{"openapi":"3.1.0","info":{"title":"cmux platform API","version":"1.45.0","description":"Public cmux cloud API. Admin and internal routes are not part of this spec."},"paths":{"/v1/slack/install-link":{"post":{"tags":["Slack"],"operationId":"slack.installLink","parameters":[],"security":[],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"url":{"type":"string"}},"required":["url"],"additionalProperties":false}}}},"400":{"description":"slack.invalid_state: the request is invalid; restart installation or correct the request | slack.invalid_ticket: the request is invalid; restart installation or correct the request | slack.oauth_denied: the request is invalid; restart installation or correct the request | slack.invalid_event: the request is invalid; restart installation or correct the request | slack.invalid_message: the request is invalid; restart installation or correct the request | slack.invalid_owner: the request is invalid; restart installation or correct the request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError400"}}}},"401":{"description":"slack.unauthorized: authentication failed; supply the required bearer or a fresh Slack signature | slack.invalid_signature: authentication failed; supply the required bearer or a fresh Slack signature","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError401"}}}},"403":{"description":"slack.forbidden: requires a person with a selected cmux team, or the post's specified owner must match the install","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError403"}}}},"404":{"description":"slack.not_found: the surface or installation is unavailable; use an installed development workspace | slack.not_connected: the surface or installation is unavailable; use an installed development workspace","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError404"}}}},"409":{"description":"slack.owner_conflict: the workspace already belongs to another cmux owner or team; disconnect it first","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError409"}}}},"413":{"description":"slack.payload_too_large: the request exceeds one MiB; reduce the payload","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError413"}}}},"503":{"description":"slack.not_configured: the bridge is not ready; check deployment secrets and bindings then retry | slack.chief_unavailable: the bridge is not ready; check deployment secrets and bindings then retry | slack.upstream_unavailable: the bridge is not ready; check deployment secrets and bindings then retry | slack.unavailable: the bridge is not ready; check deployment secrets and bindings then retry","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError503"}}}}},"description":"Requires a person's cmux bearer with a selected team. Returns {url}: a signed, single-use install ticket valid for two minutes. Open the URL in a browser without a bearer to begin OAuth. Do not cache or log it.","summary":"Create a browser Slack install link"}},"/v1/slack/install":{"get":{"tags":["Slack"],"operationId":"slack.install","parameters":[{"name":"ticket","in":"query","schema":{"type":"string"},"required":false}],"security":[],"responses":{"302":{"description":"Continue in Slack or return to the cmux app using the Location header."},"400":{"description":"slack.invalid_state: the request is invalid; restart installation or correct the request | slack.invalid_ticket: the request is invalid; restart installation or correct the request | slack.oauth_denied: the request is invalid; restart installation or correct the request | slack.invalid_event: the request is invalid; restart installation or correct the request | slack.invalid_message: the request is invalid; restart installation or correct the request | slack.invalid_owner: the request is invalid; restart installation or correct the request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError400"}}}},"401":{"description":"slack.unauthorized: authentication failed; supply the required bearer or a fresh Slack signature | slack.invalid_signature: authentication failed; supply the required bearer or a fresh Slack signature","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError401"}}}},"403":{"description":"slack.forbidden: requires a person with a selected cmux team, or the post's specified owner must match the install","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError403"}}}},"404":{"description":"slack.not_found: the surface or installation is unavailable; use an installed development workspace | slack.not_connected: the surface or installation is unavailable; use an installed development workspace","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError404"}}}},"409":{"description":"slack.owner_conflict: the workspace already belongs to another cmux owner or team; disconnect it first","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError409"}}}},"413":{"description":"slack.payload_too_large: the request exceeds one MiB; reduce the payload","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError413"}}}},"503":{"description":"slack.not_configured: the bridge is not ready; check deployment secrets and bindings then retry | slack.chief_unavailable: the bridge is not ready; check deployment secrets and bindings then retry | slack.upstream_unavailable: the bridge is not ready; check deployment secrets and bindings then retry | slack.unavailable: the bridge is not ready; check deployment secrets and bindings then retry","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError503"}}}}},"description":"Accepts a person's cmux bearer with a selected team, or the ticket query parameter from POST /v1/slack/install-link. Consumes the ticket once and redirects to Slack with signed, ten-minute, single-use state and a browser-bound nonce cookie.","summary":"Install the cmux Slack app"}},"/v1/slack/oauth/callback":{"get":{"tags":["Slack"],"operationId":"slack.callback","parameters":[],"security":[],"responses":{"302":{"description":"Continue in Slack or return to the cmux app using the Location header."},"400":{"description":"slack.invalid_state: the request is invalid; restart installation or correct the request | slack.invalid_ticket: the request is invalid; restart installation or correct the request | slack.oauth_denied: the request is invalid; restart installation or correct the request | slack.invalid_event: the request is invalid; restart installation or correct the request | slack.invalid_message: the request is invalid; restart installation or correct the request | slack.invalid_owner: the request is invalid; restart installation or correct the request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError400"}}}},"401":{"description":"slack.unauthorized: authentication failed; supply the required bearer or a fresh Slack signature | slack.invalid_signature: authentication failed; supply the required bearer or a fresh Slack signature","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError401"}}}},"403":{"description":"slack.forbidden: requires a person with a selected cmux team, or the post's specified owner must match the install","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError403"}}}},"404":{"description":"slack.not_found: the surface or installation is unavailable; use an installed development workspace | slack.not_connected: the surface or installation is unavailable; use an installed development workspace","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError404"}}}},"409":{"description":"slack.owner_conflict: the workspace already belongs to another cmux owner or team; disconnect it first","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError409"}}}},"413":{"description":"slack.payload_too_large: the request exceeds one MiB; reduce the payload","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError413"}}}},"503":{"description":"slack.not_configured: the bridge is not ready; check deployment secrets and bindings then retry | slack.chief_unavailable: the bridge is not ready; check deployment secrets and bindings then retry | slack.upstream_unavailable: the bridge is not ready; check deployment secrets and bindings then retry | slack.unavailable: the bridge is not ready; check deployment secrets and bindings then retry","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError503"}}}}},"description":"Slack redirects the installing browser here with code and state. Verifies state and its cookie, exchanges the code, seals the bot token, then redirects to cmux://slack/connected?team=<name>.","summary":"Complete Slack OAuth"}},"/v1/slack/connection":{"get":{"tags":["Slack"],"operationId":"slack.connection","parameters":[],"security":[],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"connected":{"type":"boolean"},"teams":{"type":"array","items":{"type":"object","properties":{"slackTeamId":{"type":"string"},"name":{"type":"string"},"cmuxTeamId":{"type":"string"}},"required":["slackTeamId","name","cmuxTeamId"],"additionalProperties":false}}},"required":["connected","teams"],"additionalProperties":false}}}},"400":{"description":"slack.invalid_state: the request is invalid; restart installation or correct the request | slack.invalid_ticket: the request is invalid; restart installation or correct the request | slack.oauth_denied: the request is invalid; restart installation or correct the request | slack.invalid_event: the request is invalid; restart installation or correct the request | slack.invalid_message: the request is invalid; restart installation or correct the request | slack.invalid_owner: the request is invalid; restart installation or correct the request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError400"}}}},"401":{"description":"slack.unauthorized: authentication failed; supply the required bearer or a fresh Slack signature | slack.invalid_signature: authentication failed; supply the required bearer or a fresh Slack signature","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError401"}}}},"403":{"description":"slack.forbidden: requires a person with a selected cmux team, or the post's specified owner must match the install","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError403"}}}},"404":{"description":"slack.not_found: the surface or installation is unavailable; use an installed development workspace | slack.not_connected: the surface or installation is unavailable; use an installed development workspace","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError404"}}}},"409":{"description":"slack.owner_conflict: the workspace already belongs to another cmux owner or team; disconnect it first","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError409"}}}},"413":{"description":"slack.payload_too_large: the request exceeds one MiB; reduce the payload","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError413"}}}},"503":{"description":"slack.not_configured: the bridge is not ready; check deployment secrets and bindings then retry | slack.chief_unavailable: the bridge is not ready; check deployment secrets and bindings then retry | slack.upstream_unavailable: the bridge is not ready; check deployment secrets and bindings then retry | slack.unavailable: the bridge is not ready; check deployment secrets and bindings then retry","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError503"}}}}},"description":"Requires a person's cmux bearer. Lists only that user's installed Slack workspaces; never returns credentials.","summary":"Read your Slack connections"},"delete":{"tags":["Slack"],"operationId":"slack.disconnect","parameters":[],"security":[],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"connected":{"type":"boolean"},"teams":{"type":"array","items":{"type":"object","properties":{"slackTeamId":{"type":"string"},"name":{"type":"string"},"cmuxTeamId":{"type":"string"}},"required":["slackTeamId","name","cmuxTeamId"],"additionalProperties":false}}},"required":["connected","teams"],"additionalProperties":false}}}},"400":{"description":"slack.invalid_state: the request is invalid; restart installation or correct the request | slack.invalid_ticket: the request is invalid; restart installation or correct the request | slack.oauth_denied: the request is invalid; restart installation or correct the request | slack.invalid_event: the request is invalid; restart installation or correct the request | slack.invalid_message: the request is invalid; restart installation or correct the request | slack.invalid_owner: the request is invalid; restart installation or correct the request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError400"}}}},"401":{"description":"slack.unauthorized: authentication failed; supply the required bearer or a fresh Slack signature | slack.invalid_signature: authentication failed; supply the required bearer or a fresh Slack signature","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError401"}}}},"403":{"description":"slack.forbidden: requires a person with a selected cmux team, or the post's specified owner must match the install","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError403"}}}},"404":{"description":"slack.not_found: the surface or installation is unavailable; use an installed development workspace | slack.not_connected: the surface or installation is unavailable; use an installed development workspace","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError404"}}}},"409":{"description":"slack.owner_conflict: the workspace already belongs to another cmux owner or team; disconnect it first","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError409"}}}},"413":{"description":"slack.payload_too_large: the request exceeds one MiB; reduce the payload","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError413"}}}},"503":{"description":"slack.not_configured: the bridge is not ready; check deployment secrets and bindings then retry | slack.chief_unavailable: the bridge is not ready; check deployment secrets and bindings then retry | slack.upstream_unavailable: the bridge is not ready; check deployment secrets and bindings then retry | slack.unavailable: the bridge is not ready; check deployment secrets and bindings then retry","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError503"}}}}},"description":"Requires a person's cmux bearer. Suspends delivery, revokes each bot token with Slack, and deletes the install and queued messages. A failed revocation can be retried.","summary":"Disconnect your Slack workspaces"}},"/v1/slack/events":{"post":{"tags":["Slack"],"operationId":"slack.events","parameters":[],"security":[],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{}}}},"400":{"description":"slack.invalid_state: the request is invalid; restart installation or correct the request | slack.invalid_ticket: the request is invalid; restart installation or correct the request | slack.oauth_denied: the request is invalid; restart installation or correct the request | slack.invalid_event: the request is invalid; restart installation or correct the request | slack.invalid_message: the request is invalid; restart installation or correct the request | slack.invalid_owner: the request is invalid; restart installation or correct the request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError400"}}}},"401":{"description":"slack.unauthorized: authentication failed; supply the required bearer or a fresh Slack signature | slack.invalid_signature: authentication failed; supply the required bearer or a fresh Slack signature","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError401"}}}},"403":{"description":"slack.forbidden: requires a person with a selected cmux team, or the post's specified owner must match the install","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError403"}}}},"404":{"description":"slack.not_found: the surface or installation is unavailable; use an installed development workspace | slack.not_connected: the surface or installation is unavailable; use an installed development workspace","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError404"}}}},"409":{"description":"slack.owner_conflict: the workspace already belongs to another cmux owner or team; disconnect it first","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError409"}}}},"413":{"description":"slack.payload_too_large: the request exceeds one MiB; reduce the payload","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError413"}}}},"503":{"description":"slack.not_configured: the bridge is not ready; check deployment secrets and bindings then retry | slack.chief_unavailable: the bridge is not ready; check deployment secrets and bindings then retry | slack.upstream_unavailable: the bridge is not ready; check deployment secrets and bindings then retry | slack.unavailable: the bridge is not ready; check deployment secrets and bindings then retry","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackError503"}}}}},"description":"Slack v0 HMAC over the exact body with at most five minutes skew. Answers url_verification, otherwise durably deduplicates event_id and (team, channel, ts) and acknowledges before background delivery to PlatformChief. Retries stop after ten attempts or one hour. This endpoint requires no cmux bearer.","summary":"Receive signed Slack events","requestBody":{"content":{"application/json":{"schema":{}}},"required":true}}},"/v1/health":{"get":{"tags":["System"],"operationId":"health","parameters":[],"security":[],"responses":{"200":{"description":"Liveness and the deployed build.","content":{"application/json":{"schema":{"type":"object","properties":{"status":{"type":"string","enum":["ok"],"description":"Always `ok` when the Worker answers."},"apiVersion":{"type":"string","enum":["v1"],"description":"The API major version these paths belong to."},"commit":{"type":"string","description":"The deployed commit; `dev` on a local `bun run dev` server.","examples":["0123456789abcdef0123456789abcdef01234567"]}},"required":["status","apiVersion","commit"],"additionalProperties":false,"description":"Liveness and the deployed build.","examples":[{"status":"ok","apiVersion":"v1","commit":"0123456789abcdef0123456789abcdef01234567"}]}}}}},"description":"Answers on every deployment with no auth, so call it first to check the base URL. Read-only and safe to repeat; compare `commit` with the commit you expect before relying on a recently merged change.","summary":"Check liveness and the deployed commit"}},"/v1/client-config":{"get":{"tags":["System"],"operationId":"clientConfig","parameters":[],"security":[],"responses":{"200":{"description":"ClientConfig","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ClientConfig"}}}}},"description":"Returns environment-specific public sign-in settings and the operations enabled by this backend.","summary":"Read public client and machine capabilities"}},"/mcp":{"post":{"tags":["Hosted MCP (development only)"],"operationId":"mcp.rpc","parameters":[],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{}}}},"400":{"description":"-32700: the JSON body could not be parsed; send valid JSON. | -32600: the JSON-RPC envelope is invalid; fix it. | -32602: parameters or required request metadata are invalid; check the protocol. | -32020: required metadata headers are missing, malformed or mismatched; align headers and body. | -32022: the protocol version is unsupported; use a supported version. | -32601: the notification is unsupported; use a supported method.","content":{"application/json":{"schema":{"examples":[{"jsonrpc":"2.0","error":{"code":-32700,"message":"Parse error"}},{"jsonrpc":"2.0","error":{"code":-32600,"message":"Invalid request"}},{"jsonrpc":"2.0","error":{"code":-32602,"message":"Invalid params"}},{"jsonrpc":"2.0","error":{"code":-32020,"message":"Required metadata header is missing, malformed, or mismatched"}},{"jsonrpc":"2.0","error":{"code":-32022,"message":"Unsupported protocol version"}},{"jsonrpc":"2.0","error":{"code":-32601,"message":"Unsupported notification"}}]}}}},"401":{"description":"invalid_token: the bearer or selected team is invalid, or cmux-api refused authentication; obtain valid credentials and retry.","content":{"application/json":{"schema":{"examples":[{"error":"invalid_token"}]}}}},"403":{"description":"Origin not allowed: the browser Origin differs from this endpoint; use the endpoint origin. | connector_unavailable: cmux-api refused access; check the selected team and connection.","content":{"application/json":{"schema":{"examples":[{"error":"Origin not allowed"},{"error":"connector_unavailable"}]}}}},"404":{"description":"Not Found: the hosted MCP surface is disabled; use an enabled deployment. | -32601: the JSON-RPC method is unsupported; call tools/list for supported tools.","content":{"application/json":{"schema":{"examples":["Not Found",{"jsonrpc":"2.0","error":{"code":-32601,"message":"Method not found"},"id":1}]}}}},"405":{"description":"405: GET and DELETE /mcp return an empty body with Allow: POST; send MCP requests with POST. This shared error declaration also appears on POST and discovery.","content":{"application/json":{"schema":{"examples":[null]}}}},"406":{"description":"-32600: Accept must include application/json and text/event-stream; send both media types.","content":{"application/json":{"schema":{"examples":[{"jsonrpc":"2.0","error":{"code":-32600,"message":"Accept must include application/json and text/event-stream"}}]}}}},"415":{"description":"-32600: Content-Type must be application/json; correct the header and retry.","content":{"application/json":{"schema":{"examples":[{"jsonrpc":"2.0","error":{"code":-32600,"message":"Content-Type must be application/json"}}]}}}},"500":{"description":"-32603: the MCP invocation failed unexpectedly; retry with backoff.","content":{"application/json":{"schema":{"examples":[{"jsonrpc":"2.0","error":{"code":-32603,"message":"Internal error"}}]}}}},"503":{"description":"connector_unavailable: the cmux-api binding is absent or the connector status check failed; retry with backoff.","content":{"application/json":{"schema":{"examples":[{"error":"connector_unavailable"}]}}}}},"description":"Handles stateless Streamable HTTP MCP requests for the development GitHub integration. Send an OAuth access token from /oauth/token or a cmux access bearer, and JSON-RPC 2.0; MCP 2026-07-28 and legacy initialization are accepted. The available tools include read-only GitHub repository and issue/pull-request reads; when the development AgentGateway binding is present, callers with a verified mcp:write scope may also use create_issue_comment through exact-action approval. No session is created; call `tools/list` first, then `tools/call` with an advertised tool and its arguments. Reads may mint repository credentials internally; repeated calls repeat the read and auth checks. Send Content-Type: application/json and Accept: application/json, text/event-stream. For 2026-07-28, send MCP-Protocol-Version and MCP-Method headers and params._meta entries io.modelcontextprotocol/protocolVersion and io.modelcontextprotocol/clientCapabilities. For tools/call also send MCP-Name matching params.name. Legacy versions 2025-11-25 and 2025-06-18 use initialize first. Request bodies are parsed incrementally and validated through EOF before invoking a tool. The server may return 500 with error.code -32603 for an internal error. Tool failures use result.isError and may carry structuredContent.error.code needs_auth (reconnect), access_revoked (check access), or cursor_stale (restart listing without a cursor).","summary":"Call the hosted MCP endpoint","requestBody":{"content":{"application/json":{"schema":{}}},"required":true}}},"/.well-known/oauth-protected-resource":{"get":{"tags":["Hosted MCP (development only)"],"operationId":"mcp.metadata","parameters":[],"security":[],"responses":{"200":{"description":"OAuth protected-resource metadata for the hosted MCP endpoint.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/McpProtectedResourceMetadata"}}}},"400":{"description":"-32700: the JSON body could not be parsed; send valid JSON. | -32600: the JSON-RPC envelope is invalid; fix it. | -32602: parameters or required request metadata are invalid; check the protocol. | -32020: required metadata headers are missing, malformed or mismatched; align headers and body. | -32022: the protocol version is unsupported; use a supported version. | -32601: the notification is unsupported; use a supported method.","content":{"application/json":{"schema":{"examples":[{"jsonrpc":"2.0","error":{"code":-32700,"message":"Parse error"}},{"jsonrpc":"2.0","error":{"code":-32600,"message":"Invalid request"}},{"jsonrpc":"2.0","error":{"code":-32602,"message":"Invalid params"}},{"jsonrpc":"2.0","error":{"code":-32020,"message":"Required metadata header is missing, malformed, or mismatched"}},{"jsonrpc":"2.0","error":{"code":-32022,"message":"Unsupported protocol version"}},{"jsonrpc":"2.0","error":{"code":-32601,"message":"Unsupported notification"}}]}}}},"401":{"description":"invalid_token: the bearer or selected team is invalid, or cmux-api refused authentication; obtain valid credentials and retry.","content":{"application/json":{"schema":{"examples":[{"error":"invalid_token"}]}}}},"403":{"description":"Origin not allowed: the browser Origin differs from this endpoint; use the endpoint origin. | connector_unavailable: cmux-api refused access; check the selected team and connection.","content":{"application/json":{"schema":{"examples":[{"error":"Origin not allowed"},{"error":"connector_unavailable"}]}}}},"404":{"description":"Not Found: the hosted MCP surface is disabled; use an enabled deployment. | -32601: the JSON-RPC method is unsupported; call tools/list for supported tools.","content":{"application/json":{"schema":{"examples":["Not Found",{"jsonrpc":"2.0","error":{"code":-32601,"message":"Method not found"},"id":1}]}}}},"405":{"description":"405: GET and DELETE /mcp return an empty body with Allow: POST; send MCP requests with POST. This shared error declaration also appears on POST and discovery.","content":{"application/json":{"schema":{"examples":[null]}}}},"406":{"description":"-32600: Accept must include application/json and text/event-stream; send both media types.","content":{"application/json":{"schema":{"examples":[{"jsonrpc":"2.0","error":{"code":-32600,"message":"Accept must include application/json and text/event-stream"}}]}}}},"415":{"description":"-32600: Content-Type must be application/json; correct the header and retry.","content":{"application/json":{"schema":{"examples":[{"jsonrpc":"2.0","error":{"code":-32600,"message":"Content-Type must be application/json"}}]}}}},"503":{"description":"connector_unavailable: the cmux-api binding is absent or the connector status check failed; retry with backoff.","content":{"application/json":{"schema":{"examples":[{"error":"connector_unavailable"}]}}}}},"description":"Returns OAuth protected-resource metadata for the development MCP endpoint. Use the advertised resource and authorization server information to configure a client, sign in through the authorization server, then POST JSON-RPC requests to /mcp. This read needs no bearer, creates no session, and is safe to repeat. A supplied Origin must match this endpoint. Only 403 and 404 from the shared error declarations are emitted by discovery.","summary":"Discover the hosted MCP resource"}},"/.well-known/oauth-authorization-server":{"get":{"tags":["Hosted MCP (development only)"],"operationId":"mcp.asMetadata","parameters":[],"security":[],"responses":{"200":{"description":"RFC 8414 metadata for the hosted MCP's development authorization server.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/McpAuthorizationServerMetadata"}}}},"403":{"description":"Origin not allowed: the browser Origin differs from this endpoint; use the endpoint origin.","content":{"application/json":{"schema":{"examples":[{"error":"Origin not allowed"}]}}}},"404":{"description":"Not Found: the hosted MCP surface or its authorization server is off on this deployment.","content":{"application/json":{"schema":{"examples":["Not Found"]}}}},"405":{"description":"405: the method is not supported on this OAuth route; see Allow.","content":{"application/json":{"schema":{"examples":[null]}}}}},"description":"RFC 8414 metadata for the development OAuth 2.1 authorization server of /mcp: dynamic registration, the authorization code flow with PKCE S256, rotating refresh tokens and revocation. Public clients only; the only scope is mcp:read. Needs no bearer and is safe to repeat. Answers 404 where the surface is off or this origin is not the configured issuer.","summary":"Discover the hosted MCP authorization server"}},"/oauth/register":{"post":{"tags":["Hosted MCP (development only)"],"operationId":"mcp.register","parameters":[],"security":[],"responses":{"201":{"description":"Success","content":{"application/json":{"schema":{}}}},"400":{"description":"invalid_client_metadata: the body is not JSON client metadata for a public client; fix it. | invalid_redirect_uri: redirect_uris is not 1-10 allowed URIs; register https, loopback http or an app scheme.","content":{"application/json":{"schema":{"examples":[{"error":"invalid_client_metadata","error_description":"the body is not JSON client metadata for a public client; fix it."},{"error":"invalid_redirect_uri","error_description":"redirect_uris is not 1-10 allowed URIs; register https, loopback http or an app scheme."}]}}}},"403":{"description":"Origin not allowed: the browser Origin differs from this endpoint; use the endpoint origin.","content":{"application/json":{"schema":{"examples":[{"error":"Origin not allowed"}]}}}},"404":{"description":"Not Found: the hosted MCP surface or its authorization server is off on this deployment.","content":{"application/json":{"schema":{"examples":["Not Found"]}}}},"405":{"description":"405: the method is not supported on this OAuth route; see Allow.","content":{"application/json":{"schema":{"examples":[null]}}}}},"description":"RFC 7591 dynamic client registration for public clients (token_endpoint_auth_method none). Send JSON with redirect_uris (1-10: https, loopback http on any port, or a native app's private-use scheme) and an optional client_name; answers 201 with client_id. The client_id is the registration itself, signed, so registering stores nothing and is never refused for capacity; each call returns a new client_id.","summary":"Register an MCP client","requestBody":{"content":{"application/json":{"schema":{}}},"required":true}}},"/oauth/authorize":{"get":{"tags":["Hosted MCP (development only)"],"operationId":"mcp.authorize","parameters":[],"security":[],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{}}}},"403":{"description":"Origin not allowed: the browser Origin differs from this endpoint; use the endpoint origin.","content":{"application/json":{"schema":{"examples":[{"error":"Origin not allowed"}]}}}},"404":{"description":"Not Found: the hosted MCP surface or its authorization server is off on this deployment.","content":{"application/json":{"schema":{"examples":["Not Found"]}}}},"405":{"description":"405: the method is not supported on this OAuth route; see Allow.","content":{"application/json":{"schema":{"examples":[null]}}}}},"description":"The OAuth authorization endpoint, opened in a browser by the client. Takes response_type=code, client_id, redirect_uri, code_challenge with code_challenge_method=S256, optional state and resource (must be this origin's /mcp). Answers an HTML consent page asking for a cmux access token from `cmux auth token --team T`; an unknown client or redirect gets an HTML error page, other errors return to the redirect with iss.","summary":"Start MCP authorization"},"post":{"tags":["Hosted MCP (development only)"],"operationId":"mcp.consent","parameters":[],"security":[],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{}}}},"403":{"description":"Origin not allowed: the browser Origin differs from this endpoint; use the endpoint origin.","content":{"application/json":{"schema":{"examples":[{"error":"Origin not allowed"}]}}}},"404":{"description":"Not Found: the hosted MCP surface or its authorization server is off on this deployment.","content":{"application/json":{"schema":{"examples":["Not Found"]}}}},"405":{"description":"405: the method is not supported on this OAuth route; see Allow.","content":{"application/json":{"schema":{"examples":[null]}}}}},"description":"The consent page's form post (application/x-www-form-urlencoded): the authorization parameters plus cmux_token. A person's own live install token is required; a Cloud machine's or chief's is refused. On success redirects 302 to redirect_uri with a five-minute single-use code, state and iss.","summary":"Submit MCP consent","requestBody":{"content":{"application/json":{"schema":{}}},"required":true}}},"/oauth/token":{"post":{"tags":["Hosted MCP (development only)"],"operationId":"mcp.token","parameters":[],"security":[],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{}}}},"400":{"description":"invalid_request: the body is not application/x-www-form-urlencoded; send a form. | invalid_grant: the code or refresh token is invalid, expired, revoked or already used; authorize again. | invalid_target: resource is not this origin's /mcp; send that resource or none. | unsupported_grant_type: grant_type is not authorization_code or refresh_token; use one of them.","content":{"application/json":{"schema":{"examples":[{"error":"invalid_request","error_description":"the body is not application/x-www-form-urlencoded; send a form."},{"error":"invalid_grant","error_description":"the code or refresh token is invalid, expired, revoked or already used; authorize again."},{"error":"invalid_target","error_description":"resource is not this origin's /mcp; send that resource or none."},{"error":"unsupported_grant_type","error_description":"grant_type is not authorization_code or refresh_token; use one of them."