@fleetless/sdk 4.2.0-next.1 → 4.3.0

package/dist/index.js

@@ -410,7 +410,7 @@ function createAssetsApi(http) {
   };
 }
 
-// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/common.js
+// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/common.js
 import { z } from "zod";
 var SLUG_RULE = "A name is lower-case: it starts with a letter, continues with letters and digits, and joins further words with a single underscore \u2014 `battery_voltage`. Capitals, dashes, dots, spaces, a leading digit and a doubled or trailing underscore are all refused.";
 var slug = z.string().min(2).max(63).regex(/^[a-z][a-z0-9]*(?:_[a-z0-9]+)*$/, SLUG_RULE);
@@ -441,7 +441,7 @@ var applyError = z.object({
   details: z.record(z.string(), z.unknown()).optional()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/mcp.js
+// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/mcp.js
 import { z as z2 } from "zod";
 function mcpAppEndpointPath(appIdentifier2) {
   return `/mcp/${appIdentifier2}`;
@@ -490,10 +490,10 @@ var mcpRolePreviewResponse = z2.object({
 });
 var MCP_ASSET_LINK_TTL_MS = 15 * 60 * 1e3;
 
-// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/protocol.js
+// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/protocol.js
 import { z as z8 } from "zod";
 
-// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/assets.js
+// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/assets.js
 import { z as z3 } from "zod";
 var assetKind = z3.enum(["urdf", "mesh", "texture"]);
 var asset = z3.object({
@@ -813,10 +813,10 @@ var assetSyncBusyDetails = z3.object({
   started_at_ms: z3.number().int().nonnegative()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/config.js
+// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/config.js
 import { z as z5 } from "zod";
 
-// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/alerts.js
+// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/alerts.js
 import { z as z4 } from "zod";
 var alertRowCondition = z4.discriminatedUnion("kind", [
   z4.strictObject({
@@ -886,7 +886,7 @@ var putDatapointDisplayRequest = z4.object({
   y_max: z4.number().finite().nullable()
 }).strict();
 
-// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/config.js
+// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/config.js
 var RTSP_URL_RULE = "The URL has to begin with `rtsp://` or `rtsps://` \u2014 `rtsp://cam-1.plant.local/stream1`. No other scheme is accepted: the bridge opens this with a library that would equally honour `file:`.";
 var MJPEG_URL_RULE = "The URL has to begin with `http://` or `https://` \u2014 `http://cam-1.plant.local/video.mjpg`. No other scheme is accepted: the bridge opens this with a library that would equally serve `file:`.";
 var DEVICE_PATH_RULE = "A capture device is a path under `/dev/`, and the character straight after it is a letter or a digit \u2014 `/dev/video0`, or a stable `/dev/v4l/by-id/...` symlink. Nothing outside `/dev/` is accepted: the string reaches OpenCV, which would as happily open an ordinary file.";
@@ -1978,7 +1978,7 @@ var configState = z5.object({
   applied_errors: z5.array(applyError).nullable()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/introspection.js
+// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/introspection.js
 import { z as z6 } from "zod";
 var rosGraphEntry = z6.object({
   name: rosName,
@@ -2017,7 +2017,7 @@ var typeDefinition = z6.discriminatedUnion("kind", [
   })
 ]);
 
-// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/jobs.js
+// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/jobs.js
 import { z as z7 } from "zod";
 var jobState = z7.enum(["running", "unknown", "succeeded", "failed", "cancelled", "lost"]);
 var reportedJobState = jobState.exclude(["unknown"]);
@@ -2132,6 +2132,20 @@ var jobActor = z7.object({
    */
   label: z7.string().min(1).max(200).meta({
     description: "A display name taken at invoke time \u2014 the email for a Fleetless user or an app user, the key's own name for a server key. Storing it rather than joining is the point: renaming a key afterwards does not rewrite history."
+  }),
+  /**
+   * The person's display name, snapshotted beside `label` for the same
+   * reason. **Required and nullable**, so a consumer never has to tell
+   * "absent" from "null": every run a 5.3.0 cloud answers carries it, and
+   * `null` means there is no name to show — a server key, a person without
+   * one, or a run recorded before the field existed.
+   *
+   * `jobActor` stays a plain object, not `.strict()`: a consumer still on an
+   * older contracts version then parses a newer cloud's answer by stripping
+   * the key instead of refusing the whole run.
+   */
+  name: z7.string().min(1).max(200).nullable().meta({
+    description: "The person's display name when the job started: the Fleetless user's `display_name` for a developer, the app user's `display_name` for an app user. `null` for a server key, when the person had no name set, and for runs recorded before contracts 5.3.0. Show `label` when it is null."
   })
 });
 var jobRunKind = z7.enum(["action", "service"]);
@@ -2240,7 +2254,7 @@ var jobRunSummary = z7.object({
   since_ms: z7.number().int().nonnegative()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/protocol.js
+// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/protocol.js
 var DAY_MS = 24 * 60 * 60 * 1e3;
 var MAX_PATIENCE_MS = 12e4;
 var MIN_PATIENCE_MS = 1e3;
@@ -2373,7 +2387,8 @@ var cloudCancel = z8.object({
   type: z8.literal("cancel"),
   request_id: z8.string().min(1).max(64),
   slug,
-  job_id: z8.uuid().nullable()
+  job_id: z8.uuid().nullable(),
+  own_only: z8.boolean().optional()
 });
 var CANCEL_RETURN_CODES = { none: 0, rejected: 1, unknown_goal_id: 2, goal_terminated: 3 };
 var cancelReturnCode = z8.number().int().min(0).max(3);
@@ -2637,11 +2652,11 @@ var bridgeCameraState = z8.object({
   request_id: z8.string().min(1).max(64).nullable()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/config-issues.js
+// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/config-issues.js
 var EXPOSURE_SECTIONS = ["datapoints", "actions", "services", "publishers", "cameras"];
 var EXPOSURE_SECTION_NAMES = new Set(EXPOSURE_SECTIONS);
 
-// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/rest.js
+// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/rest.js
 import { z as z9 } from "zod";
 var robot = z9.object({
   id: z9.uuid().meta({
@@ -3406,13 +3421,13 @@ var slugUsageResponse = z9.object({
   alert_count: z9.number().int().nonnegative()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/realtime.js
+// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/realtime.js
 import { z as z14 } from "zod";
 
-// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/client-auth.js
+// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/client-auth.js
 import { z as z13 } from "zod";
 
-// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/apps.js
+// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/apps.js
 import { z as z10 } from "zod";
 var appIdentifier = slug;
 var app = z10.object({
@@ -3553,7 +3568,7 @@ var role = z10.object({
     description: "The role's name, shown wherever a user's access is chosen. The two roles every app starts with are named `observe` and `operate`."
   }),
   builtin: z10.boolean().meta({
-    description: "`true` for the two roles every app starts with. Their **rights may be re-scoped** exactly like a custom role's, through `PUT /api/apps/:id/roles/:roleId/permissions` \u2014 the flag exists so the console can explain where they came from, not to protect them. It does not make them renamable or deletable \u2014 no route does that for any role."
+    description: "`true` for the two roles every app starts with. Their **rights may be re-scoped** exactly like a custom role's, through `PUT /api/apps/:id/roles/:roleId/permissions` \u2014 the flag exists so the console can explain where they came from, not to protect them. Built-in roles can be renamed and deleted like any other; the flag only records that the cloud seeded them."
   })
 });
 var roleListResponse = z10.object({
@@ -3561,6 +3576,27 @@ var roleListResponse = z10.object({
     description: "The app's roles, built-in and custom alike, ordered by `created_at` and then by `name`. The tie-break is not cosmetic \u2014 the two built-in roles are inserted in one statement and share a creation time to the microsecond, so never read a role by position."
   })
 });
+var roleRenameRequest = z10.object({
+  name: z10.string().trim().min(1).max(60).meta({
+    description: "The new name, trimmed, 1 to 60 characters. Unique per app: another role of this app with the same name answers `409 role_name_taken`. The role's users keep it under its new name."
+  })
+}).strict();
+var roleDeleteQuery = z10.object({
+  move_to: z10.uuid().optional().meta({
+    description: "Another role of the same app that takes over the deleted role's app users, pending invitations and, when it applies, the app's default. The role itself or a role of another app answers `400 validation_error`."
+  })
+}).strict();
+var roleInUseDetails = z10.object({
+  users: z10.number().int().nonnegative().meta({
+    description: "App users whose role this is."
+  }),
+  invitations: z10.number().int().nonnegative().meta({
+    description: "Pending invitations that would grant this role when accepted."
+  }),
+  is_default: z10.boolean().meta({
+    description: "`true` when this is the app's `default_role_id`; the default then moves with the users to `move_to`."
+  })
+}).strict();
 var rolePermissions = z10.object({
   role_id: z10.uuid(),
   /**
@@ -3614,10 +3650,10 @@ var rolePermissions = z10.object({
   })
 });
 
-// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/app-users.js
+// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/app-users.js
 import { z as z12 } from "zod";
 
-// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/identity.js
+// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/identity.js
 import { z as z11 } from "zod";
 var password = z11.string().min(12).max(256);
 var USER_DISPLAY_NAME_MAX = 120;
@@ -3629,6 +3665,9 @@ var org = z11.object({
   name: z11.string().min(1).max(120).meta({
     description: "The organisation's display name. Free text, changed through `PATCH /api/org`."
   }),
+  require_two_factor: z11.boolean().meta({
+    description: "Whether every member must have a second factor \u2014 a passkey or an authenticator app. A member without one sets it up at their next sign-in, before any session exists; nobody is signed out when it is switched on. It covers the console and the central MCP endpoint; server keys and robot bridges are not people and are not affected. Owners change it through `PATCH /api/org`."
+  }),
   created_at: z11.iso.datetime().meta({
     description: "When the organisation was created, as an ISO 8601 timestamp."
   })
@@ -3654,6 +3693,12 @@ var fleetlessUser = z11.object({
   tier: orgAdminTier.meta({
     description: "The console powers this person holds. **Required** \u2014 every Fleetless user has a tier; it was optional only while the org also held people with no console powers to grade, and that pool is gone."
   }),
+  two_factor: z11.object({
+    passkeys: z11.number().int().min(0).meta({ description: "How many passkeys the person has registered." }),
+    authenticator: z11.boolean().meta({ description: "Whether the person has a confirmed authenticator app." })
+  }).meta({
+    description: "The person's second factors, as the team list shows them: none, passkeys, an authenticator, or both. No credential travels here. An owner resets them through `DELETE /api/org/users/:id/two-factor`."
+  }),
   created_at: z11.iso.datetime().meta({
     description: "When the account was created, as an ISO 8601 timestamp."
   })
@@ -3675,21 +3720,19 @@ var sessionTokens = z11.object({
   })
 });
 var refreshRequest = z11.object({ refresh_token: z11.string().min(1) });
-var signUpRequest = z11.object({
-  org_name: z11.string().min(1).max(120),
-  email: z11.email(),
-  password
-});
-var signUpResponse = z11.object({
-  org,
-  user: fleetlessUser,
-  tokens: sessionTokens
+var loginCode = z11.string().regex(/^\d{6}$/, "must be exactly six digits");
+var totpCode = loginCode;
+var recoveryCode = z11.string().regex(/^[a-zA-Z2-7]{5}-[a-zA-Z2-7]{5}$/, "must be two groups of five characters, xxxxx-xxxxx");
+var recoveryCodesList = z11.array(z11.string().regex(/^[a-z2-7]{5}-[a-z2-7]{5}$/)).length(10);
+var twoFactorSetupResponse = z11.object({
+  secret: z11.string().min(1).meta({
+    description: "The shared secret, base32, for an authenticator app that cannot scan a QR code. Shown once; the cloud stores it encrypted."
+  }),
+  otpauth_url: z11.string().startsWith("otpauth://totp/").meta({
+    description: "The same secret as an `otpauth://totp/` URL, to render as a QR code. It carries the secret: never log it."
+  })
 });
 var waitlistRequest = z11.object({ email: z11.email().max(254) });
-var developerLoginRequest = z11.object({
-  email: z11.email(),
-  password: z11.string().min(1)
-});
 var mailStatus = z11.enum(["sent", "not_requested", "not_configured", "failed"]);
 var createTeamInviteRequest = z11.object({
   email: z11.email().meta({
@@ -3730,8 +3773,8 @@ var acceptTeamInviteRequest = z11.object({
   token: z11.string().min(1).meta({
     description: "The opaque invitation token from the link. Unknown, expired and already-accepted all collapse into `410 token_spent` \u2014 telling them apart would say whether a token ever existed."
   }),
-  password: password.meta({
-    description: "The password the new Fleetless account will use. At least 12 characters."
+  display_name: z11.string().min(1).max(USER_DISPLAY_NAME_MAX).nullable().optional().meta({
+    description: "An optional name, overriding whatever the invitation pre-filled. Absent keeps it."
   })
 }).strict();
 var patchFleetlessUserRequest = z11.object({
@@ -3753,13 +3796,6 @@ var passwordChangeRequest = z11.object({
     description: "The replacement password. Every other session is revoked when it is accepted, while the session that made the change survives \u2014 logging somebody out of the tab they just used is indistinguishable from the change having failed."
   })
 });
-var passwordResetRequest = z11.object({
-  email: z11.email()
-});
-var passwordResetConfirm = z11.object({
-  token: z11.string().min(1),
-  new_password: password
-});
 var idpIssuer = z11.url().max(500).refine((v) => {
   let url;
   try {
@@ -3776,10 +3812,66 @@ var idpIssuer = z11.url().max(500).refine((v) => {
   return url.hostname.length > 0;
 }, { message: "issuer must be an http(s) URL with no credentials, query or fragment" });
 var authMeResponse = z11.object({ org, user: fleetlessUser });
-var patchOrgRequest = z11.object({ name: z11.string().min(1).max(120) }).strict();
+var patchOrgRequest = z11.object({
+  name: z11.string().min(1).max(120).optional().meta({
+    description: "The organisation's new display name. Absent leaves it alone."
+  }),
+  require_two_factor: z11.boolean().optional().meta({
+    description: "Whether every member must have a second factor. Turning it on signs nobody out: each member without one sets it up at their next sign-in. Absent leaves it alone."
+  })
+}).strict().refine((b) => b.name !== void 0 || b.require_two_factor !== void 0, { message: "Send name, require_two_factor, or both." });
 var patchAuthMeRequest = z11.object({ display_name: z11.string().min(1).max(USER_DISPLAY_NAME_MAX).nullable() }).strict();
+var webauthnJson = z11.record(z11.string(), z11.unknown());
+var webauthnOptionsResponse = z11.object({
+  options: webauthnJson.meta({
+    description: "The `PublicKeyCredentialCreationOptionsJSON` or `PublicKeyCredentialRequestOptionsJSON` to pass to the browser. Its challenge is single-use and short-lived."
+  })
+});
+var developerPasskey = z11.object({
+  id: z11.uuid().meta({ description: "The passkey in the API, as renamed and removed through `/api/auth/passkeys/:id`." }),
+  name: z11.string().min(1).max(80).meta({ description: "What the person called it, such as the device it lives on." }),
+  created_at: z11.iso.datetime().meta({ description: "When it was registered." }),
+  last_used_at: z11.iso.datetime().nullable().meta({ description: "When it last signed the person in or confirmed a sign-in, or `null` if never." }),
+  synced: z11.boolean().nullable().meta({
+    description: "Whether the authenticator reported the passkey as syncable across the person's devices (the backup-eligible flag), or `null` when it said nothing."
+  })
+});
+var developerTwoFactor = z11.object({
+  passkeys: z11.array(developerPasskey).meta({ description: "Every passkey the caller has registered, oldest first. Empty when none." }),
+  authenticator: z11.object({ created_at: z11.iso.datetime().meta({ description: "When the authenticator was confirmed." }) }).nullable().meta({ description: "The confirmed authenticator app, or `null` when there is none. At most one." }),
+  recovery_codes_left: z11.number().int().min(0).max(10).meta({
+    description: "How many of the ten recovery codes are unspent. `0` while the caller has no second factor."
+  }),
+  required_by_org: z11.boolean().meta({
+    description: "Whether the organisation requires a second factor. While it does, the last one cannot be removed."
+  })
+});
+var createPasskeyRequest = z11.object({
+  name: z11.string().min(1).max(80).meta({ description: "What to call the passkey, such as the device it lives on." }),
+  credential: webauthnJson.meta({ description: "The browser's `RegistrationResponseJSON` for the options `POST /api/auth/passkeys/options` answered." })
+}).strict();
+var createPasskeyResponse = z11.object({
+  passkey: developerPasskey.meta({ description: "The passkey as it is now stored." }),
+  recovery_codes: recoveryCodesList.nullable().meta({
+    description: "The ten recovery codes, shown once, when this passkey is the account's first second factor; `null` when the account already had one and its codes stay valid."
+  })
+});
+var renamePasskeyRequest = z11.object({
+  name: z11.string().min(1).max(80).meta({ description: "The new name." })
+}).strict();
+var totpConfirmRequest = z11.object({
+  code: totpCode.meta({ description: "A code the new authenticator shows now. It proves the secret was copied correctly before anything depends on it." })
+}).strict();
+var totpConfirmResponse = z11.object({
+  recovery_codes: recoveryCodesList.nullable().meta({
+    description: "The ten recovery codes, shown once, when this is the account's first second factor; `null` otherwise."
+  })
+});
+var recoveryCodesResponse = z11.object({
+  recovery_codes: recoveryCodesList.meta({ description: "The ten new recovery codes, lowercase, shown once. Every earlier code is void." })
+});
 
-// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/app-users.js
+// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/app-users.js
 var APP_USER_DISPLAY_NAME_MAX = 120;
 var providerSlug = z12.string().max(40).regex(/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/, "must be lowercase and hyphen-separated, starting with a letter");
 var appUserStatus = z12.enum(["pending_verification", "active", "blocked"]);
@@ -3817,6 +3909,19 @@ var appUser = z12.object({
   last_login_at: z12.iso.datetime().nullable().meta({
     description: "When this user last signed in, or `null` if they never have. Required and nullable rather than optional, so *never logged in* stays distinguishable from *this field was not loaded*."
   }),
+  two_factor: z12.object({
+    enabled: z12.boolean().meta({
+      description: "Whether the account has a confirmed authenticator app (TOTP). When it has, every sign-in that yields a session asks for a code as well \u2014 whatever the app's policy \u2014 except a sign-in through an identity provider, which owns that sign-in."
+    }),
+    enabled_at: z12.iso.datetime().nullable().meta({
+      description: "When the authenticator was confirmed, or `null` while `enabled` is `false`."
+    }),
+    recovery_codes_left: z12.number().int().min(0).max(10).meta({
+      description: "How many of the ten single-use recovery codes are still unspent. `0` while `enabled` is `false`."
+    })
+  }).meta({
+    description: "The account's second factor, as a developer's user list shows it. No secret and no code travels here; resetting it is `DELETE /api/apps/:id/users/:userId/two-factor`."
+  }),
   created_at: z12.iso.datetime().meta({
     description: "When the account was created, as an ISO 8601 timestamp."
   })
@@ -3862,7 +3967,7 @@ var createAppInvitationRequest = z12.object({
     description: "An optional name to pre-fill the account with; the invitee can change it afterwards."
   }),
   send_mail: z12.boolean().meta({
-    description: "Whether Fleetless mails the invitation. **Refused with `409 target_state_conflict` naming `invite_url` when the app has configured none** \u2014 there would be nowhere for the link to point, and a mail carrying a Fleetless-hosted page is a surface this product does not have."
+    description: "Whether Fleetless mails the invitation. The link points at the app's `invite_url`, or at the Fleetless-hosted invitation page when the app has configured none \u2014 so the mail always leads somewhere, and nothing is refused for a missing URL."
   })
 }).strict();
 var appInvitation = z12.object({
@@ -3871,11 +3976,11 @@ var appInvitation = z12.object({
   email: z12.email().meta({ description: "The address the invitation was addressed to." }),
   role_id: z12.uuid().meta({ description: "The role the invitee holds once they accept. Resolved at creation, so a later change to the app's default role does not silently re-aim an outstanding invitation." }),
   expires_at: z12.iso.datetime().meta({ description: "When the token stops working. Seven days from issue; an expired token answers exactly as an unknown one does." }),
-  accept_url: z12.url().max(500).nullable().meta({
-    description: "The link to give the invitee, built from the app's `invite_url` with the token substituted for `{token}`. **`null` when the app has configured no `invite_url`** \u2014 there is nowhere for the link to point, and Fleetless serves no page of its own for an app user. Bounded like every other URL that gets mailed, logged and rendered."
+  accept_url: z12.url().max(500).meta({
+    description: "The link to give the invitee: the app's `invite_url` with the token substituted for `{token}`, or the Fleetless-hosted invitation page when the app has configured none. Bounded like every other URL that gets mailed, logged and rendered."
   }),
   mail: mailStatus.meta({
-    description: "What happened to the mail: `sent` means the SMTP server accepted it, not that it was delivered; `not_requested` means none was attempted \u2014 the caller asked for none, or the app has no `invite_url` for a link to point at; `not_configured` is an expected state and not a failure; `failed` is the one worth somebody's attention."
+    description: "What happened to the mail: `sent` means the SMTP server accepted it, not that it was delivered; `not_requested` means none was attempted because the caller asked for none; `not_configured` is an expected state and not a failure; `failed` is the one worth somebody's attention."
   })
 });
 var pendingAppInvitation = appInvitation.omit({ accept_url: true, mail: true });
@@ -3968,6 +4073,31 @@ var allowedOrigin = z12.string().max(200).refine((v) => {
   }
 }, { message: "must be a bare origin (scheme, host, port) over https, or over http on localhost" });
 var emailDomain = z12.string().min(1).max(253).regex(/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/, "must be a lowercase domain name with at least two labels");
+var appSignInMethods = z12.object({
+  password: z12.boolean().meta({
+    description: "Whether app users may sign in with a password. Off refuses `POST /api/client/login` with `method_not_allowed`, and registration and invitations then take no password."
+  }),
+  email_code: z12.boolean().meta({
+    description: "Whether app users may sign in with a six-digit code mailed to them, valid ten minutes. A code needs no URL, so it works in local development and in an app with no web UI."
+  })
+}).strict().refine((m) => m.password || m.email_code, { message: "At least one sign-in method must be on.", path: ["password"] });
+var appTwoFactorPolicy = z12.enum(["off", "optional", "required"]);
+var appHomeUrl = z12.url().max(500).refine((v) => {
+  try {
+    const u = new URL(v);
+    const hostOk = u.protocol === "https:" || u.protocol === "http:" && ["localhost", "127.0.0.1"].includes(u.hostname);
+    return hostOk && !v.includes("{");
+  } catch {
+    return false;
+  }
+}, { message: "An https URL (http only on localhost) without a placeholder." });
+var hostedAccent = z12.string().regex(/^#[0-9a-f]{6}$/, "must be a lowercase hex colour, #rrggbb");
+var appHostedPages = z12.object({
+  invite_url: z12.url().meta({ description: "The hosted invitation page, `<portal>/app/<identifier>/invite/{token}`." }),
+  verify_url: z12.url().meta({ description: "The hosted email-confirmation page, `<portal>/app/<identifier>/verify/{token}`." }),
+  reset_url: z12.url().meta({ description: "The hosted new-password page, `<portal>/app/<identifier>/reset/{token}`." }),
+  mcp_login_url: z12.url().meta({ description: "The hosted MCP sign-in, `<portal>/app/<identifier>/mcp/{interaction}`." })
+});
 var appAuthConfig = z12.object({
   self_registration: z12.boolean().meta({
     description: "Whether a stranger may create an account in this app. Off refuses `POST /api/client/register` with `403 registration_closed`, and refuses an unknown identity at an OIDC callback with the same reasoning \u2014 one switch for one decision, whichever door the person arrives at."
@@ -3982,16 +4112,34 @@ var appAuthConfig = z12.object({
     description: "Whether this app serves an MCP endpoint at `/mcp/<identifier>`. Off refuses the whole OAuth surface for the app, not merely the tool calls, and is re-read on every request rather than cached off a token."
   }),
   invite_url: appUrlTemplate("{token}").nullable().meta({
-    description: "The page in the developer's app that accepts an invitation, with `{token}` where the token goes. `null` when unconfigured, and then an invitation still issues but `send_mail` is refused with `409 target_state_conflict` \u2014 there would be nowhere for the link to point."
+    description: "The page in the developer's app that accepts an invitation, with `{token}` where the token goes. `null` means the hosted page in `hosted_pages` is used."
   }),
   verify_url: appUrlTemplate("{token}").nullable().meta({
-    description: "The page that confirms a new address, with `{token}` where the token goes. Self-registration needs it: without a page to send people to, a registration would leave an account nobody can activate."
+    description: "The page that confirms a new address, with `{token}` where the token goes. `null` means the hosted page in `hosted_pages` is used."
   }),
   reset_url: appUrlTemplate("{token}").nullable().meta({
-    description: "The page that takes a new password, with `{token}` where the token goes."
+    description: "The page that takes a new password, with `{token}` where the token goes. `null` means the hosted page in `hosted_pages` is used."
   }),
   mcp_login_url: appUrlTemplate("{interaction}").nullable().meta({
-    description: "The page an MCP authorization redirects to, with `{interaction}` where the interaction id goes. Not a token: the id names a pending request the server already holds, and the app authenticates the user itself before approving it."
+    description: "The page an MCP authorization redirects to, with `{interaction}` where the interaction id goes. Not a token: the id names a pending request the server already holds, and the app authenticates the user itself before approving it. `null` means the hosted MCP sign-in in `hosted_pages` is used."
+  }),
+  app_url: appHomeUrl.nullable().meta({
+    description: "The app's own home page, linked as `Open <app>` when a hosted flow is done. `null` makes the hosted done page say `You can close this tab`."
+  }),
+  sign_in_methods: appSignInMethods.meta({
+    description: "Which sign-in methods the app offers: password, emailed code, or both \u2014 at least one. Identity providers stay on top of either. The default is password only."
+  }),
+  two_factor: appTwoFactorPolicy.meta({
+    description: "Whether the app asks for an authenticator code: `off` (the default), `optional` or `required`. A person with a confirmed authenticator is asked at every sign-in whatever the policy; a sign-in through an identity provider is never asked."
+  }),
+  hosted_logo_url: z12.url().nullable().meta({
+    description: "Where the hosted pages load the app's logo from, `<portal>/app/<identifier>/logo`, or `null` when no logo is stored. **Read-only** \u2014 the logo is written through `PUT /api/apps/:id/auth-config/logo`."
+  }),
+  hosted_accent: hostedAccent.nullable().meta({
+    description: "The accent colour of the hosted pages, `#rrggbb` in lowercase, or `null` for the neutral shell's own."
+  }),
+  hosted_pages: appHostedPages.meta({
+    description: "The Fleetless-hosted pages an unset URL falls back to, as templates. **Read-only**: minted by the cloud from the auth portal and the app's identifier."
   }),
   oidc_callback_url: z12.url().meta({
     description: "The one callback URL to register at every identity provider, the same for every app and every provider. **Read-only** \u2014 it is minted by the cloud from its own public base URL, and a writable version of this field would let a caller point the return leg, which carries an authorization code, at a host they own."
@@ -3999,18 +4147,20 @@ var appAuthConfig = z12.object({
   updated_at: z12.iso.datetime().meta({ description: "When the configuration was last written, as an ISO 8601 timestamp." })
 });
 var putAppAuthRegistrationRequest = appAuthConfig.pick({ self_registration: true, allowed_domains: true, allowed_origins: true }).strict();
-var putAppAuthUrlsRequest = appAuthConfig.pick({ invite_url: true, verify_url: true, reset_url: true }).strict();
-var putAppAuthMcpRequest = appAuthConfig.pick({ mcp_enabled: true, mcp_login_url: true }).strict();
-var mailTemplateKind = z12.enum(["invite", "verify", "reset"]);
+var putAppAuthSignInRequest = appAuthConfig.pick({ sign_in_methods: true, two_factor: true }).strict();
+var putAppAuthUrlsRequest = appAuthConfig.pick({ app_url: true, invite_url: true, verify_url: true, reset_url: true, mcp_login_url: true }).strict();
+var putAppAuthMcpRequest = appAuthConfig.pick({ mcp_enabled: true }).strict();
+var putAppAuthLookRequest = appAuthConfig.pick({ hosted_accent: true }).strict();
+var mailTemplateKind = z12.enum(["invite", "verify", "reset", "login_code"]);
 var appMailTemplate = z12.object({
-  kind: mailTemplateKind.meta({ description: "Which of the three mails this template replaces." }),
+  kind: mailTemplateKind.meta({ description: "Which of the four mails this template replaces." }),
   subject: z12.string().min(1).max(200).meta({ description: "The subject line, a Liquid template. Bounded because a subject is rendered into a header." }),
   text: z12.string().min(1).max(2e4).meta({ description: "The plain-text body, a Liquid template. Required even when an HTML part is given: a mail with no text part is unreadable to a client that refuses HTML." }),
   html: z12.string().min(1).max(1e5).nullable().meta({ description: "The optional HTML body, a Liquid template. `null` means this template is text-only, which is a complete mail and not a half-configured one." }),
   updated_at: z12.iso.datetime().meta({ description: "When the template was last written, as an ISO 8601 timestamp." })
 });
 var appMailTemplateListResponse = z12.object({
-  templates: z12.array(appMailTemplate).max(3).meta({
+  templates: z12.array(appMailTemplate).max(4).meta({
     description: "The app's custom templates. A kind that does not appear is one using the Fleetless default text \u2014 an ordinary state, not a missing row."
   })
 });
@@ -4032,7 +4182,7 @@ var mailOutcome = z12.object({
   })
 });
 
-// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/client-auth.js
+// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/client-auth.js
 var clientLoginRequest = z13.object({
   app_identifier: appIdentifier.meta({
     description: "The app being logged in to: its globally unique, lowercase, underscore-separated identifier, chosen by the developer at creation. There is no organisation context at login, so this is what decides which app the credentials are checked for."
@@ -4054,6 +4204,49 @@ var clientLogoutRequest = z13.object({
     description: "Any refresh token of the session to end. The whole token family is revoked server-side, so a token stolen before this call stops working too \u2014 clearing a client-side store is a gesture, not a revocation. The answer is `204`: a token the server does not recognise gets it too, since that is the end state being asked for."
   })
 });
+var clientLoginCodeRequest = z13.object({
+  app_identifier: appIdentifier.meta({ description: "The app to sign in to. An identifier no app carries is `404 not_found`; the address is never the subject of a refusal." }),
+  email: z13.email().meta({
+    description: "The address to mail the code to, trimmed and compared case-insensitively. `202` whether or not it names an account of this app."
+  })
+}).strict();
+var clientLoginCodeVerifyRequest = z13.object({
+  app_identifier: appIdentifier.meta({ description: "The app the code was requested for." }),
+  email: z13.email().meta({ description: "The address the code was mailed to, as typed when it was requested; trimmed and compared case-insensitively." }),
+  code: loginCode.meta({ description: "The six digits from the mail, exactly \u2014 leading zeros included, no spaces." })
+}).strict();
+var twoFactorChallenge = z13.object({
+  status: z13.enum(["two_factor_required", "two_factor_setup_required"]).meta({
+    description: "`two_factor_required`: ask for the authenticator code. `two_factor_setup_required`: the app requires two-factor and the person has none yet, so set one up before any session exists."
+  }),
+  challenge: z13.string().min(1).meta({
+    description: "The handle the next step spends. Valid five minutes; afterwards it answers `410 token_spent` and the sign-in starts over."
+  })
+});
+var clientSignInResult = z13.union([sessionTokens, twoFactorChallenge]);
+var clientTwoFactorVerifyRequest = z13.object({
+  challenge: z13.string().min(1).meta({ description: "The challenge the sign-in step answered." }),
+  code: totpCode.optional().meta({ description: "The six-digit code the authenticator shows now. A code already accepted once is refused, so a replay of a seen code does not sign anybody in." }),
+  recovery_code: recoveryCode.optional().meta({ description: "One of the ten recovery codes, `xxxxx-xxxxx`, in either case. Spent by its use." })
+}).strict().refine((b) => b.code === void 0 !== (b.recovery_code === void 0), { message: "Send exactly one of code and recovery_code." });
+var clientTwoFactorSetupRequest = z13.object({
+  challenge: z13.string().min(1).optional().meta({
+    description: "The `two_factor_setup_required` challenge, during sign-in. Absent when the call carries the app user's bearer instead."
+  })
+}).strict();
+var clientTwoFactorSetupConfirmRequest = z13.object({
+  challenge: z13.string().min(1).optional().meta({ description: "The same challenge as at `setup`, during sign-in; absent with a bearer." }),
+  code: totpCode.meta({ description: "A code the new authenticator shows now. It proves the secret was copied correctly before anything depends on it." })
+}).strict();
+var clientTwoFactorSetupConfirmResponse = z13.object({
+  recovery_codes: recoveryCodesList.meta({
+    description: "The ten single-use recovery codes, lowercase, shown once. Any earlier set is void."
+  }),
+  session: sessionTokens.meta({ description: "The session the sign-in was waiting for, or a fresh one for the account settings." })
+});
+var clientTwoFactorDisableRequest = z13.object({
+  code: totpCode.meta({ description: "A code the authenticator shows now." })
+}).strict();
 var clientRegisterRequest = z13.object({
   app_identifier: appIdentifier.meta({
     description: "The app to register with. An identifier no app carries is `404 not_found` \u2014 an identifier is public, so naming it is no disclosure, and collapsing it into `registration_closed` sent a developer who mistyped their own identifier hunting a configuration bug that was not there. The **address** is never the subject of a refusal."
@@ -4061,8 +4254,8 @@ var clientRegisterRequest = z13.object({
   email: z13.email().meta({
     description: "The address to register. Unique per app, case-insensitively. An address this app already knows still answers `202`, without a mail \u2014 the answer may not say whether an account exists."
   }),
-  password: password.meta({
-    description: "The password for the new account. At least 12 characters; length only, because a rule a user cannot predict is a rule they work around."
+  password: password.optional().meta({
+    description: "The password for the new account, at least 12 characters. **Required while the app's password method is on, refused while it is off** \u2014 both as `400 validation_error` naming `password`. An email-code-only app registers people without one."
   }),
   display_name: z13.string().min(1).max(APP_USER_DISPLAY_NAME_MAX).nullable().optional().meta({
     description: "An optional human name for the account. The developer's own UI decides whether to ask for it."
@@ -4097,7 +4290,9 @@ var clientAcceptInvitationRequest = z13.object({
   token: z13.string().min(1).meta({
     description: "The opaque token from the invitation link, valid seven days. Unknown, expired, revoked and already-accepted all answer `410 token_spent`."
   }),
-  password: password.meta({ description: "The password the new account will use." }),
+  password: password.optional().meta({
+    description: "The password the new account will use, at least 12 characters. **Required while the app's password method is on, refused while it is off** \u2014 both as `400 validation_error` naming `password`. An email-code-only app accepts invitations without one."
+  }),
   display_name: z13.string().min(1).max(APP_USER_DISPLAY_NAME_MAX).nullable().optional().meta({
     description: "An optional name, overriding whatever the invitation pre-filled."
   })
@@ -4111,7 +4306,10 @@ var clientProviderListResponse = z13.object({
     slug: providerSlug.meta({ description: "The handle to put in the start URL: `GET /api/client/oidc/<slug>/start`." }),
     name: z13.string().meta({ description: "What to write on the button, as the developer configured it." })
   })).meta({
-    description: "The app's **enabled** providers, slug and display name only. An app with none answers an empty array, which is the state of an app that offers password login alone."
+    description: "The app's **enabled** providers, slug and display name only. An app with none answers an empty array, which is the state of an app that offers password or code sign-in alone."
+  }),
+  sign_in_methods: appSignInMethods.meta({
+    description: "Which of password and emailed code the app accepts, so its sign-in page draws the right fields without guessing. The same value the developer set; public, like the provider buttons."
   })
 });
 var clientOidcStartQuery = z13.object({
@@ -4218,10 +4416,13 @@ var clientIdentity = z13.object({
   }),
   email: z13.email().nullable().meta({
     description: "The address of the Fleetless user or app user behind this session, and `null` for a server key, which is not a person."
+  }),
+  two_factor_enabled: z13.boolean().nullable().meta({
+    description: "Whether the app user has a confirmed authenticator, so the app's account settings can offer to turn it on or off. `null` unless `kind` is `app_user`."
   })
 });
 
-// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/realtime.js
+// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/realtime.js
 var clientAuth = z14.object({
   type: z14.literal("auth"),
   token: z14.string().min(1)
@@ -4499,34 +4700,59 @@ var orgEventDropped = z14.object({
   dropped: z14.number().int().positive()
 }).strict();
 
-// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/client-robots.js
+// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/feedback.js
 import { z as z15 } from "zod";
-var clientRobotListItem = z15.object({
+var FEEDBACK_KINDS = ["idea", "problem", "question", "other"];
+var feedbackKind = z15.enum(FEEDBACK_KINDS);
+var FEEDBACK_MESSAGE_MAX = 5e3;
+var feedbackRequest = z15.object({
+  kind: feedbackKind.meta({
+    description: "What the message is: an `idea`, a `problem`, a `question` or `other`. It only sorts the inbox; it changes nothing about how the message is handled."
+  }),
+  message: z15.string().trim().min(1).max(FEEDBACK_MESSAGE_MAX).meta({
+    description: "What the developer wrote, trimmed. At most 5000 characters; a message that is only whitespace is refused."
+  }),
+  page: z15.string().startsWith("/").max(512).meta({
+    description: "The console path the message was sent from, e.g. `/robots/:id/jobs` with its real id. A path, never a full URL, so no host and no query string reach the inbox by accident."
+  })
+}).strict();
+var feedbackResponse = z15.object({
+  id: z15.uuid().meta({
+    description: "The stored message. It exists whatever `mail` says."
+  }),
+  mail: mailStatus.meta({
+    description: "What happened to the notification mail: `sent`, `failed`, or `not_configured` when this cloud has no feedback address. The message is stored in every case, so a client shows success for all three."
+  })
+}).strict();
+
+// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/client-robots.js
+import { z as z16 } from "zod";
+var clientRobotListItem = z16.object({
   ...robot.shape,
   bridge_state: bridgeState.meta({
     description: "The built-in `bridge_state` datapoint as the cloud observes it right now: whether the bridge is connected, and its latency when it is."
   }),
-  published_version: z15.number().int().positive().nullable().meta({
+  published_version: z16.number().int().positive().nullable().meta({
     description: 'The published configuration version, or `null` when nothing has been published yet. A robot with nothing published is still listed \u2014 "not configured yet" is a real state, and the caller is entitled to it \u2014 and its datasheet answers an empty exposure list.'
   })
 });
-var clientRobotListResponse = z15.object({
-  robots: z15.array(clientRobotListItem).meta({
+var clientRobotListResponse = z16.object({
+  robots: z16.array(clientRobotListItem).meta({
     description: "Every robot the caller reaches, in name order with the id as the tiebreak. An app user reaches the robots their app attaches on which their role grants at least one slug or capability; a server key reaches every robot its app attaches; a developer reaches every robot of the organisation."
   })
 });
 
-// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/audit.js
-import { z as z16 } from "zod";
-var auditActor = z16.object({
-  kind: z16.enum(["developer", "end_user", "app_user", "server_key", "bridge"]),
-  id: z16.uuid(),
-  label: z16.string().min(1).max(200)
-});
-var auditEvent = z16.object({
-  id: z16.uuid(),
-  org_id: z16.uuid(),
-  at: z16.iso.datetime(),
+// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/audit.js
+import { z as z17 } from "zod";
+var auditActor = z17.object({
+  kind: z17.enum(["developer", "end_user", "app_user", "server_key", "bridge"]),
+  id: z17.uuid(),
+  label: z17.string().min(1).max(200)
+});
+var auditEvent = z17.object({
+  id: z17.uuid(),
+  org_id: z17.uuid(),
+  at: z17.iso.datetime(),
   /**
    * A monotonic counter, ascending in write order, unique across the log.
    *
@@ -4545,18 +4771,18 @@ var auditEvent = z16.object({
    * Required, not optional: an event without a sequence cannot be ordered
    * against one that has it, and a log with two orderings has none.
    */
-  seq: z16.number().int().positive(),
+  seq: z17.number().int().positive(),
   actor: auditActor,
   /** Stable dotted name, e.g. `app_user.login`, `config.published`. */
-  action: z16.string().min(1).max(80),
+  action: z17.string().min(1).max(80),
   /**
    * What the action was about, if anything — a robot, an app, a user. Free
    * of ids the console cannot resolve: carry the label with it.
    */
-  target: z16.object({
-    kind: z16.string().min(1).max(40),
-    id: z16.string().min(1),
-    label: z16.string().min(1).max(200)
+  target: z17.object({
+    kind: z17.string().min(1).max(40),
+    id: z17.string().min(1),
+    label: z17.string().min(1).max(200)
   }).nullable(),
   /**
    * Action-specific extras.
@@ -4570,10 +4796,10 @@ var auditEvent = z16.object({
    * So: never credentials, never tokens. That is a rule, not a guarantee the
    * schema enforces.
    */
-  details: z16.record(z16.string(), z16.unknown()).nullable()
+  details: z17.record(z17.string(), z17.unknown()).nullable()
 });
 var auditTimestampMs = wireTimestampMs;
-var auditQuery = z16.object({
+var auditQuery = z17.object({
   /** Only events with a smaller `seq` — the next, older page. */
   before_seq: wireSeqCursor.optional(),
   /**
@@ -4582,9 +4808,9 @@ var auditQuery = z16.object({
    * coercion's result in either `io` direction, so the artifact would describe
    * a shape a query string can never carry.
    */
-  limit: z16.union([z16.string().regex(/^\d{1,4}$/), z16.number().int()]).transform((v) => Number(v)).pipe(z16.number().int().positive().max(500)).optional(),
+  limit: z17.union([z17.string().regex(/^\d{1,4}$/), z17.number().int()]).transform((v) => Number(v)).pipe(z17.number().int().positive().max(500)).optional(),
   /** Exact action name, e.g. `config.published`. No prefix matching: a filter that matches more than it says is not one. */
-  action: z16.string().min(1).max(80).optional(),
+  action: z17.string().min(1).max(80).optional(),
   /**
    * Everything under a dotted prefix, e.g. `server_key.` for all three
    * server-key actions.
@@ -4601,7 +4827,7 @@ var auditQuery = z16.object({
    * happily. The cloud is the only enforcement point — the same residual
    * `orgLatencyQuery` and `orgUsageQuery` already name.
    */
-  action_prefix: z16.string().min(1).max(80).optional(),
+  action_prefix: z17.string().min(1).max(80).optional(),
   /**
    * Only events by this actor.
    *
@@ -4613,9 +4839,21 @@ var auditQuery = z16.object({
    * Not an injection question — the query is parameterised either way. It is a
    * **500 where a 400 belongs**, and a 500 is the answer that explains nothing.
    */
-  actor_id: z16.uuid().optional(),
+  actor_id: z17.uuid().optional(),
   /** Only events about this kind of target, e.g. `robot`. */
-  target_kind: z16.string().min(1).max(40).optional(),
+  target_kind: z17.string().min(1).max(40).optional(),
+  /**
+   * Only events about this target — and, for a robot, also the events that
+   * name it in `details.robot_id`, so a robot's log includes what was
+   * started on it.
+   *
+   * **A string, not `z.uuid()`**, unlike `actor_id` above: `target.id` is a
+   * string in this contract and text in the cloud's table, so a uuid rule
+   * here would refuse ids the log can hold, and no value can fail a cast.
+   */
+  target_id: z17.string().min(1).max(200).optional().meta({
+    description: "Events whose target is this id; for a robot also the events that name it in `details.robot_id` (`action.invoked`, `service.called`, \u2026), so a robot's events include what was started on it."
+  }),
   /**
    * Absolute bounds in unix milliseconds, **half-open `[from, to)`** — the
    * same rule the history shapes follow.
@@ -4631,8 +4869,8 @@ var auditQuery = z16.object({
   message: "action and action_prefix cannot be combined",
   path: ["action_prefix"]
 });
-var auditListResponse = z16.object({
-  events: z16.array(auditEvent),
+var auditListResponse = z17.object({
+  events: z17.array(auditEvent),
   /**
     * The `seq` a caller sends as `before_seq` to keep reading — or `null` when
     * there is nothing further.
@@ -4643,32 +4881,37 @@ var auditListResponse = z16.object({
     * not mean *no more* here. The same distinction `historySamples` was given
     * `truncated` for.
     */
-  next_cursor: z16.number().int().positive().nullable()
+  next_cursor: z17.number().int().positive().nullable()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/errors.js
-import { z as z17 } from "zod";
-var apiError = z17.object({
-  code: z17.string().min(1),
-  message: z17.string().min(1),
-  details: z17.unknown().optional()
+// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/errors.js
+import { z as z18 } from "zod";
+var apiError = z18.object({
+  code: z18.string().min(1),
+  message: z18.string().min(1),
+  details: z18.unknown().optional()
 });
-var parameterViolation = z17.object({
-  field: z17.string().min(1),
+var parameterViolation = z18.object({
+  field: z18.string().min(1),
   /** Which rule failed — `min`, `max`, `enum`, `pattern`, `required`, `undeclared`. */
-  rule: z17.string().min(1),
-  message: z17.string().min(1)
+  rule: z18.string().min(1),
+  message: z18.string().min(1)
+});
+var parameterInvalidDetails = z18.object({
+  violations: z18.array(parameterViolation).min(1)
 });
-var parameterInvalidDetails = z17.object({
-  violations: z17.array(parameterViolation).min(1)
+var cancelRejectedDetails = z18.object({
+  goals: z18.array(bridgeCancelResultEntry).min(1)
 });
-var cancelRejectedDetails = z17.object({
-  goals: z17.array(bridgeCancelResultEntry).min(1)
+var invalidCodeDetails = z18.object({
+  attempts_left: z18.number().int().min(0).meta({
+    description: "How many more wrong codes this code or challenge takes before it is spent. `0` means the next attempt answers `410 token_spent`."
+  })
 });
 
-// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/oauth.js
-import { z as z18 } from "zod";
-var oauthErrorCode = z18.enum([
+// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/oauth.js
+import { z as z19 } from "zod";
+var oauthErrorCode = z19.enum([
   "invalid_request",
   "invalid_client",
   "invalid_grant",
@@ -4681,11 +4924,11 @@ var oauthErrorCode = z18.enum([
   /** RFC 8707: the `resource` named is not one this server issues tokens for. */
   "invalid_target"
 ]);
-var oauthError = z18.object({
+var oauthError = z19.object({
   error: oauthErrorCode,
-  error_description: z18.string().min(1).max(500).optional(),
+  error_description: z19.string().min(1).max(500).optional(),
   /** Echoed back per RFC 6749 §4.1.2.1 so a client can match the response. */
-  state: z18.string().min(1).max(500).optional(),
+  state: z19.string().min(1).max(500).optional(),
   /**
    * **A Fleetless reason carried inside a standard envelope, and it exists
    * because the alternative lost a distinction.**
@@ -4703,9 +4946,9 @@ var oauthError = z18.object({
    * our own tooling switches on. RFC 6749 §5.2 permits additional members, and
    * a client that ignores this one still behaves correctly.
    */
-  fleetless_code: z18.string().min(1).max(60).optional()
+  fleetless_code: z19.string().min(1).max(60).optional()
 });
-var redirectUri = z18.string().min(1).max(2e3).refine((v) => {
+var redirectUri = z19.string().min(1).max(2e3).refine((v) => {
   let url;
   try {
     url = new URL(v);
@@ -4720,180 +4963,180 @@ var redirectUri = z18.string().min(1).max(2e3).refine((v) => {
     return ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
   return false;
 }, { message: "redirect_uri must be an https URL, or http on an explicit loopback address, and carry no fragment" });
-var codeChallengeMethod = z18.enum(["S256"]);
+var codeChallengeMethod = z19.enum(["S256"]);
 var MCP_DCR_MAX_REDIRECT_URIS = 5;
-var dynamicClientRegistrationRequest = z18.object({
-  redirect_uris: z18.array(redirectUri).min(1).max(MCP_DCR_MAX_REDIRECT_URIS).meta({
+var dynamicClientRegistrationRequest = z19.object({
+  redirect_uris: z19.array(redirectUri).min(1).max(MCP_DCR_MAX_REDIRECT_URIS).meta({
     description: `Where the authorization code may be returned, and the one field a registration cannot omit. Each must be an \`https\` URL, or \`http\` on an explicit loopback address for a native app that cannot hold a certificate, and none may carry a fragment. Between \`1\` and \`${MCP_DCR_MAX_REDIRECT_URIS}\` of them; duplicates are collapsed rather than counted twice. Matched **exactly** at the authorize step against what was registered here.`
   }),
-  client_name: z18.string().min(1).max(200).optional().meta({
+  client_name: z19.string().min(1).max(200).optional().meta({
     description: 'The name the client calls itself. Optional: RFC 7591 makes every metadata field optional, so a registration without one is recorded under a default name. It is **not** vouched for by Fleetless and must never be rendered as if it were: a self-registered client chooses this string, and one has called itself *"Fleetless Official Helper"*.'
   }),
-  token_endpoint_auth_method: z18.enum(["none"]).optional().meta({
+  token_endpoint_auth_method: z19.enum(["none"]).optional().meta({
     description: "`none`, RFC 7591's value for a public client, and the only value either server registers. Any other value is **refused rather than silently downgraded**: a client that believes it holds a secret and does not has a wrong mental model of its own security. There is no client secret to hold \u2014 mandatory PKCE (`S256`) is the defence."
   }),
-  grant_types: z18.array(z18.enum(["authorization_code", "refresh_token"])).optional().meta({
+  grant_types: z19.array(z19.enum(["authorization_code", "refresh_token"])).optional().meta({
     description: "Accepted for conformance with RFC 7591 and then **ignored**: both MCP authorization servers grant `authorization_code` and `refresh_token` to every registration, and the answer states what was granted (\xA73.2.1) rather than what was asked."
   }),
-  response_types: z18.array(z18.enum(["code"])).optional().meta({
+  response_types: z19.array(z19.enum(["code"])).optional().meta({
     description: "Accepted for conformance and then **ignored**; the response names `code`, which is the only response type OAuth 2.1 leaves, the implicit grant having been removed."
   }),
-  scope: z18.string().max(500).optional().meta({
+  scope: z19.string().max(500).optional().meta({
     description: "Accepted for conformance and then **ignored**. This authorization server issues no scopes at all, which is why the registration answer carries no `scope` field to echo one back in."
   })
 }).meta({
   description: "What an MCP client sends to register itself, per RFC 7591. Unknown metadata is ignored rather than refused (\xA73.1), and the answer states what was actually granted rather than what was asked for (\xA73.2.1)."
 });
-var dynamicClientRegistrationResponse = z18.object({
-  client_id: z18.string().min(1).max(200).meta({
+var dynamicClientRegistrationResponse = z19.object({
+  client_id: z19.string().min(1).max(200).meta({
     description: "The identifier this client sends at the authorize and token endpoints. Opaque, and not the app identifier."
   }),
-  client_name: z18.string().min(1).max(200).meta({
+  client_name: z19.string().min(1).max(200).meta({
     description: "The name the client registered under, echoed back. Chosen by the client and not vouched for by Fleetless."
   }),
-  redirect_uris: z18.array(redirectUri).meta({
+  redirect_uris: z19.array(redirectUri).meta({
     description: "The redirect URIs this registration was accepted for. A code is returned to one of these and nowhere else."
   }),
-  grant_types: z18.array(z18.string()).meta({
+  grant_types: z19.array(z19.string()).meta({
     description: 'The grants this client may use. Always exactly `["authorization_code", "refresh_token"]` \u2014 an exchange mints a refresh token and the token endpoint rotates it.'
   }),
-  response_types: z18.array(z18.string()).meta({
+  response_types: z19.array(z19.string()).meta({
     description: "The response types this client may ask for: `code`."
   }),
-  token_endpoint_auth_method: z18.literal("none").meta({
+  token_endpoint_auth_method: z19.literal("none").meta({
     description: "`none` \u2014 this server registers public clients only, and PKCE rather than a secret is what protects the exchange."
   }),
-  client_id_issued_at: z18.number().int().nonnegative().meta({
+  client_id_issued_at: z19.number().int().nonnegative().meta({
     description: "When the registration was created, in seconds since the epoch, per RFC 7591."
   }),
-  client_secret_expires_at: z18.literal(0).meta({
+  client_secret_expires_at: z19.literal(0).meta({
     description: "Always `0`, which is RFC 7591's way of saying the client secret never expires \u2014 there is none. The **registration** itself does expire: a self-registered client that never completes a flow is an unauthenticated write somebody left behind."
   })
 });
-var oauthCodeTokenRequest = z18.object({
-  grant_type: z18.literal("authorization_code").meta({
+var oauthCodeTokenRequest = z19.object({
+  grant_type: z19.literal("authorization_code").meta({
     description: "`authorization_code`: this request exchanges the code from the authorize redirect for an access token and a refresh token."
   }),
-  code: z18.string().min(1).max(500).meta({
+  code: z19.string().min(1).max(500).meta({
     description: "The authorization code from the redirect. It may be exchanged once; a second presentation is `invalid_grant`, the same answer a fabricated code gets."
   }),
   redirect_uri: redirectUri.meta({
     description: "The same redirect URI the authorize request used. It is compared, not merely recorded."
   }),
-  client_id: z18.string().min(1).max(200).meta({
+  client_id: z19.string().min(1).max(200).meta({
     description: "The client making the exchange, as registered."
   }),
-  code_verifier: z18.string().regex(/^[A-Za-z0-9\-._~]{43,128}$/, "code_verifier must be 43-128 unreserved characters (RFC 7636 \xA74.1)").meta({
+  code_verifier: z19.string().regex(/^[A-Za-z0-9\-._~]{43,128}$/, "code_verifier must be 43-128 unreserved characters (RFC 7636 \xA74.1)").meta({
     description: "The PKCE verifier whose `S256` hash was sent as the challenge at the authorize step. Between `43` and `128` unreserved characters, per RFC 7636 \xA74.1 \u2014 it is compared rather than parsed, so a length nobody checks is a length an attacker chooses. PKCE is mandatory for every client under OAuth 2.1."
   }),
-  resource: z18.url().optional().meta({
+  resource: z19.url().optional().meta({
     description: "The resource the token is requested for, per RFC 8707. It must match the audience the code was authorized for, or the answer is `invalid_target`; omitted, the code's own audience stands. It becomes the token's `aud`, and a resource refuses a token whose audience names something else \u2014 which is what keeps a token minted for one app out of another app's endpoint."
   })
 }).meta({
   description: "RFC 6749 \xA74.1.3's authorization-code exchange with PKCE, as either MCP authorization server reads it. Sent as `application/x-www-form-urlencoded`, per \xA74.1.3, though the server accepts a JSON body too."
 });
-var oauthRefreshTokenRequest = z18.object({
-  grant_type: z18.literal("refresh_token").meta({
+var oauthRefreshTokenRequest = z19.object({
+  grant_type: z19.literal("refresh_token").meta({
     description: "`refresh_token`: this request rotates a refresh token into a new access token and a new refresh token. The presented token is consumed; presenting it again revokes the whole session."
   }),
-  refresh_token: z18.string().min(1).max(500).meta({
+  refresh_token: z19.string().min(1).max(500).meta({
     description: "The refresh token from the last token response. Bound to the client that received it and to one identity space: presented by another client, or at the other MCP server, it is `invalid_grant` and stays unconsumed."
   }),
-  client_id: z18.string().min(1).max(200).meta({
+  client_id: z19.string().min(1).max(200).meta({
     description: "The client the refresh token was issued to, as registered. A refresh token is not transferable between clients."
   }),
-  resource: z18.url().optional().meta({
+  resource: z19.url().optional().meta({
     description: "The resource the new token is for, per RFC 8707. Optional; when named it must be the audience the session was issued for, or the answer is `invalid_target` and the refresh token is left untouched. The successor carries the same audience either way."
   })
 }).meta({
   description: "RFC 6749 \xA76's refresh, as either MCP authorization server reads it. Every use rotates: the answer carries a new refresh token and the presented one is dead."
 });
-var oauthTokenRequest = z18.discriminatedUnion("grant_type", [oauthCodeTokenRequest, oauthRefreshTokenRequest]).meta({
+var oauthTokenRequest = z19.discriminatedUnion("grant_type", [oauthCodeTokenRequest, oauthRefreshTokenRequest]).meta({
   description: "What an MCP token endpoint accepts: the authorization-code exchange, or a refresh. Any other `grant_type` is `unsupported_grant_type`, refused before a lookup happens."
 });
-var oauthTokenResponse = z18.object({
-  access_token: z18.string().min(1).meta({
+var oauthTokenResponse = z19.object({
+  access_token: z19.string().min(1).meta({
     description: "The bearer token. It is the same token the client login mints \u2014 only the envelope differs, because an RFC-compliant client parses this one and knows nothing about Fleetless."
   }),
-  token_type: z18.literal("Bearer").meta({
+  token_type: z19.literal("Bearer").meta({
     description: "`Bearer`. RFC 6749 \xA75.1 makes the value case-insensitive for a client reading it; this is the spelling this server emits."
   }),
-  expires_in: z18.number().int().positive().meta({
+  expires_in: z19.number().int().positive().meta({
     description: "How long the access token is valid, in **seconds**, per RFC 6749 \xA75.1. Not a timestamp, and not milliseconds."
   }),
-  refresh_token: z18.string().min(1).optional().meta({
+  refresh_token: z19.string().min(1).optional().meta({
     description: "The refresh token. Both MCP token endpoints issue one on every exchange and every refresh; it rotates on every use, lives ninety days from its last use, and dies with the account's sessions \u2014 a block, a password change, a withdrawn consent. The console's own OAuth portal issues none."
   }),
-  scope: z18.string().max(500).optional().meta({
+  scope: z19.string().max(500).optional().meta({
     description: "The scopes the issued token actually carries, space-separated."
   })
 });
-var authorizationServerMetadata = z18.object({
-  issuer: z18.url().meta({
+var authorizationServerMetadata = z19.object({
+  issuer: z19.url().meta({
     description: "The issuer identifier of this authorization server, per RFC 8414 \xA72. It is what a client checks a token's `iss` against."
   }),
-  authorization_endpoint: z18.url().meta({
+  authorization_endpoint: z19.url().meta({
     description: "Where a client sends the user to authorize."
   }),
-  token_endpoint: z18.url().meta({
+  token_endpoint: z19.url().meta({
     description: "The URL where a client exchanges an authorization code, or a refresh token, for tokens."
   }),
-  registration_endpoint: z18.url().optional().meta({
+  registration_endpoint: z19.url().optional().meta({
     description: "The URL where a client may register itself, per RFC 7591. Absent when the app does not accept dynamic clients."
   }),
-  response_types_supported: z18.array(z18.literal("code")).meta({
+  response_types_supported: z19.array(z19.literal("code")).meta({
     description: "The response types this server offers: `code` only, the implicit grant being gone with OAuth 2.1."
   }),
-  grant_types_supported: z18.array(z18.enum(["authorization_code", "refresh_token"])).meta({
+  grant_types_supported: z19.array(z19.enum(["authorization_code", "refresh_token"])).meta({
     description: "The grants this server offers: `authorization_code` and `refresh_token`. OAuth 2.1 removes the implicit and password grants, so neither appears here."
   }),
-  code_challenge_methods_supported: z18.array(codeChallengeMethod).meta({
+  code_challenge_methods_supported: z19.array(codeChallengeMethod).meta({
     description: "The PKCE challenge methods accepted: `S256` only. `plain` is not offered \u2014 a challenge equal to its verifier defends against nothing, and offering it would make a downgrade negotiable."
   }),
-  token_endpoint_auth_methods_supported: z18.array(z18.literal("none")).meta({
+  token_endpoint_auth_methods_supported: z19.array(z19.literal("none")).meta({
     description: "How a client authenticates at the token endpoint: `none`, the public-client method, with PKCE protecting the exchange."
   }),
-  scopes_supported: z18.array(z18.string()).optional().meta({
+  scopes_supported: z19.array(z19.string()).optional().meta({
     description: "The scopes this server knows about, where it publishes a list."
   })
 });
-var protectedResourceMetadata = z18.object({
-  resource: z18.url().meta({
+var protectedResourceMetadata = z19.object({
+  resource: z19.url().meta({
     description: "The resource identifier this document describes, per RFC 9728. A token whose audience names something else is rejected here rather than merely noted."
   }),
-  authorization_servers: z18.array(z18.url()).min(1).meta({
+  authorization_servers: z19.array(z19.url()).min(1).meta({
     description: "The authorization servers that may issue tokens for this resource. There is always at least one."
   }),
-  bearer_methods_supported: z18.array(z18.literal("header")).meta({
+  bearer_methods_supported: z19.array(z19.literal("header")).meta({
     description: "How a token may be presented: in the `Authorization` header only, never in a query parameter or a form field."
   }),
-  scopes_supported: z18.array(z18.string()).optional().meta({
+  scopes_supported: z19.array(z19.string()).optional().meta({
     description: "The scopes this resource understands, where it publishes a list."
   })
 });
-var oauthRedirectResponse = z18.object({
-  redirect_to: z18.string().min(1).max(2e3)
+var oauthRedirectResponse = z19.object({
+  redirect_to: z19.string().min(1).max(2e3)
 });
-var oauthAuthorizeQuery = z18.object({
-  response_type: z18.literal("code").meta({
+var oauthAuthorizeQuery = z19.object({
+  response_type: z19.literal("code").meta({
     description: "Always `code`. RFC 6749 \xA74.1.2.1 names `unsupported_response_type` for any other value, but `oauthErrorCode` has no such member \u2014 this server issues no other grant from this endpoint \u2014 so an unsupported value comes back on the callback as `invalid_request`."
   }),
-  client_id: z18.string().min(1).meta({
+  client_id: z19.string().min(1).meta({
     description: "The OAuth client, self-registered or the one well-known central client \u2014 **not** the app identifier. Unknown, expired-dynamic and mismatched clients all collapse into the same `400 invalid_client`, answered without a redirect."
   }),
-  redirect_uri: z18.string().min(1).meta({
+  redirect_uri: z19.string().min(1).meta({
     description: "One of the client's registered redirect URIs, compared **exactly** \u2014 string equality against the registered list, never a prefix or a host match. Both the shape (`redirectUri`) and the registration are checked, and a failure of either is a `400 invalid_request` with no redirect."
   }),
-  code_challenge: z18.string().min(1).meta({
+  code_challenge: z19.string().min(1).meta({
     description: "The PKCE challenge; the verifier is presented at the token endpoint. Only non-emptiness is checked here \u2014 length and alphabet are not \u2014 since the verifier is what has to match."
   }),
-  code_challenge_method: z18.literal("S256").meta({
+  code_challenge_method: z19.literal("S256").meta({
     description: "Only `S256`. `plain` is refused: a challenge equal to its verifier defends against nothing."
   }),
-  state: z18.string().optional().meta({
+  state: z19.string().optional().meta({
     description: "Returned unchanged on the callback, and on the error redirect too, so a client can bind either answer to its own request."
   }),
-  resource: z18.string().optional().meta({
+  resource: z19.string().optional().meta({
     description: "RFC 8707 resource indicator: the API origin or the MCP endpoint the token is for. Checked against the resources this server issues tokens for **on behalf of this client's app**; a mismatch is `invalid_target` on the callback."
   })
   // **No `scope`, because this authorization server issues none.** The field
@@ -4906,7 +5149,7 @@ var oauthAuthorizeQuery = z18.object({
   description: "The authorization request an MCP client sends, per RFC 6749 \xA74.1.1 with mandatory PKCE. The handler reads it parameter by parameter rather than through one parse, because the answers differ: `client_id` and `redirect_uri` are refused flat, with no redirect, since until both are confirmed there is no trusted target to bounce a browser to, and everything after them is reported to the client's own callback as query parameters."
 });
 
