@fleetless/sdk 4.3.0 → 4.4.0-next.1

package/dist/index.js

@@ -243,7 +243,7 @@ function isRenderKind(kind) {
     }
   }
 }
-async function forEachWithConcurrency(items, limit, fn) {
+async function forEachWithConcurrency(items, limit2, fn) {
   let next = 0;
   let failed = false;
   let firstError;
@@ -261,7 +261,7 @@ async function forEachWithConcurrency(items, limit, fn) {
       }
     }
   }
-  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, () => worker()));
+  await Promise.all(Array.from({ length: Math.min(limit2, items.length) }, () => worker()));
   if (failed) throw firstError;
 }
 function createAssetsApi(http) {
@@ -410,7 +410,7 @@ function createAssetsApi(http) {
   };
 }
 
-// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/common.js
+// node_modules/.pnpm/@fleetless+contracts@6.2.0-next.2/node_modules/@fleetless/contracts/dist/common.js
 import { z } from "zod";
 var SLUG_RULE = "A name is lower-case: it starts with a letter, continues with letters and digits, and joins further words with a single underscore \u2014 `battery_voltage`. Capitals, dashes, dots, spaces, a leading digit and a doubled or trailing underscore are all refused.";
 var slug = z.string().min(2).max(63).regex(/^[a-z][a-z0-9]*(?:_[a-z0-9]+)*$/, SLUG_RULE);
@@ -441,7 +441,7 @@ var applyError = z.object({
   details: z.record(z.string(), z.unknown()).optional()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/mcp.js
+// node_modules/.pnpm/@fleetless+contracts@6.2.0-next.2/node_modules/@fleetless/contracts/dist/mcp.js
 import { z as z2 } from "zod";
 function mcpAppEndpointPath(appIdentifier2) {
   return `/mcp/${appIdentifier2}`;
@@ -490,10 +490,10 @@ var mcpRolePreviewResponse = z2.object({
 });
 var MCP_ASSET_LINK_TTL_MS = 15 * 60 * 1e3;
 
-// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/protocol.js
+// node_modules/.pnpm/@fleetless+contracts@6.2.0-next.2/node_modules/@fleetless/contracts/dist/protocol.js
 import { z as z8 } from "zod";
 
-// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/assets.js
+// node_modules/.pnpm/@fleetless+contracts@6.2.0-next.2/node_modules/@fleetless/contracts/dist/assets.js
 import { z as z3 } from "zod";
 var assetKind = z3.enum(["urdf", "mesh", "texture"]);
 var asset = z3.object({
@@ -813,10 +813,10 @@ var assetSyncBusyDetails = z3.object({
   started_at_ms: z3.number().int().nonnegative()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/config.js
+// node_modules/.pnpm/@fleetless+contracts@6.2.0-next.2/node_modules/@fleetless/contracts/dist/config.js
 import { z as z5 } from "zod";
 
-// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/alerts.js
+// node_modules/.pnpm/@fleetless+contracts@6.2.0-next.2/node_modules/@fleetless/contracts/dist/alerts.js
 import { z as z4 } from "zod";
 var alertRowCondition = z4.discriminatedUnion("kind", [
   z4.strictObject({
@@ -886,7 +886,7 @@ var putDatapointDisplayRequest = z4.object({
   y_max: z4.number().finite().nullable()
 }).strict();
 
-// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/config.js
+// node_modules/.pnpm/@fleetless+contracts@6.2.0-next.2/node_modules/@fleetless/contracts/dist/config.js
 var RTSP_URL_RULE = "The URL has to begin with `rtsp://` or `rtsps://` \u2014 `rtsp://cam-1.plant.local/stream1`. No other scheme is accepted: the bridge opens this with a library that would equally honour `file:`.";
 var MJPEG_URL_RULE = "The URL has to begin with `http://` or `https://` \u2014 `http://cam-1.plant.local/video.mjpg`. No other scheme is accepted: the bridge opens this with a library that would equally serve `file:`.";
 var DEVICE_PATH_RULE = "A capture device is a path under `/dev/`, and the character straight after it is a letter or a digit \u2014 `/dev/video0`, or a stable `/dev/v4l/by-id/...` symlink. Nothing outside `/dev/` is accepted: the string reaches OpenCV, which would as happily open an ordinary file.";
@@ -1978,7 +1978,7 @@ var configState = z5.object({
   applied_errors: z5.array(applyError).nullable()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/introspection.js
+// node_modules/.pnpm/@fleetless+contracts@6.2.0-next.2/node_modules/@fleetless/contracts/dist/introspection.js
 import { z as z6 } from "zod";
 var rosGraphEntry = z6.object({
   name: rosName,
@@ -2017,7 +2017,7 @@ var typeDefinition = z6.discriminatedUnion("kind", [
   })
 ]);
 
-// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/jobs.js
+// node_modules/.pnpm/@fleetless+contracts@6.2.0-next.2/node_modules/@fleetless/contracts/dist/jobs.js
 import { z as z7 } from "zod";
 var jobState = z7.enum(["running", "unknown", "succeeded", "failed", "cancelled", "lost"]);
 var reportedJobState = jobState.exclude(["unknown"]);
@@ -2254,7 +2254,7 @@ var jobRunSummary = z7.object({
   since_ms: z7.number().int().nonnegative()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/protocol.js
+// node_modules/.pnpm/@fleetless+contracts@6.2.0-next.2/node_modules/@fleetless/contracts/dist/protocol.js
 var DAY_MS = 24 * 60 * 60 * 1e3;
 var MAX_PATIENCE_MS = 12e4;
 var MIN_PATIENCE_MS = 1e3;
@@ -2652,11 +2652,11 @@ var bridgeCameraState = z8.object({
   request_id: z8.string().min(1).max(64).nullable()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/config-issues.js
+// node_modules/.pnpm/@fleetless+contracts@6.2.0-next.2/node_modules/@fleetless/contracts/dist/config-issues.js
 var EXPOSURE_SECTIONS = ["datapoints", "actions", "services", "publishers", "cameras"];
 var EXPOSURE_SECTION_NAMES = new Set(EXPOSURE_SECTIONS);
 
-// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/rest.js
+// node_modules/.pnpm/@fleetless+contracts@6.2.0-next.2/node_modules/@fleetless/contracts/dist/rest.js
 import { z as z9 } from "zod";
 var robot = z9.object({
   id: z9.uuid().meta({
@@ -3421,13 +3421,13 @@ var slugUsageResponse = z9.object({
   alert_count: z9.number().int().nonnegative()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/realtime.js
+// node_modules/.pnpm/@fleetless+contracts@6.2.0-next.2/node_modules/@fleetless/contracts/dist/realtime.js
 import { z as z14 } from "zod";
 
-// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/client-auth.js
+// node_modules/.pnpm/@fleetless+contracts@6.2.0-next.2/node_modules/@fleetless/contracts/dist/client-auth.js
 import { z as z13 } from "zod";
 
-// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/apps.js
+// node_modules/.pnpm/@fleetless+contracts@6.2.0-next.2/node_modules/@fleetless/contracts/dist/apps.js
 import { z as z10 } from "zod";
 var appIdentifier = slug;
 var app = z10.object({
@@ -3650,10 +3650,10 @@ var rolePermissions = z10.object({
   })
 });
 
-// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/app-users.js
+// node_modules/.pnpm/@fleetless+contracts@6.2.0-next.2/node_modules/@fleetless/contracts/dist/app-users.js
 import { z as z12 } from "zod";
 
-// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/identity.js
+// node_modules/.pnpm/@fleetless+contracts@6.2.0-next.2/node_modules/@fleetless/contracts/dist/identity.js
 import { z as z11 } from "zod";
 var password = z11.string().min(12).max(256);
 var USER_DISPLAY_NAME_MAX = 120;
@@ -3871,7 +3871,7 @@ var recoveryCodesResponse = z11.object({
   recovery_codes: recoveryCodesList.meta({ description: "The ten new recovery codes, lowercase, shown once. Every earlier code is void." })
 });
 
-// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/app-users.js
+// node_modules/.pnpm/@fleetless+contracts@6.2.0-next.2/node_modules/@fleetless/contracts/dist/app-users.js
 var APP_USER_DISPLAY_NAME_MAX = 120;
 var providerSlug = z12.string().max(40).regex(/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/, "must be lowercase and hyphen-separated, starting with a letter");
 var appUserStatus = z12.enum(["pending_verification", "active", "blocked"]);
@@ -4182,7 +4182,7 @@ var mailOutcome = z12.object({
   })
 });
 
-// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/client-auth.js
+// node_modules/.pnpm/@fleetless+contracts@6.2.0-next.2/node_modules/@fleetless/contracts/dist/client-auth.js
 var clientLoginRequest = z13.object({
   app_identifier: appIdentifier.meta({
     description: "The app being logged in to: its globally unique, lowercase, underscore-separated identifier, chosen by the developer at creation. There is no organisation context at login, so this is what decides which app the credentials are checked for."
@@ -4358,7 +4358,8 @@ var clientOidcErrorCode = z13.enum([
   "provider_misconfigured",
   "provider_disabled",
   "invalid_request",
-  "quota_exceeded"
+  "quota_exceeded",
+  "plan_limit"
 ]);
 var clientMcpInteraction = z13.object({
   id: z13.string().meta({ description: "The interaction, as it arrived in the app's `mcp_login_url`. Not a credential: it names a pending request the server already holds, and approving it needs the app user's own access token." }),
@@ -4422,7 +4423,7 @@ var clientIdentity = z13.object({
   })
 });
 
-// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/realtime.js
+// node_modules/.pnpm/@fleetless+contracts@6.2.0-next.2/node_modules/@fleetless/contracts/dist/realtime.js
 var clientAuth = z14.object({
   type: z14.literal("auth"),
   token: z14.string().min(1)
@@ -4590,6 +4591,12 @@ var liveSessionEndReason = z14.enum([
   "expired",
   /** The robot was deleted out from under the session. */
   "robot_deleted",
+  /**
+   * The organization's live video for app users reached its plan's monthly
+   * limit (2026-10-02, fleetless/fleetless#103); `detail` carries the
+   * sentence the viewer shows.
+   */
+  "plan_limit",
   /**
    * The cloud ended it and cannot say which of the above applied. **Kept
    * deliberately**: a channel that cannot say "I do not know" will say
@@ -4700,7 +4707,7 @@ var orgEventDropped = z14.object({
   dropped: z14.number().int().positive()
 }).strict();
 
-// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/feedback.js
+// node_modules/.pnpm/@fleetless+contracts@6.2.0-next.2/node_modules/@fleetless/contracts/dist/feedback.js
 import { z as z15 } from "zod";
 var FEEDBACK_KINDS = ["idea", "problem", "question", "other"];
 var feedbackKind = z15.enum(FEEDBACK_KINDS);
@@ -4725,7 +4732,7 @@ var feedbackResponse = z15.object({
   })
 }).strict();
 
-// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/client-robots.js
+// node_modules/.pnpm/@fleetless+contracts@6.2.0-next.2/node_modules/@fleetless/contracts/dist/client-robots.js
 import { z as z16 } from "zod";
 var clientRobotListItem = z16.object({
   ...robot.shape,
@@ -4742,10 +4749,10 @@ var clientRobotListResponse = z16.object({
   })
 });
 
-// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/audit.js
+// node_modules/.pnpm/@fleetless+contracts@6.2.0-next.2/node_modules/@fleetless/contracts/dist/audit.js
 import { z as z17 } from "zod";
 var auditActor = z17.object({
-  kind: z17.enum(["developer", "end_user", "app_user", "server_key", "bridge"]),
+  kind: z17.enum(["developer", "end_user", "app_user", "server_key", "bridge", "fleetless"]),
   id: z17.uuid(),
   label: z17.string().min(1).max(200)
 });
@@ -4884,34 +4891,358 @@ var auditListResponse = z17.object({
   next_cursor: z17.number().int().positive().nullable()
 });
 
-// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/errors.js
+// node_modules/.pnpm/@fleetless+contracts@6.2.0-next.2/node_modules/@fleetless/contracts/dist/errors.js
+import { z as z19 } from "zod";
+
+// node_modules/.pnpm/@fleetless+contracts@6.2.0-next.2/node_modules/@fleetless/contracts/dist/plans.js
 import { z as z18 } from "zod";
-var apiError = z18.object({
-  code: z18.string().min(1),
-  message: z18.string().min(1),
-  details: z18.unknown().optional()
+var planId = z18.enum(["basic", "plus", "pro", "enterprise"]);
+var planLimitKey = z18.enum([
+  "seats",
+  "robots",
+  "apps",
+  "app_users",
+  "live_video_ms_per_month",
+  "asset_bytes_per_robot",
+  "history_days",
+  "audit_days"
+]);
+var limit = z18.number().int().positive().nullable();
+var planLimits = z18.object({
+  seats: limit.meta({ description: "Developers, owners included, plus pending team invitations." }),
+  robots: limit.meta({ description: "Robots in the org." }),
+  apps: limit.meta({ description: "Apps in the org." }),
+  app_users: limit.meta({ description: "App users across every app of the org, plus pending app-user invitations." }),
+  live_video_ms_per_month: limit.meta({
+    description: "Live video watched by app users in one UTC calendar month, in milliseconds, across the org. Console sessions do not count."
+  }),
+  asset_bytes_per_robot: limit.meta({
+    description: "Asset storage per robot, in bytes (decimal: 1 GB = 1,000,000,000). The org stores up to robots \xD7 this value in total."
+  }),
+  history_days: limit.meta({ description: "Days the org's robot history is kept." }),
+  audit_days: limit.meta({ description: "Days the org's audit log is kept." })
+});
+var planFeature = z18.enum(["app_mcp", "two_factor", "require_two_factor", "app_oidc", "hosted_logo", "audit_export", "addons"]);
+var FEATURE_DESCRIPTIONS = {
+  app_mcp: "An app's own MCP endpoint, for its app users.",
+  two_factor: "Two-factor sign-in for developers.",
+  require_two_factor: "An owner may require two-factor sign-in for every developer of the org.",
+  app_oidc: "An app may let its users sign in through an OpenID Connect identity provider.",
+  hosted_logo: "An app's hosted pages show its logo and accent colour, not only its name.",
+  audit_export: "The audit log can be exported as CSV.",
+  addons: "Add-ons can be bought on top of the plan."
+};
+var planFeatures = z18.object(Object.fromEntries(planFeature.options.map((f) => [f, z18.boolean().meta({ description: FEATURE_DESCRIPTIONS[f] })])));
+var cents = z18.number().int().nonnegative();
+var planPrices = z18.object({
+  eur_month: cents.meta({ description: "Per month in euro cents, excluding VAT." }),
+  usd_month: cents.meta({ description: "Per month in US dollar cents, excluding VAT: the euro price \xD7 1.15, rounded up to a whole dollar." }),
+  eur_year: cents.meta({ description: "Per year in euro cents, excluding VAT: twelve months less 15 %." }),
+  usd_year: cents.meta({ description: "Per year in US dollar cents, excluding VAT: the yearly euro price \xD7 1.15, rounded up to a whole dollar." })
+});
+var planSupport = z18.enum(["community", "email", "priority", "named_contact"]);
+var planCatalogueEntry = z18.object({
+  id: planId.meta({ description: "The plan." }),
+  name: z18.string().min(1).meta({ description: "The plan's display name: Basic, Plus, Pro or Enterprise." }),
+  limits: planLimits.meta({ description: "What the plan allows. `null` means by contract." }),
+  features: planFeatures.meta({ description: "What the plan unlocks." }),
+  prices: planPrices.nullable().meta({ description: "`null` for Enterprise: sold by contract, on request." }),
+  support: planSupport.meta({ description: "The support that comes with the plan." })
+});
+var addonKey = z18.enum(["seats", "robots", "apps", "app_user_packs", "live_video_packs"]);
+var addonCatalogueEntry = z18.object({
+  key: addonKey.meta({ description: "The add-on." }),
+  raises: planLimitKey.meta({ description: "The plan limit this add-on raises." }),
+  per_unit: z18.number().int().positive().meta({ description: "How much one unit of this add-on raises `raises` by." }),
+  prices: planPrices.meta({ description: "The price of one unit." })
+});
+function usdCentsFromEurCents(eurCents) {
+  return Math.floor((eurCents * 115 + 9999) / 1e4) * 100;
+}
+function yearlyEurCents(monthEurCents) {
+  return Math.round(monthEurCents * 12 * 85 / 100);
+}
+function pricesFromEurMonth(eurMonthCents) {
+  const eurYear = yearlyEurCents(eurMonthCents);
+  return {
+    eur_month: eurMonthCents,
+    usd_month: usdCentsFromEurCents(eurMonthCents),
+    eur_year: eurYear,
+    usd_year: usdCentsFromEurCents(eurYear)
+  };
+}
+var PLANS = {
+  basic: {
+    id: "basic",
+    name: "Basic",
+    limits: {
+      seats: 1,
+      robots: 1,
+      apps: 1,
+      app_users: 10,
+      live_video_ms_per_month: 36e6,
+      asset_bytes_per_robot: 1e9,
+      history_days: 7,
+      audit_days: 7
+    },
+    features: {
+      app_mcp: false,
+      two_factor: false,
+      require_two_factor: false,
+      app_oidc: false,
+      hosted_logo: false,
+      audit_export: false,
+      addons: false
+    },
+    prices: pricesFromEurMonth(0),
+    support: "community"
+  },
+  plus: {
+    id: "plus",
+    name: "Plus",
+    limits: {
+      seats: 3,
+      robots: 3,
+      apps: 3,
+      app_users: 25,
+      live_video_ms_per_month: 36e7,
+      asset_bytes_per_robot: 2e9,
+      history_days: 30,
+      audit_days: 30
+    },
+    features: {
+      app_mcp: true,
+      two_factor: true,
+      require_two_factor: false,
+      app_oidc: true,
+      hosted_logo: true,
+      audit_export: false,
+      addons: false
+    },
+    prices: pricesFromEurMonth(2900),
+    support: "email"
+  },
+  pro: {
+    id: "pro",
+    name: "Pro",
+    limits: {
+      seats: 5,
+      robots: 5,
+      apps: 5,
+      app_users: 50,
+      live_video_ms_per_month: 9e8,
+      asset_bytes_per_robot: 3e9,
+      history_days: 90,
+      audit_days: 90
+    },
+    features: {
+      app_mcp: true,
+      two_factor: true,
+      require_two_factor: true,
+      app_oidc: true,
+      hosted_logo: true,
+      audit_export: true,
+      addons: true
+    },
+    prices: pricesFromEurMonth(14900),
+    support: "priority"
+  },
+  enterprise: {
+    id: "enterprise",
+    name: "Enterprise",
+    limits: {
+      seats: null,
+      robots: null,
+      apps: null,
+      app_users: null,
+      live_video_ms_per_month: null,
+      asset_bytes_per_robot: null,
+      history_days: null,
+      audit_days: null
+    },
+    features: {
+      app_mcp: true,
+      two_factor: true,
+      require_two_factor: true,
+      app_oidc: true,
+      hosted_logo: true,
+      audit_export: true,
+      addons: true
+    },
+    prices: null,
+    support: "named_contact"
+  }
+};
+var ADDONS = {
+  seats: { key: "seats", raises: "seats", per_unit: 1, prices: pricesFromEurMonth(900) },
+  robots: { key: "robots", raises: "robots", per_unit: 1, prices: pricesFromEurMonth(1900) },
+  apps: { key: "apps", raises: "apps", per_unit: 1, prices: pricesFromEurMonth(900) },
+  app_user_packs: { key: "app_user_packs", raises: "app_users", per_unit: 5, prices: pricesFromEurMonth(1e3) },
+  live_video_packs: { key: "live_video_packs", raises: "live_video_ms_per_month", per_unit: 9e8, prices: pricesFromEurMonth(900) }
+};
+var planCurrency = z18.enum(["eur", "usd"]);
+var addonCount = z18.number().int().nonnegative();
+var orgAddons = z18.object({
+  seats: addonCount.meta({ description: "Extra developer seats, one each." }),
+  robots: addonCount.meta({ description: "Extra robots, one each." }),
+  apps: addonCount.meta({ description: "Extra apps, one each." }),
+  app_user_packs: addonCount.meta({ description: "Packs of five extra app users." }),
+  live_video_packs: addonCount.meta({ description: "Packs of 250 extra hours of app-user live video per month." })
+});
+var usageCount = z18.number().int().nonnegative();
+var orgPlanUsage = z18.object({
+  seats: usageCount.meta({ description: "Developers, owners included, plus pending team invitations." }),
+  robots: usageCount.meta({ description: "Robots in the org." }),
+  apps: usageCount.meta({ description: "Apps in the org." }),
+  app_users: usageCount.meta({ description: "App users across every app, plus pending app-user invitations." }),
+  live_video_ms_this_month: usageCount.meta({
+    description: "Live video watched by app users in the current UTC calendar month, in milliseconds. Console sessions do not count."
+  }),
+  asset_bytes: usageCount.meta({ description: "Bytes the assets of every robot of the org occupy, together." })
+});
+var planChangeKeep = z18.object({