}]}}}},"401":{"description":"invalid_client: the client_id is not registered; register the client again.","content":{"application/json":{"schema":{"examples":[{"error":"invalid_client","error_description":"the client_id is not registered; register the client again."}]}}}},"403":{"description":"Origin not allowed: the browser Origin differs from this endpoint; use the endpoint origin.","content":{"application/json":{"schema":{"examples":[{"error":"Origin not allowed"}]}}}},"404":{"description":"Not Found: the hosted MCP surface or its authorization server is off on this deployment.","content":{"application/json":{"schema":{"examples":["Not Found"]}}}},"405":{"description":"405: the method is not supported on this OAuth route; see Allow.","content":{"application/json":{"schema":{"examples":[null]}}}}},"description":"The OAuth token endpoint (application/x-www-form-urlencoded). grant_type=authorization_code takes code, redirect_uri, code_verifier and client_id; grant_type=refresh_token takes refresh_token and client_id. Answers an opaque one-hour access token for /mcp and a rotated 30-day refresh token. A code or refresh token works once; presenting it again revokes the grant.","summary":"Exchange an MCP authorization code or refresh token","requestBody":{"content":{"application/json":{"schema":{}}},"required":true}}},"/oauth/revoke":{"post":{"tags":["Hosted MCP (development only)"],"operationId":"mcp.revoke","parameters":[],"security":[],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{}}}},"400":{"description":"invalid_request: the body is not application/x-www-form-urlencoded; send a form.","content":{"application/json":{"schema":{"examples":[{"error":"invalid_request","error_description":"the body is not application/x-www-form-urlencoded; send a form."}]}}}},"403":{"description":"Origin not allowed: the browser Origin differs from this endpoint; use the endpoint origin.","content":{"application/json":{"schema":{"examples":[{"error":"Origin not allowed"}]}}}},"404":{"description":"Not Found: the hosted MCP surface or its authorization server is off on this deployment.","content":{"application/json":{"schema":{"examples":["Not Found"]}}}},"405":{"description":"405: the method is not supported on this OAuth route; see Allow.","content":{"application/json":{"schema":{"examples":[null]}}}}},"description":"RFC 7009 revocation (application/x-www-form-urlencoded token). Revokes the whole grant the access or refresh token belongs to. Always answers 200, also for an unknown token; safe to repeat.","summary":"Revoke an MCP grant","requestBody":{"content":{"application/json":{"schema":{}}},"required":true}}},"/v1/projects":{"get":{"tags":["Projects"],"operationId":"projects.list","parameters":[],"security":[],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","description":"A project's id: an opaque string.","examples":["3f1c2b9e-8a4d-4f2e-9c1a-5b6d7e8f9a0b"]},"name":{"type":"string","examples":["my project"]},"createdAt":{"type":"string","description":"ISO 8601 time.","examples":["2026-10-30T12:00:00.000Z"]}},"required":["id","name","createdAt"],"additionalProperties":false,"description":"A project (the example resource)."}}}}}},"description":"Every project in this isolate's memory, oldest first. Needs no auth.","summary":"List projects"},"post":{"tags":["Projects"],"operationId":"projects.create","parameters":[],"security":[],"responses":{"200":{"description":"A project (the example resource).","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","description":"A project's id: an opaque string.","examples":["3f1c2b9e-8a4d-4f2e-9c1a-5b6d7e8f9a0b"]},"name":{"type":"string","examples":["my project"]},"createdAt":{"type":"string","description":"ISO 8601 time.","examples":["2026-10-30T12:00:00.000Z"]}},"required":["id","name","createdAt"],"additionalProperties":false,"description":"A project (the example resource)."}}}}},"description":"Creates a project and answers it. Needs no auth.","summary":"Create a project","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":100,"description":"1 to 100 characters.","examples":["my project"]}},"required":["name"],"additionalProperties":false,"description":"A new project.","examples":[{"name":"my project"}]}}},"required":true}}},"/v1/projects/{id}":{"get":{"tags":["Projects"],"operationId":"projects.get","parameters":[{"name":"id","in":"path","schema":{"type":"string","description":"A project's id: an opaque string.","examples":["3f1c2b9e-8a4d-4f2e-9c1a-5b6d7e8f9a0b"]},"required":true}],"security":[],"responses":{"200":{"description":"A project (the example resource).","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","description":"A project's id: an opaque string.","examples":["3f1c2b9e-8a4d-4f2e-9c1a-5b6d7e8f9a0b"]},"name":{"type":"string","examples":["my project"]},"createdAt":{"type":"string","description":"ISO 8601 time.","examples":["2026-10-30T12:00:00.000Z"]}},"required":["id","name","createdAt"],"additionalProperties":false,"description":"A project (the example resource)."}}}},"404":{"description":"NotFound: no such resource.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NotFoundEncoded"}}}}},"description":"One project by id; 404 NotFound when absent.","summary":"Read a project"}},"/v1/chat-shares/{shareId}":{"put":{"tags":["Chat shares"],"operationId":"chatShares.provision","parameters":[{"name":"shareId","in":"path","schema":{"type":"string","pattern":"^[A-Za-z0-9_-]{16,128}$","description":"The opaque id of a chat share.","examples":["share_0123456789abcd"]},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Credentials and link base returned after a share is provisioned.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProvisionedShare"}}}},"400":{"description":"share.bad_expiry: expires_at is not in the allowed window. | share.name: the guest name is invalid; fix the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ShareBadRequestEncoded"}}}},"401":{"description":"share.unauthorized: credentials are missing or invalid; PUT requires the owner's access token; DELETE also accepts the current host bearer; accept requires the person's cmux sign-in.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ShareUnauthorizedEncoded"}}}},"403":{"description":"share.forbidden: this caller is not allowed. | share.bad_secret: the guest link secret is invalid. | share.secret: the guest link secret is invalid. | share.refused: the daemon refused the request. | share.used: the daemon reports the link was already used; request a new link. | share.kicked: the guest was removed. | share.left: the guest left this share. | share.not_invited: the signed-in cmux account is not invited to this chat. | share.unverified: the signed-in account has no verified email to match an invite.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ShareForbiddenEncoded"}}}},"404":{"description":"share.not_found: no such share exists, or rooms are disabled on this deployment before auth; check the deployment and id.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ShareNotFoundEncoded"}}}},"409":{"description":"share.conflict: the share exists with another provision_key; use the original key or a new share id.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ShareConflictEncoded"}}}},"410":{"description":"share.revoked: the share was revoked; provision a new share. | share.expired: the share expired; provision a new share. | share.closed: the shared chat was closed; provision a new share.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ShareGoneEncoded"}}}},"429":{"description":"share.rate_limited: too many redemption attempts; wait and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ShareRateLimitedEncoded"}}}},"503":{"description":"share.host_offline: the owner's daemon is offline and no use was spent. | share.host_timeout: the daemon did not answer; retry. | share.host_error: the daemon sent an invalid answer; retry. | share.unavailable: the room could not be reached; retry. | share.sign_in_unavailable: this deployment has no browser sign-in, so invites cannot be accepted here.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ShareUnavailableEncoded"}}}}},"description":"Creates the share room for the authenticated owner and returns a host bearer plus the guest link base. Idempotent for the same `shareId` and `provision_key`: a retry rotates the host bearer and replaces the old host socket without changing the original expiry, secret digest or uses. The expiry must be in the future and no more than 7 days ahead. Connect the owner's daemon to WS /v1/chat-shares/{shareId}/host with the returned host bearer, then give guests the link.","summary":"Provision a hosted chat share","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProvisionShare"}}},"required":true}},"delete":{"tags":["Chat shares"],"operationId":"chatShares.end","parameters":[{"name":"shareId","in":"path","schema":{"type":"string","pattern":"^[A-Za-z0-9_-]{16,128}$","description":"The opaque id of a chat share.","examples":["share_0123456789abcd"]},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"The terminal state of a chat share.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EndedShare"}}}},"400":{"description":"share.bad_expiry: expires_at is not in the allowed window. | share.name: the guest name is invalid; fix the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ShareBadRequestEncoded"}}}},"401":{"description":"share.unauthorized: credentials are missing or invalid; PUT requires the owner's access token; DELETE also accepts the current host bearer; accept requires the person's cmux sign-in.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ShareUnauthorizedEncoded"}}}},"403":{"description":"share.forbidden: this caller is not allowed. | share.bad_secret: the guest link secret is invalid. | share.secret: the guest link secret is invalid. | share.refused: the daemon refused the request. | share.used: the daemon reports the link was already used; request a new link. | share.kicked: the guest was removed. | share.left: the guest left this share. | share.not_invited: the signed-in cmux account is not invited to this chat. | share.unverified: the signed-in account has no verified email to match an invite.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ShareForbiddenEncoded"}}}},"404":{"description":"share.not_found: no such share exists, or rooms are disabled on this deployment before auth; check the deployment and id.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ShareNotFoundEncoded"}}}},"409":{"description":"share.conflict: the share exists with another provision_key; use the original key or a new share id.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ShareConflictEncoded"}}}},"410":{"description":"share.revoked: the share was revoked; provision a new share. | share.expired: the share expired; provision a new share. | share.closed: the shared chat was closed; provision a new share.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ShareGoneEncoded"}}}},"429":{"description":"share.rate_limited: too many redemption attempts; wait and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ShareRateLimitedEncoded"}}}},"503":{"description":"share.host_offline: the owner's daemon is offline and no use was spent. | share.host_timeout: the daemon did not answer; retry. | share.host_error: the daemon sent an invalid answer; retry. | share.unavailable: the room could not be reached; retry. | share.sign_in_unavailable: this deployment has no browser sign-in, so invites cannot be accepted here.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ShareUnavailableEncoded"}}}}},"description":"Revokes the share when called with the owner's cmux token or the current host bearer, closes its host and guest sockets, and returns its terminal state (expired if its expiry already passed). Repeated authorized DELETEs return the terminal state until the room is purged. Provision a new share id to share again.","summary":"End a hosted chat share"}},"/v1/chat-shares/{shareId}/redeem":{"post":{"tags":["Chat shares"],"operationId":"chatShares.redeem","parameters":[{"name":"shareId","in":"path","schema":{"type":"string","pattern":"^[A-Za-z0-9_-]{16,128}$","description":"The opaque id of a chat share.","examples":["share_0123456789abcd"]},"required":true}],"security":[],"responses":{"200":{"description":"The guest identity and expiry after redemption.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RedeemedShare"}}}},"400":{"description":"share.bad_expiry: expires_at is not in the allowed window. | share.name: the guest name is invalid; fix the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ShareBadRequestEncoded"}}}},"401":{"description":"share.unauthorized: credentials are missing or invalid; PUT requires the owner's access token; DELETE also accepts the current host bearer; accept requires the person's cmux sign-in.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ShareUnauthorizedEncoded"}}}},"403":{"description":"share.forbidden: this caller is not allowed. | share.bad_secret: the guest link secret is invalid. | share.secret: the guest link secret is invalid. | share.refused: the daemon refused the request. | share.used: the daemon reports the link was already used; request a new link. | share.kicked: the guest was removed. | share.left: the guest left this share. | share.not_invited: the signed-in cmux account is not invited to this chat. | share.unverified: the signed-in account has no verified email to match an invite.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ShareForbiddenEncoded"}}}},"404":{"description":"share.not_found: no such share exists, or rooms are disabled on this deployment before auth; check the deployment and id.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ShareNotFoundEncoded"}}}},"409":{"description":"share.conflict: the share exists with another provision_key; use the original key or a new share id.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ShareConflictEncoded"}}}},"410":{"description":"share.revoked: the share was revoked; provision a new share. | share.expired: the share expired; provision a new share. | share.closed: the shared chat was closed; provision a new share.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ShareGoneEncoded"}}}},"429":{"description":"share.rate_limited: too many redemption attempts; wait and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ShareRateLimitedEncoded"}}}},"503":{"description":"share.host_offline: the owner's daemon is offline and no use was spent. | share.host_timeout: the daemon did not answer; retry. | share.host_error: the daemon sent an invalid answer; retry. | share.unavailable: the room could not be reached; retry. | share.sign_in_unavailable: this deployment has no browser sign-in, so invites cannot be accepted here.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ShareUnavailableEncoded"}}}}},"description":"Checks the guest secret and asks the owner's connected daemon to redeem `attempt_id`. On success, sets a scoped HttpOnly guest cookie and returns the guest id and expiry. A retry with the same attempt id reaches the daemon's attempt lookup; a successful reply for the same guest rotates its cookie and closes old guest sockets. The daemon owns attempt deduplication and use counts. After success, open WS /v1/chat-shares/{shareId}/guest with that cookie.","summary":"Redeem a chat share link","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RedeemShare"}}},"required":true}}},"/v1/chat-shares/{shareId}/accept":{"post":{"tags":["Chat shares"],"operationId":"chatShares.accept","parameters":[{"name":"shareId","in":"path","schema":{"type":"string","pattern":"^[A-Za-z0-9_-]{16,128}$","description":"The opaque id of a chat share.","examples":["share_0123456789abcd"]},"required":true}],"security":[],"responses":{"200":{"description":"The invited guest's identity, expiry and role after accept.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AcceptedShare"}}}},"400":{"description":"share.bad_expiry: expires_at is not in the allowed window. | share.name: the guest name is invalid; fix the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ShareBadRequestEncoded"}}}},"401":{"description":"share.unauthorized: credentials are missing or invalid; PUT requires the owner's access token; DELETE also accepts the current host bearer; accept requires the person's cmux sign-in.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ShareUnauthorizedEncoded"}}}},"403":{"description":"share.forbidden: this caller is not allowed. | share.bad_secret: the guest link secret is invalid. | share.secret: the guest link secret is invalid. | share.refused: the daemon refused the request. | share.used: the daemon reports the link was already used; request a new link. | share.kicked: the guest was removed. | share.left: the guest left this share. | share.not_invited: the signed-in cmux account is not invited to this chat. | share.unverified: the signed-in account has no verified email to match an invite.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ShareForbiddenEncoded"}}}},"404":{"description":"share.not_found: no such share exists, or rooms are disabled on this deployment before auth; check the deployment and id.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ShareNotFoundEncoded"}}}},"409":{"description":"share.conflict: the share exists with another provision_key; use the original key or a new share id.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ShareConflictEncoded"}}}},"410":{"description":"share.revoked: the share was revoked; provision a new share. | share.expired: the share expired; provision a new share. | share.closed: the shared chat was closed; provision a new share.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ShareGoneEncoded"}}}},"429":{"description":"share.rate_limited: too many redemption attempts; wait and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ShareRateLimitedEncoded"}}}},"503":{"description":"share.host_offline: the owner's daemon is offline and no use was spent. | share.host_timeout: the daemon did not answer; retry. | share.host_error: the daemon sent an invalid answer; retry. | share.unavailable: the room could not be reached; retry. | share.sign_in_unavailable: this deployment has no browser sign-in, so invites cannot be accepted here.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ShareUnavailableEncoded"}}}}},"description":"For a person the owner invited by account. Authenticate with the HttpOnly __Host-cmux-chief cookie after the platform's cmux sign-in (GET /i/{shareId} starts it; cookie requests need this deployment's Origin) or a human Stack bearer. The room reads the account's verified email from that sign-in, never from the body, and asks the owner's connected daemon to redeem `attempt_id` for it with no link secret; the daemon admits only an invited account (`share.not_invited` otherwise). On success, sets the same scoped guest cookie as redeem. A host that is offline spends nothing (`share.host_offline`).","summary":"Accept a chat share invite","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AcceptShare"}}},"required":true}}},"/v1/artifacts/repo":{"post":{"tags":["Artifacts"],"operationId":"artifacts.provision","parameters":[],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"The provisioned repository and its current head.","content":{"application/json":{"schema":{"type":"object","properties":{"repo":{"type":"string","description":"The per-user repository identifier.","examples":["user-repo"]},"headSha":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"The current head, or null before the first commit.","examples":[null]}},"required":["repo","headSha"],"additionalProperties":false,"description":"The provisioned repository and its current head.","examples":[{"repo":"user-repo","headSha":null}]}}}},"400":{"description":"artifacts.bad_path: the artifact path or upload is invalid; correct it and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsBadRequestEncoded"}}}},"401":{"description":"artifacts.unauthorized: a team-install access token is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsUnauthorizedEncoded"}}}},"403":{"description":"artifacts.forbidden: machine credentials cannot access artifacts; use a team token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsForbiddenEncoded"}}}},"404":{"description":"artifacts.not_found: the artifact repository or path is absent; check the ref and path.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsNotFoundEncoded"}}}},"409":{"description":"artifacts.conflict: the repository head changed; read the current head before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsConflictEncoded"}}}},"413":{"description":"artifacts.too_large: the upload exceeds the service limit; use a blob or split the save.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsTooLargeEncoded"}}}},"503":{"description":"artifacts.unavailable: the artifact store could not be reached; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsUnavailableEncoded"}}}}},"description":"Create the caller's per-user artifact repository if needed and return its current head. Idempotent: repeating the call does not add a commit. Call save or create to write, or list to inspect it.","summary":"Provision the artifact repository"}},"/v1/artifacts/save":{"post":{"tags":["Artifacts"],"operationId":"artifacts.save","parameters":[],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"The new repository head and commit.","content":{"application/json":{"schema":{"type":"object","properties":{"headSha":{"type":"string","description":"The new branch head commit id.","examples":["0123456789abcdef0123456789abcdef01234567"]},"commit":{"$ref":"#/components/schemas/ArtifactCommit"}},"required":["headSha","commit"],"additionalProperties":false,"description":"The new repository head and commit.","examples":[{"headSha":"0123456789abcdef0123456789abcdef01234567","commit":{"sha":"0123456789abcdef0123456789abcdef01234567","parents":[],"message":"Add report","authorName":"user_abc","time":1761800000000,"trailers":{}}}]}}}},"400":{"description":"artifacts.bad_path: the artifact path or upload is invalid; correct it and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsBadRequestEncoded"}}}},"401":{"description":"artifacts.unauthorized: a team-install access token is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsUnauthorizedEncoded"}}}},"403":{"description":"artifacts.forbidden: machine credentials cannot access artifacts; use a team token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsForbiddenEncoded"}}}},"404":{"description":"artifacts.not_found: the artifact repository or path is absent; check the ref and path.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsNotFoundEncoded"}}}},"409":{"description":"artifacts.conflict: the repository head changed; read the current head before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsConflictEncoded"}}}},"413":{"description":"artifacts.too_large: the upload exceeds the service limit; use a blob or split the save.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsTooLargeEncoded"}}}},"503":{"description":"artifacts.unavailable: the artifact store could not be reached; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsUnavailableEncoded"}}}}},"description":"Apply changes as one compare-and-swap commit on the selected branch. This mutates the repository and is not idempotent because each accepted save creates a new commit; on conflict, read the returned head before retrying. Call list, tree, file or history to inspect the result.","summary":"Commit artifact changes","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactSave"}}},"required":true}}},"/v1/artifacts":{"post":{"tags":["Artifacts"],"operationId":"artifacts.create","parameters":[],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"The generated artifact id and commit.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","description":"The generated artifact id.","examples":["01J8Z7Q4M6N2K5P8R3T1V9W0X2"]},"headSha":{"type":"string","description":"The new branch head commit id.","examples":["0123456789abcdef0123456789abcdef01234567"]},"commit":{"$ref":"#/components/schemas/ArtifactCommit"}},"required":["id","headSha","commit"],"additionalProperties":false,"description":"The generated artifact id and commit.","examples":[{"id":"01J8Z7Q4M6N2K5P8R3T1V9W0X2","headSha":"0123456789abcdef0123456789abcdef01234567","commit":{"sha":"0123456789abcdef0123456789abcdef01234567","parents":[],"message":"Create artifact","authorName":"user_abc","time":1761800000000,"trailers":{}}}]}}}},"400":{"description":"artifacts.bad_path: the artifact path or upload is invalid; correct it and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsBadRequestEncoded"}}}},"401":{"description":"artifacts.unauthorized: a team-install access token is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsUnauthorizedEncoded"}}}},"403":{"description":"artifacts.forbidden: machine credentials cannot access artifacts; use a team token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsForbiddenEncoded"}}}},"404":{"description":"artifacts.not_found: the artifact repository or path is absent; check the ref and path.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsNotFoundEncoded"}}}},"409":{"description":"artifacts.conflict: the repository head changed; read the current head before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsConflictEncoded"}}}},"413":{"description":"artifacts.too_large: the upload exceeds the service limit; use a blob or split the save.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsTooLargeEncoded"}}}},"503":{"description":"artifacts.unavailable: the artifact store could not be reached; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsUnavailableEncoded"}}}}},"description":"Create a new artifact directory, metadata file and commit in the caller's repository. This mutates the repository and is not idempotent because each accepted call generates a new artifact id; on conflict, read the current head before retrying. Call list or file to find and read it.","summary":"Create an artifact","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactCreate"}}},"required":true}},"get":{"tags":["Artifacts"],"operationId":"artifacts.list","parameters":[{"name":"prefix","in":"query","schema":{"type":"string","description":"Only paths beginning with this prefix.","examples":["reports/"]},"required":false},{"name":"kind","in":"query","schema":{"type":"string","enum":["html","markdown","json","image","other"],"description":"The artifact's presentation kind.","examples":["html"]},"required":false},{"name":"limit","in":"query","schema":{"type":"string"},"required":false},{"name":"cursor","in":"query","schema":{"type":"string","description":"The cursor returned by the previous page.","examples":["artifacts/next"]},"required":false}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"A page of repository items.","content":{"application/json":{"schema":{"type":"object","properties":{"headSha":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"The current head, or null before the first commit.","examples":[null]},"items":{"type":"array","items":{"$ref":"#/components/schemas/ArtifactItem"},"description":"The page of matching items, sorted by path.","examples":[[]]},"cursor":{"type":"string","description":"Pass this value as cursor for the next page.","examples":["artifacts/next"]}},"required":["headSha","items"],"additionalProperties":false,"description":"A page of repository items.","examples":[{"headSha":null,"items":[]}]}}}},"400":{"description":"artifacts.bad_path: the artifact path or upload is invalid; correct it and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsBadRequestEncoded"}}}},"401":{"description":"artifacts.unauthorized: a team-install access token is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsUnauthorizedEncoded"}}}},"403":{"description":"artifacts.forbidden: machine credentials cannot access artifacts; use a team token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsForbiddenEncoded"}}}},"404":{"description":"artifacts.not_found: the artifact repository or path is absent; check the ref and path.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsNotFoundEncoded"}}}},"409":{"description":"artifacts.conflict: the repository head changed; read the current head before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsConflictEncoded"}}}},"413":{"description":"artifacts.too_large: the upload exceeds the service limit; use a blob or split the save.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsTooLargeEncoded"}}}},"503":{"description":"artifacts.unavailable: the artifact store could not be reached; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsUnavailableEncoded"}}}}},"description":"Read a path-ordered page of artifacts and regular files from the caller's repository. This is read-only; pass the returned cursor for the next page. Call file or tree to read an item.","summary":"List repository artifacts"}},"/v1/artifacts/blobs":{"post":{"tags":["Artifacts"],"operationId":"artifacts.blob","parameters":[],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"The content-addressed blob reference.","content":{"application/json":{"schema":{"type":"object","properties":{"sha256":{"type":"string","description":"The SHA-256 of the stored blob.","examples":["0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"]},"size":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991,"description":"The blob size in bytes.","examples":[128]}},"required":["sha256","size"],"additionalProperties":false,"description":"The content-addressed blob reference.","examples":[{"sha256":"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef","size":128}]}}}},"400":{"description":"artifacts.bad_path: the artifact path or upload is invalid; correct it and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsBadRequestEncoded"}}}},"401":{"description":"artifacts.unauthorized: a team-install access token is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsUnauthorizedEncoded"}}}},"403":{"description":"artifacts.forbidden: machine credentials cannot access artifacts; use a team token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsForbiddenEncoded"}}}},"404":{"description":"artifacts.not_found: the artifact repository or path is absent; check the ref and path.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsNotFoundEncoded"}}}},"409":{"description":"artifacts.conflict: the repository head changed; read the current head before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsConflictEncoded"}}}},"413":{"description":"artifacts.too_large: the upload exceeds the service limit; use a blob or split the save.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsTooLargeEncoded"}}}},"503":{"description":"artifacts.unavailable: the artifact store could not be reached; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsUnavailableEncoded"}}}}},"description":"Store request bytes as a content-addressed blob for a later save. Repeating the same bytes yields the same hash. Call save with that hash in blobSha256.","summary":"Upload a content blob","requestBody":{"content":{"application/octet-stream":{"schema":{"type":"string","format":"binary"}}},"required":true}}},"/v1/artifacts/tree":{"get":{"tags":["Artifacts"],"operationId":"artifacts.tree","parameters":[{"name":"ref","in":"query","schema":{"type":"string","description":"A repository ref.","examples":["main"]},"required":false},{"name":"path","in":"query","schema":{"type":"string","description":"The repository directory to inspect; empty means the root.","examples":["reports"]},"required":false}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"The immediate entries at a repository path.","content":{"application/json":{"schema":{"type":"object","properties":{"ref":{"type":"string","description":"The ref that was read.","examples":["main"]},"sha":{"type":"string","description":"The resolved commit id.","examples":["0123456789abcdef0123456789abcdef01234567"]},"entries":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"The immediate child name.","examples":["index.html"]},"path":{"type":"string","description":"The child path.","examples":["reports/index.html"]},"type":{"type":"string","enum":["blob","tree"],"description":"Whether the child is a file or directory.","examples":["blob"]},"size":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991,"description":"The file size in bytes; omitted for directories.","examples":[128]}},"required":["name","path","type"],"additionalProperties":false,"description":"One immediate tree entry.","examples":[{"name":"index.html","path":"reports/index.html","type":"blob","size":128}]},"description":"Immediate children of the requested path.","examples":[[]]}},"required":["ref","sha","entries"],"additionalProperties":false,"description":"The immediate entries at a repository path.","examples":[{"ref":"main","sha":"0123456789abcdef0123456789abcdef01234567","entries":[]}]}}}},"400":{"description":"artifacts.bad_path: the artifact path or upload is invalid; correct it and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsBadRequestEncoded"}}}},"401":{"description":"artifacts.unauthorized: a team-install access token is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsUnauthorizedEncoded"}}}},"403":{"description":"artifacts.forbidden: machine credentials cannot access artifacts; use a team token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsForbiddenEncoded"}}}},"404":{"description":"artifacts.not_found: the artifact repository or path is absent; check the ref and path.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsNotFoundEncoded"}}}},"409":{"description":"artifacts.conflict: the repository head changed; read the current head before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsConflictEncoded"}}}},"413":{"description":"artifacts.too_large: the upload exceeds the service limit; use a blob or split the save.