@fleetless/sdk 3.0.0 → 3.0.1

package/dist/index.cjs

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: MIT
 "use strict";
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
@@ -440,7 +441,7 @@ function createAssetsApi(http) {
   };
 }
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_87d1585beff942190ebb8b5dc4e89225/node_modules/@fleetless/contracts/dist/common.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/common.js
 var import_zod = require("zod");
 var SLUG_RULE = "A name is lower-case: it starts with a letter, continues with letters and digits, and joins further words with a single underscore \u2014 `battery_voltage`. Capitals, dashes, dots, spaces, a leading digit and a doubled or trailing underscore are all refused.";
 var slug = import_zod.z.string().min(2).max(63).regex(/^[a-z][a-z0-9]*(?:_[a-z0-9]+)*$/, SLUG_RULE);
@@ -464,7 +465,7 @@ var applyError = import_zod.z.object({
   details: import_zod.z.record(import_zod.z.string(), import_zod.z.unknown()).optional()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_87d1585beff942190ebb8b5dc4e89225/node_modules/@fleetless/contracts/dist/mcp.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/mcp.js
 var import_zod2 = require("zod");
 function mcpAppEndpointPath(appIdentifier2) {
   return `/mcp/${appIdentifier2}`;
@@ -513,10 +514,10 @@ var mcpRolePreviewResponse = import_zod2.z.object({
 });
 var MCP_ASSET_LINK_TTL_MS = 15 * 60 * 1e3;
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_87d1585beff942190ebb8b5dc4e89225/node_modules/@fleetless/contracts/dist/protocol.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/protocol.js
 var import_zod8 = require("zod");
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_87d1585beff942190ebb8b5dc4e89225/node_modules/@fleetless/contracts/dist/assets.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/assets.js
 var import_zod3 = require("zod");
 var assetKind = import_zod3.z.enum(["urdf", "mesh", "texture", "other"]);
 var asset = import_zod3.z.object({
@@ -531,7 +532,7 @@ var asset = import_zod3.z.object({
    * against their own workspace, and matching is the whole job when a sync
    * comes back incomplete.
    *
-   * **The naming rule for a file nothing in the URDF names (W7a, D2).** A
+   * **The naming rule for a file nothing in the URDF names.** A
    * `.dae` carries its own image references — `<init_from>textures/skin.png`
    * — resolved by the renderer against *the `.dae`'s own directory*, and no
    * `package://` URI for them appears anywhere in the URDF. The rule is:
@@ -539,12 +540,11 @@ var asset = import_zod3.z.object({
    *     name = the .dae's package:// URI, directory part,
    *            joined with the internal reference, normalized.
    *
-   * So `package://rx1_description/meshes/arm.dae` referencing
+   * So `package://robot_description/meshes/arm.dae` referencing
    * `textures/skin.png` uploads as
-   * `package://rx1_description/meshes/textures/skin.png`.
+   * `package://robot_description/meshes/textures/skin.png`.
    *
-   * **This is the design's single point of failure and it is stated before
-   * anything is built against it.** three.js resolves that internal reference
+   * **Renderers depend on this rule holding.** three.js resolves that internal reference
    * relative to wherever it loaded the `.dae` from and asks the loading
    * manager for the result; the client can only answer if the asset's name
    * still carries the same **relative tail** (`textures/skin.png`) that the
@@ -555,9 +555,8 @@ var asset = import_zod3.z.object({
    *
    * A reference that escapes its package (`../../etc/passwd`) is **not**
    * renamed into something harmless — it is refused at the producer, by the
-   * same containment check W7's K2 fix applied to `package://` resolution.
-   * Two identical rules, one of which is enforced and one of which is
-   * documented, is how W7's traversal happened in the first place.
+   * same containment check that guards `package://` resolution. Two identical
+   * rules, one enforced and one only documented, is how a traversal gets in.
    */
   name: import_zod3.z.string().min(1).max(500).meta({
     description: "What the robot called it \u2014 for a mesh, the `package://` URI the URDF references, verbatim, which is the only string a developer can match against their own workspace. A file the URDF never names (an image a `.dae` loads for itself) is named by joining the mesh's own directory with that internal reference."
@@ -591,18 +590,17 @@ var urdfCompleteness = import_zod3.z.object({
     description: "How many distinct meshes the URDF references."
   }),
   /**
-   * **Was fehlt, und wovon (W9b, DEF-081).**
+   * **What is missing, and what kind of thing it was.**
    *
-   * Vorher ein blankes `string[]`. Die Console meldete daraufhin *„N meshes
-   * missing from the workspace"* — auch für eine fehlende **Textur**, während
-   * `mesh_count` daneben eine andere Zahl nannte: zwei Angaben über denselben
-   * Gegenstand, die einander widersprechen.
+   * Each entry carries its element rather than only its URI. Without that a
+   * client can only report every entry as a missing mesh, which contradicts
+   * `mesh_count` printed beside it — two statements about the same subject
+   * that disagree.
    *
-   * Die Cloud wusste es die ganze Zeit: `extractReferencesByElement` markiert
-   * jede Referenz mit ihrem Element und `buildAssetListResponse` warf die
-   * Markierung wieder weg. **Die Antwort im Client zu raten wäre genau die
-   * „neue Kopie", die die Registerzeile ausdrücklich ablehnt** — eine zweite
-   * Herleitung derselben Tatsache, die von der ersten abweichen kann.
+   * The producer knows the element when it extracts the reference, so it
+   * travels with it. A client that re-derived it from the file extension
+   * would be a second derivation of the same fact, free to diverge from the
+   * first.
    */
   missing: import_zod3.z.array(import_zod3.z.object({
     uri: import_zod3.z.string().min(1).max(500).meta({
@@ -650,23 +648,20 @@ var assetFailure = import_zod3.z.object({
     description: "Why it failed. `unresolvable` means the reference names nothing the producer can find or may read, and is **permanent** \u2014 the only kind reconciliation may treat as gone. `upload_failed` means the bytes exist and the transfer did not succeed, `refused` means it was never attempted because a producer-side ceiling was hit, and `too_large` means it exceeds the upload limit and carries both numbers in `details`."
   }),
   /**
-   * **Die zwei Zahlen, und warum `too_large` eine eigene Art ist (W9b).**
+   * **The two numbers, and why `too_large` is a kind of its own.**
    *
-   * `refused` bedeutet *„nie versucht, weil eine Decke des Erzeugers erreicht
-   * wurde"* — das passt auf eine Datei, die wegen ihrer Größe gar nicht erst
-   * gelesen wurde, **und ebenso auf die Sammel-Sentinel**, mit der ein Sync
-   * aufhört, einzelne Fehler zu benennen. Beides unter eine Art zu legen wäre
-   * derselbe Fehler, den W9a eine Welle zuvor ausgeräumt hat: zwei Fakten auf
-   * einem Schlüssel, von denen jeder den anderen überschreibt.
+   * `refused` means *never attempted, because a producer-side ceiling was
+   * hit*. That fits a file skipped for its size **and** the single collective
+   * entry a sync emits when it stops naming individual failures. Filing both
+   * under one kind puts two facts on one key, each overwriting the other.
    *
-   * Und ein Grund ohne Zahlen ist kein Grund, mit dem jemand etwas anfangen
-   * kann. *„Zu groß"* beantwortet nicht, ob das Mesh zu verkleinern ist oder
-   * die Grenze zu heben — `limit_bytes` und `size_bytes` tun es.
+   * A reason without numbers is not one a caller can act on. *"Too large"*
+   * does not answer whether to shrink the mesh or raise the limit;
+   * `limit_bytes` and `size_bytes` do.
    *
-   * Abwesend für jede andere Art — ein erzwungenes `details: null` auf jedem
-   * `unresolvable` kauft nichts. Die Paarung ist unten **erzwungen**, nicht
-   * beschrieben: ein Feld, dessen Regel nur im Kommentar steht, ist eine
-   * Bitte.
+   * Absent for every other kind — a forced `details: null` on every
+   * `unresolvable` buys nothing. The pairing is **enforced** below, not merely
+   * described: a field whose rule lives only in a comment is a request.
    */
   details: assetTooLargeDetails.nullish().meta({
     description: "The two numbers behind a `too_large` failure, and absent for every other kind \u2014 a forced `null` on every `unresolvable` entry buys nothing. The pairing is enforced, not merely described."
@@ -693,48 +688,28 @@ var assetSyncStatus = import_zod3.z.object({
     description: "How many files this sync set out to transfer. It is `0` until the producer has finished working out what there is."
   }),
   /**
-   * **Every entry says *why*, because reconciliation could not work without
-   * it and a developer could not read it without it** (W7a review, André's
-   * decision to fix rather than defer).
+   * **Every entry says *why*.**
    *
-   * It was a flat `string[]`, and **six producers wrote three different facts
-   * into it indistinguishably**: a reference that resolves to nothing in the
-   * workspace, a file that exists and whose transfer failed, and — since R9's
-   * ceiling — one that was never attempted at all. The cost was paid twice
-   * over. Reconciliation cannot tell *"no longer referenced"* from
-   * *"referenced and not delivered"*, so N14 had to decline reconciling **any**
-   * partial sync, leaving legitimately-removed assets stored and charged until
-   * the next clean one. And the console prints the whole array under *"these
-   * meshes could not be resolved"*, so a URDF upload failure — which arrives
-   * as the literal `robot_description` — is shown to a developer as a mesh
-   * they should go and find.
+   * A flat `string[]` cannot carry three different facts distinguishably: a
+   * reference that resolves to nothing in the workspace, a file that exists
+   * and whose transfer failed, and one that was never attempted at all.
    *
-   * `unresolvable` is the only kind reconciliation may drop: it is the only
-   * one that means *this will not come back*. `upload_failed` and `refused`
-   * both mean *we meant to provide this and did not*, which is the distinction
-   * the union needs and the field could not carry.
+   * The distinction is what makes reconciliation possible. `unresolvable` is
+   * the only kind that means *this will not come back*, so it is the only kind
+   * an unreferenced-asset sweep may act on. `upload_failed` and `refused` both
+   * mean *this was meant to be provided and was not*, and dropping the asset
+   * on either would delete something still wanted.
    *
-   * **Bounded, and the bound is a rule this file already wrote down one field
-   * over** (Kassandra-W7a, W7a review). `asset.name` is `max(500)`; the same
-   * names travelling here had no per-entry cap and no array cap at all.
+   * **Bounded, per entry and in total.** One mesh reference can expand into a
+   * list bounded only by the text of the `.dae` it points at, and the whole
+   * status travels in one WebSocket frame with a maximum payload. Without a
+   * cap the outcome is not a dropped frame but the robot's socket closed
+   * mid-sync by a file in its own workspace. At most 1000 entries of at most
+   * 500 bytes is about 0.5 MiB of names, comfortably inside that frame.
    *
-   * Why it matters became reachable in W7a. Before R6 an unresolvable
-   * reference was silently dropped, so this array could only grow with files
-   * that existed and failed to upload — bounded by the workspace. Once a
-   * `.dae`'s internal references are reported, **one mesh reference expands
-   * into a list bounded only by that file's own text.** Measured: a
-   * 2,120,745-byte `.dae` with 17,331 unresolvable `<init_from>` refs produces
-   * a terminal frame of 2,097,184 bytes — **32 bytes over
-   * `MAX_WS_PAYLOAD_BYTES`** — and `ws` enforces `maxPayload` before the frame
-   * is delivered, so the outcome is not a dropped frame but **the robot's
-   * socket closed, mid-sync, by a file in its own workspace.**
-   *
-   * A producer that hits its own ceiling reports **one** entry saying so
-   * rather than growing the list — the discipline gate step 5 already demands
-   * of the upload rate limit: *fail naming the limit, rather than silently
-   * reporting resolvable meshes as missing.*
-   *
-   * 1000 x 500 bytes is ~0.5 MiB of names, comfortably inside a 2 MiB frame.
+   * A producer that reaches its own ceiling reports **one** entry saying so
+   * rather than growing the list: fail naming the limit, rather than silently
+   * reporting resolvable meshes as missing.
    */
   failed: import_zod3.z.array(assetFailure).max(1e3).meta({
     description: "What could not be provided, one entry per reference, each saying why. Required rather than optional: a sync that quietly drops three meshes and reports success moves the failure into somebody's renderer, where it shows up as a robot with missing limbs and no cause. At most `1000` entries \u2014 a producer at its own ceiling reports one entry saying so rather than growing the list."
@@ -754,14 +729,13 @@ var assetListResponse = import_zod3.z.object({
     description: "Every asset stored for this robot: the URDF, the meshes it references, and the textures those paint with."
   }),
   /**
-   * Der gerade laufende Sync, oder `null` (W9b, DEF-147).
+   * The sync running right now, or `null`.
    *
-   * **Der Fall, für den das hier steht, ist der Neuladen-Fall.** Die Console
-   * hielt die `sync_id` nur im Speicher; ein Reload verlor die Fortschritts-
-   * anzeige, und der Zustand war serverseitig da, über
-   * `GET .../assets/sync/<id>` abfragbar — nur erreichte ihn niemand mehr, der
-   * die id nicht aufgehoben hatte. Eine Seite, die frisch lädt, drückt keinen
-   * Knopf; sie fragt diese Liste. Also muss die Liste es sagen.
+   * **This field exists for the reload case.** A client that holds the
+   * `sync_id` only in memory loses its progress display on a refresh, and the
+   * state is still there server-side under `GET .../assets/sync/<id>` —
+   * unreachable to anyone who did not keep the id. A page that loads fresh
+   * presses no button; it asks this list, so this list has to say.
    */
   active_sync: assetSyncStatus.nullable().meta({
     description: "The sync running right now, or `null`. It is on this list so a page that reloads and has lost the sync id can still show progress \u2014 a freshly loaded page presses no button, it asks this list."
@@ -771,30 +745,20 @@ var assetListResponse = import_zod3.z.object({
   }),
   /**
    * What the connected bridge says it *could* transfer, which is deliberately
-   * separate from what has been transferred (§4.6: the bridge "meldet nur
-   * Verfügbarkeit"). `null` when no bridge is connected — distinct from
-   * `false`, because "no robot is online to ask" and "the robot has no URDF"
-   * send a developer to two different places.
-   *
-   * **All three states are reachable as of W7a (R7).** They were not: the bridge
-   * used to report availability from a subscription callback, which fires only
-   * when a publisher *sends* something, so it could notice presence and never
-   * absence — a robot that lost its URDF left the cloud holding the last thing
-   * it heard, forever, and `true` was sticky. The fix is an **active**
-   * `count_publishers` query on the bridge's own timer.
+   * separate from what has been transferred. `null` when no bridge is
+   * connected — distinct from `false`, because "no robot is online to ask" and
+   * "the robot has no URDF" send a developer to two different places.
    *
-   * **What a consumer still needs to know is the clock, not the gap.** An
-   * ungraceful loss — the publisher process killed rather than shut down — is
-   * noticed on **DDS's liveliness timeout**, not on the bridge's check
-   * interval. Measured against a real bridge: ~1.6 s when the publisher calls
-   * `destroy_node()`, **~19 s when it is `SIGKILL`ed**. So `true` can outlive
-   * the truth by some seconds after a crash, and no amount of polling on our
-   * side shortens it.
+   * The bridge answers by actively counting publishers on its own timer, so
+   * both the appearance and the disappearance of a robot description are
+   * noticed. A callback-driven answer can only see presence.
    *
-   * The sticky-`true` gap was found by Rosie-W7 checking her own work against
-   * the camera-health row of identical shape; the DDS clock was measured by
-   * Rosie-W7a closing it, and this comment was still describing the gap a wave
-   * after it was fixed (Momus-W7a, W7a review).
+   * **What a consumer needs to know is the clock.** An ungraceful loss — the
+   * publisher process killed rather than shut down — is noticed on DDS's
+   * liveliness timeout, not on the bridge's check interval. A clean
+   * `destroy_node()` is visible in a second or two; a killed process can take
+   * around twenty. So `true` can outlive the truth by some seconds after a
+   * crash, and no amount of polling shortens it.
    */
   urdf_available: import_zod3.z.boolean().nullable().meta({
     description: 'What the connected bridge says it *could* transfer, which is deliberately separate from what has been transferred. `null` when no bridge is connected \u2014 distinct from `false`, because "no robot is online to ask" and "the robot has no URDF" send a developer to two different places. After a publisher is killed rather than shut down this can read `true` for some seconds, on the underlying DDS liveliness timeout rather than on any check made here.'