-// node_modules/.pnpm/@fleetless+contracts@5.1.0-next.1/node_modules/@fleetless/contracts/dist/routes.js
+// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/routes.js
 var MCP_APP = MCP_APP_PATHS(":appIdentifier");
 var APP_IDENTIFIER = {
   name: "appIdentifier",
@@ -4923,11 +5166,123 @@ var IN_HANDLER_ROUTES = [
   // The one route whose bearer is **optional**: it answers the same document
   // with or without one, and only `already_granted` moves.
   "GET /api/client/mcp/interactions/:id",
+  // Two-factor setup: during sign-in the challenge in the body is the
+  // credential, from the app's account settings the app user's bearer is.
+  // Either one, decided in the handler.
+  "POST /api/client/two-factor/setup",
+  "POST /api/client/two-factor/setup/confirm",
   "GET /api/asset-links/missing",
   "GET /api/asset-links/:token"
 ];
 var DEVELOPER_GUARD = ["unauthorized", "token_expired", "token_revoked"];
 var CLIENT_GUARD = ["unauthorized", "token_expired", "token_revoked", "forbidden"];
+function developerSignInRoutes(prefix) {
+  const section = prefix === "/console/oauth" ? "developer-auth" : "mcp";
+  const done = prefix === "/console/oauth" ? "the console callback with the authorization code" : "the consent screen for a self-registered client, or straight to the callback for the central one";
+  const page = (path, summary, notes) => ({
+    method: "GET",
+    path: `${prefix}${path}`,
+    section,
+    summary,
+    audience: "internal",
+    auth: "none",
+    rateLimited: false,
+    ownerTier: false,
+    status: 200,
+    params: [{ name: "id", description: "The interaction id of this sign-in; the step before redirects the browser here." }],
+    query: null,
+    request: null,
+    response: null,
+    errors: [],
+    transport: "http",
+    notes
+  });
+  const step = (path, summary, response, errors, notes) => ({
+    method: "POST",
+    path: `${prefix}${path}`,
+    section,
+    summary,
+    audience: "internal",
+    auth: "none",
+    rateLimited: true,
+    ownerTier: false,
+    status: 200,
+    params: [],
+    query: null,
+    request: null,
+    response,
+    errors: ["rate_limited", ...errors],
+    transport: "http",
+    notes
+  });
+  return [
+    step("/identify", "Takes the email address, mails a sign-in code and hands back the code step.", null, ["validation_error", "token_spent", "wrong_browser"], `The page answers \`Check your email\` **for every address**: a known one gets \`Your Fleetless sign-in code\`, six digits valid ten minutes; an unknown one gets a mail saying no Fleetless account uses it, with a link to sign up (or the waiting list while sign-up is closed). So the page never reveals who has an account, and the address is trimmed and compared case-insensitively. A request within sixty seconds of the last one for the same address renders the same page without a second mail. The browser-proof cookie is set here when the interaction has none yet, and checked when it has. A browser form post gets the code card; a JSON caller gets \`{ "next": "${prefix}/code" }\`, which has no schema. A dead interaction is \`410 token_spent\`.`),
+    step("/code", "Checks the emailed code and finishes the sign-in, or hands back the second step.", oauthRedirectResponse, ["validation_error", "token_spent", "wrong_browser", "invalid_code"], `A wrong code renders the code card again with the attempts left (\`400 invalid_code\`, \`details.attempts_left\`); a code spent, past its ten minutes or out of its five attempts is \`410 token_spent\` and a new one has to be asked for. Spaces inside a typed code are removed before it is checked. With no second factor to give, a browser gets a \`303\` to ${done}, and a JSON caller that URL as \`redirect_to\`. Otherwise the next step: a JSON caller gets \`{ "next" }\` naming \`` + prefix + "/two-factor` \u2014 the person has a passkey or an authenticator \u2014 or `" + prefix + "/two-factor/setup` \u2014 the organisation requires one and the person has none \u2014 and a browser the page itself. Audited as `developer.login` with `details.method` `email_code` once the sign-in completes."),
+    page("/two-factor/:id", "Serves the second step: the authenticator code, or the passkey prompt.", "HTML. Six boxes for the authenticator code, `Use a passkey`, and `Use a recovery code`; a developer with passkeys only sees the passkey prompt directly. The browser-proof cookie is checked on this GET too. A dead interaction renders the `410` page."),
+    page("/two-factor/:id/recovery", "Serves the recovery-code page of the second step.", "HTML. One field for a recovery code, and the way out when none is left: an owner of the organisation can reset the member's two-factor in Settings \u203A Team."),
+    step("/two-factor", "Checks an authenticator code or a recovery code and finishes the sign-in.", oauthRedirectResponse, ["validation_error", "token_spent", "wrong_browser", "invalid_code"], `The form carries either \`code\` or \`recovery_code\`. **An authenticator code is accepted at most once**, so the same code sent twice finishes one sign-in. A recovery code is spent by its use. Five wrong codes end the interaction (\`410 token_spent\`). A browser gets a \`303\` to ${done}; a JSON caller that URL as \`redirect_to\`.`),
+    step("/passkey/options", "Answers the WebAuthn request options for a passkey sign-in or second step.", webauthnOptionsResponse, ["token_spent", "wrong_browser"], "Before an address is known the options name no credential, so the browser offers every discoverable passkey for `fleetless.dev` (`Sign in with a passkey`); after the code step they name the account's own passkeys. User verification is required. The challenge is bound to the interaction and single-use. **This is the first step of a passkey sign-in**, which has no email step: the browser-proof cookie is set here when the interaction has none yet, and checked when it has \u2014 so `POST " + prefix + "/passkey` can require it."),
+    step("/passkey", "Checks a passkey assertion; a passkey completes the sign-in on its own.", oauthRedirectResponse, ["validation_error", "token_spent", "wrong_browser", "invalid_credentials"], `**A passkey is a full sign-in**: it proves possession and user verification, two factors, so it skips the emailed code and the second step \u2014 used as the second step, it finishes it. An assertion that does not verify, or names no passkey of an account, is \`401 invalid_credentials\`, the same answer for both. When the organisation requires two-factor, a passkey satisfies it. A browser gets a \`303\` to ${done}; a JSON caller that URL as \`redirect_to\`. Audited as \`developer.login\` with \`details.method\` \`passkey\`.`),
+    page("/two-factor/setup/:id", 'Serves the "your organisation requires two-factor" choice between a passkey and an authenticator.', "HTML. Reached when the organisation requires two-factor and the person has none; no session exists until the setup is done. Two options, the passkey recommended because it also signs the person in without an emailed code. `Signed in as <email> \xB7 Sign out` under it."),
+    step("/two-factor/setup/totp", "Starts an authenticator setup inside the sign-in and hands back its QR code and key.", twoFactorSetupResponse, ["token_spent", "wrong_browser"], "A browser gets the page with the QR code, the key and the confirm field; a JSON caller the secret and `otpauth_url`. Nothing is stored as confirmed yet."),
+    step("/two-factor/setup/totp/confirm", "Confirms the new authenticator and hands back the ten recovery codes.", recoveryCodesResponse, ["validation_error", "token_spent", "wrong_browser", "invalid_code"], "A code that does not match is `400 invalid_code`. On success the authenticator is on and ten recovery codes are shown once; `I saved my recovery codes` then finishes the sign-in. Audited as `developer.two_factor_added` with `details.kind` `authenticator`."),
+    step("/two-factor/setup/passkey/options", "Answers the WebAuthn creation options for a passkey set up inside the sign-in.", webauthnOptionsResponse, ["token_spent", "wrong_browser"], "The same options `POST /api/auth/passkeys/options` answers a signed-in developer: relying party `fleetless.dev`, user verification required, a discoverable credential."),
+    step("/two-factor/setup/passkey", "Registers the passkey and hands back the ten recovery codes.", recoveryCodesResponse, ["validation_error", "token_spent", "wrong_browser"], "A ceremony that does not verify is `400 validation_error`. On success the passkey is stored, named after the browser's device where it says so, and ten recovery codes are shown once. Audited as `developer.two_factor_added` with `details.kind` `passkey`."),
+    step("/two-factor/setup/done", "Finishes the sign-in once the recovery codes are saved.", oauthRedirectResponse, ["token_spent", "wrong_browser"], `\`I saved my recovery codes\` gates the button on the page; the step itself only checks that a second factor now exists. A browser gets a \`303\` to ${done}; a JSON caller that URL as \`redirect_to\`.`)
+  ];
+}
+var HOSTED_TOKEN = {
+  name: "token",
+  description: "The opaque token from the mailed link; it is never sent as a query parameter."
+};
+var HOSTED_INTERACTION = {
+  name: "interaction",
+  description: "The interaction id `GET /mcp/:appIdentifier/oauth/authorize` put into the hosted MCP sign-in URL."
+};
+function hostedPage(method, path, summary, notes, params = []) {
+  return {
+    method,
+    path: `/app/:appIdentifier${path}`,
+    section: "client-auth",
+    summary,
+    audience: "internal",
+    auth: "none",
+    rateLimited: method === "POST",
+    ownerTier: false,
+    status: 200,
+    params: [APP_IDENTIFIER, ...params],
+    query: null,
+    request: null,
+    response: null,
+    errors: method === "POST" ? ["rate_limited"] : [],
+    transport: "http",
+    notes
+  };
+}
+var HOSTED_FORM = "Renders a form; only its `POST` spends the token, so a mail scanner opening the link changes nothing. ";
+var HOSTED_DEAD = "A spent, expired or unknown token renders the `410` page with the next step for its kind.";
+var HOSTED_POST = "HTML: the next page on success, the same page with the problem named on a refusal. ";
+var HOSTED_APP_ROUTES = [
+  hostedPage("GET", "/logo", "Serves the app's logo for its hosted pages.", "The stored PNG or SVG, as written through `PUT /api/apps/:id/auth-config/logo`; `404` when the app has none. **Served sandboxed**: `X-Content-Type-Options: nosniff` and `Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox`, so a script inside an SVG never runs, even opened directly. The hosted pages embed it as an image only."),
+  hostedPage("GET", "/mcp/:interaction", "Serves the hosted MCP sign-in, the page an unset `mcp_login_url` falls back to.", "HTML: the app's identity providers, then the sign-in the app offers \u2014 email and password with `Email me a sign-in code instead`, or email and `Email me a code` for a code-only app \u2014 and `Create one` when self-registration is on. A dead interaction renders the `410` page. The browser-proof cookie is set here.", [HOSTED_INTERACTION]),
+  hostedPage("POST", "/mcp/:interaction/password", "Checks the email and password of the hosted MCP sign-in.", HOSTED_POST + "One refusal for every miss, as `POST /api/client/login` answers. With a second factor to give, the two-factor page follows; otherwise the consent page.", [HOSTED_INTERACTION]),
+  hostedPage("POST", "/mcp/:interaction/code", "Mails a sign-in code for the hosted MCP sign-in and renders the code page.", HOSTED_POST + "The same page for a known and an unknown address, as `POST /api/client/login/code` answers; six boxes, `Resend code in 0:42`, and `Use password instead` where the app has passwords on.", [HOSTED_INTERACTION]),
+  hostedPage("POST", "/mcp/:interaction/code/verify", "Checks the emailed code of the hosted MCP sign-in.", HOSTED_POST + "A wrong code renders the code page with the attempts left; a spent one asks for a new code. With a second factor to give, the two-factor page follows; otherwise the consent page.", [HOSTED_INTERACTION]),
+  hostedPage("POST", "/mcp/:interaction/consent", "Records the allow-or-deny of the hosted MCP sign-in and sends the browser back to the client.", "Answers a `303` to the MCP client's callback, carrying the code or `error=access_denied`, as `POST /api/client/mcp/interactions/:id/approve` and `\u2026/deny` do. Fail-closed: anything but the Allow value denies. The browser-proof cookie set at the sign-in must match, or the `wrong_browser` page renders.", [HOSTED_INTERACTION]),
+  hostedPage("POST", "/two-factor", "Checks an authenticator or recovery code on a hosted page and finishes the sign-in it interrupted.", HOSTED_POST + "The form carries the challenge the step before answered and either `code` or `recovery_code`, checked as `POST /api/client/two-factor/verify` checks them. Success continues where the sign-in was going: the MCP consent, or the done page."),
+  hostedPage("POST", "/two-factor/setup", "Starts an authenticator setup on a hosted page, when the app requires two-factor.", HOSTED_POST + "Renders the QR code, the key with `Copy key`, and the confirm field, for the challenge the step before answered."),
+  hostedPage("POST", "/two-factor/setup/confirm", "Confirms the new authenticator on a hosted page and shows the ten recovery codes.", HOSTED_POST + "A wrong code renders the setup page again. On success the ten recovery codes are shown once, with `Copy` and `Download .txt`; `I saved my recovery codes` gates `Continue`."),
+  hostedPage("GET", "/invite/:token", "Serves the hosted invitation page, the one an unset `invite_url` falls back to.", "HTML. " + HOSTED_FORM + "Asks for a name, and a password only while the app has passwords on; announces the two-factor setup when the app requires it. " + HOSTED_DEAD, [HOSTED_TOKEN]),
+  hostedPage("POST", "/invite", "Accepts an invitation from the hosted invitation page.", HOSTED_POST + "Spends the token as `POST /api/client/invitations/accept` does; the two-factor setup follows when the app requires it, then the done page."),
+  hostedPage("GET", "/reset/:token", "Serves the hosted new-password page, the one an unset `reset_url` falls back to.", "HTML. " + HOSTED_FORM + "Says that two-factor stays on. " + HOSTED_DEAD, [HOSTED_TOKEN]),
+  hostedPage("POST", "/reset", "Sets the new password from the hosted new-password page.", HOSTED_POST + "Spends the token as `POST /api/client/password/reset/confirm` does; a person with an authenticator gives a code before the done page."),
+  hostedPage("GET", "/forgot", 'Serves the hosted "forgot your password" page.', "HTML: the address field. Reached from the hosted sign-in and the dead-link page."),
+  hostedPage("POST", "/forgot", 'Mails a reset link from the hosted "forgot your password" page.', HOSTED_POST + 'The same "check your mail" page for a known and an unknown address, as `POST /api/client/password/reset` answers.'),
+  hostedPage("GET", "/sign-up", "Serves the hosted sign-up page, when the app has self-registration on.", 'HTML: the address, a password while the app has passwords on, and an optional name. With self-registration off it renders the "registration closed" page.'),
+  hostedPage("POST", "/sign-up", "Creates an account from the hosted sign-up page and mails the confirmation link.", HOSTED_POST + 'Registers as `POST /api/client/register` does, and renders the same "check your mail" page for a new and a known address.'),
+  hostedPage("GET", "/verify/:token", "Serves the hosted email-confirmation page, the one an unset `verify_url` falls back to.", "HTML. " + HOSTED_FORM + HOSTED_DEAD, [HOSTED_TOKEN]),
+  hostedPage("POST", "/verify", "Confirms the address from the hosted email-confirmation page.", HOSTED_POST + "Spends the token as `POST /api/client/verify-email` does; the two-factor setup follows when the app requires it, then the done page.")
+];
 var ROUTES = [
   /* ------------------------------------------------------------- health */
   {
@@ -4949,24 +5304,6 @@ var ROUTES = [
     notes: "Answers `{ ok, dependencies: { database, storage, liveKit } }` \u2014 a cloud-local shape, not a wire contract, so nothing here pins it. The status is always `200`: each dependency is probed independently and a failure is reported in the body rather than thrown, because `/healthz` must never itself be a reason the process looks down. Read `ok`, not the status code."
   },
   /* ----------------------------------------------------- developer auth */
-  {
-    method: "POST",
-    path: "/api/auth/signup",
-    section: "developer-auth",
-    summary: "Creates an org and its founding Owner, and answers a developer session.",
-    audience: "developer",
-    auth: "none",
-    rateLimited: true,
-    ownerTier: false,
-    status: 201,
-    params: [],
-    query: null,
-    request: signUpRequest,
-    response: signUpResponse,
-    errors: ["rate_limited", "signup_closed", "validation_error", "email_taken"],
-    transport: "http",
-    notes: "While the deployment runs in closed beta this answers `403 signup_closed` before it looks at the body \u2014 there is nothing for a validation message, or an `email_taken` answer, to be right about when nothing will be created. Email is globally unique, so an address already registered in any org is refused."
-  },
   {
     method: "POST",
     path: "/api/auth/refresh",
@@ -4983,7 +5320,7 @@ var ROUTES = [
     response: sessionTokens,
     errors: ["rate_limited", "validation_error", "token_expired", "token_revoked"],
     transport: "http",
-    notes: "The whole family is re-checked here, not just the token: an account that has been removed from the org, or whose `token_version` was bumped by a password change, cannot mint a fresh console token and answers `token_revoked`. Refusing that only on the other routes would leave a session that is dead everywhere but here."
+    notes: "The whole family is re-checked here, not just the token: an account that has been removed from the org, or whose `token_version` was bumped by an owner's two-factor reset, cannot mint a fresh console token and answers `token_revoked`. Refusing that only on the other routes would leave a session that is dead everywhere but here."
   },
   {
     method: "POST",
@@ -5038,11 +5375,12 @@ var ROUTES = [
     transport: "http",
     notes: "No Owner tier: this can only ever touch the caller's own row, so there is nothing for a tier check to gate. Saving the name already held writes nothing and records no audit event \u2014 the org activity stream reaches every developer with the console open, and an event for a no-op would misreport that something changed."
   },
+  /* ------------------------------------ a developer's own second factors */
   {
-    method: "POST",
-    path: "/api/auth/password/change",
+    method: "GET",
+    path: "/api/auth/two-factor",
     section: "developer-auth",
-    summary: "Verifies the current password, sets a new one and answers a fresh session.",
+    summary: "Answers the calling developer's passkeys, authenticator, recovery codes left and the org's policy.",
     audience: "developer",
     auth: "developer",
     rateLimited: false,
@@ -5050,162 +5388,233 @@ var ROUTES = [
     status: 200,
     params: [],
     query: null,
-    request: passwordChangeRequest,
-    response: sessionTokens,
-    errors: [...DEVELOPER_GUARD, "validation_error", "invalid_credentials"],
+    request: null,
+    response: developerTwoFactor,
+    errors: [...DEVELOPER_GUARD],
     transport: "http",
-    notes: "Every session of this account ends, including the caller's \u2014 the request carries nothing identifying its own refresh family, so there is none to spare. The answer is a working replacement pair, which is what the promise has to mean when nothing distinguishes one session from another."
+    notes: "What Settings \u203A Profile \u203A Security draws. No key material, secret or code travels here \u2014 the passkeys are names and dates, the authenticator is a date, the recovery codes are a count."
   },
   {
     method: "POST",
-    path: "/api/auth/password/reset",
+    path: "/api/auth/passkeys/options",
     section: "developer-auth",
-    summary: "Mails a password-reset link to the address, and answers the same either way.",
+    summary: "Answers the WebAuthn creation options for registering a passkey.",
     audience: "developer",
-    auth: "none",
-    rateLimited: true,
+    auth: "developer",
+    rateLimited: false,
     ownerTier: false,
-    status: 202,
+    status: 200,
     params: [],
     query: null,
-    request: passwordResetRequest,
-    response: null,
-    errors: ["rate_limited", "validation_error"],
+    request: null,
+    response: webauthnOptionsResponse,
+    errors: [...DEVELOPER_GUARD],
     transport: "http",
-    notes: 'Status, body and timing are identical for a known and an unknown address \u2014 any difference is an account-enumeration oracle, which is why the unknown branch still pays a real SMTP round trip to a discard address. An account provisioned through OIDC has no Fleetless password and is mailed nothing. A browser form post gets a `303` to the "check your mail" card instead of this `202`.'
+    notes: "Hand `options` to the browser's WebAuthn API as it is. The relying party is `fleetless.dev`, so the passkey works on the auth portal and in the console alike; user verification is required and the credential is discoverable, so it can sign the person in without an address. The passkeys the caller already has are excluded. The challenge is single-use and expires with the ceremony."
   },
-  /* ------------------------------------------- client auth (portal pages) */
   {
-    method: "GET",
-    path: "/reset-password",
-    section: "client-auth",
-    summary: `Serves the auth portal's "forgot your password" card as an HTML page.`,
-    audience: "internal",
-    auth: "none",
+    method: "POST",
+    path: "/api/auth/passkeys",
+    section: "developer-auth",
+    summary: "Registers a passkey from the browser's answer to the creation options.",
+    audience: "developer",
+    auth: "developer",
     rateLimited: false,
     ownerTier: false,
-    status: 200,
+    status: 201,
     params: [],
     query: null,
-    request: null,
-    response: null,
-    errors: [],
+    request: createPasskeyRequest,
+    response: createPasskeyResponse,
+    errors: [...DEVELOPER_GUARD, "validation_error"],
     transport: "http",
-    notes: 'HTML, not JSON: this is a page a person opens, served by the cloud from the auth portal origin. `?sent=1` draws the "check your mail" state instead \u2014 one path, because that second card has no inputs and a second path would exist only to be redirected to. The value is caller-settable and discloses nothing, since the page it draws is a constant.'
+    notes: "A ceremony that does not verify \u2014 a wrong challenge, origin or relying party, no user verification \u2014 is `400 validation_error` naming `credential`. When this is the account's first second factor, ten recovery codes are issued and answered once; otherwise `recovery_codes` is `null` and the existing ones stay valid. Audited as `developer.two_factor_added` with `details.kind` `passkey`."
   },
   {
-    method: "GET",
-    path: "/reset-password/:token",
-    section: "client-auth",
-    summary: 'Serves the "pick a new password" page for a mailed reset link.',
-    audience: "internal",
-    auth: "none",
+    method: "PATCH",
+    path: "/api/auth/passkeys/:id",
+    section: "developer-auth",
+    summary: "Renames one of the caller's passkeys.",
+    audience: "developer",
+    auth: "developer",
     rateLimited: false,
     ownerTier: false,
     status: 200,
-    params: [{ name: "token", description: "The opaque reset token from the mailed link; it is never sent as a query parameter." }],
+    params: [{ name: "id", description: "The passkey's uuid, as listed by `GET /api/auth/two-factor`; another person's passkey answers `404`." }],
     query: null,
-    request: null,
-    response: null,
-    errors: [],
-    transport: "http",
-    notes: 'HTML. An unknown, spent or expired token renders one "link no longer valid" page at `410` \u2014 they are one refusal on the wire already, and splitting them here would tell a stranger which tokens ever existed. No rate limiter: the GET changes nothing, and the POST it leads to is limited per IP.'
+    request: renamePasskeyRequest,
+    response: developerPasskey,
+    errors: [...DEVELOPER_GUARD, "invalid_uuid", "validation_error", "not_found"],
+    transport: "http"
   },
   {
-    method: "GET",
-    path: "/favicon.svg",
-    section: "client-auth",
-    summary: "Serves the Fleetless icon for the auth portal's and the MCP welcome page's browser tab.",
-    audience: "internal",
-    auth: "none",
+    method: "DELETE",
+    path: "/api/auth/passkeys/:id",
+    section: "developer-auth",
+    summary: "Removes one of the caller's passkeys.",
+    audience: "developer",
+    auth: "developer",
     rateLimited: false,
     ownerTier: false,
-    status: 200,
-    params: [],
+    status: 204,
+    params: [{ name: "id", description: "The passkey's uuid, as listed by `GET /api/auth/two-factor`; another person's passkey answers `404`." }],
     query: null,
     request: null,
     response: null,
-    errors: [],
+    errors: [...DEVELOPER_GUARD, "invalid_uuid", "not_found", "target_state_conflict"],
     transport: "http",
-    notes: "An SVG, not JSON. Those pages carry a Content-Security-Policy that admits no `data:` image, so the icon is a file on their own origin \u2014 the one source `img-src 'self'` names. Cached for a day: the bytes change when the brand does, not per deploy."
+    notes: "`409 target_state_conflict` names `two_factor` with rule `required_by_org` when this is the caller's last second factor and the organisation requires one. Removing the last one otherwise also voids the recovery codes. Audited as `developer.two_factor_removed` with `details.kind` `passkey`."
   },
   {
     method: "POST",
-    path: "/api/auth/password/reset/confirm",
+    path: "/api/auth/totp",
     section: "developer-auth",
-    summary: "Spends a reset token, sets the new password and ends every session of the account.",
+    summary: "Starts an authenticator setup and answers its secret and otpauth URL.",
     audience: "developer",
-    auth: "none",
-    rateLimited: true,
+    auth: "developer",
+    rateLimited: false,
     ownerTier: false,
-    status: 204,
+    status: 200,
     params: [],
     query: null,
-    request: passwordResetConfirm,
-    response: null,
-    errors: ["rate_limited", "validation_error", "token_spent"],
+    request: null,
+    response: twoFactorSetupResponse,
+    errors: [...DEVELOPER_GUARD],
     transport: "http",
-    notes: "Unknown, spent and expired tokens all answer `410 token_spent`. Sessions are revoked under the account's actual kind \u2014 a console admin holds developer sessions, an app user holds end-user ones \u2014 so an app user's open `/realtime` socket does not outlive the reset. A browser form post gets the rendered \"done\" page instead of this `204`."
+    notes: "The secret is pending until `POST /api/auth/totp/confirm` accepts a code from it; a second call replaces a pending secret. A developer who already has an authenticator keeps it until the new one is confirmed, which is how `Replace\u2026` works."
   },
