+   *               `unreadable_credential`, `missing_credential`, `ok`, …)
+   * `'publish'` — given a readable source, did publishing to LiveKit work?
+   *
+   * Before this, both went into one entry keyed `${robot} ${kind} ${ref}` with
+   * one flat `state`, in which `publish_failed` answered *"can we publish"*
+   * and every other value answered *"can the source be read"* — **same key,
+   * same field, two questions**, so each overwrote the other. The conflation
+   * was once an occasional race; W6a's reconnect restatement made it
+   * guaranteed, on every reconnect, for any camera with an active viewer.
+   *
+   * The facet is part of the entry's identity: a camera can perfectly well be
+   * readable and unpublishable at the same moment, and that pair is exactly
+   * what a developer needs to see rather than whichever fact arrived last.
+   */
+  facet: z9.enum(["source", "publish"]),
+  state: z9.enum(RESOURCE_HEALTH_STATES),
   /** A short human-readable reason, or `null`. Never an exception message. */
-  reason: z8.string().max(200).nullable(),
+  reason: z9.string().max(200).nullable(),
   /**
    * When this state was entered — not when it was sent. A page that loads
    * late must be able to tell a failure from a minute ago from one from
    * yesterday, and a state with only a send time cannot.
    */
-  changed_at_ms: z8.number().int().nonnegative()
-});
-var resourceHealthListResponse = z8.object({
-  resources: z8.array(resourceHealthState)
-});
-var orgQuotas = z8.object({
-  max_robots: z8.number().int().positive(),
-  max_apps: z8.number().int().positive(),
-  max_end_users: z8.number().int().positive(),
-  max_retention_bytes: z8.number().int().nonnegative(),
-  max_retention_writes_per_minute: z8.number().int().nonnegative(),
-  max_realtime_connections: z8.number().int().positive(),
+  changed_at_ms: z9.number().int().nonnegative()
+});
+var resourceHealthListResponse = z9.object({
+  resources: z9.array(resourceHealthState)
+});
+var orgQuotas = z9.object({
+  max_robots: z9.number().int().positive(),
+  max_apps: z9.number().int().positive(),
+  max_end_users: z9.number().int().positive(),
+  max_retention_bytes: z9.number().int().nonnegative(),
+  max_retention_writes_per_minute: z9.number().int().nonnegative(),
+  max_realtime_connections: z9.number().int().positive(),
   /**
    * Asset storage (§4.6, W7) — **its own dial, not part of
    * `max_retention_bytes`.** A sync grows storage in jumps and time series
@@ -1763,78 +3023,138 @@ var orgQuotas = z8.object({
    * which nobody can predict. Measured before the change: 342 bytes held by an
    * org owning no assets, with no operation able to free them.
    */
-  max_asset_storage_bytes: z8.number().int().nonnegative()
-});
-var orgQuotaUsageCounts = z8.object({
-  max_robots: z8.number().int().nonnegative(),
-  max_apps: z8.number().int().nonnegative(),
-  max_end_users: z8.number().int().nonnegative(),
-  max_retention_bytes: z8.number().int().nonnegative(),
-  max_asset_storage_bytes: z8.number().int().nonnegative(),
-  max_retention_writes_per_minute: z8.number().int().nonnegative(),
-  max_realtime_connections: z8.number().int().nonnegative()
+  max_asset_storage_bytes: z9.number().int().nonnegative()
+});
+var orgQuotaUsageCounts = z9.object({
+  max_robots: z9.number().int().nonnegative(),
+  max_apps: z9.number().int().nonnegative(),
+  max_end_users: z9.number().int().nonnegative(),
+  max_retention_bytes: z9.number().int().nonnegative(),
+  max_asset_storage_bytes: z9.number().int().nonnegative(),
+  max_retention_writes_per_minute: z9.number().int().nonnegative(),
+  max_realtime_connections: z9.number().int().nonnegative()
 }).partial();
-var orgQuotaUsage = z8.object({ quotas: orgQuotas, usage: orgQuotaUsageCounts });
-var credentialSummary = z8.object({
-  name: z8.string().min(1).max(64),
-  username: z8.string().nullable(),
-  /**
-   * Whether a password has ever been stored for this name.
-   *
-   * **Always `true` today**, and stated so rather than left to be inferred:
-   * `credentialWriteRequest` requires a non-empty password, so no row can
-   * exist without one, and both write paths set this literally. A consumer
-   * branching on `set === false` is writing dead code — the SDK README
-   * currently teaches exactly that (Momus, W6a review).
-   *
-   * The field is kept because the fact it names is the one `readable`
-   * qualifies, and because a username-only credential is a plausible future
-   * shape. If that never arrives, this should be removed rather than left as
-   * a permanent constant wearing the costume of a question.
-   */
-  set: z8.boolean(),
-  /**
-   * Whether that password can still be **decrypted** — a different fact from
-   * `set`, and deliberately a second field rather than a tri-state on the
-   * first (W6a).
-   *
-   * They come apart when `CAMERA_CREDENTIALS_KEY` is rotated, unset or wrong,
-   * or when a row is corrupt. W6 made that survivable: one unreadable
-   * credential costs the cameras that reference it instead of taking the
-   * robot offline. But the surviving failure was **invisible** — this route
-   * answered `set: true` with `used_by` naming the dependent camera, for a
-   * credential that ships as `credentials: {}` on every config frame, and the
-   * only evidence was a server log no developer can read.
-   *
-   * `set: true, readable: false` is therefore the shape that says "a password
-   * is stored and this platform can no longer use it" — which is a thing to
-   * act on, and nothing else in the API could say it.
-   */
-  readable: z8.boolean(),
-  used_by: z8.array(z8.object({ robot_id: z8.uuid(), slug }))
-});
-var credentialListResponse = z8.object({ credentials: z8.array(credentialSummary) });
-var credentialWriteRequest = z8.object({
-  username: z8.string().min(1).max(128),
-  password: z8.string().min(1).max(512)
+var orgQuotaUsage = z9.object({ quotas: orgQuotas, usage: orgQuotaUsageCounts });
+var LATENCY_BUCKET_MS = 6e4;
+var latencyBucket = z9.object({
+  /** Truncated to the minute. */
+  bucket_at: z9.iso.datetime(),
+  /**
+   * `null` exactly when `samples` is 0. A minute in which the robot was offline
+   * throughout has **no** latency; writing `0` would put the number meaning
+   * "perfectly fast" into the state meaning "not there at all".
+   */
+  min_ms: z9.number().nonnegative().nullable(),
+  avg_ms: z9.number().nonnegative().nullable(),
+  max_ms: z9.number().nonnegative().nullable(),
+  samples: z9.number().int().nonnegative(),
+  /**
+   * Milliseconds of this bucket the cloud held the robot online.
+   *
+   * A duration and **not a ratio**: a ratio needs a denominator, and here that
+   * would be expected pings per minute — `pingIntervalMs`, which is
+   * configurable and is shrunk in tests. A stored value whose meaning depends
+   * on a configuration variable is not comparable across the time it is stored
+   * for. A client divides by `LATENCY_BUCKET_MS` if it wants a fraction.
+   */
+  online_ms: z9.number().int().min(0).max(LATENCY_BUCKET_MS)
+});
+var robotLatencySeries = z9.object({
+  robot_id: z9.uuid(),
+  buckets: z9.array(latencyBucket)
+});
+var orgLatencyQuery = z9.object({
+  from_ms: wireTimestampMs,
+  /** Exclusive — half-open `[from, to)`, the convention every other query here already follows (DEF-062). */
+  to_ms: wireTimestampMs,
+  /**
+   * One robot's own sparkline. `z.uuid()`, because the column is one —
+   * the same fix in the same place `auditQuery.actor_id` documents at
+   * length: a non-uuid reaching Postgres as a uuid parameter answers
+   * `500 internal_error`, and a 500 explains nothing.
+   */
+  robot_id: z9.uuid().optional()
+}).strict().refine((query) => query.from_ms < query.to_ms, {
+  message: "from_ms must be strictly before to_ms",
+  path: ["from_ms"]
+});
+var orgLatencyResponse = z9.object({
+  series: z9.array(robotLatencySeries),
+  from_ms: z9.number().int().nonnegative(),
+  to_ms: z9.number().int().nonnegative(),
+  truncated: z9.boolean(),
+  /**
+   * Which ceiling cut the response short, `null` when nothing did — borrowed
+   * from `historySamplesResponse.truncated_by` rather than invented a second
+   * time, for its reason: one boolean cannot carry two different remedies.
+   */
+  truncated_by: z9.enum(["limit", "bytes"]).nullable()
+});
+var usageMetric = z9.enum(["api_calls", "live_session_ms", "retention_bytes", "asset_bytes", "robot_online_ms"]);
+var usageDay = z9.string().regex(/^\d{4}-\d{2}-\d{2}$/, "must be a UTC calendar day, YYYY-MM-DD").refine((day) => {
+  const parsed = /* @__PURE__ */ new Date(`${day}T00:00:00.000Z`);
+  return !Number.isNaN(parsed.getTime()) && parsed.toISOString().slice(0, 10) === day;
+}, { message: "must be a UTC calendar day, YYYY-MM-DD" });
+var orgUsageQuery = z9.object({ from_day: usageDay, to_day: usageDay }).strict().refine((query) => query.from_day <= query.to_day, {
+  message: "from_day must not be after to_day",
+  path: ["from_day"]
+});
+var usageRow = z9.object({
+  app_id: z9.uuid().nullable(),
+  app_name: z9.string().nullable(),
+  metric: usageMetric,
+  day: usageDay,
+  value: z9.number().int().nonnegative()
+});
+var orgUsageResponse = z9.object({
+  rows: z9.array(usageRow),
+  from_day: usageDay,
+  to_day: usageDay
+});
+var patchRobotRequest = z9.object({ name: z9.string().min(1).max(63) }).strict();
+var renameSlugRequest = z9.object({ from: slug, to: slug }).strict();
+var renameSlugResponse = z9.object({
+  rewritten_grants: z9.number().int().nonnegative(),
+  history_moved: z9.boolean(),
+  requires_publish: z9.literal(true)
+});
+var slugUsageResponse = z9.object({
+  grant_count: z9.number().int().nonnegative(),
+  app_identifiers: z9.array(z9.string()),
+  has_recorded_history: z9.boolean(),
+  alert_count: z9.number().int().nonnegative()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_367ffc97d258be510904ed62d5d477a4/node_modules/@fleetless/contracts/dist/realtime.js
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_1727a3f05719ef3ec49509ea01c84aa4/node_modules/@fleetless/contracts/dist/realtime.js
+import { z as z12 } from "zod";
+
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_1727a3f05719ef3ec49509ea01c84aa4/node_modules/@fleetless/contracts/dist/client-auth.js
 import { z as z11 } from "zod";
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_367ffc97d258be510904ed62d5d477a4/node_modules/@fleetless/contracts/dist/client-auth.js
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_1727a3f05719ef3ec49509ea01c84aa4/node_modules/@fleetless/contracts/dist/apps.js
 import { z as z10 } from "zod";
-
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_367ffc97d258be510904ed62d5d477a4/node_modules/@fleetless/contracts/dist/apps.js
-import { z as z9 } from "zod";
 var appIdentifier = slug;
-var app = z9.object({
-  id: z9.uuid(),
-  org_id: z9.uuid(),
-  name: z9.string().min(1).max(120),
+var app = z10.object({
+  id: z10.uuid(),
+  org_id: z10.uuid(),
+  name: z10.string().min(1).max(120),
   identifier: appIdentifier,
+  /**
+   * **Exactly one group owns this app** (2026-08-29 identity redesign, D2).
