@fleetless/sdk 3.0.2 → 3.1.0

package/dist/index.cjs

@@ -334,7 +334,7 @@ function createAssetsApi(http) {
           finish(
             null,
             new Error(
-              `createMeshLoader and prepareUrdfScene were both installed on the same LoadingManager for robot ${robotId}. Use one or the other on a given manager, not both \u2014 see the README.`
+              `createMeshLoader and prepareUrdfScene were both installed on the same LoadingManager for robot ${robotId}. Use one or the other on a given manager, not both \u2014 see the SDK reference.`
             )
           );
           return;
@@ -441,7 +441,7 @@ function createAssetsApi(http) {
   };
 }
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/common.js
+// node_modules/.pnpm/@fleetless+contracts@1.1.0/node_modules/@fleetless/contracts/dist/common.js
 var import_zod = require("zod");
 var SLUG_RULE = "A name is lower-case: it starts with a letter, continues with letters and digits, and joins further words with a single underscore \u2014 `battery_voltage`. Capitals, dashes, dots, spaces, a leading digit and a doubled or trailing underscore are all refused.";
 var slug = import_zod.z.string().min(2).max(63).regex(/^[a-z][a-z0-9]*(?:_[a-z0-9]+)*$/, SLUG_RULE);
@@ -465,7 +465,7 @@ var applyError = import_zod.z.object({
   details: import_zod.z.record(import_zod.z.string(), import_zod.z.unknown()).optional()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/mcp.js
+// node_modules/.pnpm/@fleetless+contracts@1.1.0/node_modules/@fleetless/contracts/dist/mcp.js
 var import_zod2 = require("zod");
 function mcpAppEndpointPath(appIdentifier2) {
   return `/mcp/${appIdentifier2}`;
@@ -514,17 +514,17 @@ var mcpRolePreviewResponse = import_zod2.z.object({
 });
 var MCP_ASSET_LINK_TTL_MS = 15 * 60 * 1e3;
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/protocol.js
+// node_modules/.pnpm/@fleetless+contracts@1.1.0/node_modules/@fleetless/contracts/dist/protocol.js
 var import_zod8 = require("zod");
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/assets.js
+// node_modules/.pnpm/@fleetless+contracts@1.1.0/node_modules/@fleetless/contracts/dist/assets.js
 var import_zod3 = require("zod");
 var assetKind = import_zod3.z.enum(["urdf", "mesh", "texture", "other"]);
 var asset = import_zod3.z.object({
   id: import_zod3.z.uuid().meta({ description: "The asset's id in the store." }),
   robot_id: import_zod3.z.uuid().meta({ description: "The robot this asset belongs to." }),
   kind: assetKind.meta({
-    description: "What the file is: the `urdf` itself, a `mesh` it references, a `texture` a mesh or the URDF paints with, or `other`. A renderer decides from this alone, before fetching anything, what it has to pre-fetch."
+    description: "What the file is: the `urdf` itself, a `mesh` it references, a `texture` a mesh or the URDF paints with, or `other`. A renderer decides from this alone, before fetching anything, what to pre-fetch."
   }),
   /**
    * What the robot called it — for a mesh, the `package://` URI the URDF
@@ -559,7 +559,7 @@ var asset = import_zod3.z.object({
    * rules, one enforced and one only documented, is how a traversal gets in.
    */
   name: import_zod3.z.string().min(1).max(500).meta({
-    description: "What the robot called it \u2014 for a mesh, the `package://` URI the URDF references, verbatim, which is the only string a developer can match against their own workspace. A file the URDF never names (an image a `.dae` loads for itself) is named by joining the mesh's own directory with that internal reference."
+    description: "What the robot called it \u2014 for a mesh, the `package://` URI the URDF references, verbatim, the only string a developer can match against their own workspace. A file the URDF never names (an image a `.dae` loads for itself) is named by joining the mesh's own directory with that internal reference."
   }),
   media_type: import_zod3.z.string().min(1).max(120).meta({
     description: "The media type of the stored bytes, as the producer reported it."
@@ -576,7 +576,7 @@ var asset = import_zod3.z.object({
    * predictable failure of a store that hides it.
    */
   sha256: import_zod3.z.string().regex(/^[a-f0-9]{64}$/).meta({
-    description: 'The content hash, lowercase hex, and the reason two robots sharing a mesh cost one copy. It is exposed because it is the only way a client can tell "this is the same mesh I already have" across robots.'
+    description: 'The content hash, lowercase hex. Exposed because it is the only way a client can tell "this is the same mesh I already have" across robots \u2014 the reason two robots sharing a mesh cost one copy.'
   }),
   created_at: import_zod3.z.iso.datetime().meta({
     description: "When the asset was first stored, as an ISO 8601 timestamp."
@@ -604,18 +604,18 @@ var urdfCompleteness = import_zod3.z.object({
    */
   missing: import_zod3.z.array(import_zod3.z.object({
     uri: import_zod3.z.string().min(1).max(500).meta({
-      description: "The reference, verbatim, that no stored asset answers \u2014 a `package://` URI the workspace does not hold, or an absolute or bare relative path nothing will ever fetch. A developer whose URDF names one of the latter is entitled to be told so."
+      description: "The reference, verbatim, that no stored asset answers \u2014 a `package://` URI the workspace does not hold, or an absolute or bare relative path nothing will ever fetch."
     }),
     element: import_zod3.z.enum(["mesh", "texture"]).meta({
       description: "Which kind of reference it was: geometry the URDF names as a `mesh`, or a `texture` a surface paints with. Without it a client reports a missing texture as a missing mesh, contradicting `mesh_count` beside it."
     })
   })).meta({
-    description: "The references nothing in the store answers, each with the element that asked for it. A bare count is a dead end that sends a developer hunting through a workspace by hand; the references are what they can act on, so the references travel."
+    description: "The references nothing in the store answers, each with the element that asked for it. A bare count would send a developer hunting through the workspace by hand; the references are what they can act on."
   })
 });
 var assetSyncRequest = import_zod3.z.object({
   source: import_zod3.z.enum(["bridge"]).meta({
-    description: "Where the bytes come from. `bridge` is the only value today: the connected bridge reads them from the robot's own workspace. It is validated rather than ignored, so a caller naming a source that does not exist yet learns that instead of silently getting a bridge sync."
+    description: "Where the bytes come from. `bridge` is the only value today: the connected bridge reads them from the robot's own workspace. Validated rather than ignored, so a caller naming an unknown source is told so instead of silently getting a bridge sync."
   })
 }).strict();
 var assetSyncResponse = import_zod3.z.object({
@@ -629,7 +629,7 @@ var assetTooLargeDetails = import_zod3.z.object({
     description: "The upload ceiling, in bytes."
   }),
   size_bytes: import_zod3.z.number().int().positive().meta({
-    description: 'How large the refused file actually is, in bytes. With `limit_bytes` beside it a developer can tell whether to shrink the mesh or raise the limit; "too large" alone answers neither.'
+    description: 'How large the refused file is, in bytes. With `limit_bytes` beside it a developer can tell whether to shrink the mesh or raise the limit; "too large" alone answers neither.'
   })
 });
 var assetFailureKind = import_zod3.z.enum(["unresolvable", "upload_failed", "refused", "too_large"]);
@@ -729,8 +729,6 @@ var assetListResponse = import_zod3.z.object({
     description: "Every asset stored for this robot: the URDF, the meshes it references, and the textures those paint with."
   }),
   /**
-   * The sync running right now, or `null`.
-   *
    * **This field exists for the reload case.** A client that holds the
    * `sync_id` only in memory loses its progress display on a refresh, and the
    * state is still there server-side under `GET .../assets/sync/<id>` —
@@ -761,7 +759,7 @@ var assetListResponse = import_zod3.z.object({
    * crash, and no amount of polling shortens it.
    */
   urdf_available: import_zod3.z.boolean().nullable().meta({
-    description: 'What the connected bridge says it *could* transfer, which is deliberately separate from what has been transferred. `null` when no bridge is connected \u2014 distinct from `false`, because "no robot is online to ask" and "the robot has no URDF" send a developer to two different places. After a publisher is killed rather than shut down this can read `true` for some seconds, on the underlying DDS liveliness timeout rather than on any check made here.'
+    description: 'What the connected bridge says it *could* transfer \u2014 deliberately separate from what has been transferred. `null` when no bridge is connected, distinct from `false`: "no robot is online to ask" and "the robot has no URDF" send a developer to different places. After a publisher is killed rather than shut down this can read `true` for some seconds, on the underlying DDS liveliness timeout rather than on any check made here.'
