@fleetless/sdk 4.0.0 → 4.1.0

package/CHANGELOG.md

@@ -1,6 +1,22 @@
 # Changelog
 
-All notable changes to `@fleetless/sdk`. The format follows Keep a Changelog; the versions follow semver.
+All notable changes to `@fleetless/sdk`. The format follows Keep a Changelog; the versions follow semver. A pull request that changes what a consumer sees adds its entry under `## [Unreleased]`; the release renames that heading to the version.
+
+## [Unreleased]
+
+## [4.1.0] — 2026-09-30
+
+Built against `@fleetless/contracts` 5.0.0. Two changes to `Job` a consumer's code sees, so the next release is a major.
+
+### Added
+
+- **`JobOrigin`** is re-exported: the type of `Job.origin`.
+
+### Changed
+
+- **`Job.origin` is required**: `fleetless` for a job the cloud minted from an invocation, `external` for a goal the bridge found running on a published action without having sent it — started by anything else on the robot's ROS graph, or its own goal after the bridge lost the mapping. An external job has no parameters and no starter, and never appears in `jobs.history`. A hand-built `Job` (a test fixture, a mock) now needs the field.
+- **`actions.cancel` is answered by the robot's action server.** It resolves once the server accepted the cancel, with the job usually still `running` — the end arrives as the job's own update. It rejects `cancel_rejected` when the server refused (`ERROR_REJECTED`), with `error.details.goals` listing each goal the cancel reached as `{ job_id, goal_id, return_code }` (`0`–`3`, or `null` when that goal's server did not answer); `bridge_timeout` when the bridge did not answer in time; and with the bridge's own code (e.g. `action_server_lost`) when it could not ask at all. Code that treated a resolved cancel as a stopped goal, or every rejection as "nothing was cancelled", needs to read these apart. Cancelling an `unknown` job cancels every `external` goal on its action.
+- **`JobState` gains `unknown`**: the cloud cannot currently say whether the job is still running — the robot went offline, or its bridge did not report in time. Not terminal: only the robot's bridge moves the job on, to `running` or to how it ended. `lost` is now final. An exhaustive `switch` over `JobState` needs the new case; `services.call` keeps waiting through `unknown`, and `jobs.history` takes `state: 'unknown'`.
 
 ## [4.0.0] — 2026-09-22
 

package/CONTRIBUTING.md

@@ -93,8 +93,9 @@ tell you what else has to move with it.
 
 **CI runs on GitHub Actions**, in this repository
 (`.github/workflows/verify.yml`) — the suite, on every push and every pull
-request. `release.yml` publishes on a release tag and calls that same file
-first, so a release is never checked by a different pipeline than a push.
+request. `release.yml` (the **Release** button) calls that same file on the
+commit it publishes, so a release is never checked by a different pipeline
+than a push.
 
 **Your pull request is verified, a fork's included** — the same suite, the
 same file. GitHub holds a first-time contributor's first run until a

package/dist/index.cjs

@@ -440,7 +440,7 @@ function createAssetsApi(http) {
   };
 }
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/common.js
+// node_modules/.pnpm/@fleetless+contracts@5.0.0/node_modules/@fleetless/contracts/dist/common.js
 var import_zod = require("zod");
 var SLUG_RULE = "A name is lower-case: it starts with a letter, continues with letters and digits, and joins further words with a single underscore \u2014 `battery_voltage`. Capitals, dashes, dots, spaces, a leading digit and a doubled or trailing underscore are all refused.";
 var slug = import_zod.z.string().min(2).max(63).regex(/^[a-z][a-z0-9]*(?:_[a-z0-9]+)*$/, SLUG_RULE);
@@ -471,7 +471,7 @@ var applyError = import_zod.z.object({
   details: import_zod.z.record(import_zod.z.string(), import_zod.z.unknown()).optional()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/mcp.js
+// node_modules/.pnpm/@fleetless+contracts@5.0.0/node_modules/@fleetless/contracts/dist/mcp.js
 var import_zod2 = require("zod");
 function mcpAppEndpointPath(appIdentifier2) {
   return `/mcp/${appIdentifier2}`;
@@ -520,10 +520,10 @@ var mcpRolePreviewResponse = import_zod2.z.object({
 });
 var MCP_ASSET_LINK_TTL_MS = 15 * 60 * 1e3;
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/protocol.js
+// node_modules/.pnpm/@fleetless+contracts@5.0.0/node_modules/@fleetless/contracts/dist/protocol.js
 var import_zod8 = require("zod");
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/assets.js
+// node_modules/.pnpm/@fleetless+contracts@5.0.0/node_modules/@fleetless/contracts/dist/assets.js
 var import_zod3 = require("zod");
 var assetKind = import_zod3.z.enum(["urdf", "mesh", "texture"]);
 var asset = import_zod3.z.object({
@@ -843,10 +843,10 @@ var assetSyncBusyDetails = import_zod3.z.object({
   started_at_ms: import_zod3.z.number().int().nonnegative()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/config.js
+// node_modules/.pnpm/@fleetless+contracts@5.0.0/node_modules/@fleetless/contracts/dist/config.js
