@fleetless/sdk 4.0.0 → 4.2.0-next.1

package/dist/index.js

@@ -410,7 +410,7 @@ function createAssetsApi(http) {
   };
 }
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/common.js
+// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/common.js
 import { z } from "zod";
 var SLUG_RULE = "A name is lower-case: it starts with a letter, continues with letters and digits, and joins further words with a single underscore \u2014 `battery_voltage`. Capitals, dashes, dots, spaces, a leading digit and a doubled or trailing underscore are all refused.";
 var slug = z.string().min(2).max(63).regex(/^[a-z][a-z0-9]*(?:_[a-z0-9]+)*$/, SLUG_RULE);
@@ -441,7 +441,7 @@ var applyError = z.object({
   details: z.record(z.string(), z.unknown()).optional()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/mcp.js
+// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/mcp.js
 import { z as z2 } from "zod";
 function mcpAppEndpointPath(appIdentifier2) {
   return `/mcp/${appIdentifier2}`;
@@ -490,10 +490,10 @@ var mcpRolePreviewResponse = z2.object({
 });
 var MCP_ASSET_LINK_TTL_MS = 15 * 60 * 1e3;
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/protocol.js
+// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/protocol.js
 import { z as z8 } from "zod";
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/assets.js
+// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/assets.js
 import { z as z3 } from "zod";
 var assetKind = z3.enum(["urdf", "mesh", "texture"]);
 var asset = z3.object({
@@ -813,10 +813,10 @@ var assetSyncBusyDetails = z3.object({
   started_at_ms: z3.number().int().nonnegative()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/config.js
+// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/config.js
 import { z as z5 } from "zod";
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/alerts.js
+// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/alerts.js
 import { z as z4 } from "zod";
 var alertRowCondition = z4.discriminatedUnion("kind", [
   z4.strictObject({
@@ -886,7 +886,7 @@ var putDatapointDisplayRequest = z4.object({
   y_max: z4.number().finite().nullable()
 }).strict();
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/config.js
+// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/config.js
 var RTSP_URL_RULE = "The URL has to begin with `rtsp://` or `rtsps://` \u2014 `rtsp://cam-1.plant.local/stream1`. No other scheme is accepted: the bridge opens this with a library that would equally honour `file:`.";
 var MJPEG_URL_RULE = "The URL has to begin with `http://` or `https://` \u2014 `http://cam-1.plant.local/video.mjpg`. No other scheme is accepted: the bridge opens this with a library that would equally serve `file:`.";
 var DEVICE_PATH_RULE = "A capture device is a path under `/dev/`, and the character straight after it is a letter or a digit \u2014 `/dev/video0`, or a stable `/dev/v4l/by-id/...` symlink. Nothing outside `/dev/` is accepted: the string reaches OpenCV, which would as happily open an ordinary file.";
@@ -1978,7 +1978,7 @@ var configState = z5.object({
   applied_errors: z5.array(applyError).nullable()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/introspection.js
+// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/introspection.js
 import { z as z6 } from "zod";
 var rosGraphEntry = z6.object({
   name: rosName,
@@ -2017,9 +2017,11 @@ var typeDefinition = z6.discriminatedUnion("kind", [
   })
 ]);
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/jobs.js
+// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/jobs.js
 import { z as z7 } from "zod";
-var jobState = z7.enum(["running", "succeeded", "failed", "cancelled", "lost"]);
+var jobState = z7.enum(["running", "unknown", "succeeded", "failed", "cancelled", "lost"]);
+var reportedJobState = jobState.exclude(["unknown"]);
+var jobOrigin = z7.enum(["fleetless", "external"]);
 var job = z7.object({
   id: z7.uuid().meta({
     description: "The job's id, minted by the cloud when the invocation is accepted. Informative \u2014 state is observed by slug; a cancel names this id to stop one specific job rather than whatever is running."
@@ -2029,7 +2031,10 @@ var job = z7.object({
     description: "The action or service this job is running, as the published configuration exposes it. One slug carries one job at a time, so every observer of that slug sees the same one."
   }),
   state: jobState.meta({
-    description: "Where the job stands: `running`, `succeeded`, `failed`, `cancelled` or `lost`. `lost` is a real outcome \u2014 the bridge restarted mid-job and the result is gone \u2014 stated rather than left reading `running` by default."