   })
 });
 var missingAssetQuery = import_zod3.z.object({
@@ -775,10 +773,10 @@ var assetSyncBusyDetails = import_zod3.z.object({
   started_at_ms: import_zod3.z.number().int().nonnegative()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/config.js
+// node_modules/.pnpm/@fleetless+contracts@1.1.0/node_modules/@fleetless/contracts/dist/config.js
 var import_zod5 = require("zod");
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/alerts.js
+// node_modules/.pnpm/@fleetless+contracts@1.1.0/node_modules/@fleetless/contracts/dist/alerts.js
 var import_zod4 = require("zod");
 var alertRowCondition = import_zod4.z.discriminatedUnion("kind", [
   import_zod4.z.strictObject({
@@ -848,7 +846,7 @@ var putDatapointDisplayRequest = import_zod4.z.object({
   y_max: import_zod4.z.number().finite().nullable()
 }).strict();
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/config.js
+// node_modules/.pnpm/@fleetless+contracts@1.1.0/node_modules/@fleetless/contracts/dist/config.js
 var RTSP_URL_RULE = "The URL has to begin with `rtsp://` or `rtsps://` \u2014 `rtsp://cam-1.plant.local/stream1`. No other scheme is accepted: the bridge opens this with a library that would equally honour `file:`.";
 var MJPEG_URL_RULE = "The URL has to begin with `http://` or `https://` \u2014 `http://cam-1.plant.local/video.mjpg`. No other scheme is accepted: the bridge opens this with a library that would equally serve `file:`.";
 var DEVICE_PATH_RULE = "A capture device is a path under `/dev/`, and the character straight after it is a letter or a digit \u2014 `/dev/video0`, or a stable `/dev/v4l/by-id/...` symlink. Nothing outside `/dev/` is accepted: the string reaches OpenCV, which would as happily open an ordinary file.";
@@ -1240,7 +1238,7 @@ var datapointConfig = strictObject({
     examples: [2, 0.5]
   }).optional(),
   description: serviceDescription.meta({
-    description: "Prose about what this value is, for whoever meets it in the console later. It changes nothing the robot does, so a publish that touches only it pushes no configuration at all \u2014 but it is carried verbatim into `robot_describe`, where a model that has never seen this robot reads it. The datapoint is offered whenever the role grants it; without one it is offered with `description: null` and the model has less to go on, as for actions, services, publishers and cameras. Omission is the only way to say nothing; an empty string is refused, here and on all five.",
+    description: "Prose about what this value is, for whoever meets it in the console. It changes nothing the robot does, so a publish that touches only it pushes no configuration at all \u2014 but it is carried verbatim into `robot_describe`, where a model that has never seen this robot reads it. The datapoint is offered whenever the role grants it; without one it is offered with `description: null` and the model has less to go on, as for actions, services, publishers and cameras. Omission is the only way to say nothing; an empty string is refused, here and on all five.",
     /**
      * The sentence both datapoint snippets already place here, verbatim. Its
      * four siblings — an action's, a service's, a publisher's, a camera's —
@@ -1895,7 +1893,7 @@ var configState = import_zod5.z.object({
   applied_errors: import_zod5.z.array(applyError).nullable()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/introspection.js
+// node_modules/.pnpm/@fleetless+contracts@1.1.0/node_modules/@fleetless/contracts/dist/introspection.js
 var import_zod6 = require("zod");
 var rosGraphEntry = import_zod6.z.object({
   name: rosName,
@@ -1934,22 +1932,22 @@ var typeDefinition = import_zod6.z.discriminatedUnion("kind", [
   })
 ]);
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/jobs.js
+// node_modules/.pnpm/@fleetless+contracts@1.1.0/node_modules/@fleetless/contracts/dist/jobs.js
 var import_zod7 = require("zod");
 var jobState = import_zod7.z.enum(["running", "succeeded", "failed", "cancelled", "lost"]);
 var job = import_zod7.z.object({
   id: import_zod7.z.uuid().meta({
-    description: "The job's id, minted by the cloud when the invocation is accepted. Informative: state is observed by slug, and this id is what a cancel names when a caller wants to stop one specific job rather than whatever is running."
+    description: "The job's id, minted by the cloud when the invocation is accepted. Informative \u2014 state is observed by slug; a cancel names this id to stop one specific job rather than whatever is running."
   }),
   robot_id: import_zod7.z.uuid().meta({ description: "The robot this job is running on." }),
   slug: slug.meta({
     description: "The action or service this job is running, as the published configuration exposes it. One slug carries one job at a time, so every observer of that slug sees the same one."
   }),
   state: jobState.meta({
-    description: "Where the job stands: `running`, `succeeded`, `failed`, `cancelled` or `lost`. `lost` is a real outcome \u2014 the bridge restarted mid-job and the result is gone \u2014 and is said out loud rather than left reading `running` because nobody contradicted it."
+    description: "Where the job stands: `running`, `succeeded`, `failed`, `cancelled` or `lost`. `lost` is a real outcome \u2014 the bridge restarted mid-job and the result is gone \u2014 stated rather than left reading `running` by default."
   }),
   started_at: import_zod7.z.iso.datetime().meta({
-    description: "When the cloud minted this job, as an ISO 8601 timestamp. For a job adopted from a reconnecting bridge it is **adoption time**, not the real start, because the cloud never minted it and has no honest alternative."
+    description: "When the cloud minted this job, as an ISO 8601 timestamp. For a job adopted from a reconnecting bridge, this is **adoption time**, not the real start \u2014 the cloud never minted it."
   }),
   updated_at: import_zod7.z.iso.datetime().meta({
     description: "When this job last changed, as an ISO 8601 timestamp."
@@ -2032,7 +2030,7 @@ var jobQueueFullDetails = import_zod7.z.object({
 var JOB_RUN_PAGE_MAX = 200;
 var jobActor = import_zod7.z.object({
   kind: import_zod7.z.enum(["developer", "end_user", "app_user", "server_key"]).meta({
-    description: "What the caller was acting as: a `developer` in the console, an `app_user` of one app, or a `server_key` used by server-side code. A bridge invokes nothing, so it is deliberately not a case here. `end_user` appears only on runs recorded before app users replaced the organisation-wide user pool \u2014 it is kept so a history page can still render them, and nothing writes it any more."
+    description: "What the caller was acting as: a `developer` in the console, an `app_user` of one app, or a `server_key` used by server-side code. A bridge invokes nothing, so it is deliberately not a case here. `end_user` appears only on runs recorded before app users replaced the organisation-wide user pool \u2014 kept so old runs still render; nothing writes it now."
   }),
   id: import_zod7.z.uuid().meta({
     description: "The id of the Fleetless user, app user or server key that invoked the run."
@@ -2049,7 +2047,7 @@ var jobActor = import_zod7.z.object({
 var jobRunKind = import_zod7.z.enum(["action", "service"]);
 var jobRun = import_zod7.z.object({
   id: import_zod7.z.uuid().meta({
-    description: "The run's id, which is the same id the invocation was answered with \u2014 so a caller that kept a job id can find its durable record here later."
+    description: "The run's id \u2014 the same id the invocation was answered with, so a caller that kept a job id can find its durable record here later."
   }),
   robot_id: import_zod7.z.uuid().meta({ description: "The robot the run happened on." }),
   slug: slug.meta({
@@ -2152,7 +2150,7 @@ var jobRunSummary = import_zod7.z.object({
   since_ms: import_zod7.z.number().int().nonnegative()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/protocol.js
+// node_modules/.pnpm/@fleetless+contracts@1.1.0/node_modules/@fleetless/contracts/dist/protocol.js
 var MAX_PATIENCE_MS = 12e4;
 var MIN_PATIENCE_MS = 1e3;
 var activeJob = import_zod8.z.object({
@@ -2168,22 +2166,21 @@ var bridgeHello = import_zod8.z.object({
   /**
    * Every job this bridge still knows about, right now.
    *
-   * A reconnect and a restart look **identical** on the wire otherwise: same
-   * token, same version, same frame. But they must end differently — after a
-   * dropped connection the running jobs are still running, after a restart
-   * their results are gone forever. Asking the bridge to enumerate what it
-   * still has settles it without either side guessing: the cloud marks every
-   * job it believes is running on this robot and that is *not* named here as
-   * `lost`.
+   * A reconnect and a restart look **identical** on the wire — same token,
+   * same version, same frame — but must end differently: after a dropped
+   * connection the running jobs are still running, after a restart their
+   * results are gone forever. Enumerating what the bridge still has settles
+   * it without either side guessing: the cloud marks every job it believed
+   * running that is *not* named here as `lost`.
    *
-   * This deliberately needs no persistence at the bridge. A live process
-   * lists its live jobs; a process that just started lists none, because it
-   * has none — which is exactly the truth the cloud needs. A breadcrumb file
-   * would only add a window in which the crash beat the write.
+   * Deliberately needs no persistence at the bridge: a live process lists its
+   * live jobs, a process that just started lists none — exactly the truth
+   * the cloud needs. A breadcrumb file would only add a window in which the
+   * crash beat the write.
    *
-   * Defaulted, so a bridge that sends no such field still parses; a bridge
-   * with no jobs and a bridge that does not report them both mean the cloud
-   * has nothing to keep alive.
+   * Defaulted, so a bridge that sends no such field still parses; no jobs
+   * and no report both mean the same thing to the cloud: nothing to keep
+   * alive.
    */
   active_jobs: import_zod8.z.array(activeJob).max(500).default([])
 });
@@ -2551,11 +2548,11 @@ var bridgeCameraState = import_zod8.z.object({
   request_id: import_zod8.z.string().min(1).max(64).nullable()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/config-issues.js
+// node_modules/.pnpm/@fleetless+contracts@1.1.0/node_modules/@fleetless/contracts/dist/config-issues.js
 var EXPOSURE_SECTIONS = ["datapoints", "actions", "services", "publishers", "cameras"];
 var EXPOSURE_SECTION_NAMES = new Set(EXPOSURE_SECTIONS);
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/rest.js
+// node_modules/.pnpm/@fleetless+contracts@1.1.0/node_modules/@fleetless/contracts/dist/rest.js
 var import_zod9 = require("zod");
 var robot = import_zod9.z.object({
   id: import_zod9.z.uuid().meta({
@@ -2570,7 +2567,7 @@ var robot = import_zod9.z.object({
 });
 var patchRobotResponse = import_zod9.z.object({
   robot: robot.meta({
-    description: "The robot as it now stands, after the patch was applied. The whole resource comes back, not only the fields that changed."
+    description: "The robot as it now stands, after the patch. The whole resource comes back, not only the changed fields."
   })
 });
 var createRobotRequest = import_zod9.z.object({
@@ -2600,10 +2597,10 @@ var robotListResponse = import_zod9.z.object({
 var datapointValue = import_zod9.z.object({
   slug: slug.meta({ description: "The datapoint this value belongs to." }),
   value: import_zod9.z.unknown().meta({
-    description: "The value itself, shaped by the datapoint: a number, a boolean, a string, or the whole ROS message where the configuration names no field inside it. Any `scale` and `offset` the configuration declares have already been applied, at the robot."
+    description: "The value, shaped by the datapoint: a number, a boolean, a string, or the whole ROS message where the configuration names no field inside it. Any `scale` and `offset` the configuration declares have already been applied, at the robot."
   }),
   timestamp_ms: import_zod9.z.number().int().nonnegative().meta({
-    description: "When the value was captured, as a unix timestamp in milliseconds. This is the **bridge's capture time**, never the time the cloud received it \u2014 the one exception is the built-in `bridge_state`, which the cloud observes by construction."