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsTooLargeEncoded"}}}},"503":{"description":"artifacts.unavailable: the artifact store could not be reached; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsUnavailableEncoded"}}}}},"description":"Read the immediate children of a path at a branch or commit. This is read-only; call file for a blob entry or tree again for a directory.","summary":"Read a repository tree"}},"/v1/artifacts/file":{"get":{"tags":["Artifacts"],"operationId":"artifacts.file","parameters":[{"name":"path","in":"query","schema":{"type":"string","description":"The repository-relative file path.","examples":["reports/index.html"]},"required":true},{"name":"ref","in":"query","schema":{"type":"string","description":"A repository ref.","examples":["main"]},"required":false}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Success","content":{"application/octet-stream":{"schema":{"type":"string","format":"binary"}}}},"400":{"description":"artifacts.bad_path: the artifact path or upload is invalid; correct it and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsBadRequestEncoded"}}}},"401":{"description":"artifacts.unauthorized: a team-install access token is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsUnauthorizedEncoded"}}}},"403":{"description":"artifacts.forbidden: machine credentials cannot access artifacts; use a team token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsForbiddenEncoded"}}}},"404":{"description":"artifacts.not_found: the artifact repository or path is absent; check the ref and path.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsNotFoundEncoded"}}}},"409":{"description":"artifacts.conflict: the repository head changed; read the current head before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsConflictEncoded"}}}},"413":{"description":"artifacts.too_large: the upload exceeds the service limit; use a blob or split the save.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsTooLargeEncoded"}}}},"503":{"description":"artifacts.unavailable: the artifact store could not be reached; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsUnavailableEncoded"}}}}},"description":"Return the bytes of one repository path at a branch or commit, with its content type and commit in response headers. This is read-only; call history to see revisions.","summary":"Read an artifact file"}},"/v1/artifacts/history":{"get":{"tags":["Artifacts"],"operationId":"artifacts.history","parameters":[{"name":"path","in":"query","schema":{"type":"string","description":"Only commits that changed this path; omit for the whole ref.","examples":["reports/index.html"]},"required":false},{"name":"ref","in":"query","schema":{"type":"string","description":"A repository ref.","examples":["main"]},"required":false},{"name":"limit","in":"query","schema":{"type":"string"},"required":false},{"name":"offset","in":"query","schema":{"type":"string"},"required":false}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"The commit history for a path or the whole ref.","content":{"application/json":{"schema":{"type":"object","properties":{"commits":{"type":"array","items":{"$ref":"#/components/schemas/ArtifactCommit"},"description":"Matching commits, newest first.","examples":[[]]}},"required":["commits"],"additionalProperties":false,"description":"The commit history for a path or the whole ref.","examples":[{"commits":[]}]}}}},"400":{"description":"artifacts.bad_path: the artifact path or upload is invalid; correct it and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsBadRequestEncoded"}}}},"401":{"description":"artifacts.unauthorized: a team-install access token is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsUnauthorizedEncoded"}}}},"403":{"description":"artifacts.forbidden: machine credentials cannot access artifacts; use a team token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsForbiddenEncoded"}}}},"404":{"description":"artifacts.not_found: the artifact repository or path is absent; check the ref and path.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsNotFoundEncoded"}}}},"409":{"description":"artifacts.conflict: the repository head changed; read the current head before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsConflictEncoded"}}}},"413":{"description":"artifacts.too_large: the upload exceeds the service limit; use a blob or split the save.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsTooLargeEncoded"}}}},"503":{"description":"artifacts.unavailable: the artifact store could not be reached; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsUnavailableEncoded"}}}}},"description":"Return commits that changed the requested path, newest first, with limit and offset applied to matching commits. This is read-only; call file with a commit id to read a historical version.","summary":"Read artifact history"}},"/v1/artifacts/search":{"get":{"tags":["Artifacts"],"operationId":"artifacts.search","parameters":[{"name":"q","in":"query","schema":{"type":"string","maxLength":512,"description":"The case-insensitive text to find.","examples":["build report"]},"required":true},{"name":"limit","in":"query","schema":{"type":"string"},"required":false}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Text matches in artifact metadata, notes and memory files.","content":{"application/json":{"schema":{"type":"object","properties":{"hits":{"type":"array","items":{"type":"object","properties":{"path":{"type":"string","description":"The matching repository path.","examples":["notes/today.md"]},"title":{"type":"string","description":"The artifact title, when matched in metadata.","examples":["Build report"]},"snippet":{"type":"string","description":"A bounded snippet around the match.","examples":["build report"]},"commit":{"type":"string","description":"The commit containing the match.","examples":["0123456789abcdef0123456789abcdef01234567"]}},"required":["path","snippet","commit"],"additionalProperties":false,"description":"One text search hit.","examples":[{"path":"notes/today.md","snippet":"build report","commit":"0123456789abcdef0123456789abcdef01234567"}]}}},"required":["hits"],"additionalProperties":false,"description":"Text matches in artifact metadata, notes and memory files.","examples":[{"hits":[]}]}}}},"400":{"description":"artifacts.bad_path: the artifact path or upload is invalid; correct it and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsBadRequestEncoded"}}}},"401":{"description":"artifacts.unauthorized: a team-install access token is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsUnauthorizedEncoded"}}}},"403":{"description":"artifacts.forbidden: machine credentials cannot access artifacts; use a team token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsForbiddenEncoded"}}}},"404":{"description":"artifacts.not_found: the artifact repository or path is absent; check the ref and path.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsNotFoundEncoded"}}}},"409":{"description":"artifacts.conflict: the repository head changed; read the current head before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsConflictEncoded"}}}},"413":{"description":"artifacts.too_large: the upload exceeds the service limit; use a blob or split the save.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsTooLargeEncoded"}}}},"503":{"description":"artifacts.unavailable: the artifact store could not be reached; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ArtifactsUnavailableEncoded"}}}}},"description":"Search bounded textual artifact metadata, notes and memory files for a case-insensitive query. This is read-only; call file with a returned path to read the match.","summary":"Search artifact text"}},"/v1/sync/blobs/missing":{"post":{"tags":["Sync"],"operationId":"sync.missing","parameters":[],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"The hashes to upload.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncMissingResult"}}}},"400":{"description":"sync.bad_request: a hash, the body or Content-Length is malformed; fix the request. | sync.digest_mismatch: the uploaded bytes do not hash to the path's sha256; nothing was stored.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncBadRequestEncoded"}}}},"401":{"description":"sync.unauthorized: the access token, or the read grant, is missing, invalid or expired; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncUnauthorizedEncoded"}}}},"403":{"description":"sync.forbidden: machine tokens cannot use the sync store; a machine reads with a grant instead.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncForbiddenEncoded"}}}},"404":{"description":"sync.not_found: the sync store is off on this deployment. | sync.blob_not_found: this user's store holds no blob with that hash.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncNotFoundEncoded"}}}},"413":{"description":"sync.too_large: a blob is at most 64 MiB; split the file into chunks.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncTooLargeEncoded"}}}},"503":{"description":"sync.unavailable: the blob store could not be reached; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncUnavailableEncoded"}}}}},"description":"Answer which of up to 1000 hashes the caller's store lacks. Read-only and safe to repeat. Upload each missing hash with PUT /v1/sync/blobs/{sha}.","summary":"List the blobs to upload","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncMissingRequest"}}},"required":true}}},"/v1/sync/blobs/{sha}":{"put":{"tags":["Sync"],"operationId":"sync.put","parameters":[{"name":"sha","in":"path","schema":{"type":"string","description":"The SHA-256 of the blob's bytes: 64 lowercase hexadecimal characters.","examples":["9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"]},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"The stored blob.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncBlobResult"}}}},"400":{"description":"sync.bad_request: a hash, the body or Content-Length is malformed; fix the request. | sync.digest_mismatch: the uploaded bytes do not hash to the path's sha256; nothing was stored.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncBadRequestEncoded"}}}},"401":{"description":"sync.unauthorized: the access token, or the read grant, is missing, invalid or expired; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncUnauthorizedEncoded"}}}},"403":{"description":"sync.forbidden: machine tokens cannot use the sync store; a machine reads with a grant instead.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncForbiddenEncoded"}}}},"404":{"description":"sync.not_found: the sync store is off on this deployment. | sync.blob_not_found: this user's store holds no blob with that hash.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncNotFoundEncoded"}}}},"413":{"description":"sync.too_large: a blob is at most 64 MiB; split the file into chunks.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncTooLargeEncoded"}}}},"503":{"description":"sync.unavailable: the blob store could not be reached; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncUnavailableEncoded"}}}}},"description":"Store the raw request bytes (Content-Length required, at most 64 MiB) under their SHA-256, which the store verifies; a mismatch stores nothing. Idempotent: a blob already stored answers 200 without being rewritten. Read it back with GET /v1/sync/blobs/{sha}.","summary":"Upload a blob","requestBody":{"content":{"application/octet-stream":{"schema":{"type":"string","format":"binary"}}},"required":true}},"get":{"tags":["Sync"],"operationId":"syncRead.get","parameters":[{"name":"sha","in":"path","schema":{"type":"string","description":"The SHA-256 of the blob's bytes: 64 lowercase hexadecimal characters.","examples":["9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"]},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Success","content":{"application/octet-stream":{"schema":{"type":"string","format":"binary"}}}},"400":{"description":"sync.bad_request: a hash, the body or Content-Length is malformed; fix the request. | sync.digest_mismatch: the uploaded bytes do not hash to the path's sha256; nothing was stored.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncBadRequestEncoded"}}}},"401":{"description":"sync.unauthorized: the access token, or the read grant, is missing, invalid or expired; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncUnauthorizedEncoded"}}}},"403":{"description":"sync.forbidden: machine tokens cannot use the sync store; a machine reads with a grant instead.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncForbiddenEncoded"}}}},"404":{"description":"sync.not_found: the sync store is off on this deployment. | sync.blob_not_found: this user's store holds no blob with that hash.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncNotFoundEncoded"}}}},"413":{"description":"sync.too_large: a blob is at most 64 MiB; split the file into chunks.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncTooLargeEncoded"}}}},"503":{"description":"sync.unavailable: the blob store could not be reached; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncUnavailableEncoded"}}}}},"description":"Stream one blob's bytes, with its hash in x-cmux-sha256. Takes the person's access token or a `csg_` read grant of the same person. Read-only.","summary":"Read a blob"}},"/v1/sync/grants":{"post":{"tags":["Sync"],"operationId":"sync.grant","parameters":[],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"A read grant to hand to the caller's own Cloud machine.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncGrantResult"}}}},"400":{"description":"sync.bad_request: a hash, the body or Content-Length is malformed; fix the request. | sync.digest_mismatch: the uploaded bytes do not hash to the path's sha256; nothing was stored.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncBadRequestEncoded"}}}},"401":{"description":"sync.unauthorized: the access token, or the read grant, is missing, invalid or expired; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncUnauthorizedEncoded"}}}},"403":{"description":"sync.forbidden: machine tokens cannot use the sync store; a machine reads with a grant instead.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncForbiddenEncoded"}}}},"404":{"description":"sync.not_found: the sync store is off on this deployment. | sync.blob_not_found: this user's store holds no blob with that hash.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncNotFoundEncoded"}}}},"413":{"description":"sync.too_large: a blob is at most 64 MiB; split the file into chunks.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncTooLargeEncoded"}}}},"503":{"description":"sync.unavailable: the blob store could not be reached; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncUnavailableEncoded"}}}}},"description":"Issue a one-hour, read-only bearer for the caller's blobs, for the caller's own Cloud machine, so the machine needs no account credential. Each call issues a new grant. Pass it as `Authorization: Bearer csg_...` to GET /v1/sync/blobs/{sha}.","summary":"Issue a read grant"}},"/v1/environments/derive":{"post":{"tags":["Environments"],"operationId":"environments.derive","parameters":[],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"A derived environment. `status` is building while a setup runs (read it again with GET until it ends), ready once new chats can boot from `snapshot`, or failed with `error` set; a derive after `retry_at` starts a new setup. Times are Unix milliseconds.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DerivedEnvironment"}}}},"400":{"description":"environment.invalid: the request matched the schema but a value in it is not valid, for example a derive's repo that is not `owner/name`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnvironmentBadRequestEncoded"}}}},"401":{"description":"environment.unauthorized: no bearer, or not a valid cmux access token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnvironmentUnauthorizedEncoded"}}}},"403":{"description":"environment.forbidden: the bearer is a Cloud VM's own token, which cannot act for the team.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnvironmentForbiddenEncoded"}}}},"404":{"description":"environment.not_found: no such environment for the caller's team, or the surface is off on this deployment (staging and production answer this on every path, before any auth).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnvironmentNotFoundEncoded"}}}},"503":{"description":"environment.unavailable: the environment's store could not be reached; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnvironmentUnavailableEncoded"}}}}},"description":"Answers the caller's team's environment for `repo` and `ref`, creating it and starting its setup in the background on first use. Idempotent: a derive while a setup runs joins it, and a ready environment is answered as is. A failed one starts a new setup only after `retry_at`. Poll GET /v1/environments/{environmentId} until `status` is ready or failed.","summary":"Derive the environment for a repository and ref","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeriveEnvironment"}}},"required":true}}},"/v1/environments/{environmentId}":{"get":{"tags":["Environments"],"operationId":"environments.get","parameters":[{"name":"environmentId","in":"path","schema":{"type":"string","description":"An environment's id: `denv_` and 24 hex digits, the same for every derive of one team, repo and ref.","examples":["denv_0123456789abcdef01234567"]},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"A derived environment. `status` is building while a setup runs (read it again with GET until it ends), ready once new chats can boot from `snapshot`, or failed with `error` set; a derive after `retry_at` starts a new setup. Times are Unix milliseconds.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DerivedEnvironment"}}}},"400":{"description":"environment.invalid: the request matched the schema but a value in it is not valid, for example a derive's repo that is not `owner/name`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnvironmentBadRequestEncoded"}}}},"401":{"description":"environment.unauthorized: no bearer, or not a valid cmux access token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnvironmentUnauthorizedEncoded"}}}},"403":{"description":"environment.forbidden: the bearer is a Cloud VM's own token, which cannot act for the team.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnvironmentForbiddenEncoded"}}}},"404":{"description":"environment.not_found: no such environment for the caller's team, or the surface is off on this deployment (staging and production answer this on every path, before any auth).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnvironmentNotFoundEncoded"}}}},"503":{"description":"environment.unavailable: the environment's store could not be reached; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnvironmentUnavailableEncoded"}}}}},"description":"Reads one environment of the caller's team. Another team's id answers 404 environment.not_found. Poll it every few seconds while `status` is building; a setup that passes `deadline_at` fails with environment.setup_timeout.","summary":"Read an environment's status and setup progress"}},"/v1/cloud-environments":{"get":{"tags":["Cloud environments"],"operationId":"cloudEnvironments.list","parameters":[],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/CloudEnvironment"}}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}},"description":"The caller's personal environments, then their team's. Each scope's Default comes first and is made on first read, so the list is never empty.","summary":"List the caller's cloud environments"},"post":{"tags":["Cloud environments"],"operationId":"cloudEnvironments.create","parameters":[],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"What a Cloud chat's machine is set up with. Times are Unix milliseconds.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CloudEnvironment"}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}},"description":"A new personal environment, or with `scope: team` one shared with the token's team. Names are unique per scope, case-insensitively (cloud_environment.name_taken); Default is the Default's.","summary":"Create a cloud environment","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateCloudEnvironment"}}},"required":true}}},"/v1/cloud-environments/{environmentId}":{"get":{"tags":["Cloud environments"],"operationId":"cloudEnvironments.get","parameters":[{"name":"environmentId","in":"path","schema":{"type":"string","description":"A cloud environment's id: `env_` and 24 hex digits.","examples":["env_0123456789abcdef01234567"]},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"What a Cloud chat's machine is set up with. Times are Unix milliseconds.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CloudEnvironment"}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}},"description":"One of the caller's environments; another person's or team's answers 404 cloud_environment.not_found.","summary":"Read a cloud environment"},"patch":{"tags":["Cloud environments"],"operationId":"cloudEnvironments.update","parameters":[{"name":"environmentId","in":"path","schema":{"type":"string","description":"A cloud environment's id: `env_` and 24 hex digits.","examples":["env_0123456789abcdef01234567"]},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"What a Cloud chat's machine is set up with. Times are Unix milliseconds.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CloudEnvironment"}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}},"description":"The sheet's Save changes. A Default can't be renamed (cloud_environment.default_locked). A secret's value is write-only; with no secret key on this deployment, setting one answers 503 cloud_environment.secrets_unavailable.","summary":"Change a cloud environment","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateCloudEnvironment"}}},"required":true}},"delete":{"tags":["Cloud environments"],"operationId":"cloudEnvironments.remove","parameters":[{"name":"environmentId","in":"path","schema":{"type":"string","description":"A cloud environment's id: `env_` and 24 hex digits.","examples":["env_0123456789abcdef01234567"]},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"deleted":{"type":"boolean","enum":[true]}},"required":["deleted"],"additionalProperties":false}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}},"description":"A Default can't be deleted (cloud_environment.default_locked).","summary":"Delete a cloud environment"}},"/v1/execution-receipts":{"post":{"tags":["Execution receipts"],"operationId":"executionReceipts.link","parameters":[],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"ExecutionReceipt","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExecutionReceipt"}}}},"400":{"description":"execution.invalid: a reference is malformed, or a cmux_artifacts output lacks its path and revision; fix the request. | execution.turn_attestation_invalid: the turn attestation's signature or fields do not verify; fetch a fresh one from the daemon.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExecutionBadRequestEncoded"}}}},"401":{"description":"execution.unauthorized: no bearer, or a token without a team install; send a team-install cmux access token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExecutionUnauthorizedEncoded"}}}},"403":{"description":"execution.forbidden: a machine's token cannot manage receipts; use a person's team-install token. | execution.turn_attestation_mismatch: the attestation names another session, turn, team, user or install than this request. | execution.grant_required: the source authority holds no grant for this caller; grant access first. | execution.grant_revoked: the grant that allowed this work was revoked. | execution.account_mismatch: the work belongs to another connected account than the caller's. | execution.scope_denied: the caller's grant does not cover this work's scope.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExecutionForbiddenEncoded"}}}},"404":{"description":"execution.not_found: no receipt with this id for this caller, or the surface is off on this deployment (answered before auth).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExecutionNotFoundEncoded"}}}},"409":{"description":"execution.idempotency_conflict: the idempotencyKey or executionId is already linked differently, or this artifact is already attached with another path or revision; use a new key or the original values. | execution.output_unavailable: outputs attach only to a succeeded or failed execution; wait for it to finish. | execution.turn_attestation_replay: this attestation's nonce was already spent; fetch a fresh attestation. | execution.stale_target: the target changed generation since the work ran; refetch it. | execution.target_gone: the target machine no longer exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExecutionConflictEncoded"}}}},"410":{"description":"execution.expired: the receipt passed its expiry and is no longer readable. | execution.turn_attestation_expired: the turn attestation expired; fetch a fresh one from the daemon.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExecutionGoneEncoded"}}}},"503":{"description":"execution.unavailable: the source authority could not verify the reference, or the store failed; retry with backoff. | execution.provider_unavailable: the work's provider is disabled or unreachable on this deployment; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExecutionUnavailableEncoded"}}}}},"description":"Records a redacted receipt of work that already ran, after its owning authority (acpmux, a cmux run, a machine lease or the connector gateway) verifies `authorityRef`. It never dispatches work or mints a credential. Repeating the same `idempotencyKey` with the same body returns the stored receipt. Read it back with GET /v1/execution-receipts/{executionId}.","summary":"Link an execution to a chat turn","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExecutionLink"}}},"required":true}}},"/v1/execution-receipts/{executionId}":{"get":{"tags":["Execution receipts"],"operationId":"executionReceipts.get","parameters":[{"name":"executionId","in":"path","schema":{"type":"string"},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"ExecutionReceipt","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExecutionReceipt"}}}},"400":{"description":"execution.invalid: a reference is malformed, or a cmux_artifacts output lacks its path and revision; fix the request. | execution.turn_attestation_invalid: the turn attestation's signature or fields do not verify; fetch a fresh one from the daemon.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExecutionBadRequestEncoded"}}}},"401":{"description":"execution.unauthorized: no bearer, or a token without a team install; send a team-install cmux access token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExecutionUnauthorizedEncoded"}}}},"403":{"description":"execution.forbidden: a machine's token cannot manage receipts; use a person's team-install token. | execution.turn_attestation_mismatch: the attestation names another session, turn, team, user or install than this request. | execution.grant_required: the source authority holds no grant for this caller; grant access first. | execution.grant_revoked: the grant that allowed this work was revoked. | execution.account_mismatch: the work belongs to another connected account than the caller's. | execution.scope_denied: the caller's grant does not cover this work's scope.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExecutionForbiddenEncoded"}}}},"404":{"description":"execution.not_found: no receipt with this id for this caller, or the surface is off on this deployment (answered before auth).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExecutionNotFoundEncoded"}}}},"409":{"description":"execution.idempotency_conflict: the idempotencyKey or executionId is already linked differently, or this artifact is already attached with another path or revision; use a new key or the original values. | execution.output_unavailable: outputs attach only to a succeeded or failed execution; wait for it to finish. | execution.turn_attestation_replay: this attestation's nonce was already spent; fetch a fresh attestation. | execution.stale_target: the target changed generation since the work ran; refetch it. | execution.target_gone: the target machine no longer exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExecutionConflictEncoded"}}}},"410":{"description":"execution.expired: the receipt passed its expiry and is no longer readable. | execution.turn_attestation_expired: the turn attestation expired; fetch a fresh one from the daemon.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExecutionGoneEncoded"}}}},"503":{"description":"execution.unavailable: the source authority could not verify the reference, or the store failed; retry with backoff. | execution.provider_unavailable: the work's provider is disabled or unreachable on this deployment; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExecutionUnavailableEncoded"}}}}},"description":"Returns the caller's receipt for one execution, with its state and attached outputs. Read-only; an expired receipt answers 410. Attach outputs with POST /v1/execution-receipts/{executionId}/outputs.","summary":"Read an execution receipt"}},"/v1/execution-receipts/{executionId}/outputs":{"post":{"tags":["Execution receipts"],"operationId":"executionReceipts.output","parameters":[{"name":"executionId","in":"path","schema":{"type":"string"},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"ExecutionReceipt","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExecutionReceipt"}}}},"400":{"description":"execution.invalid: a reference is malformed, or a cmux_artifacts output lacks its path and revision; fix the request. | execution.turn_attestation_invalid: the turn attestation's signature or fields do not verify; fetch a fresh one from the daemon.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExecutionBadRequestEncoded"}}}},"401":{"description":"execution.unauthorized: no bearer, or a token without a team install; send a team-install cmux access token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExecutionUnauthorizedEncoded"}}}},"403":{"description":"execution.forbidden: a machine's token cannot manage receipts; use a person's team-install token. | execution.turn_attestation_mismatch: the attestation names another session, turn, team, user or install than this request. | execution.grant_required: the source authority holds no grant for this caller; grant access first. | execution.grant_revoked: the grant that allowed this work was revoked. | execution.account_mismatch: the work belongs to another connected account than the caller's. | execution.scope_denied: the caller's grant does not cover this work's scope.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExecutionForbiddenEncoded"}}}},"404":{"description":"execution.not_found: no receipt with this id for this caller, or the surface is off on this deployment (answered before auth).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExecutionNotFoundEncoded"}}}},"409":{"description":"execution.idempotency_conflict: the idempotencyKey or executionId is already linked differently, or this artifact is already attached with another path or revision; use a new key or the original values. | execution.output_unavailable: outputs attach only to a succeeded or failed execution; wait for it to finish. | execution.turn_attestation_replay: this attestation's nonce was already spent; fetch a fresh attestation. | execution.stale_target: the target changed generation since the work ran; refetch it. | execution.target_gone: the target machine no longer exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExecutionConflictEncoded"}}}},"410":{"description":"execution.expired: the receipt passed its expiry and is no longer readable. | execution.turn_attestation_expired: the turn attestation expired; fetch a fresh one from the daemon.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExecutionGoneEncoded"}}}},"503":{"description":"execution.unavailable: the source authority could not verify the reference, or the store failed; retry with backoff. | execution.provider_unavailable: the work's provider is disabled or unreachable on this deployment; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExecutionUnavailableEncoded"}}}}},"description":"Attaches an existing immutable artifact to a finished (succeeded or failed) execution; the source store supplies its digest and owner. A cmux_artifacts output needs `path` and `revision`. Attaching the same artifact with the same path and revision again returns the receipt unchanged.","summary":"Attach an output to an execution receipt","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExecutionOutputLink"}}},"required":true}}},"/v1/inference/models":{"get":{"tags":["Inference"],"operationId":"inference.models","parameters":[],"security":[],"responses":{"200":{"description":"The models that this deployment can serve now.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InferenceModelList"}}}},"404":{"description":"inference.not_found: the inference surface is off on this deployment. | model.not_found: POST received an unknown catalog id; choose an id from GET /v1/inference/models.