@fleetless/sdk 3.0.1 → 3.0.2

package/CHANGELOG.md

@@ -4,6 +4,73 @@ All notable changes to `@fleetless/sdk`. The format follows Keep a Changelog; th
 
 ## [Unreleased]
 
+## [3.0.2] — 2026-09-07
+
+No API change, and one documentation example that now compiles. The guard
+that was supposed to prove 3.0.1 clean was **green over four internal
+references still inside the published bundle**, so it was rebuilt around the
+question rather than around three directory names.
+
+### Fixed
+
+- **Four internal references in the published 3.0.1 bundle**, which the guard
+  could not see: an internal decision label in `dist/index.js` and
+  `dist/index.cjs`, and a sentence in both about how a defect class had been
+  found. Measured against the registry rather than against this tree — 3.0.1
+  scores 4, 3.0.2 scores 0, and 3.0.0 scores 423.
+- **The README's error-handling example did not compile.** `details` is
+  `unknown` on `FleetlessError`, deliberately, and the block read fields off
+  it directly — two `TS2339`s in a TypeScript SDK's own README, in the block a
+  reader copies first. It now narrows before reading, and it is opted in to
+  the documentation type check so it cannot drift again.
+- **`Node 20 or newer` was listed as a runtime for the whole SDK.** Node 20
+  has no global `WebSocket` — it is behind a flag there — so anything realtime
+  fails on it with the SDK's own `no_websocket`. The README names Node 22, and
+  says what to pass on Node 20 instead.
+- **Everything published pointed at a public repository that does not exist
+  yet.** `repository`, `bugs.url`, the README, `CONTRIBUTING.md` and
+  `RELEASING.md` all named it, and its four relative links resolved to 404s on
+  the npm page. They point at the maintainer address until the repository is
+  opened.
+- **`CONTRIBUTING.md` linked `RELEASING.md`, which the tarball did not
+  carry.** `RELEASING.md` ships now, and every relative link in every shipped
+  document is checked against the tarball's own entries.
+- **Each published file declares exactly one licence.** The bundler inlines
+  `@fleetless/contracts`, which is Apache-2.0, and the declaration files
+  carried six of its SPDX identifiers below this package's MIT one. A licence
+  scan over `node_modules` reported Apache obligations for a package that
+  ships no Apache text. The inherited identifiers are stripped at build time.
+- **A CI comment sent whoever was reading a red publish job to a README
+  section that does not exist**, and `RELEASING.md` told a maintainer the
+  suite runs against a fake `fetch` — which `CONTRIBUTING.md` devotes a
+  section to denying, and which is untrue of three of the nineteen suites.
+
+### Changed
+
+- **The guard scans what becomes public, computed rather than named.** The
+  union of what `npm pack` reports, what `git ls-files` reports and a walk of
+  every directory in `files`. Ten tracked files were outside the previous
+  shape, two of them published bytes; one of those two had already carried an
+  internal host to the registry inside `devDependencies`.
+- **Only the German scan strips anything**, and only URLs and single-token
+  code spans. Stripping links and backticks before every class made the six
+  shipped documents blind to an internal hostname inside a markdown link.
+- **Eighteen detectors, each carrying its own two fixtures**, with a floor
+  over the count. Seven of the previous fifteen had no fixture proving they
+  could fire, and two could be deleted with the whole suite green.
+- **The tarball guard asserts absence as well as presence**: nothing outside
+  `files`, no sourcemaps, no source. It reads every dependency section rather
+  than the runtime one alone, and runs the marker detectors over the packed
+  manifest.
+
+### Added
+
+- **`test/readme-pointers.test.ts`**: every pointer from the code into the
+  README resolves to a heading that is there. That was the defect 3.0.1 fixed
+  and left unguarded, one of them inside a runtime error message.
+- **`scripts/verify-commit-messages.mjs`**, wired into the verify job. A
+  commit message is public the moment it is pushed.
+
 ## [3.0.1] — 2026-09-07
 
 No API change. This release exists because **3.0.0 published internal material
@@ -18,17 +85,33 @@ without it.
   comment beside it. In 3.0.0 those paths encoded a `git+ssh://` dependency
   specifier, so an internal hostname appeared **48 times** across the two
   bundles; the inlined comments carried German paragraphs and internal defect
-  ids with them. Measured over the published tarballs, the same seventeen
-  detectors over `dist/`:
-
-  | | 3.0.0 | 3.0.1 |
-  |---|---|---|
-  | internal host or workspace name | 49 | 0 |
+  ids with them.
+
+  The table this entry first carried cited "the same seventeen detectors",
+  while the entry below it said the guard had fifteen classes and the guard
+  itself asserted fifteen. No seventeen-detector artefact ever existed, so
+  the numbers could not be reproduced from anything shipped. They are
+  replaced here by a measurement of the two **published tarballs** with the
+  guard as rebuilt in 3.0.2, which is a thing a reader can run:
+
+  | class | 3.0.0 | 3.0.1 |
+  |---|---:|---:|
+  | terse schedule label | 134 | 0 |
   | German prose | 58 | 0 |
-  | internal wave labels | 134 | 0 |
-  | internal decision labels | 42 | 0 |
-  | internal defect ids | 14 | 0 |
-  | every other class | 62 | 0 |
+  | internal host or workspace name | 49 | 0 |
+  | internal decision label | 44 | **2** |
+  | a reference to this package rather than the reader's | 30 | 0 |
+  | internal review codename | 28 | 0 |
+  | a reference to a document the reader does not have | 26 | 0 |
+  | longer schedule label | 16 | 0 |
+  | how the behaviour was found | 16 | **2** |
+  | internal defect id | 14 | 0 |
+  | internal feature id | 4 | 0 |
+  | the reference robot by name | 4 | 0 |
+  | **total** | **423** | **4** |
+
+  The four remaining in 3.0.1 are the subject of 3.0.2 below. They are here
+  rather than in that entry because this is the entry that claimed zero.
 
   None of it appeared in this repository's own source, which is why no sweep of
   the source had found it. The fix is the contracts pin — `@fleetless/contracts`

package/CONTRIBUTING.md

@@ -88,9 +88,10 @@ came back and on which line.
 
 ## Pull requests
 
-**Pull requests are welcome on GitHub**, at
-<https://github.com/fleetless/sdk>. Open an issue first for anything that
-changes an existing method signature or what a method sends, so we can say what
+**The public repository is not open yet.** It will be, and this section
+describes how it will work then. Until it exists, send patches and questions to
+<hello@fleetless.dev>. Either way, raise anything that changes an existing
+method signature or what a method sends before you write it, so we can say what
 else has to move with it.
 