+    description: "When the value was captured, as a unix timestamp in milliseconds. The **bridge's capture time**, never the time the cloud received it \u2014 the one exception is the built-in `bridge_state`, which the cloud observes by construction."
   })
 });
 var robotDetailResponse = import_zod9.z.object({
@@ -2745,7 +2742,7 @@ var invokeResponse = import_zod9.z.object({
 });
 var serviceCallResponse = import_zod9.z.object({
   result: import_zod9.z.unknown().meta({
-    description: "What the service returned, shaped by the ROS service itself. A service call is awaited to completion, so there is no job to observe afterwards and no id to hold on to."
+    description: "What the service returned, shaped by the ROS service. A service call is awaited to completion, so there is no job to observe afterwards and no id to hold on to."
   })
 });
 var invokeOrServiceResponse = import_zod9.z.union([invokeResponse, serviceCallResponse]);
@@ -3315,13 +3312,13 @@ var slugUsageResponse = import_zod9.z.object({
   alert_count: import_zod9.z.number().int().nonnegative()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/realtime.js
+// node_modules/.pnpm/@fleetless+contracts@1.1.0/node_modules/@fleetless/contracts/dist/realtime.js
 var import_zod14 = require("zod");
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/client-auth.js
+// node_modules/.pnpm/@fleetless+contracts@1.1.0/node_modules/@fleetless/contracts/dist/client-auth.js
 var import_zod13 = require("zod");
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/apps.js
+// node_modules/.pnpm/@fleetless+contracts@1.1.0/node_modules/@fleetless/contracts/dist/apps.js
 var import_zod10 = require("zod");
 var appIdentifier = slug;
 var app = import_zod10.z.object({
@@ -3335,7 +3332,7 @@ var app = import_zod10.z.object({
     description: "The display name, shown in the console and available to the developer's own pages through the `app.name` mail-template variable. Free text, changed through `PATCH /api/apps/:id`."
   }),
   identifier: appIdentifier.meta({
-    description: "The stable handle a client sends at login, lowercase and underscore-separated. **Globally unique, not per organisation** \u2014 `clientLoginRequest` carries no org context to disambiguate with, so a collision is refused with `identifier_taken`."
+    description: "The stable handle a client sends at login, lowercase and underscore-separated. **Globally unique, not per organisation** \u2014 `clientLoginRequest` carries no org context, so a collision is refused with `identifier_taken`."
   }),
   /** Robots are referenced individually; tags never grant rights. */
   robot_ids: import_zod10.z.array(import_zod10.z.uuid()).meta({
@@ -3353,7 +3350,7 @@ var app = import_zod10.z.object({
    * (`createAppUserRequest`, `createAppInvitationRequest`) rather than
    * pre-filling a form.
    *
-   * That is worth saying out loud because it changes what a wrong value costs.
+   * Worth saying: it changes what a wrong value costs.
    * A prefill somebody can see and correct became a default applied on the
    * server, and the obvious next question — should it be required instead? —
    * has a deliberate answer: no, because an invitation resolves the role at
@@ -3370,7 +3367,7 @@ var app = import_zod10.z.object({
    * check that, so `PATCH /api/apps/:id` does.
    */
   default_role_id: import_zod10.z.uuid().nullable().meta({
-    description: "The role an app user gets when they are created or invited without an explicit one. `null` means this app has not chosen a default, the normal state of an app created before its roles were configured \u2014 and then a create or invite that omits `role_id` is a `validation_error` rather than a user with no role. An invitation resolves the role when it is issued, so changing this never re-aims an outstanding one. The role must belong to this app, which `PATCH /api/apps/:id` checks and the schema cannot."
+    description: "The role an app user gets when created or invited without an explicit one. `null` means this app has not chosen a default, the normal state of an app created before its roles were configured \u2014 and then a create or invite that omits `role_id` gets `validation_error`, not a user with no role. An invitation resolves the role when issued, so changing this never re-aims an outstanding one. The role must belong to this app, which `PATCH /api/apps/:id` checks and the schema cannot."
   }),
   created_at: import_zod10.z.iso.datetime().meta({
     description: "When the app was created, as an ISO 8601 timestamp. `GET /api/apps` orders by this field."
@@ -3406,7 +3403,7 @@ var updateAppRequest = import_zod10.z.object({
 var serverKeyToken = import_zod10.z.string().regex(/^flk_[0-9a-f]{32}$/);
 var serverKey = import_zod10.z.object({
   id: import_zod10.z.uuid().meta({
-    description: "The key row, and what the rotate and delete routes address. It is not the key: the secret itself is never carried by this shape."
+    description: "The key row, and what the rotate and delete routes address. It is not the key: this shape never carries the secret."
   }),
   app_id: import_zod10.z.uuid().meta({
     description: "The app whose full rights this key carries. A key is never shared between apps."
@@ -3424,7 +3421,7 @@ var serverKey = import_zod10.z.object({
 });
 var serverKeyListResponse = import_zod10.z.object({
   server_keys: import_zod10.z.array(serverKey).meta({
-    description: "The app's server keys as metadata, oldest first by `created_at`. The raw secret is not here and never will be: it exists once, in the answer to the request that created or rotated the key."
+    description: "The app's server keys as metadata, oldest first by `created_at`. The raw secret is not here and never will be: it exists once, in the response that created or rotated the key."
   })
 });
 var createServerKeyResponse = import_zod10.z.object({
@@ -3442,7 +3439,7 @@ var role = import_zod10.z.object({
     description: "The role's name, shown wherever a user's access is chosen. The two roles every app starts with are named `observe` and `operate`."
   }),
   builtin: import_zod10.z.boolean().meta({
-    description: "`true` for the two roles every app starts with. Their **rights may be re-scoped** exactly like a custom role's, through `PUT /api/apps/:id/roles/:roleId/permissions` \u2014 the flag exists so the console can explain where they came from, not to protect them. It does not make them renamable or deletable, because no route renames or deletes any role."
+    description: "`true` for the two roles every app starts with. Their **rights may be re-scoped** exactly like a custom role's, through `PUT /api/apps/:id/roles/:roleId/permissions` \u2014 the flag exists so the console can explain where they came from, not to protect them. It does not make them renamable or deletable \u2014 no route does that for any role."
   })
 });
 var roleListResponse = import_zod10.z.object({
@@ -3503,10 +3500,10 @@ var rolePermissions = import_zod10.z.object({
   })
 });
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/app-users.js
+// node_modules/.pnpm/@fleetless+contracts@1.1.0/node_modules/@fleetless/contracts/dist/app-users.js
 var import_zod12 = require("zod");
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/identity.js
+// node_modules/.pnpm/@fleetless+contracts@1.1.0/node_modules/@fleetless/contracts/dist/identity.js
 var import_zod11 = require("zod");
 var password = import_zod11.z.string().min(12).max(256);
 var USER_DISPLAY_NAME_MAX = 120;
@@ -3524,7 +3521,7 @@ var org = import_zod11.z.object({
 });
 var patchOrgResponse = import_zod11.z.object({
   org: org.meta({
-    description: "The organisation as it now stands, after the patch was applied. The whole resource comes back, not only the fields that changed."
+    description: "The organisation as it now stands, after the patch. The whole resource comes back, not only the changed fields."
   })
 });
 var fleetlessUser = import_zod11.z.object({
@@ -3532,7 +3529,7 @@ var fleetlessUser = import_zod11.z.object({
     description: "The Fleetless user in the API, assigned by the cloud and stable for the life of the account."
   }),
   org_id: import_zod11.z.uuid().meta({
-    description: "The organisation this person belongs to. Every developer route is already scoped to the caller's org, so this confirms what a client is looking at rather than being a filter it applies."
+    description: "The organisation this person belongs to. Every developer route is already scoped to the caller's org, so this confirms what a client is looking at, not a filter it applies."
   }),
   email: import_zod11.z.email().meta({
     description: "The address the account is identified by, **globally unique** across every organisation. Immutable after creation: it is what every invitation, reset link and audit line names."
@@ -3541,7 +3538,7 @@ var fleetlessUser = import_zod11.z.object({
     description: "Optional human name, shown by the console instead of the address where present. Self-service through `PATCH /api/auth/me`; never used for authentication. `null` when the person never supplied one."
   }),
   tier: orgAdminTier.meta({
-    description: "The console powers this person holds. **Required** \u2014 every Fleetless user is a member of the team and has a tier; the optional version of this field existed only while the org also held people with no console powers to grade, and that pool is gone."
+    description: "The console powers this person holds. **Required** \u2014 every Fleetless user has a tier; it was optional only while the org also held people with no console powers to grade, and that pool is gone."
   }),
   created_at: import_zod11.z.iso.datetime().meta({
     description: "When the account was created, as an ISO 8601 timestamp."
@@ -3668,9 +3665,9 @@ var authMeResponse = import_zod11.z.object({ org, user: fleetlessUser });
 var patchOrgRequest = import_zod11.z.object({ name: import_zod11.z.string().min(1).max(120) }).strict();
 var patchAuthMeRequest = import_zod11.z.object({ display_name: import_zod11.z.string().min(1).max(USER_DISPLAY_NAME_MAX).nullable() }).strict();
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/app-users.js
+// node_modules/.pnpm/@fleetless+contracts@1.1.0/node_modules/@fleetless/contracts/dist/app-users.js
 var APP_USER_DISPLAY_NAME_MAX = 120;
-var providerSlug = import_zod12.z.string().max(40).regex(/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/, "a provider slug is lowercase and hyphen-separated, starting with a letter");
+var providerSlug = import_zod12.z.string().max(40).regex(/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/, "must be lowercase and hyphen-separated, starting with a letter");
 var appUserStatus = import_zod12.z.enum(["pending_verification", "active", "blocked"]);
 var appUser = import_zod12.z.object({
   id: import_zod12.z.uuid().meta({
@@ -3698,10 +3695,10 @@ var appUser = import_zod12.z.object({
    * accepted — it does not mean blocked and it does not mean without access.