 var import_zod5 = require("zod");
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/alerts.js
+// node_modules/.pnpm/@fleetless+contracts@5.0.0/node_modules/@fleetless/contracts/dist/alerts.js
 var import_zod4 = require("zod");
 var alertRowCondition = import_zod4.z.discriminatedUnion("kind", [
   import_zod4.z.strictObject({
@@ -916,7 +916,7 @@ var putDatapointDisplayRequest = import_zod4.z.object({
   y_max: import_zod4.z.number().finite().nullable()
 }).strict();
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/config.js
+// node_modules/.pnpm/@fleetless+contracts@5.0.0/node_modules/@fleetless/contracts/dist/config.js
 var RTSP_URL_RULE = "The URL has to begin with `rtsp://` or `rtsps://` \u2014 `rtsp://cam-1.plant.local/stream1`. No other scheme is accepted: the bridge opens this with a library that would equally honour `file:`.";
 var MJPEG_URL_RULE = "The URL has to begin with `http://` or `https://` \u2014 `http://cam-1.plant.local/video.mjpg`. No other scheme is accepted: the bridge opens this with a library that would equally serve `file:`.";
 var DEVICE_PATH_RULE = "A capture device is a path under `/dev/`, and the character straight after it is a letter or a digit \u2014 `/dev/video0`, or a stable `/dev/v4l/by-id/...` symlink. Nothing outside `/dev/` is accepted: the string reaches OpenCV, which would as happily open an ordinary file.";
@@ -2008,7 +2008,7 @@ var configState = import_zod5.z.object({
   applied_errors: import_zod5.z.array(applyError).nullable()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/introspection.js
+// node_modules/.pnpm/@fleetless+contracts@5.0.0/node_modules/@fleetless/contracts/dist/introspection.js
 var import_zod6 = require("zod");
 var rosGraphEntry = import_zod6.z.object({
   name: rosName,
@@ -2047,9 +2047,11 @@ var typeDefinition = import_zod6.z.discriminatedUnion("kind", [
   })
 ]);
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/jobs.js
+// node_modules/.pnpm/@fleetless+contracts@5.0.0/node_modules/@fleetless/contracts/dist/jobs.js
 var import_zod7 = require("zod");
-var jobState = import_zod7.z.enum(["running", "succeeded", "failed", "cancelled", "lost"]);
+var jobState = import_zod7.z.enum(["running", "unknown", "succeeded", "failed", "cancelled", "lost"]);
+var reportedJobState = jobState.exclude(["unknown"]);
+var jobOrigin = import_zod7.z.enum(["fleetless", "external"]);
 var job = import_zod7.z.object({
   id: import_zod7.z.uuid().meta({
     description: "The job's id, minted by the cloud when the invocation is accepted. Informative \u2014 state is observed by slug; a cancel names this id to stop one specific job rather than whatever is running."
@@ -2059,7 +2061,10 @@ var job = import_zod7.z.object({
     description: "The action or service this job is running, as the published configuration exposes it. One slug carries one job at a time, so every observer of that slug sees the same one."
   }),
   state: jobState.meta({
-    description: "Where the job stands: `running`, `succeeded`, `failed`, `cancelled` or `lost`. `lost` is a real outcome \u2014 the bridge restarted mid-job and the result is gone \u2014 stated rather than left reading `running` by default."
+    description: "Where the job stands: `running`, `unknown`, `succeeded`, `failed`, `cancelled` or `lost`. `unknown` is not an outcome \u2014 the robot went offline or silent and the cloud does not know yet; the slug stays occupied and the bridge's next statement resolves it, `error` naming why the cloud lost sight of it. `lost` is final: the bridge stated it does not know the job and nothing else runs on its action, or the action server vanished mid-goal."
+  }),
+  origin: jobOrigin.meta({
+    description: "Who started this job. `fleetless` for everything minted by the cloud; `external` for a goal the bridge found active on a published action without having sent it \u2014 no parameters, no starter, never written to `job_runs`."
   }),
   started_at: import_zod7.z.iso.datetime().meta({
     description: "When the cloud minted this job, as an ISO 8601 timestamp. For a job adopted from a reconnecting bridge, this is **adoption time**, not the real start \u2014 the cloud never minted it."
@@ -2078,7 +2083,7 @@ var job = import_zod7.z.object({
    * exists for the same reason on the audit log.
    *
    * **Scoped honestly: per cloud process, per run.** Job state lives in memory
-   * — that is why `lost` exists at all — so this counter restarts when
+   * — that is why `unknown` and `lost` exist at all — so this counter restarts when
    * the cloud does, alongside the jobs it orders. Sound, because it only ever
    * orders jobs that coexist in one registry — and stated, because a reader
    * who assumed `auditEvent.seq`'s durable semantics would be wrong.
@@ -2113,7 +2118,7 @@ var job = import_zod7.z.object({
       description: "The structured payload belonging to `code`, for the codes that document one \u2014 `job_queue_full` carries its `limit` and its `queued` count here. Absent for a failure with nothing structured to add, which is most of them."