+    description: "Where the job stands: `running`, `unknown`, `succeeded`, `failed`, `cancelled` or `lost`. `unknown` is not an outcome \u2014 the robot went offline or silent and the cloud does not know yet; the slug stays occupied and the bridge's next statement resolves it, `error` naming why the cloud lost sight of it. `lost` is final: the bridge stated it does not know the job and nothing else runs on its action, or the action server vanished mid-goal."
+  }),
+  origin: jobOrigin.meta({
+    description: "Who started this job. `fleetless` for everything minted by the cloud; `external` for a goal the bridge found active on a published action without having sent it \u2014 no parameters, no starter, never written to `job_runs`."
   }),
   started_at: z7.iso.datetime().meta({
     description: "When the cloud minted this job, as an ISO 8601 timestamp. For a job adopted from a reconnecting bridge, this is **adoption time**, not the real start \u2014 the cloud never minted it."
@@ -2048,7 +2053,7 @@ var job = z7.object({
    * exists for the same reason on the audit log.
    *
    * **Scoped honestly: per cloud process, per run.** Job state lives in memory
-   * — that is why `lost` exists at all — so this counter restarts when
+   * — that is why `unknown` and `lost` exist at all — so this counter restarts when
    * the cloud does, alongside the jobs it orders. Sound, because it only ever
    * orders jobs that coexist in one registry — and stated, because a reader
    * who assumed `auditEvent.seq`'s durable semantics would be wrong.
@@ -2083,7 +2088,7 @@ var job = z7.object({
       description: "The structured payload belonging to `code`, for the codes that document one \u2014 `job_queue_full` carries its `limit` and its `queued` count here. Absent for a failure with nothing structured to add, which is most of them."
     })
   }).nullable().meta({
-    description: "Why the job failed: a human `message`, a `code` where one exists, and `details` for the codes that carry a documented payload. `null` unless `state` is `failed`."
+    description: "Why the job failed, or why the cloud does not know how it stands: a human `message`, a `code` where one exists, and `details` for the codes that carry a documented payload. Set on `failed` and `lost`, and on `unknown` \u2014 where `code` is `bridge_disconnected` or `bridge_timeout`, the cloud's own reason for not knowing, cleared when the bridge reports the job running again."
   })
 });
 var jobEvent = z7.object({
@@ -2142,16 +2147,16 @@ var jobRun = z7.object({
     description: "Whether the slug was an `action` or a `service`."
   }),
   state: jobState.meta({
-    description: "How the run ended, or `running` while it is still going. `lost` means the bridge restarted mid-run and the outcome is unknowable rather than unknown."
+    description: "How the run ended, or `running` while it is still going. `unknown` while the robot has not accounted for it \u2014 offline or silent \u2014 and updated once the bridge says how it stands. `lost` is final: the bridge did not know the run and nothing else ran on its action, so the outcome is unknowable rather than unknown."
   }),
   started_at: z7.iso.datetime().meta({
     description: "When the run started, as an ISO 8601 timestamp. Runs are listed and filtered by this instant."
   }),
   ended_at: z7.iso.datetime().nullable().meta({
-    description: "When the run finished, as an ISO 8601 timestamp. `null` while it is still `running` \u2014 a run has an end only once it has one."
+    description: "When the run finished, as an ISO 8601 timestamp. `null` while it is still `running` or `unknown` \u2014 a run has an end only once it has one."
   }),
   duration_ms: z7.number().int().nonnegative().nullable().meta({
-    description: 'How long the run took, in milliseconds. `null` while it is still `running`, never `0` standing in for "nothing so far".'
+    description: 'How long the run took, in milliseconds. `null` while it is still `running` or `unknown`, never `0` standing in for "nothing so far".'
   }),
   result: z7.unknown().nullable().meta({
     description: "What the action or service returned once it succeeded, shaped by ROS itself. `null` otherwise."
@@ -2201,7 +2206,7 @@ var jobRunQuery = z7.object({
     description: "Only runs of this action or service."
   }),
   state: jobState.optional().meta({
-    description: "Only runs in this state \u2014 `running`, `succeeded`, `failed`, `cancelled` or `lost`."
+    description: "Only runs in this state \u2014 `running`, `unknown`, `succeeded`, `failed`, `cancelled` or `lost`."
   }),
   kind: jobRunKind.optional().meta({
     description: "Only `action` runs, or only `service` runs."
