@fleetless/sdk 4.2.0-next.1 → 4.3.0

package/dist/index.d.ts

@@ -282,6 +282,7 @@ declare const jobRun: z.ZodObject<{
         }>;
         id: z.ZodUUID;
         label: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
     }, z.core.$strip>;
     seq: z.ZodNumber;
     progress: z.ZodNullable<z.ZodNumber>;
@@ -323,6 +324,7 @@ declare const jobRunListResponse: z.ZodObject<{
             }>;
             id: z.ZodUUID;
             label: z.ZodString;
+            name: z.ZodNullable<z.ZodString>;
         }, z.core.$strip>;
         seq: z.ZodNumber;
         progress: z.ZodNullable<z.ZodNumber>;
@@ -531,10 +533,11 @@ declare const clientOidcErrorCode: z.ZodEnum<{
 }>;
 type ClientOidcErrorCode = z.infer<typeof clientOidcErrorCode>;
 /**
- * **A pending MCP authorization, as the app's own consent screen reads it**
- * Fleetless renders no page here either: `authorize` redirects to the
- * app's `mcp_login_url` with an interaction id, the app authenticates the user
- * with its normal UI, shows this, and approves or denies through the API.
+ * **A pending MCP authorization, as the app's own consent screen reads it.**
+ * `authorize` redirects to the app's `mcp_login_url` with an interaction id,
+ * the app authenticates the user with its normal UI, shows this, and approves
+ * or denies through the API. An app with no `mcp_login_url` gets the hosted
+ * MCP sign-in instead, which reads and decides the same interaction.
  *
  * `client_name_verified` is `z.literal(false)`, and that is the whole point of
  * the field. The name comes from an **unauthenticated** dynamic registration —
@@ -624,6 +627,7 @@ declare const clientIdentity: z.ZodObject<{
     app_id: z.ZodNullable<z.ZodUUID>;
     role_id: z.ZodNullable<z.ZodUUID>;
     email: z.ZodNullable<z.ZodEmail>;
+    two_factor_enabled: z.ZodNullable<z.ZodBoolean>;
 }, z.core.$strip>;
 type ClientIdentity = z.infer<typeof clientIdentity>;
 
@@ -850,7 +854,7 @@ type CancelRejectedDetails = z.infer<typeof cancelRejectedDetails>;
  * list is the shared vocabulary, not a closed set, so a new refusal never
  * needs a contracts release before it can be reported honestly.
  */
-declare const ERROR_CODES: readonly ["not_found", "validation_error", "bad_request", "unknown_datapoint", "invalid_token", "protocol_mismatch", "bridge_too_old", "invalid_frame", "duplicate_slug", "reserved_slug", "unknown_slug", "unknown_field_path", "unknown_type", "unknown_topic", "invalid_rate", "invalid_range", "config_conflict", "no_data", "robot_offline", "bridge_timeout", "unauthorized", "forbidden", "invalid_credentials", "token_expired", "token_revoked", "email_taken", "identifier_taken", "weak_password", "account_blocked", "busy", "parameter_invalid", "cancel_rejected", "job_lost", "job_unknown_to_bridge", "action_server_lost", "action_failed", "goal_rejected", "goal_send_failed", "result_failed", "goal_uncontrollable", "bridge_disconnected", "config_changed", "publisher_busy", "unknown_command", "not_subscribable", "camera_offline", "no_snapshot_yet", "live_unavailable", "wrong_kind", "not_recorded", "not_aggregatable", "quota_exceeded", "credential_in_use", "goal_timeout", "robot_in_use", "robot_deletion_partial", "job_queue_full", "invalid_uuid", "rate_limited", "tier_required", "token_spent", "service_timeout", "asset_missing", "dynamic_registration_disabled", "client_limit_reached", "idp_unavailable", "mcp_disabled", "tool_not_available", "capability_required", "last_owner", "target_state_conflict", "signup_closed", "draft_not_a_document", "internal_error", "not_cancellable", "unsupported_media_type", "wrong_browser", "invalid_yaml", "unstorable_yaml", "registration_closed", "domain_not_allowed", "email_unverified", "origin_not_allowed", "template_invalid", "provider_disabled", "provider_misconfigured", "invalid_redirect_uri", "interaction_expired"];