@@ -807,14 +771,14 @@ var missingAssetQuery = import_zod3.z.object({
 }).meta({ description: "The one optional parameter of the missing-asset placeholder; it names the reference in the refusal." });
 var assetSyncBusyDetails = import_zod3.z.object({
   sync_id: import_zod3.z.uuid(),
-  /** Wann er begann — damit „läuft noch" von „hängt seit einer Stunde" unterscheidbar ist. */
+  /** When it started, so "still running" is distinguishable from "stuck for an hour". */
   started_at_ms: import_zod3.z.number().int().nonnegative()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_87d1585beff942190ebb8b5dc4e89225/node_modules/@fleetless/contracts/dist/config.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/config.js
 var import_zod5 = require("zod");
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_87d1585beff942190ebb8b5dc4e89225/node_modules/@fleetless/contracts/dist/alerts.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/alerts.js
 var import_zod4 = require("zod");
 var alertRowCondition = import_zod4.z.discriminatedUnion("kind", [
   import_zod4.z.strictObject({
@@ -844,7 +808,7 @@ var datapointAlertRow = import_zod4.z.object({
   severity: alertSeverity,
   condition: alertRowCondition,
   state: alertState,
-  /** `null` only until the first evaluation writes a state; every alert is created `ok` (D2), so in practice this is set from creation onward. */
+  /** `null` only until the first evaluation writes a state; every alert is created `ok`, so in practice this is set from creation onward. */
   state_since: import_zod4.z.iso.datetime().nullable(),
   /**
    * The value at the alert's last state transition — written only when the
@@ -884,7 +848,7 @@ var putDatapointDisplayRequest = import_zod4.z.object({
   y_max: import_zod4.z.number().finite().nullable()
 }).strict();
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_87d1585beff942190ebb8b5dc4e89225/node_modules/@fleetless/contracts/dist/config.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/config.js
 var RTSP_URL_RULE = "The URL has to begin with `rtsp://` or `rtsps://` \u2014 `rtsp://cam-1.plant.local/stream1`. No other scheme is accepted: the bridge opens this with a library that would equally honour `file:`.";
 var MJPEG_URL_RULE = "The URL has to begin with `http://` or `https://` \u2014 `http://cam-1.plant.local/video.mjpg`. No other scheme is accepted: the bridge opens this with a library that would equally serve `file:`.";
 var DEVICE_PATH_RULE = "A capture device is a path under `/dev/`, and the character straight after it is a letter or a digit \u2014 `/dev/video0`, or a stable `/dev/v4l/by-id/...` symlink. Nothing outside `/dev/` is accepted: the string reaches OpenCV, which would as happily open an ordinary file.";
@@ -1124,10 +1088,9 @@ var datapointAlert = strictObject({
      * `getInsertTextForProperty` (`yaml.worker.js:8520`) takes
      * `defaultSnippets[0].body` only when a node carries **exactly one**
      * snippet, so accepting `condition` from the key list writes the bare key
-     * here where every other node this wave touched writes its whole block.
-     * The two stay anyway: the value position — a developer who has written
-     * `condition:` and pressed ⏎ — is where the question "what goes here?" is
-     * actually asked, and that is the position this wave exists to answer.
+     * here where every other node writes its whole block. The two stay anyway:
+     * the value position — a developer who has written `condition:` and pressed
+     * ⏎ — is where the question "what goes here?" is actually asked.
      * Merging them into one would buy back the key completion by deleting the
      * choice the schema deliberately does not name, which is the worse trade;
      * anyone tempted to make it should change the key-completion behaviour
@@ -1246,9 +1209,9 @@ var NUMERIC_DATAPOINT_SNIPPET = {
     /**
      * The quotes inside `unit` are part of the inserted text and are not
      * decoration. A body string is written into the document verbatim, and `%`
-     * is a YAML directive indicator: measured with `yaml` 2.9.0, `unit: %` is a
-     * **syntax error** ("Plain value cannot start with directive indicator
-     * character %") while `unit: "%"` parses to `%`. Nothing between here and
+     * is a YAML directive indicator: `unit: %` is a **syntax error** ("Plain
+     * value cannot start with directive indicator character %") while
+     * `unit: "%"` parses to `%`. Nothing between here and
      * the buffer quotes a scalar for us.
      */
     numeric: { scale: 100, unit: '"%"', decimals: 1 },
@@ -1694,15 +1657,14 @@ var cameraSource = import_zod5.z.discriminatedUnion("kind", [
        * `rosTypeName` accepts either, publish accepts either, no diagnostic
        * fires anywhere, and the bridge then subscribes with the wrong type and
        * delivers no frames. A snippet supplying a wrong answer where it could
-       * have supplied a question is this project's *check that cannot fire*,
-       * arriving through a hint the developer trusts.
+       * have supplied a question is a defect arriving through a hint the
+       * developer trusts.
        *
        * `kind: 'ros'` stays a literal, because the branch really does fix it.
        *
-       * Measured through the actual pipeline rather than assumed, because
-       * choice syntax is the one construct here that three layers must each
+       * Choice syntax is the one construct here that three layers must each
        * pass through unharmed: yaml-language-server's `stringifyObject` emits
-       * the body verbatim, and monaco-editor 0.52.2's `SnippetParser` parses
+       * the body verbatim, and monaco-editor's `SnippetParser` parses
        * `${2|a,b|}` into a placeholder carrying both options whose
        * `toString()` — the text on the buffer before anyone chooses — is the
        * first one. So a developer who tabs past this gets a document
@@ -1721,16 +1683,12 @@ var cameraSource = import_zod5.z.discriminatedUnion("kind", [
       description: "Selects the RTSP source: this camera then carries `url`, and optionally `transport` and `credentials`."
     }),
     /**
-     * Scheme-constrained deliberately. The playbook drafted `z.string().url()`
-     * here and the shipped contract was `z.string().min(1).max(2048)` — nobody
-     * recorded the change, and the W6 review found the consequence: the bridge
-     * opens these with libraries that honour `file:` and `ftp:`, so an
-     * unconstrained URL turns a configuration document into an arbitrary
-     * local-file read on the robot, with the two distinct failure codes
-     * doubling as a file-existence oracle. Spec §7.6 is ROS-pure exposure with
-     * no shell or http features; that rule came back by omission rather than
-     * by intent. The bridge re-checks this too — a robot must not become a
-     * file server because a validator changed.
+     * Scheme-constrained deliberately. The bridge opens these with libraries
+     * that honour `file:` and `ftp:`, so an unconstrained URL turns a
+     * configuration document into an arbitrary local-file read on the robot,
+     * with the two distinct failure codes doubling as a file-existence oracle.
+     * The bridge re-checks this too — a robot must not become a file server
+     * because a validator changed.
      */
     url: import_zod5.z.string().min(1).max(2048).regex(/^rtsps?:\/\//i, RTSP_URL_RULE).meta({
       description: "Where the stream lives, reached from the robot rather than from the cloud. **`rtsp://` or `rtsps://` only** \u2014 the bridge opens this with a library that would equally honour `file:`, so an unconstrained URL would turn a configuration document into arbitrary file access on the robot. The bridge re-checks the scheme itself, so a validator that changed could not make a robot serve files.",
@@ -1768,8 +1726,8 @@ var cameraSource = import_zod5.z.discriminatedUnion("kind", [
       /**
        * The host and the path this branch's own snippet body inserts, and the
        * URL its rule sentence names — one answer to "what goes here?", not a
-       * third. The sibling `rtsp` url had an `examples` from the first day and
-       * this position was the format's only silent URL (§1.1).
+       * third. Every URL position in the format carries an example; a silent
+       * one is the position a developer has to guess at.
        */
       examples: ["http://cam-1.plant.local/video.mjpg"]
     }),
@@ -1794,16 +1752,14 @@ var cameraSource = import_zod5.z.discriminatedUnion("kind", [
      * on the robot, never by the cloud.
      *
      * Constrained to `/dev/` for the same reason the `rtsp` and `mjpeg` URLs
-     * are constrained to their schemes, and it was missed the first time
-     * (Momus, W6 verification). The device string reaches
+     * are constrained to their schemes. The device string reaches
      * `cv2.VideoCapture(device)` on the robot, and OpenCV does not restrict
-     * itself to devices: measured on cv2 4.5.4, an ordinary local video file
-     * opens and its pixels are published to the cloud, and so does
-     * `http://127.0.0.1:8899/secret.jpg`. Unconstrained, this field is an
-     * arbitrary local-file read *and* an outbound fetch from inside the robot
-     * — the §7.6 violation closed for the other two source kinds, reachable
-     * through the fourth, because "it is just a device path" read like a
-     * reason not to check.
+     * itself to devices: an ordinary local video file opens and its pixels are
+     * published to the cloud, and so does an `http://` URL pointing back inside
+     * the robot's own network. Unconstrained, this field is an arbitrary
+     * local-file read *and* an outbound fetch from inside the robot — the same
+     * hole closed for the other two source kinds, reachable through the fourth,
+     * because "it is just a device path" reads like a reason not to check.
      *
      * Narrower than the URL hole in one respect worth recording: a non-media
      * file and a missing file both fail to open, so this branch never worked
@@ -1939,7 +1895,7 @@ var configState = import_zod5.z.object({
   applied_errors: import_zod5.z.array(applyError).nullable()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_87d1585beff942190ebb8b5dc4e89225/node_modules/@fleetless/contracts/dist/introspection.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/introspection.js
 var import_zod6 = require("zod");
 var rosGraphEntry = import_zod6.z.object({
   name: rosName,
@@ -1978,7 +1934,7 @@ var typeDefinition = import_zod6.z.discriminatedUnion("kind", [
   })
 ]);
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_87d1585beff942190ebb8b5dc4e89225/node_modules/@fleetless/contracts/dist/jobs.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/jobs.js
 var import_zod7 = require("zod");
 var jobState = import_zod7.z.enum(["running", "succeeded", "failed", "cancelled", "lost"]);
 var job = import_zod7.z.object({
@@ -1999,17 +1955,17 @@ var job = import_zod7.z.object({
     description: "When this job last changed, as an ISO 8601 timestamp."
   }),
   /**
-   * A monotonic counter, ascending in mint order (W7), and the **named**
-   * tiebreaker for any listing that claims an order.
+   * A monotonic counter, ascending in mint order, and the **named** tiebreaker
+   * for any listing that claims an order.
    *
    * `started_at` is not a total order: two jobs minted in the same millisecond
    * sort against each other arbitrarily, and arbitrarily means *differently on
    * each query* — so `GET /api/robots/:id/jobs`, which documents "newest
-   * first", can show one twice and the other not at all. Exactly the defect
-   * `auditEvent.seq` was added for in W6b, in a route the same wave shipped.
+   * first", can show one twice and the other not at all. `auditEvent.seq`
+   * exists for the same reason on the audit log.
    *
    * **Scoped honestly: per cloud process, per run.** Job state lives in memory
-   * (§6.1 — that is why `lost` exists at all), so this counter restarts when
+   * — that is why `lost` exists at all — so this counter restarts when
    * the cloud does, alongside the jobs it orders. Sound, because it only ever
    * orders jobs that coexist in one registry — and stated, because a reader
    * who assumed `auditEvent.seq`'s durable semantics would be wrong.
@@ -2024,14 +1980,10 @@ var job = import_zod7.z.object({
    * Present on `failed`; a human message, plus a code where one exists.
    *
    * `details` exists because a refusal that carries only prose forces every
-   * consumer to parse it. W6b shipped `job_queue_full` with a documented
-   * `{limit, queued}` payload and **nowhere to put it**: the bridge reports a
-   * full queue as a job error, this shape had no `details`, and so the numbers
-   * were formatted into the message and lost. The console then rendered a
-   * "wait for one of N to finish" alert from a shape nothing in the system
-   * produced, and its test built that shape by hand — three repos agreeing
-   * with each other about a payload none of them exchanged (Momus, W6b
-   * review).
+   * consumer to parse it. A documented payload with nowhere to put it — the
+   * bridge reports a full queue as a job error — ends up formatted into the
+   * message and lost, and every consumer then builds the structured shape by
+   * hand from its own assumption.
    *
    * Optional, because most job errors have nothing structured to add. Where a
    * code has a documented payload — `job_queue_full` has
@@ -2200,7 +2152,7 @@ var jobRunSummary = import_zod7.z.object({
   since_ms: import_zod7.z.number().int().nonnegative()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_87d1585beff942190ebb8b5dc4e89225/node_modules/@fleetless/contracts/dist/protocol.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/protocol.js
 var MAX_PATIENCE_MS = 12e4;
 var MIN_PATIENCE_MS = 1e3;
 var activeJob = import_zod8.z.object({
@@ -2214,7 +2166,7 @@ var bridgeHello = import_zod8.z.object({
   token: import_zod8.z.string().min(1),
   bridge_version: import_zod8.z.string().min(1),
   /**
-   * Every job this bridge still knows about, right now (spec §6.1, W4).
+   * Every job this bridge still knows about, right now.
    *
    * A reconnect and a restart look **identical** on the wire otherwise: same
    * token, same version, same frame. But they must end differently — after a
@@ -2229,16 +2181,9 @@ var bridgeHello = import_zod8.z.object({
    * has none — which is exactly the truth the cloud needs. A breadcrumb file
    * would only add a window in which the crash beat the write.
    *
-   * Defaulted so pre-W4 bridges still parse; they had no jobs, so the empty
-   * list is also the correct answer for them.
-   *
-   * **Renamed from `active_job_ids` in W6b**, when the entries stopped being
-   * ids. A field called `_ids` holding objects is the shape this project has
-   * repeatedly been caught by — a name that describes what the field used to
-   * carry, kept because renaming looked like churn. Nothing is deployed yet
-   * (W8 is the first deployment), so the old name is gone rather than
-   * accepted alongside the new one: two accepted spellings would have to be
-   * supported and reconciled forever, and nobody is asking for that.
+   * Defaulted, so a bridge that sends no such field still parses; a bridge
+   * with no jobs and a bridge that does not report them both mean the cloud
+   * has nothing to keep alive.
    */
   active_jobs: import_zod8.z.array(activeJob).max(500).default([])
 });
@@ -2281,21 +2226,20 @@ var cloudInvoke = import_zod8.z.object({
   job_id: import_zod8.z.uuid(),
   slug,
   /**
-   * Already validated against §4.4 rules; the bridge validates structurally.
+   * Already validated against the configuration's parameter rules; the bridge
+   * validates structurally.
    *
    * **Flat, keyed by parameter name** — `{"target_x": 1}`. The key is a key of
-   * the entry's `parameters` mapping, not a path into the message. Those were
-   * the same thing until FL-002 and are now deliberately decoupled: a
-   * parameter keeps its name when the field it fills moves in the message
-   * tree, which is the same reason a slug is not a topic name.
+   * the entry's `parameters` mapping, not a path into the message. The two are
+   * deliberately decoupled: a parameter keeps its name when the field it fills
+   * moves in the message tree, which is the same reason a slug is not a topic
+   * name.
    *
-   * Three things follow, and the last one got stronger rather than weaker:
-   * the key a caller sends is the key a rule names, so a `parameter_invalid`
-   * reports something the caller can find; the console binds one input per
-   * parameter; and a position the template does not mark with `${…}` cannot
-   * be set by any caller at all. That last one used to be a rule about what
-   * no `parameterSpec` declared. It is now structural — the value has nowhere
-   * to go.
+   * Three things follow: the key a caller sends is the key a rule names, so a
+   * `parameter_invalid` reports something the caller can find; a UI binds one
+   * input per parameter; and a position the template does not mark with
+   * `${…}` cannot be set by any caller at all, structurally — the value has
+   * nowhere to go.
    *
    * The bridge substitutes these values into the entry's `message` template
    * at its placeholder positions. It no longer unflattens a dotted path;
@@ -2303,18 +2247,17 @@ var cloudInvoke = import_zod8.z.object({
    */
   params: import_zod8.z.record(import_zod8.z.string(), import_zod8.z.unknown()),
   /**
-   * How long this one call is worth waiting for (W6b), already resolved by
-   * the cloud — the caller's `invokeRequest.patience_ms`, or
+   * How long this one call is worth waiting for, already resolved by the
+   * cloud — the caller's `invokeRequest.patience_ms`, or
    * `DEFAULT_PATIENCE_MS` when they named none.
    *
    * **Required here, optional at REST**, deliberately. At the REST edge an
    * absent value is a caller who did not care and gets the default. By the
    * time the frame is on this socket somebody has decided, and the bridge
    * must never be in the position of picking a number the cloud is already
-   * counting against — which is what two independent 15 s constants meant in
-   * practice: a bridge that gave up at 15.0 s and a cloud that gave up at
-   * 15.0 s, agreeing only by accident, with no way to tell whose deadline a
-   * caller had actually hit.
+   * counting against. Two independent constants that happen to match give up
+   * at the same moment by accident, with no way to tell whose deadline a
+   * caller actually hit.
    */
   patience_ms: import_zod8.z.number().int().min(MIN_PATIENCE_MS).max(MAX_PATIENCE_MS)
 });
@@ -2462,12 +2405,12 @@ var cloudCameraStart = import_zod8.z.object({
   room: import_zod8.z.string().min(1),
   token: import_zod8.z.string().min(1),
   /**
-   * Names **this attempt** (W6b), and is echoed in the `camera_state` that
-   * answers it.
+   * Names **this attempt**, and is echoed in the `camera_state` that answers
+   * it.
    *
-   * W6a gave `camera_state` a `cause` and said in the same comment that a
-   * cause is not a correlation. This is the other half. Start a camera, have
-   * it fail slowly, start it again: the first attempt's failure arrives while
+   * `camera_state.cause` says what kind of event a frame is; a cause is not a
+   * correlation, and this is the other half. Start a camera, have it fail
+   * slowly, start it again: the first attempt's failure arrives while
    * the second is in flight, matches on slug, and resolves the attempt it
    * knows nothing about. The viewer is then told the running stream failed,
    * for a reason belonging to an attempt that is already over.
@@ -2501,12 +2444,13 @@ var bridgeAssetProgress = import_zod8.z.object({
   total: import_zod8.z.number().int().nonnegative(),
   /**
    * **Each entry says why** — see `assetFailure` in `assets.ts` for the three
-   * kinds and why one word was not enough. The bound is `assets.ts`'s too: a
-   * `.dae` with 17,331 unresolvable internal references produced a frame 32
-   * bytes over `MAX_WS_PAYLOAD_BYTES`, and `ws` enforces that **before**
-   * delivery — so the outcome was the robot's own socket closed, mid-sync, by
-   * a file in its workspace (Kassandra-W7a). A producer at its own ceiling
-   * reports **one** `refused` entry naming the file, not one per reference.
