@fleetless/sdk 1.0.0

package/dist/index.cjs

@@ -0,0 +1,3662 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  FleetlessError: () => FleetlessError,
+  InMemoryTokenStore: () => InMemoryTokenStore,
+  SDK_ERROR_CODES: () => SDK_ERROR_CODES,
+  createClient: () => createClient,
+  parameterInvalidDetails: () => parameterInvalidDetails
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/errors.ts
+var SDK_ERROR_CODES = [
+  "no_session",
+  "no_websocket",
+  "unparseable_error",
+  "command_timeout",
+  "command_outcome_unknown",
+  "unexpected_response",
+  "invalid_option",
+  "untrusted_absolute_url",
+  "state_mismatch",
+  "no_hosted_login_attempt",
+  "no_urdf_synced",
+  "aborted"
+];
+var FleetlessError = class extends Error {
+  code;
+  details;
+  status;
+  constructor(code, message, options = {}) {
+    super(message);
+    this.name = "FleetlessError";
+    this.code = code;
+    this.details = options.details;
+    this.status = options.status;
+  }
+};
+
+// src/actions.ts
+function createActionsApi(transport, jobSubscriptions) {
+  return {
+    async invoke(robotId, slug2, params, options) {
+      const result = await transport.invoke(robotId, slug2, params, options);
+      if (!result.job) {
+        throw new FleetlessError("unexpected_response", `The server accepted the invoke for '${slug2}' but returned no job to track.`);
+      }
+      return result.job;
+    },
+    async cancel(robotId, slug2, jobId, options) {
+      const result = await transport.cancel(robotId, slug2, jobId, options);
+      return result.job;
+    },
+    subscribe(robotId, slug2, handlers) {
+      return jobSubscriptions.subscribe(robotId, slug2, handlers);
+    }
+  };
+}
+
+// src/http.ts
+var noCredentials = {
+  async token() {
+    return null;
+  },
+  async handleExpired() {
+    return false;
+  }
+};
+function mimeFromContentType(headers) {
+  const raw = headers.get("content-type");
+  if (raw === null) return null;
+  return raw.split(";")[0]?.trim() || null;
+}
+function pathSegment(value) {
+  return encodeURIComponent(value);
+}
+var HttpClient = class {
+  #baseUrl;
+  #fetch;
+  #credentials;
+  constructor(options) {
+    this.#baseUrl = options.baseUrl;
+    this.#fetch = options.fetch;
+    this.#credentials = options.credentials;
+  }
+  /**
+   * Swaps the credential source after construction. Exists to break a
+   * construction cycle: a session's `CredentialSource` needs this
+   * `HttpClient` to call `/api/client/refresh`, so the client is built
+   * first with a placeholder and the real source attached once it exists.
+   */
+  setCredentials(credentials) {
+    this.#credentials = credentials;
+  }
+  /**
+   * D8 (W6c): calling `request()` with one of `RequestBodyByRoute`'s
+   * literal paths requires `options.body` to match that route's contract
+   * type exactly, via `RequestOptionsFor<P>` below.
+   *
+   * **Deliberately not a pair of overloads** — a first version was:
+   * `request<T, P extends keyof RequestBodyByRoute>(path: P, options: {
+   * body: RequestBodyByRoute[P] } & ...): Promise<T>` followed by a looser
+   * `request<T>(path: string, options?: RequestOptions): Promise<T>`
+   * fallback. Verified wrong before it ever landed: TypeScript overload
+   * resolution tries each signature in order and silently falls through to
+   * the next one on a mismatch — so a call with the WRONG body for a mapped
+   * route simply failed to match the strict overload and matched the loose
+   * one instead, with **no diagnostic at all**. A single generic signature
+   * whose `options` type is *computed* from `P` (below) has no looser
+   * sibling to fall back to, so a mismatch has nowhere to go but an error.
+   *
+   * **`options` has no default value, on purpose.** A default of `{} as
+   * RequestOptionsFor<P>` would type-check by construction — the cast
+   * bypasses the very check this exists to add, which is the identical
+   * "special case that quietly exempts calls from the general rule" shape
+   * D7 already found once in this file. Every current call site to a route
+   * with no body already passes `{}` explicitly for exactly this reason.
+   */
+  async request(path, options) {
+    const response = await this.#send(path, options, true);
+    const text = await response.text();
+    if (text.length === 0) {
+      if (options.expectEmptyBody) return void 0;
+      throw new FleetlessError(
+        "unexpected_response",
+        `${options.method ?? "GET"} ${path} answered ok (${response.status}) but the body was empty; this route is expected to always return one.`
+      );
+    }
+    return JSON.parse(text);
+  }
+  /**
+   * Like `request`, but for an endpoint that answers with raw bytes instead
+   * of a JSON body (a camera snapshot, W5) — same auth attachment, same
+   * single retry on `token_expired`, same `FleetlessError` on a non-2xx
+   * response; only what a *successful* response is made of differs, so both
+   * methods share `#send` rather than duplicating that logic.
+   */
+  async requestBinary(path, options = {}) {
+    const response = await this.#send(path, options, true);
+    const body = new Uint8Array(await response.arrayBuffer());
+    return { body, headers: response.headers };
+  }
+  /**
+   * The base URL this client was constructed with — exposed so a caller
+   * building a URL that is not itself a `request()`/`requestBinary()` call
+   * (today: `auth.beginHostedLogin`'s `/oauth/authorize` link) does not need
+   * its own copy of the value `HttpClient` already holds.
+   */
+  get baseUrl() {
+    return this.#baseUrl;
+  }
+  /**
+   * `/oauth/token` (RFC 6749 §3.2, §5), and nothing else — deliberately not
+   * routed through `request()`/`#send()`, because every difference from
+   * those follows from one fact: this is not our own API.
+   *
+   * - **`application/x-www-form-urlencoded`, never JSON.** A real
+   *   RFC-compliant client (gate step 4's `mcp-inspector`) sends form
+   *   fields, not a JSON object — this is not a stylistic choice either side
+   *   of this wire gets to make.
+   * - **Unauthenticated.** `/oauth/token` is a public client's endpoint (no
+   *   `client_secret` — OAuth 2.1 + PKCE is the defence, same as
+   *   `dynamicClientRegistrationResponse`'s `token_endpoint_auth_method:
+   *   'none'`), so there is no bearer credential to attach and no
+   *   `token_expired` retry to apply — there is no token yet to expire.
+   * - **A different error dialect.** `oauth.ts`'s own doc comment says the
+   *   OAuth/`apiError` split is "by audience, not by accident"; folding this
+   *   into `request()`'s error handling would be the identical mistake one
+   *   level down. A failure here answers `{ error, error_description }`
+   *   (RFC 6749 §5.2), never `{ code, message }`. `error` becomes this
+   *   `FleetlessError`'s `.code` directly — an OAuth error code (e.g.
+   *   `invalid_grant`) IS the stable, branch-on value here, exactly as
+   *   `apiError`'s `code` is for every other route.
+   * - **Exactly one `fetch()`, always.** No retry, no timeout-and-resend, no
+   *   `signal` parameter at all — unlike `request()`/`requestBinary()`,
+   *   nothing here can leave a second request in flight behind the
+   *   caller's back. That matters specifically for the authorization-code
+   *   grant: a second presentation of the same `code` revokes the whole
+   *   token family server-side (André, 2026-08-18), so a caller-level retry
+   *   racing an in-flight `completeHostedLogin()` is a real hazard this
+   *   method cannot protect against on its own — see that method's own doc
+   *   comment for the consequence.
+   */
+  async requestOAuth(path, formBody) {
+    const url = `${this.#baseUrl}${path}`;
+    const response = await this.#fetch(url, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams(formBody).toString()
+    });
+    const text = await response.text();
+    if (response.ok) {
+      if (text.length === 0) {
+        throw new FleetlessError("unexpected_response", `POST ${path} answered ok (${response.status}) but the body was empty.`);
+      }
+      return JSON.parse(text);
+    }
+    const body = safeJsonParse(text);
+    const code = typeof body?.error === "string" ? body.error : "unparseable_error";
+    const message = typeof body?.error_description === "string" ? body.error_description : response.statusText || "OAuth request failed";
+    throw new FleetlessError(code, message, { status: response.status });
+  }
+  /** Fetches with credentials attached and the token_expired retry applied; returns the raw successful `Response`, or throws `FleetlessError`. */
+  async #send(path, options, allowRetry) {
+    const isAbsolute = /^https?:\/\//.test(path);
+    const url = isAbsolute ? path : `${this.#baseUrl}${path}`;
+    if (isAbsolute && new URL(url).origin !== new URL(this.#baseUrl).origin) {
+      throw new FleetlessError(
+        "untrusted_absolute_url",
+        `Refusing to fetch '${url}': its origin does not match this client's own API (${this.#baseUrl}). This SDK only attaches credentials to requests aimed at the API it was configured with.`
+      );
+    }
+    const headers = {};
+    if (options.body !== void 0) headers["content-type"] = "application/json";
+    if (!options.skipAuth) {
+      const token = await this.#credentials.token();
+      if (token) headers.authorization = `Bearer ${token}`;
+    }
+    const response = await this.#fetch(url, {
+      method: options.method ?? "GET",
+      headers,
+      body: options.body === void 0 ? void 0 : JSON.stringify(options.body),
+      signal: options.signal
+    });
+    if (response.ok) return response;
+    const body = await safeJson(response);
+    const code = typeof body?.code === "string" ? body.code : "unparseable_error";
+    const message = typeof body?.message === "string" ? body.message : response.statusText || "Request failed";
+    if (!options.skipAuth && allowRetry && code === "token_expired") {
+      let canRetry;
+      try {
+        canRetry = await this.#credentials.handleExpired();
+      } catch (refreshError) {
+        if (refreshError instanceof FleetlessError) throw refreshError;
+        throw new FleetlessError(code, message, { details: body?.details, status: response.status });
+      }
+      if (canRetry) return this.#send(path, options, false);
+    }
+    throw new FleetlessError(code, message, { details: body?.details, status: response.status });
+  }
+};
+async function safeJson(response) {
+  try {
+    return await response.json();
+  } catch {
+    return void 0;
+  }
+}
+function safeJsonParse(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+}
+
+// src/assets.ts
+var DEFAULT_MESH_LOADER_TIMEOUT_MS = 3e4;
+var DEFAULT_SCENE_LOAD_CONCURRENCY = 6;
+var managersWithPreparedUrdfScene = /* @__PURE__ */ new WeakSet();
+function urlModifierKeysFor(name) {
+  const prefix = "package://";
+  if (!name.startsWith(prefix)) return [name];
+  return [name, `/${name.slice(prefix.length)}`];
+}
+function normalizedUrlModifierKey(url) {
+  if (url.startsWith("package://") || /^[a-z][a-z0-9+.-]*:/i.test(url)) return url;
+  try {
+    return new URL(url, "file:///").pathname;
+  } catch {
+    return url;
+  }
+}
+function packageNameOf(name) {
+  const prefix = "package://";
+  if (!name.startsWith(prefix)) return null;
+  const rest = name.slice(prefix.length);
+  const slash = rest.indexOf("/");
+  return slash === -1 ? rest : rest.slice(0, slash);
+}
+function isOwnedReference(url, knownPackages) {
+  if (url.startsWith("package://")) return true;
+  const match = /^\/([^/]+)\//.exec(url);
+  return match !== null && knownPackages.has(match[1]);
+}
+function isNetworkFetchableAbsoluteUrl(url) {
+  return /^https?:\/\//i.test(url);
+}
+function isRenderKind(kind) {
+  switch (kind) {
+    case "mesh":
+    case "texture":
+      return true;
+    case "urdf":
+    case "other":
+      return false;
+    default: {
+      const exhaustive = kind;
+      return exhaustive;
+    }
+  }
+}
+async function forEachWithConcurrency(items, limit, fn) {
+  let next = 0;
+  let failed = false;
+  let firstError;
+  async function worker() {
+    for (; ; ) {
+      const index = next++;
+      if (index >= items.length) return;
+      try {
+        await fn(items[index]);
+      } catch (error) {
+        if (!failed) {
+          failed = true;
+          firstError = error;
+        }
+      }
+    }
+  }
+  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, () => worker()));
+  if (failed) throw firstError;
+}
+function createAssetsApi(http) {
+  async function list(robotId, signal) {
+    const response = await http.request(`/api/robots/${pathSegment(robotId)}/assets`, { signal });
+    return response;
+  }
+  async function get(robotId, assetId, signal) {
+    const { body, headers } = await http.requestBinary(`/api/robots/${pathSegment(robotId)}/assets/${pathSegment(assetId)}`, { signal });
+    return { body, mime: mimeFromContentType(headers) };
+  }
+  return {
+    list,
+    get,
+    async urdf(robotId) {
+      const { body } = await http.requestBinary(`/api/robots/${pathSegment(robotId)}/urdf`);
+      return new TextDecoder().decode(body);
+    },
+    createMeshLoader(robotId, delegate, options = {}) {
+      const timeoutMs = options.timeoutMs ?? DEFAULT_MESH_LOADER_TIMEOUT_MS;
+      return (path, manager, material, onComplete) => {
+        let settled = false;
+        let objectUrl = null;
+        const finish = (obj, err) => {
+          if (settled) return;
+          settled = true;
+          if (objectUrl) URL.revokeObjectURL(objectUrl);
+          onComplete(obj, err);
+        };
+        if (typeof manager === "object" && manager !== null && managersWithPreparedUrdfScene.has(manager)) {
+          finish(
+            null,
+            new Error(
+              `createMeshLoader and prepareUrdfScene were both installed on the same LoadingManager for robot ${robotId}. Use one or the other on a given manager, not both \u2014 see the README.`
+            )
+          );
+          return;
+        }
+        const timer = setTimeout(() => {
+          finish(null, new Error(`Mesh '${path}' on robot ${robotId} did not finish loading within ${timeoutMs}ms.`));
+        }, timeoutMs);
+        http.requestBinary(path).then(
+          ({ body, headers }) => {
+            if (settled) return;
+            const mime = mimeFromContentType(headers) ?? "application/octet-stream";
+            objectUrl = URL.createObjectURL(new Blob([body], { type: mime }));
+            try {
+              delegate(objectUrl, manager, material, (obj, err) => {
+                clearTimeout(timer);
+                finish(obj, err);
+              });
+            } catch (delegateError) {
+              clearTimeout(timer);
+              finish(null, delegateError instanceof Error ? delegateError : new Error(String(delegateError)));
+            }
+          },
+          (fetchError) => {
+            clearTimeout(timer);
+            finish(null, fetchError instanceof Error ? fetchError : new Error(String(fetchError)));
+          }
+        );
+      };
+    },
+    async prepareUrdfScene(robotId, manager, options = {}) {
+      const concurrency = options.concurrency ?? DEFAULT_SCENE_LOAD_CONCURRENCY;
+      if (!Number.isInteger(concurrency) || concurrency < 1) {
+        throw new FleetlessError(
+          "invalid_option",
+          `prepareUrdfScene: options.concurrency must be a positive integer, got ${concurrency}.`
+        );
+      }
+      const signal = options.signal;
+      const aborted = () => new FleetlessError("aborted", `prepareUrdfScene for robot ${robotId} was aborted.`);
+      if (signal?.aborted) throw aborted();
+      const listResponse = await list(robotId, signal).catch((error) => {
+        throw signal?.aborted ? aborted() : error;
+      });
+      const urdfAsset = listResponse.assets.find((asset2) => asset2.kind === "urdf");
+      if (!urdfAsset) {
+        throw new FleetlessError(
+          "no_urdf_synced",
+          `Robot ${robotId} has no synced URDF \u2014 assets.list() has no 'urdf'-kind row. Sync one first (console, Owner-tier).`
+        );
+      }
+      const { body: urdfBytes } = await get(robotId, urdfAsset.id, signal).catch((error) => {
+        throw signal?.aborted ? aborted() : error;
+      });
+      const urdfText = new TextDecoder().decode(urdfBytes);
+      const renderAssets = listResponse.assets.filter((asset2) => isRenderKind(asset2.kind));
+      const knownPackages = /* @__PURE__ */ new Set();
+      for (const asset2 of renderAssets) {
+        const pkg = packageNameOf(asset2.name);
+        if (pkg) knownPackages.add(pkg);
+      }
+      for (const ref of listResponse.urdf.missing) {
+        const pkg = packageNameOf(ref);
+        if (pkg) knownPackages.add(pkg);
+      }
+      const refusedObjectUrl = URL.createObjectURL(new Blob([]));
+      const objectUrls = [];
+      const nameToObjectUrl = /* @__PURE__ */ new Map();
+      try {
+        await forEachWithConcurrency(renderAssets, concurrency, async (asset2) => {
+          const { body, mime } = await get(robotId, asset2.id, signal);
+          const objectUrl = URL.createObjectURL(new Blob([body], { type: mime ?? "application/octet-stream" }));
+          objectUrls.push(objectUrl);
+          for (const key of urlModifierKeysFor(asset2.name)) nameToObjectUrl.set(key, objectUrl);
+        });
+      } catch (error) {
+        for (const objectUrl of objectUrls) URL.revokeObjectURL(objectUrl);
+        throw signal?.aborted ? aborted() : error;
+      }
+      if (signal?.aborted) {
+        for (const objectUrl of objectUrls) URL.revokeObjectURL(objectUrl);
+        throw aborted();
+      }
+      if (typeof manager === "object" && manager !== null) managersWithPreparedUrdfScene.add(manager);
+      manager.setURLModifier((url) => {
+        const direct = nameToObjectUrl.get(url);
+        if (direct) return direct;
+        if (!isOwnedReference(url, knownPackages)) {
+          return isNetworkFetchableAbsoluteUrl(url) ? refusedObjectUrl : url;
+        }
+        return nameToObjectUrl.get(normalizedUrlModifierKey(url)) ?? refusedObjectUrl;
+      });
+      let disposed = false;
+      return {
+        urdfText,
+        missing: listResponse.urdf.missing,
+        dispose() {
+          if (disposed) return;
+          disposed = true;
+          for (const objectUrl of objectUrls) URL.revokeObjectURL(objectUrl);
+          nameToObjectUrl.clear();
+        }
+      };
+    }
+  };
+}
+
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_367ffc97d258be510904ed62d5d477a4/node_modules/@fleetless/contracts/dist/common.js
+var import_zod = require("zod");
+var slug = import_zod.z.string().min(2).max(63).regex(/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/);
+var rosName = import_zod.z.string().max(255).regex(/^\/[A-Za-z_][A-Za-z0-9_]*(?:\/[A-Za-z_][A-Za-z0-9_]*)*$/);
+var rosTypeName = import_zod.z.string().max(255).regex(/^[a-z][a-z0-9_]*\/(?:msg|srv|action)\/[A-Za-z][A-Za-z0-9]*$/);
+var fieldPath = import_zod.z.string().max(255).regex(/^[a-z_][a-z0-9_]*(?:\[\d+\])*(?:\.[a-z_][a-z0-9_]*(?:\[\d+\])*)*$/);
+
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_367ffc97d258be510904ed62d5d477a4/node_modules/@fleetless/contracts/dist/mcp.js
+var import_zod2 = require("zod");
+var mcpToolKind = import_zod2.z.enum(["datapoint", "service", "action", "publisher", "camera"]);
+var MCP_TOOL_NAME_MAX = 128;
+var mcpToolNamePattern = /^[a-z0-9][a-z0-9_-]*$/;
+var mcpToolPreview = import_zod2.z.object({
+  name: import_zod2.z.string().min(1).max(MCP_TOOL_NAME_MAX).regex(mcpToolNamePattern),
+  /** The human-readable label — where the robot's actual name goes. */
+  title: import_zod2.z.string().min(1).max(200),
+  /**
+   * **Four thousand, not two thousand, and the difference is the point.**
+   *
+   * `serviceDescription` bounds what a *developer writes* at 2000. This bounds
+   * what the *generator produces*, which is that text **plus** what it folds
+   * in — a datapoint's `Unit:` and `Plausible range:`, a camera's fixed
+   * sentence about snapshots. Measured by Kassandra-W7c and Momus-W7c
+   * independently: a maximal description came back at 2036–2068 characters
+   * against a 2000 bound, so the cloud served a document its own contract
+   * rejected — silently, because the route returns a typed literal without
+   * parsing it.