+  robots: z18.array(z18.uuid()).meta({ description: "The robots that stay, by id. Every other robot is deleted when the change takes effect." }),
+  apps: z18.array(z18.uuid()).meta({ description: "The apps that stay, by id. Every other app is deleted when the change takes effect." }),
+  app_users: z18.array(z18.uuid()).meta({
+    description: "The app users that stay, by id, across every app. Every other app user is deleted when the change takes effect."
+  }),
+  developers: z18.array(z18.uuid()).meta({
+    description: "The developers that stay, by user id, owners never among them: every owner stays. Every other developer is removed from the org when the change takes effect."
+  })
+}).strict();
+var planChangeReason = z18.enum(["downgrade", "cancel", "migration", "lock"]);
+var pendingPlanChange = z18.object({
+  target_plan: planId.meta({ description: "The plan the org moves to." }),
+  reason: planChangeReason.meta({ description: "Why the change is pending: `downgrade`, `cancel`, `migration` or `lock`." }),
+  effective_at: z18.iso.datetime().nullable().meta({
+    description: "When the change takes effect. `null` only for a move off the beta whose date is not set yet."
+  }),
+  keep: planChangeKeep.nullable().meta({
+    description: "What stays. `null` when the org already fits the target plan and nothing is deleted."
+  }),
+  history_days_after: z18.number().int().positive().meta({
+    description: "Days of history and audit log the org keeps on the target plan."
+  }),
+  chosen_by: z18.uuid().meta({ description: "The user id of the owner who chose the change, or the nil UUID when Fleetless queued it." }),
+  chosen_at: z18.iso.datetime().meta({ description: "When the change was chosen." })
+});
+var orgLock = z18.object({
+  reason: z18.enum(["payment", "migration"]).meta({
+    description: "`payment`: a payment is missing. `migration`: the org did not choose what stays when the beta ended."
+  }),
+  since: z18.iso.datetime().meta({ description: "When the org was locked." })
+});
+var orgPlan = z18.object({
+  plan: planId.meta({ description: "The org's current plan." }),
+  currency: planCurrency.meta({ description: "The currency the org's prices are shown and billed in." }),
+  period_ends_at: z18.iso.datetime().meta({
+    description: "The end of the organization's current billing period; while no payment period exists yet, the end of the current UTC calendar month. A pending downward plan change normally takes effect at this exact instant \u2014 except one chosen while the org was locked, which lands at once, and the platform's own move off the beta, which lands at its switch date instead."
+  }),
+  addons: orgAddons.meta({ description: "The add-ons the org has bought. All zero on a plan without the `addons` feature." }),
+  limits: planLimits.meta({
+    description: "The org's effective limits: the plan's, raised by its add-ons, or an operator's override in their place. `null` means unlimited for a count, and 90 days for `history_days` and `audit_days`."
+  }),
+  features: planFeatures.meta({ description: "What the org's plan unlocks." }),
+  usage: orgPlanUsage.meta({ description: "What the org uses now, counted the way each limit counts it." }),
+  pending_change: pendingPlanChange.nullable().meta({ description: "A move to a lower plan that has not taken effect yet, or `null`." }),
+  lock: orgLock.nullable().meta({ description: "Why and since when the org is locked, or `null` when it is not." }),
+  switch: z18.object({
+    at: z18.iso.datetime().nullable().meta({
+      description: "When the org moves from the beta onto its plan. `null` while the date is not set."
+    }),
+    needs_choice: z18.boolean().meta({
+      description: "Whether the org uses more than Basic allows, so an owner has to choose what stays before `at`."
+    })
+  }).nullable().meta({ description: "Set only while the org is still on the beta; `null` for every other org." })
 });
-var parameterViolation = z18.object({
-  field: z18.string().min(1),
+var planChangeRequest = z18.object({
+  target_plan: planId.meta({ description: "The lower plan to move to; `basic` cancels." }),
+  keep: planChangeKeep.nullable().meta({
+    description: "What stays. `null` when the org already fits the target plan, so nothing is deleted."
+  })
+}).strict();
+var planOverrides = z18.object(Object.fromEntries(planLimitKey.options.map((k) => [
+  k,
+  limit.optional().meta({ description: `Replaces the plan's \`${k}\`. \`null\` clears the override.` })
+]))).strict();
+var adminPlanChangeRequest = z18.object({
+  plan: planId.meta({ description: "The plan the org is on after this request." }),
+  addons: orgAddons.partial().strict().optional().meta({ description: "Add-on counts to set. Counts not named stay as they are." }),
+  overrides: planOverrides.optional().meta({ description: "Limits to override. `null` clears an override." }),
+  currency: planCurrency.optional().meta({ description: "The currency the org is billed in." }),
+  period_ends_at: z18.iso.datetime().nullable().optional().meta({
+    description: "The end of the org's billing period. `null` falls back to the end of the current UTC month."
+  })
+}).strict();
+
+// node_modules/.pnpm/@fleetless+contracts@6.2.0-next.2/node_modules/@fleetless/contracts/dist/errors.js
+var apiError = z19.object({
+  code: z19.string().min(1),
+  message: z19.string().min(1),
+  details: z19.unknown().optional()
+});
+var parameterViolation = z19.object({
+  field: z19.string().min(1),
   /** Which rule failed — `min`, `max`, `enum`, `pattern`, `required`, `undeclared`. */
-  rule: z18.string().min(1),
-  message: z18.string().min(1)
+  rule: z19.string().min(1),
+  message: z19.string().min(1)
 });
-var parameterInvalidDetails = z18.object({
-  violations: z18.array(parameterViolation).min(1)
+var parameterInvalidDetails = z19.object({
+  violations: z19.array(parameterViolation).min(1)
 });
-var cancelRejectedDetails = z18.object({
-  goals: z18.array(bridgeCancelResultEntry).min(1)
+var cancelRejectedDetails = z19.object({
+  goals: z19.array(bridgeCancelResultEntry).min(1)
 });
-var invalidCodeDetails = z18.object({
-  attempts_left: z18.number().int().min(0).meta({
+var invalidCodeDetails = z19.object({
+  attempts_left: z19.number().int().min(0).meta({
     description: "How many more wrong codes this code or challenge takes before it is spent. `0` means the next attempt answers `410 token_spent`."
   })
 });
+var planLimitDetails = z19.object({
+  limit: planLimitKey.exclude(["history_days", "audit_days"]).meta({ description: "The limit the action would exceed." }),
+  used: z19.number().int().nonnegative().meta({ description: "How much of the limit the org uses now." }),
+  max: z19.number().int().nonnegative().meta({
+    description: "The limit. For `asset_bytes_per_robot`, the org's whole pool: robots \xD7 the plan's bytes per robot."
+  }),
+  plan: planId.meta({ description: "The plan whose limit refused: the target plan while a move to a lower plan is pending." }),
+  lifted_by: z19.object({
+    plan: planId.nullable().meta({ description: "The cheapest higher plan that raises this limit, or `null` when none does." }),
+    addon: addonKey.nullable().meta({
+      description: "The add-on that raises this limit, when the org's plan can buy add-ons; otherwise `null`."
+    })
+  }).meta({ description: "What would lift the limit." })
+});
+var assetPlanLimitDetails = planLimitDetails.extend({
+  ...assetStoreRefusedDetails.shape,
+  store_bytes: assetStoreRefusedDetails.shape.store_bytes.meta({
+    description: "The org's asset pool, in bytes: `robots \xD7 asset_bytes_per_robot`."
+  }),
+  used_bytes: assetStoreRefusedDetails.shape.used_bytes.meta({
+    description: "Bytes the org's assets occupy, across every robot, before this upload."
+  })
+});
+var planRequiredDetails = z19.object({
+  feature: planFeature.meta({ description: "The feature the action needs." }),
+  plan: planId.meta({ description: "The org's current plan." }),
+  required_plan: planId.meta({ description: "The cheapest plan that has the feature." })
+});
+var orgLockedDetails = z19.object({
+  reason: z19.enum(["payment", "migration"]).meta({
+    description: "`payment`: a payment is missing. `migration`: the org did not choose what stays when the beta ended."
+  })
+});
+var fileTooLargeDetails = z19.object({
+  max_bytes: z19.number().int().positive().meta({
+    description: "The most one asset file can be, in bytes: `ASSET_FILE_MAX_BYTES`, the same on every plan."
+  }),
+  size_bytes: z19.number().int().positive().nullable().meta({
+    description: "The refused file's size, in bytes: the announced size, or the bytes that arrived when none (or a false one) was announced; `null` only when the body limit stopped the upload and nobody counted the bytes."
+  })
+});
 
-// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/oauth.js
-import { z as z19 } from "zod";
-var oauthErrorCode = z19.enum([
+// node_modules/.pnpm/@fleetless+contracts@6.2.0-next.2/node_modules/@fleetless/contracts/dist/oauth.js
+import { z as z20 } from "zod";
+var oauthErrorCode = z20.enum([
   "invalid_request",
   "invalid_client",
   "invalid_grant",
@@ -4924,11 +5255,11 @@ var oauthErrorCode = z19.enum([
   /** RFC 8707: the `resource` named is not one this server issues tokens for. */
   "invalid_target"
 ]);
-var oauthError = z19.object({
+var oauthError = z20.object({
   error: oauthErrorCode,
-  error_description: z19.string().min(1).max(500).optional(),
+  error_description: z20.string().min(1).max(500).optional(),
   /** Echoed back per RFC 6749 §4.1.2.1 so a client can match the response. */
-  state: z19.string().min(1).max(500).optional(),
+  state: z20.string().min(1).max(500).optional(),
   /**
    * **A Fleetless reason carried inside a standard envelope, and it exists
    * because the alternative lost a distinction.**
@@ -4946,9 +5277,9 @@ var oauthError = z19.object({
    * our own tooling switches on. RFC 6749 §5.2 permits additional members, and
    * a client that ignores this one still behaves correctly.
    */
-  fleetless_code: z19.string().min(1).max(60).optional()
+  fleetless_code: z20.string().min(1).max(60).optional()
 });
-var redirectUri = z19.string().min(1).max(2e3).refine((v) => {
+var redirectUri = z20.string().min(1).max(2e3).refine((v) => {
   let url;
   try {
     url = new URL(v);
@@ -4963,180 +5294,180 @@ var redirectUri = z19.string().min(1).max(2e3).refine((v) => {
     return ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
   return false;
 }, { message: "redirect_uri must be an https URL, or http on an explicit loopback address, and carry no fragment" });
-var codeChallengeMethod = z19.enum(["S256"]);
+var codeChallengeMethod = z20.enum(["S256"]);
 var MCP_DCR_MAX_REDIRECT_URIS = 5;
-var dynamicClientRegistrationRequest = z19.object({
-  redirect_uris: z19.array(redirectUri).min(1).max(MCP_DCR_MAX_REDIRECT_URIS).meta({
+var dynamicClientRegistrationRequest = z20.object({
+  redirect_uris: z20.array(redirectUri).min(1).max(MCP_DCR_MAX_REDIRECT_URIS).meta({
     description: `Where the authorization code may be returned, and the one field a registration cannot omit. Each must be an \`https\` URL, or \`http\` on an explicit loopback address for a native app that cannot hold a certificate, and none may carry a fragment. Between \`1\` and \`${MCP_DCR_MAX_REDIRECT_URIS}\` of them; duplicates are collapsed rather than counted twice. Matched **exactly** at the authorize step against what was registered here.`
   }),
-  client_name: z19.string().min(1).max(200).optional().meta({
+  client_name: z20.string().min(1).max(200).optional().meta({
     description: 'The name the client calls itself. Optional: RFC 7591 makes every metadata field optional, so a registration without one is recorded under a default name. It is **not** vouched for by Fleetless and must never be rendered as if it were: a self-registered client chooses this string, and one has called itself *"Fleetless Official Helper"*.'
   }),
-  token_endpoint_auth_method: z19.enum(["none"]).optional().meta({
+  token_endpoint_auth_method: z20.enum(["none"]).optional().meta({
     description: "`none`, RFC 7591's value for a public client, and the only value either server registers. Any other value is **refused rather than silently downgraded**: a client that believes it holds a secret and does not has a wrong mental model of its own security. There is no client secret to hold \u2014 mandatory PKCE (`S256`) is the defence."
   }),
-  grant_types: z19.array(z19.enum(["authorization_code", "refresh_token"])).optional().meta({
+  grant_types: z20.array(z20.enum(["authorization_code", "refresh_token"])).optional().meta({
     description: "Accepted for conformance with RFC 7591 and then **ignored**: both MCP authorization servers grant `authorization_code` and `refresh_token` to every registration, and the answer states what was granted (\xA73.2.1) rather than what was asked."
   }),
-  response_types: z19.array(z19.enum(["code"])).optional().meta({
+  response_types: z20.array(z20.enum(["code"])).optional().meta({
     description: "Accepted for conformance and then **ignored**; the response names `code`, which is the only response type OAuth 2.1 leaves, the implicit grant having been removed."
   }),
-  scope: z19.string().max(500).optional().meta({
+  scope: z20.string().max(500).optional().meta({
     description: "Accepted for conformance and then **ignored**. This authorization server issues no scopes at all, which is why the registration answer carries no `scope` field to echo one back in."
   })
 }).meta({
   description: "What an MCP client sends to register itself, per RFC 7591. Unknown metadata is ignored rather than refused (\xA73.1), and the answer states what was actually granted rather than what was asked for (\xA73.2.1)."
 });
-var dynamicClientRegistrationResponse = z19.object({
-  client_id: z19.string().min(1).max(200).meta({
+var dynamicClientRegistrationResponse = z20.object({
+  client_id: z20.string().min(1).max(200).meta({
     description: "The identifier this client sends at the authorize and token endpoints. Opaque, and not the app identifier."
   }),
-  client_name: z19.string().min(1).max(200).meta({
+  client_name: z20.string().min(1).max(200).meta({
     description: "The name the client registered under, echoed back. Chosen by the client and not vouched for by Fleetless."
   }),
-  redirect_uris: z19.array(redirectUri).meta({
+  redirect_uris: z20.array(redirectUri).meta({
     description: "The redirect URIs this registration was accepted for. A code is returned to one of these and nowhere else."
   }),
-  grant_types: z19.array(z19.string()).meta({
+  grant_types: z20.array(z20.string()).meta({
     description: 'The grants this client may use. Always exactly `["authorization_code", "refresh_token"]` \u2014 an exchange mints a refresh token and the token endpoint rotates it.'
   }),
-  response_types: z19.array(z19.string()).meta({
+  response_types: z20.array(z20.string()).meta({
     description: "The response types this client may ask for: `code`."
   }),
-  token_endpoint_auth_method: z19.literal("none").meta({
+  token_endpoint_auth_method: z20.literal("none").meta({