   {
     method: "POST",
-    path: "/api/waitlist",
+    path: "/api/auth/totp/confirm",
     section: "developer-auth",
-    summary: "Adds an address to the closed-beta waiting list.",
+    summary: "Confirms the pending authenticator with a code it shows now.",
     audience: "developer",
-    auth: "none",
+    auth: "developer",
     rateLimited: true,
     ownerTier: false,
-    status: 202,
+    status: 200,
     params: [],
     query: null,
-    request: waitlistRequest,
-    response: null,
-    errors: ["rate_limited", "validation_error"],
+    request: totpConfirmRequest,
+    response: totpConfirmResponse,
+    errors: [...DEVELOPER_GUARD, "rate_limited", "validation_error", "invalid_code", "token_spent"],
     transport: "http",
-    notes: "Answers `202` whether or not the address was already listed: the landing page's form must not be an oracle for who signed up. The operator notification is detached from the response \u2014 awaiting it made latency answer the question the status code refuses to \u2014 and is capped by its own global ceiling, above which the row is still written and the mail is skipped."
+    notes: "A code that does not match the pending secret is `400 invalid_code`; no pending setup is `410 token_spent`. On success the new authenticator replaces any earlier one. Ten recovery codes are answered when it is the account's first second factor, otherwise `null`. Audited as `developer.two_factor_added` with `details.kind` `authenticator`."
   },
-  /* ---------------------------------------------------------------- org */
   {
-    method: "GET",
-    path: "/api/audit",
-    section: "org",
-    summary: "Reads the org's audit log, newest first, cursor-paged over the durable sequence number.",
+    method: "DELETE",
+    path: "/api/auth/totp",
+    section: "developer-auth",
+    summary: "Removes the caller's authenticator app.",
     audience: "developer",
     auth: "developer",
     rateLimited: false,
     ownerTier: false,
-    status: 200,
+    status: 204,
     params: [],
-    query: auditQuery,
+    query: null,
     request: null,
-    response: auditListResponse,
-    errors: [...DEVELOPER_GUARD, "validation_error"],
+    response: null,
+    errors: [...DEVELOPER_GUARD, "not_found", "target_state_conflict"],
     transport: "http",
-    notes: "`action` and `action_prefix` are mutually exclusive, a cross-field rule no JSON Schema can express \u2014 this route is where it is enforced. Nothing redacts an event's `details`: it is returned exactly as the call site wrote it."
+    notes: "`404 not_found` when there is no authenticator. `409 target_state_conflict` names `two_factor` with rule `required_by_org` when it is the caller's last second factor and the organisation requires one. Audited as `developer.two_factor_removed` with `details.kind` `authenticator`."
   },
   {
-    method: "GET",
-    path: "/api/audit/export",
-    section: "org",
-    summary: "Downloads every audit event matching the same filters as a CSV attachment.",
+    method: "POST",
+    path: "/api/auth/recovery-codes",
+    section: "developer-auth",
+    summary: "Issues ten new recovery codes and voids the old ones.",
     audience: "developer",
     auth: "developer",
     rateLimited: false,
     ownerTier: false,
     status: 200,
     params: [],
-    query: auditQuery,
+    query: null,
     request: null,
-    response: null,
-    contentType: "text/csv",
-    errors: [...DEVELOPER_GUARD, "validation_error"],
+    response: recoveryCodesResponse,
+    errors: [...DEVELOPER_GUARD, "target_state_conflict"],
     transport: "http",
-    notes: "Answers `text/csv; charset=utf-8` with a `Content-Disposition` attachment, not JSON \u2014 so it has no response schema. `AUDIT_CSV_COLUMNS` names the columns and their order. Takes the same filters as `GET /api/audit` but refuses `before_seq` and `limit` with `400 validation_error`: an export is not a page, it is everything the filter matches up to a fixed row ceiling."
+    notes: "The codes are shown this once. `409 target_state_conflict` names `two_factor` with rule `off` when the caller has no second factor: recovery codes only stand in for one. Audited as `developer.recovery_codes_generated`."
   },
-  /* --------------------------------------------------------------- apps */
+  /* ------------------------------------------- client auth (portal pages) */
   {
-    method: "POST",
+    method: "GET",
+    path: "/favicon.svg",
+    section: "client-auth",
+    summary: "Serves the Fleetless icon for the auth portal's and the MCP welcome page's browser tab.",
+    audience: "internal",
+    auth: "none",
+    rateLimited: false,
+    ownerTier: false,
+    status: 200,
+    params: [],
+    query: null,
+    request: null,
+    response: null,
+    errors: [],
+    transport: "http",
+    notes: "An SVG, not JSON. Those pages carry a Content-Security-Policy that admits no `data:` image, so the icon is a file on their own origin \u2014 the one source `img-src 'self'` names. Cached for a day: the bytes change when the brand does, not per deploy."
+  },
+  {
+    method: "POST",
+    path: "/api/waitlist",
+    section: "developer-auth",
+    summary: "Adds an address to the closed-beta waiting list.",
+    audience: "developer",
+    auth: "none",
+    rateLimited: true,
+    ownerTier: false,
+    status: 202,
+    params: [],
+    query: null,
+    request: waitlistRequest,
+    response: null,
+    errors: ["rate_limited", "validation_error"],
+    transport: "http",
+    notes: "Answers `202` whether or not the address was already listed: the landing page's form must not be an oracle for who signed up. The operator notification is detached from the response \u2014 awaiting it made latency answer the question the status code refuses to \u2014 and is capped by its own global ceiling, above which the row is still written and the mail is skipped."
+  },
+  /* ---------------------------------------------------------------- org */
+  {
+    method: "GET",
+    path: "/api/audit",
+    section: "org",
+    summary: "Reads the org's audit log, newest first, cursor-paged over the durable sequence number.",
+    audience: "developer",
+    auth: "developer",
+    rateLimited: false,
+    ownerTier: false,
+    status: 200,
+    params: [],
+    query: auditQuery,
+    request: null,
+    response: auditListResponse,
+    errors: [...DEVELOPER_GUARD, "validation_error"],
+    transport: "http",
+    notes: "`action` and `action_prefix` are mutually exclusive, a cross-field rule no JSON Schema can express \u2014 this route is where it is enforced. Nothing redacts an event's `details`: it is returned exactly as the call site wrote it."
+  },
+  {
+    method: "GET",
+    path: "/api/audit/export",
+    section: "org",
+    summary: "Downloads every audit event matching the same filters as a CSV attachment.",
+    audience: "developer",
+    auth: "developer",
+    rateLimited: false,
+    ownerTier: false,
+    status: 200,
+    params: [],
+    query: auditQuery,
+    request: null,
+    response: null,
+    contentType: "text/csv",
+    errors: [...DEVELOPER_GUARD, "validation_error"],
+    transport: "http",
+    notes: "Answers `text/csv; charset=utf-8` with a `Content-Disposition` attachment, not JSON \u2014 so it has no response schema. `AUDIT_CSV_COLUMNS` names the columns and their order. Takes the same filters as `GET /api/audit` but refuses `before_seq` and `limit` with `400 validation_error`: an export is not a page, it is everything the filter matches up to a fixed row ceiling."
+  },
+  /* --------------------------------------------------------------- apps */
+  {
+    method: "POST",
     path: "/api/apps",
     section: "apps",
     summary: "Creates an app, optionally attaching robots to it at the same time.",
@@ -5328,7 +5737,7 @@ var ROUTES = [
     response: role,
     errors: [...DEVELOPER_GUARD, "invalid_uuid", "not_found", "validation_error"],
     transport: "http",
-    notes: 'The body is `{ "name": string }` \u2014 non-empty, trimmed, at most 120 characters \u2014 and is deliberately not a contract shape: contracts define the `role` this answers with, not this one trivial request. **The answer is a bare `role`, not an envelope**, unlike the listing beside it.'
+    notes: 'The body is `{ "name": string }` \u2014 non-empty, trimmed, at most 60 characters as on `role.name` \u2014 and is deliberately not a contract shape: contracts define the `role` this answers with, not this one trivial request. **The answer is a bare `role`, not an envelope**, unlike the listing beside it.'
   },
   {
     method: "GET",
@@ -5410,6 +5819,48 @@ var ROUTES = [
     transport: "http",
     notes: "Built by the same builder the MCP server's own `robot_describe` uses, so the two cannot drift. It answers what the role *would* be offered and consults nothing about any user's actual MCP entitlement. A robot the role grants nothing on still appears, with an empty `exposures` \u2014 dropping it would read as \"not attached\", which is a different fact."
   },
+  {
+    method: "PATCH",
+    path: "/api/apps/:id/roles/:roleId",
+    section: "apps",
+    summary: "Renames a role; its users keep it.",
+    audience: "developer",
+    auth: "developer",
+    rateLimited: false,
+    ownerTier: false,
+    status: 200,
+    params: [
+      { name: "id", description: "The app's uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`." },
+      { name: "roleId", description: "The role's uuid, from `GET /api/apps/:id/roles`; a role of another app answers `404`." }
+    ],
+    query: null,
+    request: roleRenameRequest,
+    response: role,
+    errors: [...DEVELOPER_GUARD, "invalid_uuid", "not_found", "validation_error", "role_name_taken"],
+    transport: "http",
+    notes: "Names are unique per app, compared exactly as stored after trimming. Built-in roles can be renamed."
+  },
+  {
+    method: "DELETE",
+    path: "/api/apps/:id/roles/:roleId",
+    section: "apps",
+    summary: "Deletes a role, moving its users, pending invitations and default-role status to another role.",
+    audience: "developer",
+    auth: "developer",
+    rateLimited: false,
+    ownerTier: false,
+    status: 204,
+    params: [
+      { name: "id", description: "The app's uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`." },
+      { name: "roleId", description: "The role's uuid, from `GET /api/apps/:id/roles`; a role of another app answers `404`." }
+    ],
+    query: roleDeleteQuery,
+    request: null,
+    response: null,
+    errors: [...DEVELOPER_GUARD, "invalid_uuid", "not_found", "validation_error", "role_in_use", "last_role"],
+    transport: "http",
+    notes: "Without `move_to`, a role that app users or pending invitations hold, or that is the app's default, answers `409 role_in_use` with `{ users, invitations, is_default }`. With `move_to` \u2014 another role of the same app, else `400 validation_error` \u2014 one transaction moves `app_users.role_id`, pending invitations and `default_role_id`, then deletes the role and its permissions. The app's only role answers `409 last_role`. Built-in roles can be deleted like any other."
+  },
   {
     method: "POST",
     path: "/api/apps/:id/server-keys",
@@ -5593,9 +6044,27 @@ var ROUTES = [
     query: null,
     request: null,
     response: mailOutcome,
-    errors: [...DEVELOPER_GUARD, "invalid_uuid", "not_found", "target_state_conflict"],
+    errors: [...DEVELOPER_GUARD, "invalid_uuid", "not_found", "target_state_conflict", "method_not_allowed"],
+    transport: "http",
+    notes: "The support door beside `POST /api/client/password/reset`, refused like it with `403 method_not_allowed` while the app has the password method off: the same one-hour token and the same link, triggered by a developer for a user who asked them rather than the form. **No enumeration discipline applies** \u2014 the caller is authenticated into the app and can read the user list \u2014 so this one answers what actually happened: `{ \"mail\": mailStatus }`, where `not_configured` is a deployment without a mailer and `failed` is the state worth somebody's attention. The link points at the app's `reset_url`, or at the hosted reset page when the app has configured none. `409 target_state_conflict` names `password` with rule `not_set` for an account that has none \u2014 an OIDC-only app user, whom a reset link would hand a second, quieter door \u2014 and `status` with rule `blocked` for a blocked one, since `POST /api/client/password/reset` mails a blocked account nothing and the two doors may not disagree. Setting the password directly is deliberately not offered; a developer who could would hold their customers' credentials."
+  },
+  {
+    method: "DELETE",
+    path: "/api/apps/:id/users/:userId/two-factor",
+    section: "apps",
+    summary: "Removes an app user's authenticator and recovery codes and ends every session they hold.",
+    audience: "developer",
+    auth: "developer",
+    rateLimited: false,
+    ownerTier: false,
+    status: 204,
+    params: [{ name: "id", description: "The app's uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`." }, { name: "userId", description: "The app user's uuid, from `GET /api/apps/:id/users`; a user of another app answers `404`." }],
+    query: null,
+    request: null,
+    response: null,
+    errors: [...DEVELOPER_GUARD, "invalid_uuid", "not_found"],
     transport: "http",
-    notes: "The support door beside `POST /api/client/password/reset`: the same one-hour token and the same link, triggered by a developer for a user who asked them rather than the form. **No enumeration discipline applies** \u2014 the caller is authenticated into the app and can read the user list \u2014 so this one answers what actually happened: `{ \"mail\": mailStatus }`, where `not_configured` is a deployment without a mailer and `failed` is the state worth somebody's attention. `409 target_state_conflict` names `reset_url` when the app has configured none: the token would be minted and the link would point nowhere, so nothing is minted. The same `409` names `password` with rule `not_set` for an account that has none \u2014 an OIDC-only app user, whom a reset link would hand a second, quieter door \u2014 and `status` with rule `blocked` for a blocked one, since `POST /api/client/password/reset` mails a blocked account nothing and the two doors may not disagree. Setting the password directly is deliberately not offered; a developer who could would hold their customers' credentials."
+    notes: "The support door for a person who lost their authenticator and their recovery codes. The authenticator and every recovery code go, and so does every session of the account \u2014 whoever held one may be the reason for the reset. **A user with no second factor answers `204` too**: that is the end state being asked for. When the app requires two-factor, the person sets it up again at their next sign-in, before any session exists. Audited as `app_user.two_factor_reset`."
   },
   /* ---------------------------- the MCP clients one app user has connected */
   {
@@ -5672,7 +6141,7 @@ var ROUTES = [
     response: appInvitation,
     errors: [...DEVELOPER_GUARD, "invalid_uuid", "validation_error", "not_found", "email_taken", "target_state_conflict", "rate_limited"],
     transport: "http",
-    notes: "**An app user, not a team member.** `POST /api/org/invitations` is the other space and leads to the console; this link leads into the developer's own app. The role is resolved and stored now, so a later change to `default_role_id` does not re-aim a link already sent. An invitation **always bypasses `allowed_domains`**. \n\nThe answer carries `accept_url`, which is `null` when the app has configured no `invite_url` \u2014 there is nowhere for the link to point, and Fleetless serves an app user no page of its own. That is a `201` with a null link, not a refusal: the invitation exists and a developer may hand the token over by another route. Asking to **mail** it in that state is `409 target_state_conflict` naming `invite_url`, because a mail carrying a dead link is worse than no mail. The same `409` names `default_role_id` when `role_id` is absent and the app has no default role, or its default no longer resolves: an invitation that names no role has nothing to hand its acceptor, so it is refused here rather than at the acceptance a week later. `409 email_taken` is an address the app already has as a user; `404 not_found` is the app or a `role_id` that is not one of its roles. \n\nCreating shares the reissue route's ceiling of **five invitation mails a minute per app**, answering `429 rate_limited` with `retry_after_ms`: re-creating an invitation for one address replaces it and mails again, so a limit that bound only reissue would be a limit on the wrong door."
+    notes: "**An app user, not a team member.** `POST /api/org/invitations` is the other space and leads to the console; this link leads into the developer's own app. The role is resolved and stored now, so a later change to `default_role_id` does not re-aim a link already sent. An invitation **always bypasses `allowed_domains`**. \n\nThe answer carries `accept_url`: the app's `invite_url` with the token in it, or the Fleetless-hosted invitation page when the app has configured none \u2014 so mailing it is never refused for a missing URL. `409 target_state_conflict` names `default_role_id` when `role_id` is absent and the app has no default role, or its default no longer resolves: an invitation that names no role has nothing to hand its acceptor, so it is refused here rather than at the acceptance a week later. `409 email_taken` is an address the app already has as a user; `404 not_found` is the app or a `role_id` that is not one of its roles. \n\nCreating shares the reissue route's ceiling of **five invitation mails a minute per app**, answering `429 rate_limited` with `retry_after_ms`: re-creating an invitation for one address replaces it and mails again, so a limit that bound only reissue would be a limit on the wrong door."
   },
   {
     method: "POST",
@@ -5806,7 +6275,7 @@ var ROUTES = [
     method: "GET",
     path: "/api/apps/:id/auth-config",
     section: "apps",
-    summary: "Reads the app's auth settings: self-registration, domains, origins, URLs and the MCP switch.",
+    summary: "Reads the app's auth settings: sign-in methods, two-factor, registration, pages, the hosted look and the MCP switch.",
     audience: "developer",
     auth: "developer",
     rateLimited: false,
@@ -5818,7 +6287,7 @@ var ROUTES = [
     response: appAuthConfig,
     errors: [...DEVELOPER_GUARD, "invalid_uuid", "not_found"],
     transport: "http",
-    notes: "One row per app, created with the app and never absent \u2014 an app that has configured nothing reads back the defaults rather than a `404`. `oidc_callback_url` is in the answer and not in the request: it is minted by the cloud from its own public base URL, is the same for every app and every provider, and is the value a developer registers at their identity provider. It stays read-only on every slice write below for a second reason: a writable callback URL would let a caller point the return leg of an OIDC sign-in, which carries an authorization code, at a host they own. `updated_at` is read-only for a duller one: the server stamps it on every write, and a client-supplied value would be a lie about when the row last changed."
+    notes: "One row per app, created with the app and never absent \u2014 an app that has configured nothing reads back the defaults rather than a `404`. `oidc_callback_url` is in the answer and not in the request: it is minted by the cloud from its own public base URL, is the same for every app and every provider, and is the value a developer registers at their identity provider. It stays read-only on every slice write below for a second reason: a writable callback URL would let a caller point the return leg of an OIDC sign-in, which carries an authorization code, at a host they own. `updated_at` is read-only for a duller one: the server stamps it on every write, and a client-supplied value would be a lie about when the row last changed. `hosted_pages` and `hosted_logo_url` are read-only as well: the cloud mints both from the auth portal's base URL and the app's identifier."
   },
   {
     method: "PUT",
@@ -5836,13 +6305,31 @@ var ROUTES = [
     response: appAuthConfig,
     errors: [...DEVELOPER_GUARD, "invalid_uuid", "validation_error", "not_found"],
     transport: "http",
-    notes: "**A replace, not a merge, and `.strict()`**: `self_registration`, `allowed_domains` and `allowed_origins` all arrive or the write is refused, so a client built against an older shape cannot silently clear a setting it does not know about. `oidc_callback_url` and `updated_at` are the server's, refused in this body as in every slice's \u2014 see `GET`'s notes for why. \n\n`400 validation_error` is where the two field rules land: an entry in `allowed_domains` must be lowercase, since a capitalised one can never match a lowercased address, and an entry in `allowed_origins` must be a bare scheme-host-port with no path, since a browser sends nothing longer in its `Origin` header. Each refuses at configuration time rather than failing silently later. \n\nThe merge is server-side against the stored row, so this write never disturbs the urls or mcp slice."
+    notes: "**A replace, not a merge, and `.strict()`**: `self_registration`, `allowed_domains` and `allowed_origins` all arrive or the write is refused, so a client built against an older shape cannot silently clear a setting it does not know about. `oidc_callback_url` and `updated_at` are the server's, refused in this body as in every slice's \u2014 see `GET`'s notes for why. \n\n`400 validation_error` is where the two field rules land: an entry in `allowed_domains` must be lowercase, since a capitalised one can never match a lowercased address, and an entry in `allowed_origins` must be a bare scheme-host-port with no path, since a browser sends nothing longer in its `Origin` header. Each refuses at configuration time rather than failing silently later. \n\nThe merge is server-side against the stored row, so this write never disturbs another slice."
+  },
+  {
+    method: "PUT",
+    path: "/api/apps/:id/auth-config/sign-in",
+    section: "apps",
+    summary: "Replaces how the app's users sign in and whether they give a second factor.",
+    audience: "developer",
+    auth: "developer",
+    rateLimited: false,
+    ownerTier: false,
+    status: 200,
+    params: [{ name: "id", description: "The app's uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`." }],
+    query: null,
+    request: putAppAuthSignInRequest,
+    response: appAuthConfig,
+    errors: [...DEVELOPER_GUARD, "invalid_uuid", "validation_error", "not_found"],
+    transport: "http",
+    notes: "**A replace, not a merge, and `.strict()`**: `sign_in_methods` and `two_factor` both arrive or the write is refused. Both methods off is `400 validation_error` naming `sign_in_methods.password` \u2014 an app needs at least one door besides its identity providers. \n\nTurning a method off refuses its routes with `method_not_allowed` from the next request on; a stored password stays stored. Setting `two_factor` to `required` signs nobody out: each person without an authenticator sets one up at their next sign-in, before any session exists. Audited with both old and new values. The merge is server-side against the stored row, so this write never disturbs another slice."
   },
   {
     method: "PUT",
     path: "/api/apps/:id/auth-config/urls",
     section: "apps",
-    summary: "Replaces the three pages Fleetless's mails point at.",
+    summary: "Replaces the app's home page and the four pages Fleetless's mails and MCP sign-in point at.",
     audience: "developer",
     auth: "developer",
     rateLimited: false,
@@ -5854,13 +6341,13 @@ var ROUTES = [
     response: appAuthConfig,
     errors: [...DEVELOPER_GUARD, "invalid_uuid", "validation_error", "not_found"],
     transport: "http",
-    notes: "**A replace, not a merge, and `.strict()`**: `invite_url`, `verify_url` and `reset_url` all arrive or the write is refused, so a client built against an older shape cannot silently clear a setting it does not know about. `oidc_callback_url` and `updated_at` are the server's, refused in this body as in every slice's \u2014 see `GET`'s notes for why. \n\n`400 validation_error` is where the field rule lands: a URL template must be https (or `http` on `localhost`) and carry its placeholder exactly once \u2014 a second occurrence leaves one literal in a mailed link, refused here rather than failing silently once the mail is sent. \n\nThe merge is server-side against the stored row, so this write never disturbs the registration or mcp slice."
+    notes: "**A replace, not a merge, and `.strict()`**: `app_url`, `invite_url`, `verify_url`, `reset_url` and `mcp_login_url` all arrive or the write is refused, so a client built against an older shape cannot silently clear a setting it does not know about. `oidc_callback_url` and `updated_at` are the server's, refused in this body as in every slice's \u2014 see `GET`'s notes for why. \n\nEach may be `null`, and then the Fleetless-hosted page in `hosted_pages` stands in for it: nothing is refused for a missing URL. `400 validation_error` is where the field rules land: a URL template must be https (or `http` on `localhost`) and carry its placeholder exactly once \u2014 a second occurrence leaves one literal in a mailed link, refused here rather than failing silently once the mail is sent \u2014 and `app_url` takes the same host rule with no placeholder. `mcp_login_url` moved here from the `mcp` slice, because one screen owns all four pages. \n\nThe merge is server-side against the stored row, so this write never disturbs another slice."
   },
   {
     method: "PUT",
     path: "/api/apps/:id/auth-config/mcp",
     section: "apps",
-    summary: "Replaces the MCP switch and its login URL together.",
+    summary: "Turns the app's MCP endpoint on or off.",
     audience: "developer",
     auth: "developer",
     rateLimited: false,
@@ -5872,7 +6359,61 @@ var ROUTES = [
     response: appAuthConfig,
     errors: [...DEVELOPER_GUARD, "invalid_uuid", "validation_error", "not_found"],
     transport: "http",
-    notes: "**A replace, not a merge, and `.strict()`**: `mcp_enabled` and `mcp_login_url` both arrive or the write is refused, so a client built against an older shape cannot silently clear a setting it does not know about. `oidc_callback_url` and `updated_at` are the server's, refused in this body as in every slice's \u2014 see `GET`'s notes for why. \n\n`mcp_login_url` answers to the same rule as the `urls` slice's three templates \u2014 https (or `http` on `localhost`), its placeholder exactly once \u2014 refused as `400 validation_error` rather than left to fail mid-OAuth, in a client's browser where no console screen is watching. \n\nThe merge is server-side against the stored row, so this write never disturbs the registration or urls slice."
+    notes: "**A replace, not a merge, and `.strict()`**: `mcp_enabled` arrives or the write is refused. It used to take `mcp_login_url` as well, because on without a URL refused every sign-in; the hosted MCP sign-in now stands in for an unset URL, and the URL moved to the `urls` slice. A body still carrying it is `400 validation_error`. `oidc_callback_url` and `updated_at` are the server's, refused in this body as in every slice's. The merge is server-side against the stored row, so this write never disturbs another slice."