 **CI runs on GitLab.** This repository is mirrored from an internal GitLab

package/README.md

@@ -12,8 +12,12 @@ behind roles. The SDK covers all of it: datapoints (read, subscribe, recorded
 history), actions, services, publishers, cameras, jobs, assets and URDF, and
 the whole client auth API your own sign-in UI calls. It is framework-agnostic,
 ships ESM and CJS with its own types, and runs wherever a `fetch` and a
-`WebSocket` exist — a browser, a mobile webview, Node 20 or newer, and
-server-side with a server key instead of a user session.
+`WebSocket` exist — a browser, a mobile webview, Node 22 or newer, and
+server-side with a server key instead of a user session. On Node 20 the REST
+half works as it stands, but there is no global `WebSocket` (it is behind
+`--experimental-websocket` there), so anything realtime needs one supplied:
+`createClient({ …, WebSocket: (await import('ws')).WebSocket })`, or the flag.
+Without it, `subscribe` calls `onError` with `no_websocket`.
 
 **The mental model in one paragraph.** A robot runs the Fleetless bridge, a
 ROS 2 node. In the [Fleetless Console](https://console.fleetless.dev) a
@@ -262,7 +266,7 @@ it is not true. So *how often* and *when* to publish is your application's
 decision, made where it can see the user's intent:
 
 ```ts
-// A control loop is yours to write, and yours to stop.
+// A control loop is yours to write, and yours to stop. `speed` is your app's.
 const timer = setInterval(() => {
   void client.publishers.publish(robotId, 'cmd_vel', { 'linear.x': speed })
 }, 100)
@@ -300,27 +304,48 @@ Every refusal arrives as a `FleetlessError` with a stable `code`. Branch on the
 code; never parse the message, which is written for a developer reading a
 console and may change.
 
-```ts
-import { FleetlessError } from '@fleetless/sdk'
+`error.details` is typed `unknown`, deliberately: it is whatever the server
+sent, and the SDK does not pretend to have validated it. Narrow it before you
+read a field. `BusyDetails` and `RateLimitDetails` are exported as types, and
+`parameterInvalidDetails` as a runtime schema you can `parse`.
+
+```ts checked
+import { createClient, FleetlessError } from '@fleetless/sdk'
+import type { BusyDetails, RateLimitDetails } from '@fleetless/sdk'
+
+declare function showRunning(job: BusyDetails['running'] | undefined): void
+declare function showOffline(): void
+declare function showNotAllowed(): void
+declare function showRetryLater(ms: number | undefined): void
+declare function showUnexpected(error: FleetlessError): void
+
+const client = createClient({ apiUrl: 'https://api.fleetless.dev', appIdentifier: 'warehouse_dash' })
+const robotId = '4f2c1a90-7b3e-4d51-9c86-0a1b2c3d4e5f'
+
+/** `details` is server-shaped: check the field is there before reading it. */
+const field = <T,>(details: unknown, key: string): T | undefined =>
+  typeof details === 'object' && details !== null && key in details
+    ? ((details as Record<string, unknown>)[key] as T)
+    : undefined
 
 try {
   await client.actions.invoke(robotId, 'dock', {})
 } catch (error) {
   if (!(error instanceof FleetlessError)) throw error
   switch (error.code) {
-    case 'busy':          return showRunning(error.details?.running)
-    case 'robot_offline': return showOffline()
-    case 'forbidden':     return showNotAllowed()
-    case 'rate_limited':  return showRetryLater(error.details?.retry_after_ms)
-    default:              return showUnexpected(error)
+    case 'busy':          showRunning(field<BusyDetails['running']>(error.details, 'running')); break
+    case 'robot_offline': showOffline(); break
+    case 'forbidden':     showNotAllowed(); break
+    case 'rate_limited':  showRetryLater(field<RateLimitDetails['retry_after_ms']>(error.details, 'retry_after_ms')); break
+    default:              showUnexpected(error); break
   }
 }
 ```
 
 - **`rate_limited` is surfaced, never retried behind your back.** The SDK does
-  not sleep and re-send. `error.details.retry_after_ms` carries the wait the
-  platform asked for, when it sent one — read it defensively, since a refusal
-  from an intermediary may carry no `details` at all.
+  not sleep and re-send. `details.retry_after_ms` carries the wait the platform
+  asked for, when it sent one — read it defensively, since a refusal from an
+  intermediary may carry no `details` at all.
 - **The one retry the SDK does perform is `token_expired`**, and only once: it
   refreshes the session and re-sends the same request. That refresh is
   single-flight, so ten concurrent calls meeting an expired token share one.
@@ -361,7 +386,8 @@ belongs to the platform instead.
 
 ## Contributing
 
-Pull requests are welcome at <https://github.com/fleetless/sdk>. Read
+The public repository is not open yet. Until it is, send patches and questions
+to <hello@fleetless.dev>. Read
 [CONTRIBUTING.md](CONTRIBUTING.md) first: it covers the setup, the checks, the
 Contributor Licence Agreement, and the one rule this repository is strict about
 — the auth suites drive the SDK's own `fetch` against a real `node:http`