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InferenceNotFoundEncoded"}}}}},"description":"Lists models with at least one configured provider route. The result reflects this deployment's current provider keys and is read-only; when the surface is enabled, call POST /v1/inference/chat/completions with one of the returned ids.","summary":"List available inference models"}},"/v1/inference/v1/messages":{"post":{"tags":["Inference"],"operationId":"inference.messages","parameters":[],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/MessagesResponse"},{"$ref":"#/components/schemas/MessagesStreamEvent"}]}}}},"400":{"description":"validation.invalid: the body could not be read, was not a JSON object, or failed message, tool, n or output-budget validation; fix the request and retry. | upstream.rejected: the model provider rejected the request; check messages, tools, max_tokens and the context length. | invalid_request_error: the model provider rejected the request; check messages, tools, max_tokens and the context length.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/InferenceBadRequestEncoded"},{"$ref":"#/components/schemas/MessagesUpstreamError"}]}}}},"401":{"description":"auth.required: send a valid cmux access token and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InferenceUnauthorizedEncoded"}}}},"403":{"description":"auth.forbidden: this token or team cannot use the model router; use an allowed user token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InferenceForbiddenEncoded"}}}},"404":{"description":"inference.not_found: the inference surface is off on this deployment. | model.not_found: POST received an unknown catalog id; choose an id from GET /v1/inference/models.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InferenceNotFoundEncoded"}}}},"413":{"description":"validation.too_large: the request body exceeds the 1 MiB limit; reduce the messages or tools and retry. | upstream.rejected: the model provider found the request too large for this model, even under 1 MiB; shorten the context. | request_too_large: the model provider found the request too large for this model; shorten the context.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/InferenceTooLargeEncoded"},{"$ref":"#/components/schemas/MessagesUpstreamError_1"}]}}}},"429":{"description":"inference.daily_limit: the team's daily request limit was reached; retry after the limit resets.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InferenceRateLimitedEncoded"}}}},"502":{"description":"upstream.failed: a provider failed after possible work, or all fallback routes failed; retrying creates another request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InferenceUpstreamFailedEncoded"}}}},"503":{"description":"provider.unavailable: no route is configured, or ledger admission failed; retry with backoff. | inference.unavailable: the usage ledger could not be read; retry with backoff.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InferenceUnavailableEncoded"}}}}},"description":"Translates an Anthropic Messages request to the configured OpenAI-compatible provider. A non-stream request returns a message JSON object; stream=true returns the Anthropic server-sent event sequence. This compatibility route is available only on the development deployment.","summary":"Create an Anthropic Messages response","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MessagesRequest"}}},"required":true}}},"/v1/inference/v1/messages/count_tokens":{"post":{"tags":["Inference"],"operationId":"inference.messagesCountTokens","parameters":[],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"MessagesCountTokensResponse","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MessagesCountTokensResponse"}}}},"400":{"description":"validation.invalid: the body could not be read, was not a JSON object, or failed message, tool, n or output-budget validation; fix the request and retry. | upstream.rejected: the model provider rejected the request; check messages, tools, max_tokens and the context length.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InferenceBadRequestEncoded"}}}},"401":{"description":"auth.required: send a valid cmux access token and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InferenceUnauthorizedEncoded"}}}},"403":{"description":"auth.forbidden: this token or team cannot use the model router; use an allowed user token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InferenceForbiddenEncoded"}}}},"404":{"description":"inference.not_found: the inference surface is off on this deployment. | model.not_found: POST received an unknown catalog id; choose an id from GET /v1/inference/models.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InferenceNotFoundEncoded"}}}},"413":{"description":"validation.too_large: the request body exceeds the 1 MiB limit; reduce the messages or tools and retry. | upstream.rejected: the model provider found the request too large for this model, even under 1 MiB; shorten the context.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InferenceTooLargeEncoded"}}}},"429":{"description":"inference.daily_limit: the team's daily request limit was reached; retry after the limit resets.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InferenceRateLimitedEncoded"}}}},"502":{"description":"upstream.failed: a provider failed after possible work, or all fallback routes failed; retrying creates another request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InferenceUpstreamFailedEncoded"}}}},"503":{"description":"provider.unavailable: no route is configured, or ledger admission failed; retry with backoff. | inference.unavailable: the usage ledger could not be read; retry with backoff.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InferenceUnavailableEncoded"}}}}},"description":"Estimates tokens for the normalized Messages input that the router sends to the OpenAI-compatible provider. This compatibility route is available only on the development deployment.","summary":"Count tokens for an Anthropic Messages request","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MessagesCountTokensRequest"}}},"required":true}}},"/v1/inference/chat/completions":{"post":{"tags":["Inference"],"operationId":"inference.chatCompletions","parameters":[],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"The provider's OpenAI-compatible answer, passed through unchanged for non-streaming calls.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ChatCompletion"}}}},"400":{"description":"validation.invalid: the body could not be read, was not a JSON object, or failed message, tool, n or output-budget validation; fix the request and retry. | upstream.rejected: the model provider rejected the request; check messages, tools, max_tokens and the context length.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InferenceBadRequestEncoded"}}}},"401":{"description":"auth.required: send a valid cmux access token and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InferenceUnauthorizedEncoded"}}}},"403":{"description":"auth.forbidden: this token or team cannot use the model router; use an allowed user token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InferenceForbiddenEncoded"}}}},"404":{"description":"inference.not_found: the inference surface is off on this deployment. | model.not_found: POST received an unknown catalog id; choose an id from GET /v1/inference/models.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InferenceNotFoundEncoded"}}}},"413":{"description":"validation.too_large: the request body exceeds the 1 MiB limit; reduce the messages or tools and retry. | upstream.rejected: the model provider found the request too large for this model, even under 1 MiB; shorten the context.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InferenceTooLargeEncoded"}}}},"429":{"description":"inference.daily_limit: the team's daily request limit was reached; retry after the limit resets.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InferenceRateLimitedEncoded"}}}},"502":{"description":"upstream.failed: a provider failed after possible work, or all fallback routes failed; retrying creates another request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InferenceUpstreamFailedEncoded"}}}},"503":{"description":"provider.unavailable: no route is configured, or ledger admission failed; retry with backoff. | inference.unavailable: the usage ledger could not be read; retry with backoff.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InferenceUnavailableEncoded"}}}}},"description":"Routes an OpenAI-compatible chat request to a configured provider. The request is admitted against the team's development daily limit, and prompts and outputs are not stored; usage metadata is recorded. With `stream: true`, read the server-sent event stream. On a retryable provider failure before the first byte, the router may try the next provider. This POST is not idempotent: retries create a new usage record and count against the daily limit. This development slice bills nothing. Call GET /v1/inference/models first to choose a model.","summary":"Create a chat completion","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ChatCompletionRequest"}}},"required":true}}},"/v1/mesh/heartbeat":{"post":{"tags":["Mesh"],"operationId":"mesh.heartbeat","parameters":[],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"MeshHeartbeatAccepted","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshHeartbeatAccepted"}}}},"400":{"description":"mesh.invalid: the request fields or combination are invalid; correct them and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshBadRequestEncoded"}}}},"401":{"description":"mesh.unauthorized: the bearer is missing or is not a team install credential. machine.revoked: the machine credential is revoked or expired. mesh.person_required: a signed-in person session is required; use the person bearer contract.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshUnauthorizedEncoded"}}}},"403":{"description":"mesh.forbidden: the credential is not allowed to act for this team, or the recipient's sender policy refuses the member; use an allowed team credential or sender.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshForbiddenEncoded"}}}},"404":{"description":"mesh.team_disabled: team addresses are disabled in this deployment; use ordinary daemon routes. | mesh.not_found: the mesh surface or message is not available to this caller; check the id and deployment. mesh.unknown_recipient: no live session, daemon, role, handle or team address matches; list sessions or team addresses first.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/MeshTeamDisabledEncoded"},{"$ref":"#/components/schemas/MeshNotFoundEncoded"}]}}}},"429":{"description":"mesh.rate_limited: this daemon has exceeded its call limit; retry after retryAfterSeconds. mesh.queue_full: the receiving daemon or team has too many unacknowledged messages; retry after retryAfterSeconds. mesh.team_full: the team has reached its live daemon or session limit; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshRateLimitedEncoded"}}}},"503":{"description":"mesh.unavailable: the team's mesh store could not be reached; retry. mesh.authority_unavailable: team membership authority could not be reached; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshUnavailableEncoded"}}}}},"description":"Replaces the authenticated daemon's session rows and refreshes their 90-second lease. Repeat it before expiry, then call GET /v1/mesh/sessions to discover recipients.","summary":"Record daemon sessions","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshHeartbeat"}}},"required":true}}},"/v1/mesh/sessions":{"get":{"tags":["Mesh"],"operationId":"mesh.sessions","parameters":[{"name":"name","in":"query","schema":{"type":"string","minLength":1,"maxLength":128,"description":"A non-empty mesh label.","examples":["agent-a"]},"required":false},{"name":"host","in":"query","schema":{"type":"string","minLength":1,"maxLength":128,"description":"A non-empty mesh label.","examples":["agent-a"]},"required":false},{"name":"sessionId","in":"query","schema":{"type":"string","minLength":1,"maxLength":128,"description":"A non-empty mesh label.","examples":["agent-a"]},"required":false},{"name":"daemonId","in":"query","schema":{"type":"string","minLength":1,"maxLength":128,"description":"A non-empty mesh label.","examples":["agent-a"]},"required":false}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"MeshAddressBook","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshAddressBook"}}}},"401":{"description":"mesh.unauthorized: the bearer is missing or is not a team install credential. machine.revoked: the machine credential is revoked or expired. mesh.person_required: a signed-in person session is required; use the person bearer contract.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshUnauthorizedEncoded"}}}},"403":{"description":"mesh.forbidden: the credential is not allowed to act for this team, or the recipient's sender policy refuses the member; use an allowed team credential or sender.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshForbiddenEncoded"}}}},"404":{"description":"mesh.not_found: the mesh surface or message is not available to this caller; check the id and deployment. mesh.unknown_recipient: no live session, daemon, role, handle or team address matches; list sessions or team addresses first.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshNotFoundEncoded"}}}},"429":{"description":"mesh.rate_limited: this daemon has exceeded its call limit; retry after retryAfterSeconds. mesh.queue_full: the receiving daemon or team has too many unacknowledged messages; retry after retryAfterSeconds. mesh.team_full: the team has reached its live daemon or session limit; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshRateLimitedEncoded"}}}},"503":{"description":"mesh.unavailable: the team's mesh store could not be reached; retry. mesh.authority_unavailable: team membership authority could not be reached; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshUnavailableEncoded"}}}}},"description":"Lists live daemons and sessions matching the optional filters. Call POST /v1/mesh/heartbeat first for a daemon to appear, then use a returned sessionId or name as a message target.","summary":"List live mesh sessions"}},"/v1/mesh/messages":{"post":{"tags":["Mesh"],"operationId":"mesh.send","parameters":[],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"MeshReceipt","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshReceipt"}}}},"400":{"description":"mesh.invalid: the request fields or combination are invalid; correct them and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshBadRequestEncoded"}}}},"401":{"description":"mesh.unauthorized: the bearer is missing or is not a team install credential. machine.revoked: the machine credential is revoked or expired. mesh.person_required: a signed-in person session is required; use the person bearer contract.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshUnauthorizedEncoded"}}}},"403":{"description":"mesh.forbidden: the credential is not allowed to act for this team, or the recipient's sender policy refuses the member; use an allowed team credential or sender.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshForbiddenEncoded"}}}},"404":{"description":"mesh.team_disabled: team addresses are disabled in this deployment; use ordinary daemon routes. | mesh.not_found: the mesh surface or message is not available to this caller; check the id and deployment. mesh.unknown_recipient: no live session, daemon, role, handle or team address matches; list sessions or team addresses first.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/MeshTeamDisabledEncoded"},{"$ref":"#/components/schemas/MeshNotFoundEncoded"}]}}}},"409":{"description":"mesh.ambiguous: several recipients or address claims match; use a sessionId, host or one unclaimed handle. mesh.idempotency_conflict: the idempotencyKey was already used with a different payload; choose a new key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshConflictEncoded"}}}},"413":{"description":"mesh.too_large: the UTF-8 body exceeds 64 KiB; send large attachments by reference.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshTooLargeEncoded"}}}},"429":{"description":"mesh.rate_limited: this daemon has exceeded its call limit; retry after retryAfterSeconds. mesh.queue_full: the receiving daemon or team has too many unacknowledged messages; retry after retryAfterSeconds. mesh.team_full: the team has reached its live daemon or session limit; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshRateLimitedEncoded"}}}},"503":{"description":"mesh.unavailable: the team's mesh store could not be reached; retry. mesh.authority_unavailable: team membership authority could not be reached; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshUnavailableEncoded"}}}}},"description":"Queues a prompt or control message for a registered session, daemon, or durable team address and returns its durable receipt. Retrying the same idempotencyKey and payload returns the original receipt; after sending, the recipient polls GET /v1/mesh/inbox and acknowledges delivery with POST /v1/mesh/messages/{messageId}/ack.","summary":"Send a mesh message","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshSend"}}},"required":true}},"get":{"tags":["Mesh"],"operationId":"mesh.messages","parameters":[{"name":"x-cmux-team","in":"header","schema":{"type":"string","description":"Team ID to act in; omitted or empty selects the authenticated person's personal team. Current membership and SSO policy are checked."},"required":false},{"name":"teamAddress","in":"query","schema":{"type":"string"},"required":false},{"name":"unreadOnly","in":"query","schema":{"type":"string","enum":["true","false"]},"required":false},{"name":"max","in":"query","schema":{"type":"string","description":"The most messages to return; defaults to 20. An integer from 1 through 50.","examples":["50"]},"required":false},{"name":"before","in":"query","schema":{"type":"string","description":"The `next` cursor of the previous page, to read older messages. A non-negative integer.","examples":["1761800000000"]},"required":false}],"security":[{"meshRecipientBearer":[]}],"responses":{"200":{"description":"MeshMessages","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshMessages"}}}},"400":{"description":"mesh.invalid: the request fields or combination are invalid; correct them and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshBadRequestEncoded"}}}},"401":{"description":"mesh.unauthorized: the bearer is missing or is not a team install credential. machine.revoked: the machine credential is revoked or expired. mesh.person_required: a signed-in person session is required; use the person bearer contract.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshUnauthorizedEncoded"}}}},"403":{"description":"mesh.forbidden: the credential is not allowed to act for this team, or the recipient's sender policy refuses the member; use an allowed team credential or sender.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshForbiddenEncoded"}}}},"404":{"description":"mesh.not_found: the mesh surface or message is not available to this caller; check the id and deployment. mesh.unknown_recipient: no live session, daemon, role, handle or team address matches; list sessions or team addresses first. | mesh.team_disabled: team addresses are disabled in this deployment; use ordinary daemon routes.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/MeshNotFoundEncoded"},{"$ref":"#/components/schemas/MeshTeamDisabledEncoded"}]}}}},"409":{"description":"mesh.ambiguous: several recipients or address claims match; use a sessionId, host or one unclaimed handle. mesh.idempotency_conflict: the idempotencyKey was already used with a different payload; choose a new key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshConflictEncoded"}}}},"429":{"description":"mesh.rate_limited: this daemon has exceeded its call limit; retry after retryAfterSeconds. mesh.queue_full: the receiving daemon or team has too many unacknowledged messages; retry after retryAfterSeconds. mesh.team_full: the team has reached its live daemon or session limit; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshRateLimitedEncoded"}}}},"503":{"description":"mesh.unavailable: the team's mesh store could not be reached; retry. mesh.authority_unavailable: team membership authority could not be reached; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshUnavailableEncoded"}}}}},"description":"Reads up to max team-address messages without creating leases or changing storage, with optional unread and before-cursor filters. Follow the returned next cursor as before to fetch older messages.","summary":"Browse team message history"}},"/v1/mesh/messages/{messageId}":{"get":{"tags":["Mesh"],"operationId":"mesh.receipt","parameters":[{"name":"messageId","in":"path","schema":{"type":"string","description":"Hub-assigned message id: `msg_` followed by 32 lowercase hex digits.","examples":["msg_0123456789abcdef0123456789abcdef"]},"required":true},{"name":"waitSeconds","in":"query","schema":{"type":"string","description":"Seconds to hold the request open while the sender's own message is not answered yet; 0 (the default) answers at once. An integer from 0 through 25.","examples":["25"]},"required":false}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"MeshReceipt","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshReceipt"}}}},"401":{"description":"mesh.unauthorized: the bearer is missing or is not a team install credential. machine.revoked: the machine credential is revoked or expired. mesh.person_required: a signed-in person session is required; use the person bearer contract.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshUnauthorizedEncoded"}}}},"403":{"description":"mesh.forbidden: the credential is not allowed to act for this team, or the recipient's sender policy refuses the member; use an allowed team credential or sender.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshForbiddenEncoded"}}}},"404":{"description":"mesh.not_found: the mesh surface or message is not available to this caller; check the id and deployment. mesh.unknown_recipient: no live session, daemon, role, handle or team address matches; list sessions or team addresses first.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshNotFoundEncoded"}}}},"503":{"description":"mesh.unavailable: the team's mesh store could not be reached; retry. mesh.authority_unavailable: team membership authority could not be reached; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshUnavailableEncoded"}}}}},"description":"Reads the durable receipt for a message without changing it. Poll this endpoint after POST /v1/mesh/messages when you need the delivery state; daemon message bodies are delivered through the recipient inbox, and team-address messages are also available in team history until acknowledged. The sender may pass waitSeconds to wait for the answer; a read control message's answer comes back to its sender in result.","summary":"Get a message receipt"}},"/v1/mesh/messages/{messageId}/ack":{"post":{"tags":["Mesh"],"operationId":"mesh.ack","parameters":[{"name":"messageId","in":"path","schema":{"type":"string","description":"Hub-assigned message id: `msg_` followed by 32 lowercase hex digits.","examples":["msg_0123456789abcdef0123456789abcdef"]},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"MeshReceipt","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshReceipt"}}}},"401":{"description":"mesh.unauthorized: the bearer is missing or is not a team install credential. machine.revoked: the machine credential is revoked or expired. mesh.person_required: a signed-in person session is required; use the person bearer contract.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshUnauthorizedEncoded"}}}},"403":{"description":"mesh.forbidden: the credential is not allowed to act for this team, or the recipient's sender policy refuses the member; use an allowed team credential or sender.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshForbiddenEncoded"}}}},"404":{"description":"mesh.not_found: the mesh surface or message is not available to this caller; check the id and deployment. mesh.unknown_recipient: no live session, daemon, role, handle or team address matches; list sessions or team addresses first.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshNotFoundEncoded"}}}},"503":{"description":"mesh.unavailable: the team's mesh store could not be reached; retry. mesh.authority_unavailable: team membership authority could not be reached; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshUnavailableEncoded"}}}}},"description":"Records the receiving daemon's delivered or refused answer for a leased message. The first answer wins and repeats are idempotent; for team-address messages, the recipient may then call POST /v1/mesh/messages/{messageId}/acknowledge.","summary":"Acknowledge message delivery","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshAck"}}},"required":true}}},"/v1/mesh/inbox":{"get":{"tags":["Mesh"],"operationId":"mesh.inbox","parameters":[{"name":"waitSeconds","in":"query","schema":{"type":"string","description":"Seconds to hold the request open while the inbox is empty; 0 (the default) answers at once. An integer from 0 through 25.","examples":["25"]},"required":false},{"name":"max","in":"query","schema":{"type":"string","description":"The most messages to lease in this call; defaults to 20. An integer from 1 through 50.","examples":["50"]},"required":false},{"name":"teamAddress","in":"query","schema":{"type":"string"},"required":false},{"name":"unreadOnly","in":"query","schema":{"type":"string","enum":["true","false"]},"required":false}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"MeshInbox","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshInbox"}}}},"400":{"description":"mesh.invalid: the request fields or combination are invalid; correct them and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshBadRequestEncoded"}}}},"401":{"description":"mesh.unauthorized: the bearer is missing or is not a team install credential. machine.revoked: the machine credential is revoked or expired. mesh.person_required: a signed-in person session is required; use the person bearer contract.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshUnauthorizedEncoded"}}}},"403":{"description":"mesh.forbidden: the credential is not allowed to act for this team, or the recipient's sender policy refuses the member; use an allowed team credential or sender.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshForbiddenEncoded"}}}},"404":{"description":"mesh.not_found: the mesh surface or message is not available to this caller; check the id and deployment. mesh.unknown_recipient: no live session, daemon, role, handle or team address matches; list sessions or team addresses first. | mesh.team_disabled: team addresses are disabled in this deployment; use ordinary daemon routes.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/MeshNotFoundEncoded"},{"$ref":"#/components/schemas/MeshTeamDisabledEncoded"}]}}}},"409":{"description":"mesh.ambiguous: several recipients or address claims match; use a sessionId, host or one unclaimed handle. mesh.idempotency_conflict: the idempotencyKey was already used with a different payload; choose a new key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshConflictEncoded"}}}},"429":{"description":"mesh.rate_limited: this daemon has exceeded its call limit; retry after retryAfterSeconds. mesh.queue_full: the receiving daemon or team has too many unacknowledged messages; retry after retryAfterSeconds. mesh.team_full: the team has reached its live daemon or session limit; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshRateLimitedEncoded"}}}},"503":{"description":"mesh.unavailable: the team's mesh store could not be reached; retry. mesh.authority_unavailable: team membership authority could not be reached; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshUnavailableEncoded"}}}}},"description":"Returns up to max due messages and leases them for leaseSeconds, optionally waiting up to 25 seconds. Poll again when empty and acknowledge each leased message with POST /v1/mesh/messages/{messageId}/ack before the lease expires.","summary":"Lease messages from the inbox"}},"/v1/mesh/messages/{messageId}/read":{"post":{"tags":["Mesh"],"operationId":"mesh.read","parameters":[{"name":"messageId","in":"path","schema":{"type":"string","description":"Hub-assigned message id: `msg_` followed by 32 lowercase hex digits.","examples":["msg_0123456789abcdef0123456789abcdef"]},"required":true},{"name":"x-cmux-team","in":"header","schema":{"type":"string","description":"Team ID to act in; omitted or empty selects the authenticated person's personal team. Current membership and SSO policy are checked."},"required":false}],"security":[{"meshRecipientBearer":[]}],"responses":{"200":{"description":"MeshReceipt","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshReceipt"}}}},"401":{"description":"mesh.unauthorized: the bearer is missing or is not a team install credential. machine.revoked: the machine credential is revoked or expired. mesh.person_required: a signed-in person session is required; use the person bearer contract.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshUnauthorizedEncoded"}}}},"403":{"description":"mesh.forbidden: the credential is not allowed to act for this team, or the recipient's sender policy refuses the member; use an allowed team credential or sender.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshForbiddenEncoded"}}}},"404":{"description":"mesh.not_found: the mesh surface or message is not available to this caller; check the id and deployment. mesh.unknown_recipient: no live session, daemon, role, handle or team address matches; list sessions or team addresses first.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshNotFoundEncoded"}}}},"503":{"description":"mesh.unavailable: the team's mesh store could not be reached; retry. mesh.authority_unavailable: team membership authority could not be reached; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshUnavailableEncoded"}}}}},"description":"Marks a team-address message read for the authenticated person or registered recipient and returns its receipt. It is idempotent; call POST /v1/mesh/messages/{messageId}/acknowledge when the recipient has fully handled it.","summary":"Mark a team message read","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshRead"}}},"required":true}}},"/v1/mesh/messages/{messageId}/acknowledge":{"post":{"tags":["Mesh"],"operationId":"mesh.acknowledge","parameters":[{"name":"messageId","in":"path","schema":{"type":"string","description":"Hub-assigned message id: `msg_` followed by 32 lowercase hex digits.","examples":["msg_0123456789abcdef0123456789abcdef"]},"required":true},{"name":"x-cmux-team","in":"header","schema":{"type":"string","description":"Team ID to act in; omitted or empty selects the authenticated person's personal team. Current membership and SSO policy are checked."},"required":false}],"security":[{"meshRecipientBearer":[]}],"responses":{"200":{"description":"MeshReceipt","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshReceipt"}}}},"401":{"description":"mesh.unauthorized: the bearer is missing or is not a team install credential. machine.revoked: the machine credential is revoked or expired. mesh.person_required: a signed-in person session is required; use the person bearer contract.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshUnauthorizedEncoded"}}}},"403":{"description":"mesh.forbidden: the credential is not allowed to act for this team, or the recipient's sender policy refuses the member; use an allowed team credential or sender.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshForbiddenEncoded"}}}},"404":{"description":"mesh.not_found: the mesh surface or message is not available to this caller; check the id and deployment. mesh.unknown_recipient: no live session, daemon, role, handle or team address matches; list sessions or team addresses first.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshNotFoundEncoded"}}}},"503":{"description":"mesh.unavailable: the team's mesh store could not be reached; retry. mesh.authority_unavailable: team membership authority could not be reached; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshUnavailableEncoded"}}}}},"description":"Explicitly acknowledges a team-address message, clears its body and ends its lease. Repeating the call returns the current receipt; use GET /v1/mesh/messages to browse history without leasing.","summary":"Acknowledge a team message","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshAcknowledge"}}},"required":true}}},"/v1/mesh/team-addresses":{"get":{"tags":["Mesh"],"operationId":"mesh.teamAddresses","parameters":[{"name":"teamAddress","in":"query","schema":{"type":"string","description":"Filter one Labs address in `@member/agent` or `@team/role` form.","examples":["@user_abc/reviewer"]},"required":false}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"MeshTeamAddresses","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshTeamAddresses"}}}},"400":{"description":"mesh.invalid: the request fields or combination are invalid; correct them and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshBadRequestEncoded"}}}},"401":{"description":"mesh.unauthorized: the bearer is missing or is not a team install credential. machine.revoked: the machine credential is revoked or expired. mesh.person_required: a signed-in person session is required; use the person bearer contract.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshUnauthorizedEncoded"}}}},"403":{"description":"mesh.forbidden: the credential is not allowed to act for this team, or the recipient's sender policy refuses the member; use an allowed team credential or sender.