+   *
+   * **Do not "tidy" these two numbers into agreement.** They describe
+   * different things, and making them equal reintroduces the defect: either
+   * the generator truncates a developer's own words, or the response
+   * overflows again. The gap is the room the generator needs.
+   */
+  description: import_zod2.z.string().min(1).max(4e3),
+  robot_id: import_zod2.z.uuid(),
+  slug,
+  kind: mcpToolKind,
+  input_schema: import_zod2.z.unknown()
+});
+var mcpOmission = import_zod2.z.object({
+  robot_id: import_zod2.z.uuid(),
+  slug,
+  /** One of `MCP_OMISSION_REASONS`; the wire allows any string, as with `ERROR_CODES`. */
+  reason: import_zod2.z.string().min(1),
+  message: import_zod2.z.string().min(1)
+});
+var mcpToolPreviewResponse = import_zod2.z.object({
+  role_id: import_zod2.z.uuid(),
+  tools: import_zod2.z.array(mcpToolPreview).max(500),
+  omitted: import_zod2.z.array(mcpOmission).max(500)
+});
+
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_367ffc97d258be510904ed62d5d477a4/node_modules/@fleetless/contracts/dist/protocol.js
+var import_zod7 = require("zod");
+
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_367ffc97d258be510904ed62d5d477a4/node_modules/@fleetless/contracts/dist/assets.js
+var import_zod3 = require("zod");
+var assetKind = import_zod3.z.enum(["urdf", "mesh", "texture", "other"]);
+var asset = import_zod3.z.object({
+  id: import_zod3.z.uuid(),
+  robot_id: import_zod3.z.uuid(),
+  kind: assetKind,
+  /**
+   * What the robot called it — for a mesh, the `package://` URI the URDF
+   * references, verbatim. That is the only string a developer can match
+   * against their own workspace, and matching is the whole job when a sync
+   * comes back incomplete.
+   *
+   * **The naming rule for a file nothing in the URDF names (W7a, D2).** A
+   * `.dae` carries its own image references — `<init_from>textures/skin.png`
+   * — resolved by the renderer against *the `.dae`'s own directory*, and no
+   * `package://` URI for them appears anywhere in the URDF. The rule is:
+   *
+   *     name = the .dae's package:// URI, directory part,
+   *            joined with the internal reference, normalized.
+   *
+   * So `package://rx1_description/meshes/arm.dae` referencing
+   * `textures/skin.png` uploads as
+   * `package://rx1_description/meshes/textures/skin.png`.
+   *
+   * **This is the design's single point of failure and it is stated before
+   * anything is built against it.** three.js resolves that internal reference
+   * relative to wherever it loaded the `.dae` from and asks the loading
+   * manager for the result; the client can only answer if the asset's name
+   * still carries the same **relative tail** (`textures/skin.png`) that the
+   * `.dae` asked for. Normalizing into a `package://` URI preserves that tail
+   * exactly, keeps every name in one namespace a developer already reads, and
+   * keeps `urdfCompleteness.missing` meaningful for files the URDF never
+   * mentioned.
+   *
+   * A reference that escapes its package (`../../etc/passwd`) is **not**
+   * renamed into something harmless — it is refused at the producer, by the
+   * same containment check W7's K2 fix applied to `package://` resolution.
+   * Two identical rules, one of which is enforced and one of which is
+   * documented, is how W7's traversal happened in the first place.
+   */
+  name: import_zod3.z.string().min(1).max(500),
+  media_type: import_zod3.z.string().min(1).max(120),
+  size_bytes: import_zod3.z.number().int().nonnegative(),
+  /**
+   * The content hash, and the reason two robots sharing a mesh cost one copy.
+   *
+   * Exposed rather than kept internal because it is the only way a client can
+   * tell "this is the same mesh I already have" across robots — and a 3D view
+   * that re-downloads an identical arm for every robot in a fleet is the
+   * predictable failure of a store that hides it.
+   */
+  sha256: import_zod3.z.string().regex(/^[a-f0-9]{64}$/),
+  created_at: import_zod3.z.iso.datetime()
+});
+var urdfCompleteness = import_zod3.z.object({
+  /** Whether a URDF has been synced at all. Availability is a different question. */
+  present: import_zod3.z.boolean(),
+  /** How many distinct meshes the URDF references. */
+  mesh_count: import_zod3.z.number().int().nonnegative(),
+  missing: import_zod3.z.array(import_zod3.z.string().min(1))
+});
+var assetListResponse = import_zod3.z.object({
+  assets: import_zod3.z.array(asset),
+  urdf: urdfCompleteness,
+  /**
+   * What the connected bridge says it *could* transfer, which is deliberately
+   * separate from what has been transferred (§4.6: the bridge "meldet nur
+   * Verfügbarkeit"). `null` when no bridge is connected — distinct from
+   * `false`, because "no robot is online to ask" and "the robot has no URDF"
+   * send a developer to two different places.
+   *
+   * **All three states are reachable as of W7a (R7).** They were not: the bridge
+   * used to report availability from a subscription callback, which fires only
+   * when a publisher *sends* something, so it could notice presence and never
+   * absence — a robot that lost its URDF left the cloud holding the last thing
+   * it heard, forever, and `true` was sticky. The fix is an **active**
+   * `count_publishers` query on the bridge's own timer.
+   *
+   * **What a consumer still needs to know is the clock, not the gap.** An
+   * ungraceful loss — the publisher process killed rather than shut down — is
+   * noticed on **DDS's liveliness timeout**, not on the bridge's check
+   * interval. Measured against a real bridge: ~1.6 s when the publisher calls
+   * `destroy_node()`, **~19 s when it is `SIGKILL`ed**. So `true` can outlive
+   * the truth by some seconds after a crash, and no amount of polling on our
+   * side shortens it.
+   *
+   * The sticky-`true` gap was found by Rosie-W7 checking her own work against
+   * the camera-health row of identical shape; the DDS clock was measured by
+   * Rosie-W7a closing it, and this comment was still describing the gap a wave
+   * after it was fixed (Momus-W7a, W7a review).
+   */
+  urdf_available: import_zod3.z.boolean().nullable()
+});
+var assetSyncRequest = import_zod3.z.object({
+  source: import_zod3.z.enum(["bridge"])
+}).strict();
+var assetSyncResponse = import_zod3.z.object({
+  sync_id: import_zod3.z.uuid()
+});
+var assetFailureKind = import_zod3.z.enum(["unresolvable", "upload_failed", "refused"]);
+var assetFailure = import_zod3.z.object({
+  /**
+   * What could not be provided, verbatim — the same string `asset.name` would
+   * have stored and `urdfCompleteness.missing` reports, so a developer can
+   * match it against their own workspace by eye. For a URDF upload failure it
+   * is `URDF_ASSET_NAME`, which is **not** a mesh URI: a consumer rendering
+   * this list must not assume every entry is one.
+   */
+  reference: import_zod3.z.string().min(1).max(500),
+  kind: assetFailureKind
+});
+var assetSyncState = import_zod3.z.enum(["running", "succeeded", "failed"]);
+var assetSyncStatus = import_zod3.z.object({
+  sync_id: import_zod3.z.uuid(),
+  robot_id: import_zod3.z.uuid(),
+  state: assetSyncState,
+  done: import_zod3.z.number().int().nonnegative(),
+  total: import_zod3.z.number().int().nonnegative(),
+  /**
+   * **Every entry says *why*, because reconciliation could not work without
+   * it and a developer could not read it without it** (W7a review, André's
+   * decision to fix rather than defer).
+   *
+   * It was a flat `string[]`, and **six producers wrote three different facts
+   * into it indistinguishably**: a reference that resolves to nothing in the
+   * workspace, a file that exists and whose transfer failed, and — since R9's
+   * ceiling — one that was never attempted at all. The cost was paid twice
+   * over. Reconciliation cannot tell *"no longer referenced"* from
+   * *"referenced and not delivered"*, so N14 had to decline reconciling **any**
+   * partial sync, leaving legitimately-removed assets stored and charged until
+   * the next clean one. And the console prints the whole array under *"these
+   * meshes could not be resolved"*, so a URDF upload failure — which arrives
+   * as the literal `robot_description` — is shown to a developer as a mesh
+   * they should go and find.
+   *
+   * `unresolvable` is the only kind reconciliation may drop: it is the only
+   * one that means *this will not come back*. `upload_failed` and `refused`
+   * both mean *we meant to provide this and did not*, which is the distinction
+   * the union needs and the field could not carry.
+   *
+   * **Bounded, and the bound is a rule this file already wrote down one field
+   * over** (Kassandra-W7a, W7a review). `asset.name` is `max(500)`; the same
+   * names travelling here had no per-entry cap and no array cap at all.
+   *
+   * Why it matters became reachable in W7a. Before R6 an unresolvable
+   * reference was silently dropped, so this array could only grow with files
+   * that existed and failed to upload — bounded by the workspace. Once a
+   * `.dae`'s internal references are reported, **one mesh reference expands
+   * into a list bounded only by that file's own text.** Measured: a
+   * 2,120,745-byte `.dae` with 17,331 unresolvable `<init_from>` refs produces
+   * a terminal frame of 2,097,184 bytes — **32 bytes over
+   * `MAX_WS_PAYLOAD_BYTES`** — and `ws` enforces `maxPayload` before the frame
+   * is delivered, so the outcome is not a dropped frame but **the robot's
+   * socket closed, mid-sync, by a file in its own workspace.**
+   *
+   * A producer that hits its own ceiling reports **one** entry saying so
+   * rather than growing the list — the discipline gate step 5 already demands
+   * of the upload rate limit: *fail naming the limit, rather than silently
+   * reporting resolvable meshes as missing.*
+   *
+   * 1000 x 500 bytes is ~0.5 MiB of names, comfortably inside a 2 MiB frame.
+   */
+  failed: import_zod3.z.array(assetFailure).max(1e3),
+  /** Why the sync ended as it did, when that is not a per-URI fact. */
+  reason: import_zod3.z.string().min(1).nullable(),
+  started_at: import_zod3.z.iso.datetime(),
+  updated_at: import_zod3.z.iso.datetime()
+});
+var assetTooLargeDetails = import_zod3.z.object({
+  limit_bytes: import_zod3.z.number().int().positive(),
+  size_bytes: import_zod3.z.number().int().positive()
+});
+
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_367ffc97d258be510904ed62d5d477a4/node_modules/@fleetless/contracts/dist/config.js
+var import_zod4 = require("zod");
+var valueRule = import_zod4.z.object({
+  min: import_zod4.z.number().optional(),
+  max: import_zod4.z.number().optional(),
+  enum: import_zod4.z.array(import_zod4.z.union([import_zod4.z.string(), import_zod4.z.number()])).min(1).optional(),
+  pattern: import_zod4.z.string().optional(),
+  required: import_zod4.z.boolean().optional()
+});
+var serviceDescription = import_zod4.z.string().min(1).max(2e3).optional();
+var parameterDescription = import_zod4.z.string().min(1).max(500).optional();
+var parameterSpec = import_zod4.z.object({
+  /** Field path into the ROS request/goal/message — same grammar as a datapoint's. */
+  name: fieldPath,
+  /** The ROS type, for the console to render an input the developer recognises. */
+  type: import_zod4.z.string().min(1).max(255),
+  rule: valueRule,
+  description: parameterDescription
+});
+var datapointRate = import_zod4.z.discriminatedUnion("mode", [
+  import_zod4.z.object({ mode: import_zod4.z.literal("max_hz"), hz: import_zod4.z.number().positive().max(100) }),
+  import_zod4.z.object({ mode: import_zod4.z.literal("on_change") })
+]);
+var datapointRange = import_zod4.z.object({
+  min: import_zod4.z.number().nullable(),
+  max: import_zod4.z.number().nullable()
+});
+var datapointConfig = import_zod4.z.object({
+  slug,
+  topic: rosName,
+  type: rosTypeName,
+  field: fieldPath.nullable(),
+  rate: datapointRate,
+  unit: import_zod4.z.string().max(32).nullable(),
+  scale: import_zod4.z.number().nullable(),
+  offset: import_zod4.z.number().nullable(),
+  range: datapointRange.nullable(),
+  description: serviceDescription,
+  /**
+   * Record this datapoint (spec §8). Recorded values go to the time-series
+   * store and are queryable through the history API; everything else is
+   * live-only and leaves no trace.
+   *
+   * **Exactly one representation of "not recorded": `false`.** W5 reserved
+   * this field as `z.null().optional()`, so stored documents may carry
+   * `retention: null` — the cloud normalises that to `false` on read rather
+   * than the contract accepting both, because two spellings of one fact is
+   * the defect this project has spent two waves removing.
+   *
+   * Defaulted so a document written before W6 still parses. Note that
+   * `.default()` publishes as `required` in the generated artifact — the
+   * fourth instance, deferred to W7 with the fix identified
+   * (`io: 'input'`, split per schema).
+   */
+  retention: import_zod4.z.boolean().default(false),
+  /**
+   * What happens to this datapoint's values while the bridge is disconnected
+   * (spec §6.3). Buffered values are backfilled after reconnect — **after**
+   * live telemetry and job results, at a limited rate, so closing a gap can
+   * never delay what is happening now. An unbuffered datapoint simply has a
+   * gap, which is an honest answer and often the right one.
+   */
+  buffer: import_zod4.z.object({
+    enabled: import_zod4.z.boolean(),
+    /**
+     * Zero is legal and means "no depth" — it is what a disabled buffer
+     * carries. The invariant that matters is stated below: *enabled*
+     * implies a depth greater than zero.
+     */
+    max_values: import_zod4.z.number().int().nonnegative().max(1e5)
+  }).refine((b) => !b.enabled || b.max_values > 0, {
+    message: "an enabled buffer needs max_values > 0",
+    path: ["max_values"]
+  }).default({ enabled: false, max_values: 0 })
+});
+var actionConfig = import_zod4.z.object({
+  slug,
+  ros_name: rosName,
+  type: rosTypeName,
+  parameters: import_zod4.z.array(parameterSpec).max(50),
+  description: serviceDescription
+});
+var serviceConfig = import_zod4.z.object({
+  slug,
+  ros_name: rosName,
+  type: rosTypeName,
+  parameters: import_zod4.z.array(parameterSpec).max(50),
+  description: serviceDescription
+});
+var publisherConfig = import_zod4.z.object({
+  slug,
+  topic: rosName,
+  type: rosTypeName,
+  parameters: import_zod4.z.array(parameterSpec).max(50),
+  timeout_ms: import_zod4.z.number().int().positive().max(6e4),
+  /** The message the bridge publishes on timeout. Shape is the ROS type's. */
+  failsafe: import_zod4.z.unknown(),
+  quiet_timeout_ms: import_zod4.z.number().int().nonnegative().max(6e5),
+  description: serviceDescription
+});
+var credentialRef = import_zod4.z.string().min(1).max(64);
+var cameraSource = import_zod4.z.discriminatedUnion("kind", [
+  import_zod4.z.object({
+    kind: import_zod4.z.literal("ros"),
+    topic: rosName,
+    /** `sensor_msgs/msg/Image` or `sensor_msgs/msg/CompressedImage`. */
+    type: rosTypeName
+  }),
+  import_zod4.z.object({
+    kind: import_zod4.z.literal("rtsp"),
+    /**
+     * Scheme-constrained deliberately. The playbook drafted `z.string().url()`
+     * here and the shipped contract was `z.string().min(1).max(2048)` — nobody
+     * recorded the change, and the W6 review found the consequence: the bridge
+     * opens these with libraries that honour `file:` and `ftp:`, so an
+     * unconstrained URL turns a configuration document into an arbitrary
+     * local-file read on the robot, with the two distinct failure codes
+     * doubling as a file-existence oracle. Spec §7.6 is ROS-pure exposure with
+     * no shell or http features; that rule came back by omission rather than
+     * by intent. The bridge re-checks this too — a robot must not become a
+     * file server because a validator changed.
+     */
+    url: import_zod4.z.string().min(1).max(2048).regex(/^rtsps?:\/\//i, "must be an rtsp:// or rtsps:// URL"),
+    /** TCP by default: UDP loses frames on a congested link, silently. */
+    transport: import_zod4.z.enum(["tcp", "udp"]).default("tcp"),
+    credentials_ref: credentialRef.nullable().default(null)
+  }),
+  import_zod4.z.object({
+    kind: import_zod4.z.literal("mjpeg"),
+    /** `http:`/`https:` only — see the `rtsp` variant above for why. */
+    url: import_zod4.z.string().min(1).max(2048).regex(/^https?:\/\//i, "must be an http:// or https:// URL"),
+    credentials_ref: credentialRef.nullable().default(null)
+  }),
+  import_zod4.z.object({
+    kind: import_zod4.z.literal("v4l2"),
+    /**
+     * e.g. `/dev/video0`, or a stable `/dev/v4l/by-id/...` symlink. Resolved
+     * on the robot, never by the cloud.
+     *
+     * Constrained to `/dev/` for the same reason the `rtsp` and `mjpeg` URLs
+     * are constrained to their schemes, and it was missed the first time
+     * (Momus, W6 verification). The device string reaches
+     * `cv2.VideoCapture(device)` on the robot, and OpenCV does not restrict
+     * itself to devices: measured on cv2 4.5.4, an ordinary local video file
+     * opens and its pixels are published to the cloud, and so does
+     * `http://127.0.0.1:8899/secret.jpg`. Unconstrained, this field is an
+     * arbitrary local-file read *and* an outbound fetch from inside the robot
+     * — the §7.6 violation closed for the other two source kinds, reachable
+     * through the fourth, because "it is just a device path" read like a
+     * reason not to check.
+     *
+     * Narrower than the URL hole in one respect worth recording: a non-media
+     * file and a missing file both fail to open, so this branch never worked
+     * as a file-existence oracle.
+     *
+     * The bridge re-derives this constraint rather than trusting the wire
+     * (`validate_device_path`), exactly as it re-derives the URL scheme.
+     */
+    device: import_zod4.z.string().min(1).max(128).regex(/^\/dev\/[A-Za-z0-9][A-Za-z0-9._/-]*$/, "must be a device path under /dev/").refine((v) => !v.split("/").includes(".."), "must not contain a `..` path segment").refine((v) => !v.endsWith("/"), "must name a device, not a directory")
+  })
+]);
+var cameraConfig = import_zod4.z.object({
+  slug,
+  source: cameraSource,
+  width: import_zod4.z.number().int().positive().max(7680),
+  height: import_zod4.z.number().int().positive().max(4320),
+  fps: import_zod4.z.number().int().positive().max(60),
+  bitrate_kbps: import_zod4.z.number().int().positive().max(5e4),
+  /**
+   * How often a snapshot is captured. Bounded below at one second because a
+   * snapshot is the *cheap* mode — a developer who wants motion wants live,
+   * and an interval faster than this is a live stream wearing a disguise.
+   */
+  snapshot_interval_ms: import_zod4.z.number().int().min(1e3).max(36e5),
+  description: serviceDescription
+});
+var robotConfigDoc = import_zod4.z.object({
+  datapoints: import_zod4.z.array(datapointConfig).max(200),
+  /**
+   * The three kinds W4 adds default to empty so that **every configuration
+   * published before W4 still parses**. Stored documents are jsonb; a
+   * required field here would have invalidated live robots' published
+   * versions on the first read after deploy.