+   * The app uses that group's auth provider, and only users of that group can
+   * hold an assignment for it — which is why re-linking cascade-deletes the
+   * assignments that stop being valid.
+   *
+   * Not nullable and not optional: "an app with no group" is not a state the
+   * model has, and an optional field here would let a mapper that forgot the
+   * column produce one anyway.
+   *
+   * Changing it is `PUT /api/apps/:id/group` with `putAppGroupRequest`, never
+   * `updateAppRequest` — see the comment there.
+   */
+  group_id: z10.uuid(),
   /** Robots are referenced individually; tags never grant rights (§12.2). */
-  robot_ids: z9.array(z9.uuid()),
+  robot_ids: z10.array(z10.uuid()),
   /**
    * Whether this app accepts **self-registering** OAuth clients (RFC 7591).
    *
@@ -1847,81 +3167,98 @@ var app = z9.object({
    *
    * The flag is app state rather than a deployment setting so that turning it
    * on is a decision somebody made about one app, visible in the console and
-   * in the audit log. It is also the precursor of W7c's MCP-App kind — the
-   * model grows here rather than being retrofitted around it.
-   */
-  accepts_dynamic_clients: z9.boolean(),
-  /**
-   * Whether this app serves a remote MCP server at `/mcp/<identifier>` (§17).
-   *
-   * **A switch, not an app kind.** §2 and §17 called the MCP app *"eine eigene
-   * App-Art"*; André decided on 2026-08-18 that it is a per-app switch the
-   * developer flips in the console, and §17 was reworded in the same wave
-   * rather than left contradicting this field. The model grows here — which
-   * is what the comment on `accepts_dynamic_clients` above predicted it would
-   * do, one wave before there was anything to add.
-   *
-   * The two switches are related and not the same. `accepts_dynamic_clients`
-   * decides whether a client may **register itself**; this one decides whether
-   * there is anything for it to reach. An MCP app will usually want both,
-   * because §17's end user *"trägt nur die URL ein"* and the AI tool registers
-   * itself — but a developer who registers their own MCP client by hand wants
-   * exactly this one, and coupling them would take that away.
-   *
-   * **Off means off at the metadata too.** With this false, `/mcp/<app>`
-   * answers `404` and so do its discovery documents. A resource that is
-   * advertised and not served sends a conforming client through the whole
-   * discovery chain to a door that is not there — and W7b spent a wave making
-   * that chain walkable.
-   */
-  mcp_enabled: z9.boolean(),
-  created_at: z9.iso.datetime()
+   * in the audit log.
+   *
+   * **It is the only switch left on an app, and the sibling it used to have
+   * is worth remembering.** W7c added `mcp_enabled` beside it — "whether this
+   * app serves a remote MCP server at `/mcp/<identifier>`" — and the
+   * central-MCP cut (D5, 2026-08-29) deleted the per-app endpoint it named.
+   * The field outlived its endpoint by a release, gating nothing but one
+   * `resource` branch of the legacy OAuth stub, and was removed on
+   * 2026-08-29. `orgGroup.mcp_enabled` in `identity.ts` is a **different**
+   * field with a live door behind it (`cloud/src/mcp-access.ts`); the two
+   * shared a name and never a meaning.
+   */
+  accepts_dynamic_clients: z10.boolean(),
+  /**
+   * **The app's default role** (2026-08-29 identity redesign, D1: *"role +
+   * rights matrix and default role in app settings"*).
+   *
+   * Two consumers, one field. The console prefills it when an admin assigns a
+   * user (`putAssignmentRequest` still carries the role explicitly — a
+   * prefill is not a default the server applies), and the cloud authorizes an
+   * **org admin** with it: admins hold no assignments (see `appAssignment`),
+   * so an app login by one has to get its role from somewhere, and until D4's
+   * impersonation interstitial lands this is that somewhere.
+   *
+   * `null` — and nullable rather than absent — means *this app has not chosen
+   * one*. That is a normal state, not an unset field: every app is created
+   * before its roles are configured, and the cloud falls back to the
+   * least-privileged builtin (`observe`) by name rather than picking a role by
+   * position. An app whose default role is deleted lands back here.
+   *
+   * The role must belong to **this** app; the schema sees a uuid and cannot
+   * check that, so `PATCH /api/apps/:id` does.
+   */
+  default_role_id: z10.uuid().nullable(),
+  created_at: z10.iso.datetime()
 });
-var createAppRequest = z9.object({
-  name: z9.string().min(1).max(120),
+var createAppRequest = z10.object({
+  name: z10.string().min(1).max(120),
   identifier: appIdentifier,
-  robot_ids: z9.array(z9.uuid()).optional(),
+  robot_ids: z10.array(z10.uuid()).optional(),
   /** Optional, defaulting to `false` — same reasoning as `robot_ids` above: setting it at creation is the obvious operation, and refusing it here would make a `.strict()` request reject the field the caller can plainly see on `app`. */
-  accepts_dynamic_clients: z9.boolean().optional(),
-  /**
-   * **W7c's playbook said this field would not be accepted here, and the
-   * sentence above is why that was wrong.** The argument for refusing it was
-   * W7's `robot_ids` finding — a create shape that silently drops a field cost
-   * two people a day each. But that finding was closed by *accepting* the
-   * field, not by refusing it, and this request is `.strict()`: refusing
-   * `mcp_enabled` would make it `400` on a field the caller can plainly see on
-   * `app`, which is the exact shape the line above rejects. One rule, both
-   * switches.
-   */
-  mcp_enabled: z9.boolean().optional()
+  accepts_dynamic_clients: z10.boolean().optional(),
+  /**
+   * Required, unlike the switch above: an app belongs to exactly one
+   * group from the moment it exists (D2), there is no sensible default — the
+   * Org Admins group would be the one group whose members never hold
+   * assignments — and a defaulted answer here decides who can log into the app.
+   */
+  group_id: z10.uuid()
 }).strict();
-var updateAppRequest = z9.object({
-  name: z9.string().min(1).max(120).optional(),
-  robot_ids: z9.array(z9.uuid()).optional(),
-  accepts_dynamic_clients: z9.boolean().optional(),
-  mcp_enabled: z9.boolean().optional()
-});
-var serverKeyToken = z9.string().regex(/^flk_[0-9a-f]{32}$/);
-var serverKey = z9.object({
-  id: z9.uuid(),
-  app_id: z9.uuid(),
-  name: z9.string().min(1).max(120),
-  created_at: z9.iso.datetime(),
+var updateAppRequest = z10.object({
+  name: z10.string().min(1).max(120).optional(),
+  robot_ids: z10.array(z10.uuid()).optional(),
+  accepts_dynamic_clients: z10.boolean().optional(),
+  /**
+   * `app.default_role_id`'s write half — an app *setting*, which is where D1
+   * put the default role, so it belongs on the app's own PATCH and not on a
+   * route of its own.
+   *
+   * **`.nullable().optional()`, and the two mean different things.** Absent
+   * leaves the current default alone; an explicit `null` clears it. A field
+   * that could only be set and never unset would make "we changed our mind"
+   * unreachable through the API — the same silence `group_id` above was made
+   * strict to avoid, from the other direction.
+   *
+   * Unlike `group_id`, this carries no cascade: changing it invalidates no
+   * assignment and cuts nobody off, so it needs no acknowledgement and no
+   * route of its own.
+   */
+  default_role_id: z10.uuid().nullable().optional()
+}).strict();
+var serverKeyToken = z10.string().regex(/^flk_[0-9a-f]{32}$/);
+var serverKey = z10.object({
+  id: z10.uuid(),
+  app_id: z10.uuid(),
+  name: z10.string().min(1).max(120),
+  created_at: z10.iso.datetime(),
   /** Null until first use — the cheapest way to spot a key nobody needs. */
-  last_used_at: z9.iso.datetime().nullable()
+  last_used_at: z10.iso.datetime().nullable()
 });
-var createServerKeyResponse = z9.object({
+var createServerKeyResponse = z10.object({
   server_key: serverKey,
   key: serverKeyToken
 });
-var role = z9.object({
-  id: z9.uuid(),
-  app_id: z9.uuid(),
-  name: z9.string().min(1).max(60),
-  builtin: z9.boolean()
+var role = z10.object({
+  id: z10.uuid(),
+  app_id: z10.uuid(),
+  name: z10.string().min(1).max(60),
+  builtin: z10.boolean()
 });
-var rolePermissions = z9.object({
-  role_id: z9.uuid(),
+var rolePermissions = z10.object({
+  role_id: z10.uuid(),
   /**
    * **A slug is unique per robot across ALL service kinds** (spec §4.1:
    * "Jeder Dienst erhält einen Slug" — one namespace, not one per kind), and
@@ -1934,91 +3271,169 @@ var rolePermissions = z9.object({
    * today it enumerates datapoints only, which is the seam that would
    * otherwise force a rebuild.
    */
-  grants: z9.array(z9.object({
-    robot_id: z9.uuid(),
-    slugs: z9.array(slug)
+  grants: z10.array(z10.object({
+    robot_id: z10.uuid(),
+    slugs: z10.array(slug)
   })),
   /**
    * App-wide abilities a role grants, as opposed to per-slug grants above.
    *
-   * **A capability here is a promise, and two of them have not been kept.**
-   * `action_history` and `presence` have been gated by this object since W4
-   * and are implemented nowhere — no route, no SDK method, no realtime frame
-   * (register row 8). A console can therefore switch them on and nothing
-   * changes, which is worse than their absence: the developer believes they
-   * granted something.
+   * **A capability here is a promise, and one of them is still not kept.**
+   * `action_history` and `presence` were both gated by this object from W4
+   * and implemented nowhere — no route, no SDK method, no realtime frame
+   * (register row 8). A console could therefore switch them on and nothing
+   * changed, which is worse than their absence: the developer believes they
+   * granted something. **This paragraph stays** whatever the current tally
+   * is: it is the only place that says a switch in the console may change
+   * nothing, and it is how the next unkept capability gets caught.
    *
-   * `assets` (W7) must not become the third. It gates §4.6's asset store,
+   * `assets` (W7) was the first one redeemed. It gates §4.6's asset store,
    * which is not covered by `grants` because **assets are not slugs** — and it
    * is its own decision rather than a side effect of reaching the robot,
    * because a mesh set gives away the machine's build.
+   *
+   * **`action_history` is kept as of the run-history delta.** It gates
+   * `GET /api/robots/:id/jobs/history` — an end user whose role lacks it is
+   * refused `403 capability_required`, naming the capability so the developer
+   * knows which switch is off. It was unkeepable while nothing durable
+   * recorded what had run; `jobRun` and `job_runs` are that record.
+   *
+   * **What granting it discloses.** A `jobRun` names the actor who invoked
+   * it, and `jobActor.label` is an email — so an end user holding this
+   * capability learns which *other* people have been driving that robot.
+   * That is inherent in "may read the history" rather than an oversight, and
+   * it is written down here because the switch lives in the console while its
+   * consequence does not.
+   *
+   * **`presence` is still not implemented.** Nothing in the cloud, the SDK or
+   * the realtime protocol consults it. It remains exactly what the first
+   * paragraph describes.