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshForbiddenEncoded"}}}},"404":{"description":"mesh.team_disabled: team addresses are disabled in this deployment; use ordinary daemon routes. | mesh.not_found: the mesh surface or message is not available to this caller; check the id and deployment. mesh.unknown_recipient: no live session, daemon, role, handle or team address matches; list sessions or team addresses first.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/MeshTeamDisabledEncoded"},{"$ref":"#/components/schemas/MeshNotFoundEncoded"}]}}}},"409":{"description":"mesh.ambiguous: several recipients or address claims match; use a sessionId, host or one unclaimed handle. mesh.idempotency_conflict: the idempotencyKey was already used with a different payload; choose a new key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshConflictEncoded"}}}},"429":{"description":"mesh.rate_limited: this daemon has exceeded its call limit; retry after retryAfterSeconds. mesh.queue_full: the receiving daemon or team has too many unacknowledged messages; retry after retryAfterSeconds. mesh.team_full: the team has reached its live daemon or session limit; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshRateLimitedEncoded"}}}},"503":{"description":"mesh.unavailable: the team's mesh store could not be reached; retry. mesh.authority_unavailable: team membership authority could not be reached; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshUnavailableEncoded"}}}}},"description":"Lists durable member and role addresses with their current routing and permission state, optionally for one address. Call this before sending to an @member/agent or @team/role target.","summary":"List team agent addresses"}},"/v1/mesh/team-addresses/handle":{"post":{"tags":["Mesh"],"operationId":"mesh.teamHandle","parameters":[{"name":"x-cmux-team","in":"header","schema":{"type":"string","description":"Team ID to act in; omitted or empty selects the authenticated person's personal team. Current membership and SSO policy are checked."},"required":false}],"security":[{"stackPersonSession":[]}],"responses":{"200":{"description":"MeshTeamAddresses","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshTeamAddresses"}}}},"400":{"description":"mesh.invalid: the request fields or combination are invalid; correct them and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshBadRequestEncoded"}}}},"401":{"description":"mesh.unauthorized: the bearer is missing or is not a team install credential. machine.revoked: the machine credential is revoked or expired. mesh.person_required: a signed-in person session is required; use the person bearer contract.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshUnauthorizedEncoded"}}}},"403":{"description":"mesh.forbidden: the credential is not allowed to act for this team, or the recipient's sender policy refuses the member; use an allowed team credential or sender.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshForbiddenEncoded"}}}},"404":{"description":"mesh.team_disabled: team addresses are disabled in this deployment; use ordinary daemon routes. | mesh.not_found: the mesh surface or message is not available to this caller; check the id and deployment. mesh.unknown_recipient: no live session, daemon, role, handle or team address matches; list sessions or team addresses first.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/MeshTeamDisabledEncoded"},{"$ref":"#/components/schemas/MeshNotFoundEncoded"}]}}}},"409":{"description":"mesh.ambiguous: several recipients or address claims match; use a sessionId, host or one unclaimed handle. mesh.idempotency_conflict: the idempotencyKey was already used with a different payload; choose a new key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshConflictEncoded"}}}},"429":{"description":"mesh.rate_limited: this daemon has exceeded its call limit; retry after retryAfterSeconds. mesh.queue_full: the receiving daemon or team has too many unacknowledged messages; retry after retryAfterSeconds. mesh.team_full: the team has reached its live daemon or session limit; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshRateLimitedEncoded"}}}},"503":{"description":"mesh.unavailable: the team's mesh store could not be reached; retry. mesh.authority_unavailable: team membership authority could not be reached; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshUnavailableEncoded"}}}}},"description":"Claims a handle for the authenticated person or releases it when release is true. Claiming is idempotent for the same owner; call GET /v1/mesh/team-addresses to see the resulting address.","summary":"Claim or release a team handle","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshTeamHandle"}}},"required":true}}},"/v1/mesh/team-addresses/roles":{"post":{"tags":["Mesh"],"operationId":"mesh.teamRole","parameters":[{"name":"x-cmux-team","in":"header","schema":{"type":"string","description":"Team ID to act in; omitted or empty selects the authenticated person's personal team. Current membership and SSO policy are checked."},"required":false}],"security":[{"stackPersonSession":[]}],"responses":{"200":{"description":"MeshTeamAddresses","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshTeamAddresses"}}}},"400":{"description":"mesh.invalid: the request fields or combination are invalid; correct them and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshBadRequestEncoded"}}}},"401":{"description":"mesh.unauthorized: the bearer is missing or is not a team install credential. machine.revoked: the machine credential is revoked or expired. mesh.person_required: a signed-in person session is required; use the person bearer contract.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshUnauthorizedEncoded"}}}},"403":{"description":"mesh.forbidden: the credential is not allowed to act for this team, or the recipient's sender policy refuses the member; use an allowed team credential or sender.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshForbiddenEncoded"}}}},"404":{"description":"mesh.team_disabled: team addresses are disabled in this deployment; use ordinary daemon routes. | mesh.not_found: the mesh surface or message is not available to this caller; check the id and deployment. mesh.unknown_recipient: no live session, daemon, role, handle or team address matches; list sessions or team addresses first.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/MeshTeamDisabledEncoded"},{"$ref":"#/components/schemas/MeshNotFoundEncoded"}]}}}},"409":{"description":"mesh.ambiguous: several recipients or address claims match; use a sessionId, host or one unclaimed handle. mesh.idempotency_conflict: the idempotencyKey was already used with a different payload; choose a new key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshConflictEncoded"}}}},"429":{"description":"mesh.rate_limited: this daemon has exceeded its call limit; retry after retryAfterSeconds. mesh.queue_full: the receiving daemon or team has too many unacknowledged messages; retry after retryAfterSeconds. mesh.team_full: the team has reached its live daemon or session limit; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshRateLimitedEncoded"}}}},"503":{"description":"mesh.unavailable: the team's mesh store could not be reached; retry. mesh.authority_unavailable: team membership authority could not be reached; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshUnavailableEncoded"}}}}},"description":"Creates or replaces an @team/role alias for a member and agent, resetting queued start-work grants when its target changes. Call GET /v1/mesh/team-addresses to use the updated alias.","summary":"Set a team role alias","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshTeamRole"}}},"required":true}}},"/v1/mesh/team-addresses/permissions":{"post":{"tags":["Mesh"],"operationId":"mesh.teamPermission","parameters":[{"name":"x-cmux-team","in":"header","schema":{"type":"string","description":"Team ID to act in; omitted or empty selects the authenticated person's personal team. Current membership and SSO policy are checked."},"required":false}],"security":[{"stackPersonSession":[]}],"responses":{"200":{"description":"MeshTeamAddresses","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshTeamAddresses"}}}},"400":{"description":"mesh.invalid: the request fields or combination are invalid; correct them and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshBadRequestEncoded"}}}},"401":{"description":"mesh.unauthorized: the bearer is missing or is not a team install credential. machine.revoked: the machine credential is revoked or expired. mesh.person_required: a signed-in person session is required; use the person bearer contract.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshUnauthorizedEncoded"}}}},"403":{"description":"mesh.forbidden: the credential is not allowed to act for this team, or the recipient's sender policy refuses the member; use an allowed team credential or sender.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshForbiddenEncoded"}}}},"404":{"description":"mesh.team_disabled: team addresses are disabled in this deployment; use ordinary daemon routes. | mesh.not_found: the mesh surface or message is not available to this caller; check the id and deployment. mesh.unknown_recipient: no live session, daemon, role, handle or team address matches; list sessions or team addresses first.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/MeshTeamDisabledEncoded"},{"$ref":"#/components/schemas/MeshNotFoundEncoded"}]}}}},"409":{"description":"mesh.ambiguous: several recipients or address claims match; use a sessionId, host or one unclaimed handle. mesh.idempotency_conflict: the idempotencyKey was already used with a different payload; choose a new key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshConflictEncoded"}}}},"429":{"description":"mesh.rate_limited: this daemon has exceeded its call limit; retry after retryAfterSeconds. mesh.queue_full: the receiving daemon or team has too many unacknowledged messages; retry after retryAfterSeconds. mesh.team_full: the team has reached its live daemon or session limit; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshRateLimitedEncoded"}}}},"503":{"description":"mesh.unavailable: the team's mesh store could not be reached; retry. mesh.authority_unavailable: team membership authority could not be reached; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshUnavailableEncoded"}}}}},"description":"Sets an agent owner's start-work policy and, when supplied, its allowed-sender policy; omitting allowedSenders preserves the current list. Clearing start-work grants resets queued start-work decisions. Call GET /v1/mesh/team-addresses to confirm the policy before sending.","summary":"Set team agent permissions","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshTeamPermission"}}},"required":true}}},"/v1/machines/pick":{"post":{"tags":["Machine placement"],"operationId":"machinePlacement.pick","parameters":[],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"PlacementDecision","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PlacementDecision"}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}},"description":"Says which offer a create with this payload would get and why, without creating anything or reserving budget. Same payload and answer as POST /v1/machines/place, which it replaces.","summary":"Pick a machine offer (dry run)","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PlacementRequest"}}},"required":true}}},"/v1/machines/place":{"post":{"tags":["Machine placement"],"operationId":"machinePlacement.place","parameters":[],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"PlacementDecision","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PlacementDecision"}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}},"description":"The old name of POST /v1/machines/pick: same payload, same handler, same answer. It keeps working; new callers use pick.","summary":"Deprecated: use POST /v1/machines/pick","deprecated":true,"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PlacementRequest"}}},"required":true}}},"/v1/machines":{"post":{"tags":["Machine placement"],"operationId":"machinePlacement.create","parameters":[],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"decision":{"$ref":"#/components/schemas/PlacementDecision"},"machine":{"$ref":"#/components/schemas/MachineRef"}},"required":["decision"],"additionalProperties":false}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"409":{"description":"MachineConflict: the requested machine operation conflicts with durable team capacity or an existing reservation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineConflictEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}},"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"capabilities":{"$ref":"#/components/schemas/PlacementCapabilities"},"size":{"anyOf":[{"type":"string","enum":["auto"]},{"$ref":"#/components/schemas/PlacementShape"}]},"taskKind":{"type":"string","enum":["agent","review","build"]},"region":{"type":"string","minLength":1,"maxLength":100},"minimum":{"$ref":"#/components/schemas/PlacementShape"},"clientKey":{"type":"string","minLength":1,"maxLength":128},"visibility":{"$ref":"#/components/schemas/MachineVisibility"},"kind":{"$ref":"#/components/schemas/MachineKind"}},"required":["clientKey"],"additionalProperties":false}}},"required":true}},"get":{"tags":["Machines"],"operationId":"machines.list","parameters":[],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/TeamMachine"}}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}}}},"/v1/machines/reservations":{"post":{"tags":["machineReservations"],"operationId":"machineReservations.reserve","parameters":[],"security":[{"bearer":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"leaseId":{"type":"string"},"machine":{"type":"string"},"expiresAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991}},"required":["leaseId","machine","expiresAt"],"additionalProperties":false}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry. | Unauthenticated: an access token is missing or invalid.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"},{"$ref":"#/components/schemas/UnauthenticatedEncoded"}]}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions. | Forbidden: the caller is not allowed to perform this operation. | PolicyRefused: the team policy refuses this sign-in.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/MachineForbiddenEncoded"},{"$ref":"#/components/schemas/ForbiddenEncoded"},{"$ref":"#/components/schemas/PolicyRefusedEncoded"}]}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"409":{"description":"MachineConflict: the requested machine operation conflicts with durable team capacity or an existing reservation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineConflictEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key. | OwnerUnreachable: an owner could not be reached; retry the request.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/MachineUnavailableEncoded"},{"$ref":"#/components/schemas/OwnerUnreachableEncoded"}]}}}}},"description":"A human Stack session reserves one Cloud carrier per compose key for 120 seconds. x-cmux-team selects a current team membership. The machine may still be starting; Send binds it before attaching. An explicit environment currently returns reservation.unavailable before allocation, so Send preserves its ordinary environment boot. Install and machine tokens cannot reserve machines.","summary":"Warm a Cloud machine while composing","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"composeKey":{"type":"string"},"environment":{"type":"string","minLength":1,"maxLength":256}},"required":["composeKey"],"additionalProperties":false}}},"required":true}}},"/v1/machines/reservations/{composeKey}/bind":{"post":{"tags":["machineReservations"],"operationId":"machineReservations.bind","parameters":[{"name":"composeKey","in":"path","schema":{"type":"string"},"required":true}],"security":[{"bearer":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"leaseId":{"type":"string"},"machine":{"type":"string"}},"required":["leaseId","machine"],"additionalProperties":false}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry. | Unauthenticated: an access token is missing or invalid.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"},{"$ref":"#/components/schemas/UnauthenticatedEncoded"}]}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions. | Forbidden: the caller is not allowed to perform this operation. | PolicyRefused: the team policy refuses this sign-in.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/MachineForbiddenEncoded"},{"$ref":"#/components/schemas/ForbiddenEncoded"},{"$ref":"#/components/schemas/PolicyRefusedEncoded"}]}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"409":{"description":"MachineConflict: the requested machine operation conflicts with durable team capacity or an existing reservation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineConflictEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key. | OwnerUnreachable: an owner could not be reached; retry the request.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/MachineUnavailableEncoded"},{"$ref":"#/components/schemas/OwnerUnreachableEncoded"}]}}}}},"description":"Atomically consumes the compose reservation for one Send identity. Repeating the same Send is idempotent; another Send cannot claim the reservation.","summary":"Bind a reserved Cloud machine to Send","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"sendKey":{"type":"string"},"environment":{"type":"string"}},"required":["sendKey"],"additionalProperties":false}}},"required":true}}},"/v1/machines/reservations/{composeKey}":{"delete":{"tags":["machineReservations"],"operationId":"machineReservations.release","parameters":[{"name":"composeKey","in":"path","schema":{"type":"string"},"required":true}],"security":[{"bearer":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"released":{"type":"boolean"}},"required":["released"],"additionalProperties":false}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry. | Unauthenticated: an access token is missing or invalid.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"},{"$ref":"#/components/schemas/UnauthenticatedEncoded"}]}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions. | Forbidden: the caller is not allowed to perform this operation. | PolicyRefused: the team policy refuses this sign-in.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/MachineForbiddenEncoded"},{"$ref":"#/components/schemas/ForbiddenEncoded"},{"$ref":"#/components/schemas/PolicyRefusedEncoded"}]}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"409":{"description":"MachineConflict: the requested machine operation conflicts with durable team capacity or an existing reservation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineConflictEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key. | OwnerUnreachable: an owner could not be reached; retry the request.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/MachineUnavailableEncoded"},{"$ref":"#/components/schemas/OwnerUnreachableEncoded"}]}}}}},"description":"Releases a compose reservation that Send did not consume. Bound reservations stay attached to their machine and cannot be released by this endpoint.","summary":"Release an unused Cloud reservation"}},"/v1/machines/offers":{"get":{"tags":["Machines"],"operationId":"machines.offers","parameters":[{"name":"capabilities","in":"query","schema":{"type":"string"},"required":false}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/MachineOffer"}}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}}}},"/v1/machines/audit":{"get":{"tags":["Machines"],"operationId":"machines.audit","parameters":[{"name":"target","in":"query","schema":{"type":"string","minLength":1,"maxLength":256},"required":false},{"name":"limit","in":"query","schema":{"type":"string"},"required":false}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/MachineAuditRow"}}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}}}},"/v1/machines/usage":{"get":{"tags":["Machines"],"operationId":"machines.usage","parameters":[{"name":"since","in":"query","schema":{"type":"string"},"required":false},{"name":"until","in":"query","schema":{"type":"string"},"required":false}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"MachineUsage","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUsage"}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}}}},"/v1/machines/snapshots":{"get":{"tags":["Machines"],"operationId":"machines.snapshots","parameters":[],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/MachineSnapshot"}}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}}}},"/v1/machines/snapshots/{snapshotId}":{"get":{"tags":["Machines"],"operationId":"machines.getSnapshot","parameters":[{"name":"snapshotId","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"MachineSnapshot","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineSnapshot"}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}}},"delete":{"tags":["Machines"],"operationId":"machines.deleteSnapshot","parameters":[{"name":"snapshotId","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"deleted":{"type":"boolean"}},"required":["deleted"],"additionalProperties":false}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}}}},"/v1/machines/snapshots/{snapshotId}/fork":{"post":{"tags":["Machines"],"operationId":"machines.forkSnapshot","parameters":[{"name":"snapshotId","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"TeamMachine","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TeamMachine"}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}},"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"clientKey":{"type":"string","minLength":1,"maxLength":128},"visibility":{"$ref":"#/components/schemas/MachineVisibility"}},"required":["clientKey"],"additionalProperties":false}}},"required":true}}},"/v1/machines/{id}":{"get":{"tags":["Machines"],"operationId":"machines.get","parameters":[{"name":"id","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"TeamMachine","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TeamMachine"}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}}},"delete":{"tags":["Machines"],"operationId":"machines.destroy","parameters":[{"name":"id","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"deleted":{"type":"boolean"}},"required":["deleted"],"additionalProperties":false}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}}}},"/v1/machines/{id}/open":{"post":{"tags":["Machines"],"operationId":"machines.open","parameters":[{"name":"id","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"TeamMachine","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TeamMachine"}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}}}},"/v1/machines/{id}/presence":{"post":{"tags":["Machines"],"operationId":"machines.here","parameters":[{"name":"id","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"TeamMachine","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TeamMachine"}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}}},"delete":{"tags":["Machines"],"operationId":"machines.left","parameters":[{"name":"id","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"TeamMachine","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TeamMachine"}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}}}},"/v1/machines/{id}/pause":{"post":{"tags":["Machines"],"operationId":"machines.pause","parameters":[{"name":"id","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"TeamMachine","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TeamMachine"}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}}}},"/v1/machines/{id}/resume":{"post":{"tags":["Machines"],"operationId":"machines.resume","parameters":[{"name":"id","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"TeamMachine","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TeamMachine"}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}}}},"/v1/machines/{id}/fork":{"post":{"tags":["Machines"],"operationId":"machines.fork","parameters":[{"name":"id","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"TeamMachine","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TeamMachine"}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}},"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"clientKey":{"type":"string","minLength":1,"maxLength":128},"visibility":{"$ref":"#/components/schemas/MachineVisibility"}},"required":["clientKey"],"additionalProperties":false}}},"required":true}}},"/v1/machines/{id}/snapshots":{"post":{"tags":["Machines"],"operationId":"machines.snapshot","parameters":[{"name":"id","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"MachineSnapshot","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineSnapshot"}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}},"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"clientKey":{"type":"string","minLength":1,"maxLength":128}},"required":["clientKey"],"additionalProperties":false}}},"required":true}}},"/v1/machines/{id}/resize":{"post":{"tags":["Machines"],"operationId":"machines.resize","parameters":[{"name":"id","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"MachineResize","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineResize"}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}},"description":"Takes a snapshot of the machine first and returns its id, so a failed resize can be undone. A bigger size grows the machine in place (it keeps its id, disk and running processes). A smaller size makes a new machine at that size and copies the home and work folders to it straight from the old machine, then moves this machine (same id, workspace bindings and grants) to it and deletes the old one: running processes are lost, the disk survives. A shrink answers `shrink.state: copying` until it is done; retry with the same clientKey to go on. Any failure deletes the new machine and keeps the old one unchanged. Retries with the same clientKey reach the same snapshot and the same resize.","summary":"Resize a machine, snapshot first","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"clientKey":{"type":"string","minLength":1,"maxLength":128},"size":{"type":"string","minLength":1,"maxLength":64}},"required":["clientKey","size"],"additionalProperties":false}}},"required":true}}},"/v1/machines/{id}/chat-access":{"get":{"tags":["Machines"],"operationId":"machines.chatAccess","parameters":[{"name":"id","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"MachineChatAccess","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineChatAccess"}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}}}},"/v1/machines/{id}/chat-grants/{user}":{"put":{"tags":["Machines"],"operationId":"machines.shareChat","parameters":[{"name":"id","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true},{"name":"user","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"MachineChatAccess","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineChatAccess"}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}}},"delete":{"tags":["Machines"],"operationId":"machines.unshareChat","parameters":[{"name":"id","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true},{"name":"user","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"MachineChatAccess","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineChatAccess"}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}}}},"/v1/machines/{id}/messages":{"post":{"tags":["Machines"],"operationId":"machines.sendMessage","parameters":[{"name":"id","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"MachineMessage","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineMessage"}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}},"description":"Queues a user message for a machine, workspace or session. The machine's chat access policy is checked before enqueueing. A paused machine is woken by the delivery adapter; the response exposes queued, waking or delivered state and retries with the same clientKey return the same messageId.","summary":"Queue a message for a machine session","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"clientKey":{"type":"string","minLength":1,"maxLength":128},"body":{"type":"string","minLength":1},"workspace":{"type":"string","minLength":1,"maxLength":256},"session":{"type":"string","minLength":1,"maxLength":256}},"required":["clientKey","body"],"additionalProperties":false}}},"required":true}}},"/v1/machines/{id}/visibility":{"put":{"tags":["Machines"],"operationId":"machines.visibility","parameters":[{"name":"id","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"TeamMachine","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TeamMachine"}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}},"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"visibility":{"$ref":"#/components/schemas/MachineVisibility"}},"required":["visibility"],"additionalProperties":false}}},"required":true}}},"/v1/workspaces/{workspace}/machine":{"get":{"tags":["Workspace machines"],"operationId":"workspaceMachines.get","parameters":[{"name":"workspace","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"WorkspaceMachine","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceMachine"}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}}},"post":{"tags":["Workspace machines"],"operationId":"workspaceMachines.ensure","parameters":[{"name":"workspace","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"WorkspaceMachine","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceMachine"}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}},"description":"Returns the workspace binding or reuses the caller's private machine for projectKey. Project keys normalize git remotes to git:host/owner/repo (lowercase, no .git, SSH and HTTPS unified), or use folder:stable-id for a folder without a remote. The binding is scoped to the caller's personal team. Concurrent workspaces share one project admission key and a durable first-writer binding. The first workspace remains the guest scope and the initial machine environment is retained. Without projectKey, legacy clients keep per-workspace behavior. Existing workspace bindings never move. New machines boot the requested snapshot, the ready repo environment snapshot, or the configured warm base.","summary":"Ensure the project machine for a workspace","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"clientKey":{"type":"string","minLength":1,"maxLength":128},"reservationKey":{"type":"string"},"reservationSendKey":{"type":"string"},"projectKey":{"type":"string","minLength":1,"maxLength":2048},"snapshot":{"type":"string","minLength":1,"maxLength":256},"repo":{"type":"string","minLength":2,"maxLength":140},"ref":{"anyOf":[{"type":"string","minLength":1,"maxLength":200},{"type":"null"}]},"environment":{"type":"string"}},"required":["clientKey"],"additionalProperties":false}}},"required":true}}},"/v1/workspaces/{workspace}/machine/import":{"post":{"tags":["Workspace machines"],"operationId":"workspaceMachines.import","parameters":[{"name":"workspace","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"machineId":{"type":"string","minLength":1,"maxLength":256},"generation":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"provider":{"type":"string"},"connectionMachine":{"type":"string","minLength":1,"maxLength":256},"reconnectRequired":{"type":"boolean"}},"required":["machineId","generation","provider","connectionMachine","reconnectRequired"],"additionalProperties":false}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}},"description":"Verifies an owner CloudDO machine and atomically records its logical workspace machine. It never creates a second provider machine; retries with the same client key are idempotent.","summary":"Adopt an existing Cloud carrier for a workspace","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"carrierMachine":{"type":"string","minLength":1,"maxLength":256},"expectedMachine":{"type":"string","minLength":1,"maxLength":256},"expectedGeneration":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"clientKey":{"type":"string","minLength":1,"maxLength":128}},"required":["carrierMachine","expectedGeneration","clientKey"],"additionalProperties":false}}},"required":true}}},"/v1/workspaces/{workspace}/machine/connection":{"get":{"tags":["Workspace machines"],"operationId":"workspaceMachines.connection","parameters":[{"name":"workspace","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"machineId":{"type":"string","minLength":1,"maxLength":256},"generation":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"provider":{"type":"string"},"connectionMachine":{"type":"string","minLength":1,"maxLength":256}},"required":["machineId","generation","provider","connectionMachine"],"additionalProperties":false}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}},"description":"Owner-only atomic read of the logical machine, generation and current provider connection target. Clients keep the logical machine identity and reconnect to this target after rewind or shrink.","summary":"Resolve the workspace's current connection target"}},"/v1/workspaces/{workspace}/machine/turns/{turn}/snapshot":{"post":{"tags":["Workspace machines"],"operationId":"workspaceMachines.captureTurn","parameters":[{"name":"workspace","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true},{"name":"turn","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"TurnMachineCapture","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TurnMachineCapture"}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}},"description":"Captures the machine's memory and disk through the provider before a turn. Repeating the same session, turn and clientKey returns the durable capture; a provider retry uses the same operation name.","summary":"Capture a whole-machine turn