+   */
+  actions: import_zod4.z.array(actionConfig).max(200).default([]),
+  services: import_zod4.z.array(serviceConfig).max(200).default([]),
+  publishers: import_zod4.z.array(publisherConfig).max(200).default([]),
+  /** W5, defaulted for the same reason the W4 kinds were: stored jsonb. */
+  cameras: import_zod4.z.array(cameraConfig).max(50).default([])
+});
+var validationIssue = import_zod4.z.object({
+  path: import_zod4.z.string().min(1),
+  slug: import_zod4.z.string().nullable(),
+  code: import_zod4.z.string().min(1),
+  message: import_zod4.z.string().min(1),
+  severity: import_zod4.z.enum(["error", "warning"])
+});
+var configState = import_zod4.z.object({
+  published_version: import_zod4.z.number().int().positive().nullable(),
+  published_at: import_zod4.z.iso.datetime().nullable(),
+  draft_updated_at: import_zod4.z.iso.datetime().nullable(),
+  applied_version: import_zod4.z.number().int().nonnegative().nullable(),
+  applied_ok: import_zod4.z.boolean().nullable(),
+  applied_errors: import_zod4.z.array(import_zod4.z.object({ slug: import_zod4.z.string(), message: import_zod4.z.string() })).nullable()
+});
+
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_367ffc97d258be510904ed62d5d477a4/node_modules/@fleetless/contracts/dist/introspection.js
+var import_zod5 = require("zod");
+var rosGraphEntry = import_zod5.z.object({
+  name: rosName,
+  types: import_zod5.z.array(rosTypeName).min(1)
+});
+var rosGraph = import_zod5.z.object({
+  topics: import_zod5.z.array(rosGraphEntry),
+  services: import_zod5.z.array(rosGraphEntry),
+  actions: import_zod5.z.array(rosGraphEntry),
+  captured_at_ms: import_zod5.z.number().int().nonnegative()
+});
+var typeField = import_zod5.z.lazy(() => import_zod5.z.object({
+  name: import_zod5.z.string().min(1).max(128),
+  type: import_zod5.z.string().min(1).max(255),
+  array: import_zod5.z.boolean(),
+  fields: import_zod5.z.array(typeField).nullable()
+}));
+var typeDefinition = import_zod5.z.discriminatedUnion("kind", [
+  import_zod5.z.object({
+    name: rosTypeName,
+    kind: import_zod5.z.literal("msg"),
+    fields: import_zod5.z.array(typeField)
+  }),
+  import_zod5.z.object({
+    name: rosTypeName,
+    kind: import_zod5.z.literal("srv"),
+    request: import_zod5.z.array(typeField),
+    response: import_zod5.z.array(typeField)
+  }),
+  import_zod5.z.object({
+    name: rosTypeName,
+    kind: import_zod5.z.literal("action"),
+    goal: import_zod5.z.array(typeField),
+    result: import_zod5.z.array(typeField),
+    feedback: import_zod5.z.array(typeField)
+  })
+]);
+
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_367ffc97d258be510904ed62d5d477a4/node_modules/@fleetless/contracts/dist/jobs.js
+var import_zod6 = require("zod");
+var jobState = import_zod6.z.enum(["running", "succeeded", "failed", "cancelled", "lost"]);
+var job = import_zod6.z.object({
+  id: import_zod6.z.uuid(),
+  robot_id: import_zod6.z.uuid(),
+  slug,
+  state: jobState,
+  started_at: import_zod6.z.iso.datetime(),
+  updated_at: import_zod6.z.iso.datetime(),
+  /**
+   * A monotonic counter, ascending in mint order (W7), and the **named**
+   * tiebreaker for any listing that claims an order.
+   *
+   * `started_at` is not a total order: two jobs minted in the same millisecond
+   * sort against each other arbitrarily, and arbitrarily means *differently on
+   * each query* — so `GET /api/robots/:id/jobs`, which documents "newest
+   * first", can show one twice and the other not at all. Exactly the defect
+   * `auditEvent.seq` was added for in W6b, in a route the same wave shipped.
+   *
+   * **Scoped honestly: per cloud process, per run.** Job state lives in memory
+   * (§6.1 — that is why `lost` exists at all), so this counter restarts when
+   * the cloud does, alongside the jobs it orders. Sound, because it only ever
+   * orders jobs that coexist in one registry — and stated, because a reader
+   * who assumed `auditEvent.seq`'s durable semantics would be wrong.
+   */
+  seq: import_zod6.z.number().int().positive(),
+  /** Present once the job succeeded; shape is the ROS result's. */
+  result: import_zod6.z.unknown().nullable(),
+  /**
+   * Present on `failed`; a human message, plus a code where one exists.
+   *
+   * `details` exists because a refusal that carries only prose forces every
+   * consumer to parse it. W6b shipped `job_queue_full` with a documented
+   * `{limit, queued}` payload and **nowhere to put it**: the bridge reports a
+   * full queue as a job error, this shape had no `details`, and so the numbers
+   * were formatted into the message and lost. The console then rendered a
+   * "wait for one of N to finish" alert from a shape nothing in the system
+   * produced, and its test built that shape by hand — three repos agreeing
+   * with each other about a payload none of them exchanged (Momus, W6b
+   * review).
+   *
+   * Optional, because most job errors have nothing structured to add. Where a
+   * code has a documented payload — `job_queue_full` has
+   * `jobQueueFullDetails` — it belongs here, not in the sentence.
+   */
+  error: import_zod6.z.object({
+    code: import_zod6.z.string().min(1),
+    message: import_zod6.z.string().min(1),
+    details: import_zod6.z.unknown().optional()
+  }).nullable()
+});
+var jobEvent = import_zod6.z.object({
+  type: import_zod6.z.literal("job"),
+  robot_id: import_zod6.z.uuid(),
+  slug,
+  job,
+  /** Action feedback, if this update carries any. */
+  feedback: import_zod6.z.unknown().nullable(),
+  /** 0..1 when the action reports progress; null when it does not. */
+  progress: import_zod6.z.number().min(0).max(1).nullable(),
+  timestamp_ms: import_zod6.z.number().int().nonnegative()
+});
+var busyDetails = import_zod6.z.object({
+  running: job
+});
+var publisherBusyDetails = import_zod6.z.object({
+  /** The configured silence a holder must leave before anyone else may publish. */
+  quiet_timeout_ms: import_zod6.z.number().int().nonnegative(),
+  /** How much of that silence is still outstanding, now. */
+  retry_after_ms: import_zod6.z.number().int().nonnegative()
+});
+var jobQueueFullDetails = import_zod6.z.object({
+  /** The bridge's bound on queued jobs. */
+  limit: import_zod6.z.number().int().positive(),
+  /** How many are queued right now — `>= limit` when this refusal is sent. */
+  queued: import_zod6.z.number().int().nonnegative()
+});
+
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_367ffc97d258be510904ed62d5d477a4/node_modules/@fleetless/contracts/dist/protocol.js
+var MAX_PATIENCE_MS = 12e4;
+var MIN_PATIENCE_MS = 1e3;
+var activeJob = import_zod7.z.object({
+  job_id: import_zod7.z.uuid(),
+  slug,
+  state: jobState
+});
+var bridgeHello = import_zod7.z.object({
+  type: import_zod7.z.literal("hello"),
+  protocol_version: import_zod7.z.number().int().positive(),
+  token: import_zod7.z.string().min(1),
+  bridge_version: import_zod7.z.string().min(1),
+  /**
+   * Every job this bridge still knows about, right now (spec §6.1, W4).
+   *
+   * A reconnect and a restart look **identical** on the wire otherwise: same
+   * token, same version, same frame. But they must end differently — after a
+   * dropped connection the running jobs are still running, after a restart
+   * their results are gone forever. Asking the bridge to enumerate what it
+   * still has settles it without either side guessing: the cloud marks every
+   * job it believes is running on this robot and that is *not* named here as
+   * `lost`.
+   *
+   * This deliberately needs no persistence at the bridge. A live process
+   * lists its live jobs; a process that just started lists none, because it
+   * has none — which is exactly the truth the cloud needs. A breadcrumb file
+   * would only add a window in which the crash beat the write.
+   *
+   * Defaulted so pre-W4 bridges still parse; they had no jobs, so the empty
+   * list is also the correct answer for them.
+   *
+   * **Renamed from `active_job_ids` in W6b**, when the entries stopped being
+   * ids. A field called `_ids` holding objects is the shape this project has
+   * repeatedly been caught by — a name that describes what the field used to
+   * carry, kept because renaming looked like churn. Nothing is deployed yet
+   * (W8 is the first deployment), so the old name is gone rather than
+   * accepted alongside the new one: two accepted spellings would have to be
+   * supported and reconciled forever, and nobody is asking for that.
+   */
+  active_jobs: import_zod7.z.array(activeJob).max(500).default([])
+});
+var cloudHelloOk = import_zod7.z.object({
+  type: import_zod7.z.literal("hello_ok"),
+  robot_id: import_zod7.z.uuid()
+});
+var cloudHelloError = import_zod7.z.object({
+  type: import_zod7.z.literal("hello_error"),
+  code: import_zod7.z.string().min(1),
+  message: import_zod7.z.string().min(1)
+});
+var datapointFrame = import_zod7.z.object({
+  type: import_zod7.z.literal("datapoint"),
+  slug,
+  value: import_zod7.z.unknown(),
+  timestamp_ms: import_zod7.z.number().int().nonnegative()
+});
+var cloudPing = import_zod7.z.object({
+  type: import_zod7.z.literal("ping"),
+  ts_ms: import_zod7.z.number().int().nonnegative()
+});
+var bridgePong = import_zod7.z.object({
+  type: import_zod7.z.literal("pong"),
+  ts_ms: import_zod7.z.number().int().nonnegative()
+});
+var cloudConfig = import_zod7.z.object({
+  type: import_zod7.z.literal("config"),
+  version: import_zod7.z.number().int().nonnegative(),
+  doc: robotConfigDoc,
+  credentials: import_zod7.z.record(credentialRef, import_zod7.z.object({ username: import_zod7.z.string(), password: import_zod7.z.string() })).default({})
+});
+var bridgeConfigApplied = import_zod7.z.object({
+  type: import_zod7.z.literal("config_applied"),
+  version: import_zod7.z.number().int().nonnegative(),
+  ok: import_zod7.z.boolean(),
+  errors: import_zod7.z.array(import_zod7.z.object({ slug: import_zod7.z.string(), message: import_zod7.z.string().min(1) }))
+});
+var cloudInvoke = import_zod7.z.object({
+  type: import_zod7.z.literal("invoke"),
+  job_id: import_zod7.z.uuid(),
+  slug,
+  /**
+   * Already validated against §4.4 rules; the bridge validates structurally.
+   *
+   * **Flat, keyed by `parameterSpec.name`** — `{"target_pose.position.x": 1}`,
+   * not a nested message tree. Three things follow from that and none of them
+   * survive the nested form: the key a caller sends is the key a rule names,
+   * so a `parameter_invalid` can report a `field` the caller can actually
+   * find; the console binds one form input per spec; and a goal field that no
+   * `parameterSpec` declares simply cannot be set, which is what §4.4 means by
+   * the developer deciding what a client may pass. The bridge unflattens once,
+   * on the way into the ROS goal or request.
+   */
+  params: import_zod7.z.record(import_zod7.z.string(), import_zod7.z.unknown()),
+  /**
+   * How long this one call is worth waiting for (W6b), already resolved by
+   * the cloud — the caller's `invokeRequest.patience_ms`, or
+   * `DEFAULT_PATIENCE_MS` when they named none.
+   *
+   * **Required here, optional at REST**, deliberately. At the REST edge an
+   * absent value is a caller who did not care and gets the default. By the
+   * time the frame is on this socket somebody has decided, and the bridge
+   * must never be in the position of picking a number the cloud is already
+   * counting against — which is what two independent 15 s constants meant in
+   * practice: a bridge that gave up at 15.0 s and a cloud that gave up at
+   * 15.0 s, agreeing only by accident, with no way to tell whose deadline a
+   * caller had actually hit.
+   */
+  patience_ms: import_zod7.z.number().int().min(MIN_PATIENCE_MS).max(MAX_PATIENCE_MS)
+});
+var cloudCancel = import_zod7.z.object({
+  type: import_zod7.z.literal("cancel"),
+  slug,
+  job_id: import_zod7.z.uuid().nullable()
+});
+var cloudPublish = import_zod7.z.object({
+  type: import_zod7.z.literal("publish"),
+  slug,
+  /**
+   * Flat and keyed by `parameterSpec.name`, exactly like `cloudInvoke.params`
+   * — a publisher carries parameter specs and the same §4.4 validation, so it
+   * must carry the same shape. Note this is *not* the shape of
+   * `publisherConfig.failsafe`, which is a complete nested ROS message: the
+   * failsafe is authored once by the developer against the type, never sent
+   * by a caller and never rule-checked per field.
+   */
+  message: import_zod7.z.record(import_zod7.z.string(), import_zod7.z.unknown())
+});
+var bridgeJobUpdate = import_zod7.z.object({
+  type: import_zod7.z.literal("job_update"),
+  job_id: import_zod7.z.uuid(),
+  slug,
+  state: jobState,
+  feedback: import_zod7.z.unknown().nullable(),
+  progress: import_zod7.z.number().min(0).max(1).nullable(),
+  result: import_zod7.z.unknown().nullable(),
+  /** Same shape as `job.error`, `details` included — see `jobs.ts`. */
+  error: import_zod7.z.object({ code: import_zod7.z.string().min(1), message: import_zod7.z.string().min(1), details: import_zod7.z.unknown().optional() }).nullable(),
+  timestamp_ms: import_zod7.z.number().int().nonnegative()
+});
+var bridgeJobLost = import_zod7.z.object({
+  type: import_zod7.z.literal("job_lost"),
+  job_ids: import_zod7.z.array(import_zod7.z.uuid())
+});
+var cloudIntrospectRequest = import_zod7.z.object({
+  type: import_zod7.z.literal("introspect_request"),
+  request_id: import_zod7.z.string().min(1).max(64)
+});
+var bridgeIntrospect = import_zod7.z.object({
+  type: import_zod7.z.literal("introspect"),
+  request_id: import_zod7.z.string().min(1).max(64),
+  graph: rosGraph
+});
+var cloudTypeRequest = import_zod7.z.object({
+  type: import_zod7.z.literal("type_request"),
+  request_id: import_zod7.z.string().min(1).max(64),
+  type_names: import_zod7.z.array(rosTypeName).min(1).max(50)
+});
+var bridgeTypeDefinitions = import_zod7.z.object({
+  type: import_zod7.z.literal("type_definitions"),
+  request_id: import_zod7.z.string().min(1).max(64),
+  definitions: import_zod7.z.array(typeDefinition),
+  unresolved: import_zod7.z.array(import_zod7.z.string())
+});
+var bridgeState = import_zod7.z.object({
+  online: import_zod7.z.boolean(),
+  latency_ms: import_zod7.z.number().nonnegative().nullable()
+});
+var snapshotHeader = import_zod7.z.object({
+  type: import_zod7.z.literal("snapshot"),
+  slug,
+  /** `image/jpeg` in practice; stated so nothing has to sniff the bytes. */
+  mime: import_zod7.z.string().min(1).max(64),
+  width: import_zod7.z.number().int().positive(),
+  height: import_zod7.z.number().int().positive(),
+  timestamp_ms: import_zod7.z.number().int().nonnegative()
+});
+var cloudCameraStart = import_zod7.z.object({
+  type: import_zod7.z.literal("camera_start"),
+  slug,
+  url: import_zod7.z.string().min(1),
+  room: import_zod7.z.string().min(1),
+  token: import_zod7.z.string().min(1),
+  /**
+   * Names **this attempt** (W6b), and is echoed in the `camera_state` that
+   * answers it.
+   *
+   * W6a gave `camera_state` a `cause` and said in the same comment that a
+   * cause is not a correlation. This is the other half. Start a camera, have
+   * it fail slowly, start it again: the first attempt's failure arrives while
+   * the second is in flight, matches on slug, and resolves the attempt it
+   * knows nothing about. The viewer is then told the running stream failed,
+   * for a reason belonging to an attempt that is already over.
+   */
+  request_id: import_zod7.z.string().min(1).max(64)
+});
+var bridgeAssetsAvailable = import_zod7.z.object({
+  type: import_zod7.z.literal("assets_available"),
+  /** Whether `/robot_description` (or the configured source) yielded a URDF. */
+  urdf: import_zod7.z.boolean(),
+  /**
+   * Every `package://` URI the URDF references, verbatim and unresolved —
+   * including the ones this bridge cannot find in its workspace. Reporting
+   * only the resolvable ones would make an incomplete workspace look like a
+   * complete robot, and the cloud would have nothing to show as missing.
+   */
+  meshes: import_zod7.z.array(import_zod7.z.string().min(1))
+});
+var cloudAssetRequest = import_zod7.z.object({
+  type: import_zod7.z.literal("asset_request"),
+  sync_id: import_zod7.z.uuid(),
+  upload_url: import_zod7.z.url(),
+  token: import_zod7.z.string().min(1),
+  /** Which URIs to send. Empty means the URDF only. */
+  meshes: import_zod7.z.array(import_zod7.z.string().min(1))
+});
+var bridgeAssetProgress = import_zod7.z.object({
+  type: import_zod7.z.literal("asset_progress"),
+  sync_id: import_zod7.z.uuid(),
+  done: import_zod7.z.number().int().nonnegative(),
+  total: import_zod7.z.number().int().nonnegative(),
+  /**
+   * **Each entry says why** — see `assetFailure` in `assets.ts` for the three
+   * kinds and why one word was not enough. The bound is `assets.ts`'s too: a
+   * `.dae` with 17,331 unresolvable internal references produced a frame 32
+   * bytes over `MAX_WS_PAYLOAD_BYTES`, and `ws` enforces that **before**
+   * delivery — so the outcome was the robot's own socket closed, mid-sync, by
+   * a file in its workspace (Kassandra-W7a). A producer at its own ceiling
+   * reports **one** `refused` entry naming the file, not one per reference.
+   */
+  failed: import_zod7.z.array(assetFailure).max(1e3),
+  /**
+   * Three values, because a boolean `finished` had nowhere to put a refusal.
+   *
+   * A second `asset_request` arriving while one is in flight has to be
+   * answered with something. The bridge's guard is a backstop — the cloud owns
+   * sync lifecycle and refuses a concurrent one first — but a backstop that
+   * answers with silence is a backstop nobody can debug, and the alternative
+   * on the table was to report every requested URI in `failed`. That would
+   * have made `failed` mean two different things at once — *could not be
+   * resolved* and *was never attempted* — which is the one-field-two-facts
+   * defect this project has now split five times (`set`/`readable`,
+   * `truncated`/`truncated_by`, `value`/`sample_count`, `publishing`/`cause`,
+   * and camera health's own).
+   *
+   * So: `running` while work is happening, `finished` when the bridge will
+   * send no more for this sync, `refused_busy` when it never started because
+   * another sync was in flight. `failed` keeps its single meaning.
+   *
+   * Raised by Rosie-W7, who found the gap by asking what a second request
+   * should do rather than picking the silent option.
+   */
+  state: import_zod7.z.enum(["running", "finished", "refused_busy"])
+});
+var cloudCameraStop = import_zod7.z.object({
+  type: import_zod7.z.literal("camera_stop"),
+  slug,
+  /** Names this stop, echoed by the `camera_state` that answers it — see `cloudCameraStart.request_id`. */
+  request_id: import_zod7.z.string().min(1).max(64)
+});
+var bridgeCameraState = import_zod7.z.object({
+  type: import_zod7.z.literal("camera_state"),
+  slug,
+  publishing: import_zod7.z.boolean(),
+  error: import_zod7.z.object({ code: import_zod7.z.string().min(1), message: import_zod7.z.string().min(1) }).nullable(),
+  /**
+   * Why this frame was sent (W6a).
+   *
+   * Without it, `{publishing: false, error: null}` is sent for **three
+   * different things** — an answer to `camera_stop`, a stream stopped by a
+   * configuration change, and a source that recovered — and the cloud can
+   * only tell them apart by remembering what it saw before. Deriving a cause
+   * from remembered state is precisely the inference this project keeps
+   * finding to be wrong, and W6a exists because four failures had been
+   * sharing one silence.
+   *
+   * `'command'`       this frame answers a `camera_start` / `camera_stop`.
+   * `'source'`        unsolicited: the source's own health changed, whether or
+   *                   not anybody is watching. This is the frame that makes a
+   *                   wrong password visible without a viewer.
+   * `'config_change'` a configuration change stopped this stream. Not a
+   *                   failure, and it must not be logged as one.
+   * `'live_lost'`     publishing ended unexpectedly after it had started.
+   *
+   * Note it does **not** answer "which attempt is this?" — `camera_state`
+   * still has no request id, and that remains a named deferral in cluster C.
+   * `cause` says what kind of event this is; correlation is a separate fact
+   * and giving one field both jobs would be the same mistake again.
+   *
+   * Required, not optional: an absent cause would default to the reading
+   * somebody happens to assume, and every frame's sender knows its own
+   * reason. Old bridges fail validation on this frame — acceptable while
+   * nothing is deployed, and W8 is the first deployment.