    */
-  capabilities: z9.object({
-    action_history: z9.boolean(),
-    presence: z9.boolean(),
-    assets: z9.boolean()
+  capabilities: z10.object({
+    action_history: z10.boolean(),
+    presence: z10.boolean(),
+    assets: z10.boolean()
   })
 });
-var appMembership = z9.object({
-  end_user_id: z9.uuid(),
-  app_id: z9.uuid(),
-  role_id: z9.uuid()
-});
-var brandingConfig = z9.object({
+var brandingConfig = z10.object({
   /** `#rrggbb`, lowercase — one canonical spelling so two configs that look identical are identical. */
-  primary_color: z9.string().regex(/^#[0-9a-f]{6}$/, "primary_color must be lowercase #rrggbb"),
+  primary_color: z10.string().regex(/^#[0-9a-f]{6}$/, "primary_color must be lowercase #rrggbb"),
   /**
    * 256 KiB of raw image at most. Base64 costs 4 bytes per 3, so the encoded
    * ceiling is stated here in encoded characters — the unit the validator can
    * actually count, rather than one it would have to infer.
    */
-  logo_data_uri: z9.string().max(349528).regex(/^data:image\/(png|jpeg);base64,[A-Za-z0-9+/]+={0,2}$/, "logo must be a base64 data URI of image/png or image/jpeg").optional(),
-  footer_text: z9.string().min(1).max(200).optional()
+  logo_data_uri: z10.string().max(349528).regex(/^data:image\/(png|jpeg);base64,[A-Za-z0-9+/]+={0,2}$/, "logo must be a base64 data URI of image/png or image/jpeg").optional(),
+  footer_text: z10.string().min(1).max(200).optional()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_367ffc97d258be510904ed62d5d477a4/node_modules/@fleetless/contracts/dist/client-auth.js
-var clientLoginRequest = z10.object({
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_1727a3f05719ef3ec49509ea01c84aa4/node_modules/@fleetless/contracts/dist/client-auth.js
+var clientLoginRequest = z11.object({
   app_identifier: appIdentifier,
-  email: z10.email(),
-  password: z10.string().min(1)
-});
-var clientRefreshRequest = z10.object({
-  refresh_token: z10.string().min(1)
-});
-var clientLogoutRequest = z10.object({
-  refresh_token: z10.string().min(1)
-});
-var clientIdentity = z10.object({
-  kind: z10.enum(["developer", "end_user", "server_key"]),
-  developer_id: z10.uuid().nullable(),
-  end_user_id: z10.uuid().nullable(),
-  server_key_id: z10.uuid().nullable(),
-  app_id: z10.uuid().nullable(),
-  role_id: z10.uuid().nullable(),
-  email: z10.email().nullable()
+  email: z11.email(),
+  password: z11.string().min(1)
+});
+var clientRefreshRequest = z11.object({
+  refresh_token: z11.string().min(1)
+});
+var clientLogoutRequest = z11.object({
+  refresh_token: z11.string().min(1)
+});
+var clientLogoutResponse = z11.object({
+  idp_logout: z11.discriminatedUnion("status", [
+    z11.object({
+      status: z11.literal("redirect"),
+      /** Send the browser here. Built from the IdP's own `end_session_endpoint`. */
+      url: z11.url().max(2e3)
+    }),
+    /** This session did not come from an IdP — there is nothing else to end. */
+    z11.object({ status: z11.literal("not_federated") }),
+    /**
+     * It did, and the IdP's discovery document names no `end_session_endpoint`
+     * (RP-initiated logout is optional in OIDC). **The IdP session survives and
+     * this platform cannot end it** — say so rather than implying success.
+     */
+    z11.object({ status: z11.literal("unsupported_by_idp") }),
+    /**
+     * **Federated, the IdP *can* end the session, and we cannot ask it to
+     * (W9c, Nimbus-W9c's proposal).**
+     *
+     * `id_token_hint` is missing: the stored value could not be decrypted, or
+     * the session predates the fix that started keeping one. Deliberately not
+     * folded into `unsupported_by_idp` — there the cause is **the IdP's**, here
+     * it is **ours**, and an operator reading a rise in these needs to know
+     * which of the two they are looking at.
+     *
+     * **No `url` field, and that is the whole point.** Sending somebody to a
+     * bare `end_session_endpoint` produces a page that *asks* rather than one
+     * that ends — measured against real Keycloak, which renders *"Do you want
+     * to log out?"* and leaves the session alive. An outcome that promises
+     * something it does not deliver is worse than one that admits it.
+     *
+     * **The two causes are one status on purpose.** A caller can do nothing
+     * differently between "decryption failed" and "this session is older than
+     * the fix" — both mean *the IdP session survives and you cannot end it
+     * from here*. The distinction matters to whoever runs this platform, and
+     * it belongs in the server's log, not on the wire: splitting a wire enum
+     * to carry a fact no consumer can act on is how a contract grows keys
+     * nobody reads.
+     */
+    z11.object({ status: z11.literal("hint_unavailable") }),
+    /**
+     * **The server does not know this session, so it can say nothing about an
+     * IdP** (W9 review, Argus-W9; André, 2026-08-19).
+     *
+     * The token was unknown, already superseded, revoked, or expired. There is
+     * nothing to end here and — this is the whole point — **nothing to claim
+     * either**. `not_federated` would be a statement about a login this server
+     * never saw.
+     *
+     * Same shape of argument that produced `hint_unavailable`: *there the cause
+     * is the IdP's, here it is ours.* Here it is neither — it is an **absence
+     * of knowledge**, and a contract whose job on this route is to keep facts
+     * apart should not spend a fact it does not have.
+     *
+     * **What a caller does with it: nothing, but not the same nothing as
+     * `not_federated`.** A first logout in the same flow may well have returned
+     * a `redirect` that is still worth following. Reading this as *"the user is
+     * fully logged out"* is exactly the mistake a second logout invites.
+     */
+    z11.object({ status: z11.literal("session_unknown") })
+  ])
+});
+var clientIdentity = z11.object({
+  kind: z11.enum(["developer", "end_user", "server_key"]),
+  developer_id: z11.uuid().nullable(),
+  end_user_id: z11.uuid().nullable(),
+  server_key_id: z11.uuid().nullable(),
+  app_id: z11.uuid().nullable(),
+  role_id: z11.uuid().nullable(),
+  email: z11.email().nullable(),
+  /** Present only under impersonation — the real admin's user id (D4, `act`-claim). */
+  act: z11.object({ admin_user_id: z11.uuid() }).strict().optional()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_367ffc97d258be510904ed62d5d477a4/node_modules/@fleetless/contracts/dist/realtime.js
-var clientAuth = z11.object({
-  type: z11.literal("auth"),
-  token: z11.string().min(1)
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_1727a3f05719ef3ec49509ea01c84aa4/node_modules/@fleetless/contracts/dist/realtime.js
+var clientAuth = z12.object({
+  type: z12.literal("auth"),
+  token: z12.string().min(1)
 });
-var authOk = z11.object({
-  type: z11.literal("auth_ok"),
+var authOk = z12.object({
+  type: z12.literal("auth_ok"),
   identity: clientIdentity
 });
-var authError = z11.object({
-  type: z11.literal("auth_error"),
-  code: z11.string().min(1),
-  message: z11.string().min(1)
+var authError = z12.object({
+  type: z12.literal("auth_error"),
+  code: z12.string().min(1),
+  message: z12.string().min(1)
 });
-var clientInvoke = z11.object({
-  type: z11.literal("invoke"),
-  request_id: z11.string().min(1).max(64),
-  robot_id: z11.uuid(),
+var clientInvoke = z12.object({
+  type: z12.literal("invoke"),
+  request_id: z12.string().min(1).max(64),
+  robot_id: z12.uuid(),
   slug,
   /** Parameters by field path, validated against the config's rules (§4.4). */
-  params: z11.record(z11.string(), z11.unknown()),
+  params: z12.record(z12.string(), z12.unknown()),
   /**
    * How long this one call is worth waiting for (W6b) — the same field,
    * meaning and cap as `invokeRequest.patience_ms`; absent means
@@ -2032,12 +3447,12 @@ var clientInvoke = z11.object({
    * methods no SDK caller could invoke; this is the same defect caught before
    * it shipped, by the SDK owner rather than by a reviewer.
    */
-  patience_ms: z11.number().int().min(MIN_PATIENCE_MS).max(MAX_PATIENCE_MS).optional()
+  patience_ms: z12.number().int().min(MIN_PATIENCE_MS).max(MAX_PATIENCE_MS).optional()
 });
-var clientCancel = z11.object({
-  type: z11.literal("cancel"),
-  request_id: z11.string().min(1).max(64),
-  robot_id: z11.uuid(),
+var clientCancel = z12.object({
+  type: z12.literal("cancel"),
+  request_id: z12.string().min(1).max(64),
+  robot_id: z12.uuid(),
   /** Which slug — required, and the only address a cancel had until W6b. */
   slug,
   /**
@@ -2055,19 +3470,19 @@ var clientCancel = z11.object({
    * back to the slug. Falling back would be the platform deciding that the
    * caller did not really mean the id they typed.
    */
-  job_id: z11.uuid().nullable()
+  job_id: z12.uuid().nullable()
 });
-var clientPublish = z11.object({
-  type: z11.literal("publish"),
-  request_id: z11.string().min(1).max(64),
-  robot_id: z11.uuid(),
+var clientPublish = z12.object({
+  type: z12.literal("publish"),
+  request_id: z12.string().min(1).max(64),
+  robot_id: z12.uuid(),
   slug,
-  message: z11.record(z11.string(), z11.unknown())
+  message: z12.record(z12.string(), z12.unknown())
 });
-var commandResult = z11.object({
-  type: z11.literal("command_result"),
-  request_id: z11.string().min(1).max(64),
-  ok: z11.boolean(),
+var commandResult = z12.object({
+  type: z12.literal("command_result"),
+  request_id: z12.string().min(1).max(64),
+  ok: z12.boolean(),
   /**
    * The job this reply is *about* — which is not always the caller's own.
    *
@@ -2091,9 +3506,9 @@ var commandResult = z11.object({
    * later. Returning the kind lets a client refuse its own mistake at once,
    * instead of reporting it as the machine's.
    */
-  kind: z11.enum(["datapoint", "action", "service", "publisher", "camera"]).nullable(),
-  code: z11.string().nullable(),
-  message: z11.string().nullable(),
+  kind: z12.enum(["datapoint", "action", "service", "publisher", "camera"]).nullable(),
+  code: z12.string().nullable(),
+  message: z12.string().nullable(),
   /**
    * The same payload the REST envelope carries in `apiError.details` — for
    * `parameter_invalid`, a `parameterInvalidDetails`.
@@ -2105,16 +3520,16 @@ var commandResult = z11.object({
    * A client cannot bind an error to the input that caused it from a code
    * alone — which is the entire point of the flat parameter shape.
    */
-  details: z11.unknown().optional()
+  details: z12.unknown().optional()
 });
-var errorFrame = z11.object({
-  type: z11.literal("error"),
-  code: z11.string().min(1),
-  message: z11.string().min(1)
+var errorFrame = z12.object({
+  type: z12.literal("error"),
+  code: z12.string().min(1),
+  message: z12.string().min(1)
 });
-var clientSubscribe = z11.object({
-  type: z11.literal("subscribe"),
-  robot_id: z11.uuid(),
+var clientSubscribe = z12.object({
+  type: z12.literal("subscribe"),
+  robot_id: z12.uuid(),
   slug,
   /**
    * What the subscriber expects, and how it wants it (W5).