+declare const ERROR_CODES: readonly ["not_found", "validation_error", "bad_request", "unknown_datapoint", "invalid_token", "protocol_mismatch", "bridge_too_old", "invalid_frame", "duplicate_slug", "reserved_slug", "unknown_slug", "unknown_field_path", "unknown_type", "unknown_topic", "invalid_rate", "invalid_range", "config_conflict", "no_data", "robot_offline", "bridge_timeout", "unauthorized", "forbidden", "invalid_credentials", "token_expired", "token_revoked", "email_taken", "identifier_taken", "weak_password", "account_blocked", "busy", "parameter_invalid", "cancel_rejected", "job_lost", "job_unknown_to_bridge", "action_server_lost", "action_failed", "goal_rejected", "goal_send_failed", "result_failed", "goal_uncontrollable", "bridge_disconnected", "config_changed", "publisher_busy", "unknown_command", "not_subscribable", "camera_offline", "no_snapshot_yet", "live_unavailable", "wrong_kind", "not_recorded", "not_aggregatable", "quota_exceeded", "credential_in_use", "goal_timeout", "robot_in_use", "robot_deletion_partial", "job_queue_full", "invalid_uuid", "rate_limited", "tier_required", "token_spent", "service_timeout", "asset_missing", "dynamic_registration_disabled", "client_limit_reached", "idp_unavailable", "mcp_disabled", "tool_not_available", "capability_required", "last_owner", "role_name_taken", "role_in_use", "last_role", "target_state_conflict", "signup_closed", "draft_not_a_document", "internal_error", "not_cancellable", "unsupported_media_type", "wrong_browser", "invalid_yaml", "unstorable_yaml", "registration_closed", "domain_not_allowed", "email_unverified", "origin_not_allowed", "template_invalid", "provider_disabled", "provider_misconfigured", "invalid_redirect_uri", "interaction_expired", "invalid_code", "method_not_allowed"];
 type ErrorCode = (typeof ERROR_CODES)[number];
 
 /**
@@ -1577,8 +1581,15 @@ declare class InMemoryTokenStore implements TokenStore {
 interface RegisterOptions {
     /** The address the verification mail goes to. Nothing works until that link is spent. */
     email: string;
-    /** At least 12 characters — `clientRegisterRequest` refuses less with a `validation_error`. */
-    password: string;
+    /**
+     * At least 12 characters — `clientRegisterRequest` refuses less with a
+     * `validation_error`. **Optional, and omitted from the request entirely**
+     * when you do not pass it: an app whose `sign_in_methods` is email-code
+     * only has no password to set, and sending the key at all (even as
+     * `undefined`) would be a `422` against the strict schema — same reason as
+     * `displayName` below.
+     */
+    password?: string;
     /**
      * What the app should call this person. Optional, and **omitted from the
      * request entirely** when you do not pass it — `clientRegisterRequest` is a
@@ -1591,11 +1602,105 @@ interface RegisterOptions {
 interface AcceptInvitationOptions {
     /** The `token` from the invitation link the developer's app was linked to. */
     token: string;
-    /** At least 12 characters. The invitation fixes the role; this call fixes the credential. */
-    password: string;
+    /**
+     * At least 12 characters. The invitation fixes the role; this call fixes
+     * the credential. **Optional, and omitted from the request entirely** when
+     * you do not pass it — same email-code-only reason as `RegisterOptions.password`.
+     */
+    password?: string;
     /** Optional, and omitted from the request entirely when absent — same strict-schema reason as `RegisterOptions.displayName`. */
     displayName?: string;
 }
+/**
+ * `verifyTwoFactor()`'s input — the `challenge` a sign-in step answered with
+ * `two_factor_required`, plus exactly one of the authenticator's current
+ * code or a recovery code. Sending both, or neither, is a `400
+ * validation_error` the cloud answers (`clientTwoFactorVerifyRequest` is a
+ * strict schema with both fields optional) — this SDK does not duplicate
+ * that check client-side, it only serializes whichever one the caller gave.