+   * kinds and why one word is not enough. The bound is `assets.ts`'s too: a
+   * single `.dae` can carry tens of thousands of unresolvable internal
+   * references, which is enough to push this frame past
+   * `MAX_WS_PAYLOAD_BYTES`. That limit is enforced **before** delivery, so the
+   * outcome is not a dropped frame but the robot's own socket closed mid-sync
+   * by a file in its workspace. A producer at its own ceiling reports **one**
+   * `refused` entry naming the file, not one per reference.
    */
   failed: import_zod8.z.array(assetFailure).max(1e3),
   /**
@@ -2518,17 +2462,12 @@ var bridgeAssetProgress = import_zod8.z.object({
    * answers with silence is a backstop nobody can debug, and the alternative
    * on the table was to report every requested URI in `failed`. That would
    * have made `failed` mean two different things at once — *could not be
-   * resolved* and *was never attempted* — which is the one-field-two-facts
-   * defect this project has now split five times (`set`/`readable`,
-   * `truncated`/`truncated_by`, `value`/`sample_count`, `publishing`/`cause`,
-   * and camera health's own).
+   * resolved* and *was never attempted* — one field carrying two facts, each
+   * overwriting the other.
    *
    * So: `running` while work is happening, `finished` when the bridge will
    * send no more for this sync, `refused_busy` when it never started because
    * another sync was in flight. `failed` keeps its single meaning.
-   *
-   * Raised by Rosie-W7, who found the gap by asking what a second request
-   * should do rather than picking the silent option.
    */
   state: import_zod8.z.enum(["running", "finished", "refused_busy"])
 });
@@ -2544,15 +2483,13 @@ var bridgeCameraState = import_zod8.z.object({
   publishing: import_zod8.z.boolean(),
   error: import_zod8.z.object({ code: import_zod8.z.string().min(1), message: import_zod8.z.string().min(1) }).nullable(),
   /**
-   * Why this frame was sent (W6a).
+   * Why this frame was sent.
    *
    * Without it, `{publishing: false, error: null}` is sent for **three
    * different things** — an answer to `camera_stop`, a stream stopped by a
-   * configuration change, and a source that recovered — and the cloud can
-   * only tell them apart by remembering what it saw before. Deriving a cause
-   * from remembered state is precisely the inference this project keeps
-   * finding to be wrong, and W6a exists because four failures had been
-   * sharing one silence.
+   * configuration change, and a source that recovered — and the cloud can only
+   * tell them apart by remembering what it saw before. A cause derived from
+   * remembered state is a guess.
    *
    * `'command'`       this frame answers a `camera_start` / `camera_stop`.
    * `'source'`        unsolicited: the source's own health changed, whether or
@@ -2562,29 +2499,24 @@ var bridgeCameraState = import_zod8.z.object({
    *                   failure, and it must not be logged as one.
    * `'live_lost'`     publishing ended unexpectedly after it had started.
    *
-   * Note it does **not** answer "which attempt is this?" — `camera_state`
-   * still has no request id, and that remains a named deferral in cluster C.
-   * `cause` says what kind of event this is; correlation is a separate fact
-   * and giving one field both jobs would be the same mistake again.
+   * It does **not** answer "which attempt is this?" — `request_id` beside it
+   * does. `cause` says what kind of event this is; correlation is a separate
+   * fact, and giving one field both jobs would be the same mistake again.
    *
-   * Required, not optional: an absent cause would default to the reading
-   * somebody happens to assume, and every frame's sender knows its own
-   * reason. Old bridges fail validation on this frame — acceptable while
-   * nothing is deployed, and W8 is the first deployment.
+   * Required, not optional: an absent cause would default to whatever reading
+   * the receiver happens to assume, and every frame's sender knows its own
+   * reason.
    */
   cause: import_zod8.z.enum(["command", "source", "config_change", "live_lost"]),
   /**
    * When the **robot** observed this state — bridge capture time, never
-   * receive time, the same discipline `timestamp_ms` follows for samples
-   * (spec §6.3).
+   * receive time, the same discipline `timestamp_ms` follows for samples.
    *
-   * It exists because the cloud stamped `resourceHealthState.changed_at_ms`
-   * with its own `Date.now()`, and a **restatement** is by definition an old
-   * state re-sent into an empty map. So after a cloud restart every failure —
-   * including one from yesterday — was dated to the restart, in the one
-   * scenario `changed_at_ms`'s own doc comment was written for: *"a page that
-   * loads late must be able to tell a failure from a minute ago from one from
-   * yesterday"*.
+   * It exists because a cloud that stamps `resourceHealthState.changed_at_ms`
+   * with its own clock dates every **restatement** to the moment it restarted
+   * — a restatement is by definition an old state re-sent into an empty map.
+   * That destroys exactly what `changed_at_ms` is for: a page that loads late
+   * must be able to tell a failure from a minute ago from one from yesterday.
    *
    * On a restatement this carries **when the state was first observed**, not
    * when the frame was sent. A bridge that re-states a failure it has held for
@@ -2592,7 +2524,7 @@ var bridgeCameraState = import_zod8.z.object({
    */
   observed_at_ms: import_zod8.z.number().int().nonnegative(),
   /**
-   * Which request this frame answers (W6b), or `null` when it answers none.
+   * Which request this frame answers, or `null` when it answers none.
    *
    * `null` is not a gap and must not be treated as one: a `cause: 'source'`
    * frame — the unsolicited health report that makes a wrong password visible
@@ -2609,21 +2541,21 @@ var bridgeCameraState = import_zod8.z.object({
    * **The pairing rule is not in this schema, deliberately.** "Non-null iff
    * `cause === 'command'`" is a cross-field constraint; a zod `.refine()`
    * would express it at runtime and then **disappear** from the generated
-   * JSON Schema, which is what the bridge vendors. The cloud would reject
-   * frames the bridge had validated as correct — the same artifact/runtime
-   * divergence that `.default()` publishing as `required` has produced four
-   * times in this project, only pointing the other way. The rule is enforced
+   * JSON Schema, which is what a non-TypeScript bridge validates against. The
+   * cloud would reject frames the bridge had validated as correct — the same
+   * artifact-versus-runtime divergence that `.default()` publishing as
+   * `required` produces, pointing the other way. The rule is enforced
    * where the correlation is used, in the cloud's bridge frame handler, and
    * stated here so nobody has to derive it from that code.
    */
   request_id: import_zod8.z.string().min(1).max(64).nullable()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_87d1585beff942190ebb8b5dc4e89225/node_modules/@fleetless/contracts/dist/config-issues.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/config-issues.js
 var EXPOSURE_SECTIONS = ["datapoints", "actions", "services", "publishers", "cameras"];
 var EXPOSURE_SECTION_NAMES = new Set(EXPOSURE_SECTIONS);
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_87d1585beff942190ebb8b5dc4e89225/node_modules/@fleetless/contracts/dist/rest.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/rest.js
 var import_zod9 = require("zod");
 var robot = import_zod9.z.object({
   id: import_zod9.z.uuid().meta({
@@ -2763,7 +2695,7 @@ var invokeRequest = import_zod9.z.object({
     description: "The values this call needs, keyed by **parameter name** rather than by field path \u2014 so a name survives the field moving inside the message. Every parameter without a default must be present, and the bounds the configuration declares are enforced in the cloud, before anything reaches the robot."
   }),
   /**
-   * How long **this call** is worth waiting for, in milliseconds (W6b).
+   * How long **this call** is worth waiting for, in milliseconds.
    *
    * **Absent means `DEFAULT_PATIENCE_MS`** — today's behaviour, unchanged, for
    * every caller who does not care. It is optional because most callers have
@@ -2878,16 +2810,14 @@ var cameraListResponse = import_zod9.z.object({
 });
 var liveSessionResponse = import_zod9.z.object({
   /**
-   * This viewer's hold, and the **only** thing `DELETE` should be given
-   * (W6b).
+   * This viewer's hold, and the **only** thing `DELETE` should be given.
    *
-   * A hold was addressed by `{identity, robot, slug}` and nothing else, so
-   * two tabs of one logged-in user were one hold as far as the refcount could
-   * see. Closing either tab released it: the second tab kept its LiveKit
-   * connection — the token is checked at join and never again — and went on
-   * rendering a video that the robot had already stopped producing. The
-   * viewer sees a frozen picture, not an ended session, which is the failure
-   * this project rejects everywhere else.
+   * A hold addressed by `{identity, robot, slug}` alone would make two tabs of
+   * one logged-in user a single hold as far as the refcount can see. Closing
+   * either tab would release it, and the surviving tab would keep its LiveKit
+   * connection — the token is checked at join and never again — rendering a
+   * video the robot had already stopped producing. A frozen picture is not an
+   * ended session.
    *
    * `DELETE` without a session id keeps today's meaning — *release my holds
    * on this camera* — because an SDK that has lost its id, or a client that
@@ -2945,26 +2875,23 @@ var historyQuery = import_zod9.z.object({
     description: "A dotted path to a numeric field inside an object value, such as `pose.x`. Without it the datapoint's value is used whole, which only works when it is already a number."
   }),
   /**
-   * **A union whose input branch IS the wire, not a coercion (W9d, DEF-059).**
+   * **A union whose input branch IS the wire, not a coercion.**
    *
-   * This was `z.coerce.number()`, for a good reason that stayed true: the
-   * schema describes a **query string**, where every value arrives as text,
-   * and a bare `z.number()` would make each route coerce by hand. What was
-   * measured afterwards is that a coercion cannot be *published*: zod renders
-   * a coercion's **result** in either `io` mode, so `io: 'input'` and
-   * `io: 'output'` both emit `{"type":"integer"}` — an artifact describing a
+   * The schema describes a **query string**, where every value arrives as
+   * text. `z.coerce.number()` would read it, but a coercion cannot be
+   * *published*: zod renders a coercion's **result** in either `io` mode, so
+   * input and output both emit `{"type":"integer"}` — an artifact describing a
    * shape a query string can never carry. Anyone validating a real request
    * against it rejects every one that sets `limit`.
    *
-   * That is a **different** defect from the `.default()` class, which
-   * `io: 'input'` genuinely does fix; `export-schemas.ts` once claimed one
-   * remedy for both and has been corrected.
+   * That is a different problem from `.default()` publishing as required,
+   * which input-mode export genuinely does fix.
    *
-   * A union states both truths honestly: the wire carries a numeric string,
-   * a programmatic caller may pass a number, and the artifact can render the
+   * A union states both truths honestly: the wire carries a numeric string, a
+   * programmatic caller may pass a number, and the artifact can render the
    * input branch because there is one to render.
    *
-   * **What the artifact no longer says, named here rather than left silent.**
+   * **What the artifact does not say, named here rather than left silent.**
    * The `1..10000` bound lives in the `.pipe()`, which is the *output* half, so
    * no input-mode artifact can express it as a constraint: the published shape
    * is `^\d{1,5}$` or a bare integer, and five digits is a weak echo of the
@@ -2972,11 +2899,10 @@ var historyQuery = import_zod9.z.object({
    * parsing, not by the shape of the text — but it is a **reduction**, and an
    * artifact that stops naming a bound reads as if there were none.
    *
-   * So both branches carry the number in a `.describe()` (Nimbus-W9d's
-   * proposal). It is **not** a constraint and nothing validates against it; it
-   * means a generator, or a person reading only the published schema, sees the
-   * actual ceiling instead of nothing. The gap is narrowed and named rather
-   * than closed.
+   * So both branches carry the number in a `.describe()`. It is **not** a
+   * constraint and nothing validates against it; it means a generator, or a
+   * person reading only the published schema, sees the actual ceiling instead
+   * of nothing. The gap is narrowed and named rather than closed.
    */
   limit: import_zod9.z.union([
     import_zod9.z.string().regex(/^\d{1,5}$/).describe("Positive integer, 1-10000. The pattern only bounds digit count; the real ceiling is enforced after parsing."),
@@ -3097,8 +3023,7 @@ var robotDeletionSummary = import_zod9.z.object({
    * console renders them in one sentence: *"this deletes N published slugs …
    * and M cameras"*. With cameras inside `slug_count` that sentence counts
    * them twice, on the one screen whose whole justification is naming what an
-   * irreversible click destroys (Momus, W6a review — the cloud summed all
-   * five and the console then added the cameras again).
+   * irreversible click destroys.
    *
    * A draft is destroyed too and is described by `had_unpublished_draft`
    * rather than by either of these: describing three things with two numbers
@@ -3109,7 +3034,7 @@ var robotDeletionSummary = import_zod9.z.object({
   bytes_freed: import_zod9.z.number().int().nonnegative(),
   cameras: import_zod9.z.array(slug),
   /**
-   * Assets destroyed with the robot (W7), and **`asset_bytes_freed` is what
+   * Assets destroyed with the robot, and **`asset_bytes_freed` is what
    * this org actually gets back** — not the sum of the assets' sizes.
    *
    * Storage is content-addressed, so a mesh two robots share survives the
@@ -3183,7 +3108,7 @@ var RESOURCE_HEALTH_STATES = [
   "unreadable_credential",
   /**
    * A camera names a credential that **does not exist** in this org — deleted,
-   * mistyped, or belonging to somebody else (W6a review).
+   * mistyped, or belonging to somebody else.
    *
    * Separate from `unreadable_credential` because that one asserts a
    * decryption that was attempted and failed, and here nothing was ever
@@ -3193,11 +3118,11 @@ var RESOURCE_HEALTH_STATES = [
    * — a different fact with a different fix.
    *
    * **Retiring with the credential store**, and not live behaviour to build
-   * against. Its one producer was `cloud-config-frame.ts` tolerating an
-   * unresolved `credentials_ref` at publish time; FL-002 deleted that field,
-   * so nothing emits this today. It is kept only until the wave that removes
-   * the store also removes these three credential states — `unreadable_credential`
-   * and the `readable` fact on `credentialSummary` go the same way.
+   * against. Its one producer tolerated an unresolved `credentials_ref` at
+   * publish time; that field is gone, so nothing emits this today. It is kept
+   * only until the credential store is removed, which takes these three
+   * credential states with it — `unreadable_credential` and the `readable` fact
+   * on `credentialSummary` go the same way.
    */
   "credential_missing",
   /** A configuration change stopped this stream, deliberately. */
@@ -3222,18 +3147,17 @@ var resourceHealthState = import_zod9.z.object({
   /** The camera slug, or the credential name. */
   ref: import_zod9.z.string().min(1).max(64),
   /**
-   * **Which of two questions this entry answers (W9a, DEF-072).**
+   * **Which of two questions this entry answers.**
    *
    * `'source'`  — can the source be read at all? (`unreachable`, `auth_failed`,
    *               `unreadable_credential`, `missing_credential`, `ok`, …)
    * `'publish'` — given a readable source, did publishing to LiveKit work?
    *
-   * Before this, both went into one entry keyed `${robot} ${kind} ${ref}` with
-   * one flat `state`, in which `publish_failed` answered *"can we publish"*
-   * and every other value answered *"can the source be read"* — **same key,
-   * same field, two questions**, so each overwrote the other. The conflation
-   * was once an occasional race; W6a's reconnect restatement made it
-   * guaranteed, on every reconnect, for any camera with an active viewer.
+   * Without the facet both answers land in one entry keyed
+   * `${robot} ${kind} ${ref}` with one flat `state`, in which `publish_failed`
+   * answers *"can we publish"* and every other value answers *"can the source
+   * be read"* — same key, same field, two questions, each overwriting the
+   * other.
    *
    * The facet is part of the entry's identity: a camera can perfectly well be
    * readable and unpublishable at the same moment, and that pair is exactly
@@ -3266,30 +3190,28 @@ var orgQuotas = import_zod9.z.object({
   max_retention_writes_per_minute: import_zod9.z.number().int().nonnegative(),
   max_realtime_connections: import_zod9.z.number().int().positive(),
   /**
-   * Asset storage (§4.6, W7) — **its own dial, not part of
-   * `max_retention_bytes`.** A sync grows storage in jumps and time series
-   * grow steadily; one dial would let the first crowd out the second, and the
-   * org that hit its limit would be told to look at the wrong thing.
+   * Asset storage — **its own dial, not part of `max_retention_bytes`.** A
+   * sync grows storage in jumps and time series grow steadily; one dial would
+   * let the first crowd out the second, and the org that hit its limit would be
+   * told to look at the wrong thing.
    *
    * **Counted per distinct blob *this org references* — not per asset row, and
-   * not per object the platform stores on its behalf (W7a, D1).** The two
-   * readings are indistinguishable from the number alone and a customer is
-   * entitled to know which one they are being charged for.
+   * not per object the platform stores on its behalf.** The two readings are
+   * indistinguishable from the number alone and a customer is entitled to know
+   * which one they are being charged for.
    *
    * Within an org, sharing is free: two robots referencing the same mesh cost
    * one copy, which is what dedup means to a customer, and anything else
    * charges an org twice for a fleet of identical robots — the normal case.
    *
-   * **Across orgs, sharing is not free, and W7 shipped the opposite.** Storage
-   * stays globally content-addressed (one object per sha256; that efficiency
-   * is real), but accounting is per-org: an org is charged for each distinct
-   * blob it references and credited when its own last reference goes, whether
-   * or not the blob survives for somebody else. Global refcounting made the
-   * first org to sync a blob pay for it forever while every later org stored
-   * it free — so the quota was evadable by anyone whose mesh someone else had
-   * already uploaded, and an org's own number depended on who got there first,
-   * which nobody can predict. Measured before the change: 342 bytes held by an
-   * org owning no assets, with no operation able to free them.