@@ -2136,179 +3551,375 @@ var clientSubscribe = z11.object({
    * request was the same mistake as the silent wrong-verb subscribe this
    * field was added to fix.
    */
-  kind: z11.enum(["datapoint", "action", "service", "publisher", "camera"]).optional(),
-  options: z11.record(z11.string(), z11.unknown()).optional()
+  kind: z12.enum(["datapoint", "action", "service", "publisher", "camera"]).optional(),
+  options: z12.record(z12.string(), z12.unknown()).optional()
 });
-var clientUnsubscribe = z11.object({
-  type: z11.literal("unsubscribe"),
-  robot_id: z11.uuid(),
+var clientUnsubscribe = z12.object({
+  type: z12.literal("unsubscribe"),
+  robot_id: z12.uuid(),
   slug
 });
-var subscribeError = z11.object({
-  type: z11.literal("subscribe_error"),
-  robot_id: z11.string(),
-  slug: z11.string(),
-  code: z11.string().min(1),
-  message: z11.string().min(1)
+var subscribeError = z12.object({
+  type: z12.literal("subscribe_error"),
+  robot_id: z12.string(),
+  slug: z12.string(),
+  code: z12.string().min(1),
+  message: z12.string().min(1)
 });
-var datapointEvent = z11.object({
-  type: z11.literal("datapoint"),
-  robot_id: z11.uuid(),
+var datapointEvent = z12.object({
+  type: z12.literal("datapoint"),
+  robot_id: z12.uuid(),
   slug,
-  value: z11.unknown(),
-  timestamp_ms: z11.number().int().nonnegative()
-});
-var resourceHealthEvent = z11.object({
-  type: z11.literal("resource_health"),
-  robot_id: z11.uuid(),
-  kind: z11.enum(["camera", "credential"]),
-  ref: z11.string().min(1).max(64),
-  state: z11.enum(RESOURCE_HEALTH_STATES),
-  reason: z11.string().max(200).nullable(),
-  changed_at_ms: z11.number().int().nonnegative()
-});
+  value: z12.unknown(),
+  timestamp_ms: z12.number().int().nonnegative()
+});
+var liveSessionEndReason = z12.enum([
+  /** Another holder of this camera released it — another tab, or another client. */
+  "released_by_peer",
+  /** The robot's configuration was published and this camera changed with it. */
+  "config_changed",
+  /** The robot said it could not publish. `detail` carries its own words. */
+  "publish_failed",
+  /** The bridge stopped answering. */
+  "robot_offline",
+  /** The grant this session was minted under was withdrawn. */
+  "revoked",
+  /** The session's own lifetime ran out. */
+  "expired",
+  /** The robot was deleted out from under the session. */
+  "robot_deleted",
+  /**
+   * The cloud ended it and cannot say which of the above applied. **Kept
+   * deliberately**: a channel that cannot say "I do not know" will say
+   * something false instead, and this project has paid for that four times in
+   * the camera path alone.
+   */
+  "unknown"
+]);
+var liveSessionEvent = z12.object({
+  type: z12.literal("live_session"),
+  robot_id: z12.uuid(),
+  slug,
+  session_id: z12.uuid(),
+  state: z12.literal("ended"),
+  reason: liveSessionEndReason,
+  /**
+   * **Classified text the cloud produced, never text the robot sent.**
+   *
+   * An earlier draft of this comment said *"the robot's own words when it has
+   * any"*, which reads as permission to pass `bridgeCameraState.error.message`
+   * straight through. Nothing sanitises that field, and this codebase has a
+   * documented incident of a password reaching a developer surface through
+   * exactly that route — `camera-health.ts`'s fixed-string `REASON` discipline
+   * exists because of it. Nimbus-W9a stopped at the sentence and asked rather
+   * than taking the permission it appeared to give (2026-08-19).
+   *
+   * So: `null` unless the cloud itself has something classified to say. If a
+   * developer needs the robot's own diagnosis later, it arrives as a mapped
+   * code with fixed text, the way camera health already does it — not as
+   * forwarded foreign text on a channel a client reads.
+   */
+  detail: z12.string().max(200).nullable(),
+  /** When it ended — not when this frame was sent. Same reasoning as `changed_at_ms`. */
+  ended_at_ms: z12.number().int().nonnegative()
+});
+var resourceHealthCleared = z12.object({
+  type: z12.literal("resource_health_cleared"),
+  robot_id: z12.uuid(),
+  kind: z12.enum(["camera"]),
+  ref: z12.string().min(1).max(64),
+  facet: z12.enum(["source", "publish"]),
+  cleared_at_ms: z12.number().int().nonnegative()
+});
+var resourceHealthEvent = z12.object({
+  type: z12.literal("resource_health"),
+  robot_id: z12.uuid(),
+  kind: z12.enum(["camera"]),
+  ref: z12.string().min(1).max(64),
+  /** Which of the two questions this entry answers — see `resourceHealthState.facet`. */
+  facet: z12.enum(["source", "publish"]),
+  state: z12.enum(RESOURCE_HEALTH_STATES),
+  reason: z12.string().max(200).nullable(),
+  changed_at_ms: z12.number().int().nonnegative()
+});
+var ORG_EVENT_BUFFER_SIZE = 200;
+var orgEventKind = z12.enum(["datapoint", "health", "job", "bridge", "audit", "alert"]);
+var orgEventSeverity = z12.enum(["info", "warning", "error"]);
+var orgEvent = z12.object({
+  type: z12.literal("org_event"),
+  /**
+   * **Per org, per process.** Like `job.seq` and unlike `job_runs.seq`, which
+   * is a postgres `bigserial` and durable. All three say which they are,
+   * because anyone who confuses them will confuse them in both directions.
+   */
+  seq: z12.number().int().positive(),
+  at: z12.iso.datetime(),
+  kind: orgEventKind,
+  severity: orgEventSeverity,
+  /** `null` for an org-level event — an invitation, a quota change — which belongs to no robot. */
+  robot_id: z12.uuid().nullable(),
+  /** What the line is about: a slug, a camera, an actor's email. */
+  subject: z12.string().min(1).max(200),
+  /**
+   * Kind-specific, and **capped at `ORG_EVENT_DETAIL_MAX_BYTES`** — above it
+   * the producer substitutes `{ omitted: 'too_large', bytes }`. Truncated,
+   * and saying so.
+   *
+   * Never a pre-formatted line: the reader decides language, number format
+   * and truncation, so changing how a line reads is not a cloud deploy.
+   */
+  detail: z12.unknown().nullable()
+}).strict();
+var orgEventSubscribe = z12.object({ type: z12.literal("org_event_subscribe") }).strict();
+var orgEventUnsubscribe = z12.object({ type: z12.literal("org_event_unsubscribe") }).strict();
+var orgEventReplay = z12.object({
+  type: z12.literal("org_event_replay"),
+  events: z12.array(orgEvent).max(ORG_EVENT_BUFFER_SIZE),
+  /**
+   * **`false` means three different things, on purpose**: the buffer was
+   * already full, the cloud restarted, or this org's buffer had expired. All
+   * three mean the same thing to a reader — *something is missing above this
+   * line* — and a field separating them would claim a distinction nobody
+   * would act on differently.
+   */
+  complete: z12.boolean()
+}).strict();
+var orgEventDropped = z12.object({
+  type: z12.literal("org_event_dropped"),
+  /**
+   * **An epoch instant in milliseconds (`Date.now()`), not a duration.**
+   * The moment this socket last reported a drop — or the moment it
+   * subscribed, if this is its first such frame. The window the `dropped`
+   * count covers is `since_ms` to now, so a reader wanting an age
+   * subtracts: `Date.now() - since_ms`. Spelled out because the type
+   * admits both readings and the wrong one is silent: a consumer treating
+   * it as "milliseconds ago" renders a drop that happened seconds ago as
+   * having happened in 1970.
+   */
+  since_ms: z12.number().int().nonnegative(),
+  /** Always at least one — a frame reporting nothing lost is noise on a channel built to be quiet. */
+  dropped: z12.number().int().positive()
+}).strict();
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_367ffc97d258be510904ed62d5d477a4/node_modules/@fleetless/contracts/dist/identity.js
-import { z as z12 } from "zod";
-var password = z12.string().min(12).max(256);
-var orgMemberRole = z12.enum(["owner", "member"]);
-var org = z12.object({
-  id: z12.uuid(),
-  name: z12.string().min(1).max(120),
-  created_at: z12.iso.datetime()
-});
-var orgMember = z12.object({
-  id: z12.uuid(),
-  org_id: z12.uuid(),
-  email: z12.email(),
-  role: orgMemberRole,
-  created_at: z12.iso.datetime()
-});
-var sessionTokens = z12.object({
-  access_token: z12.string().min(1),
-  refresh_token: z12.string().min(1),
-  expires_in: z12.number().int().positive()
-});
-var refreshRequest = z12.object({ refresh_token: z12.string().min(1) });
-var signUpRequest = z12.object({
-  org_name: z12.string().min(1).max(120),
-  email: z12.email(),
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_1727a3f05719ef3ec49509ea01c84aa4/node_modules/@fleetless/contracts/dist/identity.js
+import { z as z13 } from "zod";
+var password = z13.string().min(12).max(256);
+var GROUP_NAME_MAX = 120;
+var USER_DISPLAY_NAME_MAX = 120;
+var orgAdminTier = z13.enum(["owner", "developer"]);
+var mcpAccess = z13.enum(["default", "allowed", "denied"]);
+var org = z13.object({
+  id: z13.uuid(),
+  name: z13.string().min(1).max(120),
+  created_at: z13.iso.datetime()
+});
+var orgGroup = z13.object({
+  id: z13.uuid(),
+  org_id: z13.uuid(),
+  name: z13.string().min(1).max(GROUP_NAME_MAX),
+  /**
+   * **A server fact, never a request field.** The Org Admins group is created
+   * with the org and is the only path into the console, so a caller able to
+   * set this could mint themselves console access. Neither
+   * `createGroupRequest` nor `patchGroupRequest` carries it, and both are
+   * `.strict()` so offering it is a refusal rather than a silent drop.
+   */
+  is_org_admins: z13.boolean(),
+  /**
+   * Whether this **customer** group's users may reach the central MCP server,
+   * enforced since 0.5.0 at token issue and on every request
+   * (`cloud/src/mcp-access.ts`), with the per-user `mcpAccess` override
+   * winning over it in both directions.
+   *
+   * **On the Org Admins group it decides nothing.** The door permits a member
+   * of `is_org_admins` unconditionally (Andre, 2026-08-29) before it reads
+   * either this flag or the user's override; turning it off there refuses
+   * nobody. Stored and settable all the same, so the group shape stays one
+   * shape — but it is a customer-group control, and only that.
+   */
+  mcp_enabled: z13.boolean(),
+  member_count: z13.number().int().nonnegative(),
+  app_count: z13.number().int().nonnegative(),
+  created_at: z13.iso.datetime()
+});
+var orgUser = z13.object({
+  id: z13.uuid(),
+  org_id: z13.uuid(),
+  email: z13.email(),
+  /**
+   * Optional human name, shown by the console instead of the email where
+   * present. Self-service via `PATCH /api/auth/me`; never used for auth.