    */
   has_password: import_zod12.z.boolean().meta({
-    description: 'Whether this account has a Fleetless-held password at all. `false` is an identity-provider-only account, or an invitation not yet accepted \u2014 it does not mean blocked and it does not mean without access. No hash, no algorithm and no "last changed" travels here, and nothing on the wire can say whether a password is strong or already known to somebody else.'
+    description: 'Whether this account has a Fleetless-held password. `false` is an identity-provider-only account, or an invitation not yet accepted \u2014 it does not mean blocked and it does not mean without access. No hash, no algorithm and no "last changed" travels here, and nothing on the wire can say whether a password is strong or already known to somebody else.'
   }),
   providers: import_zod12.z.array(providerSlug).max(20).meta({
-    description: "The slugs of the identity providers this account is linked to, empty for a password-only user. It is what lets a developer's user list say where an account came from without a second request."
+    description: "The slugs of the identity providers this account is linked to, empty for a password-only user. Lets a developer's user list say where an account came from without a second request."
   }),
   last_login_at: import_zod12.z.iso.datetime().nullable().meta({
     description: "When this user last signed in, or `null` if they never have. Required and nullable rather than optional, so *never logged in* stays distinguishable from *this field was not loaded*."
@@ -3795,7 +3792,7 @@ var appOidcProvider = import_zod12.z.object({
     description: "Whether a federated login may join an **existing** app user with the same address. It needs the provider to assert `email_verified` as well: either condition alone is account takeover, since a provider that lets anyone type any address into a profile would otherwise hand over every matching account, and a developer who connects a provider for a subset of their users would otherwise silently merge strangers."
   }),
   enabled: import_zod12.z.boolean().meta({
-    description: "Whether this provider is offered at all. A disabled provider disappears from `GET /api/client/providers` and refuses a start with `provider_disabled`, without the row and its linked identities being deleted."
+    description: "Whether this provider is offered. A disabled provider disappears from `GET /api/client/providers` and refuses a start with `provider_disabled`, without the row and its linked identities being deleted."
   }),
   created_at: import_zod12.z.iso.datetime().meta({ description: "When the provider was configured, as an ISO 8601 timestamp." })
 }).strict();
@@ -3919,10 +3916,10 @@ var mailOutcome = import_zod12.z.object({
   })
 });
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/client-auth.js
+// node_modules/.pnpm/@fleetless+contracts@1.1.0/node_modules/@fleetless/contracts/dist/client-auth.js
 var clientLoginRequest = import_zod13.z.object({
   app_identifier: appIdentifier.meta({
-    description: "The app being logged in to, as its globally unique identifier \u2014 the lowercase, underscore-separated string the developer chose when the app was created. There is no organisation context at login, so this is what decides which app the credentials are checked for."
+    description: "The app being logged in to: its globally unique, lowercase, underscore-separated identifier, chosen by the developer at creation. There is no organisation context at login, so this is what decides which app the credentials are checked for."
   }),
   email: import_zod13.z.email().meta({
     description: "The app user's address. Addresses are unique **per app**, not across Fleetless: the same address may be an unrelated account in another app of the same organisation, so this pair is what identifies a person here."
@@ -3938,7 +3935,7 @@ var clientRefreshRequest = import_zod13.z.object({
 });
 var clientLogoutRequest = import_zod13.z.object({
   refresh_token: import_zod13.z.string().min(1).meta({
-    description: "Any refresh token of the session to end. The whole token family is revoked server-side, so a token stolen before this call stops working too \u2014 clearing a client-side store is a gesture, not a revocation. The answer is `204`: a token the server does not recognise gets it too, since the end state a caller asked for is the end state they get."
+    description: "Any refresh token of the session to end. The whole token family is revoked server-side, so a token stolen before this call stops working too \u2014 clearing a client-side store is a gesture, not a revocation. The answer is `204`: a token the server does not recognise gets it too, since that is the end state being asked for."
   })
 });
 var clientRegisterRequest = import_zod13.z.object({
@@ -4054,7 +4051,7 @@ var clientMcpInteraction = import_zod13.z.object({
   app_id: import_zod13.z.uuid().meta({ description: "The app this authorization is for. The approving token's `app_id` must match it \u2014 an interaction of one app cannot be approved with a session from another." }),
   client_name: import_zod13.z.string().nullable().meta({ description: "What the MCP client calls itself, or `null` if it named nothing. **Unverified** \u2014 see `client_name_verified`." }),
   client_name_verified: import_zod13.z.literal(false).meta({
-    description: "Always `false`. The client registered itself without authentication and chose this name about itself, so it must be rendered as a claim and never as an identity. There is no verified case, which is why this is a literal and not a boolean: a `true` branch would be dead code that looked like a safeguard."
+    description: "Always `false`. The client registered itself without authentication and named itself, so it must be rendered as a claim and never as an identity. There is no verified case, which is why this is a literal and not a boolean: a `true` branch would be dead code that looked like a safeguard."
   }),
   scopes: import_zod13.z.array(import_zod13.z.string()).meta({ description: "The scopes the client asked for, to show the person before they approve." }),
   already_granted: import_zod13.z.boolean().meta({ description: "Whether this user has already approved this client. It is a record of what they answered last time, and **this route makes no second use of it**: an app that skips its own consent screen when this is `true` is the only thing deciding that, and approve succeeds identically for a user who holds no grant at all. The standing grant is read elsewhere, on every request to the app's MCP endpoint. Withdrawing it is `DELETE /api/client/mcp/grants/:clientId` for the person themselves and `DELETE /api/apps/:id/users/:userId/mcp-grants/:clientId` for the developer. A withdrawal makes this `false` again at the next authorization **and stops the client at its very next MCP call**, unexpired access token and all \u2014 up to fifteen minutes of it \u2014 because the endpoint keys that check on the `client_id` the token carries." }),
@@ -4070,10 +4067,10 @@ var mcpConsentGrant = import_zod13.z.object({
     description: "The MCP client this consent is for, as its dynamic registration was issued. It is the value the withdrawal routes take in their path, and it is the only stable handle on a client \u2014 the name beside it is not one."
   }),
   client_name: import_zod13.z.string().nullable().meta({
-    description: "What the client calls itself, or `null` when its registration is gone and there is no longer anything to have named. **Unverified** \u2014 see `client_name_verified`."
+    description: "What the client calls itself, or `null` once its registration is gone. **Unverified** \u2014 see `client_name_verified`."
   }),
   client_name_verified: import_zod13.z.literal(false).meta({
-    description: "Always `false`. The client registered itself without authentication and chose this name about itself, so it must be rendered as a claim and never as an identity. There is no verified case, which is why this is a literal and not a boolean: a `true` branch would be dead code that looked like a safeguard."
+    description: "Always `false`. The client registered itself without authentication and named itself, so it must be rendered as a claim and never as an identity. There is no verified case, which is why this is a literal and not a boolean: a `true` branch would be dead code that looked like a safeguard."
   }),
   granted_at: import_zod13.z.iso.datetime().meta({
     description: "When the consent was last given. A withdrawal followed by a fresh approval moves it, because the second approval is the agreement that stands \u2014 it is not a record of the first time anybody ever said yes."
@@ -4086,7 +4083,7 @@ var mcpConsentGrantListResponse = import_zod13.z.object({
 });
 var clientIdentity = import_zod13.z.object({
   kind: import_zod13.z.enum(["developer", "app_user", "server_key"]).meta({
-    description: "Which of the three kinds of caller this is: a `developer` working through the console, an `app_user` holding a token from a client login, or a `server_key` used by server-side code. Stated outright rather than left to be inferred from which id happens to be set."
+    description: "Which of the three kinds of caller this is: a `developer` working through the console, an `app_user` holding a token from a client login, or a `server_key` used by server-side code. Stated outright, not inferred from which id is set."
   }),
   developer_id: import_zod13.z.uuid().nullable().meta({
     description: "The Fleetless user behind this session, or `null` when `kind` is not `developer`."
@@ -4108,7 +4105,7 @@ var clientIdentity = import_zod13.z.object({
   })
 });
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/realtime.js
+// node_modules/.pnpm/@fleetless+contracts@1.1.0/node_modules/@fleetless/contracts/dist/realtime.js
 var clientAuth = import_zod14.z.object({
   type: import_zod14.z.literal("auth"),
   token: import_zod14.z.string().min(1)
@@ -4294,10 +4291,10 @@ var liveSessionEvent = import_zod14.z.object({
   /**
    * **Classified text the cloud produced, never text the robot sent.**
    *
-   * It is **not** the robot's own words. Nothing sanitises
-   * `bridgeCameraState.error.message`, and a camera password reaches a
-   * developer surface through exactly that route — which is why the cloud maps
-   * a robot's diagnosis to fixed strings rather than forwarding it.
+   * Nothing sanitises `bridgeCameraState.error.message`, and a camera
+   * password reaches a developer surface through exactly that route — which
+   * is why the cloud maps a robot's diagnosis to fixed strings rather than
+   * forwarding it.
    *
    * So: `null` unless the cloud itself has something classified to say. If a
    * developer needs the robot's own diagnosis later, it arrives as a mapped
@@ -4386,17 +4383,34 @@ var orgEventDropped = import_zod14.z.object({
   dropped: import_zod14.z.number().int().positive()
 }).strict();
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/audit.js
+// node_modules/.pnpm/@fleetless+contracts@1.1.0/node_modules/@fleetless/contracts/dist/client-robots.js
 var import_zod15 = require("zod");
-var auditActor = import_zod15.z.object({
-  kind: import_zod15.z.enum(["developer", "end_user", "app_user", "server_key", "bridge"]),
-  id: import_zod15.z.uuid(),
-  label: import_zod15.z.string().min(1).max(200)
-});
-var auditEvent = import_zod15.z.object({
-  id: import_zod15.z.uuid(),
-  org_id: import_zod15.z.uuid(),
-  at: import_zod15.z.iso.datetime(),
+var clientRobotListItem = import_zod15.z.object({
+  ...robot.shape,
+  bridge_state: bridgeState.meta({
+    description: "The built-in `bridge_state` datapoint as the cloud observes it right now: whether the bridge is connected, and its latency when it is."