+   */
+  cause: import_zod7.z.enum(["command", "source", "config_change", "live_lost"]),
+  /**
+   * When the **robot** observed this state — bridge capture time, never
+   * receive time, the same discipline `timestamp_ms` follows for samples
+   * (spec §6.3).
+   *
+   * It exists because the cloud stamped `resourceHealthState.changed_at_ms`
+   * with its own `Date.now()`, and a **restatement** is by definition an old
+   * state re-sent into an empty map. So after a cloud restart every failure —
+   * including one from yesterday — was dated to the restart, in the one
+   * scenario `changed_at_ms`'s own doc comment was written for: *"a page that
+   * loads late must be able to tell a failure from a minute ago from one from
+   * yesterday"*.
+   *
+   * On a restatement this carries **when the state was first observed**, not
+   * when the frame was sent. A bridge that re-states a failure it has held for
+   * an hour says so.
+   */
+  observed_at_ms: import_zod7.z.number().int().nonnegative(),
+  /**
+   * Which request this frame answers (W6b), or `null` when it answers none.
+   *
+   * `null` is not a gap and must not be treated as one: a `cause: 'source'`
+   * frame — the unsolicited health report that makes a wrong password visible
+   * with nobody watching — answers no request by definition, and so does a
+   * `config_change` stop. Those are the majority of frames on a healthy
+   * system.
+   *
+   * A frame with `cause: 'command'` carries the `request_id` of the
+   * `camera_start` or `camera_stop` it answers. **The cloud resolves a
+   * pending attempt only on a matching id**, and drops a `command` frame
+   * whose id it no longer recognises rather than applying it to whatever is
+   * pending — a late answer to a cancelled attempt is stale, not current.
+   *
+   * **The pairing rule is not in this schema, deliberately.** "Non-null iff
+   * `cause === 'command'`" is a cross-field constraint; a zod `.refine()`
+   * would express it at runtime and then **disappear** from the generated
+   * JSON Schema, which is what the bridge vendors. The cloud would reject
+   * frames the bridge had validated as correct — the same artifact/runtime
+   * divergence that `.default()` publishing as `required` has produced four
+   * times in this project, only pointing the other way. The rule is enforced
+   * where the correlation is used, in the cloud's bridge frame handler, and
+   * stated here so nobody has to derive it from that code.
+   */
+  request_id: import_zod7.z.string().min(1).max(64).nullable()
+});
+
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_367ffc97d258be510904ed62d5d477a4/node_modules/@fleetless/contracts/dist/rest.js
+var import_zod8 = require("zod");
+var robot = import_zod8.z.object({
+  id: import_zod8.z.uuid(),
+  name: import_zod8.z.string().min(1).max(63),
+  created_at: import_zod8.z.iso.datetime()
+});
+var createRobotRequest = import_zod8.z.object({
+  name: import_zod8.z.string().min(1).max(63)
+});
+var robotToken = import_zod8.z.string().regex(/^frt_[0-9a-f]{32}$/);
+var createRobotResponse = import_zod8.z.object({
+  robot,
+  token: robotToken
+});
+var robotListItem = import_zod8.z.object({
+  ...robot.shape,
+  bridge_state: bridgeState
+});
+var robotListResponse = import_zod8.z.object({
+  robots: import_zod8.z.array(robotListItem)
+});
+var datapointValue = import_zod8.z.object({
+  slug,
+  value: import_zod8.z.unknown(),
+  timestamp_ms: import_zod8.z.number().int().nonnegative()
+});
+var robotDetailResponse = import_zod8.z.object({
+  ...robotListItem.shape,
+  bridge_version: import_zod8.z.string().min(1).nullable(),
+  last_hello_error: import_zod8.z.object({
+    code: import_zod8.z.string().min(1),
+    message: import_zod8.z.string().min(1),
+    at: import_zod8.z.iso.datetime()
+  }).nullable(),
+  config: configState
+});
+var configDraftResponse = import_zod8.z.object({
+  doc: robotConfigDoc,
+  updated_at: import_zod8.z.iso.datetime().nullable(),
+  issues: import_zod8.z.array(validationIssue)
+});
+var putConfigDraftRequest = import_zod8.z.object({ doc: robotConfigDoc });
+var publishConfigResponse = import_zod8.z.object({
+  version: import_zod8.z.number().int().positive(),
+  published_at: import_zod8.z.iso.datetime()
+});
+var configVersionsResponse = import_zod8.z.object({
+  versions: import_zod8.z.array(import_zod8.z.object({
+    version: import_zod8.z.number().int().positive(),
+    published_at: import_zod8.z.iso.datetime()
+  }))
+});
+var configVersionResponse = import_zod8.z.object({
+  version: import_zod8.z.number().int().positive(),
+  published_at: import_zod8.z.iso.datetime(),
+  doc: robotConfigDoc
+});
+var introspectionResponse = import_zod8.z.object({
+  graph: rosGraph,
+  fetched_at: import_zod8.z.iso.datetime(),
+  stale: import_zod8.z.boolean()
+});
+var typesResponse = import_zod8.z.object({
+  types: import_zod8.z.array(typeDefinition)
+});
+var fetchTypesRequest = import_zod8.z.object({
+  type_names: import_zod8.z.array(rosTypeName).min(1).max(50)
+});
+var fetchTypesResponse = import_zod8.z.object({
+  types: import_zod8.z.array(typeDefinition),
+  unresolved: import_zod8.z.array(import_zod8.z.string())
+});
+var datapointDescriptor = import_zod8.z.object({
+  slug,
+  builtin: import_zod8.z.boolean(),
+  unit: import_zod8.z.string().nullable(),
+  range: datapointRange.nullable(),
+  rate: datapointRate.nullable()
+});
+var datapointListResponse = import_zod8.z.object({
+  datapoints: import_zod8.z.array(datapointDescriptor)
+});
+var robotDetailsDoc = import_zod8.z.record(import_zod8.z.string().regex(/^[a-z][a-z0-9_-]{0,63}$/), import_zod8.z.union([import_zod8.z.string().max(4096), import_zod8.z.number(), import_zod8.z.boolean(), import_zod8.z.array(import_zod8.z.unknown()), import_zod8.z.record(import_zod8.z.string(), import_zod8.z.unknown())]));
+var putRobotDetailsRequest = import_zod8.z.object({ details: robotDetailsDoc });
+var invokeRequest = import_zod8.z.object({
+  params: import_zod8.z.record(import_zod8.z.string(), import_zod8.z.unknown()),
+  /**
+   * How long **this call** is worth waiting for, in milliseconds (W6b).
+   *
+   * **Absent means `DEFAULT_PATIENCE_MS`** — today's behaviour, unchanged, for
+   * every caller who does not care. It is optional because most callers have
+   * no opinion, and forcing one on them would mean every SDK example carries a
+   * number its author guessed.
+   *
+   * It exists because patience was a **server constant** and could therefore
+   * only ever be wrong in one of two directions at a time: long enough for a
+   * planner meant a dead service also took that long to report, and short
+   * enough for a snappy lookup meant a legitimate slow job was reported as
+   * `bridge_timeout` — a healthy robot, described as broken, with nothing the
+   * caller could do about it.
+   *
+   * The number travels with the call to the bridge (`cloudInvoke.patience_ms`)
+   * so that **one** deadline governs both sides. Capped at
+   * `MAX_PATIENCE_MS`; above that the call is refused with
+   * `validation_error` rather than silently clamped, because a caller who
+   * asked for ten minutes and was quietly given two would read the timeout as
+   * the robot's failure.
+   *
+   * For a service call this is the whole wait. For an action it bounds goal
+   * *acceptance* — once a goal is accepted the job runs as long as it runs,
+   * and is observed, not awaited.
+   */
+  patience_ms: import_zod8.z.number().int().min(MIN_PATIENCE_MS).max(MAX_PATIENCE_MS).optional()
+});
+var cancelRequest = import_zod8.z.object({
+  job_id: import_zod8.z.uuid().nullable().optional()
+}).strict();
+var releaseLiveQuery = import_zod8.z.object({
+  session_id: import_zod8.z.uuid().optional()
+}).strict();
+var invokeResponse = import_zod8.z.object({
+  job,
+  /** The slug's kind — see `commandResult.kind` for why the caller needs it. */
+  kind: import_zod8.z.enum(["action", "service"])
+});
+var serviceCallResponse = import_zod8.z.object({
+  result: import_zod8.z.unknown()
+});
+var publishRequest = import_zod8.z.object({
+  message: import_zod8.z.record(import_zod8.z.string(), import_zod8.z.unknown())
+});
+var jobResponse = import_zod8.z.object({ job: job.nullable() });
+var rateLimitDetails = import_zod8.z.object({
+  retry_after_ms: import_zod8.z.number().int().nonnegative()
+});
+var robotJobsResponse = import_zod8.z.object({
+  jobs: import_zod8.z.array(job)
+});
+var exposure = import_zod8.z.object({
+  slug,
+  kind: import_zod8.z.enum(["datapoint", "action", "service", "publisher", "camera"]),
+  builtin: import_zod8.z.boolean()
+});
+var exposureListResponse = import_zod8.z.object({
+  exposures: import_zod8.z.array(exposure)
+});
+var SNAPSHOT_HEADERS = {
+  ageMs: "x-fleetless-age-ms",
+  timestampMs: "x-fleetless-timestamp-ms",
+  width: "x-fleetless-width",
+  height: "x-fleetless-height"
+};
+var cameraDescriptor = import_zod8.z.object({
+  slug,
+  width: import_zod8.z.number().int().positive(),
+  height: import_zod8.z.number().int().positive(),
+  fps: import_zod8.z.number().int().positive(),
+  snapshot_interval_ms: import_zod8.z.number().int().positive()
+});
+var cameraListResponse = import_zod8.z.object({ cameras: import_zod8.z.array(cameraDescriptor) });
+var liveSessionResponse = import_zod8.z.object({
+  /**
+   * This viewer's hold, and the **only** thing `DELETE` should be given
+   * (W6b).
+   *
+   * A hold was addressed by `{identity, robot, slug}` and nothing else, so
+   * two tabs of one logged-in user were one hold as far as the refcount could
+   * see. Closing either tab released it: the second tab kept its LiveKit
+   * connection — the token is checked at join and never again — and went on
+   * rendering a video that the robot had already stopped producing. The
+   * viewer sees a frozen picture, not an ended session, which is the failure
+   * this project rejects everywhere else.
+   *
+   * `DELETE` without a session id keeps today's meaning — *release my holds
+   * on this camera* — because an SDK that has lost its id, or a client that
+   * is going away entirely, still needs a way to let go. It is the blunt
+   * form, and it is the one that strands other tabs; new callers pass the id.
+   */
+  session_id: import_zod8.z.uuid(),
+  url: import_zod8.z.string().min(1),
+  room: import_zod8.z.string().min(1),
+  token: import_zod8.z.string().min(1),
+  expires_at: import_zod8.z.iso.datetime()
+});
+var snapshotMetaResponse = import_zod8.z.object({
+  slug,
+  timestamp_ms: import_zod8.z.number().int().nonnegative().nullable(),
+  age_ms: import_zod8.z.number().int().nonnegative().nullable(),
+  width: import_zod8.z.number().int().positive().nullable(),
+  height: import_zod8.z.number().int().positive().nullable(),
+  mime: import_zod8.z.string().nullable()
+});
+var historyQuery = import_zod8.z.object({
+  from: import_zod8.z.string().min(1).max(32),
+  /** Defaults to now. */
+  to: import_zod8.z.string().min(1).max(32).optional(),
+  /** Bucket width, e.g. `10s`, `1m`. Absent means raw samples. */
+  window: import_zod8.z.string().min(2).max(16).optional(),
+  agg: import_zod8.z.enum(["min", "max", "avg"]).optional(),
+  /** A numeric field inside an object value, e.g. `pose.x` (§4.4 paths). */
+  field: import_zod8.z.string().min(1).max(128).optional(),
+  /**
+   * `z.coerce` because this schema describes a **query string**, where every
+   * value arrives as text. A bare `z.number()` would make each route coerce
+   * `limit` by hand before parsing — Nimbus had to, and flagged that the next
+   * query-taking route would have to as well. A schema that does not match
+   * the wire it describes exports its problem to every consumer.
+   */
+  limit: import_zod8.z.coerce.number().int().positive().max(1e4).optional()
+});
+var historySamplesResponse = import_zod8.z.object({
+  slug,
+  kind: import_zod8.z.literal("samples"),
+  samples: import_zod8.z.array(import_zod8.z.object({ timestamp_ms: import_zod8.z.number().int().nonnegative(), value: import_zod8.z.unknown() })),
+  truncated: import_zod8.z.boolean(),
+  /**
+   * Why it was cut, `null` when it was not — because the two causes have
+   * **different remedies** and a single boolean cannot tell them apart:
+   *
+   *   `'limit'`  too many rows. Raise `limit` (up to 10 000).
+   *   `'bytes'`  the rows are large. Raising `limit` will not help — narrow
+   *              the range, or name a numeric `field` so whole messages are
+   *              not carried.
+   *
+   * A caller cannot derive this: comparing `samples.length` against `limit`
+   * only works if they sent one, and the server's default is not in the
+   * response. So without this field, "raise the limit" is the natural next
+   * move in both cases, and in the second it changes nothing.
+   *
+   * Nullable rather than optional on purpose: `.default()` publishes as
+   * `required` in the JSON Schema artifacts, which is the contradiction this
+   * project has now hit five times.
+   */
+  truncated_by: import_zod8.z.enum(["limit", "bytes"]).nullable()
+});
+var historyBucketsResponse = import_zod8.z.object({
+  slug,
+  kind: import_zod8.z.literal("buckets"),
+  window_ms: import_zod8.z.number().int().positive(),
+  agg: import_zod8.z.enum(["min", "max", "avg"]),
+  buckets: import_zod8.z.array(import_zod8.z.object({
+    bucket_start_ms: import_zod8.z.number().int().nonnegative(),
+    /**
+     * The aggregate over this bucket's **numeric** samples — or `null` when
+     * none of them were numeric, which is **not** the same as the bucket
+     * being empty. `sample_count` is the field that separates those facts:
+     *
+     *     value: null,  sample_count: 0    nothing was recorded — a gap
+     *     value: null,  sample_count: 3    three samples, none of them numeric
+     *     value: 0,     sample_count: 3    three samples, and the average is zero
+     *
+     * A chart must draw the first as a break in the line and must **not**
+     * draw the second as one: data exists there, it simply has no height.
+     *
+     * This sentence previously read "`null` only ever means 'no samples in
+     * this bucket'", and the implementation counted numeric contributors,
+     * so the second row above was indistinguishable from the first and the
+     * console rendered "empty — no samples" over live data.
+     */
+    value: import_zod8.z.number().nullable(),
+    /**
+     * Every sample that landed in this bucket and inside the queried range,
+     * whether or not it contributed to `value` — which is the point of the
+     * field, since only a count of *all* samples can prove a bucket empty
+     * rather than merely unplottable.
+     *
+     * Two consequences, stated rather than left to be discovered:
+     *
+     * - `value` is not an average *of* `sample_count` samples when a
+     *   datapoint's values are mixed, so **`value * sample_count` is not a
+     *   sum**.
+     * - On a first or last bucket the count reflects the **range**, not the
+     *   bucket: an edge bucket can begin before `from` or extend past `to`,
+     *   and only in-range samples are counted. A low edge count is a
+     *   boundary effect, not a quiet period.
+     */
+    sample_count: import_zod8.z.number().int().nonnegative()
+  }))
+});
+var robotDeletionSummary = import_zod8.z.object({
+  /**
+   * Datapoints, actions, services and publishers in the **published**
+   * configuration — what the robot was actually running. **Cameras are not
+   * counted here**; they are the `cameras` array below.
+   *
+   * The split has to be stated because the summary carries both, and the
+   * console renders them in one sentence: *"this deletes N published slugs …
+   * and M cameras"*. With cameras inside `slug_count` that sentence counts
+   * them twice, on the one screen whose whole justification is naming what an
+   * irreversible click destroys (Momus, W6a review — the cloud summed all
+   * five and the console then added the cameras again).
+   *
+   * A draft is destroyed too and is described by `had_unpublished_draft`
+   * rather than by either of these: describing three things with two numbers
+   * would make each of them mean something else.
+   */
+  slug_count: import_zod8.z.number().int().nonnegative(),
+  sample_rows: import_zod8.z.number().int().nonnegative(),
+  bytes_freed: import_zod8.z.number().int().nonnegative(),
+  cameras: import_zod8.z.array(slug),
+  /**
+   * Assets destroyed with the robot (W7), and **`asset_bytes_freed` is what
+   * this org actually gets back** — not the sum of the assets' sizes.
+   *
+   * Storage is content-addressed, so a mesh two robots share survives the
+   * deletion of one of them and frees nothing. Reporting the total would tell
+   * a developer they are about to recover 400 MB and hand back 4, on the one
+   * screen whose entire justification is naming what an irreversible click
+   * destroys. Same reasoning that keeps `cameras` out of `slug_count`: this
+   * summary is read aloud to a human, and a number that is nearly right is
+   * worse here than an absent one.
+   *
+   * `asset_count` is the plain count of the robot's asset rows, all of which
+   * do go away.
+   */
+  asset_count: import_zod8.z.number().int().nonnegative(),
+  asset_bytes_freed: import_zod8.z.number().int().nonnegative(),
+  had_live_session: import_zod8.z.boolean(),
+  /**
+   * Whether an unpublished draft went with it — separately, because the
+   * counts above deliberately do not include it and a record that silently
+   * omitted the draft would be a receipt for less than was destroyed.
+   *
+   * `true` also covers the robot that was configured but never published:
+   * there the counts are zero and this is the only field saying anything
+   * was there at all.
+   */
+  had_unpublished_draft: import_zod8.z.boolean()
+});
+var RESOURCE_HEALTH_STATES = [
+  "ok",
+  /** The host did not answer. Not the same as refusing the password. */
+  "unreachable",
+  /** The host answered and rejected the credentials. */
+  "auth_failed",
+  /** The stored password cannot be decrypted — see `credentialSummary.readable`. */
+  "unreadable_credential",
+  /**
+   * A camera names a credential that **does not exist** in this org — deleted,
+   * mistyped, or belonging to somebody else (W6a review).
+   *
+   * Separate from `unreadable_credential` because that one asserts a
+   * decryption that was attempted and failed, and here nothing was ever
+   * encrypted: the developer is sent to a page where the credential is not
+   * listed at all, to rotate something that is not there. And separate from
+   * `unknown`, which means "the robot reported a failure we cannot classify"
+   * — a different fact with a different fix.
+   *
+   * It is reachable by a typo: `cloud-config-frame.ts` deliberately tolerates
+   * an unresolved `credentials_ref` at publish time, so this is an ordinary
+   * developer mistake rather than an edge case.
+   */
+  "credential_missing",
+  /** A configuration change stopped this stream, deliberately. */
+  "stopped_by_config_change",
+  /** Publishing failed after the session was already granted. */
+  "publish_failed",
+  /**
+   * Something is wrong and this platform cannot say what.
+   *
+   * The alternative was worse. A bridge error code the mapping table does not
+   * know had two possible fallbacks: report `ok`, which hides a real failure,
+   * or fold it into `unreachable`, which **asserts a cause nobody
+   * established** — sending a developer to check a network when the problem
+   * may be a password. The map falls back here and logs the unmapped code
+   * loudly, so the gap in the table is visible instead of confident.
+   */
+  "unknown"
+];
+var resourceHealthState = import_zod8.z.object({
+  robot_id: import_zod8.z.uuid(),
+  kind: import_zod8.z.enum(["camera", "credential"]),
+  /** The camera slug, or the credential name. */
+  ref: import_zod8.z.string().min(1).max(64),
+  state: import_zod8.z.enum(RESOURCE_HEALTH_STATES),
+  /** A short human-readable reason, or `null`. Never an exception message. */
+  reason: import_zod8.z.string().max(200).nullable(),
+  /**
+   * When this state was entered — not when it was sent. A page that loads
+   * late must be able to tell a failure from a minute ago from one from
+   * yesterday, and a state with only a send time cannot.