     })
   }).nullable().meta({
-    description: "Why the job failed: a human `message`, a `code` where one exists, and `details` for the codes that carry a documented payload. `null` unless `state` is `failed`."
+    description: "Why the job failed, or why the cloud does not know how it stands: a human `message`, a `code` where one exists, and `details` for the codes that carry a documented payload. Set on `failed` and `lost`, and on `unknown` \u2014 where `code` is `bridge_disconnected` or `bridge_timeout`, the cloud's own reason for not knowing, cleared when the bridge reports the job running again."
   })
 });
 var jobEvent = import_zod7.z.object({
@@ -2172,16 +2177,16 @@ var jobRun = import_zod7.z.object({
     description: "Whether the slug was an `action` or a `service`."
   }),
   state: jobState.meta({
-    description: "How the run ended, or `running` while it is still going. `lost` means the bridge restarted mid-run and the outcome is unknowable rather than unknown."
+    description: "How the run ended, or `running` while it is still going. `unknown` while the robot has not accounted for it \u2014 offline or silent \u2014 and updated once the bridge says how it stands. `lost` is final: the bridge did not know the run and nothing else ran on its action, so the outcome is unknowable rather than unknown."
   }),
   started_at: import_zod7.z.iso.datetime().meta({
     description: "When the run started, as an ISO 8601 timestamp. Runs are listed and filtered by this instant."
   }),
   ended_at: import_zod7.z.iso.datetime().nullable().meta({
-    description: "When the run finished, as an ISO 8601 timestamp. `null` while it is still `running` \u2014 a run has an end only once it has one."
+    description: "When the run finished, as an ISO 8601 timestamp. `null` while it is still `running` or `unknown` \u2014 a run has an end only once it has one."
   }),
   duration_ms: import_zod7.z.number().int().nonnegative().nullable().meta({
-    description: 'How long the run took, in milliseconds. `null` while it is still `running`, never `0` standing in for "nothing so far".'
+    description: 'How long the run took, in milliseconds. `null` while it is still `running` or `unknown`, never `0` standing in for "nothing so far".'
   }),
   result: import_zod7.z.unknown().nullable().meta({
     description: "What the action or service returned once it succeeded, shaped by ROS itself. `null` otherwise."
@@ -2231,7 +2236,7 @@ var jobRunQuery = import_zod7.z.object({
     description: "Only runs of this action or service."
   }),
   state: jobState.optional().meta({
-    description: "Only runs in this state \u2014 `running`, `succeeded`, `failed`, `cancelled` or `lost`."
+    description: "Only runs in this state \u2014 `running`, `unknown`, `succeeded`, `failed`, `cancelled` or `lost`."
   }),
   kind: jobRunKind.optional().meta({
     description: "Only `action` runs, or only `service` runs."
@@ -2265,14 +2270,14 @@ var jobRunSummary = import_zod7.z.object({
   since_ms: import_zod7.z.number().int().nonnegative()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/protocol.js
+// node_modules/.pnpm/@fleetless+contracts@5.0.0/node_modules/@fleetless/contracts/dist/protocol.js
 var DAY_MS = 24 * 60 * 60 * 1e3;
 var MAX_PATIENCE_MS = 12e4;
 var MIN_PATIENCE_MS = 1e3;
 var activeJob = import_zod8.z.object({
   job_id: import_zod8.z.uuid(),
   slug,
-  state: jobState
+  state: reportedJobState
 });
 var bridgeHello = import_zod8.z.object({
   type: import_zod8.z.literal("hello"),
@@ -2283,16 +2288,14 @@ var bridgeHello = import_zod8.z.object({
    * Every job this bridge still knows about, right now.
    *
    * A reconnect and a restart look **identical** on the wire — same token,
-   * same version, same frame — but must end differently: after a dropped
-   * connection the running jobs are still running, after a restart their
-   * results are gone forever. Enumerating what the bridge still has settles
-   * it without either side guessing: the cloud marks every job it believed
-   * running that is *not* named here as `lost`.
-   *
-   * Deliberately needs no persistence at the bridge: a live process lists its
-   * live jobs, a process that just started lists none — exactly the truth
-   * the cloud needs. A breadcrumb file would only add a window in which the
-   * crash beat the write.
+   * same version, same frame — so the bridge enumerates what it still has:
+   * its live jobs, and after a restart every job whose goal it recognised
+   * again from its persisted job-to-goal mapping. A job the cloud holds
+   * `running` or `unknown` that is *not* named here is "not known to the
+   * bridge"; it becomes `lost` (`job_unknown_to_bridge`) only once the
+   * bridge's goal reports show its action free of goals it cannot
+   * attribute — one of those may be that very job — and at once for a
+   * service job, which has no goals to look at.