+ */
+interface VerifyTwoFactorOptions {
+    /** The handle a sign-in step (`login`, `verifyLoginCode`, …) answered. Five minutes, five wrong codes. */
+    challenge: string;
+    /** The authenticator's current six digits. Accepted at most once — the same code sent twice signs in exactly once. */
+    code?: string;
+    /** One of the ten recovery codes, spent by its use. Use this instead of `code` when the authenticator itself is unavailable. */
+    recoveryCode?: string;
+}
+/**
+ * `beginTwoFactorSetup()`'s input. **Two ways in, decided by what is
+ * passed**: a `challenge` from a `two_factor_setup_required` sign-in step
+ * (no session exists yet, so the challenge itself is the credential), or
+ * nothing at all — from the app's own account settings, where the caller's
+ * *current session* is the credential instead. Passing neither a challenge
+ * nor holding a session is `401 unauthorized` from the cloud, not a
+ * client-side refusal: this SDK has no way to tell "forgot to pass a
+ * challenge" apart from "forgot to sign in first" without asking the server.
+ */
+interface BeginTwoFactorSetupOptions {
+    challenge?: string;
+}
+/** What `beginTwoFactorSetup()` resolves with — not yet in use until `confirmTwoFactorSetup` accepts a code from it. */
+interface TwoFactorSetup {
+    /** The shared secret, for a manual "enter this key" fallback. */
+    secret: string;
+    /** The full `otpauth://` URI, for rendering as a QR code. */
+    otpauthUrl: string;
+}
+/** `confirmTwoFactorSetup()`'s input — same two ways in as `beginTwoFactorSetup`, plus the code from the new authenticator. */
+interface ConfirmTwoFactorSetupOptions {
+    /** A code from the authenticator `beginTwoFactorSetup` just started. A mismatch is `invalid_code`. */
+    code: string;
+    /** The same challenge `beginTwoFactorSetup` was given, during a sign-in. Omit it when setting up from account settings instead. */
+    challenge?: string;
+}
+/**
+ * What `confirmTwoFactorSetup()` resolves with: the ten recovery codes,
+ * shown this once — any earlier set is void. The session itself is not
+ * here; it is saved to the token store the same way every other sign-in
+ * step saves one, not handed back for the caller to do that itself.
+ */
+interface TwoFactorSetupConfirmation {
+    recoveryCodes: string[];
+}
+/**
+ * What every sign-in step (`login`, `verifyEmail`, `confirmPasswordReset`,
+ * `acceptInvitation`, `verifyLoginCode`) resolves with — the session may not be ready yet.
+ *
+ * `'signed_in'` means exactly that: the session was stored, same as these
+ * calls always did. The other two mean the cloud is still waiting on a
+ * second factor — no session exists yet, nothing was stored, and `challenge`
+ * is a short-lived handle (five minutes) for the next call:
+ * `'two_factor_required'` when the person already has an authenticator
+ * (`POST /api/client/two-factor/verify`), `'two_factor_setup_required'` when
+ * the app requires one and the person has none yet
+ * (`POST /api/client/two-factor/setup` then `…/setup/confirm`). An app
+ * without two-factor on at all never sees either — every sign-in step
+ * resolves `{ status: 'signed_in' }`.
+ */
+type SignInResult = {
+    status: 'signed_in';
+} | {
+    status: 'two_factor_required';
+    challenge: string;
+} | {
+    status: 'two_factor_setup_required';
+    challenge: string;
+};
+/**
+ * Which credential-based ways in the app's login screen should draw, as
+ * `signInMethods()` answers it: a password field, a "mail me a code" link, or
+ * both. Federated buttons are `listProviders()`'s own answer, not this one —
+ * the two routes share one response on the wire (`GET /api/client/providers`)
+ * but ask different questions, so the SDK answers them separately rather than
+ * handing every caller a shape with fields it did not ask about.
+ */
+interface SignInMethods {
+    /** Whether `login(email, password)` is on for this app. */
+    password: boolean;
+    /** Whether `requestLoginCode`/`verifyLoginCode` is on for this app. */
+    emailCode: boolean;
+}
 /** One sign-in button on the app's own login screen, as `listProviders()` lists it. */
 interface ProviderButton {
     /** What `beginOidcLogin` addresses this provider by. */
@@ -1699,10 +1804,10 @@ interface McpInteractionDecision {
  *
  * **A client built with a `serverKey` refuses everything that needs an app
  * user's own session** with `invalid_option`, before any request. `me()`,
- * `listProviders()`, `mcpInteraction()` and `oidcErrorFromCallback()` still
- * work on one: the first is what a server key is *for*, the next two are public
- * reads the cloud answers without any credential at all, and the last touches
- * no network.