package/RELEASING.md

@@ -0,0 +1,195 @@
+# Releasing `@fleetless/sdk`
+
+Maintainer notes: the development setup, the checks, and the release
+procedure. This file is not part of the published package.
+
+**CI runs on GitLab; the repository will mirror to GitHub.** The pipeline
+that verifies and publishes this package lives on an internal GitLab instance,
+and that is the only thing that publishes to npm. The public repository does not
+exist yet; when it does it is a mirror, where issues and pull requests arrive
+and no check runs. A contributor's pull request is verified by a maintainer
+running the same commands locally — see
+[CONTRIBUTING.md](CONTRIBUTING.md), which says so to the contributor as well.
+
+A mirror pushes what it is given, so **everything in a commit becomes public
+the moment it is pushed**, including the commit message and every file the
+branch touched.
+## Development setup
+
+Node 22 via `nvm`, and pnpm through corepack:
+
+```sh
+nvm use 22
+corepack enable
+pnpm install
+```
+
+**That install needs nothing private.** `@fleetless/contracts` — the source
+of truth for every wire type this SDK reads or writes — is a devDependency on
+the public npm package, pinned to an exact version. It used to be a private
+`git+ssh://` URL that only somebody with GitLab group access could install;
+that is over. The published SDK is unaffected either way: `tsup` inlines
+contracts' types into `dist/`, so a consumer of `@fleetless/sdk` never
+resolves it.
+
+Never redefine a shape the SDK sends to or reads from the API. Import it from
+`@fleetless/contracts` instead.
+
+## Checks
+
+| Command | What it does |
+|---|---|
+| `pnpm typecheck` | `tsc --noEmit` over the package. |
+| `pnpm test` | vitest. Most suites drive a fake `fetch` and a fake WebSocket; the three auth suites drive the SDK's own default `fetch` against a real `node:http` server (`test/local-api.ts`). No cloud needed. |
+| `pnpm build` | tsup into `dist/` — ESM, CJS and `.d.ts`. |
+| `pnpm run test:pack` | `npm pack`s the tarball, installs it into a bare project with nothing but `typescript`, and typechecks and runs real usage against it. This is what catches a `dist/index.d.ts` that still imports from `@fleetless/contracts` — a devDependency, so a consumer of the SDK never installs it. |
+
+Two further scripts check the built package against a **running** cloud
+(`./infra/dev.sh` in the umbrella repo). Each one runs against `dist/`, not
+`src/`, so run `pnpm build` first, and each fails by name on a missing
+variable rather than defaulting quietly.
+
+- `pnpm run verify:live` — a `busy` refusal carrying the job that is already
+  running, `command_outcome_unknown` and its documented recovery, a
+  `parameter_invalid` naming the flat key, job-id-addressed cancel, and
+  per-session camera release. Needs `FLEETLESS_API_URL` (or `API`),
+  `APP_IDENTIFIER`, `EMAIL`, `PASSWORD`, `ROBOT_ID`, `ACTION_SLUG`,
+  `SERVICE_SLUG`, `CAMERA_SLUG`, and two optional identities:
+  - `SECOND_EMAIL` — a second, distinct **app user** with the same role,
+    without which the busy check only proves that a second request is refused,
+    not that a different user's is.
+  - `OBSERVER_EMAIL` — a **third** app user, and the one whose password check
+    [6] rotates and restores. Leave it unset and the round trip runs on
+    `EMAIL`, the identity every other check in the file signs in as; the
+    script says so out loud when that happens. `infra/seed-dev.mjs --env`
+    exports all three.
+
+  Since 3.0.0 it also drives the client auth API as check [6]: `listProviders`
+  without a session, `login`, `me` (kind, app, role, address), `logout`, the
+  `changePassword` round trip with its restore, and the reset acknowledgement
+  compared byte for byte across a known and an unknown address. What it does
+  **not** drive is anything needing a mailed token — `register`,
+  `verifyEmail`, `acceptInvitation`, `confirmPasswordReset` — or the federated
+  and MCP-consent flows. Those are `infra/browser/app-auth-check.mjs`'s
+  subject, which reads maildev and drives a real Keycloak.
+- `pnpm run verify:history` — a relative range and its absolute equivalent
+  returning the same samples, aggregation matching arithmetic done here from
+  the raw rows, and the `not_recorded` / `not_aggregatable` refusals. Needs
+  `FLEETLESS_API_URL`, `APP_IDENTIFIER`, `EMAIL`, `PASSWORD`, `ROBOT_ID`,
+  `RECORDED_NUMERIC_SLUG`, `LIVE_ONLY_SLUG`, and optionally
+  `NON_NUMERIC_RECORDED_SLUG`.
+(`verify:hosted-login` is gone. The hosted login flow it drove —
+`beginHostedLogin` / `completeHostedLogin` and the app OAuth client behind
+them — was removed in 3.0.0 along with the script and its `package.json`
+entry.)
+
+`infra/seed-dev.mjs --env` in the umbrella repo exports most of those
+variables for a freshly seeded world.
+
+## Commits
+
+[Conventional Commits](https://www.conventionalcommits.org/). English, for
+code, comments, commit messages and everything else that lands in the
+repository.
+
+## Releasing
+
+Every version on npm is published by this repository's GitLab pipeline from a
+release tag. `npm publish` by hand is retired.
+
+1. Add the version's entry to `CHANGELOG.md` and set `version` in
+   `package.json` to the same number.
+2. Commit (`chore(release): X.Y.Z`), push, and wait for the branch pipeline's
+   `verify` job to go green.
+3. `git tag vX.Y.Z && git push origin vX.Y.Z`. The tag pipeline runs `verify`
+   again and then `publish`.
+4. Check the registry yourself. The `publish` job already asserts the first
+   line; this is the independent look, and the second line is the one that
+   says which dist-tag moved.
+
+   ```sh
+   npm view @fleetless/sdk@X.Y.Z version   # answers X.Y.Z
+   npm view @fleetless/sdk dist-tags       # latest -> X.Y.Z, or next -> X.Y.Z
+   ```
+
+   Name the version. A bare `npm view @fleetless/sdk version` resolves the
+   `latest` dist-tag, so after a pre-release publish it answers the *previous*
+   stable release and reads as a publish that did not happen.
+
+A pre-release tag — `vX.Y.Z-beta.1`, `vX.Y.Z-rc.2` — publishes under the npm
+dist-tag `next` instead of `latest`. Nothing else about it differs, and it is
+exactly why step 4 names the version.
+
+**A red `publish` job does not mean nothing was published.** The job runs
+`npm publish` and then looks the version up on the registry for about two
+minutes; npm answers reads from a replica that lags a publish, so the lookup
+can time out on a version that did land. The job says so itself, and it is
+worth repeating here because a red pipeline invites exactly one reaction —
+press retry — and that reaction cannot work: npm refuses to publish over an
+existing version, so the retry ends in a 403 that reads like a broken
+pipeline rather than like a release that already happened.
+
+> publish may have succeeded; the registry has not served the version yet; do
+> NOT retry this job (npm refuses to republish a version) — check
+> `npm view @fleetless/sdk@$VERSION` by hand
+
+If the hand check answers the version, the release is done: move the dist-tag
+by hand if it is wrong (`npm dist-tag add @fleetless/sdk@X.Y.Z latest`) and
+leave the job red. If it answers nothing after several minutes, the publish
+genuinely did not land and the job can be retried.
+
+**A red `publish` job that ends in `npm error code EOTP` published nothing.**
+npm is asking for a one-time password, which a pipeline cannot supply: the
+token in `NPM_TOKEN` does not bypass two-factor authentication, or the
+package's *Publishing access* setting on npmjs.com disallows tokens. Fix the
+token (a granular access token created with *Bypass two-factor
+authentication*) or the package setting (*Require two-factor authentication
+or an automation token*), then retry the job — nothing reached the registry,
+so a retry is safe here — measured on a pipeline that hit it.
+
+**The pipeline refuses a tag whose version disagrees with `package.json`.**
+`scripts/verify-version-tag.mjs` is the one place that rule lives; `verify`
+runs it first on a tag pipeline, so a mistyped tag fails in seconds and
+`publish` never starts (measured: `verify-version-tag: tag v9.9.9 names
+9.9.9 but package.json says 1.0.0`, publish skipped).
+
+Removing that bad tag takes the API, not git. `v*` is a **protected** tag
+pattern, so a delete over git is refused by the server with nothing but
+`! [remote rejected] v9.9.9 (pre-receive hook declined)`:
+
+```sh
+git tag -d vX.Y.Z                                          # local
+glab api -X DELETE projects/37/repository/tags/vX.Y.Z      # remote
+```
+
+Then fix `package.json` and tag again.
+
+### The one-time setting
+
+It is already in place; it is written down because nothing in this repository
+would tell you it exists if it were removed.
+
+There used to be a second one — `fleetless/fleetless-sdk` on the job-token
+allow-list of `fleetless/fleetless-contracts`, so the pipeline could rewrite
+the private `git+ssh://` contracts URL to HTTPS with `CI_JOB_TOKEN`. Contracts
+is a public npm package now, the rewrite is gone from `.gitlab-ci.yml`, and
+the allow-list entry buys this project nothing. Removing it is safe; leaving
+it is harmless.
+
+- **`NPM_TOKEN` is a protected, masked CI variable on this project**, holding
+  an npm granular automation token with publish rights on `@fleetless/sdk`.
+  Protected means an unprotected ref receives an *empty* value rather than no
+  value, which is why the tag pattern `v*` is a protected tag and why the
+  `publish` job's first action is to refuse an empty `NPM_TOKEN` by name.
+
+  ```sh
+  glab api projects/37/protected_tags     # v*, create access: Maintainers
+  ```
+
+The token reaches npm through an `.npmrc` written in the job's working
+directory holding `//registry.npmjs.org/:_authToken=${NPM_TOKEN}` **literally**
+— npm expands the variable when it reads the file, so the secret itself never
+lands on disk, and `after_script` removes the file either way. It cannot be
+passed as an environment assignment instead: `NPM_CONFIG_//registry…` is not a
+valid shell identifier, so both `bash` and `dash` parse it as a command name.
+