    *
    * Defaulted, so a bridge that sends no such field still parses; no jobs
    * and no report both mean the same thing to the cloud: nothing to keep
@@ -2398,9 +2401,27 @@ var cloudInvoke = import_zod8.z.object({
 });
 var cloudCancel = import_zod8.z.object({
   type: import_zod8.z.literal("cancel"),
+  request_id: import_zod8.z.string().min(1).max(64),
   slug,
   job_id: import_zod8.z.uuid().nullable()
 });
+var cancelReturnCode = import_zod8.z.number().int().min(0).max(3);
+var bridgeCancelResultEntry = import_zod8.z.object({
+  /** The job the goal belongs to — the bridge's own, or an external goal's derived id. */
+  job_id: import_zod8.z.uuid(),
+  /** The ROS 2 goal id the cancel was sent for. */
+  goal_id: import_zod8.z.string().min(1),
+  /** `null` when the action server did not answer the cancel request within the bridge's own bound. */
+  return_code: cancelReturnCode.nullable()
+});
+var bridgeCancelResult = import_zod8.z.object({
+  type: import_zod8.z.literal("cancel_result"),
+  request_id: import_zod8.z.string().min(1).max(64),
+  slug,
+  goals: import_zod8.z.array(bridgeCancelResultEntry),
+  /** Set when the bridge could not send the cancel at all (no such slug, a service, the server gone). */
+  error: import_zod8.z.object({ code: import_zod8.z.string().min(1), message: import_zod8.z.string().min(1) }).nullable()
+});
 var cloudPublish = import_zod8.z.object({
   type: import_zod8.z.literal("publish"),
   slug,
@@ -2420,7 +2441,11 @@ var bridgeJobUpdate = import_zod8.z.object({
   type: import_zod8.z.literal("job_update"),
   job_id: import_zod8.z.uuid(),
   slug,
-  state: jobState,
+  /** Never `unknown`: that is the cloud's word for not having heard. */
+  state: reportedJobState,
+  origin: jobOrigin,
+  /** The ROS 2 goal id; `null` for a service job, which has no goal. */
+  goal_id: import_zod8.z.string().min(1).nullable(),
   feedback: import_zod8.z.unknown().nullable(),
   progress: import_zod8.z.number().min(0).max(1).nullable(),
   result: import_zod8.z.unknown().nullable(),
@@ -2430,7 +2455,29 @@ var bridgeJobUpdate = import_zod8.z.object({
 });
 var bridgeJobLost = import_zod8.z.object({
   type: import_zod8.z.literal("job_lost"),
-  job_ids: import_zod8.z.array(import_zod8.z.uuid())
+  job_ids: import_zod8.z.array(import_zod8.z.uuid()),
+  error: import_zod8.z.object({ code: import_zod8.z.string().min(1), message: import_zod8.z.string().min(1) }).optional()
+});
+var cloudJobQuery = import_zod8.z.object({
+  type: import_zod8.z.literal("job_query"),
+  request_id: import_zod8.z.string().min(1).max(64),
+  job_ids: import_zod8.z.array(import_zod8.z.uuid()).min(1)
+});
+var bridgeJobStatusEntry = import_zod8.z.object({
+  job_id: import_zod8.z.uuid(),
+  /** Never `unknown` — the bridge only ever states a definite fact about a job it recognises. */
+  state: reportedJobState,
+  feedback: import_zod8.z.unknown().nullable(),
+  progress: import_zod8.z.number().min(0).max(1).nullable(),
+  result: import_zod8.z.unknown().nullable(),
+  /** Same shape as `job.error`, `details` included — see `jobs.ts`. */
+  error: import_zod8.z.object({ code: import_zod8.z.string().min(1), message: import_zod8.z.string().min(1), details: import_zod8.z.unknown().optional() }).nullable()
+});
+var bridgeJobStatus = import_zod8.z.object({
+  type: import_zod8.z.literal("job_status"),
+  request_id: import_zod8.z.string().min(1).max(64),
+  jobs: import_zod8.z.array(bridgeJobStatusEntry),
+  unknown_job_ids: import_zod8.z.array(import_zod8.z.uuid())
 });
 var cloudIntrospectRequest = import_zod8.z.object({
   type: import_zod8.z.literal("introspect_request"),
@@ -2619,11 +2666,11 @@ var bridgeCameraState = import_zod8.z.object({
   request_id: import_zod8.z.string().min(1).max(64).nullable()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/config-issues.js
+// node_modules/.pnpm/@fleetless+contracts@5.0.0/node_modules/@fleetless/contracts/dist/config-issues.js
 var EXPOSURE_SECTIONS = ["datapoints", "actions", "services", "publishers", "cameras"];
 var EXPOSURE_SECTION_NAMES = new Set(EXPOSURE_SECTIONS);
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/rest.js
+// node_modules/.pnpm/@fleetless+contracts@5.0.0/node_modules/@fleetless/contracts/dist/rest.js
 var import_zod9 = require("zod");
 var robot = import_zod9.z.object({
   id: import_zod9.z.uuid().meta({
@@ -3388,13 +3435,13 @@ var slugUsageResponse = import_zod9.z.object({
   alert_count: import_zod9.z.number().int().nonnegative()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/realtime.js
+// node_modules/.pnpm/@fleetless+contracts@5.0.0/node_modules/@fleetless/contracts/dist/realtime.js
 var import_zod14 = require("zod");
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/client-auth.js
+// node_modules/.pnpm/@fleetless+contracts@5.0.0/node_modules/@fleetless/contracts/dist/client-auth.js
 var import_zod13 = require("zod");
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/apps.js
+// node_modules/.pnpm/@fleetless+contracts@5.0.0/node_modules/@fleetless/contracts/dist/apps.js
 var import_zod10 = require("zod");
 var appIdentifier = slug;
 var app = import_zod10.z.object({
@@ -3454,6 +3501,26 @@ var appListResponse = import_zod10.z.object({
     description: "Every app of the caller's organisation, oldest first by `created_at`. The org scope is the whole filter \u2014 there is no id to narrow by and nothing to refuse."