@@ -2235,14 +2240,14 @@ var jobRunSummary = z7.object({
   since_ms: z7.number().int().nonnegative()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/protocol.js
+// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/protocol.js
 var DAY_MS = 24 * 60 * 60 * 1e3;
 var MAX_PATIENCE_MS = 12e4;
 var MIN_PATIENCE_MS = 1e3;
 var activeJob = z8.object({
   job_id: z8.uuid(),
   slug,
-  state: jobState
+  state: reportedJobState
 });
 var bridgeHello = z8.object({
   type: z8.literal("hello"),
@@ -2253,16 +2258,14 @@ var bridgeHello = z8.object({
    * Every job this bridge still knows about, right now.
    *
    * A reconnect and a restart look **identical** on the wire — same token,
-   * same version, same frame — but must end differently: after a dropped
-   * connection the running jobs are still running, after a restart their
-   * results are gone forever. Enumerating what the bridge still has settles
-   * it without either side guessing: the cloud marks every job it believed
-   * running that is *not* named here as `lost`.
-   *
-   * Deliberately needs no persistence at the bridge: a live process lists its
-   * live jobs, a process that just started lists none — exactly the truth
-   * the cloud needs. A breadcrumb file would only add a window in which the
-   * crash beat the write.
+   * same version, same frame — so the bridge enumerates what it still has:
+   * its live jobs, and after a restart every job whose goal it recognised
+   * again from its persisted job-to-goal mapping. A job the cloud holds
+   * `running` or `unknown` that is *not* named here is "not known to the
+   * bridge"; it becomes `lost` (`job_unknown_to_bridge`) only once the
+   * bridge's goal reports show its action free of goals it cannot
+   * attribute — one of those may be that very job — and at once for a
+   * service job, which has no goals to look at.
    *
    * Defaulted, so a bridge that sends no such field still parses; no jobs
    * and no report both mean the same thing to the cloud: nothing to keep
@@ -2368,9 +2371,28 @@ var cloudInvoke = z8.object({
 });
 var cloudCancel = z8.object({
   type: z8.literal("cancel"),
+  request_id: z8.string().min(1).max(64),
   slug,
   job_id: z8.uuid().nullable()
 });
+var CANCEL_RETURN_CODES = { none: 0, rejected: 1, unknown_goal_id: 2, goal_terminated: 3 };
+var cancelReturnCode = z8.number().int().min(0).max(3);
+var bridgeCancelResultEntry = z8.object({
+  /** The job the goal belongs to — the bridge's own, or an external goal's derived id. */
+  job_id: z8.uuid(),
+  /** The ROS 2 goal id the cancel was sent for. */
+  goal_id: z8.string().min(1),
+  /** `null` when the action server did not answer the cancel request within the bridge's own bound. */
+  return_code: cancelReturnCode.nullable()
+});
+var bridgeCancelResult = z8.object({
+  type: z8.literal("cancel_result"),
+  request_id: z8.string().min(1).max(64),
+  slug,
+  goals: z8.array(bridgeCancelResultEntry),
+  /** Set when the bridge could not send the cancel at all (no such slug, a service, the server gone). */
+  error: z8.object({ code: z8.string().min(1), message: z8.string().min(1) }).nullable()
+});
 var cloudPublish = z8.object({
   type: z8.literal("publish"),
   slug,
@@ -2390,7 +2412,11 @@ var bridgeJobUpdate = z8.object({
   type: z8.literal("job_update"),
   job_id: z8.uuid(),
   slug,
-  state: jobState,
+  /** Never `unknown`: that is the cloud's word for not having heard. */
+  state: reportedJobState,
+  origin: jobOrigin,
+  /** The ROS 2 goal id; `null` for a service job, which has no goal. */
+  goal_id: z8.string().min(1).nullable(),
   feedback: z8.unknown().nullable(),
   progress: z8.number().min(0).max(1).nullable(),
   result: z8.unknown().nullable(),
@@ -2400,7 +2426,29 @@ var bridgeJobUpdate = z8.object({
 });
 var bridgeJobLost = z8.object({