+   */
+  display_name: z13.string().min(1).max(USER_DISPLAY_NAME_MAX).nullable(),
+  /** Exactly one, always (D1). Moving is a deliberate act — see `moveUserGroupRequest`. */
+  group_id: z13.uuid(),
+  /**
+   * **The wire's only statement about the Fleetless credential, and it is one
+   * bit on purpose.** No hash, no algorithm, no "last changed" — a response
+   * that carries a hash puts it in every log that ever captured a response,
+   * and this platform has already written that rule down for server keys and
+   * IdP secrets.
+   *
+   * `false` means *this user has no Fleetless password* — an OIDC-provisioned
+   * user, or an invitation not yet accepted. It does **not** mean blocked, and
+   * it does **not** mean without access: such a user signs in through their
+   * group's provider and a password reset answers them the same silent way as
+   * an unknown address (D4).
+   *
+   * What it cannot say: whether the password is strong, old, or already known
+   * to somebody else. Nothing on the wire can, and a field that looked like it
+   * could would be read as an assurance.
+   */
+  has_password: z13.boolean(),
+  mcp_access: mcpAccess,
+  /**
+   * **Present only for members of the Org Admins group — and absent means "not
+   * applicable", never "unknown".**
+   *
+   * A tier is a statement about console powers, and a user in a customer group
+   * has none to grade; giving them a `developer` tier would invent a rank the
+   * model does not have, and defaulting one would make "we did not load it"
+   * indistinguishable from "they are an ordinary user" on the field that
+   * decides who may delete the org.
+   *
+   * The schema cannot check the pairing: it sees a `group_id`, not whether
+   * that group is the Org Admins one. The cloud is what refuses a tier on a
+   * user outside that group and requires one inside it.
+   */
+  tier: orgAdminTier.optional(),
+  created_at: z13.iso.datetime()
+});
+var appAssignment = z13.object({
+  user_id: z13.uuid(),
+  app_id: z13.uuid(),
+  role_id: z13.uuid()
+});
+var groupListResponse = z13.object({ groups: z13.array(orgGroup) });
+var orgUserListResponse = z13.object({ users: z13.array(orgUser) });
+var appAssignmentListResponse = z13.object({ assignments: z13.array(appAssignment) });
+var sessionTokens = z13.object({
+  access_token: z13.string().min(1),
+  refresh_token: z13.string().min(1),
+  expires_in: z13.number().int().positive()
+});
+var refreshRequest = z13.object({ refresh_token: z13.string().min(1) });
+var signUpRequest = z13.object({
+  org_name: z13.string().min(1).max(120),
+  email: z13.email(),
   password
 });
-var signUpResponse = z12.object({
+var signUpResponse = z13.object({
   org,
-  member: orgMember,
+  user: orgUser,
   tokens: sessionTokens
 });
-var developerLoginRequest = z12.object({
-  email: z12.email(),
-  password: z12.string().min(1)
-});
-var endUser = z12.object({
-  id: z12.uuid(),
-  org_id: z12.uuid(),
-  email: z12.email(),
-  status: z12.enum(["invited", "active", "blocked"]),
-  created_at: z12.iso.datetime()
-});
-var mailStatus = z12.enum(["sent", "not_configured", "failed"]);
-var invitation = z12.object({
-  id: z12.uuid(),
-  email: z12.email(),
-  app_id: z12.uuid(),
-  role_id: z12.uuid(),
-  expires_at: z12.iso.datetime(),
-  accept_url: z12.url(),
+var waitlistRequest = z13.object({ email: z13.email().max(254) });
+var developerLoginRequest = z13.object({
+  email: z13.email(),
+  password: z13.string().min(1)
+});
+var mailStatus = z13.enum(["sent", "not_configured", "failed"]);
+var createUserInviteRequest = z13.object({
+  email: z13.email(),
+  display_name: z13.string().min(1).max(USER_DISPLAY_NAME_MAX).nullable().optional(),
+  group_id: z13.uuid(),
+  /** Org Admins group only — see above; the cloud, not the schema, enforces the pairing. */
+  tier: orgAdminTier.optional(),
+  /** Absent means `default`: follow the group. Data model only until the MCP plan. */
+  mcp_access: mcpAccess.optional(),
+  send_mail: z13.boolean()
+}).strict();
+var userInvite = z13.object({
+  id: z13.uuid(),
+  email: z13.email(),
+  group_id: z13.uuid(),
+  expires_at: z13.iso.datetime(),
+  /** Bounded like `idpIssuer`: an unbounded URL on a shape that gets mailed, logged and rendered is a size nobody chose. */
+  accept_url: z13.url().max(500),
   /** Replaces `mail_sent: boolean` — see `mailStatus` for why one bit was not enough. */
   mail: mailStatus
 });
-var createInvitationRequest = z12.object({
-  email: z12.email(),
-  app_id: z12.uuid(),
-  role_id: z12.uuid(),
-  send_mail: z12.boolean()
-});
-var acceptInvitationRequest = z12.object({
-  token: z12.string().min(1),
-  password
-});
-var createDeveloperInvitationRequest = z12.object({
-  email: z12.email(),
-  role: orgMemberRole,
-  send_mail: z12.boolean()
-});
-var developerInvitation = z12.object({
-  id: z12.uuid(),
-  email: z12.email(),
-  role: orgMemberRole,
-  expires_at: z12.iso.datetime(),
-  accept_url: z12.url(),
-  mail: mailStatus
-});
-var pendingDeveloperInvitation = z12.object({
-  id: z12.uuid(),
-  email: z12.email(),
-  role: orgMemberRole,
-  expires_at: z12.iso.datetime()
+var pendingUserInvite = z13.object({
+  id: z13.uuid(),
+  email: z13.email(),
+  group_id: z13.uuid(),
+  expires_at: z13.iso.datetime()
 });
-var developerInvitationListResponse = z12.object({
+var userInviteListResponse = z13.object({
   /** Pending only. An accepted invitation is history, not something to revoke. */
-  invitations: z12.array(pendingDeveloperInvitation)
+  invitations: z13.array(pendingUserInvite)
 });
-var acceptDeveloperInvitationRequest = z12.object({
-  token: z12.string().min(1),
+var acceptUserInviteRequest = z13.object({
+  token: z13.string().min(1),
   password
 });
-var tierRequiredDetails = z12.object({
-  required: orgMemberRole,
-  /** The caller's own tier — theirs to know, and it is what makes the message actionable. */
-  actual: orgMemberRole
-});
-var selfRegistration = z12.object({
-  enabled: z12.boolean(),
+var patchUserRequest = z13.object({
+  display_name: z13.string().min(1).max(USER_DISPLAY_NAME_MAX).nullable().optional(),
+  mcp_access: mcpAccess.optional()
+}).strict();
+var moveUserGroupRequest = z13.object({
+  group_id: z13.uuid(),
+  acknowledge_assignment_loss: z13.literal(true)
+}).strict();
+var putAppGroupRequest = z13.object({
+  group_id: z13.uuid(),
+  acknowledge_assignment_loss: z13.literal(true)
+}).strict();
+var putAssignmentRequest = z13.object({ role_id: z13.uuid() }).strict();
+var tierChangeRequest = z13.object({ tier: orgAdminTier }).strict();
+var groupUsageResponse = z13.object({
+  /** The group the change would move the subject **into**. */
+  target_group_id: z13.uuid(),
+  /** Assignments the change would delete. `0` means the change is not destructive. */
+  assignments_removed: z13.number().int().nonnegative(),
   /**
-   * Accept any address. Deliberately its own flag rather than a magic value
-   * in `domains`, so "open to everyone" is something an app owner has to say,
-   * not something that falls out of leaving a list empty.
+   * Distinct users who would lose access. For a *user* move this is 0 or 1 and
+   * adds nothing to `assignments_removed`; it exists for the *app re-link*,
+   * where one edit can cut many people off and a count of assignments alone
+   * reads far smaller than the thing actually being decided.
    */
-  all_domains: z12.boolean(),
-  /** Lower-case bare domains, no `@`: `['dehne-robotik.de']`. Ignored when `all_domains`. */
-  domains: z12.array(z12.string().min(1).max(253)),
-  /** The role every self-registered member of this pool receives (§3.2: exactly one per app). */
-  role_id: z12.uuid()
-});
-var clientRegisterRequest = z12.object({
-  app_identifier: appIdentifier,
-  email: z12.email(),
-  password
-});
-var clientRegisterResponse = z12.object({
-  mail: mailStatus
+  users_affected: z13.number().int().nonnegative(),
+  /**
+   * The apps whose assignments would die, by identifier — a bare count cannot
+   * be read by whoever has to approve it. For an app re-link this is the one
+   * app being moved.
+   */
+  app_identifiers: z13.array(z13.string())
 });
-var clientRegisterConfirm = z12.object({
-  token: z12.string().min(1)
+var createGroupRequest = z13.object({
+  name: z13.string().min(1).max(GROUP_NAME_MAX),
+  mcp_enabled: z13.boolean().default(false)
+}).strict();
+var patchGroupRequest = z13.object({
+  name: z13.string().min(1).max(GROUP_NAME_MAX).optional(),
+  mcp_enabled: z13.boolean().optional()
+}).strict();
+var tierRequiredDetails = z13.object({
+  required: orgAdminTier,
+  /** The caller's own tier — theirs to know, and it is what makes the message actionable. */
+  actual: orgAdminTier
 });
-var passwordChangeRequest = z12.object({
-  current_password: z12.string().min(1),
+var passwordChangeRequest = z13.object({
+  current_password: z13.string().min(1),
   new_password: password
 });
-var passwordResetRequest = z12.object({
-  email: z12.email()
+var passwordResetRequest = z13.object({
+  email: z13.email()
 });
-var clientPasswordResetRequest = z12.object({
+var clientPasswordResetRequest = z13.object({
   app_identifier: appIdentifier,
-  email: z12.email()
+  email: z13.email()
 });
-var passwordResetConfirm = z12.object({
-  token: z12.string().min(1),
+var passwordResetConfirm = z13.object({
+  token: z13.string().min(1),
   new_password: password
 });
-var idpClaimMapping = z12.object({
+var idpClaimMapping = z13.object({
   /** Which claim is the stable identity. `sub` unless the developer knows better. */
-  subject_claim: z12.string().min(1).max(100).default("sub"),
-  email_claim: z12.string().min(1).max(100).default("email")
+  subject_claim: z13.string().min(1).max(100).default("sub"),
+  email_claim: z13.string().min(1).max(100).default("email")
 });
-var idpIssuer = z12.url().max(500).refine((v) => {
+var idpIssuer = z13.url().max(500).refine((v) => {
   let url;
   try {
     url = new URL(v);
@@ -2323,37 +3934,109 @@ var idpIssuer = z12.url().max(500).refine((v) => {
     return false;
   return url.hostname.length > 0;
 }, { message: "issuer must be an http(s) URL with no credentials, query or fragment" });
-var idpConfig = z12.object({
-  app_id: z12.uuid(),
+var idpConfig = z13.object({
+  app_id: z13.uuid(),
   issuer: idpIssuer,
-  client_id: z12.string().min(1).max(200),
-  scopes: z12.array(z12.string().min(1).max(60)).min(1).max(20),
+  client_id: z13.string().min(1).max(200),
+  scopes: z13.array(z13.string().min(1).max(60)).min(1).max(20),
   claims: idpClaimMapping,
-  link_verified_emails: z12.boolean(),
   /** Never the secret itself — see `idpConfigRequest`. */
-  has_client_secret: z12.boolean(),
-  updated_at: z12.iso.datetime()
+  has_client_secret: z13.boolean(),
+  updated_at: z13.iso.datetime()
 });
-var idpConfigRequest = z12.object({
+var idpConfigRequest = z13.object({
   issuer: idpIssuer,
-  client_id: z12.string().min(1).max(200),
-  client_secret: z12.string().min(1).max(500).optional(),
-  scopes: z12.array(z12.string().min(1).max(60)).min(1).max(20),
-  claims: idpClaimMapping.optional(),
-  link_verified_emails: z12.boolean()
+  client_id: z13.string().min(1).max(200),
+  client_secret: z13.string().min(1).max(500).optional(),
+  scopes: z13.array(z13.string().min(1).max(60)).min(1).max(20),
+  claims: idpClaimMapping.optional()
 }).strict();
-
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_367ffc97d258be510904ed62d5d477a4/node_modules/@fleetless/contracts/dist/audit.js
-import { z as z13 } from "zod";
-var auditActor = z13.object({
-  kind: z13.enum(["developer", "end_user", "server_key", "bridge"]),
-  id: z13.uuid(),
-  label: z13.string().min(1).max(200)
+var orgFederationPolicy = z13.object({
+  /**
+   * Joins a federated login to an existing integrated account **only if** the
+   * IdP also asserts `email_verified`. Either condition alone is account
+   * takeover: without `email_verified`, an IdP that lets anyone type any
+   * address into a profile hands over every matching account; without this
+   * flag, a developer who connects an IdP for a *subset* of their users
+   * silently merges strangers.