     description: "`none` \u2014 this server registers public clients only, and PKCE rather than a secret is what protects the exchange."
   }),
-  client_id_issued_at: z19.number().int().nonnegative().meta({
+  client_id_issued_at: z20.number().int().nonnegative().meta({
     description: "When the registration was created, in seconds since the epoch, per RFC 7591."
   }),
-  client_secret_expires_at: z19.literal(0).meta({
+  client_secret_expires_at: z20.literal(0).meta({
     description: "Always `0`, which is RFC 7591's way of saying the client secret never expires \u2014 there is none. The **registration** itself does expire: a self-registered client that never completes a flow is an unauthenticated write somebody left behind."
   })
 });
-var oauthCodeTokenRequest = z19.object({
-  grant_type: z19.literal("authorization_code").meta({
+var oauthCodeTokenRequest = z20.object({
+  grant_type: z20.literal("authorization_code").meta({
     description: "`authorization_code`: this request exchanges the code from the authorize redirect for an access token and a refresh token."
   }),
-  code: z19.string().min(1).max(500).meta({
+  code: z20.string().min(1).max(500).meta({
     description: "The authorization code from the redirect. It may be exchanged once; a second presentation is `invalid_grant`, the same answer a fabricated code gets."
   }),
   redirect_uri: redirectUri.meta({
     description: "The same redirect URI the authorize request used. It is compared, not merely recorded."
   }),
-  client_id: z19.string().min(1).max(200).meta({
+  client_id: z20.string().min(1).max(200).meta({
     description: "The client making the exchange, as registered."
   }),
-  code_verifier: z19.string().regex(/^[A-Za-z0-9\-._~]{43,128}$/, "code_verifier must be 43-128 unreserved characters (RFC 7636 \xA74.1)").meta({
+  code_verifier: z20.string().regex(/^[A-Za-z0-9\-._~]{43,128}$/, "code_verifier must be 43-128 unreserved characters (RFC 7636 \xA74.1)").meta({
     description: "The PKCE verifier whose `S256` hash was sent as the challenge at the authorize step. Between `43` and `128` unreserved characters, per RFC 7636 \xA74.1 \u2014 it is compared rather than parsed, so a length nobody checks is a length an attacker chooses. PKCE is mandatory for every client under OAuth 2.1."
   }),
-  resource: z19.url().optional().meta({
+  resource: z20.url().optional().meta({
     description: "The resource the token is requested for, per RFC 8707. It must match the audience the code was authorized for, or the answer is `invalid_target`; omitted, the code's own audience stands. It becomes the token's `aud`, and a resource refuses a token whose audience names something else \u2014 which is what keeps a token minted for one app out of another app's endpoint."
   })
 }).meta({
   description: "RFC 6749 \xA74.1.3's authorization-code exchange with PKCE, as either MCP authorization server reads it. Sent as `application/x-www-form-urlencoded`, per \xA74.1.3, though the server accepts a JSON body too."
 });
-var oauthRefreshTokenRequest = z19.object({
-  grant_type: z19.literal("refresh_token").meta({
+var oauthRefreshTokenRequest = z20.object({
+  grant_type: z20.literal("refresh_token").meta({
     description: "`refresh_token`: this request rotates a refresh token into a new access token and a new refresh token. The presented token is consumed; presenting it again revokes the whole session."
   }),
-  refresh_token: z19.string().min(1).max(500).meta({
+  refresh_token: z20.string().min(1).max(500).meta({
     description: "The refresh token from the last token response. Bound to the client that received it and to one identity space: presented by another client, or at the other MCP server, it is `invalid_grant` and stays unconsumed."
   }),
-  client_id: z19.string().min(1).max(200).meta({
+  client_id: z20.string().min(1).max(200).meta({
     description: "The client the refresh token was issued to, as registered. A refresh token is not transferable between clients."
   }),
-  resource: z19.url().optional().meta({
+  resource: z20.url().optional().meta({
     description: "The resource the new token is for, per RFC 8707. Optional; when named it must be the audience the session was issued for, or the answer is `invalid_target` and the refresh token is left untouched. The successor carries the same audience either way."
   })
 }).meta({
   description: "RFC 6749 \xA76's refresh, as either MCP authorization server reads it. Every use rotates: the answer carries a new refresh token and the presented one is dead."
 });
-var oauthTokenRequest = z19.discriminatedUnion("grant_type", [oauthCodeTokenRequest, oauthRefreshTokenRequest]).meta({
+var oauthTokenRequest = z20.discriminatedUnion("grant_type", [oauthCodeTokenRequest, oauthRefreshTokenRequest]).meta({
   description: "What an MCP token endpoint accepts: the authorization-code exchange, or a refresh. Any other `grant_type` is `unsupported_grant_type`, refused before a lookup happens."
 });
-var oauthTokenResponse = z19.object({
-  access_token: z19.string().min(1).meta({
+var oauthTokenResponse = z20.object({
+  access_token: z20.string().min(1).meta({
     description: "The bearer token. It is the same token the client login mints \u2014 only the envelope differs, because an RFC-compliant client parses this one and knows nothing about Fleetless."
   }),
-  token_type: z19.literal("Bearer").meta({
+  token_type: z20.literal("Bearer").meta({
     description: "`Bearer`. RFC 6749 \xA75.1 makes the value case-insensitive for a client reading it; this is the spelling this server emits."
   }),
-  expires_in: z19.number().int().positive().meta({
+  expires_in: z20.number().int().positive().meta({
     description: "How long the access token is valid, in **seconds**, per RFC 6749 \xA75.1. Not a timestamp, and not milliseconds."
   }),
-  refresh_token: z19.string().min(1).optional().meta({
+  refresh_token: z20.string().min(1).optional().meta({
     description: "The refresh token. Both MCP token endpoints issue one on every exchange and every refresh; it rotates on every use, lives ninety days from its last use, and dies with the account's sessions \u2014 a block, a password change, a withdrawn consent. The console's own OAuth portal issues none."
   }),
-  scope: z19.string().max(500).optional().meta({
+  scope: z20.string().max(500).optional().meta({
     description: "The scopes the issued token actually carries, space-separated."
   })
 });
-var authorizationServerMetadata = z19.object({
-  issuer: z19.url().meta({