checkpoint","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"session":{"type":"string","minLength":1,"maxLength":256},"clientKey":{"type":"string","minLength":1,"maxLength":128},"expectedMachine":{"type":"string","minLength":1,"maxLength":256},"expectedGeneration":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991}},"required":["session","clientKey","expectedMachine","expectedGeneration"],"additionalProperties":false}}},"required":true}}},"/v1/workspaces/{workspace}/machine/turns/{turn}/start":{"post":{"tags":["Workspace machines"],"operationId":"workspaceMachines.startTurn","parameters":[{"name":"workspace","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true},{"name":"turn","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"TurnMachineCapture","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TurnMachineCapture"}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}},"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"session":{"type":"string","minLength":1,"maxLength":256},"expectedMachine":{"type":"string","minLength":1,"maxLength":256},"expectedGeneration":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991}},"required":["session","expectedMachine","expectedGeneration"],"additionalProperties":false}}},"required":true}}},"/v1/workspaces/{workspace}/machine/turns/{turn}/finish":{"post":{"tags":["Workspace machines"],"operationId":"workspaceMachines.finishTurn","parameters":[{"name":"workspace","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true},{"name":"turn","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"TurnMachineCapture","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TurnMachineCapture"}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}},"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"session":{"type":"string","minLength":1,"maxLength":256},"expectedMachine":{"type":"string","minLength":1,"maxLength":256},"expectedGeneration":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991}},"required":["session","expectedMachine","expectedGeneration"],"additionalProperties":false}}},"required":true}}},"/v1/workspaces/{workspace}/machine/turns":{"get":{"tags":["Workspace machines"],"operationId":"workspaceMachines.turns","parameters":[{"name":"workspace","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"machineId":{"type":"string"},"generation":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"revision":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"gate":{"anyOf":[{"type":"object","properties":{"phase":{"type":"string","enum":["idle"]}},"required":["phase"],"additionalProperties":false},{"type":"object","properties":{"phase":{"type":"string","enum":["capturing","reserved","running"]},"captureId":{"type":"string"}},"required":["phase","captureId"],"additionalProperties":false},{"type":"object","properties":{"phase":{"type":"string","enum":["rewinding"]},"rewindId":{"type":"string"}},"required":["phase","rewindId"],"additionalProperties":false},{"type":"object","properties":{"phase":{"type":"string","enum":["mutation"]},"operation":{"type":"string"}},"required":["phase","operation"],"additionalProperties":false}]},"captures":{"type":"array","items":{"$ref":"#/components/schemas/TurnMachineCapture"}}},"required":["machineId","generation","revision","gate","captures"],"additionalProperties":false}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}}}},"/v1/workspaces/{workspace}/machine/turns/{turn}":{"get":{"tags":["Workspace machines"],"operationId":"workspaceMachines.turnState","parameters":[{"name":"workspace","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true},{"name":"turn","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true},{"name":"session","in":"query","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"TurnMachineCapture","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TurnMachineCapture"}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}}}},"/v1/workspaces/{workspace}/machine/turns/{turn}/rewind":{"post":{"tags":["Workspace machines"],"operationId":"workspaceMachines.rewindTurn","parameters":[{"name":"workspace","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true},{"name":"turn","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"machine":{"$ref":"#/components/schemas/TeamMachine"},"capture":{"$ref":"#/components/schemas/TurnMachineCapture"},"generation":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"rewindId":{"type":"string"}},"required":["machine","capture","generation","rewindId"],"additionalProperties":false}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}},"description":"Restores a captured machine into a new provider machine and atomically moves the workspace binding when the expected machine identity still matches. A stale identity is refused; the old machine is kept until the replacement is recorded.","summary":"Rewind a whole machine to a turn checkpoint","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"session":{"type":"string","minLength":1,"maxLength":256},"clientKey":{"type":"string","minLength":1,"maxLength":128},"expectedMachine":{"type":"string","minLength":1,"maxLength":256},"expectedGeneration":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991}},"required":["session","clientKey","expectedMachine","expectedGeneration"],"additionalProperties":false}}},"required":true}}},"/v1/machines/default":{"post":{"tags":["defaultMachines"],"operationId":"defaultMachines.ensure","parameters":[],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"DefaultMachine","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DefaultMachine"}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}},"description":"Creates one private machine in the caller's personal team through normal caps and budget admission. The workspace and idempotency key are fixed per account. Repeated and concurrent calls return the same machine.","summary":"Ensure the account's default Cloud machine"}},"/v1/triggers":{"post":{"tags":["Cloud triggers"],"operationId":"triggers.create","parameters":[],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"TriggerCreated","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TriggerCreated"}}}},"400":{"description":"trigger.invalid: the configuration or payload is invalid; correct it before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TriggerBadRequestEncoded"}}}},"401":{"description":"trigger.unauthorized: authentication or webhook signature is invalid; use valid credentials. | MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/TriggerUnauthorizedEncoded"},{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}]}}}},"403":{"description":"trigger.forbidden: current machine or workspace access was refused; check the owner permissions. | MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/TriggerForbiddenEncoded"},{"$ref":"#/components/schemas/MachineForbiddenEncoded"}]}}}},"404":{"description":"trigger.not_found: the trigger is absent, belongs to another owner, or the surface is disabled. | MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/TriggerNotFoundEncoded"},{"$ref":"#/components/schemas/MachineNotFoundEncoded"}]}}}},"409":{"description":"trigger.conflict: the trigger revision changed; read it again before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TriggerConflictEncoded"}}}},"503":{"description":"trigger.unavailable: the store or exact guest turn is unavailable; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TriggerUnavailableEncoded"}}}}},"description":"Register an owner-scoped repository filter, trusted prompt and existing machine/chat target. Returns the webhook secret once; retain it securely for event delivery.","summary":"Register a GitHub or generic webhook trigger","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TriggerCreate"}}},"required":true}}},"/v1/triggers/{id}":{"get":{"tags":["Cloud triggers"],"operationId":"triggers.get","parameters":[{"name":"id","in":"path","schema":{"type":"string"},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Trigger","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Trigger"}}}},"400":{"description":"trigger.invalid: the configuration or payload is invalid; correct it before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TriggerBadRequestEncoded"}}}},"401":{"description":"trigger.unauthorized: authentication or webhook signature is invalid; use valid credentials. | MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/TriggerUnauthorizedEncoded"},{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}]}}}},"403":{"description":"trigger.forbidden: current machine or workspace access was refused; check the owner permissions. | MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/TriggerForbiddenEncoded"},{"$ref":"#/components/schemas/MachineForbiddenEncoded"}]}}}},"404":{"description":"trigger.not_found: the trigger is absent, belongs to another owner, or the surface is disabled. | MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/TriggerNotFoundEncoded"},{"$ref":"#/components/schemas/MachineNotFoundEncoded"}]}}}},"409":{"description":"trigger.conflict: the trigger revision changed; read it again before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TriggerConflictEncoded"}}}},"503":{"description":"trigger.unavailable: the store or exact guest turn is unavailable; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TriggerUnavailableEncoded"}}}}},"description":"Read the owner's trigger configuration after checking current machine and workspace access. Signing and webhook secrets are never returned.","summary":"Read a trigger"},"delete":{"tags":["Cloud triggers"],"operationId":"triggers.remove","parameters":[{"name":"id","in":"path","schema":{"type":"string"},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"removed":{"type":"boolean"}},"required":["removed"],"additionalProperties":false}}}},"400":{"description":"trigger.invalid: the configuration or payload is invalid; correct it before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TriggerBadRequestEncoded"}}}},"401":{"description":"trigger.unauthorized: authentication or webhook signature is invalid; use valid credentials. | MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/TriggerUnauthorizedEncoded"},{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}]}}}},"403":{"description":"trigger.forbidden: current machine or workspace access was refused; check the owner permissions. | MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/TriggerForbiddenEncoded"},{"$ref":"#/components/schemas/MachineForbiddenEncoded"}]}}}},"404":{"description":"trigger.not_found: the trigger is absent, belongs to another owner, or the surface is disabled. | MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/TriggerNotFoundEncoded"},{"$ref":"#/components/schemas/MachineNotFoundEncoded"}]}}}},"409":{"description":"trigger.conflict: the trigger revision changed; read it again before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TriggerConflictEncoded"}}}},"503":{"description":"trigger.unavailable: the store or exact guest turn is unavailable; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TriggerUnavailableEncoded"}}}}},"description":"Disable the owner's trigger and revoke its outstanding principals. Owners may disable after losing access to the target machine.","summary":"Disable a trigger"}},"/v1/triggers/{id}/deliveries/{delivery}":{"get":{"tags":["Cloud triggers"],"operationId":"triggers.delivery","parameters":[{"name":"id","in":"path","schema":{"type":"string"},"required":true},{"name":"delivery","in":"path","schema":{"type":"string","pattern":"^[A-Za-z0-9_-]{8,128}$"},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"TriggerDelivery","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TriggerDelivery"}}}},"400":{"description":"trigger.invalid: the configuration or payload is invalid; correct it before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TriggerBadRequestEncoded"}}}},"401":{"description":"trigger.unauthorized: authentication or webhook signature is invalid; use valid credentials. | MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/TriggerUnauthorizedEncoded"},{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}]}}}},"403":{"description":"trigger.forbidden: current machine or workspace access was refused; check the owner permissions. | MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/TriggerForbiddenEncoded"},{"$ref":"#/components/schemas/MachineForbiddenEncoded"}]}}}},"404":{"description":"trigger.not_found: the trigger is absent, belongs to another owner, or the surface is disabled. | MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/TriggerNotFoundEncoded"},{"$ref":"#/components/schemas/MachineNotFoundEncoded"}]}}}},"409":{"description":"trigger.conflict: the trigger revision changed; read it again before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TriggerConflictEncoded"}}}},"503":{"description":"trigger.unavailable: the store or exact guest turn is unavailable; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TriggerUnavailableEncoded"}}}}},"description":"Read durable delivery state and, after acceptance, the exact guest turn's state and reply. Delivered alone does not mean the model completed; questions and permission requests return attention.","summary":"Read a trigger delivery"}},"/v1/triggers/{id}/github":{"post":{"tags":["Cloud trigger ingress"],"operationId":"triggerIngress.ingest","parameters":[{"name":"id","in":"path","schema":{"type":"string"},"required":true}],"security":[],"responses":{"200":{"description":"TriggerIngressResult","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TriggerIngressResult"}}}},"400":{"description":"trigger.invalid: the configuration or payload is invalid; correct it before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TriggerBadRequestEncoded"}}}},"401":{"description":"trigger.unauthorized: authentication or webhook signature is invalid; use valid credentials.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TriggerUnauthorizedEncoded"}}}},"403":{"description":"trigger.forbidden: current machine or workspace access was refused; check the owner permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TriggerForbiddenEncoded"}}}},"404":{"description":"trigger.not_found: the trigger is absent, belongs to another owner, or the surface is disabled.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TriggerNotFoundEncoded"}}}},"409":{"description":"trigger.conflict: the trigger revision changed; read it again before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TriggerConflictEncoded"}}}},"503":{"description":"trigger.unavailable: the store or exact guest turn is unavailable; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TriggerUnavailableEncoded"}}}}},"description":"Verify GitHub's signature over the exact request bytes, match the stored filter, and durably enqueue one delivery. Retries with the same delivery ID reuse the original job.","summary":"Receive a signed GitHub event"}},"/v1/triggers/{id}/authorize":{"post":{"tags":["Cloud trigger ingress"],"operationId":"triggerIngress.authorize","parameters":[{"name":"id","in":"path","schema":{"type":"string"},"required":true}],"security":[],"responses":{"200":{"description":"TriggerAuthorizeResult","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TriggerAuthorizeResult"}}}},"400":{"description":"trigger.invalid: the configuration or payload is invalid; correct it before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TriggerBadRequestEncoded"}}}},"401":{"description":"trigger.unauthorized: authentication or webhook signature is invalid; use valid credentials.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TriggerUnauthorizedEncoded"}}}},"403":{"description":"trigger.forbidden: current machine or workspace access was refused; check the owner permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TriggerForbiddenEncoded"}}}},"404":{"description":"trigger.not_found: the trigger is absent, belongs to another owner, or the surface is disabled.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TriggerNotFoundEncoded"}}}},"409":{"description":"trigger.conflict: the trigger revision changed; read it again before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TriggerConflictEncoded"}}}},"503":{"description":"trigger.unavailable: the store or exact guest turn is unavailable; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TriggerUnavailableEncoded"}}}}},"description":"Introspect a short-lived trigger token for ensure, send or status. Only active:true grants authority; owner tokens are never used.","summary":"Authorize one guest trigger operation","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TriggerAuthorize"}}},"required":true}}},"/v1/triggers/{id}/webhook":{"post":{"tags":["Cloud trigger ingress"],"operationId":"triggerIngress.ingestWebhook","parameters":[{"name":"id","in":"path","schema":{"type":"string"},"required":true}],"security":[],"responses":{"200":{"description":"TriggerIngressResult","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TriggerIngressResult"}}}},"400":{"description":"trigger.invalid: the configuration or payload is invalid; correct it before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TriggerBadRequestEncoded"}}}},"401":{"description":"trigger.unauthorized: authentication or webhook signature is invalid; use valid credentials.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TriggerUnauthorizedEncoded"}}}},"403":{"description":"trigger.forbidden: current machine or workspace access was refused; check the owner permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TriggerForbiddenEncoded"}}}},"404":{"description":"trigger.not_found: the trigger is absent, belongs to another owner, or the surface is disabled.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TriggerNotFoundEncoded"}}}},"409":{"description":"trigger.conflict: the trigger revision changed; read it again before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TriggerConflictEncoded"}}}},"503":{"description":"trigger.unavailable: the store or exact guest turn is unavailable; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TriggerUnavailableEncoded"}}}}},"description":"Verify the HMAC signature over the exact request bytes, match the configured event filter, and durably enqueue one delivery. Retries with the same delivery ID reuse the original job.","summary":"Receive a signed generic webhook"}},"/v1/turn-execution/claim":{"post":{"tags":["Cloud turn execution"],"operationId":"turnExecution.claim","parameters":[],"security":[{"bearer":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"claimed":{"type":"boolean","enum":[true]},"team":{"type":"string","minLength":1,"maxLength":256},"user":{"type":"string","minLength":1,"maxLength":256},"workspace":{"type":"string","minLength":1,"maxLength":256},"machine":{"type":"string","minLength":1,"maxLength":256},"generation":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"session":{"type":"string","minLength":1,"maxLength":256},"turn":{"type":"string","minLength":1,"maxLength":256},"purpose":{"type":"string","enum":["prepare","execute"]},"attemptId":{"type":"string","minLength":1,"maxLength":256}},"required":["claimed","team","user","workspace","machine","generation","session","turn","purpose","attemptId"],"additionalProperties":false}}}},"400":{"description":"machine.turn_capability_invalid: the capability or its requested scope is invalid; obtain a new owner-issued capability.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TurnCapabilityBadRequestEncoded"}}}},"401":{"description":"machine.turn_capability_unauthorized: a valid unexpired turn capability bearer is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TurnCapabilityUnauthorizedEncoded"}}}},"409":{"description":"machine.turn_capability_scope_mismatch: the request does not match the issued scope. | machine.turn_capability_replay: execution was already claimed or the turn is no longer reserved. | machine.turn_generation_conflict: the machine generation changed; reconnect and prepare a new turn.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TurnCapabilityConflictEncoded"}}}},"503":{"description":"machine.turn_capability_unavailable: the durable capability service is unavailable; retry the same operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TurnCapabilityUnavailableEncoded"}}}}},"description":"Checks the opaque capability against its exact scope and durable workspace generation. Prepare validation is repeatable and does not authorize execution; an execute capability is consumed atomically once. Neither can manage or rewind a machine.","summary":"Validate preparation or claim Cloud turn execution","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"team":{"type":"string","minLength":1,"maxLength":256},"user":{"type":"string","minLength":1,"maxLength":256},"workspace":{"type":"string","minLength":1,"maxLength":256},"machine":{"type":"string","minLength":1,"maxLength":256},"generation":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"session":{"type":"string","minLength":1,"maxLength":256},"turn":{"type":"string","minLength":1,"maxLength":256},"purpose":{"type":"string","enum":["prepare","execute"]},"attemptId":{"type":"string","minLength":1,"maxLength":256}},"required":["team","user","workspace","machine","generation","session","turn"],"additionalProperties":false}}},"required":true}}},"/v1/turn-execution/finish":{"post":{"tags":["Cloud turn execution"],"operationId":"turnExecution.finish","parameters":[],"security":[{"bearer":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"finished":{"type":"boolean","enum":[true]},"team":{"type":"string","minLength":1,"maxLength":256},"user":{"type":"string","minLength":1,"maxLength":256},"workspace":{"type":"string","minLength":1,"maxLength":256},"machine":{"type":"string","minLength":1,"maxLength":256},"generation":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"session":{"type":"string","minLength":1,"maxLength":256},"turn":{"type":"string","minLength":1,"maxLength":256},"purpose":{"type":"string","enum":["prepare","execute"]},"attemptId":{"type":"string","minLength":1,"maxLength":256}},"required":["finished","team","user","workspace","machine","generation","session","turn","purpose","attemptId"],"additionalProperties":false}}}},"400":{"description":"machine.turn_capability_invalid: the capability or its requested scope is invalid; obtain a new owner-issued capability.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TurnCapabilityBadRequestEncoded"}}}},"401":{"description":"machine.turn_capability_unauthorized: a valid unexpired turn capability bearer is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TurnCapabilityUnauthorizedEncoded"}}}},"409":{"description":"machine.turn_capability_scope_mismatch: the request does not match the issued scope. | machine.turn_capability_replay: execution was already claimed or the turn is no longer reserved. | machine.turn_generation_conflict: the machine generation changed; reconnect and prepare a new turn.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TurnCapabilityConflictEncoded"}}}},"503":{"description":"machine.turn_capability_unavailable: the durable capability service is unavailable; retry the same operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TurnCapabilityUnavailableEncoded"}}}}},"description":"Releases only the exact active turn and generation authorized by this capability. Replays are idempotent and cannot finish another turn.","summary":"Finish a one-use Cloud turn capability","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"team":{"type":"string","minLength":1,"maxLength":256},"user":{"type":"string","minLength":1,"maxLength":256},"workspace":{"type":"string","minLength":1,"maxLength":256},"machine":{"type":"string","minLength":1,"maxLength":256},"generation":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"session":{"type":"string","minLength":1,"maxLength":256},"turn":{"type":"string","minLength":1,"maxLength":256},"purpose":{"type":"string","enum":["prepare","execute"]},"attemptId":{"type":"string","minLength":1,"maxLength":256}},"required":["team","user","workspace","machine","generation","session","turn"],"additionalProperties":false}}},"required":true}}},"/v1/workspaces/{workspace}/machine/turns/{turn}/capability":{"post":{"tags":["Cloud turn capabilities"],"operationId":"turnMint.mint","parameters":[{"name":"workspace","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true},{"name":"turn","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"capability":{"type":"string"},"team":{"type":"string","minLength":1,"maxLength":256},"user":{"type":"string","minLength":1,"maxLength":256},"workspace":{"type":"string","minLength":1,"maxLength":256},"machine":{"type":"string","minLength":1,"maxLength":256},"generation":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"session":{"type":"string","minLength":1,"maxLength":256},"turn":{"type":"string","minLength":1,"maxLength":256},"purpose":{"type":"string","enum":["prepare","execute"]},"attemptId":{"type":"string","minLength":1,"maxLength":256},"expiresAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991}},"required":["capability","team","user","workspace","machine","generation","session","turn","purpose","attemptId","expiresAt"],"additionalProperties":false}}}},"400":{"description":"machine.turn_capability_invalid: the capability or its requested scope is invalid; obtain a new owner-issued capability. | MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/TurnCapabilityBadRequestEncoded"},{"$ref":"#/components/schemas/MachineBadRequestEncoded"}]}}}},"401":{"description":"machine.turn_capability_unauthorized: a valid unexpired turn capability bearer is required. | MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/TurnCapabilityUnauthorizedEncoded"},{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}]}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"409":{"description":"machine.turn_capability_scope_mismatch: the request does not match the issued scope. | machine.turn_capability_replay: execution was already claimed or the turn is no longer reserved. | machine.turn_generation_conflict: the machine generation changed; reconnect and prepare a new turn.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TurnCapabilityConflictEncoded"}}}},"503":{"description":"machine.turn_capability_unavailable: the durable capability service is unavailable; retry the same operation. | MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/TurnCapabilityUnavailableEncoded"},{"$ref":"#/components/schemas/MachineUnavailableEncoded"}]}}}}},"description":"An owner-only route issues a prepare capability before capture, or a one-use execute capability after capture reserves the same turn. The response supplies the canonical scope, purpose and attempt. Only the digest is stored in the durable ledger.","summary":"Mint a scoped Cloud turn capability","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"session":{"type":"string","minLength":1,"maxLength":256},"expectedMachine":{"type":"string","minLength":1,"maxLength":256},"expectedGeneration":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"purpose":{"type":"string","enum":["prepare","execute"]},"attemptId":{"type":"string","minLength":1,"maxLength":256}},"required":["session","expectedMachine","expectedGeneration"],"additionalProperties":false}}},"required":true}}},"/v1/machines/{id}/autosize":{"get":{"tags":["Machine automatic sizing"],"operationId":"machineAutoSize.status","parameters":[{"name":"id","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"AutoSizeStatus","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AutoSizeStatus"}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}},"description":"Machines size themselves: one load sample a minute while running; one size step up when starved (an OOM kill, sustained memory pressure, a CPU maxed out during agent work, a full disk, or a known-heavy task), snapshot first; one step down after a long idle stretch, never mid-turn. This reads the decisions and why.","summary":"A machine's automatic sizing"}},"/v1/workspaces/{workspace}/fork-runs":{"post":{"tags":["Cloud fork runs"],"operationId":"forkRuns.start","parameters":[{"name":"workspace","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"A durable copy-on-write fork: one source snapshot restored into one machine per requested harness. The client seeds each child and syncs back exactly one selected bundle.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForkRun"}}}},"400":{"description":"MachineBadRequest: machine.invalid, the machine request is invalid. | ForkRunBadRequest: fork_run.invalid, the fork request is invalid.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/MachineBadRequestEncoded"},{"$ref":"#/components/schemas/ForkRunBadRequestEncoded"}]}}}},"401":{"description":"MachineUnauthorized: machine.unauthorized, the access token is missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: machine.forbidden, the caller cannot use this machine.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: machine.not_found, the source machine or fork run does not exist.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"409":{"description":"ForkRunConflict: fork_run.conflict, the client key or selected child conflicts with this run.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForkRunConflictEncoded"}}}},"503":{"description":"MachineUnavailable: machine.unavailable, the machine provider is unavailable. | ForkRunUnavailable: fork_run.unavailable, fork orchestration is unavailable; retry the same client key.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/MachineUnavailableEncoded"},{"$ref":"#/components/schemas/ForkRunUnavailableEncoded"}]}}}}},"description":"Captures the source machine once, then restores one copy-on-write machine per harness. The operation is durable and idempotent: an uncertain response can be retried with the same clientKey, and each child uses a stable provider operation name. The caller seeds the children and syncs back one selected diff bundle.","summary":"Fork a chat across harnesses","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"clientKey":{"type":"string","minLength":1,"maxLength":128},"sourceMachine":{"type":"string","minLength":1,"maxLength":256},"session":{"type":"string","minLength":1,"maxLength":256},"prompt":{"type":"string","minLength":1},"harnesses":{"type":"array","items":{"type":"string"},"maxItems":16}},"required":["clientKey","sourceMachine","harnesses"],"additionalProperties":false}}},"required":true}}},"/v1/workspaces/{workspace}/fork-runs/{runId}":{"get":{"tags":["Cloud fork runs"],"operationId":"forkRuns.get","parameters":[{"name":"workspace","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true},{"name":"runId","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"A durable copy-on-write fork: one source snapshot restored into one machine per requested harness. The client seeds each child and syncs back exactly one selected bundle.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForkRun"}}}},"400":{"description":"MachineBadRequest: machine.invalid, the machine request is invalid. | ForkRunBadRequest: fork_run.invalid, the fork request is invalid.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/MachineBadRequestEncoded"},{"$ref":"#/components/schemas/ForkRunBadRequestEncoded"}]}}}},"401":{"description":"MachineUnauthorized: machine.unauthorized, the access token is missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: machine.forbidden, the caller cannot use this machine.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: machine.not_found, the source machine or fork run does not exist.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"409":{"description":"ForkRunConflict: fork_run.conflict, the client key or selected child conflicts with this run.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForkRunConflictEncoded"}}}},"503":{"description":"MachineUnavailable: machine.unavailable, the machine provider is unavailable. | ForkRunUnavailable: fork_run.unavailable, fork orchestration is unavailable; retry the same client key.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/MachineUnavailableEncoded"},{"$ref":"#/components/schemas/ForkRunUnavailableEncoded"}]}}}}},"description":"Returns the durable source snapshot, child machines, states, and selected child for this fork run.","summary":"Read a fork run"}},"/v1/workspaces/{workspace}/fork-runs/{runId}/select":{"post":{"tags":["Cloud fork runs"],"operationId":"forkRuns.select","parameters":[{"name":"workspace","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true},{"name":"runId","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"A durable copy-on-write fork: one source snapshot restored into one machine per requested harness. The client seeds each child and syncs back exactly one selected bundle.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForkRun"}}}},"400":{"description":"MachineBadRequest: machine.invalid, the machine request is invalid. | ForkRunBadRequest: fork_run.invalid, the fork request is invalid.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/MachineBadRequestEncoded"},{"$ref":"#/components/schemas/ForkRunBadRequestEncoded"}]}}}},"401":{"description":"MachineUnauthorized: machine.unauthorized, the access token is missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: machine.forbidden, the caller cannot use this machine.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: machine.not_found, the source machine or fork run does not exist.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"409":{"description":"ForkRunConflict: fork_run.conflict, the client key or selected child conflicts with this run.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForkRunConflictEncoded"}}}},"503":{"description":"MachineUnavailable: machine.unavailable, the machine provider is unavailable. | ForkRunUnavailable: fork_run.unavailable, fork orchestration is unavailable; retry the same client key.