+   */
+  link_verified_emails: z13.boolean(),
+  updated_at: z13.iso.datetime()
 });
-var auditEvent = z13.object({
-  id: z13.uuid(),
-  org_id: z13.uuid(),
-  at: z13.iso.datetime(),
+var orgFederationPolicyRequest = z13.object({
+  link_verified_emails: z13.boolean()
+}).strict();
+var jitGrant = z13.object({
+  app_id: z13.uuid(),
+  role_id: z13.uuid()
+}).strict();
+var groupOidcProvider = z13.object({
+  group_id: z13.uuid(),
+  issuer: idpIssuer,
+  client_id: z13.string().min(1).max(200),
+  scopes: z13.array(z13.string().min(1).max(60)).min(1).max(20),
+  /** Whether an unknown `(issuer, sub)` is provisioned rather than refused (D3). */
+  jit_enabled: z13.boolean(),
+  /**
+   * The grants an unknown user receives on their first federated login.
+   * Bounded for the reason `scopes` and `accept_url` are: an unbounded array
+   * on a shape that is stored, logged and rendered is a size nobody chose.
+   */
+  jit_grants: z13.array(jitGrant).max(50),
+  created_at: z13.iso.datetime()
+}).strict();
+var putGroupOidcProviderRequest = z13.object({
+  issuer: idpIssuer,
+  client_id: z13.string().min(1).max(200),
+  /** Write-only; absent means keep the stored secret. Never echoed by `groupOidcProvider`. */
+  client_secret: z13.string().min(16).max(500).optional(),
+  scopes: z13.array(z13.string().min(1).max(60)).min(1).max(20),
+  jit_enabled: z13.boolean().default(false),
+  jit_grants: z13.array(jitGrant).max(50).default([])
+}).strict();
+var oidcCallbackErrorCode = z13.enum([
+  /** The IdP could not be reached, or its discovery document could not be read. */
+  "idp_unreachable",
+  /** The authorization code could not be exchanged for tokens (`invalid_grant` and friends). */
+  "exchange_failed",
+  /** The IdP answered, but the token is missing a `sub` or `email` the flow needs. */
+  "claims_incomplete",
+  /** An unknown identity on a group with JIT off — no route in, by design (D3). */
+  "jit_disabled",
+  /**
+   * JIT would provision, but the asserted email already belongs to a user —
+   * of this org or any other, since email is globally unique (Andre,
+   * 2026-08-29). **Refusal, never auto-link** (account-takeover guard, D3);
+   * resolution is manual, by an org admin.
+   */
+  "email_collision",
+  /** The provider is set up wrong (bad client, secret rejected) — the developer's to fix. */
+  "provider_misconfigured"
+]);
+var oidcCallbackError = z13.object({
+  code: oidcCallbackErrorCode,
+  /** Safe user-facing text — no issuer, no token internals; bounded because it is rendered. */
+  message: z13.string().min(1).max(300)
+}).strict();
+var impersonationChoice = z13.discriminatedUnion("mode", [
+  z13.object({ mode: z13.literal("role"), role_id: z13.uuid() }).strict(),
+  z13.object({ mode: z13.literal("user"), user_id: z13.uuid() }).strict()
+]);
+var authMeResponse = z13.object({ org, user: orgUser });
+var patchOrgRequest = z13.object({ name: z13.string().min(1).max(120) }).strict();
+var patchAuthMeRequest = z13.object({ display_name: z13.string().min(1).max(USER_DISPLAY_NAME_MAX).nullable() }).strict();
+
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_1727a3f05719ef3ec49509ea01c84aa4/node_modules/@fleetless/contracts/dist/audit.js
+import { z as z14 } from "zod";
+var auditActor = z14.object({
+  kind: z14.enum(["developer", "end_user", "server_key", "bridge"]),
+  id: z14.uuid(),
+  label: z14.string().min(1).max(200)
+});
+var auditEvent = z14.object({
+  id: z14.uuid(),
+  org_id: z14.uuid(),
+  at: z14.iso.datetime(),
   /**
    * A monotonic counter, ascending in write order, unique across the log
    * (W6b).
@@ -2377,46 +4060,139 @@ var auditEvent = z13.object({
    * Required, not optional: an event without a sequence cannot be ordered
    * against one that has it, and a log with two orderings has none.
    */
-  seq: z13.number().int().positive(),
+  seq: z14.number().int().positive(),
   actor: auditActor,
   /** Stable dotted name, e.g. `end_user.invited`, `config.published`. */
-  action: z13.string().min(1).max(80),
+  action: z14.string().min(1).max(80),
   /**
    * What the action was about, if anything — a robot, an app, a user. Free
    * of ids the console cannot resolve: carry the label with it.
    */
-  target: z13.object({
-    kind: z13.string().min(1).max(40),
-    id: z13.string().min(1),
-    label: z13.string().min(1).max(200)
+  target: z14.object({
+    kind: z14.string().min(1).max(40),
+    id: z14.string().min(1),
+    label: z14.string().min(1).max(200)
   }).nullable(),
-  /** Action-specific extras. Never credentials, never tokens. */
-  details: z13.record(z13.string(), z13.unknown()).nullable()
+  /**
+   * Action-specific extras.
+   *
+   * **Nothing redacts this.** There is no denylist, no allowlist and no pass
+   * over what a call site puts here — the call site is responsible, and this
+   * comment is where that responsibility is written down. Since the org event
+   * stream, the same object also reaches every developer with the console
+   * overview open, not only whoever later reads the audit log.
+   *
+   * So: never credentials, never tokens. That is a rule, not a guarantee the
+   * schema enforces.
+   */
+  details: z14.record(z14.string(), z14.unknown()).nullable()
 });
-var auditListResponse = z13.object({
-  events: z13.array(auditEvent)
+var auditTimestampMs = wireTimestampMs;
+var auditQuery = z14.object({
+  /** Only events with a smaller `seq` — the next, older page. */
+  before_seq: wireSeqCursor.optional(),
+  /**
+   * Same shape as DEF-059's `historyQuery.limit`: a union whose input branch
+   * **is the wire**. A `z.coerce` cannot be published — zod renders the
+   * coercion's result in either `io` direction, so the artifact would describe
+   * a shape a query string can never carry.
+   */
+  limit: z14.union([z14.string().regex(/^\d{1,4}$/), z14.number().int()]).transform((v) => Number(v)).pipe(z14.number().int().positive().max(500)).optional(),
+  /** Exact action name, e.g. `config.published`. No prefix matching: a filter that matches more than it says is not one. */
+  action: z14.string().min(1).max(80).optional(),
+  /**
+   * Everything under a dotted prefix, e.g. `server_key.` for all three
+   * server-key actions.
+   *
+   * **A separate parameter, not a widening of `action`.** The sentence on
+   * `action` above — a filter that matches more than it says is not one —
+   * still stands; this is a different question with a name that says which
+   * one it is. Setting both is refused rather than resolved, because a query
+   * naming an exact action *and* a prefix is a caller mistake, not a
+   * combination anyone should have to guess the meaning of.
+   *
+   * **The published artifact cannot express that refusal**: a cross-field
+   * `.refine()` has no JSON Schema rendering, so `audit-query.schema.json`
+   * describes two independent optional strings and validates both-at-once
+   * happily. The cloud is the only enforcement point — the same residual
+   * `orgLatencyQuery` and `orgUsageQuery` already name.
+   */
+  action_prefix: z14.string().min(1).max(80).optional(),
+  /**
+   * Only events by this actor.
+   *
+   * **`z.uuid()`, because the column is one (Argus-W9, W9 review).** This was
+   * `z.string().min(1).max(200)`, so any non-uuid value reached Postgres as a
+   * uuid parameter and threw: `?actor_id=not-a-uuid` answered **500
+   * `internal_error`**, on the list route and the export alike.
+   *
+   * Not a SQL-injection finding — Drizzle parameterises, and `' or 1=1--`
+   * failed at the same cast. It is a **500 where a 400 belongs**, and a 500 is
+   * the answer that explains nothing.
+   *
+   * The place is the part worth keeping: **this same wave pulled
+   * `refuseIfNotUuid` through ~15 call sites** so a typo could be told from a
+   * deletion — and the brand-new filter, whose field has exactly that shape,
+   * is the one that did not get it. A rule applied to the sites in front of
+   * you is not a rule applied to the class.
+   */
+  actor_id: z14.uuid().optional(),
+  /** Only events about this kind of target, e.g. `robot`. */
+  target_kind: z14.string().min(1).max(40).optional(),
+  /**
+   * Absolute bounds in unix milliseconds, **half-open `[from, to)`** — the
+   * same rule the history shapes follow (DEF-062).
+   *
+   * **Bounded to years 1..9999, and the bound is borrowed rather than
+   * invented.** `nonnegative()` alone let `253402300800000` (year 10000)
+   * through, where the Postgres bind path has no representation and the route
+   * answered 500 — measured either side of the edge: `253402300799000` → 200,
+   * `253402300800000` → 500 (Argus-W9). `history-query.ts`'s `parseTimeExprMs`
+   * already carries exactly this range, with M3's reasoning for why
+   * `Number.isSafeInteger` is wider than what a timestamp can be; this is that
+   * same number, not a second one that happens to agree.
+   */
+  from_ms: auditTimestampMs.optional(),
+  to_ms: auditTimestampMs.optional()
+}).strict().refine((query) => !(query.action !== void 0 && query.action_prefix !== void 0), {
+  message: "action and action_prefix cannot be combined",
+  path: ["action_prefix"]
+});
+var auditListResponse = z14.object({
+  events: z14.array(auditEvent),
+  /**
+    * The `seq` a caller sends as `before_seq` to keep reading — or `null` when
+    * there is nothing further.
+    *
+    * **`null` means the end, and that is a promise rather than an
+    * observation.** A caller who instead compares `events.length` against
+    * `limit` is wrong the moment a filter makes a page thin: a short page does
+    * not mean *no more* here. The same distinction `historySamples` was given
+    * `truncated` for.