+   * **Across orgs, sharing is not free.** Storage stays globally
+   * content-addressed (one object per sha256; that efficiency is real), but
+   * accounting is per-org: an org is charged for each distinct blob it
+   * references and credited when its own last reference goes, whether or not
+   * the blob survives for somebody else. Global refcounting would make the
+   * first org to sync a blob pay for it forever while every later org stored it
+   * free — a quota evadable by anyone whose mesh someone else had already
+   * uploaded, and an org's own number would depend on who got there first.
    */
   max_asset_storage_bytes: import_zod9.z.number().int().nonnegative()
 });
@@ -3333,7 +3255,7 @@ var robotLatencySeries = import_zod9.z.object({
 });
 var orgLatencyQuery = import_zod9.z.object({
   from_ms: wireTimestampMs,
-  /** Exclusive — half-open `[from, to)`, the convention every other query here already follows (DEF-062). */
+  /** Exclusive — half-open `[from, to)`, the convention every other query here already follows. */
   to_ms: wireTimestampMs,
   /**
    * One robot's own sparkline. `z.uuid()`, because the column is one —
@@ -3393,13 +3315,13 @@ var slugUsageResponse = import_zod9.z.object({
   alert_count: import_zod9.z.number().int().nonnegative()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_87d1585beff942190ebb8b5dc4e89225/node_modules/@fleetless/contracts/dist/realtime.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/realtime.js
 var import_zod14 = require("zod");
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_87d1585beff942190ebb8b5dc4e89225/node_modules/@fleetless/contracts/dist/client-auth.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/client-auth.js
 var import_zod13 = require("zod");
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_87d1585beff942190ebb8b5dc4e89225/node_modules/@fleetless/contracts/dist/apps.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/apps.js
 var import_zod10 = require("zod");
 var appIdentifier = slug;
 var app = import_zod10.z.object({
@@ -3415,7 +3337,7 @@ var app = import_zod10.z.object({
   identifier: appIdentifier.meta({
     description: "The stable handle a client sends at login, lowercase and underscore-separated. **Globally unique, not per organisation** \u2014 `clientLoginRequest` carries no org context to disambiguate with, so a collision is refused with `identifier_taken`."
   }),
-  /** Robots are referenced individually; tags never grant rights (§12.2). */
+  /** Robots are referenced individually; tags never grant rights. */
   robot_ids: import_zod10.z.array(import_zod10.z.uuid()).meta({
     description: "The robots this app may reach, each referenced individually. Tags never grant rights, and a robot absent from this list is invisible to the app whatever a role grants."
   }),
@@ -3468,16 +3390,17 @@ var updateAppRequest = import_zod10.z.object({
   name: import_zod10.z.string().min(1).max(120).optional(),
   robot_ids: import_zod10.z.array(import_zod10.z.uuid()).optional(),
   /**
-   * `app.default_role_id`'s write half — an app *setting*, which is where D1
-   * put the default role, so it belongs on the app's own PATCH and not on a
-   * route of its own.
-   *
-   * **`.nullable().optional()`, and the two mean different things.** Absent
-   * leaves the current default alone; an explicit `null` clears it. A field
-   * that could only be set and never unset would make "we changed our mind"
-   * unreachable through the API — the same silence `.strict()` above exists to
-   * avoid, from the other direction.
-   */
+    * `app.default_role_id`'s write half — an app *setting*, which is where the
+  * two-identity-space model
+    * put the default role, so it belongs on the app's own PATCH and not on a
+    * route of its own.
+    *
+    * **`.nullable().optional()`, and the two mean different things.** Absent
+    * leaves the current default alone; an explicit `null` clears it. A field
+    * that could only be set and never unset would make "we changed our mind"
+    * unreachable through the API — the same silence `.strict()` above exists to
+    * avoid, from the other direction.
+    */
   default_role_id: import_zod10.z.uuid().nullable().optional()
 }).strict();
 var serverKeyToken = import_zod10.z.string().regex(/^flk_[0-9a-f]{32}$/);
@@ -3530,16 +3453,13 @@ var roleListResponse = import_zod10.z.object({
 var rolePermissions = import_zod10.z.object({
   role_id: import_zod10.z.uuid(),
   /**
-   * **A slug is unique per robot across ALL service kinds** (spec §4.1:
-   * "Jeder Dienst erhält einen Slug" — one namespace, not one per kind), and
-   * the cloud's config validation enforces that with a kind-agnostic
-   * collection pass. That is why this list carries slugs and not
-   * (kind, slug) pairs: when W4 adds actions, services and publishers, a
-   * grant keeps meaning exactly what it means today, and this shape does not
-   * change. What W4 does need is an endpoint that lists every *grantable*
-   * slug of a robot with its kind, so the console's matrix can offer them —
-   * today it enumerates datapoints only, which is the seam that would
-   * otherwise force a rebuild.
+   * **A slug is unique per robot across ALL exposure kinds** — one namespace,
+   * not one per kind — and the cloud's configuration validation enforces that
+   * with a kind-agnostic collection pass. That is why this list carries slugs
+   * and not (kind, slug) pairs: a grant means the same thing whichever kind the
+   * slug turns out to name. `GET /api/robots/:id/exposures` is the companion
+   * read that lists every grantable slug of a robot **with** its kind, so a
+   * rights matrix can offer them.
    */
   grants: import_zod10.z.array(import_zod10.z.object({
     robot_id: import_zod10.z.uuid(),
@@ -3548,25 +3468,22 @@ var rolePermissions = import_zod10.z.object({
   /**
    * App-wide abilities a role grants, as opposed to per-slug grants above.
    *
-   * **A capability here is a promise, and one of them is still not kept.**
-   * `action_history` and `presence` were both gated by this object from W4
-   * and implemented nowhere — no route, no SDK method, no realtime frame
-   * (register row 8). A console could therefore switch them on and nothing
-   * changed, which is worse than their absence: the developer believes they
-   * granted something. **This paragraph stays** whatever the current tally
-   * is: it is the only place that says a switch in the console may change
-   * nothing, and it is how the next unkept capability gets caught.
+   * **A capability here is a promise, and one of them is still not kept.** A
+   * capability with no route, no SDK method and no realtime frame behind it can
+   * be switched on while nothing changes, which is worse than its absence: the
+   * developer believes they granted something. **This paragraph stays**
+   * whatever the current tally is: it is the only place that says a switch may
+   * change nothing, and it is how the next unkept capability gets caught.
    *
-   * `assets` (W7) was the first one redeemed. It gates §4.6's asset store,
-   * which is not covered by `grants` because **assets are not slugs** — and it
-   * is its own decision rather than a side effect of reaching the robot,
-   * because a mesh set gives away the machine's build.
+   * `assets` gates the asset store, which is not covered by `grants` because
+   * **assets are not slugs** — and it is its own decision rather than a side
+   * effect of reaching the robot, because a mesh set gives away the machine's
+   * build.
    *
-   * **`action_history` is kept as of the run-history delta.** It gates
+   * **`action_history` is kept.** It gates
    * `GET /api/robots/:id/jobs/history` — an end user whose role lacks it is
    * refused `403 capability_required`, naming the capability so the developer
-   * knows which switch is off. It was unkeepable while nothing durable
-   * recorded what had run; `jobRun` and `job_runs` are that record.
+   * knows which switch is off.
    *
    * **What granting it discloses.** A `jobRun` names the actor who invoked
    * it, and `jobActor.label` is an email — so an end user holding this
@@ -3586,10 +3503,10 @@ var rolePermissions = import_zod10.z.object({
   })
 });
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_87d1585beff942190ebb8b5dc4e89225/node_modules/@fleetless/contracts/dist/app-users.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/app-users.js
 var import_zod12 = require("zod");
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_87d1585beff942190ebb8b5dc4e89225/node_modules/@fleetless/contracts/dist/identity.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/identity.js
 var import_zod11 = require("zod");
 var password = import_zod11.z.string().min(12).max(256);
 var USER_DISPLAY_NAME_MAX = 120;
@@ -3751,7 +3668,7 @@ var authMeResponse = import_zod11.z.object({ org, user: fleetlessUser });
 var patchOrgRequest = import_zod11.z.object({ name: import_zod11.z.string().min(1).max(120) }).strict();
 var patchAuthMeRequest = import_zod11.z.object({ display_name: import_zod11.z.string().min(1).max(USER_DISPLAY_NAME_MAX).nullable() }).strict();
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_87d1585beff942190ebb8b5dc4e89225/node_modules/@fleetless/contracts/dist/app-users.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/app-users.js
 var APP_USER_DISPLAY_NAME_MAX = 120;
 var providerSlug = import_zod12.z.string().max(40).regex(/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/, "a provider slug is lowercase and hyphen-separated, starting with a letter");
 var appUserStatus = import_zod12.z.enum(["pending_verification", "active", "blocked"]);
@@ -3900,7 +3817,7 @@ var createAppOidcProviderRequest = import_zod12.z.object({
     description: "The client secret, **write-only**: it is stored encrypted and comes back through nothing \u2014 not the read, not this route's own answer, not an audit detail. Required on create, since a provider with no secret cannot exchange a code; the minimum length refuses a value that is a misconfiguration rather than a secret."
   }),
   scopes: import_zod12.z.array(import_zod12.z.string().min(1).max(60)).min(1).max(20).default(["openid", "email", "profile"]).meta({
-    description: "The scopes to request. Defaults to `openid email profile`, which is what the linking rules in this design actually read: the subject, the address and its verified flag, and a name."
+    description: "The scopes to request. Defaults to `openid email profile`, which is what account linking actually reads: the subject, the address and its verified flag, and a name."
   }),
   link_verified_emails: import_zod12.z.boolean().default(false).meta({
     description: "Whether a federated login may join an existing app user by verified address. **Defaults to off**, because relaxing later is additive and admitting duplicates now and tightening afterwards is not."
@@ -4002,7 +3919,7 @@ var mailOutcome = import_zod12.z.object({
   })
 });
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_87d1585beff942190ebb8b5dc4e89225/node_modules/@fleetless/contracts/dist/client-auth.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/client-auth.js
 var clientLoginRequest = import_zod13.z.object({
   app_identifier: appIdentifier.meta({
     description: "The app being logged in to, as its globally unique identifier \u2014 the lowercase, underscore-separated string the developer chose when the app was created. There is no organisation context at login, so this is what decides which app the credentials are checked for."
@@ -4140,7 +4057,7 @@ var clientMcpInteraction = import_zod13.z.object({
     description: "Always `false`. The client registered itself without authentication and chose this name about itself, so it must be rendered as a claim and never as an identity. There is no verified case, which is why this is a literal and not a boolean: a `true` branch would be dead code that looked like a safeguard."
   }),
   scopes: import_zod13.z.array(import_zod13.z.string()).meta({ description: "The scopes the client asked for, to show the person before they approve." }),
-  already_granted: import_zod13.z.boolean().meta({ description: "Whether this user has already approved this client. It is a record of what they answered last time and nothing more: **the server performs no second check of it**, so an app that skips its own consent screen when this is `true` is the only thing deciding, and approve succeeds identically for a user who holds no grant at all. Withdrawing it is `DELETE /api/client/mcp/grants/:clientId` for the person themselves and `DELETE /api/apps/:id/users/:userId/mcp-grants/:clientId` for the developer. A withdrawal makes this `false` again at the next authorization and does not end an MCP session already running: the access token it minted stays valid for the rest of its fifteen minutes, and no refresh grant exists to extend it." }),
+  already_granted: import_zod13.z.boolean().meta({ description: "Whether this user has already approved this client. It is a record of what they answered last time, and **this route makes no second use of it**: an app that skips its own consent screen when this is `true` is the only thing deciding that, and approve succeeds identically for a user who holds no grant at all. The standing grant is read elsewhere, on every request to the app's MCP endpoint. Withdrawing it is `DELETE /api/client/mcp/grants/:clientId` for the person themselves and `DELETE /api/apps/:id/users/:userId/mcp-grants/:clientId` for the developer. A withdrawal makes this `false` again at the next authorization **and stops the client at its very next MCP call**, unexpired access token and all \u2014 up to fifteen minutes of it \u2014 because the endpoint keys that check on the `client_id` the token carries." }),
   expires_at: import_zod13.z.iso.datetime().meta({ description: "When the interaction stops being approvable. Ten minutes from the authorize step; afterwards both approve and deny answer `interaction_expired`." })
 });
 var clientMcpInteractionDecisionResponse = import_zod13.z.object({
@@ -4191,7 +4108,7 @@ var clientIdentity = import_zod13.z.object({
   })
 });
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_87d1585beff942190ebb8b5dc4e89225/node_modules/@fleetless/contracts/dist/realtime.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/realtime.js
 var clientAuth = import_zod14.z.object({
   type: import_zod14.z.literal("auth"),
   token: import_zod14.z.string().min(1)
@@ -4210,20 +4127,16 @@ var clientInvoke = import_zod14.z.object({
   request_id: import_zod14.z.string().min(1).max(64),
   robot_id: import_zod14.z.uuid(),
   slug,
-  /** Parameters by field path, validated against the config's rules (§4.4). */
+  /** Parameters by field path, validated against the configuration's rules. */
   params: import_zod14.z.record(import_zod14.z.string(), import_zod14.z.unknown()),
   /**
-   * How long this one call is worth waiting for (W6b) — the same field,
-   * meaning and cap as `invokeRequest.patience_ms`; absent means
-   * `DEFAULT_PATIENCE_MS`.
+   * How long this one call is worth waiting for — the same field, meaning and
+   * cap as `invokeRequest.patience_ms`; absent means `DEFAULT_PATIENCE_MS`.
    *
-   * It is here because **§11.1 parity is a rule, not a preference**: what REST
-   * can do travels over this socket. The first version of this delta gave
-   * `patience_ms` to the REST body only — and the SDK invokes exclusively over
-   * the realtime channel, so the field would have been unreachable for every
-   * SDK caller while appearing in the documentation. W6a shipped four SDK
-   * methods no SDK caller could invoke; this is the same defect caught before
-   * it shipped, by the SDK owner rather than by a reviewer.
+   * It is here because **parity is a rule, not a preference**: what REST can do
+   * travels over this socket. A field given to the REST body alone would be
+   * unreachable to every caller that invokes over the realtime channel, while
+   * still appearing in the documentation.
    */
   patience_ms: import_zod14.z.number().int().min(MIN_PATIENCE_MS).max(MAX_PATIENCE_MS).optional()
 });
@@ -4231,17 +4144,17 @@ var clientCancel = import_zod14.z.object({
   type: import_zod14.z.literal("cancel"),
   request_id: import_zod14.z.string().min(1).max(64),
   robot_id: import_zod14.z.uuid(),
-  /** Which slug — required, and the only address a cancel had until W6b. */
+  /** Which slug — required, and the coarse address of a cancel. */
   slug,
   /**
-   * Which job on that slug (W6b), or `null` for *whatever is running there*.
+   * Which job on that slug, or `null` for *whatever is running there*.
    *
    * The two are different requests and both are legitimate. An operator
    * hitting a stop button means the second: stop the machine, whatever it is
    * doing. A client cancelling the job it started means the first — and until
-   * this field existed it could not say so, so a cancel that arrived just
-   * after its own job ended stopped the next caller's job instead. Same slug,
-   * same wire frame, entirely different machine behaviour, and nothing in the
+   * this field a client could not say so, and a cancel arriving just after its
+   * own job ended would stop the next caller's job instead. Same slug, same
+   * wire frame, entirely different machine behaviour, and nothing in the
    * protocol able to tell them apart.
    *
    * A named id that is not running answers `not_found` rather than falling
@@ -4267,9 +4180,9 @@ var commandResult = import_zod14.z.object({
    * - `ok:true` on an invoke or a call: the job that was just created.
    * - `ok:true` on a cancel: the job the cancel was sent to.
    * - `ok:false, code:'busy'`: **the job that is already running** — the
-   *   caller has none. This is the §11.3 "inkl. Information, was läuft", and
-   *   it is the whole reason a busy refusal is useful: the caller learns
-   *   whether to wait or to give up (see `busyDetails`).
+   *   caller has none. Naming what is already running is the whole reason a
+   *   busy refusal is useful: the caller learns whether to wait or to give up
+   *   (see `busyDetails`).
    * - any other refusal: `null`.
    */
   job: job.nullable(),
@@ -4291,12 +4204,11 @@ var commandResult = import_zod14.z.object({
    * The same payload the REST envelope carries in `apiError.details` — for
    * `parameter_invalid`, a `parameterInvalidDetails`.
    *
-   * Added because it was missing, and its absence quietly broke §11.1: this
-   * socket is supposed to do *everything* REST can do, but a
-   * `parameter_invalid` arriving here had nowhere to put its violations, so
-   * the same refusal was actionable over HTTP and opaque over the socket.
-   * A client cannot bind an error to the input that caused it from a code
-   * alone — which is the entire point of the flat parameter shape.
+   * It is here because this socket does *everything* REST can do, and without
+   * it a `parameter_invalid` arriving here would have nowhere to put its
+   * violations — the same refusal actionable over HTTP and opaque over the
+   * socket. A client cannot bind an error to the input that caused it from a
+   * code alone, which is the entire point of the flat parameter shape.