+  },
+  {
+    method: "PUT",
+    path: "/api/apps/:id/auth-config/look",
+    section: "apps",
+    summary: "Replaces the hosted pages' accent colour.",
+    audience: "developer",
+    auth: "developer",
+    rateLimited: false,
+    ownerTier: false,
+    status: 200,
+    params: [{ name: "id", description: "The app's uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`." }],
+    query: null,
+    request: putAppAuthLookRequest,
+    response: appAuthConfig,
+    errors: [...DEVELOPER_GUARD, "invalid_uuid", "validation_error", "not_found"],
+    transport: "http",
+    notes: "**A replace, and `.strict()`**: `hosted_accent` arrives, `#rrggbb` in lowercase, or `null` for the neutral shell's own accent. The logo is its own write, `PUT /api/apps/:id/auth-config/logo`, because it is an image rather than a field. The merge is server-side against the stored row, so this write never disturbs another slice."
+  },
+  {
+    method: "PUT",
+    path: "/api/apps/:id/auth-config/logo",
+    section: "apps",
+    summary: "Stores the logo the hosted pages show above the app's name.",
+    audience: "developer",
+    auth: "developer",
+    rateLimited: false,
+    ownerTier: false,
+    status: 200,
+    params: [{ name: "id", description: "The app's uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`." }],
+    query: null,
+    request: null,
+    response: appAuthConfig,
+    errors: [...DEVELOPER_GUARD, "invalid_uuid", "validation_error", "not_found", "unsupported_media_type"],
+    transport: "http",
+    notes: "The body is the **raw image**, not JSON, so it has no request schema: `Content-Type` is one of `HOSTED_LOGO_TYPES` (`image/png`, `image/svg+xml`) and anything else is `415 unsupported_media_type`. At most `HOSTED_LOGO_MAX_BYTES` (100 KB); a larger body, or one that is not the image its type names, is `400 validation_error`. A new logo replaces the stored one. The hosted pages load it from `hosted_logo_url` as an image only, and the cloud serves an SVG sandboxed, so a script inside one never runs."
+  },
+  {
+    method: "DELETE",
+    path: "/api/apps/:id/auth-config/logo",
+    section: "apps",
+    summary: "Removes the logo from the hosted pages.",
+    audience: "developer",
+    auth: "developer",
+    rateLimited: false,
+    ownerTier: false,
+    status: 200,
+    params: [{ name: "id", description: "The app's uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`." }],
+    query: null,
+    request: null,
+    response: appAuthConfig,
+    errors: [...DEVELOPER_GUARD, "invalid_uuid", "not_found"],
+    transport: "http",
+    notes: "Answers the whole configuration, with `hosted_logo_url` now `null`; the hosted pages show the app's name alone. An app with no logo answers the same: that is the end state being asked for."
   },
   {
     method: "GET",
@@ -5890,7 +6431,7 @@ var ROUTES = [
     response: appMailTemplateListResponse,
     errors: [...DEVELOPER_GUARD, "invalid_uuid", "not_found"],
     transport: "http",
-    notes: 'Answers `{ "templates": [appMailTemplate, \u2026] }` with **only the kinds that have a custom template** \u2014 at most three. A kind that does not appear is one using the Fleetless default text, which is an ordinary state and not a missing row. Mails to *Fleetless* users, a team invitation or a console password reset, are not in this list and are deliberately not customisable: they are about this platform, not about the developer\'s product.'
+    notes: 'Answers `{ "templates": [appMailTemplate, \u2026] }` with **only the kinds that have a custom template** \u2014 at most four. A kind that does not appear is one using the Fleetless default text, which is an ordinary state and not a missing row. Mails to *Fleetless* users, a team invitation or a console sign-in code, are not in this list and are deliberately not customisable: they are about this platform, not about the developer\'s product.'
   },
   {
     method: "GET",
@@ -5902,7 +6443,7 @@ var ROUTES = [
     rateLimited: false,
     ownerTier: false,
     status: 200,
-    params: [{ name: "id", description: "The app's uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`." }, { name: "kind", description: "Which of the three mails this template replaces \u2014 a `mailTemplateKind`: `invite`, `verify` or `reset`." }],
+    params: [{ name: "id", description: "The app's uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`." }, { name: "kind", description: "Which of the four mails this template replaces \u2014 a `mailTemplateKind`: `invite`, `verify`, `reset` or `login_code`." }],
     query: null,
     request: null,
     response: appMailTemplate,
@@ -5920,7 +6461,7 @@ var ROUTES = [
     rateLimited: false,
     ownerTier: false,
     status: 200,
-    params: [{ name: "id", description: "The app's uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`." }, { name: "kind", description: "Which of the three mails this template replaces \u2014 a `mailTemplateKind`: `invite`, `verify` or `reset`." }],
+    params: [{ name: "id", description: "The app's uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`." }, { name: "kind", description: "Which of the four mails this template replaces \u2014 a `mailTemplateKind`: `invite`, `verify`, `reset` or `login_code`." }],
     query: null,
     request: putAppMailTemplateRequest,
     response: appMailTemplate,
@@ -5938,7 +6479,7 @@ var ROUTES = [
     rateLimited: false,
     ownerTier: false,
     status: 204,
-    params: [{ name: "id", description: "The app's uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`." }, { name: "kind", description: "Which of the three mails this template replaces \u2014 a `mailTemplateKind`: `invite`, `verify` or `reset`." }],
+    params: [{ name: "id", description: "The app's uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`." }, { name: "kind", description: "Which of the four mails this template replaces \u2014 a `mailTemplateKind`: `invite`, `verify`, `reset` or `login_code`." }],
     query: null,
     request: null,
     response: null,
@@ -5956,7 +6497,7 @@ var ROUTES = [
     rateLimited: false,
     ownerTier: false,
     status: 200,
-    params: [{ name: "id", description: "The app's uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`." }, { name: "kind", description: "Which of the three mails this template replaces \u2014 a `mailTemplateKind`: `invite`, `verify` or `reset`." }],
+    params: [{ name: "id", description: "The app's uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`." }, { name: "kind", description: "Which of the four mails this template replaces \u2014 a `mailTemplateKind`: `invite`, `verify`, `reset` or `login_code`." }],
     query: null,
     request: mailTemplatePreviewRequest,
     response: mailTemplatePreviewResponse,
@@ -5974,7 +6515,7 @@ var ROUTES = [
     rateLimited: false,
     ownerTier: false,
     status: 202,
-    params: [{ name: "id", description: "The app's uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`." }, { name: "kind", description: "Which of the three mails this template replaces \u2014 a `mailTemplateKind`: `invite`, `verify` or `reset`." }],
+    params: [{ name: "id", description: "The app's uuid, as returned by `POST /api/apps` or listed by `GET /api/apps`." }, { name: "kind", description: "Which of the four mails this template replaces \u2014 a `mailTemplateKind`: `invite`, `verify`, `reset` or `login_code`." }],
     query: null,
     request: mailTemplatePreviewRequest,
     response: mailOutcome,
@@ -6094,7 +6635,7 @@ var ROUTES = [
     method: "POST",
     path: "/api/org/invitations/accept",
     section: "users",
-    summary: "Spends an invitation token and creates the login it was addressed to.",
+    summary: "Spends an invitation token and creates the account it was addressed to.",
     audience: "developer",
     auth: "none",
     rateLimited: true,
@@ -6106,7 +6647,7 @@ var ROUTES = [
     response: null,
     errors: ["rate_limited", "validation_error", "token_spent", "email_taken"],
     transport: "http",
-    notes: '**`204`, not a session.** The console signs in through its own OAuth portal, so a session minted here would be a second credential door for one account \u2014 and every security property would then have to be right in two places. Unknown, expired and already-accepted tokens collapse into `410 token_spent`. A browser form post gets the rendered "you\'re in" page instead.'
+    notes: '**`204`, not a session.** The console signs in through its own OAuth portal, so a session minted here would be a second credential door for one account \u2014 and every security property would then have to be right in two places. **No password**: the mailed link proves the address, so accepting needs no code either, and the new member signs in by emailed code from then on. When the organisation requires two-factor, the member sets one up at their first sign-in. Unknown, expired and already-accepted tokens collapse into `410 token_spent`. A browser form post gets the rendered "you\'re in" page instead.'
   },
   {
     method: "GET",
@@ -6124,7 +6665,7 @@ var ROUTES = [
     response: null,
     errors: [],
     transport: "http",
-    notes: 'HTML, served by the cloud from the auth portal origin; the form on it posts to `POST /api/org/invitations/accept`. An unknown, spent or expired token renders the "link no longer valid" page at `410`, which offers the password-reset page \u2014 the only self-service door the portal has, since an invitation cannot be re-issued by the person holding it.'
+    notes: 'HTML, served by the cloud from the auth portal origin; the form on it posts to `POST /api/org/invitations/accept`. **The GET spends nothing** \u2014 a mail scanner opening the link must not accept the invitation \u2014 only the form\'s POST does. An unknown, spent or expired token renders the "link no longer valid" page at `410`, which says to ask the organisation for a new invitation: the person holding a dead link cannot re-issue it.'
   },
   {
     method: "PATCH",
@@ -6180,11 +6721,29 @@ var ROUTES = [
     transport: "http",
     notes: "Owner tier, unconditionally \u2014 this is the route the whole owner-exclusive list is about. A uuid that is not a Fleetless user of this org answers `404 not_found`, the same as one that does not exist anywhere: the `409 target_state_conflict` documented here until the two-space cut had exactly one producer, the Org Admins membership check, and went with it. Demoting the last Owner is `409 last_owner`, decided by a row lock inside the writing transaction rather than by a read beforehand. Setting the tier already held changes nothing and writes no audit event. No session is revoked: a tier is re-read from the row on every request, so no issued token carries a stale copy of it."
   },
+  {
+    method: "DELETE",
+    path: "/api/org/users/:id/two-factor",
+    section: "users",
+    summary: "Removes a team member's passkeys, authenticator and recovery codes and ends their sessions.",
+    audience: "developer",
+    auth: "developer",
+    rateLimited: false,
+    ownerTier: true,
+    status: 204,
+    params: [{ name: "id", description: "The Fleetless user's uuid, as listed by `GET /api/org/users`." }],
+    query: null,
+    request: null,
+    response: null,
+    errors: [...DEVELOPER_GUARD, "tier_required", "invalid_uuid", "not_found", "target_state_conflict"],
+    transport: "http",
+    notes: "Owner tier: the door for a member who lost every second factor and every recovery code. Every session of the member ends, and when the organisation requires two-factor they set one up again at their next sign-in. **An owner cannot reset their own** \u2014 `409 target_state_conflict` naming `user_id` with rule `self`; Settings \u203A Profile is where they change it. A member with no second factor answers `204` too. Audited as `developer.two_factor_reset`, naming the owner who did it."
+  },
   {
     method: "PATCH",
     path: "/api/org",
     section: "org",
-    summary: "Renames the org.",
+    summary: "Renames the org, requires two-factor for its members, or both.",
     audience: "developer",
     auth: "developer",
     rateLimited: false,
@@ -6196,7 +6755,7 @@ var ROUTES = [
     response: patchOrgResponse,
     errors: [...DEVELOPER_GUARD, "tier_required", "validation_error"],
     transport: "http",
-    notes: 'Answers `{ "org": org }`. Owner tier, and the gate runs before the body is looked at, so a malformed rename and a forbidden one answer the same way. Renaming to the name already held writes nothing and records no audit event.'
+    notes: 'Answers `{ "org": org }`. Owner tier, and the gate runs before the body is looked at, so a malformed patch and a forbidden one answer the same way \u2014 `403 tier_required` for a developer, whichever field they sent. An empty body is `400 validation_error`. Writing the values already held writes nothing and records no audit event. \n\n`require_two_factor` on signs nobody out: each member without a passkey or authenticator sets one up at their next sign-in, before any session exists, on the console and the central MCP endpoint alike. Server keys and robot bridges are not people and are not affected. Audited as `org.two_factor_required_changed`.'
   },
   /* --------------------------------------------------------------- mcp */
   {
@@ -6269,7 +6828,7 @@ var ROUTES = [
     response: null,
     errors: [],
     transport: "http",
-    notes: "**The query schema is what this endpoint accepts, not what it parses**: the handler reads it parameter by parameter because the answers differ, and one parse would collapse them. Client and `redirect_uri` are validated first and a failure there never redirects, the same open-redirect discipline the app flow applies; those refusals are `oauthError`. Exact `redirect_uri` matching for both client kinds \u2014 the loopback-port wildcard of RFC 8252 \xA77.3 belongs to the one central client alone, whose URIs are configured ahead of time and cannot name an ephemeral port. A client that registered itself seconds ago can name the port it bound, and widening the wildcard there would only widen where a stolen `client_id` may send a browser. Nothing about the person is decided here \u2014 the next card asks for an email address and the password step after it resolves the account; this route knows only the client."
+    notes: "**The query schema is what this endpoint accepts, not what it parses**: the handler reads it parameter by parameter because the answers differ, and one parse would collapse them. Client and `redirect_uri` are validated first and a failure there never redirects, the same open-redirect discipline the app flow applies; those refusals are `oauthError`. Exact `redirect_uri` matching for both client kinds \u2014 the loopback-port wildcard of RFC 8252 \xA77.3 belongs to the one central client alone, whose URIs are configured ahead of time and cannot name an ephemeral port. A client that registered itself seconds ago can name the port it bound, and widening the wildcard there would only widen where a stolen `client_id` may send a browser. Nothing about the person is decided here \u2014 the next card asks for an email address, or a passkey, and the steps after it resolve the account; this route knows only the client."
   },
   {
     method: "GET",
@@ -6287,44 +6846,9 @@ var ROUTES = [
     response: null,
     errors: [],
     transport: "http",
-    notes: "HTML, and a GET rather than the body of the authorize response \u2014 so it is reloadable, bookmarkable and survives a back button, which the inline page it replaced was not. An expired, consumed, unknown or hand-edited interaction renders one page at `410`, and so does a client whose dynamic registration lapsed in between."
-  },
-  {
-    method: "POST",
-    path: "/mcp/oauth/identify",
-    section: "mcp",
-    summary: "Takes the email address and hands back the password step.",
-    audience: "internal",
-    auth: "none",
-    rateLimited: true,
-    ownerTier: false,
-    status: 200,
-    params: [],
-    query: null,
-    request: null,
-    response: null,
-    errors: ["rate_limited", "validation_error", "token_spent"],
-    transport: "http",
-    notes: 'The identifier-first step, with nothing left to identify: Fleetless users are password-only, so **this step does not read the address at all** \u2014 it renders the password card for a known address, an unknown one and an empty one alike, and the login step below answers the same `401` for all three. That is a property of the shape rather than of two branches agreeing: there is no lookup here whose result could differ. A browser form post gets the password card; a JSON caller gets `{ "next" }`, which has no schema. Still rate limited per (route, ip, email), because it is an unauthenticated endpoint that renders a page.'
-  },
-  {
-    method: "POST",
-    path: "/mcp/oauth/login",
-    section: "mcp",
-    summary: "Checks the password and hands back where the MCP sign-in continues.",
-    audience: "internal",
-    auth: "none",
-    rateLimited: true,
-    ownerTier: false,
-    status: 200,
-    params: [],
-    query: null,
-    request: null,
-    response: oauthRedirectResponse,
-    errors: ["rate_limited", "validation_error", "token_spent", "invalid_credentials"],
-    transport: "http",
-    notes: 'The body is `{ "interaction_id", "email", "password" }`, read field by field rather than through a contract shape. A browser gets a `303` \u2014 to the consent screen for a self-registered client, or straight to the callback for the central one \u2014 where a JSON caller gets this `200` and `redirect_to`.'
+    notes: "HTML, and a GET rather than the body of the authorize response \u2014 so it is reloadable, bookmarkable and survives a back button, which the inline page it replaced was not. An expired, consumed, unknown or hand-edited interaction renders one page at `410`, and so does a client whose dynamic registration lapsed in between. It offers the email field and `Sign in with a passkey`, and opening it binds the interaction to this browser with the browser-proof cookie, which every sign-in step after it checks."
   },
+  ...developerSignInRoutes("/mcp/oauth"),
   {
     method: "GET",
     path: "/mcp/oauth/consent/:id",
@@ -6335,7 +6859,7 @@ var ROUTES = [
     rateLimited: false,
     ownerTier: false,
     status: 200,
-    params: [{ name: "id", description: "The interaction id from the sign-in; the login step redirects the browser here." }],
+    params: [{ name: "id", description: "The interaction id from the sign-in; the last sign-in step redirects the browser here." }],
     query: null,
     request: null,
     response: null,
@@ -6414,31 +6938,32 @@ var ROUTES = [
     response: null,
     errors: [],
     transport: "http",
-    notes: "HTML. An expired, consumed, unknown or hand-edited interaction renders one page at `410`: which of the four it was is not a fact a stranger may learn, and to the person it is one fact anyway. The page resolves nothing about the address typed into it, so there is no enumeration oracle here at all."
+    notes: "HTML: the email field, `Email me a code`, and `Sign in with a passkey`. Opening it binds the interaction to this browser with the browser-proof cookie, which every sign-in step after it checks. An expired, consumed, unknown or hand-edited interaction renders one page at `410`: which of the four it was is not a fact a stranger may learn, and to the person it is one fact anyway. The page resolves nothing about the address typed into it, so there is no enumeration oracle here at all."
   },
+  ...developerSignInRoutes("/console/oauth"),
   {
-    method: "POST",
-    path: "/console/oauth/identify",
+    method: "GET",
+    path: "/console/oauth/signup/:id",
     section: "developer-auth",
-    summary: "Takes the email address and hands back the password step.",
+    summary: "Serves step one of console sign-up, the email card.",
     audience: "internal",
     auth: "none",
-    rateLimited: true,
+    rateLimited: false,
     ownerTier: false,
     status: 200,
-    params: [],
+    params: [{ name: "id", description: "The interaction id minted by `GET /console/oauth/authorize` with `?prompt=create`." }],
     query: null,
     request: null,
     response: null,
-    errors: ["rate_limited", "token_spent"],
+    errors: [],
     transport: "http",
-    notes: 'A browser form post gets the password card as HTML; a JSON caller gets `{ "next": "/console/oauth/login" }`, which has no schema \u2014 the step made no decision, and it says so rather than inventing a redirect. A dead interaction is `410 token_spent`. Rate limited despite spending no credential: it is an unauthenticated endpoint that renders a page.'
+    notes: 'HTML: the email field and `Email me a code`, the first of three steps \u2014 email, code, organization. While the deployment runs in closed beta this renders the "sign-up is closed" card at `403` instead, keeping the interaction alive and pointing back at sign-in and the waiting list \u2014 the person may well already have an account.'
   },
   {
     method: "POST",
-    path: "/console/oauth/login",
+    path: "/console/oauth/signup",
     section: "developer-auth",
-    summary: "Checks the password and mints the authorization code the console exchanges.",
+    summary: "Takes the sign-up email, mails a code and hands back the code step.",
     audience: "internal",
     auth: "none",
     rateLimited: true,
@@ -6447,34 +6972,16 @@ var ROUTES = [
     params: [],
     query: null,
     request: null,
-    response: oauthRedirectResponse,
-    errors: ["rate_limited", "token_spent", "invalid_credentials"],
-    transport: "http",
-    notes: 'This is the only place a Fleetless developer password may be typed; `POST /api/auth/login` is gone, because a second credential door means every security property has to be right in two places. A browser form post gets a `303` to the callback URL; a JSON caller gets that same URL as `redirect_to` at `200`. An argon2 verify runs whether or not the address exists, and the Org Admins check runs after it \u2014 filtering first would hand back a faster "no" for a non-admin account, which is a timing oracle. Wrong password, unknown address and "not an org admin" render identical bytes under one `401`.'
-  },
-  {
-    method: "GET",
-    path: "/console/oauth/signup/:id",
-    section: "developer-auth",
-    summary: "Serves step one of console sign-up, the account card.",
-    audience: "internal",
-    auth: "none",
-    rateLimited: false,
-    ownerTier: false,
-    status: 200,
-    params: [{ name: "id", description: "The interaction id minted by `GET /console/oauth/authorize` with `?prompt=create`." }],
-    query: null,
-    request: null,
     response: null,
-    errors: [],
+    errors: ["rate_limited", "token_spent", "signup_closed", "validation_error", "email_taken"],
     transport: "http",
-    notes: 'HTML. While the deployment runs in closed beta this renders the "sign-up is closed" card at `403` instead, keeping the interaction alive and pointing back at sign-in \u2014 the person may well already have an account.'
+    notes: 'A browser form post gets the code card; a JSON caller gets `{ "next", "email" }`, which has no schema. **No password**: the code mailed here, six digits valid ten minutes, proves the address. A per-interaction proof cookie is set here \u2014 it is what stops a third party from finishing a sign-up somebody else started. Sign-up is the one surface whose job is to say an address is taken, so `409 email_taken` is not a leak here.'
   },
   {
     method: "POST",
-    path: "/console/oauth/signup",
+    path: "/console/oauth/signup/code",
     section: "developer-auth",
-    summary: "Takes the sign-up email and password and hands back the organization step.",
+    summary: "Checks the sign-up code and hands back the organization step.",
     audience: "internal",
     auth: "none",
     rateLimited: true,
@@ -6484,9 +6991,9 @@ var ROUTES = [
     query: null,
     request: null,
     response: null,
-    errors: ["rate_limited", "token_spent", "signup_closed", "validation_error", "email_taken"],
+    errors: ["rate_limited", "token_spent", "signup_closed", "wrong_browser", "validation_error", "invalid_code"],
     transport: "http",
-    notes: 'A browser form post gets the organization card; a JSON caller gets `{ "next", "email" }`, which has no schema. The plaintext password exists for this one request: what is stored is its argon2 hash, on the interaction row, which expires with it. A per-interaction proof cookie is set here \u2014 it is what stops a third party from finishing a sign-up somebody else started. Sign-up is the one surface whose job is to say an address is taken, so `409 email_taken` is not a leak here.'
+    notes: 'A wrong code renders the code card again with the attempts left (`400 invalid_code`); a spent, expired or exhausted one is `410 token_spent`. The step before must have run in **this** browser (`401 wrong_browser`). A browser form post gets the organization card, the address shown `confirmed`; a JSON caller gets `{ "next" }`, which has no schema.'
   },
   {
     method: "POST",
@@ -6504,7 +7011,7 @@ var ROUTES = [
     response: oauthRedirectResponse,
     errors: ["rate_limited", "token_spent", "signup_closed", "wrong_browser", "validation_error", "email_taken"],
     transport: "http",
-    notes: "The same single transaction `POST /api/auth/signup` runs. Step one must have run in **this** browser: a missing or mismatched proof cookie is `401 wrong_browser` and the person is sent back to step one. A browser form post gets a `303` to the console callback; a JSON caller gets `redirect_to` at `200`."
+    notes: "The form carries `org_name` only. The org and its founding Owner are created in one transaction, and only after the code step confirmed the address. Both steps before must have run in **this** browser: a missing or mismatched proof cookie is `401 wrong_browser` and the person is sent back to step one. `409 email_taken` when the address was taken meanwhile. A browser form post gets a `303` to the console callback; a JSON caller gets `redirect_to` at `200`. This is the only way an organisation is created: `POST /api/auth/signup` is gone, because without a password it would hand a session to anybody who names an address."
   },
   {
     method: "POST",
@@ -6524,6 +7031,8 @@ var ROUTES = [
     transport: "http",
     notes: "Called by the console's own server, never by a browser. Refusals use RFC 6749 \xA75.2's flat `oauthError` shape \u2014 it is a token endpoint, and that is the dialect a caller of one expects \u2014 so it emits none of the codes in this reference. Proof of possession is checked before the replay check, and the single-use consume is atomic, so exactly one caller ever mints. The Org Admins membership is re-read here: the code was minted earlier, and a user moved out in between must not get a console session."
   },
+  /* --------------------------------- the Fleetless-hosted app pages */
+  ...HOSTED_APP_ROUTES,
   /* ---------------------------------------------------- mcp (the endpoint) */
   {
     method: "GET",
@@ -6650,7 +7159,7 @@ var ROUTES = [