+var authorizationServerMetadata = z20.object({
+  issuer: z20.url().meta({
     description: "The issuer identifier of this authorization server, per RFC 8414 \xA72. It is what a client checks a token's `iss` against."
   }),
-  authorization_endpoint: z19.url().meta({
+  authorization_endpoint: z20.url().meta({
     description: "Where a client sends the user to authorize."
   }),
-  token_endpoint: z19.url().meta({
+  token_endpoint: z20.url().meta({
     description: "The URL where a client exchanges an authorization code, or a refresh token, for tokens."
   }),
-  registration_endpoint: z19.url().optional().meta({
+  registration_endpoint: z20.url().optional().meta({
     description: "The URL where a client may register itself, per RFC 7591. Absent when the app does not accept dynamic clients."
   }),
-  response_types_supported: z19.array(z19.literal("code")).meta({
+  response_types_supported: z20.array(z20.literal("code")).meta({
     description: "The response types this server offers: `code` only, the implicit grant being gone with OAuth 2.1."
   }),
-  grant_types_supported: z19.array(z19.enum(["authorization_code", "refresh_token"])).meta({
+  grant_types_supported: z20.array(z20.enum(["authorization_code", "refresh_token"])).meta({
     description: "The grants this server offers: `authorization_code` and `refresh_token`. OAuth 2.1 removes the implicit and password grants, so neither appears here."
   }),
-  code_challenge_methods_supported: z19.array(codeChallengeMethod).meta({
+  code_challenge_methods_supported: z20.array(codeChallengeMethod).meta({
     description: "The PKCE challenge methods accepted: `S256` only. `plain` is not offered \u2014 a challenge equal to its verifier defends against nothing, and offering it would make a downgrade negotiable."
   }),
-  token_endpoint_auth_methods_supported: z19.array(z19.literal("none")).meta({
+  token_endpoint_auth_methods_supported: z20.array(z20.literal("none")).meta({
     description: "How a client authenticates at the token endpoint: `none`, the public-client method, with PKCE protecting the exchange."
   }),
-  scopes_supported: z19.array(z19.string()).optional().meta({
+  scopes_supported: z20.array(z20.string()).optional().meta({
     description: "The scopes this server knows about, where it publishes a list."
   })
 });
-var protectedResourceMetadata = z19.object({
-  resource: z19.url().meta({
+var protectedResourceMetadata = z20.object({
+  resource: z20.url().meta({
     description: "The resource identifier this document describes, per RFC 9728. A token whose audience names something else is rejected here rather than merely noted."
   }),
-  authorization_servers: z19.array(z19.url()).min(1).meta({
+  authorization_servers: z20.array(z20.url()).min(1).meta({
     description: "The authorization servers that may issue tokens for this resource. There is always at least one."
   }),
-  bearer_methods_supported: z19.array(z19.literal("header")).meta({
+  bearer_methods_supported: z20.array(z20.literal("header")).meta({
     description: "How a token may be presented: in the `Authorization` header only, never in a query parameter or a form field."
   }),
-  scopes_supported: z19.array(z19.string()).optional().meta({
+  scopes_supported: z20.array(z20.string()).optional().meta({
     description: "The scopes this resource understands, where it publishes a list."
   })
 });
-var oauthRedirectResponse = z19.object({
-  redirect_to: z19.string().min(1).max(2e3)
+var oauthRedirectResponse = z20.object({
+  redirect_to: z20.string().min(1).max(2e3)
 });
-var oauthAuthorizeQuery = z19.object({
-  response_type: z19.literal("code").meta({
+var oauthAuthorizeQuery = z20.object({
+  response_type: z20.literal("code").meta({
     description: "Always `code`. RFC 6749 \xA74.1.2.1 names `unsupported_response_type` for any other value, but `oauthErrorCode` has no such member \u2014 this server issues no other grant from this endpoint \u2014 so an unsupported value comes back on the callback as `invalid_request`."
   }),
-  client_id: z19.string().min(1).meta({
+  client_id: z20.string().min(1).meta({
     description: "The OAuth client, self-registered or the one well-known central client \u2014 **not** the app identifier. Unknown, expired-dynamic and mismatched clients all collapse into the same `400 invalid_client`, answered without a redirect."
   }),
-  redirect_uri: z19.string().min(1).meta({
+  redirect_uri: z20.string().min(1).meta({
     description: "One of the client's registered redirect URIs, compared **exactly** \u2014 string equality against the registered list, never a prefix or a host match. Both the shape (`redirectUri`) and the registration are checked, and a failure of either is a `400 invalid_request` with no redirect."
   }),
-  code_challenge: z19.string().min(1).meta({
+  code_challenge: z20.string().min(1).meta({
     description: "The PKCE challenge; the verifier is presented at the token endpoint. Only non-emptiness is checked here \u2014 length and alphabet are not \u2014 since the verifier is what has to match."
   }),
-  code_challenge_method: z19.literal("S256").meta({
+  code_challenge_method: z20.literal("S256").meta({
     description: "Only `S256`. `plain` is refused: a challenge equal to its verifier defends against nothing."
   }),
-  state: z19.string().optional().meta({
+  state: z20.string().optional().meta({
     description: "Returned unchanged on the callback, and on the error redirect too, so a client can bind either answer to its own request."
   }),
-  resource: z19.string().optional().meta({
+  resource: z20.string().optional().meta({
     description: "RFC 8707 resource indicator: the API origin or the MCP endpoint the token is for. Checked against the resources this server issues tokens for **on behalf of this client's app**; a mismatch is `invalid_target` on the callback."
   })
   // **No `scope`, because this authorization server issues none.** The field
@@ -5149,7 +5480,7 @@ var oauthAuthorizeQuery = z19.object({
   description: "The authorization request an MCP client sends, per RFC 6749 \xA74.1.1 with mandatory PKCE. The handler reads it parameter by parameter rather than through one parse, because the answers differ: `client_id` and `redirect_uri` are refused flat, with no redirect, since until both are confirmed there is no trusted target to bounce a browser to, and everything after them is reported to the client's own callback as query parameters."
 });
 