+   */
+  changed_at_ms: import_zod8.z.number().int().nonnegative()
+});
+var resourceHealthListResponse = import_zod8.z.object({
+  resources: import_zod8.z.array(resourceHealthState)
+});
+var orgQuotas = import_zod8.z.object({
+  max_robots: import_zod8.z.number().int().positive(),
+  max_apps: import_zod8.z.number().int().positive(),
+  max_end_users: import_zod8.z.number().int().positive(),
+  max_retention_bytes: import_zod8.z.number().int().nonnegative(),
+  max_retention_writes_per_minute: import_zod8.z.number().int().nonnegative(),
+  max_realtime_connections: import_zod8.z.number().int().positive(),
+  /**
+   * Asset storage (§4.6, W7) — **its own dial, not part of
+   * `max_retention_bytes`.** A sync grows storage in jumps and time series
+   * grow steadily; one dial would let the first crowd out the second, and the
+   * org that hit its limit would be told to look at the wrong thing.
+   *
+   * **Counted per distinct blob *this org references* — not per asset row, and
+   * not per object the platform stores on its behalf (W7a, D1).** The two
+   * readings are indistinguishable from the number alone and a customer is
+   * entitled to know which one they are being charged for.
+   *
+   * Within an org, sharing is free: two robots referencing the same mesh cost
+   * one copy, which is what dedup means to a customer, and anything else
+   * charges an org twice for a fleet of identical robots — the normal case.
+   *
+   * **Across orgs, sharing is not free, and W7 shipped the opposite.** Storage
+   * stays globally content-addressed (one object per sha256; that efficiency
+   * is real), but accounting is per-org: an org is charged for each distinct
+   * blob it references and credited when its own last reference goes, whether
+   * or not the blob survives for somebody else. Global refcounting made the
+   * first org to sync a blob pay for it forever while every later org stored
+   * it free — so the quota was evadable by anyone whose mesh someone else had
+   * already uploaded, and an org's own number depended on who got there first,
+   * which nobody can predict. Measured before the change: 342 bytes held by an
+   * org owning no assets, with no operation able to free them.
+   */
+  max_asset_storage_bytes: import_zod8.z.number().int().nonnegative()
+});
+var orgQuotaUsageCounts = import_zod8.z.object({
+  max_robots: import_zod8.z.number().int().nonnegative(),
+  max_apps: import_zod8.z.number().int().nonnegative(),
+  max_end_users: import_zod8.z.number().int().nonnegative(),
+  max_retention_bytes: import_zod8.z.number().int().nonnegative(),
+  max_asset_storage_bytes: import_zod8.z.number().int().nonnegative(),
+  max_retention_writes_per_minute: import_zod8.z.number().int().nonnegative(),
+  max_realtime_connections: import_zod8.z.number().int().nonnegative()
+}).partial();
+var orgQuotaUsage = import_zod8.z.object({ quotas: orgQuotas, usage: orgQuotaUsageCounts });
+var credentialSummary = import_zod8.z.object({
+  name: import_zod8.z.string().min(1).max(64),
+  username: import_zod8.z.string().nullable(),
+  /**
+   * Whether a password has ever been stored for this name.
+   *
+   * **Always `true` today**, and stated so rather than left to be inferred:
+   * `credentialWriteRequest` requires a non-empty password, so no row can
+   * exist without one, and both write paths set this literally. A consumer
+   * branching on `set === false` is writing dead code — the SDK README
+   * currently teaches exactly that (Momus, W6a review).
+   *
+   * The field is kept because the fact it names is the one `readable`
+   * qualifies, and because a username-only credential is a plausible future
+   * shape. If that never arrives, this should be removed rather than left as
+   * a permanent constant wearing the costume of a question.
+   */
+  set: import_zod8.z.boolean(),
+  /**
+   * Whether that password can still be **decrypted** — a different fact from
+   * `set`, and deliberately a second field rather than a tri-state on the
+   * first (W6a).
+   *
+   * They come apart when `CAMERA_CREDENTIALS_KEY` is rotated, unset or wrong,
+   * or when a row is corrupt. W6 made that survivable: one unreadable
+   * credential costs the cameras that reference it instead of taking the
+   * robot offline. But the surviving failure was **invisible** — this route
+   * answered `set: true` with `used_by` naming the dependent camera, for a
+   * credential that ships as `credentials: {}` on every config frame, and the
+   * only evidence was a server log no developer can read.
+   *
+   * `set: true, readable: false` is therefore the shape that says "a password
+   * is stored and this platform can no longer use it" — which is a thing to
+   * act on, and nothing else in the API could say it.
+   */
+  readable: import_zod8.z.boolean(),
+  used_by: import_zod8.z.array(import_zod8.z.object({ robot_id: import_zod8.z.uuid(), slug }))
+});
+var credentialListResponse = import_zod8.z.object({ credentials: import_zod8.z.array(credentialSummary) });
+var credentialWriteRequest = import_zod8.z.object({
+  username: import_zod8.z.string().min(1).max(128),
+  password: import_zod8.z.string().min(1).max(512)
+});
+
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_367ffc97d258be510904ed62d5d477a4/node_modules/@fleetless/contracts/dist/realtime.js
+var import_zod11 = require("zod");
+
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_367ffc97d258be510904ed62d5d477a4/node_modules/@fleetless/contracts/dist/client-auth.js
+var import_zod10 = require("zod");
+
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_367ffc97d258be510904ed62d5d477a4/node_modules/@fleetless/contracts/dist/apps.js
+var import_zod9 = require("zod");
+var appIdentifier = slug;
+var app = import_zod9.z.object({
+  id: import_zod9.z.uuid(),
+  org_id: import_zod9.z.uuid(),
+  name: import_zod9.z.string().min(1).max(120),
+  identifier: appIdentifier,
+  /** Robots are referenced individually; tags never grant rights (§12.2). */
+  robot_ids: import_zod9.z.array(import_zod9.z.uuid()),
+  /**
+   * Whether this app accepts **self-registering** OAuth clients (RFC 7591).
+   *
+   * Off by default and per app, because a normal app has no reason to accept
+   * them: its own client is registered by the developer with known redirect
+   * URIs. An MCP app does, because the end user *"trägt nur die URL ein"*
+   * (§17) and the client registers itself — nobody vetted it, and
+   * `POST /oauth/register` is therefore an **unauthenticated write endpoint**
+   * standing in front of tools that move a physical robot.
+   *
+   * The flag is app state rather than a deployment setting so that turning it
+   * on is a decision somebody made about one app, visible in the console and
+   * in the audit log. It is also the precursor of W7c's MCP-App kind — the
+   * model grows here rather than being retrofitted around it.
+   */
+  accepts_dynamic_clients: import_zod9.z.boolean(),
+  /**
+   * Whether this app serves a remote MCP server at `/mcp/<identifier>` (§17).
+   *
+   * **A switch, not an app kind.** §2 and §17 called the MCP app *"eine eigene
+   * App-Art"*; André decided on 2026-08-18 that it is a per-app switch the
+   * developer flips in the console, and §17 was reworded in the same wave
+   * rather than left contradicting this field. The model grows here — which
+   * is what the comment on `accepts_dynamic_clients` above predicted it would
+   * do, one wave before there was anything to add.
+   *
+   * The two switches are related and not the same. `accepts_dynamic_clients`
+   * decides whether a client may **register itself**; this one decides whether
+   * there is anything for it to reach. An MCP app will usually want both,
+   * because §17's end user *"trägt nur die URL ein"* and the AI tool registers
+   * itself — but a developer who registers their own MCP client by hand wants
+   * exactly this one, and coupling them would take that away.
+   *
+   * **Off means off at the metadata too.** With this false, `/mcp/<app>`
+   * answers `404` and so do its discovery documents. A resource that is
+   * advertised and not served sends a conforming client through the whole
+   * discovery chain to a door that is not there — and W7b spent a wave making
+   * that chain walkable.
+   */
+  mcp_enabled: import_zod9.z.boolean(),
+  created_at: import_zod9.z.iso.datetime()
+});
+var createAppRequest = import_zod9.z.object({
+  name: import_zod9.z.string().min(1).max(120),
+  identifier: appIdentifier,
+  robot_ids: import_zod9.z.array(import_zod9.z.uuid()).optional(),
+  /** Optional, defaulting to `false` — same reasoning as `robot_ids` above: setting it at creation is the obvious operation, and refusing it here would make a `.strict()` request reject the field the caller can plainly see on `app`. */
+  accepts_dynamic_clients: import_zod9.z.boolean().optional(),
+  /**
+   * **W7c's playbook said this field would not be accepted here, and the
+   * sentence above is why that was wrong.** The argument for refusing it was
+   * W7's `robot_ids` finding — a create shape that silently drops a field cost
+   * two people a day each. But that finding was closed by *accepting* the
+   * field, not by refusing it, and this request is `.strict()`: refusing
+   * `mcp_enabled` would make it `400` on a field the caller can plainly see on
+   * `app`, which is the exact shape the line above rejects. One rule, both
+   * switches.
+   */
+  mcp_enabled: import_zod9.z.boolean().optional()
+}).strict();
+var updateAppRequest = import_zod9.z.object({
+  name: import_zod9.z.string().min(1).max(120).optional(),
+  robot_ids: import_zod9.z.array(import_zod9.z.uuid()).optional(),
+  accepts_dynamic_clients: import_zod9.z.boolean().optional(),
+  mcp_enabled: import_zod9.z.boolean().optional()
+});
+var serverKeyToken = import_zod9.z.string().regex(/^flk_[0-9a-f]{32}$/);
+var serverKey = import_zod9.z.object({
+  id: import_zod9.z.uuid(),
+  app_id: import_zod9.z.uuid(),
+  name: import_zod9.z.string().min(1).max(120),
+  created_at: import_zod9.z.iso.datetime(),
+  /** Null until first use — the cheapest way to spot a key nobody needs. */
+  last_used_at: import_zod9.z.iso.datetime().nullable()
+});
+var createServerKeyResponse = import_zod9.z.object({
+  server_key: serverKey,
+  key: serverKeyToken
+});
+var role = import_zod9.z.object({
+  id: import_zod9.z.uuid(),
+  app_id: import_zod9.z.uuid(),
+  name: import_zod9.z.string().min(1).max(60),
+  builtin: import_zod9.z.boolean()
+});
+var rolePermissions = import_zod9.z.object({
+  role_id: import_zod9.z.uuid(),
+  /**
+   * **A slug is unique per robot across ALL service kinds** (spec §4.1:
+   * "Jeder Dienst erhält einen Slug" — one namespace, not one per kind), and
+   * the cloud's config validation enforces that with a kind-agnostic
+   * collection pass. That is why this list carries slugs and not
+   * (kind, slug) pairs: when W4 adds actions, services and publishers, a
+   * grant keeps meaning exactly what it means today, and this shape does not
+   * change. What W4 does need is an endpoint that lists every *grantable*
+   * slug of a robot with its kind, so the console's matrix can offer them —
+   * today it enumerates datapoints only, which is the seam that would
+   * otherwise force a rebuild.
+   */
+  grants: import_zod9.z.array(import_zod9.z.object({
+    robot_id: import_zod9.z.uuid(),
+    slugs: import_zod9.z.array(slug)
+  })),
+  /**
+   * App-wide abilities a role grants, as opposed to per-slug grants above.
+   *
+   * **A capability here is a promise, and two of them have not been kept.**
+   * `action_history` and `presence` have been gated by this object since W4
+   * and are implemented nowhere — no route, no SDK method, no realtime frame
+   * (register row 8). A console can therefore switch them on and nothing
+   * changes, which is worse than their absence: the developer believes they
+   * granted something.
+   *
+   * `assets` (W7) must not become the third. It gates §4.6's asset store,
+   * which is not covered by `grants` because **assets are not slugs** — and it
+   * is its own decision rather than a side effect of reaching the robot,
+   * because a mesh set gives away the machine's build.
+   */
+  capabilities: import_zod9.z.object({
+    action_history: import_zod9.z.boolean(),
+    presence: import_zod9.z.boolean(),
+    assets: import_zod9.z.boolean()
+  })
+});
+var appMembership = import_zod9.z.object({
+  end_user_id: import_zod9.z.uuid(),
+  app_id: import_zod9.z.uuid(),
+  role_id: import_zod9.z.uuid()
+});
+var brandingConfig = import_zod9.z.object({
+  /** `#rrggbb`, lowercase — one canonical spelling so two configs that look identical are identical. */
+  primary_color: import_zod9.z.string().regex(/^#[0-9a-f]{6}$/, "primary_color must be lowercase #rrggbb"),
+  /**
+   * 256 KiB of raw image at most. Base64 costs 4 bytes per 3, so the encoded
+   * ceiling is stated here in encoded characters — the unit the validator can
+   * actually count, rather than one it would have to infer.
+   */
+  logo_data_uri: import_zod9.z.string().max(349528).regex(/^data:image\/(png|jpeg);base64,[A-Za-z0-9+/]+={0,2}$/, "logo must be a base64 data URI of image/png or image/jpeg").optional(),
+  footer_text: import_zod9.z.string().min(1).max(200).optional()
+});
+
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_367ffc97d258be510904ed62d5d477a4/node_modules/@fleetless/contracts/dist/client-auth.js
+var clientLoginRequest = import_zod10.z.object({
+  app_identifier: appIdentifier,
+  email: import_zod10.z.email(),
+  password: import_zod10.z.string().min(1)
+});
+var clientRefreshRequest = import_zod10.z.object({
+  refresh_token: import_zod10.z.string().min(1)
+});
+var clientLogoutRequest = import_zod10.z.object({
+  refresh_token: import_zod10.z.string().min(1)
+});
+var clientIdentity = import_zod10.z.object({
+  kind: import_zod10.z.enum(["developer", "end_user", "server_key"]),
+  developer_id: import_zod10.z.uuid().nullable(),
+  end_user_id: import_zod10.z.uuid().nullable(),
+  server_key_id: import_zod10.z.uuid().nullable(),
+  app_id: import_zod10.z.uuid().nullable(),
+  role_id: import_zod10.z.uuid().nullable(),
+  email: import_zod10.z.email().nullable()
+});
+
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_367ffc97d258be510904ed62d5d477a4/node_modules/@fleetless/contracts/dist/realtime.js
+var clientAuth = import_zod11.z.object({
+  type: import_zod11.z.literal("auth"),
+  token: import_zod11.z.string().min(1)
+});
+var authOk = import_zod11.z.object({
+  type: import_zod11.z.literal("auth_ok"),
+  identity: clientIdentity
+});
+var authError = import_zod11.z.object({
+  type: import_zod11.z.literal("auth_error"),
+  code: import_zod11.z.string().min(1),
+  message: import_zod11.z.string().min(1)
+});
+var clientInvoke = import_zod11.z.object({
+  type: import_zod11.z.literal("invoke"),
+  request_id: import_zod11.z.string().min(1).max(64),
+  robot_id: import_zod11.z.uuid(),
+  slug,
+  /** Parameters by field path, validated against the config's rules (§4.4). */
+  params: import_zod11.z.record(import_zod11.z.string(), import_zod11.z.unknown()),
+  /**
+   * How long this one call is worth waiting for (W6b) — the same field,
+   * meaning and cap as `invokeRequest.patience_ms`; absent means
+   * `DEFAULT_PATIENCE_MS`.
+   *
+   * It is here because **§11.1 parity is a rule, not a preference**: what REST
+   * can do travels over this socket. The first version of this delta gave
+   * `patience_ms` to the REST body only — and the SDK invokes exclusively over
+   * the realtime channel, so the field would have been unreachable for every
+   * SDK caller while appearing in the documentation. W6a shipped four SDK
+   * methods no SDK caller could invoke; this is the same defect caught before
+   * it shipped, by the SDK owner rather than by a reviewer.
+   */
+  patience_ms: import_zod11.z.number().int().min(MIN_PATIENCE_MS).max(MAX_PATIENCE_MS).optional()
+});
+var clientCancel = import_zod11.z.object({
+  type: import_zod11.z.literal("cancel"),
+  request_id: import_zod11.z.string().min(1).max(64),
+  robot_id: import_zod11.z.uuid(),
+  /** Which slug — required, and the only address a cancel had until W6b. */
+  slug,
+  /**
+   * Which job on that slug (W6b), or `null` for *whatever is running there*.
+   *
+   * The two are different requests and both are legitimate. An operator
+   * hitting a stop button means the second: stop the machine, whatever it is
+   * doing. A client cancelling the job it started means the first — and until
+   * this field existed it could not say so, so a cancel that arrived just
+   * after its own job ended stopped the next caller's job instead. Same slug,
+   * same wire frame, entirely different machine behaviour, and nothing in the
+   * protocol able to tell them apart.
+   *
+   * A named id that is not running answers `not_found` rather than falling
+   * back to the slug. Falling back would be the platform deciding that the
+   * caller did not really mean the id they typed.
+   */
+  job_id: import_zod11.z.uuid().nullable()
+});
+var clientPublish = import_zod11.z.object({
+  type: import_zod11.z.literal("publish"),
+  request_id: import_zod11.z.string().min(1).max(64),
+  robot_id: import_zod11.z.uuid(),
+  slug,
+  message: import_zod11.z.record(import_zod11.z.string(), import_zod11.z.unknown())
+});
+var commandResult = import_zod11.z.object({
+  type: import_zod11.z.literal("command_result"),
+  request_id: import_zod11.z.string().min(1).max(64),
+  ok: import_zod11.z.boolean(),
+  /**
+   * The job this reply is *about* — which is not always the caller's own.
+   *
+   * - `ok:true` on an invoke or a call: the job that was just created.
+   * - `ok:true` on a cancel: the job the cancel was sent to.
+   * - `ok:false, code:'busy'`: **the job that is already running** — the
+   *   caller has none. This is the §11.3 "inkl. Information, was läuft", and
+   *   it is the whole reason a busy refusal is useful: the caller learns
+   *   whether to wait or to give up (see `busyDetails`).
+   * - any other refusal: `null`.
+   */
+  job: job.nullable(),
+  /**
+   * The **kind** of the slug this command addressed, when the slug resolved.
+   *
+   * Invoke and call share a route on purpose — both create the job on the
+   * slug — but a *client* library distinguishes them: `services.call` waits
+   * for a terminal state, `actions.invoke` does not. Without the kind coming
+   * back, calling a service helper on an action slug **starts the real action
+   * on the robot** and then blames the robot for not finishing, half a minute
+   * later. Returning the kind lets a client refuse its own mistake at once,
+   * instead of reporting it as the machine's.
+   */
+  kind: import_zod11.z.enum(["datapoint", "action", "service", "publisher", "camera"]).nullable(),
+  code: import_zod11.z.string().nullable(),
+  message: import_zod11.z.string().nullable(),
+  /**
+   * The same payload the REST envelope carries in `apiError.details` — for
+   * `parameter_invalid`, a `parameterInvalidDetails`.
+   *
+   * Added because it was missing, and its absence quietly broke §11.1: this
+   * socket is supposed to do *everything* REST can do, but a
+   * `parameter_invalid` arriving here had nowhere to put its violations, so
+   * the same refusal was actionable over HTTP and opaque over the socket.
+   * A client cannot bind an error to the input that caused it from a code
+   * alone — which is the entire point of the flat parameter shape.
+   */
+  details: import_zod11.z.unknown().optional()
+});
+var errorFrame = import_zod11.z.object({
+  type: import_zod11.z.literal("error"),
+  code: import_zod11.z.string().min(1),
+  message: import_zod11.z.string().min(1)
+});
+var clientSubscribe = import_zod11.z.object({
+  type: import_zod11.z.literal("subscribe"),
+  robot_id: import_zod11.z.uuid(),
+  slug,
+  /**
+   * What the subscriber expects, and how it wants it (W5).
+   *
+   * `kind` lets the server answer **`wrong_kind`** instead of accepting a
+   * subscribe the client will then filter to silence — and silence is
+   * indistinguishable from an idle slug, so it tells a developer nothing.
+   * Optional, so an older client that omits it keeps today's behaviour.
+   *
+   * `options` is where a camera says what it wants; a datapoint needs none.
+   * It exists now rather than later because adding a field to a frame three
+   * repos parse is cheap once and expensive twice.