   type: z8.literal("job_lost"),
-  job_ids: z8.array(z8.uuid())
+  job_ids: z8.array(z8.uuid()),
+  error: z8.object({ code: z8.string().min(1), message: z8.string().min(1) }).optional()
+});
+var cloudJobQuery = z8.object({
+  type: z8.literal("job_query"),
+  request_id: z8.string().min(1).max(64),
+  job_ids: z8.array(z8.uuid()).min(1)
+});
+var bridgeJobStatusEntry = z8.object({
+  job_id: z8.uuid(),
+  /** Never `unknown` — the bridge only ever states a definite fact about a job it recognises. */
+  state: reportedJobState,
+  feedback: z8.unknown().nullable(),
+  progress: z8.number().min(0).max(1).nullable(),
+  result: z8.unknown().nullable(),
+  /** Same shape as `job.error`, `details` included — see `jobs.ts`. */
+  error: z8.object({ code: z8.string().min(1), message: z8.string().min(1), details: z8.unknown().optional() }).nullable()
+});
+var bridgeJobStatus = z8.object({
+  type: z8.literal("job_status"),
+  request_id: z8.string().min(1).max(64),
+  jobs: z8.array(bridgeJobStatusEntry),
+  unknown_job_ids: z8.array(z8.uuid())
 });
 var cloudIntrospectRequest = z8.object({
   type: z8.literal("introspect_request"),
@@ -2589,11 +2637,11 @@ var bridgeCameraState = z8.object({
   request_id: z8.string().min(1).max(64).nullable()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/config-issues.js
+// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/config-issues.js
 var EXPOSURE_SECTIONS = ["datapoints", "actions", "services", "publishers", "cameras"];
 var EXPOSURE_SECTION_NAMES = new Set(EXPOSURE_SECTIONS);
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/rest.js
+// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/rest.js
 import { z as z9 } from "zod";
 var robot = z9.object({
   id: z9.uuid().meta({
@@ -3358,13 +3406,13 @@ var slugUsageResponse = z9.object({
   alert_count: z9.number().int().nonnegative()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/realtime.js
+// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/realtime.js
 import { z as z14 } from "zod";
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/client-auth.js
+// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/client-auth.js
 import { z as z13 } from "zod";
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/apps.js
+// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/apps.js
 import { z as z10 } from "zod";
 var appIdentifier = slug;
 var app = z10.object({
@@ -3424,6 +3472,26 @@ var appListResponse = z10.object({
     description: "Every app of the caller's organisation, oldest first by `created_at`. The org scope is the whole filter \u2014 there is no id to narrow by and nothing to refuse."
   })
 });
+var appDeletionSummary = z10.object({
+  user_count: z10.number().int().nonnegative().meta({
+    description: "App users deleted with the app. They are the developer's own customers, not Fleetless users, and exist in no other app."
+  }),
+  role_count: z10.number().int().nonnegative().meta({
+    description: "Roles deleted with the app, each with its per-robot slug grants."
+  }),
+  server_key_count: z10.number().int().nonnegative().meta({
+    description: "Server keys deleted with the app. A client still holding one is refused at its next request."
+  }),
+  invitation_count: z10.number().int().nonnegative().meta({
+    description: "Outstanding invitations \u2014 unspent and unexpired \u2014 that will never be accepted."
+  }),
+  oidc_provider_count: z10.number().int().nonnegative().meta({
+    description: "Identity providers configured for this app. The providers themselves are somebody else's; only this app's configuration of them goes."
+  }),
+  mail_template_count: z10.number().int().nonnegative().meta({
+    description: "Custom mail templates, of at most three. A kind using the Fleetless default text is not counted \u2014 there is no row to lose."