package/dist/index.cjs

@@ -144,7 +144,7 @@ var HttpClient = class {
    * RequestOptionsFor<P>` would type-check by construction — the cast
    * bypasses the very check this exists to add, which is the identical
    * "special case that quietly exempts calls from the general rule" shape
-   * this file has already been caught by once. Every current call site to a route
+   * this file has already made once. Every current call site to a route
    * with no body already passes `{}` explicitly for exactly this reason.
    */
   async request(path, options) {
@@ -441,7 +441,7 @@ function createAssetsApi(http) {
   };
 }
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/common.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/common.js
 var import_zod = require("zod");
 var SLUG_RULE = "A name is lower-case: it starts with a letter, continues with letters and digits, and joins further words with a single underscore \u2014 `battery_voltage`. Capitals, dashes, dots, spaces, a leading digit and a doubled or trailing underscore are all refused.";
 var slug = import_zod.z.string().min(2).max(63).regex(/^[a-z][a-z0-9]*(?:_[a-z0-9]+)*$/, SLUG_RULE);
@@ -465,7 +465,7 @@ var applyError = import_zod.z.object({
   details: import_zod.z.record(import_zod.z.string(), import_zod.z.unknown()).optional()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/mcp.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/mcp.js
 var import_zod2 = require("zod");
 function mcpAppEndpointPath(appIdentifier2) {
   return `/mcp/${appIdentifier2}`;
@@ -514,10 +514,10 @@ var mcpRolePreviewResponse = import_zod2.z.object({
 });
 var MCP_ASSET_LINK_TTL_MS = 15 * 60 * 1e3;
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/protocol.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/protocol.js
 var import_zod8 = require("zod");
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/assets.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/assets.js
 var import_zod3 = require("zod");
 var assetKind = import_zod3.z.enum(["urdf", "mesh", "texture", "other"]);
 var asset = import_zod3.z.object({
@@ -775,10 +775,10 @@ var assetSyncBusyDetails = import_zod3.z.object({
   started_at_ms: import_zod3.z.number().int().nonnegative()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/config.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/config.js
 var import_zod5 = require("zod");
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/alerts.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/alerts.js
 var import_zod4 = require("zod");
 var alertRowCondition = import_zod4.z.discriminatedUnion("kind", [
   import_zod4.z.strictObject({
@@ -848,7 +848,7 @@ var putDatapointDisplayRequest = import_zod4.z.object({
   y_max: import_zod4.z.number().finite().nullable()
 }).strict();
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/config.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/config.js
 var RTSP_URL_RULE = "The URL has to begin with `rtsp://` or `rtsps://` \u2014 `rtsp://cam-1.plant.local/stream1`. No other scheme is accepted: the bridge opens this with a library that would equally honour `file:`.";
 var MJPEG_URL_RULE = "The URL has to begin with `http://` or `https://` \u2014 `http://cam-1.plant.local/video.mjpg`. No other scheme is accepted: the bridge opens this with a library that would equally serve `file:`.";
 var DEVICE_PATH_RULE = "A capture device is a path under `/dev/`, and the character straight after it is a letter or a digit \u2014 `/dev/video0`, or a stable `/dev/v4l/by-id/...` symlink. Nothing outside `/dev/` is accepted: the string reaches OpenCV, which would as happily open an ordinary file.";
@@ -1895,7 +1895,7 @@ var configState = import_zod5.z.object({
   applied_errors: import_zod5.z.array(applyError).nullable()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/introspection.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/introspection.js
 var import_zod6 = require("zod");
 var rosGraphEntry = import_zod6.z.object({
   name: rosName,
@@ -1934,7 +1934,7 @@ var typeDefinition = import_zod6.z.discriminatedUnion("kind", [
   })
 ]);
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/jobs.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/jobs.js
 var import_zod7 = require("zod");
 var jobState = import_zod7.z.enum(["running", "succeeded", "failed", "cancelled", "lost"]);
 var job = import_zod7.z.object({
@@ -2152,7 +2152,7 @@ var jobRunSummary = import_zod7.z.object({
   since_ms: import_zod7.z.number().int().nonnegative()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/protocol.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/protocol.js
 var MAX_PATIENCE_MS = 12e4;
 var MIN_PATIENCE_MS = 1e3;
 var activeJob = import_zod8.z.object({
@@ -2551,11 +2551,11 @@ var bridgeCameraState = import_zod8.z.object({
   request_id: import_zod8.z.string().min(1).max(64).nullable()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/config-issues.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/config-issues.js
 var EXPOSURE_SECTIONS = ["datapoints", "actions", "services", "publishers", "cameras"];
 var EXPOSURE_SECTION_NAMES = new Set(EXPOSURE_SECTIONS);
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/rest.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/rest.js
 var import_zod9 = require("zod");
 var robot = import_zod9.z.object({
   id: import_zod9.z.uuid().meta({
@@ -3315,13 +3315,13 @@ var slugUsageResponse = import_zod9.z.object({
   alert_count: import_zod9.z.number().int().nonnegative()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/realtime.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/realtime.js
 var import_zod14 = require("zod");
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/client-auth.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/client-auth.js
 var import_zod13 = require("zod");
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/apps.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/apps.js
 var import_zod10 = require("zod");
 var appIdentifier = slug;
 var app = import_zod10.z.object({
@@ -3503,10 +3503,10 @@ var rolePermissions = import_zod10.z.object({
   })
 });
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/app-users.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/app-users.js
 var import_zod12 = require("zod");
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/identity.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/identity.js
 var import_zod11 = require("zod");
 var password = import_zod11.z.string().min(12).max(256);
 var USER_DISPLAY_NAME_MAX = 120;
@@ -3668,7 +3668,7 @@ var authMeResponse = import_zod11.z.object({ org, user: fleetlessUser });
 var patchOrgRequest = import_zod11.z.object({ name: import_zod11.z.string().min(1).max(120) }).strict();
 var patchAuthMeRequest = import_zod11.z.object({ display_name: import_zod11.z.string().min(1).max(USER_DISPLAY_NAME_MAX).nullable() }).strict();
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/app-users.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/app-users.js
 var APP_USER_DISPLAY_NAME_MAX = 120;
 var providerSlug = import_zod12.z.string().max(40).regex(/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/, "a provider slug is lowercase and hyphen-separated, starting with a letter");
 var appUserStatus = import_zod12.z.enum(["pending_verification", "active", "blocked"]);
@@ -3919,7 +3919,7 @@ var mailOutcome = import_zod12.z.object({
   })
 });
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/client-auth.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/client-auth.js
 var clientLoginRequest = import_zod13.z.object({
   app_identifier: appIdentifier.meta({
     description: "The app being logged in to, as its globally unique identifier \u2014 the lowercase, underscore-separated string the developer chose when the app was created. There is no organisation context at login, so this is what decides which app the credentials are checked for."
@@ -4108,7 +4108,7 @@ var clientIdentity = import_zod13.z.object({
   })
 });
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/realtime.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/realtime.js