   })
 });
+var appDeletionSummary = import_zod10.z.object({
+  user_count: import_zod10.z.number().int().nonnegative().meta({
+    description: "App users deleted with the app. They are the developer's own customers, not Fleetless users, and exist in no other app."
+  }),
+  role_count: import_zod10.z.number().int().nonnegative().meta({
+    description: "Roles deleted with the app, each with its per-robot slug grants."
+  }),
+  server_key_count: import_zod10.z.number().int().nonnegative().meta({
+    description: "Server keys deleted with the app. A client still holding one is refused at its next request."
+  }),
+  invitation_count: import_zod10.z.number().int().nonnegative().meta({
+    description: "Outstanding invitations \u2014 unspent and unexpired \u2014 that will never be accepted."
+  }),
+  oidc_provider_count: import_zod10.z.number().int().nonnegative().meta({
+    description: "Identity providers configured for this app. The providers themselves are somebody else's; only this app's configuration of them goes."
+  }),
+  mail_template_count: import_zod10.z.number().int().nonnegative().meta({
+    description: "Custom mail templates, of at most three. A kind using the Fleetless default text is not counted \u2014 there is no row to lose."
+  })
+});
 var createAppRequest = import_zod10.z.object({
   name: import_zod10.z.string().min(1).max(120),
   identifier: appIdentifier,
@@ -3576,10 +3643,10 @@ var rolePermissions = import_zod10.z.object({
   })
 });
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/app-users.js
+// node_modules/.pnpm/@fleetless+contracts@5.0.0/node_modules/@fleetless/contracts/dist/app-users.js
 var import_zod12 = require("zod");
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/identity.js
+// node_modules/.pnpm/@fleetless+contracts@5.0.0/node_modules/@fleetless/contracts/dist/identity.js
 var import_zod11 = require("zod");
 var password = import_zod11.z.string().min(12).max(256);
 var USER_DISPLAY_NAME_MAX = 120;
@@ -3741,7 +3808,7 @@ var authMeResponse = import_zod11.z.object({ org, user: fleetlessUser });
 var patchOrgRequest = import_zod11.z.object({ name: import_zod11.z.string().min(1).max(120) }).strict();
 var patchAuthMeRequest = import_zod11.z.object({ display_name: import_zod11.z.string().min(1).max(USER_DISPLAY_NAME_MAX).nullable() }).strict();
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/app-users.js
+// node_modules/.pnpm/@fleetless+contracts@5.0.0/node_modules/@fleetless/contracts/dist/app-users.js
 var APP_USER_DISPLAY_NAME_MAX = 120;
 var providerSlug = import_zod12.z.string().max(40).regex(/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/, "must be lowercase and hyphen-separated, starting with a letter");
 var appUserStatus = import_zod12.z.enum(["pending_verification", "active", "blocked"]);
@@ -3960,7 +4027,9 @@ var appAuthConfig = import_zod12.z.object({
   }),
   updated_at: import_zod12.z.iso.datetime().meta({ description: "When the configuration was last written, as an ISO 8601 timestamp." })
 });
-var putAppAuthConfigRequest = appAuthConfig.omit({ oidc_callback_url: true, updated_at: true }).strict();
+var putAppAuthRegistrationRequest = appAuthConfig.pick({ self_registration: true, allowed_domains: true, allowed_origins: true }).strict();
+var putAppAuthUrlsRequest = appAuthConfig.pick({ invite_url: true, verify_url: true, reset_url: true }).strict();
+var putAppAuthMcpRequest = appAuthConfig.pick({ mcp_enabled: true, mcp_login_url: true }).strict();
 var mailTemplateKind = import_zod12.z.enum(["invite", "verify", "reset"]);
 var appMailTemplate = import_zod12.z.object({
   kind: mailTemplateKind.meta({ description: "Which of the three mails this template replaces." }),
@@ -3992,7 +4061,7 @@ var mailOutcome = import_zod12.z.object({
   })
 });
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/client-auth.js
+// node_modules/.pnpm/@fleetless+contracts@5.0.0/node_modules/@fleetless/contracts/dist/client-auth.js
 var clientLoginRequest = import_zod13.z.object({
   app_identifier: appIdentifier.meta({
     description: "The app being logged in to: its globally unique, lowercase, underscore-separated identifier, chosen by the developer at creation. There is no organisation context at login, so this is what decides which app the credentials are checked for."