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/MachineUnavailableEncoded"},{"$ref":"#/components/schemas/ForkRunUnavailableEncoded"}]}}}}},"description":"Records the one ready child whose sync-back bundle is authoritative. Selection is durable and idempotent; selecting a different child after selection is refused.","summary":"Select the best fork result","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"childId":{"type":"string","minLength":1,"maxLength":256}},"required":["childId"],"additionalProperties":false}}},"required":true}}},"/v1/machines/joined/heartbeat":{"post":{"tags":["Registered machines"],"operationId":"registeredMachines.joinedHeartbeat","parameters":[],"security":[],"responses":{"200":{"description":"RegisteredMachineHeartbeatAck","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RegisteredMachineHeartbeatAck"}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}},"description":"A heartbeat from a machine cmux already owns: its free vCPU, memory and disk, load and running sessions. Same payload and answer as POST /v1/machines/registered/heartbeat, which it replaces.","summary":"Report a joined machine's free capacity","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RegisteredMachineHeartbeat"}}},"required":true}}},"/v1/machines/registered/heartbeat":{"post":{"tags":["Registered machines"],"operationId":"registeredMachines.heartbeat","parameters":[],"security":[],"responses":{"200":{"description":"RegisteredMachineHeartbeatAck","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RegisteredMachineHeartbeatAck"}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}},"description":"The old name of POST /v1/machines/joined/heartbeat: same payload, same handler, same answer. It keeps working; new callers use joined.","summary":"Deprecated: use POST /v1/machines/joined/heartbeat","deprecated":true,"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RegisteredMachineHeartbeat"}}},"required":true}}},"/v1/connectors":{"get":{"tags":["Connectors"],"operationId":"connectors.list","parameters":[{"name":"team","in":"query","schema":{"type":"string"},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"connectors":{"type":"array","items":{"type":"object","properties":{"provider":{"type":"string","enum":["github","gitlab","google-drive"]},"state":{"type":"string","enum":["available","installed","needs-auth","expired","unavailable"]},"detail":{"type":"string"},"account":{"type":"string"}},"required":["provider","state"],"additionalProperties":false}}},"required":["connectors"],"additionalProperties":false}}}},"400":{"description":"ConnectorInvalid","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorInvalidEncoded"}}}},"401":{"description":"ConnectorAuthRequired","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorAuthRequiredEncoded"}}}},"403":{"description":"ConnectorForbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorForbiddenEncoded"}}}},"404":{"description":"ConnectorNotFound","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorNotFoundEncoded"}}}},"409":{"description":"ConnectorNeedsAuth","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorNeedsAuthEncoded"}}}},"429":{"description":"ConnectorRateLimited","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorRateLimitedEncoded"}}}},"501":{"description":"ConnectorNotBuilt","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorNotBuiltEncoded"}}}},"503":{"description":"ConnectorUnavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorUnavailableEncoded"}}}}}}},"/v1/connectors/{provider}/install":{"get":{"tags":["Connectors"],"operationId":"connectors.install","parameters":[{"name":"provider","in":"path","schema":{"type":"string","enum":["github","gitlab","google-drive"]},"required":true},{"name":"team","in":"query","schema":{"type":"string"},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"provider":{"type":"string","enum":["github","gitlab","google-drive"]},"url":{"type":"string"}},"required":["provider","url"],"additionalProperties":false}}}},"400":{"description":"ConnectorInvalid","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorInvalidEncoded"}}}},"401":{"description":"ConnectorAuthRequired","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorAuthRequiredEncoded"}}}},"403":{"description":"ConnectorForbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorForbiddenEncoded"}}}},"404":{"description":"ConnectorNotFound","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorNotFoundEncoded"}}}},"409":{"description":"ConnectorNeedsAuth","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorNeedsAuthEncoded"}}}},"429":{"description":"ConnectorRateLimited","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorRateLimitedEncoded"}}}},"501":{"description":"ConnectorNotBuilt","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorNotBuiltEncoded"}}}},"503":{"description":"ConnectorUnavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorUnavailableEncoded"}}}}}}},"/v1/connectors/{provider}/repos":{"get":{"tags":["Connectors"],"operationId":"connectors.repos","parameters":[{"name":"provider","in":"path","schema":{"type":"string","enum":["github","gitlab","google-drive"]},"required":true},{"name":"team","in":"query","schema":{"type":"string"},"required":true},{"name":"query","in":"query","schema":{"anyOf":[{"type":"string"},{"type":"null"}]},"required":false},{"name":"cursor","in":"query","schema":{"anyOf":[{"type":"string"},{"type":"null"}]},"required":false}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"provider":{"type":"string","enum":["github","gitlab","google-drive"]},"repos":{"type":"array","items":{"type":"object","properties":{"fullName":{"type":"string"},"name":{"type":"string"},"owner":{"type":"string"},"private":{"type":"boolean"},"connectionId":{"type":"string"}},"required":["fullName","name","owner","private"],"additionalProperties":false}},"cursor":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["provider","repos","cursor"],"additionalProperties":false}}}},"400":{"description":"ConnectorInvalid","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorInvalidEncoded"}}}},"401":{"description":"ConnectorAuthRequired","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorAuthRequiredEncoded"}}}},"403":{"description":"ConnectorForbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorForbiddenEncoded"}}}},"404":{"description":"ConnectorNotFound","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorNotFoundEncoded"}}}},"409":{"description":"ConnectorNeedsAuth | ConnectorCursorStale","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/ConnectorNeedsAuthEncoded"},{"$ref":"#/components/schemas/ConnectorCursorStaleEncoded"}]}}}},"429":{"description":"ConnectorRateLimited","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorRateLimitedEncoded"}}}},"501":{"description":"ConnectorNotBuilt","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorNotBuiltEncoded"}}}},"503":{"description":"ConnectorUnavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorUnavailableEncoded"}}}}}}},"/v1/connectors/{provider}/token":{"post":{"tags":["Connectors"],"operationId":"connectors.token","parameters":[{"name":"provider","in":"path","schema":{"type":"string","enum":["github","gitlab","google-drive"]},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"provider":{"type":"string","enum":["github","gitlab","google-drive"]},"token":{"type":"string"},"expiresAt":{"type":"string"},"repo":{"type":"string"},"scopes":{"type":"array","items":{"type":"string"}},"tokenId":{"type":"string"},"connectionId":{"type":"string"}},"required":["provider","token","expiresAt","repo","scopes","tokenId"],"additionalProperties":false}}}},"400":{"description":"ConnectorInvalid","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorInvalidEncoded"}}}},"401":{"description":"ConnectorAuthRequired","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorAuthRequiredEncoded"}}}},"403":{"description":"ConnectorForbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorForbiddenEncoded"}}}},"404":{"description":"ConnectorNotFound","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorNotFoundEncoded"}}}},"409":{"description":"ConnectorNeedsAuth","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorNeedsAuthEncoded"}}}},"429":{"description":"ConnectorRateLimited","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorRateLimitedEncoded"}}}},"501":{"description":"ConnectorNotBuilt","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorNotBuiltEncoded"}}}},"503":{"description":"ConnectorUnavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorUnavailableEncoded"}}}}},"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"team":{"type":"string"},"repo":{"type":"string"},"scopes":{"type":"array","items":{"type":"string","minLength":1,"maxLength":80},"minItems":1,"maxItems":16},"ttlSec":{"type":"integer","minimum":60,"maximum":3600},"connectionId":{"type":"string"}},"required":["team","repo","scopes","ttlSec"],"additionalProperties":false}}},"required":true}}},"/v1/me/github":{"get":{"tags":["Me"],"operationId":"me.github","parameters":[{"name":"x-cmux-team","in":"header","schema":{"type":"string","description":"Team to read; the team query wins. Omitted: the bearer's own team."},"required":false},{"name":"team","in":"query","schema":{"anyOf":[{"type":"string"},{"type":"null"}]},"required":false}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"anyOf":[{"type":"object","properties":{"connected":{"type":"boolean","enum":[true]},"login":{"type":"string"},"name":{"anyOf":[{"type":"string"},{"type":"null"}]},"avatarUrl":{"type":"string"},"htmlUrl":{"type":"string"},"accountType":{"type":"string","enum":["user","organization"]},"source":{"type":"string","enum":["github-app","oauth"]},"repositories":{"type":"object","properties":{"count":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"selection":{"type":"string","enum":["all","selected"]}},"required":["count","selection"],"additionalProperties":false}},"required":["connected","login","source"],"additionalProperties":false},{"type":"object","properties":{"connected":{"type":"boolean","enum":[false]},"connectUrl":{"type":"string"}},"required":["connected"],"additionalProperties":false}]}}}},"400":{"description":"ConnectorInvalid: the team query or x-cmux-team header is not a team id; send a team_ id or omit it.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorInvalidEncoded"}}}},"401":{"description":"ConnectorAuthRequired: the bearer is missing, expired or revoked; sign in again or use a live machine install token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorAuthRequiredEncoded"}}}},"403":{"description":"ConnectorForbidden: the caller is not a member of that team, its sign-in policy refuses it, or this install kind cannot read GitHub.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorForbiddenEncoded"}}}},"404":{"description":"ConnectorNotFound: cmux-api has no GitHub status route here; treat GitHub as not connected.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorNotFoundEncoded"}}}},"409":{"description":"ConnectorNeedsAuth: the GitHub connection needs to be linked again; reconnect GitHub in cmux.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorNeedsAuthEncoded"}}}},"429":{"description":"ConnectorRateLimited: cmux-api is rate limiting the read; retry after retryAfter seconds.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorRateLimitedEncoded"}}}},"501":{"description":"ConnectorNotBuilt: this deployment cannot read GitHub connections yet; treat GitHub as unknown.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorNotBuiltEncoded"}}}},"503":{"description":"ConnectorUnavailable: cmux-api is not bound or did not answer in time; retry shortly, the answer is unknown until then.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConnectorUnavailableEncoded"}}}}},"description":"Read which GitHub account the caller's cmux account has connected through the cmux GitHub App, so an agent can answer \"can you see my GitHub?\" with no repository picked. Accepts the person's cmux access token or a Cloud machine's install token (acting in its machine's team); the team is the team query, else x-cmux-team, else the bearer's own. Read-only, never returns a token or scopes; connected false means link GitHub in cmux.","summary":"The GitHub account this cmux account has connected"}},"/v1/machines/join-tokens":{"post":{"tags":["Machine join credentials"],"operationId":"machineJoin.mint","parameters":[],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"A newly minted join credential and its metadata.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/JoinTokenMinted"}}}},"400":{"description":"join.malformed: the join request is malformed; correct the fields and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/JoinBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: the access token is missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"machine.revoked: a revoked machine cannot be rotated; redeem a new join credential. machine.not_member: minting or listing on a shared team needs the team.resources permission; ask a team admin. machine.vault_personal_only: only a person (not an agent) on their own personal team grants a machine their vault. | MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/JoinForbiddenEncoded"},{"$ref":"#/components/schemas/MachineForbiddenEncoded"}]}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"429":{"description":"join.rate_limited: the join request is rate limited; retry after the indicated delay.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/JoinRateLimitedEncoded"}}}},"503":{"description":"machine.join.unavailable: machine onboarding is unavailable; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/JoinUnavailableEncoded"}}}}},"description":"Create a single-use join credential for the caller's team, valid for the requested TTL or 600 seconds by default. This mutates onboarding state and is not idempotent; call POST /v1/machines/join-tokens/redeem from the joining machine.","summary":"Mint a machine join credential","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/JoinTokenMint"}}},"required":true}}},"/v1/machines/credentials":{"get":{"tags":["Machine join credentials"],"operationId":"machineJoin.list","parameters":[],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"The team's machine credential list.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineCredentialList"}}}},"401":{"description":"MachineUnauthorized: the access token is missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"machine.revoked: a revoked machine cannot be rotated; redeem a new join credential. machine.not_member: minting or listing on a shared team needs the team.resources permission; ask a team admin. machine.vault_personal_only: only a person (not an agent) on their own personal team grants a machine their vault. | MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/JoinForbiddenEncoded"},{"$ref":"#/components/schemas/MachineForbiddenEncoded"}]}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"429":{"description":"join.rate_limited: the join request is rate limited; retry after the indicated delay.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/JoinRateLimitedEncoded"}}}},"503":{"description":"machine.join.unavailable: machine onboarding is unavailable; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/JoinUnavailableEncoded"}}}}},"description":"Read all enrolled machine credential metadata for the caller's team. This is read-only; call rotate or revoke with a machine id to manage one.","summary":"List team machine credentials"}},"/v1/machines/credentials/{machineId}/rotate":{"post":{"tags":["Machine join credentials"],"operationId":"machineJoin.rotate","parameters":[{"name":"machineId","in":"path","schema":{"type":"string","minLength":1,"maxLength":256,"description":"A machine or join-token identifier.","examples":["machine_01"]},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"The machine identity created or refreshed by redemption.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/JoinRedeemed"}}}},"400":{"description":"join.malformed: the join request is malformed; correct the fields and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/JoinBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: the access token is missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"machine.revoked: a revoked machine cannot be rotated; redeem a new join credential. machine.not_member: minting or listing on a shared team needs the team.resources permission; ask a team admin. machine.vault_personal_only: only a person (not an agent) on their own personal team grants a machine their vault. | MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/JoinForbiddenEncoded"},{"$ref":"#/components/schemas/MachineForbiddenEncoded"}]}}}},"404":{"description":"machine.not_found: the machine was not found; check the machine id. | MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/JoinNotFoundEncoded"},{"$ref":"#/components/schemas/MachineNotFoundEncoded"}]}}}},"409":{"description":"join.used: the join credential was already used; mint another one.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/JoinConflictEncoded"}}}},"429":{"description":"join.rate_limited: the join request is rate limited; retry after the indicated delay.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/JoinRateLimitedEncoded"}}}},"503":{"description":"machine.join.unavailable: machine onboarding is unavailable; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/JoinUnavailableEncoded"}}}}},"description":"Issue a new credential for an enrolled machine and retire its previous credential. This mutates credential state and is not idempotent; call GET /v1/machines/credentials/self with the new credential.","summary":"Rotate a machine credential"}},"/v1/machines/credentials/{machineId}/revoke":{"post":{"tags":["Machine join credentials"],"operationId":"machineJoin.revoke","parameters":[{"name":"machineId","in":"path","schema":{"type":"string","minLength":1,"maxLength":256,"description":"A machine or join-token identifier.","examples":["machine_01"]},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"<No Content>"},"401":{"description":"MachineUnauthorized: the access token is missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"machine.not_found: the machine was not found; check the machine id. | MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/JoinNotFoundEncoded"},{"$ref":"#/components/schemas/MachineNotFoundEncoded"}]}}}},"429":{"description":"join.rate_limited: the join request is rate limited; retry after the indicated delay.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/JoinRateLimitedEncoded"}}}},"503":{"description":"machine.join.unavailable: machine onboarding is unavailable; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/JoinUnavailableEncoded"}}}}},"description":"Revoke an enrolled machine credential so it can no longer authenticate. Repeating the operation is idempotent for an existing machine; redeem a new join credential to re-enroll it.","summary":"Revoke a machine credential"}},"/v1/machines/{machineId}/vault":{"put":{"tags":["Machine join credentials"],"operationId":"machineJoin.vault","parameters":[{"name":"machineId","in":"path","schema":{"type":"string","minLength":1,"maxLength":256,"description":"A machine or join-token identifier.","examples":["machine_01"]},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"A joined machine's vault grant.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineVaultGranted"}}}},"401":{"description":"MachineUnauthorized: the access token is missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"machine.revoked: a revoked machine cannot be rotated; redeem a new join credential. machine.not_member: minting or listing on a shared team needs the team.resources permission; ask a team admin. machine.vault_personal_only: only a person (not an agent) on their own personal team grants a machine their vault. | MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/JoinForbiddenEncoded"},{"$ref":"#/components/schemas/MachineForbiddenEncoded"}]}}}},"404":{"description":"machine.not_found: the machine was not found; check the machine id. | MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/JoinNotFoundEncoded"},{"$ref":"#/components/schemas/MachineNotFoundEncoded"}]}}}},"429":{"description":"join.rate_limited: the join request is rate limited; retry after the indicated delay.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/JoinRateLimitedEncoded"}}}},"503":{"description":"machine.join.unavailable: machine onboarding is unavailable; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/JoinUnavailableEncoded"}}}}},"description":"Set whether a joined machine may read its minter's vault (GET /v1/vault/machine). Only the person who minted its join credential, on their personal team, may set it; anyone else's machine reads as not found. Idempotent.","summary":"Grant or withdraw a joined machine's vault","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineVaultGrant"}}},"required":true}}},"/v1/machines/credentials/self":{"get":{"tags":["Machine join redemption"],"operationId":"machineRedeem.self","parameters":[],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Metadata for the calling machine credential.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineCredentialSelf"}}}},"401":{"description":"machine.unknown: the machine credential is unknown. machine.revoked: the machine credential is revoked. machine.unauthorized: the replacement proof is invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/JoinUnauthorizedEncoded"}}}},"503":{"description":"machine.join.unavailable: machine onboarding is unavailable; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/JoinUnavailableEncoded"}}}}},"description":"Read the calling machine credential's metadata using its bearer. This is read-only and does not update heartbeat or expiry; call it after redemption or rotation to verify the credential.","summary":"Read the calling machine credential"}},"/v1/machines/credentials/self/revoke":{"post":{"tags":["Machine join redemption"],"operationId":"machineRedeem.selfRevoke","parameters":[],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"The calling machine's credential, now revoked; the machine has left its team's mesh.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineCredentialRevoked"}}}},"401":{"description":"machine.unknown: the machine credential is unknown. machine.revoked: the machine credential is revoked. machine.unauthorized: the replacement proof is invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/JoinUnauthorizedEncoded"}}}},"503":{"description":"machine.join.unavailable: machine onboarding is unavailable; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/JoinUnavailableEncoded"}}}}},"description":"Revoke the calling machine credential using its own bearer, and remove the machine from its team's mesh address book in the same request (its daemon, sessions and team-address routes; messages queued to it expire). The state change is idempotent: once revoked, the same bearer answers 401 machine.revoked, which a client treats as already unenrolled; an unknown bearer answers the same. A 503 changed nothing the retry cannot finish. To enroll again, redeem a new join credential.","summary":"Unenroll the calling machine"}},"/v1/machines/join-tokens/redeem":{"post":{"tags":["Machine join redemption"],"operationId":"machineRedeem.redeem","parameters":[],"security":[],"responses":{"200":{"description":"The machine identity created or refreshed by redemption.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/JoinRedeemed"}}}},"400":{"description":"join.malformed: the join request is malformed; correct the fields and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/JoinBadRequestEncoded"}}}},"401":{"description":"machine.unknown: the machine credential is unknown. machine.revoked: the machine credential is revoked. machine.unauthorized: the replacement proof is invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/JoinUnauthorizedEncoded"}}}},"404":{"description":"machine.not_found: the machine was not found; check the machine id.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/JoinNotFoundEncoded"}}}},"409":{"description":"join.used: the join credential was already used; mint another one.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/JoinConflictEncoded"}}}},"410":{"description":"join.expired: the join credential expired; mint another one.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/JoinGoneEncoded"}}}},"429":{"description":"join.rate_limited: the join request is rate limited; retry after the indicated delay.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/JoinRateLimitedEncoded"}}}},"503":{"description":"machine.join.unavailable: machine onboarding is unavailable; retry later.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/JoinUnavailableEncoded"}}}}},"description":"Consume a single-use join credential and enroll the machine, optionally replacing the credential for the same WireGuard identity. A successful first redemption returns a new machine credential; a retry is only idempotent with the same proposed credential and machine details. Call GET /v1/machines/credentials/self with the returned credential.","summary":"Redeem a machine join credential","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/JoinRedeem"}}},"required":true}}},"/v1/mesh/nodes/register":{"put":{"tags":["Mesh node registry"],"operationId":"nodeRegistry.register","parameters":[],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"A registered WireGuard mesh node and its current visibility state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshNode"}}}},"400":{"description":"mesh.node.invalid: the node registration or ACL payload is invalid. mesh.node.platform: platform does not match the machine credential; correct it and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NodeBadRequestEncoded"}}}},"401":{"description":"machine.unauthorized: a cmm_ machine credential is required. machine.revoked: the credential is revoked, expired or replaced; redeem a replacement credential.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NodeUnauthorizedEncoded"}}}},"404":{"description":"mesh.node.not_found: the node is not registered; check nodeId and register it first.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NodeNotFoundEncoded"}}}},"503":{"description":"mesh.node.unavailable: the node registry store is unavailable; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NodeUnavailableEncoded"}}}}},"description":"Upserts the authenticated machine's node record after validating its node id, platform and WireGuard public key. Repeat registration to refresh the record, then call GET /v1/mesh/nodes/{nodeId}/peers to obtain its peer map.","summary":"Register a mesh node","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/NodeRegister"}}},"required":true}}},"/v1/mesh/nodes/{nodeId}/peers":{"get":{"tags":["Mesh node registry"],"operationId":"nodeRegistry.peers","parameters":[{"name":"nodeId","in":"path","schema":{"type":"string","minLength":1,"maxLength":256,"description":"The registered node id whose peer map is requested.","examples":["node-a"]},"required":true},{"name":"waitSeconds","in":"query","schema":{"type":"string","description":"Seconds to wait for a peer-map change; omit or 0 for an immediate response. An integer from 0 through 25.","examples":["25"]},"required":false},{"name":"sinceVersion","in":"query","schema":{"type":"string","description":"The map version already held; an unchanged version can wait for the next change. A non-negative integer.","examples":["3"]},"required":false}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"The current peer map for one registered node.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshPeerMap"}}}},"400":{"description":"mesh.node.invalid: the node registration or ACL payload is invalid. mesh.node.platform: platform does not match the machine credential; correct it and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NodeBadRequestEncoded"}}}},"401":{"description":"machine.unauthorized: a cmm_ machine credential is required. machine.revoked: the credential is revoked, expired or replaced; redeem a replacement credential.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NodeUnauthorizedEncoded"}}}},"404":{"description":"mesh.node.not_found: the node is not registered; check nodeId and register it first.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NodeNotFoundEncoded"}}}},"503":{"description":"mesh.node.unavailable: the node registry store is unavailable; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NodeUnavailableEncoded"}}}}},"description":"Returns the authenticated node's visible peer map, excluding itself and ACL-denied peers. Pass sinceVersion and waitSeconds to long-poll until the map changes; register first with PUT /v1/mesh/nodes/register.","summary":"List mesh peers"}},"/v1/mesh/nodes/acl":{"put":{"tags":["Mesh node ACL"],"operationId":"nodeAcl.set","parameters":[],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"The team's complete directed node-to-node deny list.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshNodeAcl"}}}},"400":{"description":"mesh.node.invalid: the node registration or ACL payload is invalid. mesh.node.platform: platform does not match the machine credential; correct it and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NodeBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: machine.unauthorized, no bearer or a cmux access token without a team claim; send a team member's token. | NodeUnauthorized: shared by the node errors; these routes do not answer it.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/NodeUnauthorizedEncoded"},{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}]}}}},"403":{"description":"MachineForbidden: machine.forbidden, a machine's own token cannot edit ACLs or revoke nodes; use a person's token. | NodeForbidden: shared by the node errors; these routes do not answer it.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/NodeForbiddenEncoded"},{"$ref":"#/components/schemas/MachineForbiddenEncoded"}]}}}},"404":{"description":"MachineNotFound: machine.not_found, the machines surface is off on this deployment. | NodeNotFound: mesh.node.not_found, no such node, or the caller may not change it (see the operation).","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/NodeNotFoundEncoded"},{"$ref":"#/components/schemas/MachineNotFoundEncoded"}]}}}},"503":{"description":"mesh.node.unavailable: the node registry store is unavailable; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NodeUnavailableEncoded"}}}}},"description":"Replaces the team's directed node-to-node deny list. The next peer-map read reflects the new visibility; send the complete desired list because this operation replaces the previous list. On a shared team the caller needs the team.resources permission (any member of a personal team may); without it the answer is 404 mesh.node.not_found.","summary":"Set node ACL denies","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshNodeAcl"}}},"required":true}}},"/v1/mesh/nodes/{nodeId}/revoke":{"post":{"tags":["Mesh node ACL"],"operationId":"nodeAcl.revoke","parameters":[{"name":"nodeId","in":"path","schema":{"type":"string","minLength":1,"maxLength":256,"description":"The registered node id to revoke.","examples":["node-a"]},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"A registered WireGuard mesh node and its current visibility state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MeshNode"}}}},"400":{"description":"mesh.node.invalid: the node registration or ACL payload is invalid. mesh.node.platform: platform does not match the machine credential; correct it and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NodeBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: machine.unauthorized, no bearer or a cmux access token without a team claim; send a team member's token. | NodeUnauthorized: shared by the node errors; these routes do not answer it.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/NodeUnauthorizedEncoded"},{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}]}}}},"403":{"description":"MachineForbidden: machine.forbidden, a machine's own token cannot edit ACLs or revoke nodes; use a person's token. | NodeForbidden: shared by the node errors; these routes do not answer it.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/NodeForbiddenEncoded"},{"$ref":"#/components/schemas/MachineForbiddenEncoded"}]}}}},"404":{"description":"MachineNotFound: machine.not_found, the machines surface is off on this deployment. | NodeNotFound: mesh.node.not_found, no such node, or the caller may not change it (see the operation).","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/NodeNotFoundEncoded"},{"$ref":"#/components/schemas/MachineNotFoundEncoded"}]}}}},"503":{"description":"mesh.node.unavailable: the node registry store is unavailable; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NodeUnavailableEncoded"}}}}},"description":"Marks a registered node revoked and returns its record. Only the member who registered the node, or one with the team.manage permission, may revoke it; anyone else gets 404 mesh.node.not_found. Repeating the call is idempotent; the node must register again with a replacement machine credential before peers can see it.","summary":"Revoke a mesh node"}},"/v1/resources":{"post":{"tags":["Hosted connector resources"],"operationId":"resources.mint","parameters":[],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"ResourceRef","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourceRef"}}}},"400":{"description":"resource.invalid: the request matched its schema but a resource selector is not valid. | resource.invalid_locator: the provider returned an unsafe locator.