 var clientAuth = import_zod14.z.object({
   type: import_zod14.z.literal("auth"),
   token: import_zod14.z.string().min(1)
@@ -4386,7 +4386,7 @@ var orgEventDropped = import_zod14.z.object({
   dropped: import_zod14.z.number().int().positive()
 }).strict();
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/audit.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/audit.js
 var import_zod15 = require("zod");
 var auditActor = import_zod15.z.object({
   kind: import_zod15.z.enum(["developer", "end_user", "app_user", "server_key", "bridge"]),
@@ -4517,7 +4517,7 @@ var auditListResponse = import_zod15.z.object({
   next_cursor: import_zod15.z.number().int().positive().nullable()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/errors.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/errors.js
 var import_zod16 = require("zod");
 var apiError = import_zod16.z.object({
   code: import_zod16.z.string().min(1),
@@ -4534,7 +4534,7 @@ var parameterInvalidDetails = import_zod16.z.object({
   violations: import_zod16.z.array(parameterViolation).min(1)
 });
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/oauth.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/oauth.js
 var import_zod17 = require("zod");
 var oauthErrorCode = import_zod17.z.enum([
   "invalid_request",
@@ -4755,7 +4755,7 @@ var oauthAuthorizeQuery = import_zod17.z.object({
   description: "The authorization request an MCP client sends, per RFC 6749 \xA74.1.1 with mandatory PKCE. The handler reads it parameter by parameter rather than through one parse, because the answers differ: `client_id` and `redirect_uri` are refused flat, with no redirect, since until both are confirmed there is no trusted target to bounce a browser to, and everything after them is reported to the client's own callback as query parameters."
 });
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/routes.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/routes.js
 var MCP_APP = MCP_APP_PATHS(":appIdentifier");
 var APP_IDENTIFIER = {
   name: "appIdentifier",
@@ -6355,7 +6355,7 @@ var ROUTES = [
     response: null,
     errors: ["not_found", "unauthorized", "forbidden"],
     transport: "http",
-    notes: "MCP's Streamable HTTP gives this path three verbs: `POST` carries JSON-RPC, `GET` opens the server-initiated SSE stream, and `DELETE` ends a session. This server has no sessions \u2014 the argument is in `MCP_PROTOCOL_VERSION`'s own note, and a per-process session map is what breaks at the second cloud instance \u2014 so `GET` and `DELETE` answer `405`, which is what a client is built to fall back from. \n\n**The `405` is this cloud's own answer, not the SDK's**, and the two differ: MCP SDK 1.30.0 opens an SSE stream on `GET` (`handleGetRequest`) and answers `200` on `DELETE` (`handleDeleteRequest`), neither of which a stateless server has any business doing, so the cloud writes the `405` itself in the transport's own JSON-RPC error shape with `Allow: POST`. \n\n**The row exists so that the `405` is not a `404`.** An unregistered verb answers `404`, and at a path whose last segment is an app identifier a `404` already means *no such app* \u2014 one answer for two states, which is one answer for two states. Registering the verb lets the endpoint say \"this app's server is here; this verb is not part of it\". The central `/mcp` registers neither verb and does not need to: its path takes no parameter, so nothing can misread its `404`. \n\n**The `405` body is the transport's JSON-RPC error object, not the `apiError` envelope.** The three codes above are the refusals that come *first* \u2014 the app, its switch, then the bearer, in the order `POST` describes \u2014 and they are `apiError` because they are answered before the transport is reached at all. If this server ever becomes stateful, this row and the `DELETE` beside it are where that lands, and the cloud's route-manifest test is what would make both repositories notice."
+    notes: "MCP's Streamable HTTP gives this path three verbs: `POST` carries JSON-RPC, `GET` opens the server-initiated SSE stream, and `DELETE` ends a session. This server has no sessions \u2014 the argument is in `MCP_PROTOCOL_VERSION`'s own note, and a per-process session map is what breaks at the second cloud instance \u2014 so `GET` and `DELETE` answer `405`, which is what a client is built to fall back from. \n\n**The `405` is this cloud's own answer, not the SDK's**, and the two differ: MCP SDK 1.30.0 opens an SSE stream on `GET` (`handleGetRequest`) and answers `200` on `DELETE` (`handleDeleteRequest`), neither of which a stateless server has any business doing, so the cloud writes the `405` itself in the transport's own JSON-RPC error shape with `Allow: POST`. \n\n**The row exists so that the `405` is not a `404`.** An unregistered verb answers `404`, and at a path whose last segment is an app identifier a `404` already means *no such app* \u2014 so an unregistered verb and an unknown app would answer identically. Registering the verb lets the endpoint say \"this app's server is here; this verb is not part of it\". The central `/mcp` registers neither verb and does not need to: its path takes no parameter, so nothing can misread its `404`. \n\n**The `405` body is the transport's JSON-RPC error object, not the `apiError` envelope.** The three codes above are the refusals that come *first* \u2014 the app, its switch, then the bearer, in the order `POST` describes \u2014 and they are `apiError` because they are answered before the transport is reached at all. If this server ever becomes stateful, this row and the `DELETE` beside it are where that lands, and the cloud's route-manifest test is what would make both repositories notice."
   },
   {
     method: "DELETE",
@@ -7320,7 +7320,7 @@ var ROUTES = [
     response: jobRunListResponse,
     errors: [...CLIENT_GUARD, "invalid_uuid", "not_found", "capability_required", "validation_error"],
     transport: "http",
-    notes: "Needs the `action_history` capability, and **this route is what makes that switch mean something** \u2014 it was unkeepable while nothing durable recorded what had run. Two residuals worth stating rather than implying away. `history` is a syntactically valid slug and The router matches a static segment first, so a robot with a service literally slugged `history` can no longer be **read** through `GET /api/robots/:id/jobs/:slug`; invoking, cancelling and the listing are unaffected. And a run row names its actor by email address, so an end user holding this capability learns which other people have been driving the machine. `robot_id` in the query is shared with the org-wide read; a *different* one here is refused rather than quietly answered about the robot in the path."
+    notes: "Needs the `action_history` capability, and **this route is what makes that switch mean something** \u2014 it was unkeepable while nothing durable recorded what had run. Two residuals worth stating rather than implying away. `history` is a syntactically valid slug, and a static segment matches before a parameter, so a robot with a service literally slugged `history` can no longer be **read** through `GET /api/robots/:id/jobs/:slug`; invoking, cancelling and the listing are unaffected. And a run row names its actor by email address, so an end user holding this capability learns which other people have been driving the machine. `robot_id` in the query is shared with the org-wide read; a *different* one here is refused rather than quietly answered about the robot in the path."
   },
   {
     method: "POST",
@@ -8339,7 +8339,7 @@ function createRealtimeCommandTransport(channel) {
   return {
     // Declared `async` deliberately, unlike `cancel`/`publish` below: it is
     // the only one of the three that can refuse *before* sending anything
-    // (resolveLocalWaitMs's `invalid_option`, D3a), and every caller of
+    // (`resolveLocalWaitMs`'s `invalid_option`), and every caller of
     // this interface — starting with this file's own `sendCommand` callers
     // — is entitled to assume `CommandTransport.invoke` always returns a
     // promise rather than throwing synchronously. Without `async` here, a