@@ -4181,7 +4250,7 @@ var clientIdentity = import_zod13.z.object({
   })
 });
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/realtime.js
+// node_modules/.pnpm/@fleetless+contracts@5.0.0/node_modules/@fleetless/contracts/dist/realtime.js
 var clientAuth = import_zod14.z.object({
   type: import_zod14.z.literal("auth"),
   token: import_zod14.z.string().min(1)
@@ -4459,7 +4528,7 @@ var orgEventDropped = import_zod14.z.object({
   dropped: import_zod14.z.number().int().positive()
 }).strict();
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/client-robots.js
+// node_modules/.pnpm/@fleetless+contracts@5.0.0/node_modules/@fleetless/contracts/dist/client-robots.js
 var import_zod15 = require("zod");
 var clientRobotListItem = import_zod15.z.object({
   ...robot.shape,
@@ -4476,7 +4545,7 @@ var clientRobotListResponse = import_zod15.z.object({
   })
 });
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/audit.js
+// node_modules/.pnpm/@fleetless+contracts@5.0.0/node_modules/@fleetless/contracts/dist/audit.js
 var import_zod16 = require("zod");
 var auditActor = import_zod16.z.object({
   kind: import_zod16.z.enum(["developer", "end_user", "app_user", "server_key", "bridge"]),
@@ -4606,7 +4675,7 @@ var auditListResponse = import_zod16.z.object({
   next_cursor: import_zod16.z.number().int().positive().nullable()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/errors.js
+// node_modules/.pnpm/@fleetless+contracts@5.0.0/node_modules/@fleetless/contracts/dist/errors.js
 var import_zod17 = require("zod");
 var apiError = import_zod17.z.object({
   code: import_zod17.z.string().min(1),
@@ -4623,7 +4692,7 @@ var parameterInvalidDetails = import_zod17.z.object({
   violations: import_zod17.z.array(parameterViolation).min(1)
 });
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/oauth.js
+// node_modules/.pnpm/@fleetless+contracts@5.0.0/node_modules/@fleetless/contracts/dist/oauth.js
 var import_zod18 = require("zod");
 var oauthErrorCode = import_zod18.z.enum([
   "invalid_request",
@@ -4863,7 +4932,7 @@ var oauthAuthorizeQuery = import_zod18.z.object({
   description: "The authorization request an MCP client sends, per RFC 6749 \xA74.1.1 with mandatory PKCE. The handler reads it parameter by parameter rather than through one parse, because the answers differ: `client_id` and `redirect_uri` are refused flat, with no redirect, since until both are confirmed there is no trusted target to bounce a browser to, and everything after them is reported to the client's own callback as query parameters."
 });
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/routes.js
+// node_modules/.pnpm/@fleetless+contracts@5.0.0/node_modules/@fleetless/contracts/dist/routes.js
 var MCP_APP = MCP_APP_PATHS(":appIdentifier");
 var APP_IDENTIFIER = {
   name: "appIdentifier",
@@ -5233,6 +5302,42 @@ var ROUTES = [
     transport: "http",
     notes: "A `default_role_id` naming a role of another app is refused: it is the one cross-app authorization check this shape can carry. Changing the robot set closes every live subscription the app's users hold, since a grant may no longer name a reachable robot."
   },
+  {
+    method: "GET",
+    path: "/api/apps/:id/deletion-preview",
+    section: "apps",
+    summary: "Reports what deleting the app would destroy, without destroying it.",
+    audience: "developer",
+    auth: "developer",
+    rateLimited: false,
+    ownerTier: false,
+    status: 200,
+    params: [{ name: "id", description: "The app's uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`." }],
+    query: null,
+    request: null,
+    response: appDeletionSummary,
+    errors: [...DEVELOPER_GUARD, "invalid_uuid", "not_found"],
+    transport: "http",
+    notes: "The same shape the delete's own audit event carries, computed by the same function on purpose: the confirmation dialog and the eventual receipt agree by construction, and any difference between them is real drift rather than two estimates that quietly disagree. \n\n**No `force` parameter, unlike the robot pair this is modelled on.** A robot's open live session is a single nameable state whose interruption is its own hazard, which is why that route makes the caller pass `force` explicitly. An app has no equivalent state to force past, and inventing one would be a guess wearing a guard's clothes \u2014 this preview is the guard."
+  },
+  {
+    method: "DELETE",
+    path: "/api/apps/:id",
+    section: "apps",
+    summary: "Deletes an app and everything it produced.",
+    audience: "developer",
+    auth: "developer",
+    rateLimited: false,
+    ownerTier: true,
+    status: 204,
+    params: [{ name: "id", description: "The app's uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`." }],
+    query: null,
+    request: null,
+    response: null,
+    errors: [...DEVELOPER_GUARD, "tier_required", "invalid_uuid", "not_found"],
+    transport: "http",
+    notes: "Owner tier, and the gate runs **after** the org-scoped lookup: a developer-tier admin therefore sees the same `404` a stranger would for an app outside their org, rather than a tier refusal that confirms the id exists. A full cascade \u2014 its users, roles, server keys, invitations, OIDC provider configuration and mail templates all go, recorded once as `app.deleted` carrying an `appDeletionSummary`. Its robots are untouched: they belong to the org, not to the app. \n\n**No `force` parameter** \u2014 see `GET /api/apps/:id/deletion-preview`."