+   */
+  /**
+   * `publisher` is here even though a publisher is not subscribable: a client
+   * that models the five grantable kinds and honestly names one gets the
+   * informative `not_subscribable` the cloud already computes, instead of a
+   * `validation_error` reciting an enum. Refusing the *word* rather than the
+   * request was the same mistake as the silent wrong-verb subscribe this
+   * field was added to fix.
+   */
+  kind: import_zod11.z.enum(["datapoint", "action", "service", "publisher", "camera"]).optional(),
+  options: import_zod11.z.record(import_zod11.z.string(), import_zod11.z.unknown()).optional()
+});
+var clientUnsubscribe = import_zod11.z.object({
+  type: import_zod11.z.literal("unsubscribe"),
+  robot_id: import_zod11.z.uuid(),
+  slug
+});
+var subscribeError = import_zod11.z.object({
+  type: import_zod11.z.literal("subscribe_error"),
+  robot_id: import_zod11.z.string(),
+  slug: import_zod11.z.string(),
+  code: import_zod11.z.string().min(1),
+  message: import_zod11.z.string().min(1)
+});
+var datapointEvent = import_zod11.z.object({
+  type: import_zod11.z.literal("datapoint"),
+  robot_id: import_zod11.z.uuid(),
+  slug,
+  value: import_zod11.z.unknown(),
+  timestamp_ms: import_zod11.z.number().int().nonnegative()
+});
+var resourceHealthEvent = import_zod11.z.object({
+  type: import_zod11.z.literal("resource_health"),
+  robot_id: import_zod11.z.uuid(),
+  kind: import_zod11.z.enum(["camera", "credential"]),
+  ref: import_zod11.z.string().min(1).max(64),
+  state: import_zod11.z.enum(RESOURCE_HEALTH_STATES),
+  reason: import_zod11.z.string().max(200).nullable(),
+  changed_at_ms: import_zod11.z.number().int().nonnegative()
+});
+
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_367ffc97d258be510904ed62d5d477a4/node_modules/@fleetless/contracts/dist/identity.js
+var import_zod12 = require("zod");
+var password = import_zod12.z.string().min(12).max(256);
+var orgMemberRole = import_zod12.z.enum(["owner", "member"]);
+var org = import_zod12.z.object({
+  id: import_zod12.z.uuid(),
+  name: import_zod12.z.string().min(1).max(120),
+  created_at: import_zod12.z.iso.datetime()
+});
+var orgMember = import_zod12.z.object({
+  id: import_zod12.z.uuid(),
+  org_id: import_zod12.z.uuid(),
+  email: import_zod12.z.email(),
+  role: orgMemberRole,
+  created_at: import_zod12.z.iso.datetime()
+});
+var sessionTokens = import_zod12.z.object({
+  access_token: import_zod12.z.string().min(1),
+  refresh_token: import_zod12.z.string().min(1),
+  expires_in: import_zod12.z.number().int().positive()
+});
+var refreshRequest = import_zod12.z.object({ refresh_token: import_zod12.z.string().min(1) });
+var signUpRequest = import_zod12.z.object({
+  org_name: import_zod12.z.string().min(1).max(120),
+  email: import_zod12.z.email(),
+  password
+});
+var signUpResponse = import_zod12.z.object({
+  org,
+  member: orgMember,
+  tokens: sessionTokens
+});
+var developerLoginRequest = import_zod12.z.object({
+  email: import_zod12.z.email(),
+  password: import_zod12.z.string().min(1)
+});
+var endUser = import_zod12.z.object({
+  id: import_zod12.z.uuid(),
+  org_id: import_zod12.z.uuid(),
+  email: import_zod12.z.email(),
+  status: import_zod12.z.enum(["invited", "active", "blocked"]),
+  created_at: import_zod12.z.iso.datetime()
+});
+var mailStatus = import_zod12.z.enum(["sent", "not_configured", "failed"]);
+var invitation = import_zod12.z.object({
+  id: import_zod12.z.uuid(),
+  email: import_zod12.z.email(),
+  app_id: import_zod12.z.uuid(),
+  role_id: import_zod12.z.uuid(),
+  expires_at: import_zod12.z.iso.datetime(),
+  accept_url: import_zod12.z.url(),
+  /** Replaces `mail_sent: boolean` — see `mailStatus` for why one bit was not enough. */
+  mail: mailStatus
+});
+var createInvitationRequest = import_zod12.z.object({
+  email: import_zod12.z.email(),
+  app_id: import_zod12.z.uuid(),
+  role_id: import_zod12.z.uuid(),
+  send_mail: import_zod12.z.boolean()
+});
+var acceptInvitationRequest = import_zod12.z.object({
+  token: import_zod12.z.string().min(1),
+  password
+});
+var createDeveloperInvitationRequest = import_zod12.z.object({
+  email: import_zod12.z.email(),
+  role: orgMemberRole,
+  send_mail: import_zod12.z.boolean()
+});
+var developerInvitation = import_zod12.z.object({
+  id: import_zod12.z.uuid(),
+  email: import_zod12.z.email(),
+  role: orgMemberRole,
+  expires_at: import_zod12.z.iso.datetime(),
+  accept_url: import_zod12.z.url(),
+  mail: mailStatus
+});
+var pendingDeveloperInvitation = import_zod12.z.object({
+  id: import_zod12.z.uuid(),
+  email: import_zod12.z.email(),
+  role: orgMemberRole,
+  expires_at: import_zod12.z.iso.datetime()
+});
+var developerInvitationListResponse = import_zod12.z.object({
+  /** Pending only. An accepted invitation is history, not something to revoke. */
+  invitations: import_zod12.z.array(pendingDeveloperInvitation)
+});
+var acceptDeveloperInvitationRequest = import_zod12.z.object({
+  token: import_zod12.z.string().min(1),
+  password
+});
+var tierRequiredDetails = import_zod12.z.object({
+  required: orgMemberRole,
+  /** The caller's own tier — theirs to know, and it is what makes the message actionable. */
+  actual: orgMemberRole
+});
+var selfRegistration = import_zod12.z.object({
+  enabled: import_zod12.z.boolean(),
+  /**
+   * Accept any address. Deliberately its own flag rather than a magic value
+   * in `domains`, so "open to everyone" is something an app owner has to say,
+   * not something that falls out of leaving a list empty.
+   */
+  all_domains: import_zod12.z.boolean(),
+  /** Lower-case bare domains, no `@`: `['dehne-robotik.de']`. Ignored when `all_domains`. */
+  domains: import_zod12.z.array(import_zod12.z.string().min(1).max(253)),
+  /** The role every self-registered member of this pool receives (§3.2: exactly one per app). */
+  role_id: import_zod12.z.uuid()
+});
+var clientRegisterRequest = import_zod12.z.object({
+  app_identifier: appIdentifier,
+  email: import_zod12.z.email(),
+  password
+});
+var clientRegisterResponse = import_zod12.z.object({
+  mail: mailStatus
+});
+var clientRegisterConfirm = import_zod12.z.object({
+  token: import_zod12.z.string().min(1)
+});
+var passwordChangeRequest = import_zod12.z.object({
+  current_password: import_zod12.z.string().min(1),
+  new_password: password
+});
+var passwordResetRequest = import_zod12.z.object({
+  email: import_zod12.z.email()
+});
+var clientPasswordResetRequest = import_zod12.z.object({
+  app_identifier: appIdentifier,
+  email: import_zod12.z.email()
+});
+var passwordResetConfirm = import_zod12.z.object({
+  token: import_zod12.z.string().min(1),
+  new_password: password
+});
+var idpClaimMapping = import_zod12.z.object({
+  /** Which claim is the stable identity. `sub` unless the developer knows better. */
+  subject_claim: import_zod12.z.string().min(1).max(100).default("sub"),
+  email_claim: import_zod12.z.string().min(1).max(100).default("email")
+});
+var idpIssuer = import_zod12.z.url().max(500).refine((v) => {
+  let url;
+  try {
+    url = new URL(v);
+  } catch {
+    return false;
+  }
+  if (!["http:", "https:"].includes(url.protocol))
+    return false;
+  if (url.username !== "" || url.password !== "")
+    return false;
+  if (url.hash !== "" || url.search !== "")
+    return false;
+  return url.hostname.length > 0;
+}, { message: "issuer must be an http(s) URL with no credentials, query or fragment" });
+var idpConfig = import_zod12.z.object({
+  app_id: import_zod12.z.uuid(),
+  issuer: idpIssuer,
+  client_id: import_zod12.z.string().min(1).max(200),
+  scopes: import_zod12.z.array(import_zod12.z.string().min(1).max(60)).min(1).max(20),
+  claims: idpClaimMapping,
+  link_verified_emails: import_zod12.z.boolean(),
+  /** Never the secret itself — see `idpConfigRequest`. */
+  has_client_secret: import_zod12.z.boolean(),
+  updated_at: import_zod12.z.iso.datetime()
+});
+var idpConfigRequest = import_zod12.z.object({
+  issuer: idpIssuer,
+  client_id: import_zod12.z.string().min(1).max(200),
+  client_secret: import_zod12.z.string().min(1).max(500).optional(),
+  scopes: import_zod12.z.array(import_zod12.z.string().min(1).max(60)).min(1).max(20),
+  claims: idpClaimMapping.optional(),
+  link_verified_emails: import_zod12.z.boolean()
+}).strict();
+
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_367ffc97d258be510904ed62d5d477a4/node_modules/@fleetless/contracts/dist/audit.js
+var import_zod13 = require("zod");
+var auditActor = import_zod13.z.object({
+  kind: import_zod13.z.enum(["developer", "end_user", "server_key", "bridge"]),
+  id: import_zod13.z.uuid(),
+  label: import_zod13.z.string().min(1).max(200)
+});
+var auditEvent = import_zod13.z.object({
+  id: import_zod13.z.uuid(),
+  org_id: import_zod13.z.uuid(),
+  at: import_zod13.z.iso.datetime(),
+  /**
+   * A monotonic counter, ascending in write order, unique across the log
+   * (W6b).
+   *
+   * `at` is not a total order. Two events written in the same millisecond —
+   * a login and the config publish it enables, a cascade writing several
+   * rows — sort against each other arbitrarily, and "arbitrarily" means
+   * *differently on each query*. A reader paging through "newest first" can
+   * therefore see one of them twice and the other not at all, which is the
+   * one failure mode an audit log may not have: a record that is present and
+   * invisible.
+   *
+   * It is also the only correct **cursor** for paging this log, for the same
+   * reason: a cursor that is not unique either skips rows or repeats them at
+   * every page boundary. No cursor parameter exists on `GET /api/audit` yet —
+   * the route returns the whole log — and that is stated here rather than
+   * implied, because a contract that describes a capability the API does not
+   * have is the defect this project keeps finding. When paging is added it
+   * uses this field; nothing else in this shape can carry it.
+   *
+   * Required, not optional: an event without a sequence cannot be ordered
+   * against one that has it, and a log with two orderings has none.
+   */
+  seq: import_zod13.z.number().int().positive(),
+  actor: auditActor,
+  /** Stable dotted name, e.g. `end_user.invited`, `config.published`. */
+  action: import_zod13.z.string().min(1).max(80),
+  /**
+   * What the action was about, if anything — a robot, an app, a user. Free
+   * of ids the console cannot resolve: carry the label with it.
+   */
+  target: import_zod13.z.object({
+    kind: import_zod13.z.string().min(1).max(40),
+    id: import_zod13.z.string().min(1),
+    label: import_zod13.z.string().min(1).max(200)
+  }).nullable(),
+  /** Action-specific extras. Never credentials, never tokens. */
+  details: import_zod13.z.record(import_zod13.z.string(), import_zod13.z.unknown()).nullable()
+});
+var auditListResponse = import_zod13.z.object({
+  events: import_zod13.z.array(auditEvent)
+});
+
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_367ffc97d258be510904ed62d5d477a4/node_modules/@fleetless/contracts/dist/errors.js
+var import_zod14 = require("zod");
+var apiError = import_zod14.z.object({
+  code: import_zod14.z.string().min(1),
+  message: import_zod14.z.string().min(1),
+  details: import_zod14.z.unknown().optional()
+});
+var parameterViolation = import_zod14.z.object({
+  field: import_zod14.z.string().min(1),
+  /** Which rule failed — `min`, `max`, `enum`, `pattern`, `required`, `undeclared`. */
+  rule: import_zod14.z.string().min(1),
+  message: import_zod14.z.string().min(1)
+});
+var parameterInvalidDetails = import_zod14.z.object({
+  violations: import_zod14.z.array(parameterViolation).min(1)
+});
+
+// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_367ffc97d258be510904ed62d5d477a4/node_modules/@fleetless/contracts/dist/oauth.js
+var import_zod15 = require("zod");
+var oauthErrorCode = import_zod15.z.enum([
+  "invalid_request",
+  "invalid_client",
+  "invalid_grant",
+  "unauthorized_client",
+  "unsupported_grant_type",
+  "invalid_scope",
+  "access_denied",
+  "server_error",
+  "temporarily_unavailable",
+  /** RFC 8707: the `resource` named is not one this server issues tokens for. */
+  "invalid_target"
+]);
+var oauthError = import_zod15.z.object({
+  error: oauthErrorCode,
+  error_description: import_zod15.z.string().min(1).max(500).optional(),
+  /** Echoed back per RFC 6749 §4.1.2.1 so a client can match the response. */
+  state: import_zod15.z.string().min(1).max(500).optional(),
+  /**
+   * **A Fleetless reason carried inside a standard envelope, and it exists
+   * because the alternative lost a distinction.**
+   *
+   * Two policy refusals at `/oauth/register` — the app has not opted in, and
+   * the app's client ceiling is full — both map to RFC 6749's `access_denied`,
+   * which is the honest standard code for either. Answering with only that
+   * makes the two indistinguishable to the caller, and *a field that cannot
+   * express a distinction produces a workaround somewhere else*. Answering in
+   * `apiError` instead would keep the distinction and hand an RFC-compliant
+   * client a body it cannot parse — which is the conformance this wave exists
+   * to provide.
+   *
+   * So both: `error` is what a standard client reads, `fleetless_code` is what
+   * our own tooling switches on. RFC 6749 §5.2 permits additional members, and
+   * a client that ignores this one still behaves correctly.
+   */
+  fleetless_code: import_zod15.z.string().min(1).max(60).optional()
+});
+var oauthClientRegistration = import_zod15.z.enum(["developer", "dynamic"]);
+var redirectUri = import_zod15.z.string().min(1).max(2e3).refine((v) => {
+  let url;
+  try {
+    url = new URL(v);
+  } catch {
+    return false;
+  }
+  if (url.hash !== "")
+    return false;
+  if (url.protocol === "https:")
+    return url.hostname.length > 0;
+  if (url.protocol === "http:")
+    return ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+  return false;
+}, { message: "redirect_uri must be an https URL, or http on an explicit loopback address, and carry no fragment" });
+var codeChallengeMethod = import_zod15.z.enum(["S256"]);
+var oauthClient = import_zod15.z.object({
+  id: import_zod15.z.uuid(),
+  app_id: import_zod15.z.uuid(),
+  /** The `client_id` on the wire — opaque, and not the app identifier. */
+  client_id: import_zod15.z.string().min(1).max(200),
+  client_name: import_zod15.z.string().min(1).max(200),
+  registration: oauthClientRegistration,
+  redirect_uris: import_zod15.z.array(redirectUri).min(1).max(20),
+  created_at: import_zod15.z.iso.datetime(),
+  /**
+   * **Only `dynamic` clients expire, and the field is nullable rather than
+   * absent so a consumer must decide what it means.** A self-registered client
+   * that never completes a flow is an unauthenticated write somebody left
+   * behind; a developer's own client is a configured thing that should not
+   * vanish under them.
+   */
+  expires_at: import_zod15.z.iso.datetime().nullable(),
+  last_used_at: import_zod15.z.iso.datetime().nullable()
+});
+var dynamicClientRegistrationRequest = import_zod15.z.object({
+  client_name: import_zod15.z.string().min(1).max(200),
+  redirect_uris: import_zod15.z.array(redirectUri).min(1).max(20),
+  /** Accepted and echoed for conformance; this server issues only this pair. */
+  grant_types: import_zod15.z.array(import_zod15.z.enum(["authorization_code", "refresh_token"])).optional(),
+  response_types: import_zod15.z.array(import_zod15.z.enum(["code"])).optional(),
+  /** RFC 7591 allows `none` for public clients; OAuth 2.1 + PKCE is the defence. */
+  token_endpoint_auth_method: import_zod15.z.enum(["none"]).optional(),
+  scope: import_zod15.z.string().max(500).optional()
+}).strict();
+var dynamicClientRegistrationResponse = import_zod15.z.object({
+  client_id: import_zod15.z.string().min(1).max(200),
+  client_name: import_zod15.z.string().min(1).max(200),
+  redirect_uris: import_zod15.z.array(redirectUri),
+  grant_types: import_zod15.z.array(import_zod15.z.string()),
+  response_types: import_zod15.z.array(import_zod15.z.string()),
+  token_endpoint_auth_method: import_zod15.z.literal("none"),
+  client_id_issued_at: import_zod15.z.number().int().nonnegative(),
+  /** Seconds since the epoch, per RFC 7591. `0` would mean "never expires". */
+  client_secret_expires_at: import_zod15.z.literal(0)
+});
+var oauthTokenRequest = import_zod15.z.discriminatedUnion("grant_type", [
+  import_zod15.z.object({
+    grant_type: import_zod15.z.literal("authorization_code"),
+    code: import_zod15.z.string().min(1).max(500),
+    redirect_uri: redirectUri,
+    client_id: import_zod15.z.string().min(1).max(200),
+    code_verifier: import_zod15.z.string().regex(/^[A-Za-z0-9\-._~]{43,128}$/, "code_verifier must be 43-128 unreserved characters (RFC 7636 \xA74.1)"),
+    resource: import_zod15.z.url().optional()
+  }),
+  import_zod15.z.object({
+    grant_type: import_zod15.z.literal("refresh_token"),
+    refresh_token: import_zod15.z.string().min(1).max(500),
+    client_id: import_zod15.z.string().min(1).max(200),
+    resource: import_zod15.z.url().optional(),
+    /** RFC 6749 §6 — a refresh may narrow scope, never widen it. */
+    scope: import_zod15.z.string().max(500).optional()
+  })
+]);
+var oauthTokenResponse = import_zod15.z.object({
+  access_token: import_zod15.z.string().min(1),
+  token_type: import_zod15.z.literal("Bearer"),
+  /** Seconds, per RFC 6749 §5.1 — not a timestamp, and not milliseconds. */
+  expires_in: import_zod15.z.number().int().positive(),
+  refresh_token: import_zod15.z.string().min(1).optional(),
+  scope: import_zod15.z.string().max(500).optional()
+});
+var authorizationServerMetadata = import_zod15.z.object({
+  issuer: import_zod15.z.url(),
+  authorization_endpoint: import_zod15.z.url(),
+  token_endpoint: import_zod15.z.url(),
+  registration_endpoint: import_zod15.z.url().optional(),
+  response_types_supported: import_zod15.z.array(import_zod15.z.literal("code")),
+  grant_types_supported: import_zod15.z.array(import_zod15.z.enum(["authorization_code", "refresh_token"])),
+  code_challenge_methods_supported: import_zod15.z.array(codeChallengeMethod),
+  token_endpoint_auth_methods_supported: import_zod15.z.array(import_zod15.z.literal("none")),
+  scopes_supported: import_zod15.z.array(import_zod15.z.string()).optional()
+});
+var protectedResourceMetadata = import_zod15.z.object({
+  resource: import_zod15.z.url(),
+  authorization_servers: import_zod15.z.array(import_zod15.z.url()).min(1),
+  bearer_methods_supported: import_zod15.z.array(import_zod15.z.literal("header")),
+  scopes_supported: import_zod15.z.array(import_zod15.z.string()).optional()
+});
+var consentGrant = import_zod15.z.object({
+  client_id: import_zod15.z.string().min(1).max(200),
+  app_id: import_zod15.z.uuid(),
+  end_user_id: import_zod15.z.uuid(),
+  role_id: import_zod15.z.uuid(),
+  scope: import_zod15.z.string().max(500),
+  granted_at: import_zod15.z.iso.datetime()
+});
+var oauthInteraction = import_zod15.z.object({
+  interaction_id: import_zod15.z.string().min(1).max(200),
+  app_name: import_zod15.z.string().min(1).max(120),
+  idp: import_zod15.z.object({ button_label: import_zod15.z.string().min(1).max(60) }).nullable()
+});
+var oauthConsentInteraction = import_zod15.z.object({
+  interaction_id: import_zod15.z.string().min(1).max(200),
+  app_name: import_zod15.z.string().min(1).max(120),
+  client_name: import_zod15.z.string().min(1).max(200),
+  registration: oauthClientRegistration,
+  role_name: import_zod15.z.string().min(1).max(120),
+  scope: import_zod15.z.string().max(500)
+});
+var oauthLoginRequest = import_zod15.z.object({
+  interaction_id: import_zod15.z.string().min(1).max(200),
+  email: import_zod15.z.email(),
+  password: import_zod15.z.string().min(1)
+}).strict();
+var oauthRedirectResponse = import_zod15.z.object({
+  redirect_to: import_zod15.z.string().min(1).max(2e3)
+});
+var consentDecision = import_zod15.z.object({
+  /** The opaque handle the authorize step handed the consent screen. */
+  interaction_id: import_zod15.z.string().min(1).max(200),
+  approved: import_zod15.z.boolean()
+});
+var OAUTH_PATHS = {
+  authorizationServerMetadata: "/.well-known/oauth-authorization-server",
+  protectedResourceMetadata: "/.well-known/oauth-protected-resource",
+  authorize: "/oauth/authorize",
+  token: "/oauth/token",
+  register: "/oauth/register",
+  /**
+   * **One path, both verbs** — `GET` serves the consent page, `POST` accepts a
+   * `consentDecision`. Decided 2026-08-18 rather than left to be inferred:
+   * Eve-W7b asked whether the page's own GET route was this path or another,
+   * which is the right question and had no answer anywhere.