    */
   details: import_zod14.z.unknown().optional()
 });
@@ -4310,7 +4222,7 @@ var clientSubscribe = import_zod14.z.object({
   robot_id: import_zod14.z.uuid(),
   slug,
   /**
-   * What the subscriber expects, and how it wants it (W5).
+   * What the subscriber expects, and how it wants it.
    *
    * `kind` lets the server answer **`wrong_kind`** instead of accepting a
    * subscribe the client will then filter to silence — and silence is
@@ -4318,8 +4230,6 @@ var clientSubscribe = import_zod14.z.object({
    * Optional, so an older client that omits it keeps today's behaviour.
    *
    * `options` is where a camera says what it wants; a datapoint needs none.
-   * It exists now rather than later because adding a field to a frame three
-   * repos parse is cheap once and expensive twice.
    */
   /**
    * `publisher` is here even though a publisher is not subscribable: a client
@@ -4369,7 +4279,7 @@ var liveSessionEndReason = import_zod14.z.enum([
   /**
    * The cloud ended it and cannot say which of the above applied. **Kept
    * deliberately**: a channel that cannot say "I do not know" will say
-   * something false instead, and this project has paid for that four times in
+   * something false instead, which is the costlier failure in
    * the camera path alone.
    */
   "unknown"
@@ -4384,13 +4294,10 @@ var liveSessionEvent = import_zod14.z.object({
   /**
    * **Classified text the cloud produced, never text the robot sent.**
    *
-   * An earlier draft of this comment said *"the robot's own words when it has
-   * any"*, which reads as permission to pass `bridgeCameraState.error.message`
-   * straight through. Nothing sanitises that field, and this codebase has a
-   * documented incident of a password reaching a developer surface through
-   * exactly that route — `camera-health.ts`'s fixed-string `REASON` discipline
-   * exists because of it. Nimbus-W9a stopped at the sentence and asked rather
-   * than taking the permission it appeared to give (2026-08-19).
+   * It is **not** the robot's own words. Nothing sanitises
+   * `bridgeCameraState.error.message`, and a camera password reaches a
+   * developer surface through exactly that route — which is why the cloud maps
+   * a robot's diagnosis to fixed strings rather than forwarding it.
    *
    * So: `null` unless the cloud itself has something classified to say. If a
    * developer needs the robot's own diagnosis later, it arrives as a mapped
@@ -4479,7 +4386,7 @@ var orgEventDropped = import_zod14.z.object({
   dropped: import_zod14.z.number().int().positive()
 }).strict();
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_87d1585beff942190ebb8b5dc4e89225/node_modules/@fleetless/contracts/dist/audit.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/audit.js
 var import_zod15 = require("zod");
 var auditActor = import_zod15.z.object({
   kind: import_zod15.z.enum(["developer", "end_user", "app_user", "server_key", "bridge"]),
@@ -4491,8 +4398,7 @@ var auditEvent = import_zod15.z.object({
   org_id: import_zod15.z.uuid(),
   at: import_zod15.z.iso.datetime(),
   /**
-   * A monotonic counter, ascending in write order, unique across the log
-   * (W6b).
+   * A monotonic counter, ascending in write order, unique across the log.
    *
    * `at` is not a total order. Two events written in the same millisecond —
    * a login and the config publish it enables, a cascade writing several
@@ -4504,11 +4410,7 @@ var auditEvent = import_zod15.z.object({
    *
    * It is also the only correct **cursor** for paging this log, for the same
    * reason: a cursor that is not unique either skips rows or repeats them at
-   * every page boundary. No cursor parameter exists on `GET /api/audit` yet —
-   * the route returns the whole log — and that is stated here rather than
-   * implied, because a contract that describes a capability the API does not
-   * have is the defect this project keeps finding. When paging is added it
-   * uses this field; nothing else in this shape can carry it.
+   * every page boundary. Nothing else in this shape can carry one.
    *
    * Required, not optional: an event without a sequence cannot be ordered
    * against one that has it, and a log with two orderings has none.
@@ -4545,7 +4447,7 @@ var auditQuery = import_zod15.z.object({
   /** Only events with a smaller `seq` — the next, older page. */
   before_seq: wireSeqCursor.optional(),
   /**
-   * Same shape as DEF-059's `historyQuery.limit`: a union whose input branch
+   * The same shape as `historyQuery.limit`: a union whose input branch
    * **is the wire**. A `z.coerce` cannot be published — zod renders the
    * coercion's result in either `io` direction, so the artifact would describe
    * a shape a query string can never carry.
@@ -4574,36 +4476,25 @@ var auditQuery = import_zod15.z.object({
   /**
    * Only events by this actor.
    *
-   * **`z.uuid()`, because the column is one (Argus-W9, W9 review).** This was
-   * `z.string().min(1).max(200)`, so any non-uuid value reached Postgres as a
-   * uuid parameter and threw: `?actor_id=not-a-uuid` answered **500
-   * `internal_error`**, on the list route and the export alike.
+   * **`z.uuid()`, because the column is one.** A looser string type lets any
+   * non-uuid value reach the database as a uuid parameter, where the cast
+   * throws: `?actor_id=not-a-uuid` then answers **500 `internal_error`** rather
+   * than refusing the value.
    *
-   * Not a SQL-injection finding — Drizzle parameterises, and `' or 1=1--`
-   * failed at the same cast. It is a **500 where a 400 belongs**, and a 500 is
-   * the answer that explains nothing.
-   *
-   * The place is the part worth keeping: **this same wave pulled
-   * `refuseIfNotUuid` through ~15 call sites** so a typo could be told from a
-   * deletion — and the brand-new filter, whose field has exactly that shape,
-   * is the one that did not get it. A rule applied to the sites in front of
-   * you is not a rule applied to the class.
+   * Not an injection question — the query is parameterised either way. It is a
+   * **500 where a 400 belongs**, and a 500 is the answer that explains nothing.
    */
   actor_id: import_zod15.z.uuid().optional(),
   /** Only events about this kind of target, e.g. `robot`. */
   target_kind: import_zod15.z.string().min(1).max(40).optional(),
   /**
    * Absolute bounds in unix milliseconds, **half-open `[from, to)`** — the
-   * same rule the history shapes follow (DEF-062).
+   * same rule the history shapes follow.
    *
-   * **Bounded to years 1..9999, and the bound is borrowed rather than
-   * invented.** `nonnegative()` alone let `253402300800000` (year 10000)
-   * through, where the Postgres bind path has no representation and the route
-   * answered 500 — measured either side of the edge: `253402300799000` → 200,
-   * `253402300800000` → 500 (Argus-W9). `history-query.ts`'s `parseTimeExprMs`
-   * already carries exactly this range, with M3's reasoning for why
-   * `Number.isSafeInteger` is wider than what a timestamp can be; this is that
-   * same number, not a second one that happens to agree.
+   * **Bounded to years 1..9999.** `nonnegative()` alone admits instants a
+   * timestamp column has no representation for, and the route answers 500
+   * rather than refusing the value. `Number.isSafeInteger` is wider than what a
+   * timestamp can be, so the bound is stated rather than inherited.
    */
   from_ms: auditTimestampMs.optional(),
   to_ms: auditTimestampMs.optional()
@@ -4626,7 +4517,7 @@ var auditListResponse = import_zod15.z.object({
   next_cursor: import_zod15.z.number().int().positive().nullable()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_87d1585beff942190ebb8b5dc4e89225/node_modules/@fleetless/contracts/dist/errors.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/errors.js
 var import_zod16 = require("zod");
 var apiError = import_zod16.z.object({
   code: import_zod16.z.string().min(1),
@@ -4643,7 +4534,7 @@ var parameterInvalidDetails = import_zod16.z.object({
   violations: import_zod16.z.array(parameterViolation).min(1)
 });
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_87d1585beff942190ebb8b5dc4e89225/node_modules/@fleetless/contracts/dist/oauth.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/oauth.js
 var import_zod17 = require("zod");
 var oauthErrorCode = import_zod17.z.enum([
   "invalid_request",
@@ -4673,8 +4564,8 @@ var oauthError = import_zod17.z.object({
    * makes the two indistinguishable to the caller, and *a field that cannot
    * express a distinction produces a workaround somewhere else*. Answering in
    * `apiError` instead would keep the distinction and hand an RFC-compliant
-   * client a body it cannot parse — which is the conformance this wave exists
-   * to provide.
+   * client a body it cannot parse, which is the conformance this dialect
+   * exists to provide.
    *
    * So both: `error` is what a standard client reads, `fleetless_code` is what
    * our own tooling switches on. RFC 6749 §5.2 permits additional members, and
@@ -4698,26 +4589,29 @@ var redirectUri = import_zod17.z.string().min(1).max(2e3).refine((v) => {
   return false;
 }, { message: "redirect_uri must be an https URL, or http on an explicit loopback address, and carry no fragment" });
 var codeChallengeMethod = import_zod17.z.enum(["S256"]);
+var MCP_DCR_MAX_REDIRECT_URIS = 5;
 var dynamicClientRegistrationRequest = import_zod17.z.object({
-  client_name: import_zod17.z.string().min(1).max(200).meta({
-    description: 'The name the client calls itself. It is **not** vouched for by Fleetless and must never be rendered as if it were \u2014 a self-registered client chooses this string, and one has called itself *"Fleetless Official Helper"*.'
+  redirect_uris: import_zod17.z.array(redirectUri).min(1).max(MCP_DCR_MAX_REDIRECT_URIS).meta({
+    description: `Where the authorization code may be returned, and the one field a registration cannot omit. Each must be an \`https\` URL, or \`http\` on an explicit loopback address for a native app that cannot hold a certificate, and none may carry a fragment. There must be between \`1\` and \`${MCP_DCR_MAX_REDIRECT_URIS}\` of them; duplicates are collapsed rather than counted twice. Matched **exactly** at the authorize step against what was registered here.`
   }),
-  redirect_uris: import_zod17.z.array(redirectUri).min(1).max(20).meta({
-    description: "Where the authorization code may be returned. Each must be an `https` URL, or `http` on an explicit loopback address for a native app that cannot hold a certificate, and none may carry a fragment. There must be between `1` and `20` of them."
+  client_name: import_zod17.z.string().min(1).max(200).optional().meta({
+    description: `The name the client calls itself. Optional \u2014 a registration without one is recorded under a default name, per RFC 7591's making every metadata field optional. It is **not** vouched for by Fleetless and must never be rendered as if it were: a self-registered client chooses this string, and one has called itself *"Fleetless Official Helper"*.`
+  }),
+  token_endpoint_auth_method: import_zod17.z.enum(["none"]).optional().meta({
+    description: "`none`, RFC 7591's value for a public client, and the only value either server registers. Any other value is **refused rather than silently downgraded**: a client that believes it holds a secret and does not has a wrong mental model of its own security. There is no client secret to hold \u2014 mandatory PKCE (`S256`) is the defence."
   }),
   grant_types: import_zod17.z.array(import_zod17.z.enum(["authorization_code", "refresh_token"])).optional().meta({
-    description: "Accepted and echoed back for conformance with RFC 7591. This server issues `authorization_code` and `refresh_token` and nothing else."
+    description: "Accepted for conformance with RFC 7591 and then **ignored**. What comes back is what was actually granted, which \xA73.2.1 permits a server to substitute: `authorization_code` and nothing else, so a client that asks for `refresh_token` is registered and told plainly that it did not get one."
   }),
   response_types: import_zod17.z.array(import_zod17.z.enum(["code"])).optional().meta({
-    description: "Accepted and echoed back for conformance. `code` is the only response type OAuth 2.1 leaves, the implicit grant having been removed."
-  }),
-  token_endpoint_auth_method: import_zod17.z.enum(["none"]).optional().meta({
-    description: "`none`, RFC 7591's value for a public client. There is no client secret to hold: mandatory PKCE is the defence."
+    description: "Accepted for conformance and then **ignored**; the response names `code`, which is the only response type OAuth 2.1 leaves, the implicit grant having been removed."
   }),
   scope: import_zod17.z.string().max(500).optional().meta({
-    description: "The scopes the client asks to be registered for, space-separated."
+    description: "Accepted for conformance and then **ignored**. This authorization server issues no scopes at all, which is why the registration answer carries no `scope` field to echo one back in."
   })
-}).strict();
+}).meta({
+  description: "What an MCP client sends to register itself, per RFC 7591. Unknown metadata is ignored rather than refused (\xA73.1), and the answer states what was actually granted rather than what was asked for (\xA73.2.1)."
+});
 var dynamicClientRegistrationResponse = import_zod17.z.object({
   client_id: import_zod17.z.string().min(1).max(200).meta({
     description: "The identifier this client sends at the authorize and token endpoints. Opaque, and not the app identifier."
@@ -4729,7 +4623,7 @@ var dynamicClientRegistrationResponse = import_zod17.z.object({
     description: "The redirect URIs this registration was accepted for. A code is returned to one of these and nowhere else."
   }),
   grant_types: import_zod17.z.array(import_zod17.z.string()).meta({
-    description: "The grants this client may use: `authorization_code` and `refresh_token`."
+    description: 'The grants this client may use. Always exactly `["authorization_code"]` \u2014 a client that asked for `refresh_token` is registered and told here that it did not get one, which is the substitution RFC 7591 \xA73.2.1 permits.'
   }),
   response_types: import_zod17.z.array(import_zod17.z.string()).meta({
     description: "The response types this client may ask for: `code`."
@@ -4744,45 +4638,28 @@ var dynamicClientRegistrationResponse = import_zod17.z.object({
     description: "Always `0`, which is RFC 7591's way of saying the client secret never expires \u2014 there is none. The **registration** itself does expire: a self-registered client that never completes a flow is an unauthenticated write somebody left behind."
   })
 });
-var oauthTokenRequest = import_zod17.z.discriminatedUnion("grant_type", [
-  import_zod17.z.object({
-    grant_type: import_zod17.z.literal("authorization_code").meta({
-      description: "This request exchanges the code from the authorize redirect for tokens."
-    }),
-    code: import_zod17.z.string().min(1).max(500).meta({
-      description: "The authorization code from the redirect. It may be exchanged once."
-    }),
-    redirect_uri: redirectUri.meta({
-      description: "The same redirect URI the authorize request used. It is compared, not merely recorded."
-    }),
-    client_id: import_zod17.z.string().min(1).max(200).meta({
-      description: "The client making the exchange, as registered."
-    }),
-    code_verifier: import_zod17.z.string().regex(/^[A-Za-z0-9\-._~]{43,128}$/, "code_verifier must be 43-128 unreserved characters (RFC 7636 \xA74.1)").meta({
-      description: "The PKCE verifier whose `S256` hash was sent as the challenge at the authorize step. Between `43` and `128` unreserved characters, per RFC 7636 \xA74.1 \u2014 it is compared rather than parsed, so a length nobody checks is a length an attacker chooses. PKCE is mandatory for every client under OAuth 2.1."
-    }),
-    resource: import_zod17.z.url().optional().meta({
-      description: "The resource the token is being requested for, per RFC 8707. It becomes the token's audience, and a resource refuses a token whose audience names something else."
-    })
+var oauthTokenRequest = import_zod17.z.object({
+  grant_type: import_zod17.z.literal("authorization_code").meta({
+    description: "Always `authorization_code`: this request exchanges the code from the authorize redirect for tokens. Any other value \u2014 `refresh_token` included \u2014 is `unsupported_grant_type`, refused before the code is looked up."
   }),
-  import_zod17.z.object({
-    grant_type: import_zod17.z.literal("refresh_token").meta({
-      description: "This request trades a refresh token for a fresh access token."
-    }),
-    refresh_token: import_zod17.z.string().min(1).max(500).meta({
-      description: "The refresh token to spend. Refresh tokens rotate, and presenting one twice is treated as theft rather than as a retry."
-    }),
-    client_id: import_zod17.z.string().min(1).max(200).meta({
-      description: "The client refreshing, as registered."
-    }),
-    resource: import_zod17.z.url().optional().meta({
-      description: "The resource the successor token should be bound to, per RFC 8707. **Carry it forward**: a refresh that drops it mints a token with no audience, and the resource then refuses it one token lifetime after a login that worked, to somebody who did nothing wrong."
-    }),
-    scope: import_zod17.z.string().max(500).optional().meta({
-      description: "A narrower scope for the successor token. RFC 6749 \xA76 lets a refresh narrow scope, never widen it."
-    })
+  code: import_zod17.z.string().min(1).max(500).meta({
+    description: "The authorization code from the redirect. It may be exchanged once; a second presentation is `invalid_grant`, the same answer a fabricated code gets."
+  }),
+  redirect_uri: redirectUri.meta({
+    description: "The same redirect URI the authorize request used. It is compared, not merely recorded."
+  }),
+  client_id: import_zod17.z.string().min(1).max(200).meta({
+    description: "The client making the exchange, as registered."
+  }),
+  code_verifier: import_zod17.z.string().regex(/^[A-Za-z0-9\-._~]{43,128}$/, "code_verifier must be 43-128 unreserved characters (RFC 7636 \xA74.1)").meta({
+    description: "The PKCE verifier whose `S256` hash was sent as the challenge at the authorize step. Between `43` and `128` unreserved characters, per RFC 7636 \xA74.1 \u2014 it is compared rather than parsed, so a length nobody checks is a length an attacker chooses. PKCE is mandatory for every client under OAuth 2.1."
+  }),
+  resource: import_zod17.z.url().optional().meta({
+    description: "The resource the token is being requested for, per RFC 8707. It must match the audience the code was authorized for, or the answer is `invalid_target`; omitted, the code's own audience stands. It becomes the token's `aud`, and a resource refuses a token whose audience names something else \u2014 which is what keeps a token minted for one app out of another app's endpoint."