+  },
   {
     method: "POST",
     path: "/api/apps/:id/roles",
@@ -5739,13 +5844,31 @@ var ROUTES = [
     response: appAuthConfig,
     errors: [...DEVELOPER_GUARD, "invalid_uuid", "not_found"],
     transport: "http",
-    notes: "One row per app, created with the app and never absent \u2014 an app that has configured nothing reads back the defaults rather than a `404`. `oidc_callback_url` is in the answer and not in the request: it is minted by the cloud from its own public base URL, is the same for every app and every provider, and is the value a developer registers at their identity provider."
+    notes: "One row per app, created with the app and never absent \u2014 an app that has configured nothing reads back the defaults rather than a `404`. `oidc_callback_url` is in the answer and not in the request: it is minted by the cloud from its own public base URL, is the same for every app and every provider, and is the value a developer registers at their identity provider. It stays read-only on every slice write below for a second reason: a writable callback URL would let a caller point the return leg of an OIDC sign-in, which carries an authorization code, at a host they own. `updated_at` is read-only for a duller one: the server stamps it on every write, and a client-supplied value would be a lie about when the row last changed."
   },
   {
     method: "PUT",
-    path: "/api/apps/:id/auth-config",
+    path: "/api/apps/:id/auth-config/registration",
+    section: "apps",
+    summary: "Replaces who may self-register, and from where.",
+    audience: "developer",
+    auth: "developer",
+    rateLimited: false,
+    ownerTier: false,
+    status: 200,
+    params: [{ name: "id", description: "The app's uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`." }],
+    query: null,
+    request: putAppAuthRegistrationRequest,
+    response: appAuthConfig,
+    errors: [...DEVELOPER_GUARD, "invalid_uuid", "validation_error", "not_found"],
+    transport: "http",
+    notes: "**A replace, not a merge, and `.strict()`**: `self_registration`, `allowed_domains` and `allowed_origins` all arrive or the write is refused, so a client built against an older shape cannot silently clear a setting it does not know about. `oidc_callback_url` and `updated_at` are the server's, refused in this body as in every slice's \u2014 see `GET`'s notes for why. \n\n`400 validation_error` is where the two field rules land: an entry in `allowed_domains` must be lowercase, since a capitalised one can never match a lowercased address, and an entry in `allowed_origins` must be a bare scheme-host-port with no path, since a browser sends nothing longer in its `Origin` header. Each refuses at configuration time rather than failing silently later. \n\nThe merge is server-side against the stored row, so this write never disturbs the urls or mcp slice."
+  },
+  {
+    method: "PUT",
+    path: "/api/apps/:id/auth-config/urls",
     section: "apps",
-    summary: "Replaces the app's auth settings in one write.",
+    summary: "Replaces the three pages Fleetless's mails point at.",
     audience: "developer",
     auth: "developer",
     rateLimited: false,
@@ -5753,11 +5876,29 @@ var ROUTES = [
     status: 200,
     params: [{ name: "id", description: "The app's uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`." }],
     query: null,
-    request: putAppAuthConfigRequest,
+    request: putAppAuthUrlsRequest,
     response: appAuthConfig,
     errors: [...DEVELOPER_GUARD, "invalid_uuid", "validation_error", "not_found"],
     transport: "http",
-    notes: "**A replace, not a merge, and `.strict()`**: every field arrives or the write is refused, so a client built against an older shape cannot silently clear a setting it does not know about. `oidc_callback_url` and `updated_at` are refused in the body \u2014 a writable callback URL would let a caller point the return leg of an OIDC sign-in, which carries an authorization code, at a host they own. \n\n`400 validation_error` is where the three field rules land: a URL template must be https (or `http` on `localhost`) and carry its placeholder exactly once, an origin must be a bare scheme-host-port with no path, and a domain must be lowercase. Each refuses at configuration time because each would otherwise fail silently later \u2014 a second placeholder leaves one occurrence literal in a mailed link, an origin with a path can never equal a browser's `Origin` header, and a capitalised domain can never match a lowercased address."
+    notes: "**A replace, not a merge, and `.strict()`**: `invite_url`, `verify_url` and `reset_url` all arrive or the write is refused, so a client built against an older shape cannot silently clear a setting it does not know about. `oidc_callback_url` and `updated_at` are the server's, refused in this body as in every slice's \u2014 see `GET`'s notes for why. \n\n`400 validation_error` is where the field rule lands: a URL template must be https (or `http` on `localhost`) and carry its placeholder exactly once \u2014 a second occurrence leaves one literal in a mailed link, refused here rather than failing silently once the mail is sent. \n\nThe merge is server-side against the stored row, so this write never disturbs the registration or mcp slice."