+   *
+   * One entry means the console and the cloud cannot drift apart on it, which
+   * is the failure W7a paid for when five hand-written copies of `assetKind`
+   * and a header name crossed the TypeScript/Python line. Note that the two
+   * verbs answer differently: the page is HTML, and a failed `POST` answers
+   * `apiError` — see the dialect note at the top of this file, which names
+   * this path as the exception the prefix will mislead you about.
+   */
+  consent: "/oauth/consent",
+  /**
+   * The two federation legs. **Server-owned redirect targets a client never
+   * constructs** — the same category as `authorize`, `token` and `register`,
+   * and the reason they belong here rather than as literals.
+   *
+   * Kassandra-W7b found `/oauth/idp-start` written as a literal in
+   * `cloud/src/routes/oauth-federation.ts` **and** in
+   * `console/oauth-pages/login/src/App.vue` — two repos agreeing on a string
+   * with nothing shared between them. Worse than the `/idp` versus
+   * `/idp-config` mismatch this wave already met, because the console half
+   * ships as a **committed artifact**: the drift would survive a re-pin and an
+   * install, and the symptom is a federation button that navigates to a 404,
+   * invisible to both suites.
+   *
+   * `OAUTH_PATHS` was created in this wave with a doc comment citing W7a's
+   * five hand-written copies of `assetKind`. The rule was applied to `login`
+   * and `consent` and stopped there.
+   */
+  idpStart: "/oauth/idp-start",
+  idpCallback: "/oauth/idp-callback",
+  /**
+   * The console-built page the cloud serves from its own origin (see §3.4) —
+   * and, like `consent` above, **one path with both verbs**: `GET` serves the
+   * page, `POST` accepts an `oauthLoginRequest` and answers an
+   * `oauthLoginResponse`.
+   *
+   * Decided 2026-08-18. Nimbus-W7b proposed a separate `POST /oauth/login`,
+   * which would work; one path is chosen for the same reason `consent` has
+   * one — the page posts to its own URL, so there is no second string for two
+   * repos to disagree about, and this wave has already produced one live
+   * mismatch of exactly that kind (`/idp` versus `/idp-config`, caught by
+   * comparing repos rather than by either suite).
+   *
+   * A failed `POST` answers `apiError`, not `oauthError`: the caller is our own
+   * page, not a standard client. See the dialect note at the top of this file.
+   */
+  login: "/login"
+};
+
+// src/pkce.ts
+function requireCrypto() {
+  const c = globalThis.crypto;
+  if (!c?.subtle) {
+    throw new Error(
+      "auth.beginHostedLogin/completeHostedLogin need the Web Crypto API (globalThis.crypto.subtle), which is not available in this environment."
+    );
+  }
+  return c;
+}
+function toBase64Url(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function randomBase64Url(byteLength) {
+  const bytes = new Uint8Array(byteLength);
+  requireCrypto().getRandomValues(bytes);
+  return toBase64Url(bytes);
+}
+function generateCodeVerifier() {
+  return randomBase64Url(32);
+}
+function generateState() {
+  return randomBase64Url(32);
+}
+async function computeCodeChallenge(codeVerifier) {
+  const digest = await requireCrypto().subtle.digest("SHA-256", new TextEncoder().encode(codeVerifier));
+  return toBase64Url(new Uint8Array(digest));
+}
+
+// src/auth.ts
+var SessionCredentials = class {
+  constructor(http, tokenStore) {
+    this.http = http;
+    this.tokenStore = tokenStore;
+  }
+  http;
+  tokenStore;
+  #refreshing = null;
+  async token() {
+    const session = await this.tokenStore.load();
+    return session ? session.access_token : null;
+  }
+  async handleExpired() {
+    await this.#ensureRefreshed();
+    return true;
+  }
+  /** Single-flight — a refresh already in progress is awaited, never duplicated. */
+  #ensureRefreshed() {
+    if (this.#refreshing) return this.#refreshing;
+    const attempt = this.#refresh().finally(() => {
+      this.#refreshing = null;
+    });
+    this.#refreshing = attempt;
+    return attempt;
+  }
+  async #refresh() {
+    const current = await this.tokenStore.load();
+    if (!current) throw new FleetlessError("no_session", "No session to refresh.");
+    const body = { refresh_token: current.refresh_token };
+    const tokens = await this.http.request("/api/client/refresh", {
+      method: "POST",
+      skipAuth: true,
+      body
+    });
+    await this.tokenStore.save(tokens);
+    return tokens;
+  }
+};
+var ServerKeyCredentials = class {
+  constructor(serverKey2) {
+    this.serverKey = serverKey2;
+  }
+  serverKey;
+  async token() {
+    return this.serverKey;
+  }
+  async handleExpired() {
+    return false;
+  }
+};
+function createPasswordResetMethods(http, appIdentifier2) {
+  return {
+    async requestPasswordReset(email) {
+      const body = { app_identifier: appIdentifier2, email };
+      await http.request("/api/client/password/reset", { method: "POST", skipAuth: true, body, expectEmptyBody: true });
+    },
+    async confirmPasswordReset(token, newPassword) {
+      const body = { token, new_password: newPassword };
+      await http.request("/api/client/password/reset/confirm", { method: "POST", skipAuth: true, body, expectEmptyBody: true });
+    }
+  };
+}
+function createSessionAuth(http, tokenStore, appIdentifier2) {
+  return {
+    async login(email, password2) {
+      const body = { app_identifier: appIdentifier2, email, password: password2 };
+      const tokens = await http.request("/api/client/login", { method: "POST", skipAuth: true, body });
+      await tokenStore.save(tokens);
+    },
+    async beginHostedLogin(options) {
+      const state = generateState();
+      const codeVerifier = generateCodeVerifier();
+      const codeChallenge = await computeCodeChallenge(codeVerifier);
+      const url = new URL(`${http.baseUrl}${OAUTH_PATHS.authorize}`);
+      url.searchParams.set("response_type", "code");
+      url.searchParams.set("client_id", options.clientId);
+      url.searchParams.set("redirect_uri", options.redirectUri);
+      url.searchParams.set("code_challenge", codeChallenge);
+      url.searchParams.set("code_challenge_method", "S256");
+      url.searchParams.set("state", state);
+      if (options.scope !== void 0) url.searchParams.set("scope", options.scope);
+      if (options.resource !== void 0) url.searchParams.set("resource", options.resource);
+      return { url: url.toString(), state, codeVerifier };
+    },
+    async completeHostedLogin(options) {
+      if (!options.expectedState) {
+        throw new FleetlessError(
+          "no_hosted_login_attempt",
+          "completeHostedLogin: expectedState is empty \u2014 nothing was persisted for this attempt. This usually means the callback landed in a different tab or window than the one that called beginHostedLogin, the session was restored, or storage was cleared in between \u2014 not necessarily an attack. Check what beginHostedLogin returned and how your app persisted it."
+        );
+      }
+      if (!options.state || options.state !== options.expectedState) {
+        throw new FleetlessError(
+          "state_mismatch",
+          "completeHostedLogin: the redirect's state does not match the state beginHostedLogin generated for this attempt \u2014 refusing to complete a login this client did not start (RFC 6749 \xA710.12)."
+        );
+      }
+      const raw = await http.requestOAuth(OAUTH_PATHS.token, {
+        grant_type: "authorization_code",
+        code: options.code,
+        redirect_uri: options.redirectUri,
+        client_id: options.clientId,
+        code_verifier: options.codeVerifier,
+        ...options.resource !== void 0 ? { resource: options.resource } : {}
+      });
+      if (raw.refresh_token === void 0) {
+        throw new FleetlessError(
+          "unexpected_response",
+          "POST /oauth/token answered ok but did not include a refresh_token; a hosted-login session cannot silently refresh without one."
+        );
+      }
+      const tokens = { access_token: raw.access_token, refresh_token: raw.refresh_token, expires_in: raw.expires_in };
+      await tokenStore.save(tokens);
+    },
+    async logout() {
+      const session = await tokenStore.load();
+      let revoked = true;
+      if (session) {
+        const body = { refresh_token: session.refresh_token };
+        revoked = await http.request("/api/client/logout", { method: "POST", skipAuth: true, body, expectEmptyBody: true }).then(() => true).catch(() => false);
+      }
+      await tokenStore.save(null);
+      return { revoked };
+    },
+    async me() {
+      return http.request("/api/client/me", {});
+    },
+    async register(email, password2) {
+      const body = { app_identifier: appIdentifier2, email, password: password2 };
+      return http.request("/api/client/register", { method: "POST", skipAuth: true, body });
+    },
+    async confirmRegistration(token) {
+      const body = { token };
+      const tokens = await http.request("/api/client/register/confirm", { method: "POST", skipAuth: true, body });
+      await tokenStore.save(tokens);
+    },
+    async changePassword(currentPassword, newPassword) {
+      const body = { current_password: currentPassword, new_password: newPassword };
+      const tokens = await http.request("/api/client/password/change", { method: "POST", body });
+      await tokenStore.save(tokens);
+    },
+    ...createPasswordResetMethods(http, appIdentifier2)
+  };
+}
+function createServerKeyAuth(http, appIdentifier2) {
+  return {
+    async login() {
+      throw new Error("auth.login is not available on a client constructed with a serverKey.");
+    },
+    async beginHostedLogin() {
+      throw new Error("auth.beginHostedLogin is not available on a client constructed with a serverKey.");
+    },
+    async completeHostedLogin() {
+      throw new Error("auth.completeHostedLogin is not available on a client constructed with a serverKey.");
+    },
+    async logout() {
+      throw new Error("auth.logout is not available on a client constructed with a serverKey.");
+    },
+    async me() {
+      return http.request("/api/client/me", {});
+    },
+    async register() {
+      throw new Error("auth.register is not available on a client constructed with a serverKey.");
+    },
+    async confirmRegistration() {
+      throw new Error("auth.confirmRegistration is not available on a client constructed with a serverKey.");
+    },
+    async changePassword() {
+      throw new Error("auth.changePassword is not available on a client constructed with a serverKey.");
+    },
+    ...createPasswordResetMethods(http, appIdentifier2)
+  };
+}
+
+// src/cameras.ts
+var EMPTY_SNAPSHOT_META = { mime: null, width: null, height: null, timestamp_ms: null, age_ms: null };
+function headerNumber(headers, name) {
+  const raw = headers.get(name);
+  if (raw === null) return null;
+  const value = Number(raw);
+  return Number.isFinite(value) ? value : null;
+}
+function createCamerasApi(http) {
+  return {
+    async list(robotId) {
+      const response = await http.request(`/api/robots/${pathSegment(robotId)}/cameras`, {});
+      return response.cameras;
+    },
+    async snapshot(robotId, slug2) {
+      try {
+        const { body, headers } = await http.requestBinary(`/api/robots/${pathSegment(robotId)}/cameras/${pathSegment(slug2)}/snapshot`);
+        return {
+          image: body,
+          mime: mimeFromContentType(headers),
+          width: headerNumber(headers, SNAPSHOT_HEADERS.width),
+          height: headerNumber(headers, SNAPSHOT_HEADERS.height),
+          timestamp_ms: headerNumber(headers, SNAPSHOT_HEADERS.timestampMs),
+          age_ms: headerNumber(headers, SNAPSHOT_HEADERS.ageMs)
+        };
+      } catch (error) {
+        if (error instanceof FleetlessError && error.code === "no_snapshot_yet") return { image: null, ...EMPTY_SNAPSHOT_META };
+        throw error;
+      }
+    },
+    async snapshotMeta(robotId, slug2) {
+      try {
+        const response = await http.request(`/api/robots/${pathSegment(robotId)}/cameras/${pathSegment(slug2)}/snapshot/meta`, {});
+        return {
+          mime: response.mime,
+          width: response.width,
+          height: response.height,
+          timestamp_ms: response.timestamp_ms,
+          age_ms: response.age_ms
+        };
+      } catch (error) {
+        if (error instanceof FleetlessError && error.code === "no_snapshot_yet") return { ...EMPTY_SNAPSHOT_META };
+        throw error;
+      }
+    },
+    async live(robotId, slug2) {
+      const response = await http.request(`/api/robots/${pathSegment(robotId)}/cameras/${pathSegment(slug2)}/live`, {
+        method: "POST"
+      });
+      const releasePath = `/api/robots/${pathSegment(robotId)}/cameras/${pathSegment(slug2)}/live?${new URLSearchParams({ session_id: response.session_id })}`;
+      let releasePromise = null;
+      const release = () => {
+        if (!releasePromise) {
+          releasePromise = http.request(releasePath, { method: "DELETE", expectEmptyBody: true }).then(() => void 0).catch(() => void 0);
+        }
+        return releasePromise;
+      };
+      return {
+        session_id: response.session_id,
+        url: response.url,
+        room: response.room,
+        token: response.token,
+        expires_at: response.expires_at,
+        release
+      };
+    }
+  };
+}
+
+// src/commands.ts
+function generateRequestId() {
+  if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function") return crypto.randomUUID();
+  return `req_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 10)}`;
+}
+var DEFAULT_COMMAND_TIMEOUT_MS = 1e4;
+var LOCAL_WAIT_MARGIN_MS = 5e3;
+function resolveLocalWaitMs(options, defaultMs) {
+  const { timeoutMs, patienceMs } = options;
+  if (timeoutMs !== void 0 && patienceMs !== void 0 && timeoutMs < patienceMs) {
+    throw new FleetlessError(
+      "invalid_option",
+      `timeoutMs (${timeoutMs}ms) is shorter than patienceMs (${patienceMs}ms) \u2014 the SDK would give up locally before the platform's own patience runs out, and report command_timeout for a call the platform never actually refused. Raise timeoutMs above patienceMs, or omit timeoutMs to have it derived automatically.`
+    );
+  }
+  if (timeoutMs !== void 0) return timeoutMs;
+  if (patienceMs !== void 0) return patienceMs + LOCAL_WAIT_MARGIN_MS;
+  return defaultMs;
+}
+function sendCommand(channel, frame, options = {}) {
+  channel.connect();
+  const timeoutMs = options.timeoutMs ?? DEFAULT_COMMAND_TIMEOUT_MS;
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const cleanups = [];
+    const cleanup = () => {
+      for (const fn of cleanups) fn();
+    };
+    const settle = (fn) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      fn();
+    };
+    const timer = setTimeout(() => {
+      settle(
+        () => reject(
+          new FleetlessError(
+            "command_timeout",
+            `Command '${frame.type}' (request_id=${frame.request_id}) timed out after ${timeoutMs}ms without a reply.`
+          )
+        )
+      );
+    }, timeoutMs);
+    cleanups.push(() => clearTimeout(timer));
+    cleanups.push(
+      channel.on("command_result", (raw) => {
+        const result = raw;
+        if (result.request_id !== frame.request_id) return;
+        settle(() => {
+          if (result.ok) {
+            resolve(result);
+            return;
+          }
+          const code = result.code ?? "command_failed";
+          const details = code === "busy" && result.job ? { running: result.job } : result.details;
+          reject(new FleetlessError(code, result.message ?? "The command was refused.", details !== void 0 ? { details } : void 0));
+        });
+      })
+    );
+    cleanups.push(
+      channel.onAuthFailed((error) => {
+        settle(() => reject(error));
+      })
+    );
+    const watchForDeadConnection = (epochAtSend) => {
+      cleanups.push(
+        channel.onReady(() => {
+          if (channel.connectionEpoch === epochAtSend) return;
+          settle(
+            () => reject(
+              new FleetlessError(
+                "command_outcome_unknown",
+                `The realtime connection was re-established before a reply to '${frame.type}' (request_id=${frame.request_id}) arrived. The command may or may not have run \u2014 read the job by slug (e.g. actions.subscribe) rather than retrying blindly.`
+              )
+            )
+          );
+        })
+      );
+    };
+    if (channel.isReady) {
+      const epoch = channel.connectionEpoch;
+      channel.send(frame);
+      watchForDeadConnection(epoch);
+    } else {
+      const unlistenReady = channel.onReady(() => {
+        unlistenReady();
+        const epoch = channel.connectionEpoch;
+        channel.send(frame);
+        watchForDeadConnection(epoch);
+      });
+      cleanups.push(unlistenReady);
+    }
+  });
+}
+function assertValidJobId(jobId) {
+  if (jobId === void 0 || jobId === null || typeof jobId === "string") return;
+  throw new FleetlessError(
+    "invalid_option",
+    `cancel()'s third argument must be a job id (string), null, or omitted \u2014 got ${typeof jobId === "object" ? "an object" : typeof jobId}. If you are passing an options object (e.g. {timeoutMs}) as the third argument, note the signature changed in this release: cancel(robotId, slug) is unchanged, but a third positional argument is now the job id to cancel and options moved to a fourth argument \u2014 cancel(robotId, slug, jobId, options). See the README's Actions section.`
+  );
+}
+function createRealtimeCommandTransport(channel) {
+  return {
+    // Declared `async` deliberately, unlike `cancel`/`publish` below: it is
+    // the only one of the three that can refuse *before* sending anything
+    // (resolveLocalWaitMs's `invalid_option`, D3a), and every caller of
+    // this interface — starting with this file's own `sendCommand` callers
+    // — is entitled to assume `CommandTransport.invoke` always returns a
+    // promise rather than throwing synchronously. Without `async` here, a
+    // synchronous throw from `resolveLocalWaitMs` would escape as a thrown
+    // exception instead of a rejection, breaking that assumption for any
+    // caller that isn't itself inside an `async` function (e.g. a test
+    // calling this transport directly).
+    async invoke(robotId, slug2, params, options) {
+      const timeoutMs = resolveLocalWaitMs(options ?? {}, DEFAULT_COMMAND_TIMEOUT_MS);
+      const frame = {
+        type: "invoke",
+        request_id: generateRequestId(),
+        robot_id: robotId,
+        slug: slug2,
+        params,
+        patience_ms: options?.patienceMs
+      };
+      return sendCommand(channel, frame, { timeoutMs });
+    },
+    // Declared `async` for the same reason `invoke` above is (D3a, D6):
+    // `assertValidJobId` can throw before a frame is ever built, and a
+    // caller of this interface is entitled to a rejected promise, never a
+    // thrown exception.