package/dist/index.d.cts

@@ -1,7 +1,6 @@
 // SPDX-License-Identifier: MIT
 import { z } from 'zod';
 
-// SPDX-License-Identifier: Apache-2.0
 
 /**
  * Jobs: one running unit of work on a robot — an action
@@ -234,7 +233,6 @@ declare const historyBucketsResponse: z.ZodObject<{
 }, z.core.$strip>;
 type HistoryBucketsResponse = z.infer<typeof historyBucketsResponse>;
 
-// SPDX-License-Identifier: Apache-2.0
 
 /**
  * One datapoint sample pushed to a subscriber. The current value arrives
@@ -250,7 +248,6 @@ declare const datapointEvent: z.ZodObject<{
 }, z.core.$strip>;
 type DatapointEvent = z.infer<typeof datapointEvent>;
 
-// SPDX-License-Identifier: Apache-2.0
 
 /**
  * Access plus refresh. The access token is short-lived; the
@@ -267,7 +264,6 @@ declare const sessionTokens: z.ZodObject<{
 }, z.core.$strip>;
 type SessionTokens = z.infer<typeof sessionTokens>;
 
-// SPDX-License-Identifier: Apache-2.0
 
 /**
  * **Why a federated sign-in ended without a session, in a code the app can
@@ -416,7 +412,6 @@ declare const clientIdentity: z.ZodObject<{
 }, z.core.$strip>;
 type ClientIdentity = z.infer<typeof clientIdentity>;
 
-// SPDX-License-Identifier: Apache-2.0
 
 declare const asset: z.ZodObject<{
     id: z.ZodUUID;
@@ -551,7 +546,6 @@ declare const assetListResponse: z.ZodObject<{
 }, z.core.$strip>;
 type AssetListResponse = z.infer<typeof assetListResponse>;
 
-// SPDX-License-Identifier: Apache-2.0
 
 /**
  * One violated parameter rule. `details` on the envelope stays `unknown` — codes

package/dist/index.d.ts

@@ -1,7 +1,6 @@
 // SPDX-License-Identifier: MIT
 import { z } from 'zod';
 
-// SPDX-License-Identifier: Apache-2.0
 
 /**
  * Jobs: one running unit of work on a robot — an action
@@ -234,7 +233,6 @@ declare const historyBucketsResponse: z.ZodObject<{
 }, z.core.$strip>;
 type HistoryBucketsResponse = z.infer<typeof historyBucketsResponse>;
 
-// SPDX-License-Identifier: Apache-2.0
 
 /**
  * One datapoint sample pushed to a subscriber. The current value arrives
@@ -250,7 +248,6 @@ declare const datapointEvent: z.ZodObject<{
 }, z.core.$strip>;
 type DatapointEvent = z.infer<typeof datapointEvent>;
 
-// SPDX-License-Identifier: Apache-2.0
 
 /**
  * Access plus refresh. The access token is short-lived; the
@@ -267,7 +264,6 @@ declare const sessionTokens: z.ZodObject<{
 }, z.core.$strip>;
 type SessionTokens = z.infer<typeof sessionTokens>;
 
-// SPDX-License-Identifier: Apache-2.0
 
 /**
  * **Why a federated sign-in ended without a session, in a code the app can
@@ -416,7 +412,6 @@ declare const clientIdentity: z.ZodObject<{
 }, z.core.$strip>;
 type ClientIdentity = z.infer<typeof clientIdentity>;
 
-// SPDX-License-Identifier: Apache-2.0
 
 declare const asset: z.ZodObject<{
     id: z.ZodUUID;
@@ -551,7 +546,6 @@ declare const assetListResponse: z.ZodObject<{
 }, z.core.$strip>;
 type AssetListResponse = z.infer<typeof assetListResponse>;
 
-// SPDX-License-Identifier: Apache-2.0
 
 /**
  * One violated parameter rule. `details` on the envelope stays `unknown` — codes