+    */
+  next_cursor: z14.number().int().positive().nullable()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_367ffc97d258be510904ed62d5d477a4/node_modules/@fleetless/contracts/dist/errors.js
-import { z as z14 } from "zod";
-var apiError = z14.object({
-  code: z14.string().min(1),
-  message: z14.string().min(1),
-  details: z14.unknown().optional()
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_1727a3f05719ef3ec49509ea01c84aa4/node_modules/@fleetless/contracts/dist/errors.js
+import { z as z15 } from "zod";
+var apiError = z15.object({
+  code: z15.string().min(1),
+  message: z15.string().min(1),
+  details: z15.unknown().optional()
 });
-var parameterViolation = z14.object({
-  field: z14.string().min(1),
+var parameterViolation = z15.object({
+  field: z15.string().min(1),
   /** Which rule failed — `min`, `max`, `enum`, `pattern`, `required`, `undeclared`. */
-  rule: z14.string().min(1),
-  message: z14.string().min(1)
+  rule: z15.string().min(1),
+  message: z15.string().min(1)
 });
-var parameterInvalidDetails = z14.object({
-  violations: z14.array(parameterViolation).min(1)
+var parameterInvalidDetails = z15.object({
+  violations: z15.array(parameterViolation).min(1)
 });
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_367ffc97d258be510904ed62d5d477a4/node_modules/@fleetless/contracts/dist/oauth.js
-import { z as z15 } from "zod";
-var oauthErrorCode = z15.enum([
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_1727a3f05719ef3ec49509ea01c84aa4/node_modules/@fleetless/contracts/dist/oauth.js
+import { z as z16 } from "zod";
+var oauthErrorCode = z16.enum([
   "invalid_request",
   "invalid_client",
   "invalid_grant",
@@ -2429,11 +4205,11 @@ var oauthErrorCode = z15.enum([
   /** RFC 8707: the `resource` named is not one this server issues tokens for. */
   "invalid_target"
 ]);
-var oauthError = z15.object({
+var oauthError = z16.object({
   error: oauthErrorCode,
-  error_description: z15.string().min(1).max(500).optional(),
+  error_description: z16.string().min(1).max(500).optional(),
   /** Echoed back per RFC 6749 §4.1.2.1 so a client can match the response. */
-  state: z15.string().min(1).max(500).optional(),
+  state: z16.string().min(1).max(500).optional(),
   /**
    * **A Fleetless reason carried inside a standard envelope, and it exists
    * because the alternative lost a distinction.**
@@ -2451,10 +4227,10 @@ var oauthError = z15.object({
    * our own tooling switches on. RFC 6749 §5.2 permits additional members, and
    * a client that ignores this one still behaves correctly.
    */
-  fleetless_code: z15.string().min(1).max(60).optional()
+  fleetless_code: z16.string().min(1).max(60).optional()
 });
-var oauthClientRegistration = z15.enum(["developer", "dynamic"]);
-var redirectUri = z15.string().min(1).max(2e3).refine((v) => {
+var oauthClientRegistration = z16.enum(["developer", "dynamic"]);
+var redirectUri = z16.string().min(1).max(2e3).refine((v) => {
   let url;
   try {
     url = new URL(v);
@@ -2469,16 +4245,16 @@ var redirectUri = z15.string().min(1).max(2e3).refine((v) => {
     return ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
   return false;
 }, { message: "redirect_uri must be an https URL, or http on an explicit loopback address, and carry no fragment" });
-var codeChallengeMethod = z15.enum(["S256"]);
-var oauthClient = z15.object({
-  id: z15.uuid(),
-  app_id: z15.uuid(),
+var codeChallengeMethod = z16.enum(["S256"]);
+var oauthClient = z16.object({
+  id: z16.uuid(),
+  app_id: z16.uuid(),
   /** The `client_id` on the wire — opaque, and not the app identifier. */
-  client_id: z15.string().min(1).max(200),
-  client_name: z15.string().min(1).max(200),
+  client_id: z16.string().min(1).max(200),
+  client_name: z16.string().min(1).max(200),
   registration: oauthClientRegistration,
-  redirect_uris: z15.array(redirectUri).min(1).max(20),
-  created_at: z15.iso.datetime(),
+  redirect_uris: z16.array(redirectUri).min(1).max(20),
+  created_at: z16.iso.datetime(),
   /**
    * **Only `dynamic` clients expire, and the field is nullable rather than
    * absent so a consumer must decide what it means.** A self-registered client
@@ -2486,106 +4262,152 @@ var oauthClient = z15.object({
    * behind; a developer's own client is a configured thing that should not
    * vanish under them.
    */
-  expires_at: z15.iso.datetime().nullable(),
-  last_used_at: z15.iso.datetime().nullable()
+  expires_at: z16.iso.datetime().nullable(),
+  last_used_at: z16.iso.datetime().nullable()
 });
-var dynamicClientRegistrationRequest = z15.object({
-  client_name: z15.string().min(1).max(200),
-  redirect_uris: z15.array(redirectUri).min(1).max(20),
+var dynamicClientRegistrationRequest = z16.object({
+  client_name: z16.string().min(1).max(200),
+  redirect_uris: z16.array(redirectUri).min(1).max(20),
   /** Accepted and echoed for conformance; this server issues only this pair. */
-  grant_types: z15.array(z15.enum(["authorization_code", "refresh_token"])).optional(),
-  response_types: z15.array(z15.enum(["code"])).optional(),
+  grant_types: z16.array(z16.enum(["authorization_code", "refresh_token"])).optional(),
+  response_types: z16.array(z16.enum(["code"])).optional(),
   /** RFC 7591 allows `none` for public clients; OAuth 2.1 + PKCE is the defence. */
-  token_endpoint_auth_method: z15.enum(["none"]).optional(),
-  scope: z15.string().max(500).optional()
+  token_endpoint_auth_method: z16.enum(["none"]).optional(),
+  scope: z16.string().max(500).optional()
 }).strict();
-var dynamicClientRegistrationResponse = z15.object({
-  client_id: z15.string().min(1).max(200),
-  client_name: z15.string().min(1).max(200),
-  redirect_uris: z15.array(redirectUri),
-  grant_types: z15.array(z15.string()),
-  response_types: z15.array(z15.string()),
-  token_endpoint_auth_method: z15.literal("none"),
-  client_id_issued_at: z15.number().int().nonnegative(),
+var dynamicClientRegistrationResponse = z16.object({
+  client_id: z16.string().min(1).max(200),
+  client_name: z16.string().min(1).max(200),
+  redirect_uris: z16.array(redirectUri),
+  grant_types: z16.array(z16.string()),
+  response_types: z16.array(z16.string()),
+  token_endpoint_auth_method: z16.literal("none"),
+  client_id_issued_at: z16.number().int().nonnegative(),
   /** Seconds since the epoch, per RFC 7591. `0` would mean "never expires". */
-  client_secret_expires_at: z15.literal(0)
+  client_secret_expires_at: z16.literal(0)
 });
-var oauthTokenRequest = z15.discriminatedUnion("grant_type", [
-  z15.object({
-    grant_type: z15.literal("authorization_code"),
-    code: z15.string().min(1).max(500),
+var oauthTokenRequest = z16.discriminatedUnion("grant_type", [
+  z16.object({
+    grant_type: z16.literal("authorization_code"),
+    code: z16.string().min(1).max(500),
     redirect_uri: redirectUri,
-    client_id: z15.string().min(1).max(200),
-    code_verifier: z15.string().regex(/^[A-Za-z0-9\-._~]{43,128}$/, "code_verifier must be 43-128 unreserved characters (RFC 7636 \xA74.1)"),
-    resource: z15.url().optional()
+    client_id: z16.string().min(1).max(200),
+    code_verifier: z16.string().regex(/^[A-Za-z0-9\-._~]{43,128}$/, "code_verifier must be 43-128 unreserved characters (RFC 7636 \xA74.1)"),
+    resource: z16.url().optional()
   }),
-  z15.object({
-    grant_type: z15.literal("refresh_token"),
-    refresh_token: z15.string().min(1).max(500),
-    client_id: z15.string().min(1).max(200),
-    resource: z15.url().optional(),
+  z16.object({
+    grant_type: z16.literal("refresh_token"),
+    refresh_token: z16.string().min(1).max(500),
+    client_id: z16.string().min(1).max(200),
+    resource: z16.url().optional(),
     /** RFC 6749 §6 — a refresh may narrow scope, never widen it. */
-    scope: z15.string().max(500).optional()
+    scope: z16.string().max(500).optional()
   })
 ]);
-var oauthTokenResponse = z15.object({
-  access_token: z15.string().min(1),
-  token_type: z15.literal("Bearer"),
+var oauthTokenResponse = z16.object({
+  access_token: z16.string().min(1),
+  token_type: z16.literal("Bearer"),
   /** Seconds, per RFC 6749 §5.1 — not a timestamp, and not milliseconds. */
-  expires_in: z15.number().int().positive(),
-  refresh_token: z15.string().min(1).optional(),
-  scope: z15.string().max(500).optional()
-});
-var authorizationServerMetadata = z15.object({
-  issuer: z15.url(),
-  authorization_endpoint: z15.url(),
-  token_endpoint: z15.url(),
-  registration_endpoint: z15.url().optional(),
-  response_types_supported: z15.array(z15.literal("code")),
-  grant_types_supported: z15.array(z15.enum(["authorization_code", "refresh_token"])),
-  code_challenge_methods_supported: z15.array(codeChallengeMethod),
-  token_endpoint_auth_methods_supported: z15.array(z15.literal("none")),
-  scopes_supported: z15.array(z15.string()).optional()
-});
-var protectedResourceMetadata = z15.object({
-  resource: z15.url(),
-  authorization_servers: z15.array(z15.url()).min(1),
-  bearer_methods_supported: z15.array(z15.literal("header")),
-  scopes_supported: z15.array(z15.string()).optional()
-});
-var consentGrant = z15.object({
-  client_id: z15.string().min(1).max(200),
-  app_id: z15.uuid(),
-  end_user_id: z15.uuid(),
-  role_id: z15.uuid(),
-  scope: z15.string().max(500),
-  granted_at: z15.iso.datetime()
-});
-var oauthInteraction = z15.object({
-  interaction_id: z15.string().min(1).max(200),
-  app_name: z15.string().min(1).max(120),
-  idp: z15.object({ button_label: z15.string().min(1).max(60) }).nullable()
-});
-var oauthConsentInteraction = z15.object({
-  interaction_id: z15.string().min(1).max(200),
-  app_name: z15.string().min(1).max(120),
-  client_name: z15.string().min(1).max(200),
+  expires_in: z16.number().int().positive(),
+  refresh_token: z16.string().min(1).optional(),
+  scope: z16.string().max(500).optional()
+});
+var authorizationServerMetadata = z16.object({
+  issuer: z16.url(),
+  authorization_endpoint: z16.url(),
+  token_endpoint: z16.url(),
+  registration_endpoint: z16.url().optional(),
+  response_types_supported: z16.array(z16.literal("code")),
+  grant_types_supported: z16.array(z16.enum(["authorization_code", "refresh_token"])),
+  code_challenge_methods_supported: z16.array(codeChallengeMethod),
+  token_endpoint_auth_methods_supported: z16.array(z16.literal("none")),
+  scopes_supported: z16.array(z16.string()).optional()
+});
+var protectedResourceMetadata = z16.object({
+  resource: z16.url(),
+  authorization_servers: z16.array(z16.url()).min(1),
+  bearer_methods_supported: z16.array(z16.literal("header")),
+  scopes_supported: z16.array(z16.string()).optional()
+});
+var consentGrant = z16.object({
+  client_id: z16.string().min(1).max(200),
+  app_id: z16.uuid(),
+  end_user_id: z16.uuid(),
+  role_id: z16.uuid(),
+  scope: z16.string().max(500),
+  granted_at: z16.iso.datetime()
+});
+var consentGrantSummary = z16.object({
+  client_id: z16.string().min(1).max(200),
+  /**
+   * The client's own declared name. **Not trusted, and the console/page must
+   * not render it as if Fleetless vouched for it** — a self-registered client
+   * chooses this string, and W7c already measured what that buys: one called
+   * itself *"Fleetless Official Helper"*.