+  }),
+  published_version: import_zod15.z.number().int().positive().nullable().meta({
+    description: 'The published configuration version, or `null` when nothing has been published yet. A robot with nothing published is still listed \u2014 "not configured yet" is a real state, and the caller is entitled to it \u2014 and its datasheet answers an empty exposure list.'
+  })
+});
+var clientRobotListResponse = import_zod15.z.object({
+  robots: import_zod15.z.array(clientRobotListItem).meta({
+    description: "Every robot the caller reaches, in name order with the id as the tiebreak. An app user reaches the robots their app attaches on which their role grants at least one slug or capability; a server key reaches every robot its app attaches; a developer reaches every robot of the organisation."
+  })
+});
+
+// node_modules/.pnpm/@fleetless+contracts@1.1.0/node_modules/@fleetless/contracts/dist/audit.js
+var import_zod16 = require("zod");
+var auditActor = import_zod16.z.object({
+  kind: import_zod16.z.enum(["developer", "end_user", "app_user", "server_key", "bridge"]),
+  id: import_zod16.z.uuid(),
+  label: import_zod16.z.string().min(1).max(200)
+});
+var auditEvent = import_zod16.z.object({
+  id: import_zod16.z.uuid(),
+  org_id: import_zod16.z.uuid(),
+  at: import_zod16.z.iso.datetime(),
   /**
    * A monotonic counter, ascending in write order, unique across the log.
    *
@@ -4415,18 +4429,18 @@ var auditEvent = import_zod15.z.object({
    * Required, not optional: an event without a sequence cannot be ordered
    * against one that has it, and a log with two orderings has none.
    */
-  seq: import_zod15.z.number().int().positive(),
+  seq: import_zod16.z.number().int().positive(),
   actor: auditActor,
   /** Stable dotted name, e.g. `app_user.login`, `config.published`. */
-  action: import_zod15.z.string().min(1).max(80),
+  action: import_zod16.z.string().min(1).max(80),
   /**
    * What the action was about, if anything — a robot, an app, a user. Free
    * of ids the console cannot resolve: carry the label with it.
    */
-  target: import_zod15.z.object({
-    kind: import_zod15.z.string().min(1).max(40),
-    id: import_zod15.z.string().min(1),
-    label: import_zod15.z.string().min(1).max(200)
+  target: import_zod16.z.object({
+    kind: import_zod16.z.string().min(1).max(40),
+    id: import_zod16.z.string().min(1),
+    label: import_zod16.z.string().min(1).max(200)
   }).nullable(),
   /**
    * Action-specific extras.
@@ -4440,10 +4454,10 @@ var auditEvent = import_zod15.z.object({
    * So: never credentials, never tokens. That is a rule, not a guarantee the
    * schema enforces.
    */
-  details: import_zod15.z.record(import_zod15.z.string(), import_zod15.z.unknown()).nullable()
+  details: import_zod16.z.record(import_zod16.z.string(), import_zod16.z.unknown()).nullable()
 });
 var auditTimestampMs = wireTimestampMs;
-var auditQuery = import_zod15.z.object({
+var auditQuery = import_zod16.z.object({
   /** Only events with a smaller `seq` — the next, older page. */
   before_seq: wireSeqCursor.optional(),
   /**
@@ -4452,19 +4466,18 @@ var auditQuery = import_zod15.z.object({
    * coercion's result in either `io` direction, so the artifact would describe
    * a shape a query string can never carry.
    */
-  limit: import_zod15.z.union([import_zod15.z.string().regex(/^\d{1,4}$/), import_zod15.z.number().int()]).transform((v) => Number(v)).pipe(import_zod15.z.number().int().positive().max(500)).optional(),
+  limit: import_zod16.z.union([import_zod16.z.string().regex(/^\d{1,4}$/), import_zod16.z.number().int()]).transform((v) => Number(v)).pipe(import_zod16.z.number().int().positive().max(500)).optional(),
   /** Exact action name, e.g. `config.published`. No prefix matching: a filter that matches more than it says is not one. */
-  action: import_zod15.z.string().min(1).max(80).optional(),
+  action: import_zod16.z.string().min(1).max(80).optional(),
   /**
    * Everything under a dotted prefix, e.g. `server_key.` for all three
    * server-key actions.
    *
-   * **A separate parameter, not a widening of `action`.** The sentence on
-   * `action` above — a filter that matches more than it says is not one —
-   * still stands; this is a different question with a name that says which
-   * one it is. Setting both is refused rather than resolved, because a query
+   * **A separate parameter, not a widening of `action`.** The rule on
+   * `action` above still stands; this is a different question with a name
+   * that says which one it is. Setting both is refused, not resolved —
    * naming an exact action *and* a prefix is a caller mistake, not a
-   * combination anyone should have to guess the meaning of.
+   * combination to guess the meaning of.
    *
    * **The published artifact cannot express that refusal**: a cross-field
    * `.refine()` has no JSON Schema rendering, so `audit-query.schema.json`
@@ -4472,7 +4485,7 @@ var auditQuery = import_zod15.z.object({
    * happily. The cloud is the only enforcement point — the same residual
    * `orgLatencyQuery` and `orgUsageQuery` already name.
    */
-  action_prefix: import_zod15.z.string().min(1).max(80).optional(),
+  action_prefix: import_zod16.z.string().min(1).max(80).optional(),
   /**
    * Only events by this actor.
    *
@@ -4484,9 +4497,9 @@ var auditQuery = import_zod15.z.object({
    * Not an injection question — the query is parameterised either way. It is a
    * **500 where a 400 belongs**, and a 500 is the answer that explains nothing.
    */
-  actor_id: import_zod15.z.uuid().optional(),
+  actor_id: import_zod16.z.uuid().optional(),
   /** Only events about this kind of target, e.g. `robot`. */
-  target_kind: import_zod15.z.string().min(1).max(40).optional(),
+  target_kind: import_zod16.z.string().min(1).max(40).optional(),
   /**
    * Absolute bounds in unix milliseconds, **half-open `[from, to)`** — the
    * same rule the history shapes follow.
@@ -4502,8 +4515,8 @@ var auditQuery = import_zod15.z.object({
   message: "action and action_prefix cannot be combined",
   path: ["action_prefix"]
 });
-var auditListResponse = import_zod15.z.object({
-  events: import_zod15.z.array(auditEvent),
+var auditListResponse = import_zod16.z.object({
+  events: import_zod16.z.array(auditEvent),
   /**
     * The `seq` a caller sends as `before_seq` to keep reading — or `null` when
     * there is nothing further.
@@ -4514,29 +4527,29 @@ var auditListResponse = import_zod15.z.object({
     * not mean *no more* here. The same distinction `historySamples` was given
     * `truncated` for.
     */
-  next_cursor: import_zod15.z.number().int().positive().nullable()
+  next_cursor: import_zod16.z.number().int().positive().nullable()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/errors.js
-var import_zod16 = require("zod");
-var apiError = import_zod16.z.object({
-  code: import_zod16.z.string().min(1),
-  message: import_zod16.z.string().min(1),
-  details: import_zod16.z.unknown().optional()
+// node_modules/.pnpm/@fleetless+contracts@1.1.0/node_modules/@fleetless/contracts/dist/errors.js
+var import_zod17 = require("zod");
+var apiError = import_zod17.z.object({
+  code: import_zod17.z.string().min(1),
+  message: import_zod17.z.string().min(1),
+  details: import_zod17.z.unknown().optional()
 });
-var parameterViolation = import_zod16.z.object({
-  field: import_zod16.z.string().min(1),
+var parameterViolation = import_zod17.z.object({
+  field: import_zod17.z.string().min(1),
   /** Which rule failed — `min`, `max`, `enum`, `pattern`, `required`, `undeclared`. */
-  rule: import_zod16.z.string().min(1),
-  message: import_zod16.z.string().min(1)
+  rule: import_zod17.z.string().min(1),
+  message: import_zod17.z.string().min(1)
 });
-var parameterInvalidDetails = import_zod16.z.object({
-  violations: import_zod16.z.array(parameterViolation).min(1)
+var parameterInvalidDetails = import_zod17.z.object({
+  violations: import_zod17.z.array(parameterViolation).min(1)
 });
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/oauth.js
-var import_zod17 = require("zod");
-var oauthErrorCode = import_zod17.z.enum([
+// node_modules/.pnpm/@fleetless+contracts@1.1.0/node_modules/@fleetless/contracts/dist/oauth.js
+var import_zod18 = require("zod");
+var oauthErrorCode = import_zod18.z.enum([
   "invalid_request",
   "invalid_client",
   "invalid_grant",
@@ -4549,11 +4562,11 @@ var oauthErrorCode = import_zod17.z.enum([
   /** RFC 8707: the `resource` named is not one this server issues tokens for. */
   "invalid_target"
 ]);
-var oauthError = import_zod17.z.object({
+var oauthError = import_zod18.z.object({
   error: oauthErrorCode,
-  error_description: import_zod17.z.string().min(1).max(500).optional(),
+  error_description: import_zod18.z.string().min(1).max(500).optional(),
   /** Echoed back per RFC 6749 §4.1.2.1 so a client can match the response. */
-  state: import_zod17.z.string().min(1).max(500).optional(),
+  state: import_zod18.z.string().min(1).max(500).optional(),
   /**
    * **A Fleetless reason carried inside a standard envelope, and it exists
    * because the alternative lost a distinction.**
@@ -4571,9 +4584,9 @@ var oauthError = import_zod17.z.object({
    * our own tooling switches on. RFC 6749 §5.2 permits additional members, and
    * a client that ignores this one still behaves correctly.