+ * `listProviders()`, `signInMethods()`, `mcpInteraction()` and
+ * `oidcErrorFromCallback()` still work on one: the first is what a server key
+ * is *for*, the next three are public reads the cloud answers without any
+ * credential at all, and the last touches no network.
  */
 interface AuthApi {
     /**
@@ -1726,26 +1831,48 @@ interface AuthApi {
      */
     register(input: RegisterOptions): Promise<void>;
     /**
-     * Spends a verification token and **stores the session it answers with**, so
-     * the person is not asked to log in immediately after proving they can read
-     * the mail.
+     * Spends a verification token and **stores the session it answers with**
+     * when the sign-in is complete, so the person is not asked to log in
+     * immediately after proving they can read the mail — see `SignInResult`
+     * for the second-factor case, where nothing is stored yet.
      *
      * `token_spent` covers unknown, expired and already-used alike — one code,
      * because the remedy is one thing: ask for a fresh link with
      * `resendVerification`. An app rendering this refusal should offer that.
      */
-    verifyEmail(token: string): Promise<void>;
+    verifyEmail(token: string): Promise<SignInResult>;
     /** Asks for the verification mail again. Resolves on `202` for every policy-allowed request, existing address or not — same reason as `register`. */
     resendVerification(email: string): Promise<void>;
     /**
      * Exchanges email + password, and the client's configured app identifier, for
-     * a session.
+     * a session — or a second-factor challenge, see `SignInResult`.
      *
      * `invalid_credentials` is answered identically for a wrong password, a
      * blocked account and one still waiting to verify. Do not try to tell them
      * apart — there is nothing in the answer that does, deliberately.
      */
-    login(email: string, password: string): Promise<void>;
+    login(email: string, password: string): Promise<SignInResult>;
+    /**
+     * Mails a six-digit sign-in code to `email`, valid ten minutes — the
+     * password-free alternative to `login`. Resolves on the route's `202` for
+     * every policy-allowed request, whether or not the address names an
+     * account, same discipline as `register`/`resendVerification`/
+     * `requestPasswordReset`: this is no enumeration oracle either. A fresh
+     * request expires the previous code for the same address.
+     */
+    requestLoginCode(email: string): Promise<void>;
+    /**
+     * Spends a mailed sign-in code for a session — or a second-factor
+     * challenge, see `SignInResult`, exactly like `login`.
+     *
+     * A wrong code is `invalid_code`, carrying `details.attempts_left`; five
+     * wrong attempts, or the tenth minute, spend the code the same way a
+     * correct one would, and the recovery is the same either way: call
+     * `requestLoginCode` again. A pending-verification account that spends a
+     * code is activated — reading the mail at that address is the proof
+     * verification asks for.
+     */
+    verifyLoginCode(email: string, code: string): Promise<SignInResult>;
     /**
      * Ends the session: revokes the whole refresh-token family server-side (a
      * stolen refresh token stops working immediately), closes this client's live
@@ -1770,7 +1897,17 @@ interface AuthApi {
      * which Fleetless never did better than it.
      */
     logout(): Promise<void>;
-    /** Who the caller turned out to be, without decoding a token client-side — which is how apps end up trusting claims nobody verified. */
+    /**
+     * Who the caller turned out to be, without decoding a token client-side —
+     * which is how apps end up trusting claims nobody verified.
+     *
+     * Throws the SDK's own `no_session` **before any request is sent** when
+     * nothing is stored — which is exactly the state a sign-in step leaves a
+     * caller in while a second factor is still pending (see `SignInResult`):
+     * there is no session yet to ask the cloud about, so this fails the same
+     * way "never logged in" does, rather than round-tripping to a route that
+     * would just answer `unauthorized` for having no bearer at all.
+     */
     me(): Promise<ClientIdentity>;
     /**
      * Changes the current app user's password.
@@ -1792,21 +1929,68 @@ interface AuthApi {
     requestPasswordReset(email: string): Promise<void>;
     /**
      * Spends a reset token, sets the new password and **stores the session it
-     * answers with**. Every refresh family of that user is revoked first — a
-     * forgotten password is one of the two states where somebody else may be
-     * holding a session.
+     * answers with** when the sign-in is complete (see `SignInResult`). Every
+     * refresh family of that user is revoked first — a forgotten password is
+     * one of the two states where somebody else may be holding a session.