+   */
+  client_name: z16.string().min(1).max(200),
+  app_id: z16.uuid(),
+  app_name: z16.string().min(1).max(120),
+  role_id: z16.uuid(),
+  role_name: z16.string().min(1).max(120),
+  scope: z16.string().max(500),
+  granted_at: z16.iso.datetime()
+});
+var consentGrantListResponse = z16.object({
+  grants: z16.array(consentGrantSummary).max(200),
+  /**
+   * **`true` heisst: es gibt mehr, und diese Antwort zeigt sie nicht** (W9
+   * review, Argus-W9; DEF-151).
+   *
+   * Das `.max(200)` oben war eine Grenze auf dem Draht und im Store keine —
+   * ein Endnutzer ueber 200 bekam eine Antwort, die dieser Vertrag verbietet.
+   * Das Limit nachzuziehen machte die Antwort **vertragskonform statt
+   * vertragswidrig — und stumm statt vollstaendig**: wer 250 Grants hat, sah
+   * 200 und erreichte die uebrigen 50 nie.
+   *
+   * Dieselbe Unterscheidung, die `historySamplesResponse` mit `truncated_by`
+   * traegt und `auditListResponse` mit `next_cursor`: **eine kurze Seite
+   * heisst nicht, dass nichts mehr da ist.** Sie fehlte ausgerechnet auf der
+   * einen Liste, auf der ein Nutzer etwas **abstellen** will — dort ist
+   * *"ich sehe es nicht"* und *"es gibt es nicht"* der teuerste aller
+   * Unterschiede.
+   *
+   * Bewusst ein Boolean und kein Cursor: Blaettern waere eine Zusage ueber
+   * Reihenfolge und Stabilitaet, die diese Liste heute nicht macht. `true`
+   * sagt, was der Nutzer wissen muss — **hier fehlt etwas, frag jemanden** —
+   * ohne einen Mechanismus zu versprechen, den es nicht gibt.
+   */
+  truncated: z16.boolean()
+});
+var consentRevokeResponse = z16.object({
+  revoked: z16.boolean(),
+  tokens_revoked: z16.number().int().nonnegative()
+});
+var oauthInteraction = z16.object({
+  interaction_id: z16.string().min(1).max(200),
+  app_name: z16.string().min(1).max(120),
+  idp: z16.object({ button_label: z16.string().min(1).max(60) }).nullable()
+});
+var oauthConsentInteraction = z16.object({
+  interaction_id: z16.string().min(1).max(200),
+  app_name: z16.string().min(1).max(120),
+  client_name: z16.string().min(1).max(200),
   registration: oauthClientRegistration,
-  role_name: z15.string().min(1).max(120),
-  scope: z15.string().max(500)
+  role_name: z16.string().min(1).max(120),
+  scope: z16.string().max(500)
 });
-var oauthLoginRequest = z15.object({
-  interaction_id: z15.string().min(1).max(200),
-  email: z15.email(),
-  password: z15.string().min(1)
+var oauthLoginRequest = z16.object({
+  interaction_id: z16.string().min(1).max(200),
+  email: z16.email(),
+  password: z16.string().min(1)
 }).strict();
-var oauthRedirectResponse = z15.object({
-  redirect_to: z15.string().min(1).max(2e3)
+var oauthRedirectResponse = z16.object({
+  redirect_to: z16.string().min(1).max(2e3)
 });
-var consentDecision = z15.object({
+var consentDecision = z16.object({
   /** The opaque handle the authorize step handed the consent screen. */
-  interaction_id: z15.string().min(1).max(200),
-  approved: z15.boolean()
+  interaction_id: z16.string().min(1).max(200),
+  approved: z16.boolean()
 });
 var OAUTH_PATHS = {
   authorizationServerMetadata: "/.well-known/oauth-authorization-server",
@@ -2643,7 +4465,24 @@ var OAUTH_PATHS = {
    * A failed `POST` answers `apiError`, not `oauthError`: the caller is our own
    * page, not a standard client. See the dialect note at the top of this file.
    */
-  login: "/login"
+  login: "/login",
+  /**
+   * **The org-admin impersonation interstitial** (spec `org-identity-redesign`
+   * D4) — and, like `consent` and `login`, **one path with both verbs**: `GET`
+   * serves the "sign in as" page, `POST` accepts an `impersonationChoice` and
+   * answers an `oauthLoginResponse`.
+   *
+   * Reached only by an org admin whose `POST /login` authenticated against the
+   * Org Admins group: instead of a session, they are redirected here to pick a
+   * role to preview or a user to sign in as. The page is **server-rendered by
+   * the cloud from its own origin** — the console never builds it and never
+   * hardcodes this path; the login page merely follows the `redirect_to` it is
+   * handed. It belongs in this list for the reason `idpStart`/`idpCallback` do:
+   * a server-owned target a client is sent to, which must have exactly one
+   * definition rather than a literal in `cloud/src/routes/oauth.ts` that a
+   * second reader could drift from.
+   */
+  impersonate: "/oauth/impersonate"
 };
 
 // src/pkce.ts
@@ -2728,18 +4567,6 @@ var ServerKeyCredentials = class {
     return false;
   }
 };
-function createPasswordResetMethods(http, appIdentifier2) {
-  return {
-    async requestPasswordReset(email) {
-      const body = { app_identifier: appIdentifier2, email };
-      await http.request("/api/client/password/reset", { method: "POST", skipAuth: true, body, expectEmptyBody: true });
-    },
-    async confirmPasswordReset(token, newPassword) {
-      const body = { token, new_password: newPassword };
-      await http.request("/api/client/password/reset/confirm", { method: "POST", skipAuth: true, body, expectEmptyBody: true });
-    }
-  };
-}
 function createSessionAuth(http, tokenStore, appIdentifier2) {
   return {
     async login(email, password2) {
@@ -2795,34 +4622,39 @@ function createSessionAuth(http, tokenStore, appIdentifier2) {
     async logout() {
       const session = await tokenStore.load();
       let revoked = true;
+      let idpLogout = null;
       if (session) {
         const body = { refresh_token: session.refresh_token };
-        revoked = await http.request("/api/client/logout", { method: "POST", skipAuth: true, body, expectEmptyBody: true }).then(() => true).catch(() => false);
+        try {
+          const response = await http.request("/api/client/logout", {
+            method: "POST",
+            skipAuth: true,
+            body
+          });
+          revoked = true;
+          idpLogout = response.idp_logout;
+        } catch {
+          revoked = false;
+          idpLogout = null;
+        }
       }
       await tokenStore.save(null);
-      return { revoked };
+      return { revoked, idp_logout: idpLogout };
     },
     async me() {
       return http.request("/api/client/me", {});
     },
-    async register(email, password2) {
-      const body = { app_identifier: appIdentifier2, email, password: password2 };
-      return http.request("/api/client/register", { method: "POST", skipAuth: true, body });
-    },
-    async confirmRegistration(token) {
-      const body = { token };
-      const tokens = await http.request("/api/client/register/confirm", { method: "POST", skipAuth: true, body });
-      await tokenStore.save(tokens);
-    },
     async changePassword(currentPassword, newPassword) {
       const body = { current_password: currentPassword, new_password: newPassword };
       const tokens = await http.request("/api/client/password/change", { method: "POST", body });
       await tokenStore.save(tokens);
     },
-    ...createPasswordResetMethods(http, appIdentifier2)
+    passwordResetUrl() {
+      return `${http.baseUrl.replace(/\/+$/, "")}/reset-password`;
+    }
   };
 }
-function createServerKeyAuth(http, appIdentifier2) {
+function createServerKeyAuth(http) {
   return {
     async login() {
       throw new Error("auth.login is not available on a client constructed with a serverKey.");
@@ -2839,16 +4671,12 @@ function createServerKeyAuth(http, appIdentifier2) {
     async me() {
       return http.request("/api/client/me", {});
     },
-    async register() {
-      throw new Error("auth.register is not available on a client constructed with a serverKey.");
-    },
-    async confirmRegistration() {
-      throw new Error("auth.confirmRegistration is not available on a client constructed with a serverKey.");
-    },
     async changePassword() {
       throw new Error("auth.changePassword is not available on a client constructed with a serverKey.");
     },
-    ...createPasswordResetMethods(http, appIdentifier2)
+    passwordResetUrl() {
+      throw new Error("auth.passwordResetUrl is not available on a client constructed with a serverKey.");
+    }
   };
 }
 
@@ -3138,6 +4966,29 @@ function createDatapointsApi(http, channel, slugSubscriptions) {
   };
 }
 
+// src/grants.ts
+function createSessionGrants(http) {
+  return {
+    async list() {
+      const response = await http.request("/api/client/grants", {});
+      return response.grants;
+    },
+    async revoke(clientId) {
+      return http.request(`/api/client/grants/${pathSegment(clientId)}`, { method: "DELETE" });
+    }
+  };
+}
+function createServerKeyGrants() {
+  return {
+    async list() {
+      throw new Error("grants.list is not available on a client constructed with a serverKey.");
+    },
+    async revoke() {
+      throw new Error("grants.revoke is not available on a client constructed with a serverKey.");
+    }
+  };
+}
+
 // src/job-subscriptions.ts
 function keyOf2(robotId, slug2) {
   return `${robotId} ${slug2}`;
@@ -3566,18 +5417,21 @@ function createClient(options) {
   }
   const webSocketImpl = options.WebSocket ?? globalThis.WebSocket;
   let auth;
+  let grants;
   let http;
   let credentials;
   if (options.serverKey !== void 0) {
     credentials = new ServerKeyCredentials(options.serverKey);
     http = new HttpClient({ baseUrl: config.apiUrl, fetch: fetchImpl, credentials });
-    auth = createServerKeyAuth(http, config.appIdentifier);
+    auth = createServerKeyAuth(http);
+    grants = createServerKeyGrants();
   } else {
     const tokenStore = options.tokenStore ?? new InMemoryTokenStore();
     http = new HttpClient({ baseUrl: config.apiUrl, fetch: fetchImpl, credentials: noCredentials });
     credentials = new SessionCredentials(http, tokenStore);
     http.setCredentials(credentials);
     auth = createSessionAuth(http, tokenStore, config.appIdentifier);
+    grants = createSessionGrants(http);
   }
   const channel = new RealtimeChannel({ url: config.realtimeUrl, WebSocket: webSocketImpl, credentials });
   const slugSubscriptions = createSlugSubscriptions(channel);
@@ -3604,6 +5458,7 @@ function createClient(options) {
   return {
     config,
     auth,
+    grants,
     datapoints,
     actions,
     services,