    */
-  fleetless_code: import_zod17.z.string().min(1).max(60).optional()
+  fleetless_code: import_zod18.z.string().min(1).max(60).optional()
 });
-var redirectUri = import_zod17.z.string().min(1).max(2e3).refine((v) => {
+var redirectUri = import_zod18.z.string().min(1).max(2e3).refine((v) => {
   let url;
   try {
     url = new URL(v);
@@ -4588,161 +4601,161 @@ var redirectUri = import_zod17.z.string().min(1).max(2e3).refine((v) => {
     return ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
   return false;
 }, { message: "redirect_uri must be an https URL, or http on an explicit loopback address, and carry no fragment" });
-var codeChallengeMethod = import_zod17.z.enum(["S256"]);
+var codeChallengeMethod = import_zod18.z.enum(["S256"]);
 var MCP_DCR_MAX_REDIRECT_URIS = 5;
-var dynamicClientRegistrationRequest = import_zod17.z.object({
-  redirect_uris: import_zod17.z.array(redirectUri).min(1).max(MCP_DCR_MAX_REDIRECT_URIS).meta({
-    description: `Where the authorization code may be returned, and the one field a registration cannot omit. Each must be an \`https\` URL, or \`http\` on an explicit loopback address for a native app that cannot hold a certificate, and none may carry a fragment. There must be between \`1\` and \`${MCP_DCR_MAX_REDIRECT_URIS}\` of them; duplicates are collapsed rather than counted twice. Matched **exactly** at the authorize step against what was registered here.`
+var dynamicClientRegistrationRequest = import_zod18.z.object({
+  redirect_uris: import_zod18.z.array(redirectUri).min(1).max(MCP_DCR_MAX_REDIRECT_URIS).meta({
+    description: `Where the authorization code may be returned, and the one field a registration cannot omit. Each must be an \`https\` URL, or \`http\` on an explicit loopback address for a native app that cannot hold a certificate, and none may carry a fragment. Between \`1\` and \`${MCP_DCR_MAX_REDIRECT_URIS}\` of them; duplicates are collapsed rather than counted twice. Matched **exactly** at the authorize step against what was registered here.`
   }),
-  client_name: import_zod17.z.string().min(1).max(200).optional().meta({
-    description: `The name the client calls itself. Optional \u2014 a registration without one is recorded under a default name, per RFC 7591's making every metadata field optional. It is **not** vouched for by Fleetless and must never be rendered as if it were: a self-registered client chooses this string, and one has called itself *"Fleetless Official Helper"*.`
+  client_name: import_zod18.z.string().min(1).max(200).optional().meta({
+    description: 'The name the client calls itself. Optional: RFC 7591 makes every metadata field optional, so a registration without one is recorded under a default name. It is **not** vouched for by Fleetless and must never be rendered as if it were: a self-registered client chooses this string, and one has called itself *"Fleetless Official Helper"*.'
   }),
-  token_endpoint_auth_method: import_zod17.z.enum(["none"]).optional().meta({
+  token_endpoint_auth_method: import_zod18.z.enum(["none"]).optional().meta({
     description: "`none`, RFC 7591's value for a public client, and the only value either server registers. Any other value is **refused rather than silently downgraded**: a client that believes it holds a secret and does not has a wrong mental model of its own security. There is no client secret to hold \u2014 mandatory PKCE (`S256`) is the defence."
   }),
-  grant_types: import_zod17.z.array(import_zod17.z.enum(["authorization_code", "refresh_token"])).optional().meta({
+  grant_types: import_zod18.z.array(import_zod18.z.enum(["authorization_code", "refresh_token"])).optional().meta({
     description: "Accepted for conformance with RFC 7591 and then **ignored**. What comes back is what was actually granted, which \xA73.2.1 permits a server to substitute: `authorization_code` and nothing else, so a client that asks for `refresh_token` is registered and told plainly that it did not get one."
   }),
-  response_types: import_zod17.z.array(import_zod17.z.enum(["code"])).optional().meta({
+  response_types: import_zod18.z.array(import_zod18.z.enum(["code"])).optional().meta({
     description: "Accepted for conformance and then **ignored**; the response names `code`, which is the only response type OAuth 2.1 leaves, the implicit grant having been removed."
   }),
-  scope: import_zod17.z.string().max(500).optional().meta({
+  scope: import_zod18.z.string().max(500).optional().meta({
     description: "Accepted for conformance and then **ignored**. This authorization server issues no scopes at all, which is why the registration answer carries no `scope` field to echo one back in."
   })
 }).meta({
   description: "What an MCP client sends to register itself, per RFC 7591. Unknown metadata is ignored rather than refused (\xA73.1), and the answer states what was actually granted rather than what was asked for (\xA73.2.1)."
 });
-var dynamicClientRegistrationResponse = import_zod17.z.object({
-  client_id: import_zod17.z.string().min(1).max(200).meta({
+var dynamicClientRegistrationResponse = import_zod18.z.object({
+  client_id: import_zod18.z.string().min(1).max(200).meta({
     description: "The identifier this client sends at the authorize and token endpoints. Opaque, and not the app identifier."
   }),
-  client_name: import_zod17.z.string().min(1).max(200).meta({
+  client_name: import_zod18.z.string().min(1).max(200).meta({
     description: "The name the client registered under, echoed back. Chosen by the client and not vouched for by Fleetless."
   }),
-  redirect_uris: import_zod17.z.array(redirectUri).meta({
+  redirect_uris: import_zod18.z.array(redirectUri).meta({
     description: "The redirect URIs this registration was accepted for. A code is returned to one of these and nowhere else."
   }),
-  grant_types: import_zod17.z.array(import_zod17.z.string()).meta({
+  grant_types: import_zod18.z.array(import_zod18.z.string()).meta({
     description: 'The grants this client may use. Always exactly `["authorization_code"]` \u2014 a client that asked for `refresh_token` is registered and told here that it did not get one, which is the substitution RFC 7591 \xA73.2.1 permits.'
   }),
-  response_types: import_zod17.z.array(import_zod17.z.string()).meta({
+  response_types: import_zod18.z.array(import_zod18.z.string()).meta({
     description: "The response types this client may ask for: `code`."
   }),
-  token_endpoint_auth_method: import_zod17.z.literal("none").meta({
+  token_endpoint_auth_method: import_zod18.z.literal("none").meta({
     description: "`none` \u2014 this server registers public clients only, and PKCE rather than a secret is what protects the exchange."
   }),
-  client_id_issued_at: import_zod17.z.number().int().nonnegative().meta({
+  client_id_issued_at: import_zod18.z.number().int().nonnegative().meta({
     description: "When the registration was created, in seconds since the epoch, per RFC 7591."
   }),
-  client_secret_expires_at: import_zod17.z.literal(0).meta({
+  client_secret_expires_at: import_zod18.z.literal(0).meta({
     description: "Always `0`, which is RFC 7591's way of saying the client secret never expires \u2014 there is none. The **registration** itself does expire: a self-registered client that never completes a flow is an unauthenticated write somebody left behind."
   })
 });
-var oauthTokenRequest = import_zod17.z.object({
-  grant_type: import_zod17.z.literal("authorization_code").meta({
+var oauthTokenRequest = import_zod18.z.object({
+  grant_type: import_zod18.z.literal("authorization_code").meta({
     description: "Always `authorization_code`: this request exchanges the code from the authorize redirect for tokens. Any other value \u2014 `refresh_token` included \u2014 is `unsupported_grant_type`, refused before the code is looked up."
   }),
-  code: import_zod17.z.string().min(1).max(500).meta({
+  code: import_zod18.z.string().min(1).max(500).meta({
     description: "The authorization code from the redirect. It may be exchanged once; a second presentation is `invalid_grant`, the same answer a fabricated code gets."
   }),
   redirect_uri: redirectUri.meta({
     description: "The same redirect URI the authorize request used. It is compared, not merely recorded."
   }),
-  client_id: import_zod17.z.string().min(1).max(200).meta({
+  client_id: import_zod18.z.string().min(1).max(200).meta({
     description: "The client making the exchange, as registered."
   }),
-  code_verifier: import_zod17.z.string().regex(/^[A-Za-z0-9\-._~]{43,128}$/, "code_verifier must be 43-128 unreserved characters (RFC 7636 \xA74.1)").meta({
+  code_verifier: import_zod18.z.string().regex(/^[A-Za-z0-9\-._~]{43,128}$/, "code_verifier must be 43-128 unreserved characters (RFC 7636 \xA74.1)").meta({
     description: "The PKCE verifier whose `S256` hash was sent as the challenge at the authorize step. Between `43` and `128` unreserved characters, per RFC 7636 \xA74.1 \u2014 it is compared rather than parsed, so a length nobody checks is a length an attacker chooses. PKCE is mandatory for every client under OAuth 2.1."
   }),
-  resource: import_zod17.z.url().optional().meta({
-    description: "The resource the token is being requested for, per RFC 8707. It must match the audience the code was authorized for, or the answer is `invalid_target`; omitted, the code's own audience stands. It becomes the token's `aud`, and a resource refuses a token whose audience names something else \u2014 which is what keeps a token minted for one app out of another app's endpoint."
+  resource: import_zod18.z.url().optional().meta({
+    description: "The resource the token is requested for, per RFC 8707. It must match the audience the code was authorized for, or the answer is `invalid_target`; omitted, the code's own audience stands. It becomes the token's `aud`, and a resource refuses a token whose audience names something else \u2014 which is what keeps a token minted for one app out of another app's endpoint."
   })
 }).meta({
   description: "RFC 6749 \xA74.1.3's authorization-code exchange with PKCE, as either MCP authorization server reads it. Sent as `application/x-www-form-urlencoded`, per \xA74.1.3, though the server accepts a JSON body too."
 });
-var oauthTokenResponse = import_zod17.z.object({
-  access_token: import_zod17.z.string().min(1).meta({
+var oauthTokenResponse = import_zod18.z.object({
+  access_token: import_zod18.z.string().min(1).meta({
     description: "The bearer token. It is the same token the client login mints \u2014 only the envelope differs, because an RFC-compliant client parses this one and knows nothing about Fleetless."
   }),
-  token_type: import_zod17.z.literal("Bearer").meta({
+  token_type: import_zod18.z.literal("Bearer").meta({
     description: "`Bearer`. RFC 6749 \xA75.1 makes the value case-insensitive for a client reading it; this is the spelling this server emits."