package/dist/index.js

@@ -114,7 +114,7 @@ var HttpClient = class {
    * RequestOptionsFor<P>` would type-check by construction — the cast
    * bypasses the very check this exists to add, which is the identical
    * "special case that quietly exempts calls from the general rule" shape
-   * this file has already been caught by once. Every current call site to a route
+   * this file has already made once. Every current call site to a route
    * with no body already passes `{}` explicitly for exactly this reason.
    */
   async request(path, options) {
@@ -411,7 +411,7 @@ function createAssetsApi(http) {
   };
 }
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/common.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/common.js
 import { z } from "zod";
 var SLUG_RULE = "A name is lower-case: it starts with a letter, continues with letters and digits, and joins further words with a single underscore \u2014 `battery_voltage`. Capitals, dashes, dots, spaces, a leading digit and a doubled or trailing underscore are all refused.";
 var slug = z.string().min(2).max(63).regex(/^[a-z][a-z0-9]*(?:_[a-z0-9]+)*$/, SLUG_RULE);
@@ -435,7 +435,7 @@ var applyError = z.object({
   details: z.record(z.string(), z.unknown()).optional()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/mcp.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/mcp.js
 import { z as z2 } from "zod";
 function mcpAppEndpointPath(appIdentifier2) {
   return `/mcp/${appIdentifier2}`;
@@ -484,10 +484,10 @@ var mcpRolePreviewResponse = z2.object({
 });
 var MCP_ASSET_LINK_TTL_MS = 15 * 60 * 1e3;
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/protocol.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/protocol.js
 import { z as z8 } from "zod";
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/assets.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/assets.js
 import { z as z3 } from "zod";
 var assetKind = z3.enum(["urdf", "mesh", "texture", "other"]);
 var asset = z3.object({
@@ -745,10 +745,10 @@ var assetSyncBusyDetails = z3.object({
   started_at_ms: z3.number().int().nonnegative()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/config.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/config.js
 import { z as z5 } from "zod";
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/alerts.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/alerts.js
 import { z as z4 } from "zod";
 var alertRowCondition = z4.discriminatedUnion("kind", [
   z4.strictObject({
@@ -818,7 +818,7 @@ var putDatapointDisplayRequest = z4.object({
   y_max: z4.number().finite().nullable()
 }).strict();
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/config.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/config.js
 var RTSP_URL_RULE = "The URL has to begin with `rtsp://` or `rtsps://` \u2014 `rtsp://cam-1.plant.local/stream1`. No other scheme is accepted: the bridge opens this with a library that would equally honour `file:`.";
 var MJPEG_URL_RULE = "The URL has to begin with `http://` or `https://` \u2014 `http://cam-1.plant.local/video.mjpg`. No other scheme is accepted: the bridge opens this with a library that would equally serve `file:`.";
 var DEVICE_PATH_RULE = "A capture device is a path under `/dev/`, and the character straight after it is a letter or a digit \u2014 `/dev/video0`, or a stable `/dev/v4l/by-id/...` symlink. Nothing outside `/dev/` is accepted: the string reaches OpenCV, which would as happily open an ordinary file.";
@@ -1865,7 +1865,7 @@ var configState = z5.object({
   applied_errors: z5.array(applyError).nullable()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/introspection.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/introspection.js
 import { z as z6 } from "zod";
 var rosGraphEntry = z6.object({
   name: rosName,
@@ -1904,7 +1904,7 @@ var typeDefinition = z6.discriminatedUnion("kind", [
   })
 ]);
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/jobs.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/jobs.js
 import { z as z7 } from "zod";
 var jobState = z7.enum(["running", "succeeded", "failed", "cancelled", "lost"]);
 var job = z7.object({
@@ -2122,7 +2122,7 @@ var jobRunSummary = z7.object({
   since_ms: z7.number().int().nonnegative()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/protocol.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/protocol.js
 var MAX_PATIENCE_MS = 12e4;
 var MIN_PATIENCE_MS = 1e3;
 var activeJob = z8.object({
@@ -2521,11 +2521,11 @@ var bridgeCameraState = z8.object({
   request_id: z8.string().min(1).max(64).nullable()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/config-issues.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/config-issues.js
 var EXPOSURE_SECTIONS = ["datapoints", "actions", "services", "publishers", "cameras"];
 var EXPOSURE_SECTION_NAMES = new Set(EXPOSURE_SECTIONS);
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/rest.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/rest.js
 import { z as z9 } from "zod";
 var robot = z9.object({
   id: z9.uuid().meta({
@@ -3285,13 +3285,13 @@ var slugUsageResponse = z9.object({
   alert_count: z9.number().int().nonnegative()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/realtime.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/realtime.js
 import { z as z14 } from "zod";
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/client-auth.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/client-auth.js
 import { z as z13 } from "zod";
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/apps.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/apps.js
 import { z as z10 } from "zod";
 var appIdentifier = slug;
 var app = z10.object({
@@ -3473,10 +3473,10 @@ var rolePermissions = z10.object({
   })
 });
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/app-users.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/app-users.js
 import { z as z12 } from "zod";
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/identity.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/identity.js
 import { z as z11 } from "zod";
 var password = z11.string().min(12).max(256);
 var USER_DISPLAY_NAME_MAX = 120;
@@ -3638,7 +3638,7 @@ var authMeResponse = z11.object({ org, user: fleetlessUser });
 var patchOrgRequest = z11.object({ name: z11.string().min(1).max(120) }).strict();
 var patchAuthMeRequest = z11.object({ display_name: z11.string().min(1).max(USER_DISPLAY_NAME_MAX).nullable() }).strict();
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/app-users.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/app-users.js
 var APP_USER_DISPLAY_NAME_MAX = 120;
 var providerSlug = z12.string().max(40).regex(/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/, "a provider slug is lowercase and hyphen-separated, starting with a letter");
 var appUserStatus = z12.enum(["pending_verification", "active", "blocked"]);
@@ -3889,7 +3889,7 @@ var mailOutcome = z12.object({
   })
 });
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/client-auth.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/client-auth.js
 var clientLoginRequest = z13.object({
   app_identifier: appIdentifier.meta({
     description: "The app being logged in to, as its globally unique identifier \u2014 the lowercase, underscore-separated string the developer chose when the app was created. There is no organisation context at login, so this is what decides which app the credentials are checked for."
@@ -4078,7 +4078,7 @@ var clientIdentity = z13.object({
   })
 });
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/realtime.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/realtime.js
 var clientAuth = z14.object({
   type: z14.literal("auth"),
   token: z14.string().min(1)
@@ -4356,7 +4356,7 @@ var orgEventDropped = z14.object({
   dropped: z14.number().int().positive()
 }).strict();
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/audit.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/audit.js
 import { z as z15 } from "zod";
 var auditActor = z15.object({
   kind: z15.enum(["developer", "end_user", "app_user", "server_key", "bridge"]),
@@ -4487,7 +4487,7 @@ var auditListResponse = z15.object({
   next_cursor: z15.number().int().positive().nullable()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/errors.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/errors.js
 import { z as z16 } from "zod";
 var apiError = z16.object({
   code: z16.string().min(1),
@@ -4504,7 +4504,7 @@ var parameterInvalidDetails = z16.object({
   violations: z16.array(parameterViolation).min(1)
 });