+  })
+});
 var createAppRequest = z10.object({
   name: z10.string().min(1).max(120),
   identifier: appIdentifier,
@@ -3546,10 +3614,10 @@ var rolePermissions = z10.object({
   })
 });
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/app-users.js
+// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/app-users.js
 import { z as z12 } from "zod";
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/identity.js
+// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/identity.js
 import { z as z11 } from "zod";
 var password = z11.string().min(12).max(256);
 var USER_DISPLAY_NAME_MAX = 120;
@@ -3711,7 +3779,7 @@ var authMeResponse = z11.object({ org, user: fleetlessUser });
 var patchOrgRequest = z11.object({ name: z11.string().min(1).max(120) }).strict();
 var patchAuthMeRequest = z11.object({ display_name: z11.string().min(1).max(USER_DISPLAY_NAME_MAX).nullable() }).strict();
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/app-users.js
+// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/app-users.js
 var APP_USER_DISPLAY_NAME_MAX = 120;
 var providerSlug = z12.string().max(40).regex(/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/, "must be lowercase and hyphen-separated, starting with a letter");
 var appUserStatus = z12.enum(["pending_verification", "active", "blocked"]);
@@ -3930,7 +3998,9 @@ var appAuthConfig = z12.object({
   }),
   updated_at: z12.iso.datetime().meta({ description: "When the configuration was last written, as an ISO 8601 timestamp." })
 });
-var putAppAuthConfigRequest = appAuthConfig.omit({ oidc_callback_url: true, updated_at: true }).strict();
+var putAppAuthRegistrationRequest = appAuthConfig.pick({ self_registration: true, allowed_domains: true, allowed_origins: true }).strict();
+var putAppAuthUrlsRequest = appAuthConfig.pick({ invite_url: true, verify_url: true, reset_url: true }).strict();
+var putAppAuthMcpRequest = appAuthConfig.pick({ mcp_enabled: true, mcp_login_url: true }).strict();
 var mailTemplateKind = z12.enum(["invite", "verify", "reset"]);
 var appMailTemplate = z12.object({
   kind: mailTemplateKind.meta({ description: "Which of the three mails this template replaces." }),
@@ -3962,7 +4032,7 @@ var mailOutcome = z12.object({
   })
 });
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/client-auth.js
+// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/client-auth.js
 var clientLoginRequest = z13.object({
   app_identifier: appIdentifier.meta({
     description: "The app being logged in to: its globally unique, lowercase, underscore-separated identifier, chosen by the developer at creation. There is no organisation context at login, so this is what decides which app the credentials are checked for."
@@ -4151,7 +4221,7 @@ var clientIdentity = z13.object({
   })
 });
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/realtime.js
+// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/realtime.js
 var clientAuth = z14.object({
   type: z14.literal("auth"),
   token: z14.string().min(1)
@@ -4429,7 +4499,7 @@ var orgEventDropped = z14.object({
   dropped: z14.number().int().positive()
 }).strict();
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/client-robots.js
+// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/client-robots.js
 import { z as z15 } from "zod";
 var clientRobotListItem = z15.object({
   ...robot.shape,
@@ -4446,7 +4516,7 @@ var clientRobotListResponse = z15.object({
   })
 });
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/audit.js
+// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/audit.js
 import { z as z16 } from "zod";
 var auditActor = z16.object({
   kind: z16.enum(["developer", "end_user", "app_user", "server_key", "bridge"]),
@@ -4576,7 +4646,7 @@ var auditListResponse = z16.object({
   next_cursor: z16.number().int().positive().nullable()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/errors.js
+// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/errors.js
 import { z as z17 } from "zod";
 var apiError = z17.object({
   code: z17.string().min(1),
@@ -4592,8 +4662,11 @@ var parameterViolation = z17.object({
 var parameterInvalidDetails = z17.object({
   violations: z17.array(parameterViolation).min(1)
 });
+var cancelRejectedDetails = z17.object({
+  goals: z17.array(bridgeCancelResultEntry).min(1)
+});
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/oauth.js
+// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/oauth.js
 import { z as z18 } from "zod";
 var oauthErrorCode = z18.enum([
   "invalid_request",
@@ -4833,7 +4906,7 @@ var oauthAuthorizeQuery = z18.object({
   description: "The authorization request an MCP client sends, per RFC 6749 \xA74.1.1 with mandatory PKCE. The handler reads it parameter by parameter rather than through one parse, because the answers differ: `client_id` and `redirect_uri` are refused flat, with no redirect, since until both are confirmed there is no trusted target to bounce a browser to, and everything after them is reported to the client's own callback as query parameters."
 });
 
-// node_modules/.pnpm/@fleetless+contracts@2.0.0/node_modules/@fleetless/contracts/dist/routes.js
+// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/routes.js
 var MCP_APP = MCP_APP_PATHS(":appIdentifier");
 var APP_IDENTIFIER = {
   name: "appIdentifier",
@@ -5203,6 +5276,42 @@ var ROUTES = [
     transport: "http",
     notes: "A `default_role_id` naming a role of another app is refused: it is the one cross-app authorization check this shape can carry. Changing the robot set closes every live subscription the app's users hold, since a grant may no longer name a reachable robot."