      */
-    confirmPasswordReset(token: string, newPassword: string): Promise<void>;
+    confirmPasswordReset(token: string, newPassword: string): Promise<SignInResult>;
     /**
      * Accepts an app invitation: creates the account (or activates one invited
      * before it existed) with the role the invitation fixed, and **stores the
-     * session**.
+     * session** when the sign-in is complete (see `SignInResult`).
      *
      * An invitation always bypasses the app's domain whitelist — a developer
      * inviting somebody by hand has already made the decision the whitelist
      * automates.
      */
-    acceptInvitation(input: AcceptInvitationOptions): Promise<void>;
+    acceptInvitation(input: AcceptInvitationOptions): Promise<SignInResult>;
+    /**
+     * Answers a `two_factor_required` challenge and **saves the session
+     * unconditionally** — unlike `login`/`verifyEmail`/`confirmPasswordReset`/
+     * `acceptInvitation`/`verifyLoginCode`, this call's answer is never a
+     * `SignInResult` union: the second factor is the last step, so the cloud
+     * has nothing left to ask for and always answers tokens.
+     *
+     * A wrong code or recovery code is `invalid_code`, carrying
+     * `details.attempts_left`; five wrong attempts, or the challenge's own
+     * five minutes, spend it the same way a correct answer would — the
+     * sign-in has to start over from `login`/`requestLoginCode`/etc.
+     */
+    verifyTwoFactor(input: VerifyTwoFactorOptions): Promise<void>;
+    /**
+     * Starts an authenticator setup and hands back its secret and `otpauth://`
+     * URL for rendering a QR code. **Two ways in**: pass the `challenge` a
+     * `two_factor_setup_required` sign-in step answered, when the app requires
+     * a second factor and this person has none yet — no session exists at
+     * that point, so the challenge is the credential; or pass nothing at all,
+     * from the app's own account settings, where the *current session* is the
+     * credential instead. The secret is not in use until
+     * `confirmTwoFactorSetup` accepts a code from it — calling this twice
+     * replaces the pending secret, and an account that already has an
+     * authenticator keeps it until the new one is confirmed.
+     */
+    beginTwoFactorSetup(input?: BeginTwoFactorSetupOptions): Promise<TwoFactorSetup>;
+    /**
+     * Confirms the authenticator `beginTwoFactorSetup` just started, with a
+     * code from it, and **saves the session it answers** — same two ways in
+     * as `beginTwoFactorSetup` (a sign-in `challenge`, or the current
+     * session). On success the authenticator is on and ten recovery codes
+     * come back, shown this once; any earlier set is void. A code that does
+     * not match the pending secret is `invalid_code`.
+     *
+     * From account settings, every other session of the account ends and this
+     * call's own session is replaced with the fresh one it answers — the same
+     * discipline `changePassword` already keeps.
+     */
+    confirmTwoFactorSetup(input: ConfirmTwoFactorSetupOptions): Promise<TwoFactorSetupConfirmation>;
+    /**
+     * Turns the signed-in app user's authenticator off — the account's own
+     * door, not the developer's support one (`DELETE
+     * /api/apps/:id/users/:userId/two-factor`, management-side). A current
+     * code proves the person still holds the authenticator before it and
+     * every recovery code are removed; a stolen session alone cannot do this.
+     */
+    disableTwoFactor(code: string): Promise<void>;
     /**
      * The app's **enabled** sign-in providers, for drawing the buttons on your
      * own login screen. A disabled provider is not a button that refuses; it is a
@@ -1818,6 +2002,18 @@ interface AuthApi {
      * is configured.
      */
     listProviders(): Promise<ProviderButton[]>;
+    /**
+     * Which credential-based sign-in methods this app has on, for drawing a
+     * password field, a "get a code by email" link, or both, on your own login
+     * screen — the other half of what the login screen needs, the federated
+     * buttons being `listProviders()`'s own answer.
+     *
+     * Public and unauthenticated, same route as `listProviders()`
+     * (`GET /api/client/providers`) — each call is its own request, picking a
+     * different field out of the same response; call both if your login
+     * screen needs both.