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/oauth.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/oauth.js
 import { z as z17 } from "zod";
 var oauthErrorCode = z17.enum([
   "invalid_request",
@@ -4725,7 +4725,7 @@ var oauthAuthorizeQuery = z17.object({
   description: "The authorization request an MCP client sends, per RFC 6749 \xA74.1.1 with mandatory PKCE. The handler reads it parameter by parameter rather than through one parse, because the answers differ: `client_id` and `redirect_uri` are refused flat, with no redirect, since until both are confirmed there is no trusted target to bounce a browser to, and everything after them is reported to the client's own callback as query parameters."
 });
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.4/node_modules/@fleetless/contracts/dist/routes.js
+// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/routes.js
 var MCP_APP = MCP_APP_PATHS(":appIdentifier");
 var APP_IDENTIFIER = {
   name: "appIdentifier",
@@ -6325,7 +6325,7 @@ var ROUTES = [
     response: null,
     errors: ["not_found", "unauthorized", "forbidden"],
     transport: "http",
-    notes: "MCP's Streamable HTTP gives this path three verbs: `POST` carries JSON-RPC, `GET` opens the server-initiated SSE stream, and `DELETE` ends a session. This server has no sessions \u2014 the argument is in `MCP_PROTOCOL_VERSION`'s own note, and a per-process session map is what breaks at the second cloud instance \u2014 so `GET` and `DELETE` answer `405`, which is what a client is built to fall back from. \n\n**The `405` is this cloud's own answer, not the SDK's**, and the two differ: MCP SDK 1.30.0 opens an SSE stream on `GET` (`handleGetRequest`) and answers `200` on `DELETE` (`handleDeleteRequest`), neither of which a stateless server has any business doing, so the cloud writes the `405` itself in the transport's own JSON-RPC error shape with `Allow: POST`. \n\n**The row exists so that the `405` is not a `404`.** An unregistered verb answers `404`, and at a path whose last segment is an app identifier a `404` already means *no such app* \u2014 one answer for two states, which is one answer for two states. Registering the verb lets the endpoint say \"this app's server is here; this verb is not part of it\". The central `/mcp` registers neither verb and does not need to: its path takes no parameter, so nothing can misread its `404`. \n\n**The `405` body is the transport's JSON-RPC error object, not the `apiError` envelope.** The three codes above are the refusals that come *first* \u2014 the app, its switch, then the bearer, in the order `POST` describes \u2014 and they are `apiError` because they are answered before the transport is reached at all. If this server ever becomes stateful, this row and the `DELETE` beside it are where that lands, and the cloud's route-manifest test is what would make both repositories notice."
+    notes: "MCP's Streamable HTTP gives this path three verbs: `POST` carries JSON-RPC, `GET` opens the server-initiated SSE stream, and `DELETE` ends a session. This server has no sessions \u2014 the argument is in `MCP_PROTOCOL_VERSION`'s own note, and a per-process session map is what breaks at the second cloud instance \u2014 so `GET` and `DELETE` answer `405`, which is what a client is built to fall back from. \n\n**The `405` is this cloud's own answer, not the SDK's**, and the two differ: MCP SDK 1.30.0 opens an SSE stream on `GET` (`handleGetRequest`) and answers `200` on `DELETE` (`handleDeleteRequest`), neither of which a stateless server has any business doing, so the cloud writes the `405` itself in the transport's own JSON-RPC error shape with `Allow: POST`. \n\n**The row exists so that the `405` is not a `404`.** An unregistered verb answers `404`, and at a path whose last segment is an app identifier a `404` already means *no such app* \u2014 so an unregistered verb and an unknown app would answer identically. Registering the verb lets the endpoint say \"this app's server is here; this verb is not part of it\". The central `/mcp` registers neither verb and does not need to: its path takes no parameter, so nothing can misread its `404`. \n\n**The `405` body is the transport's JSON-RPC error object, not the `apiError` envelope.** The three codes above are the refusals that come *first* \u2014 the app, its switch, then the bearer, in the order `POST` describes \u2014 and they are `apiError` because they are answered before the transport is reached at all. If this server ever becomes stateful, this row and the `DELETE` beside it are where that lands, and the cloud's route-manifest test is what would make both repositories notice."
   },
   {
     method: "DELETE",
@@ -7290,7 +7290,7 @@ var ROUTES = [
     response: jobRunListResponse,
     errors: [...CLIENT_GUARD, "invalid_uuid", "not_found", "capability_required", "validation_error"],
     transport: "http",
-    notes: "Needs the `action_history` capability, and **this route is what makes that switch mean something** \u2014 it was unkeepable while nothing durable recorded what had run. Two residuals worth stating rather than implying away. `history` is a syntactically valid slug and The router matches a static segment first, so a robot with a service literally slugged `history` can no longer be **read** through `GET /api/robots/:id/jobs/:slug`; invoking, cancelling and the listing are unaffected. And a run row names its actor by email address, so an end user holding this capability learns which other people have been driving the machine. `robot_id` in the query is shared with the org-wide read; a *different* one here is refused rather than quietly answered about the robot in the path."
+    notes: "Needs the `action_history` capability, and **this route is what makes that switch mean something** \u2014 it was unkeepable while nothing durable recorded what had run. Two residuals worth stating rather than implying away. `history` is a syntactically valid slug, and a static segment matches before a parameter, so a robot with a service literally slugged `history` can no longer be **read** through `GET /api/robots/:id/jobs/:slug`; invoking, cancelling and the listing are unaffected. And a run row names its actor by email address, so an end user holding this capability learns which other people have been driving the machine. `robot_id` in the query is shared with the org-wide read; a *different* one here is refused rather than quietly answered about the robot in the path."
   },
   {
     method: "POST",
@@ -8309,7 +8309,7 @@ function createRealtimeCommandTransport(channel) {
   return {
     // Declared `async` deliberately, unlike `cancel`/`publish` below: it is
     // the only one of the three that can refuse *before* sending anything
-    // (resolveLocalWaitMs's `invalid_option`, D3a), and every caller of
+    // (`resolveLocalWaitMs`'s `invalid_option`), and every caller of
     // this interface — starting with this file's own `sendCommand` callers
     // — is entitled to assume `CommandTransport.invoke` always returns a
     // promise rather than throwing synchronously. Without `async` here, a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fleetless/sdk",
-  "version": "3.0.1",
+  "version": "3.0.2",
   "description": "The official TypeScript SDK for Fleetless client apps \u2014 a ROS 2 robot as a REST and realtime API, cameras, jobs, and the app's own user accounts, federated sign-in and MCP consent.",
   "license": "MIT",
   "author": {
@@ -8,13 +8,8 @@
     "email": "hello@fleetless.dev",
     "url": "https://dehne-robotik.de"
   },
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/fleetless/sdk"
-  },
   "homepage": "https://docs.fleetless.dev/reference/sdk/",
   "bugs": {
-    "url": "https://github.com/fleetless/sdk/issues",
     "email": "hello@fleetless.dev"
   },
   "keywords": [
@@ -56,7 +51,8 @@
     "CHANGELOG.md",
     "SECURITY.md",
     "CONTRIBUTING.md",
-    "CODE_OF_CONDUCT.md"
+    "CODE_OF_CONDUCT.md",
+    "RELEASING.md"
   ],
   "engines": {
     "node": ">=20"
@@ -69,13 +65,14 @@
     "test": "vitest run",
     "test:pack": "node scripts/verify-published-types.mjs",
     "verify:live": "node scripts/verify-live.mjs",
-    "verify:history": "node scripts/verify-history.mjs"
+    "verify:history": "node scripts/verify-history.mjs",
+    "verify:commits": "node scripts/verify-commit-messages.mjs"
   },
   "dependencies": {
     "zod": "^4.0.0"
   },
   "devDependencies": {
-    "@fleetless/contracts": "1.0.4",
+    "@fleetless/contracts": "1.0.5",
     "@types/node": "^22.20.1",
     "tsup": "^8.3.0",
     "typedoc": "0.28.20",