   })
-]);
+}).meta({
+  description: "RFC 6749 \xA74.1.3's authorization-code exchange with PKCE, as either MCP authorization server reads it. Sent as `application/x-www-form-urlencoded`, per \xA74.1.3, though the server accepts a JSON body too."
+});
 var oauthTokenResponse = import_zod17.z.object({
   access_token: import_zod17.z.string().min(1).meta({
     description: "The bearer token. It is the same token the client login mints \u2014 only the envelope differs, because an RFC-compliant client parses this one and knows nothing about Fleetless."
@@ -4867,20 +4744,18 @@ var oauthAuthorizeQuery = import_zod17.z.object({
   }),
   resource: import_zod17.z.string().optional().meta({
     description: "RFC 8707 resource indicator: the API origin or the MCP endpoint the token is for. Checked against the resources this server issues tokens for **on behalf of this client's app**; a mismatch is `invalid_target` on the callback."
-  }),
-  scope: import_zod17.z.string().optional().meta({
-    description: "Space-separated scopes. Carried onto the interaction and read again at consent \u2014 **nothing is enforced at this step**, so an unknown scope is not a refusal here."
   })
+  // **No `scope`, because this authorization server issues none.** The field
+  // was here describing itself as "carried onto the interaction and read
+  // again at consent"; neither authorize handler reads it, the interaction
+  // row has no column for it, and the consent screen answers `scopes: []`.
+  // A parameter documented as carried and in fact dropped is worse than one
+  // that is absent.
 }).meta({
-  description: "The authorization request an MCP client sends. The two parameters above `response_type` are validated first and refuse flat; every parameter after them reports to the callback."
+  description: "The authorization request an MCP client sends, per RFC 6749 \xA74.1.1 with mandatory PKCE. The handler reads it parameter by parameter rather than through one parse, because the answers differ: `client_id` and `redirect_uri` are refused flat, with no redirect, since until both are confirmed there is no trusted target to bounce a browser to, and everything after them is reported to the client's own callback as query parameters."
 });
-var oauthRegisterQuery = import_zod17.z.object({
-  app_identifier: import_zod17.z.string().min(1).meta({
-    description: "The app the dynamic client registers under, as `appIdentifier` spells it. Required: missing and unknown answer the same `400 invalid_request` in the `oauthError` dialect. Whether that app has MCP enabled at all is a separate, later refusal (`access_denied`)."
-  })
-}).meta({ description: "The app a dynamic client registers under \u2014 the one parameter RFC 7591 has no body field for." });
 
-// node_modules/.pnpm/@fleetless+contracts@git+ssh+++git@gitlab.dehne-robotik.de+fleetless+fleetless-contract_87d1585beff942190ebb8b5dc4e89225/node_modules/@fleetless/contracts/dist/routes.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/routes.js
 var MCP_APP = MCP_APP_PATHS(":appIdentifier");
 var APP_IDENTIFIER = {
   name: "appIdentifier",
@@ -5443,7 +5318,7 @@ var ROUTES = [
     response: appUser,
     errors: [...DEVELOPER_GUARD, "invalid_uuid", "validation_error", "not_found", "email_taken", "target_state_conflict", "quota_exceeded"],
     transport: "http",
-    notes: "The developer-authenticated door into the app's user table, and the one place `409 email_taken` is an honest answer about an app user: the caller is authenticated into this app already, so telling them the address is taken discloses nothing they could not read from the listing beside it. `POST /api/client/register` answers `202` to the same fact, because there the caller is a stranger. `404 not_found` is the app, or a `role_id` that is not a role of it \u2014 a role of another app is refused rather than stored, since a user holding one would carry rights nothing in this app can resolve. **The password policy answers `400 validation_error`**, not a code of its own: the twelve-character minimum is the `password` field's schema rule, and every route in this repository that takes a password refuses a short one exactly the way it refuses any other malformed field. An account created here is `active` immediately: a developer entering somebody by hand has made the decision the verification mail automates, and its address counts as proven. `409 target_state_conflict` names `default_role_id` when `role_id` is absent and the app has no default role, or its default names a role that no longer resolves \u2014 a user with no role holds rights nothing in this app can read, so nothing is created. \n\n**`409 quota_exceeded` when the org holds as many app users as `max_end_users` allows**, counted across every app of the org \u2014 the same number `GET /api/org/quotas` reports as `usage.max_end_users`, since the same address in two apps is two accounts. `details` carries `{ quota, limit }`, as every count quota's refusal does. The check is at **creation** only: an existing user signs in, is patched and is deleted at the quota exactly as under it, because a protection limit that also froze the accounts already made would be an outage rather than a limit."
+    notes: "The developer-authenticated door into the app's user table, and the one place `409 email_taken` is an honest answer about an app user: the caller is authenticated into this app already, so telling them the address is taken discloses nothing they could not read from the listing beside it. `POST /api/client/register` answers `202` to the same fact, because there the caller is a stranger. `404 not_found` is the app, or a `role_id` that is not a role of it \u2014 a role of another app is refused rather than stored, since a user holding one would carry rights nothing in this app can resolve. **The password policy answers `400 validation_error`**, not a code of its own: the twelve-character minimum is the `password` field's schema rule, and every route that takes a password refuses a short one exactly the way it refuses any other malformed field. An account created here is `active` immediately: a developer entering somebody by hand has made the decision the verification mail automates, and its address counts as proven. `409 target_state_conflict` names `default_role_id` when `role_id` is absent and the app has no default role, or its default names a role that no longer resolves \u2014 a user with no role holds rights nothing in this app can read, so nothing is created. \n\n**`409 quota_exceeded` when the org holds as many app users as `max_end_users` allows**, counted across every app of the org \u2014 the same number `GET /api/org/quotas` reports as `usage.max_end_users`, since the same address in two apps is two accounts. `details` carries `{ quota, limit }`, as every count quota's refusal does. The check is at **creation** only: an existing user signs in, is patched and is deleted at the quota exactly as under it, because a protection limit that also froze the accounts already made would be an outage rather than a limit."
   },
   {
     method: "GET",
@@ -5556,7 +5431,7 @@ var ROUTES = [
     response: null,
     errors: [...DEVELOPER_GUARD, "invalid_uuid", "not_found"],
     transport: "http",
-    notes: "The support door beside `DELETE /api/client/mcp/grants/:clientId`, which is the same act by the person themselves. Audited as `app_user.mcp_grant_revoked`, whose `details` carry the client id and the app's uuid \u2014 and nothing else, in particular no token and no name the client chose for itself. \n\n**`204` whether or not there was anything to withdraw**, so a double-clicked button and a client id no grant names both land on the end state the caller asked for. The alternative \u2014 `404` for a client this user never approved \u2014 would make the route an oracle for which clients somebody has connected, answered before the listing beside it was read; and it would turn the ordinary retry into a refusal. Only a withdrawal that actually ended a standing agreement writes an audit event, so the log counts consents ended rather than buttons pressed. **`404` is still the app and the user**, which are the two things the caller must own. \n\n**It does not end an MCP session already running.** The access token that consent produced is a fifteen-minute bearer the transport checks against the account, not against this table, so a session in flight survives until it expires; there is no refresh grant on this authorization server, so nothing can extend it, and the next authorization shows the consent screen again. Blocking the account (`PATCH /api/apps/:id/users/:userId`) is what ends a live session now, and it ends every one of their sessions rather than this client's."
+    notes: "The support door beside `DELETE /api/client/mcp/grants/:clientId`, which is the same act by the person themselves. Audited as `app_user.mcp_grant_revoked`, whose `details` carry the client id and the app's uuid \u2014 and nothing else, in particular no token and no name the client chose for itself. \n\n**`204` whether or not there was anything to withdraw**, so a double-clicked button and a client id no grant names both land on the end state the caller asked for. The alternative \u2014 `404` for a client this user never approved \u2014 would make the route an oracle for which clients somebody has connected, answered before the listing beside it was read; and it would turn the ordinary retry into a refusal. Only a withdrawal that actually ended a standing agreement writes an audit event, so the log counts consents ended rather than buttons pressed. **`404` is still the app and the user**, which are the two things the caller must own. \n\n**It ends a session already running, at that client's very next call.** The app's MCP endpoint reads this table on every request, beside the account checks it already makes, so a withdrawn client is answered `401` with the `WWW-Authenticate` challenge that sends it back to the consent screen. The refusal is keyed on the `client_id` the access token carries, so it bites at the next call rather than at the next token: that token is still unexpired \u2014 up to fifteen minutes are left on it \u2014 and is refused anyway. Only this client stops. The person's other clients and their own use of the app are untouched, which is the difference from blocking the account (`PATCH /api/apps/:id/users/:userId`)."
   },
   {
     method: "GET",
@@ -5630,7 +5505,7 @@ var ROUTES = [
     transport: "http",
     notes: "An invitation that was already accepted is not pending and answers `404`, the same answer one that never existed gets \u2014 the account it created is a user now, and deleting that is `DELETE /api/apps/:id/users/:userId`. A revoked token answers `410 token_spent` at `POST /api/client/invitations/accept`, the same answer one that expired or never existed gets \u2014 the developer withdrew it deliberately, and an answer saying so would tell whoever still holds the link that it was once real."
   },
-  /* --------------------------------------- the app's OIDC providers (D4) */
+  /* ------------------------------------------- the app's OIDC providers */
   {
     method: "GET",
     path: "/api/apps/:id/oidc-providers",
@@ -6131,11 +6006,11 @@ var ROUTES = [
     status: 201,
     params: [],
     query: null,
-    request: null,
+    request: dynamicClientRegistrationRequest,
     response: dynamicClientRegistrationResponse,
     errors: ["rate_limited"],
     transport: "http",
-    notes: "RFC 7591, and deliberately **not** parsed against `dynamicClientRegistrationRequest`: that shape is strict, and a strict schema here would answer `400` to a conforming client and take the whole paste-the-URL flow down with it. `client_name` and `redirect_uris` are read by hand; everything else is ignored. What comes back is what was actually granted, which \xA73.2.1 allows a server to substitute \u2014 this authorization server issues `authorization_code` only, so a client that asked for `refresh_token` is registered and told plainly that it did not get one. The registration carries a TTL. Refusals are `oauthError`; the rate limiter answers `apiError`."
+    notes: "RFC 7591. **The request schema is what this endpoint accepts, not what it parses**: the handler reads the body field by field, because \xA73.2.2 distinguishes `invalid_redirect_uri` from `invalid_client_metadata` and one `safeParse` failure cannot say which of the two a caller earned. The shape is deliberately **not** strict, which is the schema agreeing with \xA73.1 rather than a gap in it \u2014 a conforming client sends `client_uri`, `logo_uri` and `software_id`, and both the schema and the server ignore them. `client_name` and `redirect_uris` are the two fields read; `grant_types`, `response_types` and `scope` are accepted and ignored. What comes back is what was actually granted, which \xA73.2.1 allows a server to substitute \u2014 this authorization server issues `authorization_code` only, so a client that asked for `refresh_token` is registered and told plainly that it did not get one. The registration carries a TTL. Refusals are `oauthError`; the rate limiter answers `apiError`."
   },
   {
     method: "GET",
@@ -6148,12 +6023,12 @@ var ROUTES = [
     ownerTier: false,
     status: 302,
     params: [],
-    query: null,
+    query: oauthAuthorizeQuery,
     request: null,
     response: null,
     errors: [],
     transport: "http",
-    notes: "Client and `redirect_uri` are validated first and a failure there never redirects, the same open-redirect discipline the app flow applies; those refusals are `oauthError`. Exact `redirect_uri` matching for both client kinds \u2014 the loopback-port wildcard of RFC 8252 \xA77.3 belongs to the one central client alone, whose URIs are configured ahead of time and cannot name an ephemeral port. A client that registered itself seconds ago can name the port it bound, and widening the wildcard there would only widen where a stolen `client_id` may send a browser. Nothing about the person is decided here \u2014 the next card asks for an email address and the password step after it resolves the account; this route knows only the client."
+    notes: "**The query schema is what this endpoint accepts, not what it parses**: the handler reads it parameter by parameter because the answers differ, and one parse would collapse them. Client and `redirect_uri` are validated first and a failure there never redirects, the same open-redirect discipline the app flow applies; those refusals are `oauthError`. Exact `redirect_uri` matching for both client kinds \u2014 the loopback-port wildcard of RFC 8252 \xA77.3 belongs to the one central client alone, whose URIs are configured ahead of time and cannot name an ephemeral port. A client that registered itself seconds ago can name the port it bound, and widening the wildcard there would only widen where a stolen `client_id` may send a browser. Nothing about the person is decided here \u2014 the next card asks for an email address and the password step after it resolves the account; this route knows only the client."
   },
   {
     method: "GET",
@@ -6189,7 +6064,7 @@ var ROUTES = [
     response: null,
     errors: ["rate_limited", "validation_error", "token_spent"],
     transport: "http",
-    notes: 'The identifier-first step, with nothing left to identify: Fleetless users are password-only (design D1/D7), so **this step does not read the address at all** \u2014 it renders the password card for a known address, an unknown one and an empty one alike, and the login step below answers the same `401` for all three. That is a property of the shape rather than of two branches agreeing: there is no lookup here whose result could differ. A browser form post gets the password card; a JSON caller gets `{ "next" }`, which has no schema. Still rate limited per (route, ip, email), because it is an unauthenticated endpoint that renders a page.'
+    notes: 'The identifier-first step, with nothing left to identify: Fleetless users are password-only, so **this step does not read the address at all** \u2014 it renders the password card for a known address, an unknown one and an empty one alike, and the login step below answers the same `401` for all three. That is a property of the shape rather than of two branches agreeing: there is no lookup here whose result could differ. A browser form post gets the password card; a JSON caller gets `{ "next" }`, which has no schema. Still rate limited per (route, ip, email), because it is an unauthenticated endpoint that renders a page.'
   },
   {
     method: "POST",
@@ -6257,7 +6132,7 @@ var ROUTES = [
     status: 200,
     params: [],
     query: null,
-    request: null,
+    request: oauthTokenRequest,
     response: oauthTokenResponse,
     errors: [],
     transport: "http",
@@ -6443,9 +6318,9 @@ var ROUTES = [
     response: null,
     errors: ["unauthorized", "forbidden"],
     transport: "http",
-    notes: "JSON-RPC over MCP's Streamable HTTP, so neither the request nor the response is a shape contracts describes; the tool arguments and results are the schemas in each tool definition. **Fleetless users only** \u2014 an app's users reach their own app endpoint instead. **The bearer is verified inside the handler**, not by a route guard: the identity comes from the token and the path names none, and the refusal has to carry a `WWW-Authenticate` challenge that a guard shared with the REST surface does not send. `Origin` is checked against the cloud's own, and a foreign one is the `403 forbidden` above. **Both catalogs, unconditionally**: every caller admitted here is a Fleetless user, so the tool list has nothing left to vary with and the admin-ness check on `tools/call` is gone \u2014 a console tool that is still narrower than the catalog refuses for itself (`console_robot_delete` answers `tier_required` to a non-Owner). `403 forbidden` is also what an `mcp_session` token whose subject is an **app user** gets: this endpoint serves the team only, and such a token belongs to its own app's endpoint. The code is `forbidden` rather than `mcp_disabled` because nothing is switched off \u2014 the caller is at the wrong server \u2014 and per-app sign-in mints exactly such tokens, so the two states must not share a word. `mcp_access_denied` is gone with the per-user override and the group flag it read: every Fleetless user has MCP access here (D1). Stateless: a fresh transport per request, no session id, nothing survives the call."
+    notes: "JSON-RPC over MCP's Streamable HTTP, so neither the request nor the response is a shape contracts describes; the tool arguments and results are the schemas in each tool definition. **Fleetless users only** \u2014 an app's users reach their own app endpoint instead. **The bearer is verified inside the handler**, not by a route guard: the identity comes from the token and the path names none, and the refusal has to carry a `WWW-Authenticate` challenge that a guard shared with the REST surface does not send. `Origin` is checked against the cloud's own, and a foreign one is the `403 forbidden` above. **Both catalogs, unconditionally**: every caller admitted here is a Fleetless user, so the tool list has nothing left to vary with and the admin-ness check on `tools/call` is gone \u2014 a console tool that is still narrower than the catalog refuses for itself (`console_robot_delete` answers `tier_required` to a non-Owner). `403 forbidden` is also what an `mcp_session` token whose subject is an **app user** gets: this endpoint serves the team only, and such a token belongs to its own app's endpoint. The code is `forbidden` rather than `mcp_disabled` because nothing is switched off \u2014 the caller is at the wrong server \u2014 and per-app sign-in mints exactly such tokens, so the two states must not share a word. `mcp_access_denied` is gone with the per-user override and the group flag it read: every Fleetless user has MCP access here. Stateless: a fresh transport per request, no session id, nothing survives the call."