   }),
-  expires_in: import_zod17.z.number().int().positive().meta({
+  expires_in: import_zod18.z.number().int().positive().meta({
     description: "How long the access token is valid, in **seconds**, per RFC 6749 \xA75.1. Not a timestamp, and not milliseconds."
   }),
-  refresh_token: import_zod17.z.string().min(1).optional().meta({
+  refresh_token: import_zod18.z.string().min(1).optional().meta({
     description: "The refresh token, when one was issued. It rotates on every use."
   }),
-  scope: import_zod17.z.string().max(500).optional().meta({
+  scope: import_zod18.z.string().max(500).optional().meta({
     description: "The scopes the issued token actually carries, space-separated."
   })
 });
-var authorizationServerMetadata = import_zod17.z.object({
-  issuer: import_zod17.z.url().meta({
+var authorizationServerMetadata = import_zod18.z.object({
+  issuer: import_zod18.z.url().meta({
     description: "The issuer identifier of this authorization server, per RFC 8414 \xA72. It is what a client checks a token's `iss` against."
   }),
-  authorization_endpoint: import_zod17.z.url().meta({
-    description: "The URL a client sends the user to in order to authorize."
+  authorization_endpoint: import_zod18.z.url().meta({
+    description: "Where a client sends the user to authorize."
   }),
-  token_endpoint: import_zod17.z.url().meta({
+  token_endpoint: import_zod18.z.url().meta({
     description: "The URL where a client exchanges an authorization code, or a refresh token, for tokens."
   }),
-  registration_endpoint: import_zod17.z.url().optional().meta({
+  registration_endpoint: import_zod18.z.url().optional().meta({
     description: "The URL where a client may register itself, per RFC 7591. Absent when the app does not accept dynamic clients."
   }),
-  response_types_supported: import_zod17.z.array(import_zod17.z.literal("code")).meta({
+  response_types_supported: import_zod18.z.array(import_zod18.z.literal("code")).meta({
     description: "The response types this server offers: `code` only, the implicit grant being gone with OAuth 2.1."
   }),
-  grant_types_supported: import_zod17.z.array(import_zod17.z.enum(["authorization_code", "refresh_token"])).meta({
+  grant_types_supported: import_zod18.z.array(import_zod18.z.enum(["authorization_code", "refresh_token"])).meta({
     description: "The grants this server offers. OAuth 2.1 removes the implicit and password grants, so neither appears here."
   }),
-  code_challenge_methods_supported: import_zod17.z.array(codeChallengeMethod).meta({
+  code_challenge_methods_supported: import_zod18.z.array(codeChallengeMethod).meta({
     description: "The PKCE challenge methods accepted: `S256` only. `plain` is not offered \u2014 a challenge equal to its verifier defends against nothing, and offering it would make a downgrade negotiable."
   }),
-  token_endpoint_auth_methods_supported: import_zod17.z.array(import_zod17.z.literal("none")).meta({
+  token_endpoint_auth_methods_supported: import_zod18.z.array(import_zod18.z.literal("none")).meta({
     description: "How a client authenticates at the token endpoint: `none`, the public-client method, with PKCE protecting the exchange."
   }),
-  scopes_supported: import_zod17.z.array(import_zod17.z.string()).optional().meta({
+  scopes_supported: import_zod18.z.array(import_zod18.z.string()).optional().meta({
     description: "The scopes this server knows about, where it publishes a list."
   })
 });
-var protectedResourceMetadata = import_zod17.z.object({
-  resource: import_zod17.z.url().meta({
+var protectedResourceMetadata = import_zod18.z.object({
+  resource: import_zod18.z.url().meta({
     description: "The resource identifier this document describes, per RFC 9728. A token whose audience names something else is rejected here rather than merely noted."
   }),
-  authorization_servers: import_zod17.z.array(import_zod17.z.url()).min(1).meta({
+  authorization_servers: import_zod18.z.array(import_zod18.z.url()).min(1).meta({
     description: "The authorization servers that may issue tokens for this resource. There is always at least one."
   }),
-  bearer_methods_supported: import_zod17.z.array(import_zod17.z.literal("header")).meta({
+  bearer_methods_supported: import_zod18.z.array(import_zod18.z.literal("header")).meta({
     description: "How a token may be presented: in the `Authorization` header only, never in a query parameter or a form field."
   }),
-  scopes_supported: import_zod17.z.array(import_zod17.z.string()).optional().meta({
+  scopes_supported: import_zod18.z.array(import_zod18.z.string()).optional().meta({
     description: "The scopes this resource understands, where it publishes a list."
   })
 });
-var oauthRedirectResponse = import_zod17.z.object({
-  redirect_to: import_zod17.z.string().min(1).max(2e3)
+var oauthRedirectResponse = import_zod18.z.object({
+  redirect_to: import_zod18.z.string().min(1).max(2e3)
 });
-var oauthAuthorizeQuery = import_zod17.z.object({
-  response_type: import_zod17.z.literal("code").meta({
+var oauthAuthorizeQuery = import_zod18.z.object({
+  response_type: import_zod18.z.literal("code").meta({
     description: "Always `code`. RFC 6749 \xA74.1.2.1 names `unsupported_response_type` for any other value, but `oauthErrorCode` has no such member \u2014 this server issues no other grant from this endpoint \u2014 so an unsupported value comes back on the callback as `invalid_request`."
   }),
-  client_id: import_zod17.z.string().min(1).meta({
+  client_id: import_zod18.z.string().min(1).meta({
     description: "The OAuth client, self-registered or the one well-known central client \u2014 **not** the app identifier. Unknown, expired-dynamic and mismatched clients all collapse into the same `400 invalid_client`, answered without a redirect."
   }),
-  redirect_uri: import_zod17.z.string().min(1).meta({
+  redirect_uri: import_zod18.z.string().min(1).meta({
     description: "One of the client's registered redirect URIs, compared **exactly** \u2014 string equality against the registered list, never a prefix or a host match. Both the shape (`redirectUri`) and the registration are checked, and a failure of either is a `400 invalid_request` with no redirect."
   }),
-  code_challenge: import_zod17.z.string().min(1).meta({
-    description: "The PKCE challenge; the verifier is presented at the token endpoint. Only non-emptiness is checked here \u2014 length and alphabet are not \u2014 since the verifier is what actually has to match."
+  code_challenge: import_zod18.z.string().min(1).meta({
+    description: "The PKCE challenge; the verifier is presented at the token endpoint. Only non-emptiness is checked here \u2014 length and alphabet are not \u2014 since the verifier is what has to match."
   }),
-  code_challenge_method: import_zod17.z.literal("S256").meta({
+  code_challenge_method: import_zod18.z.literal("S256").meta({
     description: "Only `S256`. `plain` is refused: a challenge equal to its verifier defends against nothing."
   }),
-  state: import_zod17.z.string().optional().meta({
+  state: import_zod18.z.string().optional().meta({
     description: "Returned unchanged on the callback, and on the error redirect too, so a client can bind either answer to its own request."
   }),
-  resource: import_zod17.z.string().optional().meta({
+  resource: import_zod18.z.string().optional().meta({
     description: "RFC 8707 resource indicator: the API origin or the MCP endpoint the token is for. Checked against the resources this server issues tokens for **on behalf of this client's app**; a mismatch is `invalid_target` on the callback."
   })
   // **No `scope`, because this authorization server issues none.** The field
@@ -4755,7 +4768,7 @@ var oauthAuthorizeQuery = import_zod17.z.object({
   description: "The authorization request an MCP client sends, per RFC 6749 \xA74.1.1 with mandatory PKCE. The handler reads it parameter by parameter rather than through one parse, because the answers differ: `client_id` and `redirect_uri` are refused flat, with no redirect, since until both are confirmed there is no trusted target to bounce a browser to, and everything after them is reported to the client's own callback as query parameters."
 });
 
-// node_modules/.pnpm/@fleetless+contracts@1.0.5/node_modules/@fleetless/contracts/dist/routes.js
+// node_modules/.pnpm/@fleetless+contracts@1.1.0/node_modules/@fleetless/contracts/dist/routes.js
 var MCP_APP = MCP_APP_PATHS(":appIdentifier");
 var APP_IDENTIFIER = {
   name: "appIdentifier",
@@ -4960,6 +4973,24 @@ var ROUTES = [
     transport: "http",
     notes: 'HTML. An unknown, spent or expired token renders one "link no longer valid" page at `410` \u2014 they are one refusal on the wire already, and splitting them here would tell a stranger which tokens ever existed. No rate limiter: the GET changes nothing, and the POST it leads to is limited per IP.'
   },
+  {
+    method: "GET",
+    path: "/favicon.svg",
+    section: "client-auth",
+    summary: "Serves the Fleetless icon for the auth portal's and the MCP welcome page's browser tab.",
+    audience: "internal",
+    auth: "none",
+    rateLimited: false,
+    ownerTier: false,
+    status: 200,
+    params: [],
+    query: null,
+    request: null,
+    response: null,
+    errors: [],
+    transport: "http",
+    notes: "An SVG, not JSON. Those pages carry a Content-Security-Policy that admits no `data:` image, so the icon is a file on their own origin \u2014 the one source `img-src 'self'` names. Cached for a day: the bytes change when the brand does, not per deploy."