-// node_modules/.pnpm/@fleetless+contracts@6.0.0/node_modules/@fleetless/contracts/dist/routes.js
+// node_modules/.pnpm/@fleetless+contracts@6.2.0-next.2/node_modules/@fleetless/contracts/dist/routes.js
 var MCP_APP = MCP_APP_PATHS(":appIdentifier");
 var APP_IDENTIFIER = {
   name: "appIdentifier",
@@ -8786,6 +9117,79 @@ var ROUTES = [
     transport: "http",
     notes: "The message is stored before any mail is tried, so `202` means it is kept whatever `mail` says: `sent`, `failed`, or `not_configured` when this cloud has no feedback address. At most 10 messages per developer per hour; the 11th answers `429 rate_limited` with `retry_after_ms`. Replies come by mail, to the sender's address."
   },
+  /* ----------------------------------------------------------- org (plan) */
+  {
+    method: "GET",
+    path: "/api/org/plan",
+    section: "org",
+    summary: "Reads the org's plan: its limits, its usage against them, its add-ons and any change already queued.",
+    audience: "developer",
+    auth: "developer",
+    rateLimited: false,
+    ownerTier: false,
+    status: 200,
+    params: [],
+    query: null,
+    request: null,
+    response: orgPlan,
+    errors: [...DEVELOPER_GUARD],
+    transport: "http",
+    notes: "The one read the console's Plan & billing page, its usage and limit gauges, and every upgrade prompt and feature gate draw from \u2014 nothing else computes `limits` or `usage` on its own. `limits` is already the effective ceiling, the catalogue row raised by `addons` or replaced by an operator's override, so a consumer never recomputes it from the catalogue. `usage` is counted fresh on every call, never cached. `switch` is present only for an organization still on the beta that has not yet landed on a priced plan."
+  },
+  {
+    method: "PUT",
+    path: "/api/org/plan/change",
+    section: "org",
+    summary: "Moves the org's plan down \u2014 a lower plan or a cancellation to Basic \u2014 queuing the change rather than applying it at once.",
+    audience: "developer",
+    auth: "developer",
+    rateLimited: false,
+    ownerTier: true,
+    status: 200,
+    params: [],
+    query: null,
+    request: planChangeRequest,
+    response: orgPlan,
+    errors: [...DEVELOPER_GUARD, "tier_required", "validation_error", "plan_limit", "target_state_conflict"],
+    transport: "http",
+    notes: "Owner tier, and **downward only**: this route moves the org to a lower plan or cancels it outright to Basic. It never moves the org up \u2014 until payment exists, an upgrade or an add-on is not this route's job at all, and is handled today as a Feedback request that Fleetless then applies through the admin route. `409 target_state_conflict` names `target_plan` with rule `not_lower` when the chosen plan is not below the org's current one; with rule `locked_basic_only` when the org is locked (`orgLock`) and the chosen plan is anything but Basic; and with rule `migration_basic_only` when the org is still on the beta, awaiting the switch to priced plans, and the chosen plan is anything but Basic \u2014 that choice is exactly what the org lands on at the switch. An owner is never named in `keep` and always stays, but still counts against the target plan's `seats`; `409 plan_limit` names `seats` when the owners alone already exceed it, and names whichever other limit `keep` still exceeds otherwise. `keep` is `null` when the org's current usage already fits the target plan outright and nothing is deleted; named, it lists exactly the robots, apps, app users and developers that stay. The choice is stored as `pending_change` and takes effect at `period_ends_at` \u2014 **everything of the chosen kind not named in `keep` is deleted at that instant, never before** \u2014 except a choice made while the org is locked, which takes effect at once, and a beta org's choice, which takes effect at the switch date instead. Anything created while the choice is pending is checked against the target plan too and, when it passes, is folded into `keep`, so exactly what the confirmation counted is what is actually deleted. A later `PUT` replaces a still-pending choice outright."
+  },
+  {
+    method: "DELETE",
+    path: "/api/org/plan/change",
+    section: "org",
+    summary: "Withdraws a plan change that was queued but has not taken effect yet.",
+    audience: "developer",
+    auth: "developer",
+    rateLimited: false,
+    ownerTier: true,
+    status: 204,
+    params: [],
+    query: null,
+    request: null,
+    response: null,
+    errors: [...DEVELOPER_GUARD, "tier_required", "not_found"],
+    transport: "http",
+    notes: "Owner tier. `404 not_found` when the org has no `pending_change` to withdraw. The org stays on its current plan, unchanged, as if the choice had never been made; a developer who wants a different one sends a new `PUT`, which would have replaced this one outright anyway."
+  },
+  {
+    method: "PATCH",
+    path: "/api/admin/orgs/:id/plan",
+    section: "org",
+    summary: "Changes an org's plan, add-ons, limit overrides, currency or billing period as the operator.",
+    audience: "internal",
+    auth: "ops",
+    rateLimited: true,
+    ownerTier: false,
+    status: 200,
+    params: [{ name: "id", description: "The org's uuid, whose plan, add-ons or overrides the operator is changing." }],
+    query: null,
+    request: adminPlanChangeRequest,
+    response: orgPlan,
+    errors: ["unauthorized", "not_found", "validation_error", "plan_limit", "rate_limited"],
+    transport: "http",
+    notes: "Every public host answers `404 not_found` for every `/api/admin/*` path \u2014 this route is reachable only on the cloud's private address \u2014 and that same address answers `404` here too while `OPS_API_TOKEN` is not configured, so a door with no key behind it reads exactly like one nobody opened. An unknown `:id` is the same `404`. Applies at once, never queued as a `pending_change`, and only when the org's current usage fits the result: `409 plan_limit` when a lower plan, a lowered override or a removed add-on would leave the org over a limit \u2014 the operator never deletes an org's things, only the owner's own choice does. On success it also withdraws any `pending_change`, ends a beta org's wait for the switch and lifts a lock. Audited as `org.plan_changed` with the `fleetless` actor, never a developer's \u2014 the row names what an operator did, not who in the org asked for it."
+  },
   /* ------------------------------------------------- assets (robot upload) */
   {
     method: "POST",
@@ -8801,9 +9205,9 @@ var ROUTES = [
     query: null,
     request: null,
     response: asset,
-    errors: ["unauthorized", "rate_limited", "validation_error", "not_found", "quota_exceeded", "bad_request"],
+    errors: ["unauthorized", "rate_limited", "validation_error", "not_found", "file_too_large", "plan_limit", "quota_exceeded", "bad_request"],
     transport: "http",
-    notes: "The body is the **raw file bytes**, not JSON, so it has no request schema; everything about the file \u2014 its kind, its name, its sync id and its announced size \u2014 rides in the `x-fleetless-asset-*` headers `ASSET_UPLOAD_HEADERS` names. The credential is a short-lived upload token minted by `POST /api/robots/:id/assets/sync`, verified in a `preParsing` hook so a refusal precedes the work rather than following it: a `preHandler` would already have buffered the whole file. **Nothing is refused for its own size** \u2014 the robot's asset store is the only limit, so the announced size is checked there against `ROBOT_ASSET_STORE_BYTES` and a file with no room left answers `409 quota_exceeded` carrying `store_bytes`, `used_bytes` and `size_bytes`, while the sync carries on with the next file. Past that, the server's own body limit answers a bare `413 bad_request` with none of those numbers in it. Rate limited per robot inside that same hook, which is why `rateLimited` is `false`: there is no rate-limiting preHandler registered on this route. The URDF itself is never refused for the store; only meshes and textures are charged against it."
+    notes: "The body is the **raw file bytes**, not JSON, so it has no request schema; everything about the file \u2014 its kind, its name, its sync id and its announced size \u2014 rides in the `x-fleetless-asset-*` headers `ASSET_UPLOAD_HEADERS` names. The credential is a short-lived upload token minted by `POST /api/robots/:id/assets/sync`, verified in a `preParsing` hook so a refusal precedes the work rather than following it: a `preHandler` would already have buffered the whole file. **One file can be at most `ASSET_FILE_MAX_BYTES`**, on every plan and for every kind, the URDF included: an announced size over it answers `413 file_too_large` with `max_bytes` and `size_bytes` before a byte is buffered; without a truthful size, a body over the limit answers the same code with the bytes that arrived as `size_bytes`, or with `size_bytes: null` when it ran past the server's body limit and nobody counted the bytes. Retrying does not help. A file that fits but finds the store full answers `409 plan_limit` (or `409 quota_exceeded` for an organisation still on the beta) carrying `store_bytes`, `used_bytes` and `size_bytes`, while the sync carries on with the next file. Rate limited per robot inside that same hook, which is why `rateLimited` is `false`: there is no rate-limiting preHandler registered on this route. The URDF itself is never refused for the store; only meshes and textures are charged against it."
   },
   /* ------------------------------------ realtime and bridge transports */
   {