   },
+  {
+    method: "GET",
+    path: "/api/apps/:id/deletion-preview",
+    section: "apps",
+    summary: "Reports what deleting the app would destroy, without destroying it.",
+    audience: "developer",
+    auth: "developer",
+    rateLimited: false,
+    ownerTier: false,
+    status: 200,
+    params: [{ name: "id", description: "The app's uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`." }],
+    query: null,
+    request: null,
+    response: appDeletionSummary,
+    errors: [...DEVELOPER_GUARD, "invalid_uuid", "not_found"],
+    transport: "http",
+    notes: "The same shape the delete's own audit event carries, computed by the same function on purpose: the confirmation dialog and the eventual receipt agree by construction, and any difference between them is real drift rather than two estimates that quietly disagree. \n\n**No `force` parameter, unlike the robot pair this is modelled on.** A robot's open live session is a single nameable state whose interruption is its own hazard, which is why that route makes the caller pass `force` explicitly. An app has no equivalent state to force past, and inventing one would be a guess wearing a guard's clothes \u2014 this preview is the guard."
+  },
+  {
+    method: "DELETE",
+    path: "/api/apps/:id",
+    section: "apps",
+    summary: "Deletes an app and everything it produced.",
+    audience: "developer",
+    auth: "developer",
+    rateLimited: false,
+    ownerTier: true,
+    status: 204,
+    params: [{ name: "id", description: "The app's uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`." }],
+    query: null,
+    request: null,
+    response: null,
+    errors: [...DEVELOPER_GUARD, "tier_required", "invalid_uuid", "not_found"],
+    transport: "http",
+    notes: "Owner tier, and the gate runs **after** the org-scoped lookup: a developer-tier admin therefore sees the same `404` a stranger would for an app outside their org, rather than a tier refusal that confirms the id exists. A full cascade \u2014 its users, roles, server keys, invitations, OIDC provider configuration and mail templates all go, recorded once as `app.deleted` carrying an `appDeletionSummary`. Its robots are untouched: they belong to the org, not to the app. \n\n**No `force` parameter** \u2014 see `GET /api/apps/:id/deletion-preview`."
+  },
   {
     method: "POST",
     path: "/api/apps/:id/roles",
@@ -5709,13 +5818,31 @@ var ROUTES = [
     response: appAuthConfig,
     errors: [...DEVELOPER_GUARD, "invalid_uuid", "not_found"],
     transport: "http",
-    notes: "One row per app, created with the app and never absent \u2014 an app that has configured nothing reads back the defaults rather than a `404`. `oidc_callback_url` is in the answer and not in the request: it is minted by the cloud from its own public base URL, is the same for every app and every provider, and is the value a developer registers at their identity provider."
+    notes: "One row per app, created with the app and never absent \u2014 an app that has configured nothing reads back the defaults rather than a `404`. `oidc_callback_url` is in the answer and not in the request: it is minted by the cloud from its own public base URL, is the same for every app and every provider, and is the value a developer registers at their identity provider. It stays read-only on every slice write below for a second reason: a writable callback URL would let a caller point the return leg of an OIDC sign-in, which carries an authorization code, at a host they own. `updated_at` is read-only for a duller one: the server stamps it on every write, and a client-supplied value would be a lie about when the row last changed."
   },
   {
     method: "PUT",
-    path: "/api/apps/:id/auth-config",
+    path: "/api/apps/:id/auth-config/registration",
+    section: "apps",
+    summary: "Replaces who may self-register, and from where.",
+    audience: "developer",
+    auth: "developer",
+    rateLimited: false,
+    ownerTier: false,
+    status: 200,
+    params: [{ name: "id", description: "The app's uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`." }],
+    query: null,
+    request: putAppAuthRegistrationRequest,
+    response: appAuthConfig,
+    errors: [...DEVELOPER_GUARD, "invalid_uuid", "validation_error", "not_found"],
+    transport: "http",
+    notes: "**A replace, not a merge, and `.strict()`**: `self_registration`, `allowed_domains` and `allowed_origins` all arrive or the write is refused, so a client built against an older shape cannot silently clear a setting it does not know about. `oidc_callback_url` and `updated_at` are the server's, refused in this body as in every slice's \u2014 see `GET`'s notes for why. \n\n`400 validation_error` is where the two field rules land: an entry in `allowed_domains` must be lowercase, since a capitalised one can never match a lowercased address, and an entry in `allowed_origins` must be a bare scheme-host-port with no path, since a browser sends nothing longer in its `Origin` header. Each refuses at configuration time rather than failing silently later. \n\nThe merge is server-side against the stored row, so this write never disturbs the urls or mcp slice."