     response: authorizationServerMetadata,
     errors: ["not_found"],
     transport: "http",
-    notes: "RFC 8414, for the issuer `<PUBLIC_API_BASE_URL>/mcp/<identifier>` \u2014 the same path rule as the document above, and the same `404` for a switched-off app. `registration_endpoint` is present for the reason the central document states: a client that finds it registers itself and never asks a person for a `client_id`. \n\n**`issuer`, `token_endpoint` and the resource identifier are minted from the canonical public base, never from the friendly `mcp.fleetless.dev` alias or the request's `Host`**, because a client checks a minted token's `iss` and `aud` against these exact strings. \n\n**Unlike the central document, `authorization_endpoint` does not move to an auth-portal origin**, and there is nothing here for one to serve: this authorization step renders no Fleetless page at all. It redirects to the app's own `mcp_login_url`, which is on the developer's origin already."
+    notes: "RFC 8414, for the issuer `<PUBLIC_API_BASE_URL>/mcp/<identifier>` \u2014 the same path rule as the document above, and the same `404` for a switched-off app. `registration_endpoint` is present for the reason the central document states: a client that finds it registers itself and never asks a person for a `client_id`. \n\n**`issuer`, `token_endpoint` and the resource identifier are minted from the canonical public base, never from the friendly `mcp.fleetless.dev` alias or the request's `Host`**, because a client checks a minted token's `iss` and `aud` against these exact strings. \n\n**Unlike the central document, `authorization_endpoint` does not move to an auth-portal origin**: the authorization step renders no page itself. It redirects to the app's own `mcp_login_url`, or to the hosted MCP sign-in on the auth portal when the app has configured none."
   },
   {
     method: "POST",
@@ -6674,7 +7183,7 @@ var ROUTES = [
     method: "GET",
     path: MCP_APP.authorize,
     section: "mcp",
-    summary: "Starts an MCP sign-in and redirects the browser to the app's own login page.",
+    summary: "Starts an MCP sign-in and redirects the browser to the app's own login page, or to the hosted one.",
     audience: "client",
     auth: "none",
     rateLimited: false,
@@ -6684,9 +7193,9 @@ var ROUTES = [
     query: oauthAuthorizeQuery,
     request: null,
     response: null,
-    errors: ["not_found", "target_state_conflict"],
+    errors: ["not_found"],
     transport: "http",
-    notes: 'The same query as `GET /mcp/oauth/authorize`, read the same way \u2014 parameter by parameter, because the answers differ and one parse would collapse them. \n\n**Fleetless renders no page here**, and that is the whole of it. The route writes an interaction \u2014 ten minutes, as the OIDC ones live \u2014 and redirects to `appAuthConfig.mcp_login_url` with `{interaction}` filled in. The app then authenticates the person with its own UI, reads `GET /api/client/mcp/interactions/:id` to show the client\'s claimed name and the scopes it asked for, and calls approve or deny. \n\nClient and `redirect_uri` are validated first and a failure there never redirects \u2014 the open-redirect discipline `GET /mcp/oauth/authorize` and `GET /api/client/oidc/:slug/start` both keep \u2014 and those refusals are RFC 6749\'s flat `oauthError`, which is why none of them appear above. `redirect_uri` is matched **exactly** against the registration, with no loopback-port wildcard: every client here registered itself minutes ago and can name the port it bound, so a wildcard would only widen where a stolen `client_id` may send a browser. \n\nThe two codes above are the `apiError` envelope because they are refusals about the **app**, decided before an OAuth parameter is looked at. **`404 not_found` covers an identifier no app carries AND an app with MCP switched off** \u2014 the same single answer the two metadata documents, `register` and the transport give. An earlier draft answered `403 mcp_disabled` here, on the argument that a client which registered while the switch was on is owed the difference between "turned off" and "mistyped"; that argument does not survive the caller being anonymous. This route takes no credential, so the extra code was readable by anyone who could type an identifier, and it handed back precisely the existence distinction every neighbouring route collapses. `mcp_disabled` survives only where the caller has already proved they belong to the app \u2014 the two decision routes under `/api/client/mcp/interactions/:id`. `409 target_state_conflict` names `mcp_login_url` with rule `not_set`: MCP is enabled and no page is configured to send the person to. It is the same code and the same shape `send_mail` answers for an unconfigured `invite_url`, and the refusal is the honest one \u2014 Fleetless has nowhere to redirect, and rendering a page of its own would contradict the rule that Fleetless shows an app user no page.'
+    notes: 'The same query as `GET /mcp/oauth/authorize`, read the same way \u2014 parameter by parameter, because the answers differ and one parse would collapse them. \n\n**This route renders no page.** It writes an interaction \u2014 ten minutes, as the OIDC ones live \u2014 and redirects to `appAuthConfig.mcp_login_url` with `{interaction}` filled in. The app then authenticates the person with its own UI, reads `GET /api/client/mcp/interactions/:id` to show the client\'s claimed name and the scopes it asked for, and calls approve or deny. **An app with no `mcp_login_url` is redirected to the hosted MCP sign-in** (`GET /app/:appIdentifier/mcp/:interaction`), which runs the same steps on the auth portal; nothing is refused for a missing URL. \n\nClient and `redirect_uri` are validated first and a failure there never redirects \u2014 the open-redirect discipline `GET /mcp/oauth/authorize` and `GET /api/client/oidc/:slug/start` both keep \u2014 and those refusals are RFC 6749\'s flat `oauthError`, which is why none of them appear above. `redirect_uri` is matched **exactly** against the registration, with no loopback-port wildcard: every client here registered itself minutes ago and can name the port it bound, so a wildcard would only widen where a stolen `client_id` may send a browser. \n\nThe code above is the `apiError` envelope because it is a refusal about the **app**, decided before an OAuth parameter is looked at. **`404 not_found` covers an identifier no app carries AND an app with MCP switched off** \u2014 the same single answer the two metadata documents, `register` and the transport give. An earlier draft answered `403 mcp_disabled` here, on the argument that a client which registered while the switch was on is owed the difference between "turned off" and "mistyped"; that argument does not survive the caller being anonymous. This route takes no credential, so the extra code was readable by anyone who could type an identifier, and it handed back precisely the existence distinction every neighbouring route collapses. `mcp_disabled` survives only where the caller has already proved they belong to the app \u2014 the two decision routes under `/api/client/mcp/interactions/:id`.'
   },
   {
     method: "POST",
@@ -6720,10 +7229,46 @@ var ROUTES = [
     params: [],
     query: null,
     request: clientLoginRequest,
-    response: sessionTokens,
-    errors: ["rate_limited", "validation_error", "invalid_credentials"],
+    response: clientSignInResult,
+    errors: ["rate_limited", "validation_error", "invalid_credentials", "method_not_allowed"],
     transport: "http",
-    notes: 'One refusal for every miss \u2014 unknown app, unknown address, wrong password, a `blocked` account and one still `pending_verification` \u2014 because the caller supplies the `app_identifier` unauthenticated, so "this app knows this user" is not a fact the answer may carry. The argon2 verify is paid unconditionally, including for an unknown app identifier, so response time is not an oracle either.'
+    notes: 'One refusal for every miss \u2014 unknown app, unknown address, wrong password, a `blocked` account and one still `pending_verification` \u2014 because the caller supplies the `app_identifier` unauthenticated, so "this app knows this user" is not a fact the answer may carry. The argon2 verify is paid unconditionally, including for an unknown app identifier, so response time is not an oracle either. \n\n**The answer is a `clientSignInResult`**: session tokens, or a `twoFactorChallenge` when the person has a confirmed authenticator or the app requires one \u2014 then no session exists until `POST /api/client/two-factor/verify` or the setup is done. `403 method_not_allowed` when the app has the password method off; it names the app\'s policy, not a person.'
+  },
+  {
+    method: "POST",
+    path: "/api/client/login/code",
+    section: "client-auth",
+    summary: "Mails a six-digit sign-in code, and answers the same whether or not the address exists.",
+    audience: "client",
+    auth: "none",
+    rateLimited: true,
+    ownerTier: false,
+    status: 202,
+    params: [],
+    query: null,
+    request: clientLoginCodeRequest,
+    response: null,
+    errors: ["rate_limited", "validation_error", "not_found", "method_not_allowed"],
+    transport: "http",
+    notes: "**`202` and an empty body for every request the policy allows**, in status, body and timing, whether or not the address names an active account of this app \u2014 a decoy like `POST /api/client/resend-verification`, so this is no enumeration oracle. A mail goes out for an `active` account and for one still `pending_verification` \u2014 spending the code proves the address, as the verification link would \u2014 and never for a `blocked` one or an unknown address. The code is six digits, valid ten minutes, takes five wrong attempts, and a new request expires the previous one for the same address; a request within sixty seconds of the last sends no second mail. The address is trimmed and compared case-insensitively. `404 not_found` is the **app identifier**, never the address; `403 method_not_allowed` when the app has the email-code method off. Limited per app, address and IP, so it cannot be used to mail somebody repeatedly."
+  },
+  {
+    method: "POST",
+    path: "/api/client/login/code/verify",
+    section: "client-auth",
+    summary: "Spends a mailed sign-in code and answers a session or a two-factor challenge.",
+    audience: "client",
+    auth: "none",
+    rateLimited: true,
+    ownerTier: false,
+    status: 200,
+    params: [],
+    query: null,
+    request: clientLoginCodeVerifyRequest,
+    response: clientSignInResult,
+    errors: ["rate_limited", "validation_error", "invalid_code", "token_spent", "method_not_allowed"],
+    transport: "http",
+    notes: "A wrong code is `400 invalid_code` with `details.attempts_left` (`invalidCodeDetails`). A code that is spent, past its ten minutes, out of attempts, or was never mailed is `410 token_spent` \u2014 one answer, because telling them apart would say whether a code was ever sent to that address; the recovery is the same, ask for a new code. The address is trimmed and compared case-insensitively, so the address typed at the request and here need not match in case. \n\n**The answer is a `clientSignInResult`**, like the password login: tokens, or a `twoFactorChallenge` when the person has an authenticator or the app requires one. A pending-verification account that spends a code is activated \u2014 reading a mail at that address is the proof verification asks for."
   },
   {
     method: "POST",
@@ -6741,7 +7286,7 @@ var ROUTES = [
     response: null,
     errors: ["rate_limited", "validation_error", "not_found", "registration_closed", "domain_not_allowed", "target_state_conflict", "quota_exceeded"],
     transport: "http",
-    notes: "**`202` and an empty body for every request policy allows** \u2014 a new address, one this app already knows and one it does not answer identically, in status, body and timing. An answer that depended on existence would be the account-enumeration oracle the whole client family is built to avoid. The account cannot log in until the mailed link is spent; `POST /api/client/verify-email` is what does that. \n\n**An address on an account still `pending_verification` is re-registered, not ignored.** The password and display name from this call replace what is stored, every outstanding verification link for the address stops working, and a fresh one is mailed. Otherwise whoever typed an address first would own the password of the account its real owner later verifies. An address on an `active` account changes nothing and sends nothing \u2014 that account has already been proven, and its way back in is `POST /api/client/password/reset`. Neither case is visible in the answer. \n\nThe refusals it *does* make are about policy or about what the caller typed, never about a person. `403 registration_closed` when the app has self-registration off and `403 domain_not_allowed` when the address is outside `allowed_domains`: both are the developer's own configuration, and a stranger learns the app's policy rather than who is in it. **A password under twelve characters is part of that `400 validation_error`** and not a code of its own \u2014 the minimum is the `password` field's schema rule, and the error names the field, which is what a form needs to mark it. `404 not_found` names an **app identifier no app carries**, and never an address: an app identifier is already public (it is in the MCP metadata path and in the developer's own URLs), while collapsing it into `registration_closed` sent a developer who mistyped their own identifier hunting a configuration bug that was not there. `409 target_state_conflict` when the app has configured no `verify_url` or has no default role \u2014 there would be nowhere to send the person and no role to give them, and mailing a link that leads nowhere is worse than refusing. \n\n**`409 quota_exceeded` when the org is at its `max_end_users` limit**, counted across every app of the org. It is the one refusal here that is answered **before the address is looked at** \u2014 and that ordering is the point rather than an implementation detail: a quota checked after the existence branch would answer `202` for an address the app already knows and `409` for one it does not, which is precisely the enumeration oracle every other line of this route exists to close. At the quota, every registration is refused identically, including one that would only have re-mailed a pending account's link."
+    notes: "**`202` and an empty body for every request policy allows** \u2014 a new address, one this app already knows and one it does not answer identically, in status, body and timing. An answer that depended on existence would be the account-enumeration oracle the whole client family is built to avoid. The account cannot log in until the mailed link is spent; `POST /api/client/verify-email` is what does that. \n\n**An address on an account still `pending_verification` is re-registered, not ignored.** The password and display name from this call replace what is stored, every outstanding verification link for the address stops working, and a fresh one is mailed. Otherwise whoever typed an address first would own the password of the account its real owner later verifies. An address on an `active` account changes nothing and sends nothing \u2014 that account has already been proven, and its way back in is `POST /api/client/password/reset`. Neither case is visible in the answer. \n\nThe refusals it *does* make are about policy or about what the caller typed, never about a person. `403 registration_closed` when the app has self-registration off and `403 domain_not_allowed` when the address is outside `allowed_domains`: both are the developer's own configuration, and a stranger learns the app's policy rather than who is in it. **A password under twelve characters is part of that `400 validation_error`** and not a code of its own \u2014 the minimum is the `password` field's schema rule, and the error names the field, which is what a form needs to mark it. The same `400` names `password` when one is missing while the app's password method is on, or sent while it is off: an email-code-only app registers people without one. `404 not_found` names an **app identifier no app carries**, and never an address: an app identifier is already public (it is in the MCP metadata path and in the developer's own URLs), while collapsing it into `registration_closed` sent a developer who mistyped their own identifier hunting a configuration bug that was not there. `409 target_state_conflict` when the app has no default role \u2014 there would be no role to give the person. An app with no `verify_url` is not refused: the mailed link points at the hosted confirmation page instead. \n\n**`409 quota_exceeded` when the org is at its `max_end_users` limit**, counted across every app of the org. It is the one refusal here that is answered **before the address is looked at** \u2014 and that ordering is the point rather than an implementation detail: a quota checked after the existence branch would answer `202` for an address the app already knows and `409` for one it does not, which is precisely the enumeration oracle every other line of this route exists to close. At the quota, every registration is refused identically, including one that would only have re-mailed a pending account's link."
   },
   {
     method: "POST",
@@ -6756,10 +7301,10 @@ var ROUTES = [
     params: [],
     query: null,
     request: clientVerifyEmailRequest,
-    response: sessionTokens,
+    response: clientSignInResult,
     errors: ["rate_limited", "validation_error", "token_spent"],
     transport: "http",
-    notes: "**The answer is a session, not a `204`.** Somebody who has just proved they can read the mail should not be asked to type their password again on the next screen, and the app has an access token to carry them into it. The token is spent first and the account is activated second, as **two writes**: the spend is the atomic one, so a link opened twice cannot mint two sessions, but a process that died between them would leave a spent token on an account still `pending_verification`, whose recovery is `POST /api/client/resend-verification`. Spending the token also proves the address, so a later `PATCH` may return the account to `active` after a block. \n\n**One refusal for every token that does not work: `410 token_spent`** \u2014 unknown, past its twenty-four hours, or already used. There is one code because distinguishing them would tell a stranger whether a token ever existed, and because the recovery is the same in all three cases: ask for a fresh link with `POST /api/client/resend-verification`. An app rendering this refusal should offer that and nothing conditional on which of the three it was."
+    notes: "**The answer is a session, not a `204`** \u2014 or, as on every sign-in step, a `twoFactorChallenge` when the app requires two-factor (`clientSignInResult`). Somebody who has just proved they can read the mail should not be asked to type their password again on the next screen, and the app has an access token to carry them into it. The token is spent first and the account is activated second, as **two writes**: the spend is the atomic one, so a link opened twice cannot mint two sessions, but a process that died between them would leave a spent token on an account still `pending_verification`, whose recovery is `POST /api/client/resend-verification`. Spending the token also proves the address, so a later `PATCH` may return the account to `active` after a block. \n\n**One refusal for every token that does not work: `410 token_spent`** \u2014 unknown, past its twenty-four hours, or already used. There is one code because distinguishing them would tell a stranger whether a token ever existed, and because the recovery is the same in all three cases: ask for a fresh link with `POST /api/client/resend-verification`. An app rendering this refusal should offer that and nothing conditional on which of the three it was."
   },
   {
     method: "POST",
@@ -6793,9 +7338,9 @@ var ROUTES = [
     query: null,
     request: clientPasswordResetRequest,
     response: null,
-    errors: ["rate_limited", "validation_error", "not_found"],
+    errors: ["rate_limited", "validation_error", "not_found", "method_not_allowed"],
     transport: "http",
-    notes: "**The app-user twin of `POST /api/auth/password/reset`, and a different shape** because the two surfaces name a person differently: a Fleetless address is globally unique and resolves alone, an app user's is unique only within their app, so the pair is the identifier. Status, body and timing are identical for a known and an unknown address. An account with no Fleetless password \u2014 one created through an identity provider \u2014 is mailed nothing and still answers `202`. `404 not_found` is the **app identifier**, never the address. The link points at the app's `reset_url`; an app that has configured none can send no mail, which the `202` does not distinguish, because saying so would answer for the address as well."
+    notes: "The pair of app identifier and address is the identifier: an app user's address is unique only within their app. `403 method_not_allowed` when the app has the password method off \u2014 a reset link whose confirmation would be refused is not mailed; the code names the app's policy, not a person. Status, body and timing are identical for a known and an unknown address. An account with no password \u2014 one created through an identity provider \u2014 is mailed nothing and still answers `202`. `404 not_found` is the **app identifier**, never the address. The link points at the app's `reset_url`, or at the hosted reset page when the app has configured none."
   },
   {
     method: "POST",
@@ -6810,10 +7355,10 @@ var ROUTES = [
     params: [],
     query: null,
     request: clientPasswordResetConfirmRequest,
-    response: sessionTokens,
-    errors: ["rate_limited", "validation_error", "token_spent"],
+    response: clientSignInResult,
+    errors: ["rate_limited", "validation_error", "token_spent", "method_not_allowed"],
     transport: "http",
-    notes: "**Every refresh family of that account is revoked**, then a fresh pair is minted for the caller \u2014 a forgotten password is one of the two states where somebody else may be holding a live session, and the person completing the reset is the one who should keep theirs. The account is activated if it was still `pending_verification`: reading a mail at that address is the same proof verification asks for. \n\n**One refusal for every token that does not work: `410 token_spent`** \u2014 unknown, past its hour, or already used. There is one code because distinguishing them would tell a stranger whether a token ever existed, and the recovery is identical either way: ask for a new link. A replacement password under twelve characters is a `400 validation_error` naming the `new_password` field \u2014 the twelve-character minimum is that field's schema rule, and it is refused the way any other malformed field is."
+    notes: "**A new password does not bypass the second factor**: a person with an authenticator, or in an app that requires one, gets a `twoFactorChallenge` instead of tokens (`clientSignInResult`), and the authenticator stays on. `403 method_not_allowed` when the app has the password method off. \n\n**Every refresh family of that account is revoked**, then a fresh pair is minted for the caller \u2014 a forgotten password is one of the two states where somebody else may be holding a live session, and the person completing the reset is the one who should keep theirs. The account is activated if it was still `pending_verification`: reading a mail at that address is the same proof verification asks for. \n\n**One refusal for every token that does not work: `410 token_spent`** \u2014 unknown, past its hour, or already used. There is one code because distinguishing them would tell a stranger whether a token ever existed, and the recovery is identical either way: ask for a new link. A replacement password under twelve characters is a `400 validation_error` naming the `new_password` field \u2014 the twelve-character minimum is that field's schema rule, and it is refused the way any other malformed field is."
   },
   {
     method: "POST",
@@ -6828,10 +7373,10 @@ var ROUTES = [
     params: [],
     query: null,
     request: clientAcceptInvitationRequest,
-    response: sessionTokens,
+    response: clientSignInResult,
     errors: ["rate_limited", "validation_error", "token_spent", "email_taken", "target_state_conflict", "quota_exceeded"],
     transport: "http",
-    notes: "**An app invitation, not a team one.** `POST /api/org/invitations/accept` is the other space and answers `204`; this one answers a session, because the person is landing in the developer's app and there is no second door for them to sign in through. The role is the one the invitation fixed at creation, so a later change to the app's default role does not re-aim a link already in somebody's inbox, and the invitation **bypasses `allowed_domains`** \u2014 a developer inviting somebody by hand has already made the decision the whitelist automates. \n\n**One refusal for every token that does not work: `410 token_spent`** \u2014 unknown, expired past the seven days, revoked by the developer, or already accepted. There is one code because telling them apart would say whether a token ever existed, and because the one thing the holder of a dead link can do is ask the developer for a new one, whichever of the four it was. A chosen password under twelve characters is part of the `400 validation_error`, naming the `password` field. `409 email_taken` is an address this app has acquired since the invitation was written **as an account that is already in use** \u2014 the invitation stays outstanding rather than being spent, so the developer can revoke it or point the person at the login. An address that registered itself and is still `pending_verification` is not that state: accepting sets the password the invitee just chose, activates the account and gives it the invitation's role, because reading the invitation mail proves the address the verification link was waiting on. \n\n`409 target_state_conflict` names `role_id` with rule `not_set` when the role the invitation was fixed to has since been deleted and the app has no default role to fall back on: there is no access to hand the acceptor, and creating an account with none would be worse than saying so. \n\n**`409 quota_exceeded` when accepting would CREATE an account and the org is at its `max_end_users` limit**, counted across every app of the org. An invitation that names a row the developer already created, and one whose address is held by an unfinished self-registration, both finish an account that already counts \u2014 those are not refused, because the org is not one account larger afterwards. The token is not spent by the refusal: the developer can raise the limit, or delete somebody, and the same link still works."