+    async cancel(robotId, slug2, jobId, options) {
+      assertValidJobId(jobId);
+      const frame = { type: "cancel", request_id: generateRequestId(), robot_id: robotId, slug: slug2, job_id: jobId ?? null };
+      return sendCommand(channel, frame, options);
+    },
+    publish(robotId, slug2, message, options) {
+      const frame = { type: "publish", request_id: generateRequestId(), robot_id: robotId, slug: slug2, message };
+      return sendCommand(channel, frame, options);
+    }
+  };
+}
+
+// src/datapoints.ts
+function keyOf(robotId, slug2) {
+  return `${robotId} ${slug2}`;
+}
+function createKeyState(channel, slugSubscriptions, robotId, slug2) {
+  const handlers = /* @__PURE__ */ new Set();
+  const unlistenEvent = channel.on("datapoint", (frame) => {
+    const event = frame;
+    if (event.robot_id !== robotId || event.slug !== slug2) return;
+    for (const handler of handlers) handler.onEvent(event);
+  });
+  const slugHandle = slugSubscriptions.acquire(robotId, slug2, {
+    onSubscribeError(error) {
+      for (const handler of handlers) handler.onError?.(error);
+    },
+    onAuthFailed(error) {
+      for (const handler of handlers) handler.onError?.(error);
+    }
+  });
+  return { handlers, unlistenEvent, slugHandle };
+}
+function historyQueryString(options) {
+  const params = new URLSearchParams();
+  params.set("from", options.from);
+  if (options.to !== void 0) params.set("to", options.to);
+  if (options.limit !== void 0) params.set("limit", String(options.limit));
+  if (options.aggregate) {
+    params.set("window", options.aggregate.window);
+    params.set("agg", options.aggregate.agg);
+    if (options.aggregate.field !== void 0) params.set("field", options.aggregate.field);
+  }
+  return params.toString();
+}
+function createDatapointsApi(http, channel, slugSubscriptions) {
+  const registry = /* @__PURE__ */ new Map();
+  async function history(robotId, slug2, options) {
+    const query = historyQueryString(options);
+    const result = await http.request(
+      `/api/robots/${pathSegment(robotId)}/datapoints/${pathSegment(slug2)}/history?${query}`,
+      {}
+    );
+    return result;
+  }
+  return {
+    async get(robotId, slug2) {
+      const value = await http.request(`/api/robots/${pathSegment(robotId)}/datapoints/${pathSegment(slug2)}`, {});
+      return value;
+    },
+    history,
+    subscribe(robotId, slug2, handlers) {
+      const key = keyOf(robotId, slug2);
+      let state = registry.get(key);
+      if (!state) {
+        state = createKeyState(channel, slugSubscriptions, robotId, slug2);
+        registry.set(key, state);
+      }
+      state.handlers.add(handlers);
+      let active = true;
+      return {
+        unsubscribe() {
+          if (!active) return;
+          active = false;
+          const current = registry.get(key);
+          if (!current) return;
+          current.handlers.delete(handlers);
+          if (current.handlers.size > 0) return;
+          current.unlistenEvent();
+          current.slugHandle.release();
+          registry.delete(key);
+        }
+      };
+    }
+  };
+}
+
+// src/job-subscriptions.ts
+function keyOf2(robotId, slug2) {
+  return `${robotId} ${slug2}`;
+}
+function createKeyState2(channel, slugSubscriptions, robotId, slug2) {
+  const handlers = /* @__PURE__ */ new Set();
+  const unlistenEvent = channel.on("job", (frame) => {
+    const event = frame;
+    if (event.robot_id !== robotId || event.slug !== slug2) return;
+    for (const handler of handlers) handler.onJob(event);
+  });
+  const slugHandle = slugSubscriptions.acquire(robotId, slug2, {
+    onSubscribeError(error) {
+      for (const handler of handlers) handler.onError?.(error);
+    },
+    onAuthFailed(error) {
+      for (const handler of handlers) handler.onError?.(error);
+    }
+  });
+  return { handlers, unlistenEvent, slugHandle };
+}
+function createJobSubscriptions(channel, slugSubscriptions) {
+  const registry = /* @__PURE__ */ new Map();
+  return {
+    subscribe(robotId, slug2, handlers) {
+      const key = keyOf2(robotId, slug2);
+      let state = registry.get(key);
+      if (!state) {
+        state = createKeyState2(channel, slugSubscriptions, robotId, slug2);
+        registry.set(key, state);
+      }
+      state.handlers.add(handlers);
+      let active = true;
+      return {
+        unsubscribe() {
+          if (!active) return;
+          active = false;
+          const current = registry.get(key);
+          if (!current) return;
+          current.handlers.delete(handlers);
+          if (current.handlers.size > 0) return;
+          current.unlistenEvent();
+          current.slugHandle.release();
+          registry.delete(key);
+        }
+      };
+    }
+  };
+}
+
+// src/jobs.ts
+function createJobsApi(http) {
+  return {
+    async list(robotId) {
+      const response = await http.request(`/api/robots/${pathSegment(robotId)}/jobs`, {});
+      return response.jobs;
+    }
+  };
+}
+
+// src/publishers.ts
+function createPublishersApi(transport) {
+  return {
+    async publish(robotId, slug2, message, options) {
+      await transport.publish(robotId, slug2, message, options);
+    }
+  };
+}
+
+// src/realtime.ts
+var WS_OPEN = 1;
+var RealtimeChannel = class {
+  #options;
+  #socket = null;
+  #opening = false;
+  #authenticated = false;
+  #closedByCaller = false;
+  #backoffAttempt = 0;
+  #reconnectTimer = null;
+  #reauthAttempted = false;
+  #identity = null;
+  #connectionEpoch = 0;
+  #frameListeners = /* @__PURE__ */ new Map();
+  #readyListeners = /* @__PURE__ */ new Set();
+  #authFailedListeners = /* @__PURE__ */ new Set();
+  constructor(options) {
+    this.#options = options;
+  }
+  get isReady() {
+    return this.#authenticated;
+  }
+  get identity() {
+    return this.#identity;
+  }
+  /**
+   * Increments on every successful authentication (first connect and every
+   * reconnect). A command sent on one physical socket can only ever be
+   * answered on that socket — comparing the epoch captured at send time
+   * against the current one is how a caller (see `commands.ts`) tells "still
+   * waiting on the connection it was sent over" from "that connection is
+   * gone and a new one has taken its place", the moment it happens rather
+   * than after a timeout elapses.
+   */
+  get connectionEpoch() {
+    return this.#connectionEpoch;
+  }
+  /**
+   * Opens the socket if not already open/opening. Idempotent.
+   *
+   * `#opening` closes a real race: `#open()` is async and does not assign
+   * `#socket` until *after* `await credentials.token()` — so two `connect()`
+   * calls issued before that await settles (e.g. a `subscribe()` and a
+   * command in the same tick, or two calls in a `Promise.all`) both used to
+   * see `#socket` as unset and both proceed, opening two physical sockets.
+   * Each socket's own `auth_ok` bumps `connectionEpoch`, so the second
+   * socket authenticating made `sendCommand`'s dead-connection watch treat
+   * the *first* socket — which was fine, and may already have carried a
+   * command — as replaced, failing it `command_outcome_unknown` for a
+   * connection that never actually died. The orphaned first socket was also
+   * never closed: `close()`/`logout()` only ever reach whichever socket
+   * `#socket` currently points to. `#opening` is set as the very first
+   * statement inside `#open()` (not here — `#open()` is also called
+   * directly from the reconnect timer and the re-auth retry, and both need
+   * the same protection against a `connect()` landing in their own async
+   * gap), so it is already true by the time any *synchronous* second caller
+   * runs, because `void this.#open()` executes an async function's body up
+   * to its first `await` immediately, not on a later microtask.
+   */
+  connect() {
+    if (this.#socket || this.#reconnectTimer || this.#opening) return;
+    this.#closedByCaller = false;
+    void this.#open();
+  }
+  /**
+   * Sends a frame only once the current socket has actually authenticated —
+   * otherwise a silent no-op (nothing server-side to address). Checking the
+   * socket's own `readyState` in addition to the channel-level
+   * `#authenticated` flag is deliberate belt-and-suspenders: `#authenticated`
+   * is set by whichever socket's `auth_ok` arrives, so if `#socket` were ever
+   * reassigned without a matching reset (the `#opening` race above was one
+   * way that could happen), a frame could otherwise be sent into a socket
+   * that never authenticated at all.
+   */
+  send(frame) {
+    if (this.#authenticated && this.#socket?.readyState === WS_OPEN) this.#socket.send(JSON.stringify(frame));
+  }
+  /** Registers a listener for one frame `type` (e.g. `'datapoint'`, `'subscribe_error'`). */
+  on(type, handler) {
+    let set = this.#frameListeners.get(type);
+    if (!set) {
+      set = /* @__PURE__ */ new Set();
+      this.#frameListeners.set(type, set);
+    }
+    set.add(handler);
+    return () => set.delete(handler);
+  }
+  /**
+   * Fires once now if the channel is already authenticated, and again after
+   * every future (re)authentication. This is how a subscription (re)sends
+   * its `subscribe` frame without special-casing "already connected" itself.
+   */
+  onReady(fn) {
+    this.#readyListeners.add(fn);
+    if (this.#authenticated) queueMicrotask(fn);
+    return () => this.#readyListeners.delete(fn);
+  }
+  /** Fires when authentication fails in a way that will not be retried (see `#handleAuthError`). */
+  onAuthFailed(fn) {
+    this.#authFailedListeners.add(fn);
+    return () => this.#authFailedListeners.delete(fn);
+  }
+  /** Closes the socket and stops reconnecting. */
+  close() {
+    this.#closedByCaller = true;
+    if (this.#reconnectTimer) {
+      clearTimeout(this.#reconnectTimer);
+      this.#reconnectTimer = null;
+    }
+    this.#authenticated = false;
+    this.#socket?.close();
+    this.#socket = null;
+  }
+  async #open() {
+    this.#opening = true;
+    const WebSocketCtor = this.#options.WebSocket;
+    if (!WebSocketCtor) {
+      this.#opening = false;
+      this.#failAuth(new FleetlessError("no_websocket", "No WebSocket implementation is available in this environment."));
+      return;
+    }
+    let token;
+    try {
+      token = await this.#options.credentials.token();
+    } catch (error) {
+      this.#opening = false;
+      this.#failAuth(error instanceof FleetlessError ? error : new FleetlessError("no_session", "Could not obtain a credential."));
+      return;
+    }
+    if (!token) {
+      this.#opening = false;
+      this.#failAuth(new FleetlessError("no_session", "Not authenticated \u2014 call auth.login() before subscribing."));
+      return;
+    }
+    const socket = new WebSocketCtor(this.#options.url);
+    this.#socket = socket;
+    this.#opening = false;
+    this.#authenticated = false;
+    socket.onopen = () => {
+      const authFrame = { type: "auth", token };
+      socket.send(JSON.stringify(authFrame));
+    };
+    socket.onmessage = (event) => this.#handleMessage(event.data);
+    socket.onclose = () => this.#handleClose();
+    socket.onerror = () => {
+    };
+  }
+  #handleMessage(raw) {
+    let frame;
+    try {
+      frame = JSON.parse(raw);
+    } catch {
+      return;
+    }
+    if (typeof frame?.type !== "string") return;
+    if (frame.type === "auth_ok") {
+      this.#handleAuthOk(frame);
+      return;
+    }
+    if (frame.type === "auth_error") {
+      void this.#handleAuthError(frame);
+      return;
+    }
+    this.#frameListeners.get(frame.type)?.forEach((handler) => handler(frame));
+  }
+  #handleAuthOk(frame) {
+    this.#authenticated = true;
+    this.#identity = frame.identity;
+    this.#backoffAttempt = 0;
+    this.#reauthAttempted = false;
+    this.#connectionEpoch += 1;
+    this.#readyListeners.forEach((fn) => fn());
+  }
+  async #handleAuthError(frame) {
+    if (frame.code === "token_expired" && !this.#reauthAttempted) {
+      this.#reauthAttempted = true;
+      try {
+        await this.#options.credentials.handleExpired();
+        this.#socket?.close();
+        this.#socket = null;
+        void this.#open();
+        return;
+      } catch (refreshError) {
+        this.#failAuth(refreshError instanceof FleetlessError ? refreshError : new FleetlessError(frame.code, frame.message));
+        return;
+      }
+    }
+    this.#failAuth(new FleetlessError(frame.code, frame.message));
+  }
+  #failAuth(error) {
+    this.#closedByCaller = true;
+    this.#socket?.close();
+    this.#socket = null;
+    this.#authenticated = false;
+    this.#authFailedListeners.forEach((fn) => fn(error));
+  }
+  #handleClose() {
+    this.#authenticated = false;
+    this.#socket = null;
+    if (this.#closedByCaller) return;
+    this.#scheduleReconnect();
+  }
+  #scheduleReconnect() {
+    const initial = this.#options.initialBackoffMs ?? 500;
+    const max = this.#options.maxBackoffMs ?? 3e4;
+    const delay = Math.min(initial * 2 ** this.#backoffAttempt, max);
+    this.#backoffAttempt += 1;
+    this.#reconnectTimer = setTimeout(() => {
+      this.#reconnectTimer = null;
+      void this.#open();
+    }, delay);
+  }
+};
+
+// src/services.ts
+var DEFAULT_RESULT_TIMEOUT_MS = 3e4;
+function isTerminal(state) {
+  return state === "succeeded" || state === "failed" || state === "cancelled" || state === "lost";
+}
+function unwrap(job2) {
+  if (job2.state === "succeeded") return job2.result;
+  const error = job2.error;
+  throw new FleetlessError(
+    error?.code ?? job2.state,
+    error?.message ?? `The service call ended in state '${job2.state}'.`,
+    error?.details !== void 0 ? { details: error.details } : void 0
+  );
+}
+function createServicesApi(transport, jobSubscriptions) {
+  return {
+    async call(robotId, slug2, params, options = {}) {
+      const timeoutMs = resolveLocalWaitMs(options, DEFAULT_RESULT_TIMEOUT_MS);
+      const deadline = Date.now() + timeoutMs;
+      const initial = await transport.invoke(robotId, slug2, params, { timeoutMs, patienceMs: options.patienceMs });
+      const initialJob = initial.job;
+      if (!initialJob) {
+        throw new FleetlessError("unexpected_response", `The server accepted the call to '${slug2}' but returned no job to track.`);
+      }
+      if (isTerminal(initialJob.state)) return unwrap(initialJob);
+      const remainingMs = Math.max(0, deadline - Date.now());
+      if (remainingMs === 0) {
+        throw new FleetlessError("command_timeout", `Service '${slug2}' did not reach a terminal state within ${timeoutMs}ms.`);
+      }
+      return new Promise((resolve, reject) => {
+        let settled = false;
+        const timer = setTimeout(() => {
+          settle(
+            () => reject(new FleetlessError("command_timeout", `Service '${slug2}' did not reach a terminal state within ${timeoutMs}ms.`))
+          );
+        }, remainingMs);
+        const subscription = jobSubscriptions.subscribe(robotId, slug2, {
+          onJob(event) {
+            if (event.job.id !== initialJob.id || !isTerminal(event.job.state)) return;
+            settle(() => {
+              try {
+                resolve(unwrap(event.job));
+              } catch (error) {
+                reject(error);
+              }
+            });
+          },
+          onError(error) {
+            settle(() => reject(error));
+          }
+        });
+        function settle(fn) {
+          if (settled) return;
+          settled = true;
+          clearTimeout(timer);
+          subscription.unsubscribe();
+          fn();
+        }
+      });
+    }
+  };
+}
+
+// src/slug-subscriptions.ts
+function keyOf3(robotId, slug2) {
+  return `${robotId} ${slug2}`;
+}
+function createSlugSubscriptions(channel) {
+  const registry = /* @__PURE__ */ new Map();
+  channel.on("subscribe_error", (frame) => {
+    const error = frame;
+    const state = registry.get(keyOf3(error.robot_id, error.slug));
+    if (!state) return;
+    const fleetlessError = new FleetlessError(error.code, error.message);
+    for (const callbacks of state.callbacks) callbacks.onSubscribeError(fleetlessError);
+  });
+  channel.onAuthFailed((error) => {
+    for (const state of registry.values()) {
+      for (const callbacks of state.callbacks) callbacks.onAuthFailed(error);
+    }
+  });
+  return {
+    acquire(robotId, slug2, callbacks) {
+      const key = keyOf3(robotId, slug2);
+      let state = registry.get(key);
+      if (!state) {
+        const unlistenReady = channel.onReady(() => {
+          const frame = { type: "subscribe", robot_id: robotId, slug: slug2 };
+          channel.send(frame);
+        });
+        state = { count: 0, callbacks: /* @__PURE__ */ new Set(), unlistenReady };
+        registry.set(key, state);
+      }
+      state.count += 1;
+      state.callbacks.add(callbacks);
+      channel.connect();
+      let released = false;
+      return {
+        release() {
+          if (released) return;
+          released = true;
+          const current = registry.get(key);
+          if (!current) return;
+          current.callbacks.delete(callbacks);
+          current.count -= 1;
+          if (current.count > 0) return;
+          current.unlistenReady();
+          registry.delete(key);
+          const frame = { type: "unsubscribe", robot_id: robotId, slug: slug2 };
+          channel.send(frame);
+        }
+      };
+    }
+  };
+}
+
+// src/token-store.ts
+var InMemoryTokenStore = class {
+  #session = null;
+  load() {
+    return this.#session;
+  }
+  save(session) {
+    this.#session = session;
+  }
+};
+
+// src/client.ts
+function createClient(options) {
+  if (options.serverKey !== void 0 && options.tokenStore !== void 0) {
+    throw new Error(
+      "createClient: pass either `tokenStore` (end-user login) or `serverKey` (a server-side caller), not both."
+    );
+  }
+  const config = Object.freeze({
+    apiUrl: options.apiUrl,
+    appIdentifier: options.appIdentifier,
+    realtimeUrl: options.realtimeUrl ?? deriveRealtimeUrl(options.apiUrl)
+  });
+  const fetchImpl = options.fetch ?? globalThis.fetch?.bind(globalThis);
+  if (!fetchImpl) {
+    throw new Error("createClient: no global `fetch` is available in this environment \u2014 pass one explicitly.");
+  }
+  const webSocketImpl = options.WebSocket ?? globalThis.WebSocket;
+  let auth;
+  let http;
+  let credentials;
+  if (options.serverKey !== void 0) {
+    credentials = new ServerKeyCredentials(options.serverKey);
+    http = new HttpClient({ baseUrl: config.apiUrl, fetch: fetchImpl, credentials });
+    auth = createServerKeyAuth(http, config.appIdentifier);
+  } else {
+    const tokenStore = options.tokenStore ?? new InMemoryTokenStore();
+    http = new HttpClient({ baseUrl: config.apiUrl, fetch: fetchImpl, credentials: noCredentials });
+    credentials = new SessionCredentials(http, tokenStore);
+    http.setCredentials(credentials);
+    auth = createSessionAuth(http, tokenStore, config.appIdentifier);
+  }
+  const channel = new RealtimeChannel({ url: config.realtimeUrl, WebSocket: webSocketImpl, credentials });
+  const slugSubscriptions = createSlugSubscriptions(channel);
+  const datapoints = createDatapointsApi(http, channel, slugSubscriptions);
+  const commandTransport = createRealtimeCommandTransport(channel);
+  const jobSubscriptions = createJobSubscriptions(channel, slugSubscriptions);
+  const actions = createActionsApi(commandTransport, jobSubscriptions);
+  const services = createServicesApi(commandTransport, jobSubscriptions);
+  const publishers = createPublishersApi(commandTransport);
+  const cameras = createCamerasApi(http);
+  const jobs = createJobsApi(http);
+  const assets = createAssetsApi(http);
+  if (options.serverKey === void 0) {
+    const baseLogout = auth.logout.bind(auth);
+    auth = {
+      ...auth,
+      async logout() {
+        const result = await baseLogout();
+        channel.close();
+        return result;
+      }
+    };
+  }
+  return {
+    config,
+    auth,
+    datapoints,
+    actions,
+    services,
+    publishers,
+    cameras,
+    jobs,
+    assets,
+    close() {
+      channel.close();
+    }
+  };
+}
+function deriveRealtimeUrl(apiUrl) {
+  const url = new URL(apiUrl);
+  url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+  url.pathname = `${url.pathname.replace(/\/$/, "")}/realtime`;
+  return url.toString();
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  FleetlessError,
+  InMemoryTokenStore,
+  SDK_ERROR_CODES,
+  createClient,
+  parameterInvalidDetails
+});