+  },
+  {
+    method: "PUT",
+    path: "/api/apps/:id/auth-config/urls",
     section: "apps",
-    summary: "Replaces the app's auth settings in one write.",
+    summary: "Replaces the three pages Fleetless's mails point at.",
     audience: "developer",
     auth: "developer",
     rateLimited: false,
@@ -5723,11 +5850,29 @@ var ROUTES = [
     status: 200,
     params: [{ name: "id", description: "The app's uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`." }],
     query: null,
-    request: putAppAuthConfigRequest,
+    request: putAppAuthUrlsRequest,
     response: appAuthConfig,
     errors: [...DEVELOPER_GUARD, "invalid_uuid", "validation_error", "not_found"],
     transport: "http",
-    notes: "**A replace, not a merge, and `.strict()`**: every field arrives or the write is refused, so a client built against an older shape cannot silently clear a setting it does not know about. `oidc_callback_url` and `updated_at` are refused in the body \u2014 a writable callback URL would let a caller point the return leg of an OIDC sign-in, which carries an authorization code, at a host they own. \n\n`400 validation_error` is where the three field rules land: a URL template must be https (or `http` on `localhost`) and carry its placeholder exactly once, an origin must be a bare scheme-host-port with no path, and a domain must be lowercase. Each refuses at configuration time because each would otherwise fail silently later \u2014 a second placeholder leaves one occurrence literal in a mailed link, an origin with a path can never equal a browser's `Origin` header, and a capitalised domain can never match a lowercased address."
+    notes: "**A replace, not a merge, and `.strict()`**: `invite_url`, `verify_url` and `reset_url` all arrive or the write is refused, so a client built against an older shape cannot silently clear a setting it does not know about. `oidc_callback_url` and `updated_at` are the server's, refused in this body as in every slice's \u2014 see `GET`'s notes for why. \n\n`400 validation_error` is where the field rule lands: a URL template must be https (or `http` on `localhost`) and carry its placeholder exactly once \u2014 a second occurrence leaves one literal in a mailed link, refused here rather than failing silently once the mail is sent. \n\nThe merge is server-side against the stored row, so this write never disturbs the registration or mcp slice."
+  },
+  {
+    method: "PUT",
+    path: "/api/apps/:id/auth-config/mcp",
+    section: "apps",
+    summary: "Replaces the MCP switch and its login URL together.",
+    audience: "developer",
+    auth: "developer",
+    rateLimited: false,
+    ownerTier: false,
+    status: 200,
+    params: [{ name: "id", description: "The app's uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`." }],
+    query: null,
+    request: putAppAuthMcpRequest,
+    response: appAuthConfig,
+    errors: [...DEVELOPER_GUARD, "invalid_uuid", "validation_error", "not_found"],
+    transport: "http",
+    notes: "**A replace, not a merge, and `.strict()`**: `mcp_enabled` and `mcp_login_url` both arrive or the write is refused, so a client built against an older shape cannot silently clear a setting it does not know about. `oidc_callback_url` and `updated_at` are the server's, refused in this body as in every slice's \u2014 see `GET`'s notes for why. \n\n`mcp_login_url` answers to the same rule as the `urls` slice's three templates \u2014 https (or `http` on `localhost`), its placeholder exactly once \u2014 refused as `400 validation_error` rather than left to fail mid-OAuth, in a client's browser where no console screen is watching. \n\nThe merge is server-side against the stored row, so this write never disturbs the registration or urls slice."
   },
   {
     method: "GET",
@@ -7520,7 +7665,7 @@ var ROUTES = [
       "internal_error"
     ],
     transport: "http",
-    notes: "**One route for both kinds**, because a path segment naming the kind would demand a fact a role grant does not carry. An action answers `202` with an `invokeResponse` the moment the job exists; a service answers `200` with a `serviceCallResponse` once the result is in \u2014 two shapes, carried by one union (`invokeOrServiceResponse`) and told apart by whether `kind` or a bare `result` arrives. Parameters are checked **before** anything about the world (offline, busy): the same request must get the same verdict whether or not the robot happens to be reachable, or a developer testing against an offline robot never learns their parameters were wrong. A service the robot reports as failed answers `502` carrying **the job's own error code**, which is an open set and not one of the codes above."