   },
-  /* ----------------------------------------- mcp (one app's own server, D7) */
+  /* --------------------------------------------- mcp (one app's own server) */
   {
     method: "POST",
     path: MCP_APP.endpoint,
@@ -6462,7 +6337,7 @@ var ROUTES = [
     response: null,
     errors: ["not_found", "unauthorized", "forbidden"],
     transport: "http",
-    notes: "JSON-RPC over MCP's Streamable HTTP, so neither the request nor the response is a shape contracts describes \u2014 exactly as `POST /mcp` is, and stateless for the same reason: a fresh transport per request, no session id, nothing surviving the call. **App users only.** The tools are this app's robots filtered by the caller's role, built by the same builder `GET /api/apps/:id/roles/:roleId/mcp-tools` previews, so the console's preview and the live catalog cannot drift. The console tool family belongs to the central endpoint and is offered here to nobody. \n\n**The bearer is verified inside the handler**, not by a route guard, for the two reasons the central endpoint gives \u2014 the identity comes from the token and the path names none of it, and the refusal has to carry a `WWW-Authenticate` challenge a guard shared with the REST surface does not send. The challenge names **this app's** protected-resource document (RFC 9728's `resource_metadata`), which is how an MCP client discovers the right authorization server from a bare `401`; pointing it at the central document would send every app's client to the wrong sign-in. \n\n**`404 not_found` covers an identifier no app carries AND an app whose `appAuthConfig.mcp_enabled` is off \u2014 one answer for both, the same one the two metadata documents and `register` give.** A separate `403 mcp_disabled` here would hand an anonymous caller a three-way oracle (`404` = no such app, `403` = the app exists with MCP off, `401` = the app exists and is live), which is exactly the distinction discovery collapses; there is no point collapsing it in one place and publishing it in another. The switch is re-read on every request rather than cached off the token, so a developer turning it off ends the sessions already running, and it is decided **before the bearer is looked at** \u2014 the reverse of the usual order, and deliberate: it is a fact about the path, an app identifier is public, and an absent server that answered `401` would send a client hunting a credential no credential can satisfy. `401 unauthorized` is a missing, unverifiable or expired bearer, or an `aud` that is not this endpoint. `403 forbidden` is a token that verifies and is not this app's user: another app's session, a Fleetless user's central `mcp_session`, an account that is `blocked` or still `pending_verification`, or a foreign `Origin`."
+    notes: "JSON-RPC over MCP's Streamable HTTP, so neither the request nor the response is a shape contracts describes \u2014 exactly as `POST /mcp` is, and stateless for the same reason: a fresh transport per request, no session id, nothing surviving the call. **App users only.** The tools are this app's robots filtered by the caller's role, built by the same builder `GET /api/apps/:id/roles/:roleId/mcp-tools` previews, so the console's preview and the live catalog cannot drift. The console tool family belongs to the central endpoint and is offered here to nobody. \n\n**The bearer is verified inside the handler**, not by a route guard, for the two reasons the central endpoint gives \u2014 the identity comes from the token and the path names none of it, and the refusal has to carry a `WWW-Authenticate` challenge a guard shared with the REST surface does not send. The challenge names **this app's** protected-resource document (RFC 9728's `resource_metadata`), which is how an MCP client discovers the right authorization server from a bare `401`; pointing it at the central document would send every app's client to the wrong sign-in. \n\n**`404 not_found` covers an identifier no app carries AND an app whose `appAuthConfig.mcp_enabled` is off \u2014 one answer for both, the same one the two metadata documents and `register` give.** A separate `403 mcp_disabled` here would hand an anonymous caller a three-way oracle (`404` = no such app, `403` = the app exists with MCP off, `401` = the app exists and is live), which is exactly the distinction discovery collapses; there is no point collapsing it in one place and publishing it in another. The switch is re-read on every request rather than cached off the token, so a developer turning it off ends the sessions already running, and it is decided **before the bearer is looked at** \u2014 the reverse of the usual order, and deliberate: it is a fact about the path, an app identifier is public, and an absent server that answered `401` would send a client hunting a credential no credential can satisfy. `401 unauthorized` is a missing, unverifiable or expired bearer, an `aud` that is not this endpoint, or **a consent this person has since withdrawn from the client the token was minted for**: the access token names its client, and the standing consent is re-read here on every request exactly as the account is, so `DELETE /api/client/mcp/grants/:clientId` and its developer twin bite at the next call rather than when the token expires. `403 forbidden` is a token that verifies and is not this app's user: another app's session, a Fleetless user's central `mcp_session`, an account that is `blocked` or still `pending_verification`, or a foreign `Origin`."
   },
   {
     method: "GET",
@@ -6480,7 +6355,7 @@ var ROUTES = [
     response: null,
     errors: ["not_found", "unauthorized", "forbidden"],
     transport: "http",
-    notes: "MCP's Streamable HTTP gives this path three verbs: `POST` carries JSON-RPC, `GET` opens the server-initiated SSE stream, and `DELETE` ends a session. This server has no sessions \u2014 the argument is in `MCP_PROTOCOL_VERSION`'s own note, and W8's second cloud instance is where a per-process session map would break \u2014 so `GET` and `DELETE` answer `405`, which is what a client is built to fall back from. \n\n**The `405` is this cloud's own answer, not the SDK's**, and the difference was measured: MCP SDK 1.30.0 opens an SSE stream on `GET` (`handleGetRequest`) and answers `200` on `DELETE` (`handleDeleteRequest`), neither of which a stateless server has any business doing, so the cloud writes the `405` itself in the transport's own JSON-RPC error shape with `Allow: POST`. \n\n**The row exists so that the `405` is not a `404`.** An unregistered verb answers `404`, and at a path whose last segment is an app identifier a `404` already means *no such app* \u2014 one answer for two states, which is the failure this project keeps paying for. Registering the verb lets the endpoint say \"this app's server is here; this verb is not part of it\". The central `/mcp` registers neither verb and does not need to: its path takes no parameter, so nothing can misread its `404`. \n\n**The `405` body is the transport's JSON-RPC error object, not the `apiError` envelope.** The three codes above are the refusals that come *first* \u2014 the app, its switch, then the bearer, in the order `POST` describes \u2014 and they are `apiError` because they are answered before the transport is reached at all. If this server ever becomes stateful, this row and the `DELETE` beside it are where that lands, and the cloud's route-manifest test is what would make both repositories notice."
+    notes: "MCP's Streamable HTTP gives this path three verbs: `POST` carries JSON-RPC, `GET` opens the server-initiated SSE stream, and `DELETE` ends a session. This server has no sessions \u2014 the argument is in `MCP_PROTOCOL_VERSION`'s own note, and a per-process session map is what breaks at the second cloud instance \u2014 so `GET` and `DELETE` answer `405`, which is what a client is built to fall back from. \n\n**The `405` is this cloud's own answer, not the SDK's**, and the two differ: MCP SDK 1.30.0 opens an SSE stream on `GET` (`handleGetRequest`) and answers `200` on `DELETE` (`handleDeleteRequest`), neither of which a stateless server has any business doing, so the cloud writes the `405` itself in the transport's own JSON-RPC error shape with `Allow: POST`. \n\n**The row exists so that the `405` is not a `404`.** An unregistered verb answers `404`, and at a path whose last segment is an app identifier a `404` already means *no such app* \u2014 one answer for two states, which is one answer for two states. Registering the verb lets the endpoint say \"this app's server is here; this verb is not part of it\". The central `/mcp` registers neither verb and does not need to: its path takes no parameter, so nothing can misread its `404`. \n\n**The `405` body is the transport's JSON-RPC error object, not the `apiError` envelope.** The three codes above are the refusals that come *first* \u2014 the app, its switch, then the bearer, in the order `POST` describes \u2014 and they are `apiError` because they are answered before the transport is reached at all. If this server ever becomes stateful, this row and the `DELETE` beside it are where that lands, and the cloud's route-manifest test is what would make both repositories notice."
   },
   {
     method: "DELETE",
@@ -6534,7 +6409,7 @@ var ROUTES = [
     response: authorizationServerMetadata,
     errors: ["not_found"],
     transport: "http",
-    notes: "RFC 8414, for the issuer `<PUBLIC_API_BASE_URL>/mcp/<identifier>` \u2014 the same path rule as the document above, and the same `404` for a switched-off app. `registration_endpoint` is present for the reason the central document states: a client that finds it registers itself and never asks a person for a `client_id`. \n\n**`issuer`, `token_endpoint` and the resource identifier are minted from the canonical public base, never from the friendly `mcp.fleetless.dev` alias or the request's `Host`**, because a client checks a minted token's `iss` and `aud` against these exact strings. \n\n**Unlike the central document, `authorization_endpoint` does not move to an auth-portal origin**, and there is nothing here for one to serve: this authorization step renders no Fleetless page at all. It redirects to the app's own `mcp_login_url` (D7), which is on the developer's origin already."
+    notes: "RFC 8414, for the issuer `<PUBLIC_API_BASE_URL>/mcp/<identifier>` \u2014 the same path rule as the document above, and the same `404` for a switched-off app. `registration_endpoint` is present for the reason the central document states: a client that finds it registers itself and never asks a person for a `client_id`. \n\n**`issuer`, `token_endpoint` and the resource identifier are minted from the canonical public base, never from the friendly `mcp.fleetless.dev` alias or the request's `Host`**, because a client checks a minted token's `iss` and `aud` against these exact strings. \n\n**Unlike the central document, `authorization_endpoint` does not move to an auth-portal origin**, and there is nothing here for one to serve: this authorization step renders no Fleetless page at all. It redirects to the app's own `mcp_login_url`, which is on the developer's origin already."
   },
   {
     method: "POST",
@@ -6548,11 +6423,11 @@ var ROUTES = [
     status: 201,
     params: [APP_IDENTIFIER],
     query: null,
-    request: null,
+    request: dynamicClientRegistrationRequest,
     response: dynamicClientRegistrationResponse,
     errors: ["rate_limited", "not_found"],
     transport: "http",
-    notes: "RFC 7591, and deliberately **not** parsed against `dynamicClientRegistrationRequest`, for the reason `POST /mcp/oauth/register` gives: that shape is strict, and a strict schema here would answer `400` to a conforming client and take the whole paste-the-URL flow down with it. `client_name` and `redirect_uris` are read by hand; everything else is ignored, and what comes back is what was actually granted, which \xA73.2.1 allows \u2014 `authorization_code` only, so a client that asked for `refresh_token` is registered and told plainly that it did not get one. The registration carries a TTL. \n\n**The registration is scoped to this app.** A `client_id` minted here authorizes at this app's endpoint and nowhere else, so a client registered against one app cannot walk into another's authorize with it, and a developer who switches MCP off is not left with strangers' registrations valid somewhere adjacent. \n\nRefusals are `oauthError`; the rate limiter and `404 not_found` answer `apiError`. That `404` covers an unknown identifier **and** an app with the switch off, mirroring the two metadata documents this endpoint is discovered from \u2014 a client that could not read those has no business registering here, and giving it a third distinct answer would only tell it something the documents deliberately do not."
+    notes: "RFC 7591, the same wire and the same handler as `POST /mcp/oauth/register` \u2014 one implementation, because a second answer to \"is this redirect URI acceptable\" would agree with the first only by luck. The request schema is what the endpoint accepts rather than what it parses, for the reason that row gives: \xA73.2.2 needs two distinguishable refusals and one `safeParse` failure offers one. `client_name` and `redirect_uris` are read; `grant_types`, `response_types` and `scope` are accepted and ignored, and what comes back is what was actually granted, which \xA73.2.1 allows \u2014 `authorization_code` only, so a client that asked for `refresh_token` is registered and told plainly that it did not get one. The registration carries a TTL. \n\n**The registration is scoped to this app.** A `client_id` minted here authorizes at this app's endpoint and nowhere else, so a client registered against one app cannot walk into another's authorize with it, and a developer who switches MCP off is not left with strangers' registrations valid somewhere adjacent. \n\nRefusals are `oauthError`; the rate limiter and `404 not_found` answer `apiError`. That `404` covers an unknown identifier **and** an app with the switch off, mirroring the two metadata documents this endpoint is discovered from \u2014 a client that could not read those has no business registering here, and giving it a third distinct answer would only tell it something the documents deliberately do not."
   },
   {
     method: "GET",
@@ -6565,12 +6440,12 @@ var ROUTES = [
     ownerTier: false,
     status: 302,
     params: [APP_IDENTIFIER],
-    query: null,
+    query: oauthAuthorizeQuery,
     request: null,
     response: null,
     errors: ["not_found", "target_state_conflict"],
     transport: "http",
-    notes: '**Fleetless renders no page here, and that is the whole of D7.** The route writes an interaction \u2014 ten minutes, as the OIDC ones live \u2014 and redirects to `appAuthConfig.mcp_login_url` with `{interaction}` filled in. The app then authenticates the person with its own UI, reads `GET /api/client/mcp/interactions/:id` to show the client\'s claimed name and the scopes it asked for, and calls approve or deny. \n\nClient and `redirect_uri` are validated first and a failure there never redirects \u2014 the open-redirect discipline `GET /mcp/oauth/authorize` and `GET /api/client/oidc/:slug/start` both keep \u2014 and those refusals are RFC 6749\'s flat `oauthError`, which is why none of them appear above. `redirect_uri` is matched **exactly** against the registration, with no loopback-port wildcard: every client here registered itself minutes ago and can name the port it bound, so a wildcard would only widen where a stolen `client_id` may send a browser. \n\nThe two codes above are the `apiError` envelope because they are refusals about the **app**, decided before an OAuth parameter is looked at. **`404 not_found` covers an identifier no app carries AND an app with MCP switched off** \u2014 the same single answer the two metadata documents, `register` and the transport give. An earlier draft answered `403 mcp_disabled` here, on the argument that a client which registered while the switch was on is owed the difference between "turned off" and "mistyped"; that argument does not survive the caller being anonymous. This route takes no credential, so the extra code was readable by anyone who could type an identifier, and it handed back precisely the existence distinction every neighbouring route collapses. `mcp_disabled` survives only where the caller has already proved they belong to the app \u2014 the two decision routes under `/api/client/mcp/interactions/:id`. `409 target_state_conflict` names `mcp_login_url` with rule `not_set`: MCP is enabled and no page is configured to send the person to. It is the same code and the same shape `send_mail` answers for an unconfigured `invite_url`, and the refusal is the honest one \u2014 Fleetless has nowhere to redirect, and rendering a page of its own instead would contradict D2.'
+    notes: 'The same query as `GET /mcp/oauth/authorize`, read the same way \u2014 parameter by parameter, because the answers differ and one parse would collapse them. \n\n**Fleetless renders no page here**, and that is the whole of it. The route writes an interaction \u2014 ten minutes, as the OIDC ones live \u2014 and redirects to `appAuthConfig.mcp_login_url` with `{interaction}` filled in. The app then authenticates the person with its own UI, reads `GET /api/client/mcp/interactions/:id` to show the client\'s claimed name and the scopes it asked for, and calls approve or deny. \n\nClient and `redirect_uri` are validated first and a failure there never redirects \u2014 the open-redirect discipline `GET /mcp/oauth/authorize` and `GET /api/client/oidc/:slug/start` both keep \u2014 and those refusals are RFC 6749\'s flat `oauthError`, which is why none of them appear above. `redirect_uri` is matched **exactly** against the registration, with no loopback-port wildcard: every client here registered itself minutes ago and can name the port it bound, so a wildcard would only widen where a stolen `client_id` may send a browser. \n\nThe two codes above are the `apiError` envelope because they are refusals about the **app**, decided before an OAuth parameter is looked at. **`404 not_found` covers an identifier no app carries AND an app with MCP switched off** \u2014 the same single answer the two metadata documents, `register` and the transport give. An earlier draft answered `403 mcp_disabled` here, on the argument that a client which registered while the switch was on is owed the difference between "turned off" and "mistyped"; that argument does not survive the caller being anonymous. This route takes no credential, so the extra code was readable by anyone who could type an identifier, and it handed back precisely the existence distinction every neighbouring route collapses. `mcp_disabled` survives only where the caller has already proved they belong to the app \u2014 the two decision routes under `/api/client/mcp/interactions/:id`. `409 target_state_conflict` names `mcp_login_url` with rule `not_set`: MCP is enabled and no page is configured to send the person to. It is the same code and the same shape `send_mail` answers for an unconfigured `invite_url`, and the refusal is the honest one \u2014 Fleetless has nowhere to redirect, and rendering a page of its own would contradict the rule that Fleetless shows an app user no page.'