+    notes: "**An app invitation, not a team one.** `POST /api/org/invitations/accept` is the other space and answers `204`; this one answers a session, because the person is landing in the developer's app and there is no second door for them to sign in through. The role is the one the invitation fixed at creation, so a later change to the app's default role does not re-aim a link already in somebody's inbox, and the invitation **bypasses `allowed_domains`** \u2014 a developer inviting somebody by hand has already made the decision the whitelist automates. The answer is a `clientSignInResult`: a `twoFactorChallenge` instead of tokens when the app requires two-factor. `password` is required while the app's password method is on and refused while it is off, both as `400 validation_error` naming the field. \n\n**One refusal for every token that does not work: `410 token_spent`** \u2014 unknown, expired past the seven days, revoked by the developer, or already accepted. There is one code because telling them apart would say whether a token ever existed, and because the one thing the holder of a dead link can do is ask the developer for a new one, whichever of the four it was. A chosen password under twelve characters is part of the `400 validation_error`, naming the `password` field. `409 email_taken` is an address this app has acquired since the invitation was written **as an account that is already in use** \u2014 the invitation stays outstanding rather than being spent, so the developer can revoke it or point the person at the login. An address that registered itself and is still `pending_verification` is not that state: accepting sets the password the invitee just chose, activates the account and gives it the invitation's role, because reading the invitation mail proves the address the verification link was waiting on. \n\n`409 target_state_conflict` names `role_id` with rule `not_set` when the role the invitation was fixed to has since been deleted and the app has no default role to fall back on: there is no access to hand the acceptor, and creating an account with none would be worse than saying so. \n\n**`409 quota_exceeded` when accepting would CREATE an account and the org is at its `max_end_users` limit**, counted across every app of the org. An invitation that names a row the developer already created, and one whose address is held by an unfinished self-registration, both finish an account that already counts \u2014 those are not refused, because the org is not one account larger afterwards. The token is not spent by the refusal: the developer can raise the limit, or delete somebody, and the same link still works."
   },
   {
     method: "POST",
@@ -6883,9 +7428,9 @@ var ROUTES = [
     query: null,
     request: passwordChangeRequest,
     response: sessionTokens,
-    errors: [...CLIENT_GUARD, "validation_error", "invalid_credentials", "target_state_conflict"],
+    errors: [...CLIENT_GUARD, "validation_error", "invalid_credentials", "target_state_conflict", "method_not_allowed"],
     transport: "http",
-    notes: 'The guard admits all three caller kinds, but a password belongs to an app user specifically \u2014 a developer bearer or a server key reaching this is `401 unauthorized`. Every other session of the account ends; the answer is the replacement pair, so the tab that made the change stays signed in. An app user belongs to one app, so "every session" is this app\'s. An account that has **no password** \u2014 an OIDC-only app user, which the schema admits \u2014 answers `409 target_state_conflict` naming the `password` field with rule `not_set`, not `401`: the session is live and the token is fine, it is the account that has nothing to change, and telling such a caller to sign in again sends them round a loop that ends here.'
+    notes: '`403 method_not_allowed` when the app has the password method off: a stored password stays stored but is not in use, so it is not changed either. The guard admits all three caller kinds, but a password belongs to an app user specifically \u2014 a developer bearer or a server key reaching this is `401 unauthorized`. Every other session of the account ends; the answer is the replacement pair, so the tab that made the change stays signed in. An app user belongs to one app, so "every session" is this app\'s. An account that has **no password** \u2014 an OIDC-only app user, which the schema admits \u2014 answers `409 target_state_conflict` naming the `password` field with rule `not_set`, not `401`: the session is live and the token is fine, it is the account that has nothing to change, and telling such a caller to sign in again sends them round a loop that ends here.'
   },
   {
     method: "GET",
@@ -6905,6 +7450,80 @@ var ROUTES = [
     transport: "http",
     notes: "The one route that answers for all three caller kinds \u2014 a developer bearer, an app-user bearer and a server key \u2014 which is why the shape names each of `developer_id`, `app_user_id` and `server_key_id` and fills exactly one."
   },
+  /* ------------------------------------------------ app-user two-factor */
+  {
+    method: "POST",
+    path: "/api/client/two-factor/verify",
+    section: "client-auth",
+    summary: "Answers a two-factor challenge with an authenticator or recovery code, and answers the session.",
+    audience: "client",
+    auth: "none",
+    rateLimited: true,
+    ownerTier: false,
+    status: 200,
+    params: [],
+    query: null,
+    request: clientTwoFactorVerifyRequest,
+    response: sessionTokens,
+    errors: ["rate_limited", "validation_error", "invalid_code", "token_spent"],
+    transport: "http",
+    notes: "The challenge is the one a sign-in step answered with `two_factor_required`; it lives five minutes and takes five wrong codes, after which it is `410 token_spent` and the sign-in starts over. A wrong code is `400 invalid_code` with `details.attempts_left`. **A code is accepted at most once**: the same authenticator code sent twice, even at the same moment, signs in exactly once. A recovery code is spent by its use and audited as `app_user.recovery_code_used`. Exactly one of `code` and `recovery_code`, or `400 validation_error`."
+  },
+  {
+    method: "POST",
+    path: "/api/client/two-factor/setup",
+    section: "client-auth",
+    summary: "Starts an authenticator setup and answers its secret and otpauth URL.",
+    audience: "client",
+    auth: "in_handler",
+    rateLimited: true,
+    ownerTier: false,
+    status: 200,
+    params: [],
+    query: null,
+    request: clientTwoFactorSetupRequest,
+    requestOptional: true,
+    response: twoFactorSetupResponse,
+    errors: ["rate_limited", "validation_error", "token_spent", "unauthorized", "target_state_conflict"],
+    transport: "http",
+    notes: "**Two ways in, decided in the handler.** During sign-in the body carries the `two_factor_setup_required` challenge, and that is the credential; from the app's own account settings the app user's bearer is, with no challenge and an empty or missing body. Neither is `401 unauthorized`, and a dead challenge is `410 token_spent`. `409 target_state_conflict` names `two_factor` with rule `off` when the app's policy is `off`. The secret is not in use until `POST /api/client/two-factor/setup/confirm` accepts a code from it; a second call replaces a pending secret, and an account that already has an authenticator keeps it until the new one is confirmed."
+  },
+  {
+    method: "POST",
+    path: "/api/client/two-factor/setup/confirm",
+    section: "client-auth",
+    summary: "Confirms the new authenticator with a code and answers the recovery codes and a session.",
+    audience: "client",
+    auth: "in_handler",
+    rateLimited: true,
+    ownerTier: false,
+    status: 200,
+    params: [],
+    query: null,
+    request: clientTwoFactorSetupConfirmRequest,
+    response: clientTwoFactorSetupConfirmResponse,
+    errors: ["rate_limited", "validation_error", "invalid_code", "token_spent", "unauthorized"],
+    transport: "http",
+    notes: "The same two ways in as `setup`. A code that does not match the pending secret is `400 invalid_code`; no pending setup, or a dead challenge, is `410 token_spent`. On success the authenticator is on, ten recovery codes are issued \u2014 shown this once, any earlier set void \u2014 and the answer carries a session: the one the sign-in was waiting for, or, from account settings, a fresh one while every other session of the account ends. Audited as `app_user.two_factor_enabled`."
+  },
+  {
+    method: "DELETE",
+    path: "/api/client/two-factor",
+    section: "client-auth",
+    summary: "Turns the signed-in app user's authenticator off.",
+    audience: "client",
+    auth: "developer_or_client",
+    rateLimited: true,
+    ownerTier: false,
+    status: 204,
+    params: [],
+    query: null,
+    request: clientTwoFactorDisableRequest,
+    response: null,
+    errors: [...CLIENT_GUARD, "rate_limited", "validation_error", "invalid_code", "target_state_conflict"],
+    transport: "http",
+    notes: "The app user's own door; a developer bearer or a server key is `401 unauthorized`, because the factor is the person's. A current code proves they still hold the authenticator: a stolen session alone cannot remove it. The authenticator and every recovery code go. `409 target_state_conflict` names `two_factor` with rule `required` while the app requires two-factor, and with rule `off` when there is none to remove. Audited as `app_user.two_factor_disabled`. The developer's support door is `DELETE /api/apps/:id/users/:userId/two-factor`."
+  },
   /* ---------------------------------------- app-user sign-in through an IdP */
   {
     method: "GET",
@@ -6958,7 +7577,7 @@ var ROUTES = [
     response: null,
     errors: ["rate_limited"],
     transport: "http",
-    notes: "**One callback URL for every app and every provider**, and the value of `appAuthConfig.oidc_callback_url` \u2014 the string a developer registers at their IdP. `CLIENT_OIDC_CALLBACK_PATH` in `client-auth.ts` is the single spelling of this path; the URL is that path on the cloud's canonical public base, never a friendly alias, because the provider compares the redirect target against the one string it was given. \n\n**Rate limited per ip, generously.** The first draft left this route unlimited on the argument that the caller is an identity provider redirecting somebody's browser, so a limiter would drop real sign-ins on the strength of traffic none of those people sent. The cost of that argument is a `state` obtained from one `start` being replayable for the interaction's full ten minutes, unbounded and unauthenticated, with every replay driving a server-side POST to the developer's token endpoint and one audit row into their org \u2014 an amplifier against a third party. The interaction is now spent on **every** terminal outcome, refusals included, which closes the replay itself; the limiter is the ceiling on how fast the attempts may arrive at all. It is per ip and sized for a browser, so a person completing a sign-in never meets it. `429 rate_limited` is the one `apiError` this route can answer, and it is not a sign-in outcome \u2014 it is a refusal to begin the work, which is why it does not ride back to the app as an `?error=`. \n\nThe query is the **provider's** rather than a Fleetless shape, and `clientOidcCallbackQuery` describes it **without being strict**: `state` always, `code` on success, `error` and `error_description` on the provider's own refusal, and whatever else that provider adds \u2014 RFC 9207's `iss`, a `session_state`, a vendor field. Refusing those would refuse conforming providers, the trap `POST /mcp/oauth/register` documents avoiding. `state` is the required field because it is the only one Fleetless minted. \n\n**It lists `rate_limited` and no other code, because every sign-in outcome it has is a redirect.** Success and failure alike are a `302` to the app's own `redirect_uri`: `?code=\u2026&state=\u2026` when a session was resolved, `?error=<clientOidcErrorCode>&state=\u2026` when it was not, so the app renders its own message and can bind either answer to the request it started. Fleetless shows an app user no page. \n\n**The one exception is a `state` that resolves to no interaction** \u2014 unknown, hand-edited, or past its ten minutes. Then there is no confirmed redirect target to carry the answer to, and bouncing a browser to an unvalidated one is the hole the whole flow is arranged to avoid, so the cloud renders an HTML problem page at `400`. That is the only Fleetless-rendered surface an app user can reach. It is HTML rather than an `apiError`, which is why no code is listed: a code here would document an envelope no caller receives, and this manifest's other HTML pages (`GET /mcp/oauth/interaction/:id`, `GET /console/oauth/interaction/:id`) say their status in prose for the same reason."
+    notes: "**One callback URL for every app and every provider**, and the value of `appAuthConfig.oidc_callback_url` \u2014 the string a developer registers at their IdP. `CLIENT_OIDC_CALLBACK_PATH` in `client-auth.ts` is the single spelling of this path; the URL is that path on the cloud's canonical public base, never a friendly alias, because the provider compares the redirect target against the one string it was given. \n\n**Rate limited per ip, generously.** The first draft left this route unlimited on the argument that the caller is an identity provider redirecting somebody's browser, so a limiter would drop real sign-ins on the strength of traffic none of those people sent. The cost of that argument is a `state` obtained from one `start` being replayable for the interaction's full ten minutes, unbounded and unauthenticated, with every replay driving a server-side POST to the developer's token endpoint and one audit row into their org \u2014 an amplifier against a third party. The interaction is now spent on **every** terminal outcome, refusals included, which closes the replay itself; the limiter is the ceiling on how fast the attempts may arrive at all. It is per ip and sized for a browser, so a person completing a sign-in never meets it. `429 rate_limited` is the one `apiError` this route can answer, and it is not a sign-in outcome \u2014 it is a refusal to begin the work, which is why it does not ride back to the app as an `?error=`. \n\nThe query is the **provider's** rather than a Fleetless shape, and `clientOidcCallbackQuery` describes it **without being strict**: `state` always, `code` on success, `error` and `error_description` on the provider's own refusal, and whatever else that provider adds \u2014 RFC 9207's `iss`, a `session_state`, a vendor field. Refusing those would refuse conforming providers, the trap `POST /mcp/oauth/register` documents avoiding. `state` is the required field because it is the only one Fleetless minted. \n\n**It lists `rate_limited` and no other code, because every sign-in outcome it has is a redirect.** Success and failure alike are a `302` to the app's own `redirect_uri`: `?code=\u2026&state=\u2026` when a session was resolved, `?error=<clientOidcErrorCode>&state=\u2026` when it was not, so the app renders its own message and can bind either answer to the request it started. This route renders no page for an outcome. \n\n**The one exception is a `state` that resolves to no interaction** \u2014 unknown, hand-edited, or past its ten minutes. Then there is no confirmed redirect target to carry the answer to, and bouncing a browser to an unvalidated one is the hole the whole flow is arranged to avoid, so the cloud renders an HTML problem page at `400`. It is HTML rather than an `apiError`, which is why no code is listed: a code here would document an envelope no caller receives, and this manifest's other HTML pages (`GET /mcp/oauth/interaction/:id`, `GET /console/oauth/interaction/:id`) say their status in prose for the same reason."
   },
   {
     method: "POST",
@@ -8149,6 +8768,24 @@ var ROUTES = [
     transport: "http",
     notes: "A window longer than `USAGE_WINDOW_MAX_DAYS` is refused naming the field, not silently capped: a caller who asked for more than the platform will answer is owed a refusal, not a shorter answer they will mistake for the whole picture. `from_day <= to_day` is a cross-field rule no JSON Schema can express and is enforced here. The window is echoed back."
   },
+  {
+    method: "POST",
+    path: "/api/feedback",
+    section: "org",
+    summary: "Sends a message from a developer to the people who build Fleetless.",
+    audience: "developer",
+    auth: "developer",
+    rateLimited: true,
+    ownerTier: false,
+    status: 202,
+    params: [],
+    query: null,
+    request: feedbackRequest,
+    response: feedbackResponse,
+    errors: [...DEVELOPER_GUARD, "validation_error", "rate_limited"],
+    transport: "http",
+    notes: "The message is stored before any mail is tried, so `202` means it is kept whatever `mail` says: `sent`, `failed`, or `not_configured` when this cloud has no feedback address. At most 10 messages per developer per hour; the 11th answers `429 rate_limited` with `retry_after_ms`. Replies come by mail, to the sender's address."
+  },
   /* ------------------------------------------------- assets (robot upload) */
   {
     method: "POST",
@@ -8291,13 +8928,19 @@ var ServerKeyCredentials = class {
 function displayNameField(displayName) {
   return displayName === void 0 ? {} : { display_name: displayName };
 }
+function passwordField(password2) {
+  return password2 === void 0 ? {} : { password: password2 };
+}
+function challengeField(challenge) {
+  return challenge === void 0 ? {} : { challenge };
+}
 function createPublicAuthCalls(http, appIdentifier2) {
   return {
     async register(input) {
       const body = {
         app_identifier: appIdentifier2,
         email: input.email,
-        password: input.password,
+        ...passwordField(input.password),
         ...displayNameField(input.displayName)
       };
       await http.request("/api/client/register", { method: "POST", skipAuth: true, expectEmptyBody: true, body });
@@ -8309,6 +8952,10 @@ function createPublicAuthCalls(http, appIdentifier2) {
     async requestPasswordReset(email) {
       const body = { app_identifier: appIdentifier2, email };
       await http.request("/api/client/password/reset", { method: "POST", skipAuth: true, expectEmptyBody: true, body });
+    },
+    async requestLoginCode(email) {
+      const body = { app_identifier: appIdentifier2, email };
+      await http.request("/api/client/login/code", { method: "POST", skipAuth: true, expectEmptyBody: true, body });
     }
   };
 }
@@ -8316,6 +8963,11 @@ function createSessionAuth(http, tokenStore, appIdentifier2) {
   async function storeSession(tokens) {
     await tokenStore.save(tokens);
   }
+  async function completeSignIn(result) {
+    if ("status" in result) return { status: result.status, challenge: result.challenge };
+    await storeSession(result);
+    return { status: "signed_in" };
+  }
   async function identity() {
     return http.request("/api/client/me", {});
   }
@@ -8323,13 +8975,18 @@ function createSessionAuth(http, tokenStore, appIdentifier2) {
     ...createPublicAuthCalls(http, appIdentifier2),
     async verifyEmail(token) {
       const body = { token };
-      const tokens = await http.request("/api/client/verify-email", { method: "POST", skipAuth: true, body });
-      await storeSession(tokens);
+      const result = await http.request("/api/client/verify-email", { method: "POST", skipAuth: true, body });
+      return completeSignIn(result);
     },
     async login(email, password2) {
       const body = { app_identifier: appIdentifier2, email, password: password2 };
-      const tokens = await http.request("/api/client/login", { method: "POST", skipAuth: true, body });
-      await storeSession(tokens);
+      const result = await http.request("/api/client/login", { method: "POST", skipAuth: true, body });
+      return completeSignIn(result);
+    },
+    async verifyLoginCode(email, code) {
+      const body = { app_identifier: appIdentifier2, email, code };
+      const result = await http.request("/api/client/login/code/verify", { method: "POST", skipAuth: true, body });
+      return completeSignIn(result);
     },
     async logout() {
       const session = await tokenStore.load();
@@ -8343,6 +9000,13 @@ function createSessionAuth(http, tokenStore, appIdentifier2) {
       await tokenStore.save(null);
     },
     async me() {
+      const session = await tokenStore.load();
+      if (!session) {
+        throw new FleetlessError(
+          "no_session",
+          "auth.me() has no session to ask about \u2014 call login()/verifyEmail()/confirmPasswordReset()/acceptInvitation() and get back { status: 'signed_in' } first; a pending two-factor challenge does not count as signed in."
+        );
+      }
       return identity();
     },
     async changePassword(currentPassword, newPassword) {
@@ -8352,23 +9016,61 @@ function createSessionAuth(http, tokenStore, appIdentifier2) {
     },
     async confirmPasswordReset(token, newPassword) {
       const body = { token, new_password: newPassword };
-      const tokens = await http.request("/api/client/password/reset/confirm", { method: "POST", skipAuth: true, body });
-      await storeSession(tokens);
+      const result = await http.request("/api/client/password/reset/confirm", { method: "POST", skipAuth: true, body });
+      return completeSignIn(result);
     },
     async acceptInvitation(input) {
       const body = {
         token: input.token,
-        password: input.password,
+        ...passwordField(input.password),
         ...displayNameField(input.displayName)
       };
-      const tokens = await http.request("/api/client/invitations/accept", { method: "POST", skipAuth: true, body });
+      const result = await http.request("/api/client/invitations/accept", { method: "POST", skipAuth: true, body });
+      return completeSignIn(result);
+    },
+    async verifyTwoFactor(input) {
+      const body = {
+        challenge: input.challenge,
+        ...input.code !== void 0 ? { code: input.code } : {},
+        ...input.recoveryCode !== void 0 ? { recovery_code: input.recoveryCode } : {}
+      };
+      const tokens = await http.request("/api/client/two-factor/verify", { method: "POST", skipAuth: true, body });
       await storeSession(tokens);
     },
+    async beginTwoFactorSetup(input) {
+      const challenge = input?.challenge;
+      const body = challengeField(challenge);
+      const response = await http.request("/api/client/two-factor/setup", {
+        method: "POST",
+        skipAuth: challenge !== void 0,
+        body
+      });
+      return { secret: response.secret, otpauthUrl: response.otpauth_url };
+    },
+    async confirmTwoFactorSetup(input) {
+      const body = { code: input.code, ...challengeField(input.challenge) };
+      const response = await http.request("/api/client/two-factor/setup/confirm", {
+        method: "POST",
+        skipAuth: input.challenge !== void 0,
+        body
+      });
+      await storeSession(response.session);
+      return { recoveryCodes: response.recovery_codes };
+    },
+    async disableTwoFactor(code) {
+      const body = { code };
+      await http.request("/api/client/two-factor", { method: "DELETE", expectEmptyBody: true, body });
+    },
     async listProviders() {
       const query = new URLSearchParams({ app_identifier: appIdentifier2 });
       const response = await http.request(`/api/client/providers?${query.toString()}`, { skipAuth: true });
       return response.providers;
     },
+    async signInMethods() {
+      const query = new URLSearchParams({ app_identifier: appIdentifier2 });
+      const response = await http.request(`/api/client/providers?${query.toString()}`, { skipAuth: true });
+      return { password: response.sign_in_methods.password, emailCode: response.sign_in_methods.email_code };
+    },
     async beginOidcLogin(input) {
       const state = generateState();
       const codeVerifier = generateCodeVerifier();
@@ -8452,11 +9154,11 @@ function createServerKeyAuth(http, appIdentifier2, option = "serverKey") {
   const subject = option === "serverKey" ? "a server key" : "a supplied credential";
   const holder = option === "serverKey" ? "a server-key client" : "a client with a supplied credential";
   return {
-    // **`register`, `resendVerification` and `requestPasswordReset` are
-    // allowed here** — see `createPublicAuthCalls`. They are public routes
-    // that name their own subject and answer nothing, so a server-rendered
-    // sign-up or forgot-password page can use the one client its backend
-    // already has.
+    // **`register`, `resendVerification`, `requestPasswordReset` and
+    // `requestLoginCode` are allowed here** — see `createPublicAuthCalls`.
+    // They are public routes that name their own subject and answer
+    // nothing, so a server-rendered sign-up or forgot-password (or
+    // sign-in-by-code) page can use the one client its backend already has.
     ...createPublicAuthCalls(http, appIdentifier2),
     async verifyEmail() {
       serverKeyRefusal("verifyEmail", `the route answers a session and ${holder} has nowhere to store it, so the session would be silently discarded`);
@@ -8464,6 +9166,9 @@ function createServerKeyAuth(http, appIdentifier2, option = "serverKey") {
     async login() {
       serverKeyRefusal("login", `${subject} IS the credential; there is nothing to exchange`);
     },
+    async verifyLoginCode() {
+      serverKeyRefusal("verifyLoginCode", `the route answers a session and ${holder} has nowhere to store it, so the session would be silently discarded`);
+    },
     async logout() {
       serverKeyRefusal("logout", `${subject} holds no session to end`);
     },
@@ -8479,11 +9184,31 @@ function createServerKeyAuth(http, appIdentifier2, option = "serverKey") {
     async acceptInvitation() {
       serverKeyRefusal("acceptInvitation", `the route answers a session and ${holder} has nowhere to store it, so the session would be silently discarded`);
     },
+    async verifyTwoFactor() {
+      serverKeyRefusal("verifyTwoFactor", `the route answers a session and ${holder} has nowhere to store it, so the session would be silently discarded`);
+    },
+    async beginTwoFactorSetup() {
+      serverKeyRefusal("beginTwoFactorSetup", `a two-factor setup is a person's own account's, and ${subject} is not a person's session`);
+    },
+    async confirmTwoFactorSetup() {
+      serverKeyRefusal(
+        "confirmTwoFactorSetup",
+        `a two-factor setup is a person's own account's, and ${holder} is not a person's session and has nowhere to store the one this route answers with`
+      );
+    },
+    async disableTwoFactor() {
+      serverKeyRefusal("disableTwoFactor", `turning an authenticator off is a person's own decision, and ${subject} is not a person`);
+    },
     async listProviders() {
       const query = new URLSearchParams({ app_identifier: appIdentifier2 });
       const response = await http.request(`/api/client/providers?${query.toString()}`, { skipAuth: true });
       return response.providers;
     },
+    async signInMethods() {
+      const query = new URLSearchParams({ app_identifier: appIdentifier2 });
+      const response = await http.request(`/api/client/providers?${query.toString()}`, { skipAuth: true });
+      return { password: response.sign_in_methods.password, emailCode: response.sign_in_methods.email_code };
+    },
     async beginOidcLogin() {
       serverKeyRefusal("beginOidcLogin", "a federated sign-in is inherently an app user's browser flow");
     },