+     */
+    signInMethods(): Promise<SignInMethods>;
     /**
      * Builds the URL that starts a federated sign-in, with a fresh `state` and a
      * fresh PKCE verifier. **Makes no network call and does not navigate** —
@@ -2515,4 +2711,4 @@ interface FleetlessClient {
  */
 declare function createClient(options: FleetlessClientOptions): FleetlessClient;
 
-export { type AcceptInvitationOptions, type ActionsApi, type Asset, type AssetBytes, type AssetListResponse, type AssetsApi, type AuthApi, type BeginOidcLoginOptions, type BusyDetails, CANCEL_RETURN_CODES, type CameraDescriptor, type CameraLiveSession, type CameraSnapshot, type CameraSnapshotMeta, type CamerasApi, type CancelRejectedDetails, type CancelReturnCode, type ClientIdentity, type ClientMcpInteraction, type ClientOidcErrorCode, type ClientRobotListItem, type CompleteOidcLoginOptions, type CreateMeshLoaderOptions, type CredentialSource, type DatapointEvent, type DatapointSubscription, type DatapointSubscriptionHandlers, type DatapointValue, type DatapointsApi, type FleetlessClient, type FleetlessClientConfig, type FleetlessClientOptions, FleetlessError, type FleetlessErrorCode, type FleetlessErrorOptions, type HistoryAggregation, type HistoryBucketsResponse, type HistoryOptions, type HistorySamplesResponse, InMemoryTokenStore, type InvokeOptions, type Job, type JobEvent, type JobHistoryOptions, type JobOrigin, type JobRun, type JobRunListResponse, type JobState, type JobSubscription, type JobSubscriptionHandlers, type JobsApi, type McpCapabilities, type McpConsentGrant, type McpExposure, type McpInteractionDecision, type McpRobotDatasheet, type MeshLoaderDelegate, type OidcLoginRequest, type ParameterInvalidDetails, type ParameterViolation, type PrepareUrdfSceneOptions, type ProviderButton, type PublishersApi, type RateLimitDetails, type RegisterOptions, type RobotsApi, SDK_ERROR_CODES, type SdkErrorCode, type SendCommandOptions, type ServicesApi, type StoredSession, type TokenStore, type UrdfCompleteness, type UrdfSceneManager, type UrdfSceneResources, cancelRejectedDetails, createClient, parameterInvalidDetails };
+export { type AcceptInvitationOptions, type ActionsApi, type Asset, type AssetBytes, type AssetListResponse, type AssetsApi, type AuthApi, type BeginOidcLoginOptions, type BeginTwoFactorSetupOptions, type BusyDetails, CANCEL_RETURN_CODES, type CameraDescriptor, type CameraLiveSession, type CameraSnapshot, type CameraSnapshotMeta, type CamerasApi, type CancelRejectedDetails, type CancelReturnCode, type ClientIdentity, type ClientMcpInteraction, type ClientOidcErrorCode, type ClientRobotListItem, type CompleteOidcLoginOptions, type ConfirmTwoFactorSetupOptions, type CreateMeshLoaderOptions, type CredentialSource, type DatapointEvent, type DatapointSubscription, type DatapointSubscriptionHandlers, type DatapointValue, type DatapointsApi, type FleetlessClient, type FleetlessClientConfig, type FleetlessClientOptions, FleetlessError, type FleetlessErrorCode, type FleetlessErrorOptions, type HistoryAggregation, type HistoryBucketsResponse, type HistoryOptions, type HistorySamplesResponse, InMemoryTokenStore, type InvokeOptions, type Job, type JobEvent, type JobHistoryOptions, type JobOrigin, type JobRun, type JobRunListResponse, type JobState, type JobSubscription, type JobSubscriptionHandlers, type JobsApi, type McpCapabilities, type McpConsentGrant, type McpExposure, type McpInteractionDecision, type McpRobotDatasheet, type MeshLoaderDelegate, type OidcLoginRequest, type ParameterInvalidDetails, type ParameterViolation, type PrepareUrdfSceneOptions, type ProviderButton, type PublishersApi, type RateLimitDetails, type RegisterOptions, type RobotsApi, SDK_ERROR_CODES, type SdkErrorCode, type SendCommandOptions, type ServicesApi, type SignInMethods, type SignInResult, type StoredSession, type TokenStore, type TwoFactorSetup, type TwoFactorSetupConfirmation, type UrdfCompleteness, type UrdfSceneManager, type UrdfSceneResources, type VerifyTwoFactorOptions, cancelRejectedDetails, createClient, parameterInvalidDetails };