   },
   {
     method: "POST",
@@ -6584,7 +6459,7 @@ var ROUTES = [
     status: 200,
     params: [APP_IDENTIFIER],
     query: null,
-    request: null,
+    request: oauthTokenRequest,
     response: oauthTokenResponse,
     errors: [],
     transport: "http",
@@ -6842,7 +6717,7 @@ var ROUTES = [
     response: null,
     errors: ["rate_limited"],
     transport: "http",
-    notes: "**One callback URL for every app and every provider**, and the value of `appAuthConfig.oidc_callback_url` \u2014 the string a developer registers at their IdP. `CLIENT_OIDC_CALLBACK_PATH` in `client-auth.ts` is the single spelling of this path; the URL is that path on the cloud's canonical public base, never a friendly alias, because the provider compares the redirect target against the one string it was given. \n\n**Rate limited per ip, generously.** The first draft left this route unlimited on the argument that the caller is an identity provider redirecting somebody's browser, so a limiter would drop real sign-ins on the strength of traffic none of those people sent. The cost of that argument is a `state` obtained from one `start` being replayable for the interaction's full ten minutes, unbounded and unauthenticated, with every replay driving a server-side POST to the developer's token endpoint and one audit row into their org \u2014 an amplifier against a third party. The interaction is now spent on **every** terminal outcome, refusals included, which closes the replay itself; the limiter is the ceiling on how fast the attempts may arrive at all. It is per ip and sized for a browser, so a person completing a sign-in never meets it. `429 rate_limited` is the one `apiError` this route can answer, and it is not a sign-in outcome \u2014 it is a refusal to begin the work, which is why it does not ride back to the app as an `?error=`. \n\nThe query is the **provider's** rather than a Fleetless shape, and `clientOidcCallbackQuery` describes it **without being strict**: `state` always, `code` on success, `error` and `error_description` on the provider's own refusal, and whatever else that provider adds \u2014 RFC 9207's `iss`, a `session_state`, a vendor field. Refusing those would refuse conforming providers, the trap `POST /mcp/oauth/register` documents avoiding. `state` is the required field because it is the only one Fleetless minted. \n\n**It lists `rate_limited` and no other code, because every sign-in outcome it has is a redirect.** Success and failure alike are a `302` to the app's own `redirect_uri`: `?code=\u2026&state=\u2026` when a session was resolved, `?error=<clientOidcErrorCode>&state=\u2026` when it was not, so the app renders its own message and can bind either answer to the request it started. Fleetless shows an app user no page (D2). \n\n**The one exception is a `state` that resolves to no interaction** \u2014 unknown, hand-edited, or past its ten minutes. Then there is no confirmed redirect target to carry the answer to, and bouncing a browser to an unvalidated one is the hole the whole flow is arranged to avoid, so the cloud renders an HTML problem page at `400`. That is the only Fleetless-rendered surface an app user can reach. It is HTML rather than an `apiError`, which is why no code is listed: a code here would document an envelope no caller receives, and this manifest's other HTML pages (`GET /mcp/oauth/interaction/:id`, `GET /console/oauth/interaction/:id`) say their status in prose for the same reason."
+    notes: "**One callback URL for every app and every provider**, and the value of `appAuthConfig.oidc_callback_url` \u2014 the string a developer registers at their IdP. `CLIENT_OIDC_CALLBACK_PATH` in `client-auth.ts` is the single spelling of this path; the URL is that path on the cloud's canonical public base, never a friendly alias, because the provider compares the redirect target against the one string it was given. \n\n**Rate limited per ip, generously.** The first draft left this route unlimited on the argument that the caller is an identity provider redirecting somebody's browser, so a limiter would drop real sign-ins on the strength of traffic none of those people sent. The cost of that argument is a `state` obtained from one `start` being replayable for the interaction's full ten minutes, unbounded and unauthenticated, with every replay driving a server-side POST to the developer's token endpoint and one audit row into their org \u2014 an amplifier against a third party. The interaction is now spent on **every** terminal outcome, refusals included, which closes the replay itself; the limiter is the ceiling on how fast the attempts may arrive at all. It is per ip and sized for a browser, so a person completing a sign-in never meets it. `429 rate_limited` is the one `apiError` this route can answer, and it is not a sign-in outcome \u2014 it is a refusal to begin the work, which is why it does not ride back to the app as an `?error=`. \n\nThe query is the **provider's** rather than a Fleetless shape, and `clientOidcCallbackQuery` describes it **without being strict**: `state` always, `code` on success, `error` and `error_description` on the provider's own refusal, and whatever else that provider adds \u2014 RFC 9207's `iss`, a `session_state`, a vendor field. Refusing those would refuse conforming providers, the trap `POST /mcp/oauth/register` documents avoiding. `state` is the required field because it is the only one Fleetless minted. \n\n**It lists `rate_limited` and no other code, because every sign-in outcome it has is a redirect.** Success and failure alike are a `302` to the app's own `redirect_uri`: `?code=\u2026&state=\u2026` when a session was resolved, `?error=<clientOidcErrorCode>&state=\u2026` when it was not, so the app renders its own message and can bind either answer to the request it started. Fleetless shows an app user no page. \n\n**The one exception is a `state` that resolves to no interaction** \u2014 unknown, hand-edited, or past its ten minutes. Then there is no confirmed redirect target to carry the answer to, and bouncing a browser to an unvalidated one is the hole the whole flow is arranged to avoid, so the cloud renders an HTML problem page at `400`. That is the only Fleetless-rendered surface an app user can reach. It is HTML rather than an `apiError`, which is why no code is listed: a code here would document an envelope no caller receives, and this manifest's other HTML pages (`GET /mcp/oauth/interaction/:id`, `GET /console/oauth/interaction/:id`) say their status in prose for the same reason."
   },
   {
     method: "POST",
@@ -6862,7 +6737,7 @@ var ROUTES = [
     transport: "http",
     notes: "The second half of the app's own PKCE: the `code` from the callback redirect plus the `code_verifier` for the challenge `start` carried. Sixty seconds, single-use, and worth nothing to whoever intercepted the redirect without the verifier. \n\n**One refusal for every code that does not work: `410 token_spent`** \u2014 unknown, past its sixty seconds, already exchanged, or presented with a verifier that does not match. There is one code because this code **is a credential**: telling the four apart would say whether a given value ever existed, and the recovery is the same in all four \u2014 start the sign-in again. The MCP interaction routes collapse their four states the same way and for the same reason, and answer `interaction_expired` rather than this code \u2014 the difference is what the value is, not how vague the answer is: a mailed one-time code is a credential, an interaction id names a pending request, and the two deserve different advice on the app's own page."
   },
-  /* --------------------------- the app's own MCP consent screen (D7) */
+  /* ------------------------------- the app's own MCP consent screen */
   {
     method: "GET",
     path: "/api/client/mcp/interactions/:id",
@@ -6897,7 +6772,7 @@ var ROUTES = [
     response: clientMcpInteractionDecisionResponse,
     errors: [...CLIENT_GUARD, "rate_limited", "interaction_expired", "mcp_disabled"],
     transport: "http",
-    notes: "The person is already signed in **at the app**, by whatever means that app uses, and this is the app telling Fleetless what they decided. Fleetless never sees that sign-in, which is D7 in one sentence. \n\nThe guard admits all three caller kinds and the handler takes one: a developer bearer or a server key reaching this is `401 unauthorized`, because a consent is a person's and a server key is not a person \u2014 the same shape `POST /api/client/password/change` has. `403 mcp_disabled` is the app's switch, re-read here as it is on every request \u2014 and it is the one refusal on this surface that names the switch, because reaching it needs an app-user session of that very app. \n\n**An interaction of ANOTHER app answers `410 interaction_expired`, not `403`.** An interaction of one app cannot be decided with a session from another \u2014 that is what stops a developer running two apps from letting one speak for the other \u2014 but saying so with a distinct code would tell any bearer holder that the id names a real, live interaction somewhere else, which is the existence answer the shared `410` exists to withhold. Unknown, expired, already decided, an interaction of the central flow, and one belonging to a different app are one status and one body. Approve and deny spend an interaction alike, so the second call gets it whichever route made the first. \n\n**Rate limited per app user, unlike the read.** The read is a public document about a request the server already holds; this one spends something, and a decision is the one thing a leaked interaction id would be worth hammering for. The limit is on the signed-in account rather than on the ip, because that is what the caller has had to prove. \n\n**The answer is a redirect target, not a redirect.** `redirect_to` is the MCP client's own callback carrying the authorization code, and the app's page sends the browser there. The app is holding that browser and Fleetless is answering its JSON call, so a `302` here would be a redirect on the wrong request. Approving records the grant for this user and this client, which is what a later `already_granted` reads back."
+    notes: "The person is already signed in **at the app**, by whatever means that app uses, and this is the app telling Fleetless what they decided. Fleetless never sees that sign-in. \n\nThe guard admits all three caller kinds and the handler takes one: a developer bearer or a server key reaching this is `401 unauthorized`, because a consent is a person's and a server key is not a person \u2014 the same shape `POST /api/client/password/change` has. `403 mcp_disabled` is the app's switch, re-read here as it is on every request \u2014 and it is the one refusal on this surface that names the switch, because reaching it needs an app-user session of that very app. \n\n**An interaction of ANOTHER app answers `410 interaction_expired`, not `403`.** An interaction of one app cannot be decided with a session from another \u2014 that is what stops a developer running two apps from letting one speak for the other \u2014 but saying so with a distinct code would tell any bearer holder that the id names a real, live interaction somewhere else, which is the existence answer the shared `410` exists to withhold. Unknown, expired, already decided, an interaction of the central flow, and one belonging to a different app are one status and one body. Approve and deny spend an interaction alike, so the second call gets it whichever route made the first. \n\n**Rate limited per app user, unlike the read.** The read is a public document about a request the server already holds; this one spends something, and a decision is the one thing a leaked interaction id would be worth hammering for. The limit is on the signed-in account rather than on the ip, because that is what the caller has had to prove. \n\n**The answer is a redirect target, not a redirect.** `redirect_to` is the MCP client's own callback carrying the authorization code, and the app's page sends the browser there. The app is holding that browser and Fleetless is answering its JSON call, so a `302` here would be a redirect on the wrong request. Approving records the grant for this user and this client, which is what a later `already_granted` reads back."
   },
   {
     method: "POST",
@@ -6934,7 +6809,7 @@ var ROUTES = [
     response: mcpConsentGrantListResponse,
     errors: [...CLIENT_GUARD],
     transport: "http",
-    notes: "**So the developer's app can offer a \"connected apps\" screen of its own**, which is the only place an end user could ever be shown this: Fleetless renders no page for an app's users (D2), and the console is the developer's tool rather than their customers'. \n\nThe answer is about the bearer's own account and takes no user id \u2014 there is no id to pass and therefore nothing to pass the wrong one. The guard admits all three caller kinds because it is shared, and the handler takes one: a developer bearer or a server key is `401 unauthorized`, the shape `POST /api/client/password/change` has, because a consent is a person's and a server key is not a person. \n\n**Every `client_name` is unverified**, on every row: dynamic registration takes no credential, so the name is text the client chose about itself and `client_name_verified` is the literal `false`. A screen that renders it as an identity is showing somebody a string an attacker picked, and this list is read long after the moment of approval, when nobody remembers what they clicked. **Withdrawn grants are absent**, not listed as withdrawn. \n\n**Not rate limited and not gated on the app's MCP switch.** It reads one small table for one account, and a person must be able to see and end what they agreed to even after a developer switches MCP off \u2014 a withdrawal door that closes with the feature is a door that is shut exactly when somebody wants it."
+    notes: "**So the developer's app can offer a \"connected apps\" screen of its own**, which is the only place an end user could ever be shown this: Fleetless renders no page for an app's users, and the console is the developer's tool rather than their customers'. \n\nThe answer is about the bearer's own account and takes no user id \u2014 there is no id to pass and therefore nothing to pass the wrong one. The guard admits all three caller kinds because it is shared, and the handler takes one: a developer bearer or a server key is `401 unauthorized`, the shape `POST /api/client/password/change` has, because a consent is a person's and a server key is not a person. \n\n**Every `client_name` is unverified**, on every row: dynamic registration takes no credential, so the name is text the client chose about itself and `client_name_verified` is the literal `false`. A screen that renders it as an identity is showing somebody a string an attacker picked, and this list is read long after the moment of approval, when nobody remembers what they clicked. **Withdrawn grants are absent**, not listed as withdrawn. \n\n**Not rate limited and not gated on the app's MCP switch.** It reads one small table for one account, and a person must be able to see and end what they agreed to even after a developer switches MCP off \u2014 a withdrawal door that closes with the feature is a door that is shut exactly when somebody wants it."
   },
   {
     method: "DELETE",
@@ -6952,7 +6827,7 @@ var ROUTES = [
     response: null,
     errors: [...CLIENT_GUARD],
     transport: "http",
-    notes: "The person's own door, beside the developer's `DELETE /api/apps/:id/users/:userId/mcp-grants/:clientId`. It acts on the bearer's own account and on no other \u2014 the path carries a client and never a subject \u2014 so there is no user for a caller to name and none to confuse. The shared guard admits all three caller kinds and the handler takes one: a developer bearer or a server key is `401 unauthorized`, because withdrawing a consent is the same person's act as giving it. Audited as `app_user.mcp_grant_revoked`, with the app user themselves as the actor. \n\n**`204` whether or not there was anything to withdraw.** A client id this account never approved, and one it withdrew a minute ago, both answer the end state that was asked for: a `404` would tell the caller which clients some account has connected, and would make the ordinary double-click a failure. Only a withdrawal that ended a standing agreement is audited. \n\n**It does not end an MCP session already running.** That consent minted a fifteen-minute access token, and the MCP transport checks it against the account rather than against this table, so a session in flight survives until it expires. Nothing can extend it \u2014 this authorization server issues no refresh tokens \u2014 and the next authorization asks again. An app that needs a client cut off **now** blocks the account, which ends every session that account holds rather than this client's alone."
+    notes: "The person's own door, beside the developer's `DELETE /api/apps/:id/users/:userId/mcp-grants/:clientId`. It acts on the bearer's own account and on no other \u2014 the path carries a client and never a subject \u2014 so there is no user for a caller to name and none to confuse. The shared guard admits all three caller kinds and the handler takes one: a developer bearer or a server key is `401 unauthorized`, because withdrawing a consent is the same person's act as giving it. Audited as `app_user.mcp_grant_revoked`, with the app user themselves as the actor. \n\n**`204` whether or not there was anything to withdraw.** A client id this account never approved, and one it withdrew a minute ago, both answer the end state that was asked for: a `404` would tell the caller which clients some account has connected, and would make the ordinary double-click a failure. Only a withdrawal that ended a standing agreement is audited. \n\n**It ends a session already running, at that client's very next call.** The app's MCP endpoint reads this table on every request and keys the check on the `client_id` the access token carries, so the withdrawn client is answered `401` with a challenge and has to ask this person again. The token it holds is still unexpired \u2014 up to fifteen minutes are left on it \u2014 and is refused anyway. Nothing else stops: this ends one client, not the account, which is what blocking would end."
   },
   /* ------------------------------------------------------------- robots */
   {
@@ -7445,7 +7320,7 @@ var ROUTES = [
     response: jobRunListResponse,
     errors: [...CLIENT_GUARD, "invalid_uuid", "not_found", "capability_required", "validation_error"],
     transport: "http",
-    notes: "Needs the `action_history` capability, and **this route is what makes that switch mean something** \u2014 it was unkeepable while nothing durable recorded what had run. Two residuals worth stating rather than implying away. `history` is a syntactically valid slug and Fastify matches a static segment first, so a robot with a service literally slugged `history` can no longer be **read** through `GET /api/robots/:id/jobs/:slug`; invoking, cancelling and the listing are unaffected. And a run row names its actor by email address, so an end user holding this capability learns which other people have been driving the machine. `robot_id` in the query is shared with the org-wide read; a *different* one here is refused rather than quietly answered about the robot in the path."
+    notes: "Needs the `action_history` capability, and **this route is what makes that switch mean something** \u2014 it was unkeepable while nothing durable recorded what had run. Two residuals worth stating rather than implying away. `history` is a syntactically valid slug and The router matches a static segment first, so a robot with a service literally slugged `history` can no longer be **read** through `GET /api/robots/:id/jobs/:slug`; invoking, cancelling and the listing are unaffected. And a run row names its actor by email address, so an end user holding this capability learns which other people have been driving the machine. `robot_id` in the query is shared with the org-wide read; a *different* one here is refused rather than quietly answered about the robot in the path."
   },
   {
     method: "POST",
@@ -7947,7 +7822,7 @@ var ROUTES = [
     response: asset,
     errors: ["unauthorized", "rate_limited", "asset_too_large", "validation_error", "not_found", "quota_exceeded", "bad_request"],
     transport: "http",
-    notes: "The body is the **raw file bytes**, not JSON, so it has no request schema; everything about the file \u2014 its kind, its name, its sync id and its announced size \u2014 rides in the `x-fleetless-asset-*` headers `ASSET_UPLOAD_HEADERS` names. The credential is a short-lived upload token minted by `POST /api/robots/:id/assets/sync`, verified in a `preParsing` hook so a refusal precedes the work rather than following it: a `preHandler` would already have buffered the whole file. The announced size is refused there too, before a single byte is read \u2014 it is an announcement and not a proof, so it only ever rejects early and never accepts early, and a body that lies small is still caught by the real length check. Past both, Fastify's own body limit answers a bare `413 bad_request` with neither ceiling nor size in it. Rate limited per robot inside that same hook, which is why `rateLimited` is `false`: there is no rate-limiting preHandler registered on this route."
+    notes: "The body is the **raw file bytes**, not JSON, so it has no request schema; everything about the file \u2014 its kind, its name, its sync id and its announced size \u2014 rides in the `x-fleetless-asset-*` headers `ASSET_UPLOAD_HEADERS` names. The credential is a short-lived upload token minted by `POST /api/robots/:id/assets/sync`, verified in a `preParsing` hook so a refusal precedes the work rather than following it: a `preHandler` would already have buffered the whole file. The announced size is refused there too, before a single byte is read \u2014 it is an announcement and not a proof, so it only ever rejects early and never accepts early, and a body that lies small is still caught by the real length check. Past both, the server's own body limit answers a bare `413 bad_request` with neither ceiling nor size in it. Rate limited per robot inside that same hook, which is why `rateLimited` is `false`: there is no rate-limiting preHandler registered on this route."
   },
   /* ------------------------------------ realtime and bridge transports */
   {
@@ -8484,7 +8359,7 @@ function createRealtimeCommandTransport(channel) {
       };
       return sendCommand(channel, frame, { timeoutMs });
     },
-    // Declared `async` for the same reason `invoke` above is (D3a, D6):
+    // Declared `async` for the same reason `invoke` above is:
     // `assertValidJobId` can throw before a frame is ever built, and a
     // caller of this interface is entitled to a rejected promise, never a
     // thrown exception.