+  },
+  {
+    method: "PUT",
+    path: "/api/apps/:id/auth-config/mcp",
+    section: "apps",
+    summary: "Replaces the MCP switch and its login URL together.",
+    audience: "developer",
+    auth: "developer",
+    rateLimited: false,
+    ownerTier: false,
+    status: 200,
+    params: [{ name: "id", description: "The app's uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`." }],
+    query: null,
+    request: putAppAuthMcpRequest,
+    response: appAuthConfig,
+    errors: [...DEVELOPER_GUARD, "invalid_uuid", "validation_error", "not_found"],
+    transport: "http",
+    notes: "**A replace, not a merge, and `.strict()`**: `mcp_enabled` and `mcp_login_url` both arrive or the write is refused, so a client built against an older shape cannot silently clear a setting it does not know about. `oidc_callback_url` and `updated_at` are the server's, refused in this body as in every slice's \u2014 see `GET`'s notes for why. \n\n`mcp_login_url` answers to the same rule as the `urls` slice's three templates \u2014 https (or `http` on `localhost`), its placeholder exactly once \u2014 refused as `400 validation_error` rather than left to fail mid-OAuth, in a client's browser where no console screen is watching. \n\nThe merge is server-side against the stored row, so this write never disturbs the registration or urls slice."
   },
   {
     method: "GET",
@@ -7550,7 +7691,7 @@ var ROUTES = [
       "internal_error"
     ],
     transport: "http",
-    notes: "**One route for both kinds**, because a path segment naming the kind would demand a fact a role grant does not carry. An action answers `202` with an `invokeResponse` the moment the job exists; a service answers `200` with a `serviceCallResponse` once the result is in \u2014 two shapes, carried by one union (`invokeOrServiceResponse`) and told apart by whether `kind` or a bare `result` arrives. Parameters are checked **before** anything about the world (offline, busy): the same request must get the same verdict whether or not the robot happens to be reachable, or a developer testing against an offline robot never learns their parameters were wrong. A service the robot reports as failed answers `502` carrying **the job's own error code**, which is an open set and not one of the codes above."
+    notes: "**One route for both kinds**, because a path segment naming the kind would demand a fact a role grant does not carry. An action answers `202` with an `invokeResponse` the moment the job exists; a service answers `200` with a `serviceCallResponse` once the result is in \u2014 two shapes, carried by one union (`invokeOrServiceResponse`) and told apart by whether `kind` or a bare `result` arrives. Parameters are checked **before** anything about the world (offline, busy): the same request must get the same verdict whether or not the robot happens to be reachable, or a developer testing against an offline robot never learns their parameters were wrong. A slug is `409 busy` while it holds a `running` job, an `unknown` one the robot has not accounted for yet, or an `external` goal someone else started; the refusal's `details.running` names that job, `state` and `origin` included. A service the robot reports as failed answers `502` carrying **the job's own error code**, which is an open set and not one of the codes above."
   },
   {
     method: "GET",
@@ -7591,9 +7732,21 @@ var ROUTES = [
     request: cancelRequest,
     requestOptional: true,
     response: jobResponse,
-    errors: [...CLIENT_GUARD, "invalid_uuid", "not_found", "validation_error", "not_cancellable", "robot_offline"],
+    errors: [
+      ...CLIENT_GUARD,
+      "invalid_uuid",
+      "not_found",
+      "validation_error",
+      "not_cancellable",
+      "robot_offline",
+      "cancel_rejected",
+      "bridge_timeout",
+      "unknown_slug",
+      "action_server_lost",
+      "internal_error"
+    ],
     transport: "http",
-    notes: 'The body is optional: a bodyless `POST` was every caller\'s shape before `job_id` existed, and absent or `job_id: null` both mean "cancel whatever is running". A named `job_id` that is **not** what is running cancels nothing and answers `404` \u2014 the caller named an id and thereby ruled the other one out. A service is `422 not_cancellable`: a service call has no goal to cancel. Nothing running is a `200` with `job: null`.'
+    notes: "The body is optional: a bodyless `POST` was every caller's shape before `job_id` existed, and absent or `job_id: null` both mean \"cancel whatever is running\". A named `job_id` that is **not** what is running cancels nothing and answers `404` \u2014 the caller named an id and thereby ruled the other one out. An `external` job is cancelled the same way, through its goal id. Cancelling an `unknown` job also cancels every external goal on its action, since one of them may be that job. A service is `422 not_cancellable`: a service call has no goal to cancel. Nothing running is a `200` with `job: null`. The answer waits for the bridge's `cancel_result`: a `200` means the action server accepted the cancel request, not that the goal has ended \u2014 the job's end arrives as its own update. Any goal answered `ERROR_REJECTED` makes it `409 cancel_rejected`, with every goal and its `return_code` in `details.goals`; no answer within `JOB_HEARTBEAT_TIMEOUT_MS` is `504 bridge_timeout`; a cancel the bridge could not send at all is `502` carrying the bridge's own code (`unknown_slug`, `action_server_lost`, `internal_error`)."
   },
   {
     method: "POST",