+  },
   {
     method: "POST",
     path: "/api/auth/password/reset/confirm",
@@ -5424,7 +5455,7 @@ var ROUTES = [
     params: [
       { name: "id", description: "The app's uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`." },
       { name: "userId", description: "The app user's uuid, from `GET /api/apps/:id/users`; a user of another app answers `404`." },
-      { name: "clientId", description: "The MCP client, as `GET /api/apps/:id/users/:userId/mcp-grants` reports its `client_id`. Not a uuid \u2014 it is the identifier the dynamic registration issued." }
+      { name: "clientId", description: "The MCP client, as `GET /api/apps/:id/users/:userId/mcp-grants` reports its `client_id`. Not a uuid \u2014 the identifier dynamic registration issued." }
     ],
     query: null,
     request: null,
@@ -6821,7 +6852,7 @@ var ROUTES = [
     rateLimited: false,
     ownerTier: false,
     status: 204,
-    params: [{ name: "clientId", description: "The MCP client, as `GET /api/client/mcp/grants` reports its `client_id`. Not a uuid \u2014 it is the identifier the dynamic registration issued." }],
+    params: [{ name: "clientId", description: "The MCP client, as `GET /api/client/mcp/grants` reports its `client_id`. Not a uuid \u2014 the identifier dynamic registration issued." }],
     query: null,
     request: null,
     response: null,
@@ -7012,6 +7043,43 @@ var ROUTES = [
     transport: "http",
     notes: "For a client caller the grant check runs **before** any existence lookup, with no extra query on either path to time: a denied slug and a nonexistent one must be one answer. That is why an ungranted slug is `403 forbidden` while a granted-but-unconfigured one is `404 unknown_datapoint` and a configured one with no sample yet is `404 no_data` \u2014 three facts a caller who is entitled to them needs told apart. The plane built-ins (`bridge_state`, `robot_details`) answer here too, without appearing in any document."
   },
+  /* ------------------------------------------ discovery: the REST twins of the two MCP tools a session starts from */
+  {
+    method: "GET",
+    path: "/api/client/robots",
+    section: "robots",
+    summary: "Lists the robots the caller reaches, with bridge state and the published configuration version.",
+    audience: "client",
+    auth: "developer_or_client",
+    rateLimited: false,
+    ownerTier: false,
+    status: 200,
+    params: [],
+    query: null,
+    request: null,
+    response: clientRobotListResponse,
+    errors: [...CLIENT_GUARD],
+    transport: "http",
+    notes: "**The REST twin of the MCP tool `robots_list`**, and the one robot question no robot-scoped route can answer: which robots may I name at all. An app user sees the robots their app attaches on which their role grants at least one slug or capability; a server key sees every robot its app attaches; a developer bearer sees the organisation's robots. Name order, id as the tiebreak. A robot on which the role grants nothing is absent rather than listed empty \u2014 the same answer `robots_list` gives, for the same reason: reach is a grant, not an attachment. Under `/api/client/` because it names no robot; every robot-scoped read stays under `/api/robots/:id/\u2026`."
+  },
+  {
+    method: "GET",
+    path: "/api/robots/:id/datasheet",
+    section: "robots",
+    summary: "Describes everything the caller's role lets them do on one robot, with parameter schemas.",
+    audience: "client",
+    auth: "developer_or_client",
+    rateLimited: false,
+    ownerTier: false,
+    status: 200,
+    params: [{ name: "id", description: "The robot's uuid, as `GET /api/client/robots` lists it." }],
+    query: null,
+    request: null,
+    response: mcpRobotDatasheet,
+    errors: [...CLIENT_GUARD, "invalid_uuid", "not_found"],
+    transport: "http",
+    notes: "**The REST twin of the MCP tool `robot_describe`**: one answer per robot \u2014 every datapoint, action, service, publisher and camera the role grants, each with its `input_schema` where it takes parameters, plus the two capabilities that gate whole features, `action_history` and `assets`. A robot with nothing published answers an empty `exposures` list, never a refusal. A robot the caller does not reach \u2014 not attached to their app, or attached with a role that grants nothing on it \u2014 answers `404` exactly as one that does not exist. The app-user datapoint and camera listings under this prefix stay; this is the one read that also names actions, services, publishers and capabilities, which is what an app needs before it can draw a screen."
+  },
   /* ------------------------------------------------- config (draft/publish) */
   {
     method: "GET",
@@ -7334,7 +7402,7 @@ var ROUTES = [
     status: 202,
     params: [
       { name: "id", description: "The robot's uuid; an end user reaches it through an app that attaches it." },
-      { name: "slug", description: "The action or service slug from the published configuration; the cloud already knows which kind it is." }
+      { name: "slug", description: "The action or service slug from the published configuration \u2014 the cloud already knows which kind." }
     ],
     query: null,
     request: invokeRequest,
@@ -8332,21 +8400,21 @@ function assertValidJobId(jobId) {
   if (jobId === void 0 || jobId === null || typeof jobId === "string") return;
   throw new FleetlessError(
     "invalid_option",
-    `cancel()'s third argument must be a job id (string), null, or omitted \u2014 got ${typeof jobId === "object" ? "an object" : typeof jobId}. If you are passing an options object (e.g. {timeoutMs}) as the third argument, note the signature changed in this release: cancel(robotId, slug) is unchanged, but a third positional argument is now the job id to cancel and options moved to a fourth argument \u2014 cancel(robotId, slug, jobId, options). See the README's Actions section.`
+    `cancel()'s third argument must be a job id (string), null, or omitted \u2014 got ${typeof jobId === "object" ? "an object" : typeof jobId}. If you are passing an options object (e.g. {timeoutMs}) as the third argument, note the signature changed in this release: cancel(robotId, slug) is unchanged, but a third positional argument is now the job id to cancel and options moved to a fourth argument \u2014 cancel(robotId, slug, jobId, options). See the Actions section of the SDK reference at https://docs.fleetless.dev/reference/sdk/`
   );
 }
 function createRealtimeCommandTransport(channel) {
   return {
-    // Declared `async` deliberately, unlike `cancel`/`publish` below: it is
+    // Declared `async` deliberately, unlike `cancel`/`publish` below: it's
     // the only one of the three that can refuse *before* sending anything
-    // (`resolveLocalWaitMs`'s `invalid_option`), and every caller of
-    // this interface — starting with this file's own `sendCommand` callers
-    // — is entitled to assume `CommandTransport.invoke` always returns a
-    // promise rather than throwing synchronously. Without `async` here, a
-    // synchronous throw from `resolveLocalWaitMs` would escape as a thrown
-    // exception instead of a rejection, breaking that assumption for any
-    // caller that isn't itself inside an `async` function (e.g. a test
-    // calling this transport directly).
+    // (`resolveLocalWaitMs`'s `invalid_option`), and every caller of this
+    // interface — starting with this file's own `sendCommand` callers —
+    // assumes `CommandTransport.invoke` always returns a promise, never
+    // throws synchronously. Without `async` here, a synchronous throw from
+    // `resolveLocalWaitMs` would escape as a thrown exception instead of a
+    // rejection, breaking that assumption for a caller that isn't itself
+    // inside an `async` function (e.g. a test calling this transport
+    // directly).
     async invoke(robotId, slug2, params, options) {
       const timeoutMs = resolveLocalWaitMs(options ?? {}, DEFAULT_COMMAND_TIMEOUT_MS);
       const frame = {
@@ -8501,11 +8569,30 @@ function createJobSubscriptions(channel, slugSubscriptions) {
 }
 
 // src/jobs.ts
+function historyQueryString2(options) {
+  const params = new URLSearchParams();
+  if (options.slug !== void 0) params.set("slug", options.slug);
+  if (options.state !== void 0) params.set("state", options.state);
+  if (options.kind !== void 0) params.set("kind", options.kind);
+  if (options.limit !== void 0) params.set("limit", String(options.limit));
+  if (options.beforeSeq !== void 0) params.set("before_seq", String(options.beforeSeq));
+  if (options.fromMs !== void 0) params.set("from_ms", String(options.fromMs));
+  if (options.toMs !== void 0) params.set("to_ms", String(options.toMs));
+  return params.toString();
+}
 function createJobsApi(http) {
   return {
     async list(robotId) {
       const response = await http.request(`/api/robots/${pathSegment(robotId)}/jobs`, {});
       return response.jobs;
+    },
+    async history(robotId, options = {}) {
+      const query = historyQueryString2(options);
+      const page = await http.request(
+        `/api/robots/${pathSegment(robotId)}/jobs/history${query ? `?${query}` : ""}`,
+        {}
+      );
+      return page;
     }
   };
 }
@@ -8546,12 +8633,11 @@ var RealtimeChannel = class {
   }
   /**
    * Increments on every successful authentication (first connect and every
-   * reconnect). A command sent on one physical socket can only ever be
-   * answered on that socket — comparing the epoch captured at send time
-   * against the current one is how a caller (see `commands.ts`) tells "still
-   * waiting on the connection it was sent over" from "that connection is
-   * gone and a new one has taken its place", the moment it happens rather
-   * than after a timeout elapses.
+   * reconnect). A command sent on one socket can only be answered on that
+   * socket — comparing the epoch at send time against the current one is
+   * how a caller (see `commands.ts`) tells "still waiting on the connection
+   * it was sent over" from "that connection is gone and a new one has taken
+   * its place", the moment it happens rather than after a timeout elapses.
    */
   get connectionEpoch() {
     return this.#connectionEpoch;
@@ -8733,6 +8819,20 @@ var RealtimeChannel = class {
   }
 };
 
+// src/robots.ts
+function createRobotsApi(http) {
+  return {
+    async list() {
+      const response = await http.request("/api/client/robots", {});
+      return response.robots;
+    },
+    async describe(robotId) {
+      const sheet = await http.request(`/api/robots/${pathSegment(robotId)}/datasheet`, {});
+      return sheet;
+    }
+  };
+}
+
 // src/services.ts
 var DEFAULT_RESULT_TIMEOUT_MS = 3e4;
 function isTerminal(state) {
@@ -8852,7 +8952,7 @@ function createSlugSubscriptions(channel) {
 // src/token-store.ts
 var InMemoryTokenStore = class {
   #session = null;
-  /** Creates an empty store. Nothing is loaded from anywhere — a client built with it starts logged out. */
+  /** Nothing is loaded from anywhere — a client built with it starts logged out. */
   constructor() {
   }
   /** Returns the session held in memory, or `null` if there is none. */
@@ -8907,6 +9007,7 @@ function createClient(options) {
   const cameras = createCamerasApi(http);
   const jobs = createJobsApi(http);
   const assets = createAssetsApi(http);
+  const robots = createRobotsApi(http);
   if (options.serverKey === void 0) {
     const baseLogout = auth.logout.bind(auth);
     auth = {
@@ -8927,6 +9028,7 @@ function createClient(options) {
     cameras,
     jobs,
     assets,
+    robots,
     close() {
       channel.close();
     }