+    notes: "**One route for both kinds**, because a path segment naming the kind would demand a fact a role grant does not carry. An action answers `202` with an `invokeResponse` the moment the job exists; a service answers `200` with a `serviceCallResponse` once the result is in \u2014 two shapes, carried by one union (`invokeOrServiceResponse`) and told apart by whether `kind` or a bare `result` arrives. Parameters are checked **before** anything about the world (offline, busy): the same request must get the same verdict whether or not the robot happens to be reachable, or a developer testing against an offline robot never learns their parameters were wrong. A slug is `409 busy` while it holds a `running` job, an `unknown` one the robot has not accounted for yet, or an `external` goal someone else started; the refusal's `details.running` names that job, `state` and `origin` included. A service the robot reports as failed answers `502` carrying **the job's own error code**, which is an open set and not one of the codes above."
   },
   {
     method: "GET",
@@ -7561,9 +7706,21 @@ var ROUTES = [
     request: cancelRequest,
     requestOptional: true,
     response: jobResponse,
-    errors: [...CLIENT_GUARD, "invalid_uuid", "not_found", "validation_error", "not_cancellable", "robot_offline"],
+    errors: [
+      ...CLIENT_GUARD,
+      "invalid_uuid",
+      "not_found",
+      "validation_error",
+      "not_cancellable",
+      "robot_offline",
+      "cancel_rejected",
+      "bridge_timeout",
+      "unknown_slug",
+      "action_server_lost",
+      "internal_error"
+    ],
     transport: "http",
-    notes: 'The body is optional: a bodyless `POST` was every caller\'s shape before `job_id` existed, and absent or `job_id: null` both mean "cancel whatever is running". A named `job_id` that is **not** what is running cancels nothing and answers `404` \u2014 the caller named an id and thereby ruled the other one out. A service is `422 not_cancellable`: a service call has no goal to cancel. Nothing running is a `200` with `job: null`.'
+    notes: "The body is optional: a bodyless `POST` was every caller's shape before `job_id` existed, and absent or `job_id: null` both mean \"cancel whatever is running\". A named `job_id` that is **not** what is running cancels nothing and answers `404` \u2014 the caller named an id and thereby ruled the other one out. An `external` job is cancelled the same way, through its goal id. Cancelling an `unknown` job also cancels every external goal on its action, since one of them may be that job. A service is `422 not_cancellable`: a service call has no goal to cancel. Nothing running is a `200` with `job: null`. The answer waits for the bridge's `cancel_result`: a `200` means the action server accepted the cancel request, not that the goal has ended \u2014 the job's end arrives as its own update. Any goal answered `ERROR_REJECTED` makes it `409 cancel_rejected`, with every goal and its `return_code` in `details.goals`; no answer within `JOB_HEARTBEAT_TIMEOUT_MS` is `504 bridge_timeout`; a cancel the bridge could not send at all is `502` carrying the bridge's own code (`unknown_slug`, `action_server_lost`, `internal_error`)."
   },
   {
     method: "POST",
@@ -9168,9 +9325,11 @@ function deriveRealtimeUrl(apiUrl) {
   return url.toString();
 }
 export {
+  CANCEL_RETURN_CODES,
   FleetlessError,
   InMemoryTokenStore,
   SDK_ERROR_CODES,
+  cancelRejectedDetails,
   createClient,
   parameterInvalidDetails
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fleetless/sdk",
-  "version": "4.0.0",
+  "version": "4.2.0-next.1",
   "description": "The official TypeScript SDK for Fleetless client apps — a ROS 2 robot as a REST and realtime API, cameras, jobs, and the app's own user accounts, federated sign-in and MCP consent.",
   "license": "MIT",
   "author": {
@@ -76,7 +76,7 @@
     "zod": "^4.0.0"
   },
   "devDependencies": {
-    "@fleetless/contracts": "2.0.0",
+    "@fleetless/contracts": "5.1.0-next.1",
     "@types/node": "^22.20.1",
     "tsup": "^8.3.0",
     "typedoc": "0.28.20",