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourceBadRequestEncoded"}}}},"401":{"description":"resource.unauthorized: no bearer, or not a valid cmux access token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourceUnauthorizedEncoded"}}}},"403":{"description":"resource.wrong_account: the referenced connection belongs to another team. | resource.insufficient_scope: the token cannot use this connection.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/ResourceWrongAccountEncoded"},{"$ref":"#/components/schemas/ResourceInsufficientScopeEncoded"}]}}}},"404":{"description":"resource.not_found: no such resource reference for the caller's team.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourceNotFoundEncoded"}}}},"410":{"description":"resource.revoked: the durable resource reference was revoked and cannot be resolved.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourceRevokedEncoded"}}}},"501":{"description":"resource.unsupported: this provider or resource kind is not implemented.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourceUnsupportedEncoded"}}}},"503":{"description":"resource.provider_unavailable: the connection or provider could not be reached; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourceUnavailableEncoded"}}}}},"description":"Hosted connector resources are off in this deployment and return 404 resource.not_found until a resolver is enabled. When enabled: Checks the selection with the provider's backend (the exact connection, its current grant) and answers a `src_` reference bound to the caller's user and team. Store the refId in the chat; it is never a local path.","summary":"Save a selected provider object as a durable reference","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourceSelection"}}},"required":true}}},"/v1/resources/{refId}/resolve":{"post":{"tags":["Hosted connector resources"],"operationId":"resources.resolve","parameters":[{"name":"refId","in":"path","schema":{"type":"string"},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"ResourceResolved","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourceResolved"}}}},"400":{"description":"resource.invalid: the request matched its schema but a resource selector is not valid. | resource.invalid_locator: the provider returned an unsafe locator.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourceBadRequestEncoded"}}}},"401":{"description":"resource.unauthorized: no bearer, or not a valid cmux access token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourceUnauthorizedEncoded"}}}},"403":{"description":"resource.wrong_account: the referenced connection belongs to another team. | resource.insufficient_scope: the token cannot use this connection.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/ResourceWrongAccountEncoded"},{"$ref":"#/components/schemas/ResourceInsufficientScopeEncoded"}]}}}},"404":{"description":"resource.not_found: no such resource reference for the caller's team.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourceNotFoundEncoded"}}}},"410":{"description":"resource.revoked: the durable resource reference was revoked and cannot be resolved.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourceRevokedEncoded"}}}},"501":{"description":"resource.unsupported: this provider or resource kind is not implemented.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourceUnsupportedEncoded"}}}},"503":{"description":"resource.provider_unavailable: the connection or provider could not be reached; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourceUnavailableEncoded"}}}}},"description":"Hosted connector resources are off in this deployment and return 404 resource.not_found until a resolver is enabled. When enabled: Re-checks the caller, the same connection and its current provider grant on every call, then answers a Credential-free HTTPS URL or opaque provider locator and the observed version. A denied check keeps the reference and answers its typed error; it never falls back to another account.","summary":"Resolve a saved reference to its current provider locator"}},"/v1/task-results":{"post":{"tags":["Cloud task results"],"operationId":"taskResults.create","parameters":[],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"The branch, bounded diff card and optional pull request produced from a finished task.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TaskResult"}}}},"400":{"description":"task_result.invalid: the task result request is invalid. | task_result.idempotency_conflict: the key is already linked to another publication.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TaskResultBadRequestEncoded"}}}},"401":{"description":"task_result.unauthorized: a signed user access token is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TaskResultUnauthorizedEncoded"}}}},"403":{"description":"task_result.forbidden: this caller cannot publish the result. | task_result.machine_unavailable: the task machine is unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TaskResultForbiddenEncoded"}}}},"404":{"description":"task_result.not_found: no such task result exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TaskResultNotFoundEncoded"}}}},"409":{"description":"task_result.conflict: the publication conflicts with an existing result. | task_result.task_not_finished: the task has not finished.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TaskResultConflictEncoded"}}}},"503":{"description":"task_result.unavailable: the result provider is unavailable. | task_result.provider_unavailable: GitHub publication is unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TaskResultUnavailableEncoded"}}}}},"description":"Asks the machine task owner to compare the finished commit with baseRef, push a branch and optionally open a pull request. The provider verifies the task and keeps all GitHub credentials behind the connector; this endpoint never accepts a VM token or routes through CodeRouter.","summary":"Publish a finished task result","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/TaskResultRequest"}}},"required":true}}},"/v1/task-results/{taskId}":{"get":{"tags":["Cloud task results"],"operationId":"taskResults.get","parameters":[{"name":"taskId","in":"path","schema":{"type":"string","description":"The opaque task id assigned by the machine task owner.","examples":["task_01J8Z7Q4M6N2K5P8R3T1V9W0X2"]},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"The branch, bounded diff card and optional pull request produced from a finished task.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TaskResult"}}}},"400":{"description":"task_result.invalid: the task result request is invalid. | task_result.idempotency_conflict: the key is already linked to another publication.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TaskResultBadRequestEncoded"}}}},"401":{"description":"task_result.unauthorized: a signed user access token is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TaskResultUnauthorizedEncoded"}}}},"403":{"description":"task_result.forbidden: this caller cannot publish the result. | task_result.machine_unavailable: the task machine is unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TaskResultForbiddenEncoded"}}}},"404":{"description":"task_result.not_found: no such task result exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TaskResultNotFoundEncoded"}}}},"409":{"description":"task_result.conflict: the publication conflicts with an existing result. | task_result.task_not_finished: the task has not finished.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TaskResultConflictEncoded"}}}},"503":{"description":"task_result.unavailable: the result provider is unavailable. | task_result.provider_unavailable: GitHub publication is unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/TaskResultUnavailableEncoded"}}}}},"description":"Returns the caller's previously published branch, diff card and optional pull request.","summary":"Read a task result"}},"/v1/vault/env":{"get":{"tags":["Vault env"],"operationId":"vaultEnv.list","parameters":[],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"entries":{"type":"array","items":{"$ref":"#/components/schemas/VaultEnvSummary"}}},"required":["entries"],"additionalProperties":false}}}},"400":{"description":"vault.invalid_name: the name is not [A-Za-z_][A-Za-z0-9_]* of at most 128, or is one the machine owns (PATH, HOME, LD_*, CMUX_*, ...). | vault.invalid_value: valueBase64 is not padded base64 of 1-16384 bytes. | vault.fingerprint_mismatch: fingerprint is not the lowercase sha256 hex of the value. | vault.invalid_hosts: allowedHosts is not 0-16 lowercase DNS names (optionally `*.` and `:port`). | vault.no_entry: the name has no active entry to set a policy on.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultBadRequestEncoded"}}}},"401":{"description":"vault.unauthorized: a valid cmux access token or machine credential is required, or the machine was revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultUnauthorizedEncoded"}}}},"403":{"description":"vault.forbidden: this caller may not use this route (person routes refuse machines and agents). | vault.not_granted: the machine was never granted its owner's vault; the owner grants it with PUT /v1/machines/{id}/vault. | vault.grant_expired: the machine's grant lapsed; the owner renews it with PUT /v1/vault/grants/{kind}/{id}.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultForbiddenEncoded"}}}},"404":{"description":"vault.not_found: the vault is not enabled on this deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultNotFoundEncoded"}}}},"409":{"description":"vault.limit: the user already has 100 env entries saved; delete one first.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultConflictEncoded"}}}},"503":{"description":"vault.unconfigured: the deployment has no usable vault master key yet; retry later. | vault.unavailable: the store or a credential check is unreachable; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultUnavailableEncoded"}}}}},"description":"The names of the active entries with their revisions, never a value or its fingerprint.","summary":"List the caller's vault env entries"},"delete":{"tags":["Vault env"],"operationId":"vaultEnv.erase","parameters":[],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"VaultErased","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultErased"}}}},"400":{"description":"vault.invalid_name: the name is not [A-Za-z_][A-Za-z0-9_]* of at most 128, or is one the machine owns (PATH, HOME, LD_*, CMUX_*, ...). | vault.invalid_value: valueBase64 is not padded base64 of 1-16384 bytes. | vault.fingerprint_mismatch: fingerprint is not the lowercase sha256 hex of the value. | vault.invalid_hosts: allowedHosts is not 0-16 lowercase DNS names (optionally `*.` and `:port`). | vault.no_entry: the name has no active entry to set a policy on.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultBadRequestEncoded"}}}},"401":{"description":"vault.unauthorized: a valid cmux access token or machine credential is required, or the machine was revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultUnauthorizedEncoded"}}}},"403":{"description":"vault.forbidden: this caller may not use this route (person routes refuse machines and agents). | vault.not_granted: the machine was never granted its owner's vault; the owner grants it with PUT /v1/machines/{id}/vault. | vault.grant_expired: the machine's grant lapsed; the owner renews it with PUT /v1/vault/grants/{kind}/{id}.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultForbiddenEncoded"}}}},"404":{"description":"vault.not_found: the vault is not enabled on this deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultNotFoundEncoded"}}}},"409":{"description":"vault.limit: the user already has 100 env entries saved; delete one first.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultConflictEncoded"}}}},"503":{"description":"vault.unconfigured: the deployment has no usable vault master key yet; retry later. | vault.unavailable: the store or a credential check is unreachable; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultUnavailableEncoded"}}}}},"description":"Destroys the caller's vault data key and every entry (crypto-shred): a sealed entry copied out of the vault can no longer be opened. The platform's own storage recovery keeps a restorable copy for up to 30 days. Every machine grant is revoked (403 vault.not_granted until its owner grants it again); a consented machine that never read the vault starts from the default grant and reads an empty vault. Revisions are never reused afterwards.","summary":"Erase the caller's whole vault"}},"/v1/vault/env/{name}":{"put":{"tags":["Vault env"],"operationId":"vaultEnv.write","parameters":[{"name":"name","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"VaultEnvWritten","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultEnvWritten"}}}},"400":{"description":"vault.invalid_name: the name is not [A-Za-z_][A-Za-z0-9_]* of at most 128, or is one the machine owns (PATH, HOME, LD_*, CMUX_*, ...). | vault.invalid_value: valueBase64 is not padded base64 of 1-16384 bytes. | vault.fingerprint_mismatch: fingerprint is not the lowercase sha256 hex of the value. | vault.invalid_hosts: allowedHosts is not 0-16 lowercase DNS names (optionally `*.` and `:port`). | vault.no_entry: the name has no active entry to set a policy on.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultBadRequestEncoded"}}}},"401":{"description":"vault.unauthorized: a valid cmux access token or machine credential is required, or the machine was revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultUnauthorizedEncoded"}}}},"403":{"description":"vault.forbidden: this caller may not use this route (person routes refuse machines and agents). | vault.not_granted: the machine was never granted its owner's vault; the owner grants it with PUT /v1/machines/{id}/vault. | vault.grant_expired: the machine's grant lapsed; the owner renews it with PUT /v1/vault/grants/{kind}/{id}.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultForbiddenEncoded"}}}},"404":{"description":"vault.not_found: the vault is not enabled on this deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultNotFoundEncoded"}}}},"409":{"description":"vault.limit: the user already has 100 env entries saved; delete one first.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultConflictEncoded"}}}},"503":{"description":"vault.unconfigured: the deployment has no usable vault master key yet; retry later. | vault.unavailable: the store or a credential check is unreachable; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultUnavailableEncoded"}}}}},"description":"Last writer wins: a new value is the next revision. The same fingerprint as the active entry answers it unchanged (a `delivery` or `allowedHosts` given still sets the policy, at the same revision). A new entry without them is `proxy` to the name's known hosts (GITHUB_TOKEN: api.github.com, ...), else to none; an update without them keeps its policy. Invalid hosts answer 400 vault.invalid_hosts. At most 100 active entries per user.","summary":"Save an env entry to the caller's vault","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultEnvWrite"}}},"required":true}},"delete":{"tags":["Vault env"],"operationId":"vaultEnv.remove","parameters":[{"name":"name","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"VaultEnvWritten","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultEnvWritten"}}}},"400":{"description":"vault.invalid_name: the name is not [A-Za-z_][A-Za-z0-9_]* of at most 128, or is one the machine owns (PATH, HOME, LD_*, CMUX_*, ...). | vault.invalid_value: valueBase64 is not padded base64 of 1-16384 bytes. | vault.fingerprint_mismatch: fingerprint is not the lowercase sha256 hex of the value. | vault.invalid_hosts: allowedHosts is not 0-16 lowercase DNS names (optionally `*.` and `:port`). | vault.no_entry: the name has no active entry to set a policy on.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultBadRequestEncoded"}}}},"401":{"description":"vault.unauthorized: a valid cmux access token or machine credential is required, or the machine was revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultUnauthorizedEncoded"}}}},"403":{"description":"vault.forbidden: this caller may not use this route (person routes refuse machines and agents). | vault.not_granted: the machine was never granted its owner's vault; the owner grants it with PUT /v1/machines/{id}/vault. | vault.grant_expired: the machine's grant lapsed; the owner renews it with PUT /v1/vault/grants/{kind}/{id}.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultForbiddenEncoded"}}}},"404":{"description":"vault.not_found: the vault is not enabled on this deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultNotFoundEncoded"}}}},"409":{"description":"vault.limit: the user already has 100 env entries saved; delete one first.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultConflictEncoded"}}}},"503":{"description":"vault.unconfigured: the deployment has no usable vault master key yet; retry later. | vault.unavailable: the store or a credential check is unreachable; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultUnavailableEncoded"}}}}},"description":"Drops the value and leaves a tombstone one revision later, so machines see it revoked and remove it. Deleting a name with nothing saved answers revision 0 and writes nothing; deleting a deleted one answers its tombstone unchanged.","summary":"Delete an env entry from the caller's vault"}},"/v1/vault/env/{name}/policy":{"put":{"tags":["Vault env"],"operationId":"vaultEnv.policy","parameters":[{"name":"name","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"VaultEnvPolicy","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultEnvPolicy"}}}},"400":{"description":"vault.invalid_name: the name is not [A-Za-z_][A-Za-z0-9_]* of at most 128, or is one the machine owns (PATH, HOME, LD_*, CMUX_*, ...). | vault.invalid_value: valueBase64 is not padded base64 of 1-16384 bytes. | vault.fingerprint_mismatch: fingerprint is not the lowercase sha256 hex of the value. | vault.invalid_hosts: allowedHosts is not 0-16 lowercase DNS names (optionally `*.` and `:port`). | vault.no_entry: the name has no active entry to set a policy on.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultBadRequestEncoded"}}}},"401":{"description":"vault.unauthorized: a valid cmux access token or machine credential is required, or the machine was revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultUnauthorizedEncoded"}}}},"403":{"description":"vault.forbidden: this caller may not use this route (person routes refuse machines and agents). | vault.not_granted: the machine was never granted its owner's vault; the owner grants it with PUT /v1/machines/{id}/vault. | vault.grant_expired: the machine's grant lapsed; the owner renews it with PUT /v1/vault/grants/{kind}/{id}.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultForbiddenEncoded"}}}},"404":{"description":"vault.not_found: the vault is not enabled on this deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultNotFoundEncoded"}}}},"409":{"description":"vault.limit: the user already has 100 env entries saved; delete one first.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultConflictEncoded"}}}},"503":{"description":"vault.unconfigured: the deployment has no usable vault master key yet; retry later. | vault.unavailable: the store or a credential check is unreachable; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultUnavailableEncoded"}}}}},"description":"`proxy`: agents get the placeholder `cmux-secret://NAME` and the machine's egress proxy sends the value only to `allowedHosts`; `env`: the value in the agents' environment (weaker: agents can read it). Changes no value and no revision. A field left out keeps the entry's own. A name with no active entry answers 400 vault.no_entry; invalid hosts answer 400 vault.invalid_hosts.","summary":"Set how an env entry reaches machines","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultEnvPolicyWrite"}}},"required":true}}},"/v1/vault/grants":{"get":{"tags":["Vault grants"],"operationId":"vaultGrants.list","parameters":[],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"grants":{"type":"array","items":{"$ref":"#/components/schemas/VaultGrant"}}},"required":["grants"],"additionalProperties":false}}}},"400":{"description":"vault.invalid_name: the name is not [A-Za-z_][A-Za-z0-9_]* of at most 128, or is one the machine owns (PATH, HOME, LD_*, CMUX_*, ...). | vault.invalid_value: valueBase64 is not padded base64 of 1-16384 bytes. | vault.fingerprint_mismatch: fingerprint is not the lowercase sha256 hex of the value. | vault.invalid_hosts: allowedHosts is not 0-16 lowercase DNS names (optionally `*.` and `:port`). | vault.no_entry: the name has no active entry to set a policy on.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultBadRequestEncoded"}}}},"401":{"description":"vault.unauthorized: a valid cmux access token or machine credential is required, or the machine was revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultUnauthorizedEncoded"}}}},"403":{"description":"vault.forbidden: this caller may not use this route (person routes refuse machines and agents). | vault.not_granted: the machine was never granted its owner's vault; the owner grants it with PUT /v1/machines/{id}/vault. | vault.grant_expired: the machine's grant lapsed; the owner renews it with PUT /v1/vault/grants/{kind}/{id}.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultForbiddenEncoded"}}}},"404":{"description":"vault.not_found: the vault is not enabled on this deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultNotFoundEncoded"}}}},"409":{"description":"vault.limit: the user already has 100 env entries saved; delete one first.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultConflictEncoded"}}}},"503":{"description":"vault.unconfigured: the deployment has no usable vault master key yet; retry later. | vault.unavailable: the store or a credential check is unreachable; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultUnavailableEncoded"}}}}},"description":"Each grant names its machine, the entries it may read and when it expires.","summary":"List the machines that may read the caller's vault"}},"/v1/vault/grants/joined/{id}":{"put":{"tags":["Vault grants"],"operationId":"vaultGrants.joined","parameters":[{"name":"id","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"VaultGrant","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultGrant"}}}},"400":{"description":"vault.invalid_name: the name is not [A-Za-z_][A-Za-z0-9_]* of at most 128, or is one the machine owns (PATH, HOME, LD_*, CMUX_*, ...). | vault.invalid_value: valueBase64 is not padded base64 of 1-16384 bytes. | vault.fingerprint_mismatch: fingerprint is not the lowercase sha256 hex of the value. | vault.invalid_hosts: allowedHosts is not 0-16 lowercase DNS names (optionally `*.` and `:port`). | vault.no_entry: the name has no active entry to set a policy on.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultBadRequestEncoded"}}}},"401":{"description":"vault.unauthorized: a valid cmux access token or machine credential is required, or the machine was revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultUnauthorizedEncoded"}}}},"403":{"description":"vault.forbidden: this caller may not use this route (person routes refuse machines and agents). | vault.not_granted: the machine was never granted its owner's vault; the owner grants it with PUT /v1/machines/{id}/vault. | vault.grant_expired: the machine's grant lapsed; the owner renews it with PUT /v1/vault/grants/{kind}/{id}.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultForbiddenEncoded"}}}},"404":{"description":"vault.not_found: the vault is not enabled on this deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultNotFoundEncoded"}}}},"409":{"description":"vault.limit: the user already has 100 env entries saved; delete one first.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultConflictEncoded"}}}},"503":{"description":"vault.unconfigured: the deployment has no usable vault master key yet; retry later. | vault.unavailable: the store or a credential check is unreachable; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultUnavailableEncoded"}}}}},"description":"The machine must be one the caller joined to their personal team and gave the vault (the join token's `vault: true` or PUT /v1/machines/{id}/vault). It then reads only `entries` (all when omitted) until `ttlSeconds` pass (default 7 days, at most 30). Writing again replaces the grant (a renewal).","summary":"Grant a joined machine some or all of the caller's vault, for a while","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultGrantWrite"}}},"required":true}},"delete":{"tags":["Vault grants"],"operationId":"vaultGrants.removeJoined","parameters":[{"name":"id","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"VaultGrantRemoved","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultGrantRemoved"}}}},"400":{"description":"vault.invalid_name: the name is not [A-Za-z_][A-Za-z0-9_]* of at most 128, or is one the machine owns (PATH, HOME, LD_*, CMUX_*, ...). | vault.invalid_value: valueBase64 is not padded base64 of 1-16384 bytes. | vault.fingerprint_mismatch: fingerprint is not the lowercase sha256 hex of the value. | vault.invalid_hosts: allowedHosts is not 0-16 lowercase DNS names (optionally `*.` and `:port`). | vault.no_entry: the name has no active entry to set a policy on.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultBadRequestEncoded"}}}},"401":{"description":"vault.unauthorized: a valid cmux access token or machine credential is required, or the machine was revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultUnauthorizedEncoded"}}}},"403":{"description":"vault.forbidden: this caller may not use this route (person routes refuse machines and agents). | vault.not_granted: the machine was never granted its owner's vault; the owner grants it with PUT /v1/machines/{id}/vault. | vault.grant_expired: the machine's grant lapsed; the owner renews it with PUT /v1/vault/grants/{kind}/{id}.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultForbiddenEncoded"}}}},"404":{"description":"vault.not_found: the vault is not enabled on this deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultNotFoundEncoded"}}}},"409":{"description":"vault.limit: the user already has 100 env entries saved; delete one first.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultConflictEncoded"}}}},"503":{"description":"vault.unconfigured: the deployment has no usable vault master key yet; retry later. | vault.unavailable: the store or a credential check is unreachable; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultUnavailableEncoded"}}}}},"description":"The machine is refused (403 vault.not_granted) until a new grant is written; it never falls back to the default grant. Listed afterwards with expiresAt 0.","summary":"Revoke a joined machine's grant"}},"/v1/vault/grants/cloud/{id}":{"put":{"tags":["Vault grants"],"operationId":"vaultGrants.cloud","parameters":[{"name":"id","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"VaultGrant","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultGrant"}}}},"400":{"description":"vault.invalid_name: the name is not [A-Za-z_][A-Za-z0-9_]* of at most 128, or is one the machine owns (PATH, HOME, LD_*, CMUX_*, ...). | vault.invalid_value: valueBase64 is not padded base64 of 1-16384 bytes. | vault.fingerprint_mismatch: fingerprint is not the lowercase sha256 hex of the value. | vault.invalid_hosts: allowedHosts is not 0-16 lowercase DNS names (optionally `*.` and `:port`). | vault.no_entry: the name has no active entry to set a policy on.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultBadRequestEncoded"}}}},"401":{"description":"vault.unauthorized: a valid cmux access token or machine credential is required, or the machine was revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultUnauthorizedEncoded"}}}},"403":{"description":"vault.forbidden: this caller may not use this route (person routes refuse machines and agents). | vault.not_granted: the machine was never granted its owner's vault; the owner grants it with PUT /v1/machines/{id}/vault. | vault.grant_expired: the machine's grant lapsed; the owner renews it with PUT /v1/vault/grants/{kind}/{id}.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultForbiddenEncoded"}}}},"404":{"description":"vault.not_found: the vault is not enabled on this deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultNotFoundEncoded"}}}},"409":{"description":"vault.limit: the user already has 100 env entries saved; delete one first.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultConflictEncoded"}}}},"503":{"description":"vault.unconfigured: the deployment has no usable vault master key yet; retry later. | vault.unavailable: the store or a credential check is unreachable; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultUnavailableEncoded"}}}}},"description":"As for a joined machine, keyed by the Cloud machine's install id.","summary":"Grant one of the caller's own Cloud machines (by install) some or all of their vault","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultGrantWrite"}}},"required":true}},"delete":{"tags":["Vault grants"],"operationId":"vaultGrants.removeCloud","parameters":[{"name":"id","in":"path","schema":{"type":"string","minLength":1,"maxLength":256},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"VaultGrantRemoved","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultGrantRemoved"}}}},"400":{"description":"vault.invalid_name: the name is not [A-Za-z_][A-Za-z0-9_]* of at most 128, or is one the machine owns (PATH, HOME, LD_*, CMUX_*, ...). | vault.invalid_value: valueBase64 is not padded base64 of 1-16384 bytes. | vault.fingerprint_mismatch: fingerprint is not the lowercase sha256 hex of the value. | vault.invalid_hosts: allowedHosts is not 0-16 lowercase DNS names (optionally `*.` and `:port`). | vault.no_entry: the name has no active entry to set a policy on.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultBadRequestEncoded"}}}},"401":{"description":"vault.unauthorized: a valid cmux access token or machine credential is required, or the machine was revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultUnauthorizedEncoded"}}}},"403":{"description":"vault.forbidden: this caller may not use this route (person routes refuse machines and agents). | vault.not_granted: the machine was never granted its owner's vault; the owner grants it with PUT /v1/machines/{id}/vault. | vault.grant_expired: the machine's grant lapsed; the owner renews it with PUT /v1/vault/grants/{kind}/{id}.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultForbiddenEncoded"}}}},"404":{"description":"vault.not_found: the vault is not enabled on this deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultNotFoundEncoded"}}}},"409":{"description":"vault.limit: the user already has 100 env entries saved; delete one first.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultConflictEncoded"}}}},"503":{"description":"vault.unconfigured: the deployment has no usable vault master key yet; retry later. | vault.unavailable: the store or a credential check is unreachable; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultUnavailableEncoded"}}}}},"description":"As for a joined machine: refused (403 vault.not_granted) until a new grant is written, never defaulted. Listed afterwards with expiresAt 0.","summary":"Revoke one of the caller's Cloud machines' grant (by install)"}},"/v1/vault/reads":{"get":{"tags":["Vault reads"],"operationId":"vaultReads.list","parameters":[],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"reads":{"type":"array","items":{"$ref":"#/components/schemas/VaultRead"}},"alerts":{"type":"array","items":{"$ref":"#/components/schemas/VaultReadAlert"}}},"required":["reads","alerts"],"additionalProperties":false}}}},"400":{"description":"vault.invalid_name: the name is not [A-Za-z_][A-Za-z0-9_]* of at most 128, or is one the machine owns (PATH, HOME, LD_*, CMUX_*, ...). | vault.invalid_value: valueBase64 is not padded base64 of 1-16384 bytes. | vault.fingerprint_mismatch: fingerprint is not the lowercase sha256 hex of the value. | vault.invalid_hosts: allowedHosts is not 0-16 lowercase DNS names (optionally `*.` and `:port`). | vault.no_entry: the name has no active entry to set a policy on.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultBadRequestEncoded"}}}},"401":{"description":"vault.unauthorized: a valid cmux access token or machine credential is required, or the machine was revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultUnauthorizedEncoded"}}}},"403":{"description":"vault.forbidden: this caller may not use this route (person routes refuse machines and agents). | vault.not_granted: the machine was never granted its owner's vault; the owner grants it with PUT /v1/machines/{id}/vault. | vault.grant_expired: the machine's grant lapsed; the owner renews it with PUT /v1/vault/grants/{kind}/{id}.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultForbiddenEncoded"}}}},"404":{"description":"vault.not_found: the vault is not enabled on this deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultNotFoundEncoded"}}}},"409":{"description":"vault.limit: the user already has 100 env entries saved; delete one first.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultConflictEncoded"}}}},"503":{"description":"vault.unconfigured: the deployment has no usable vault master key yet; retry later. | vault.unavailable: the store or a credential check is unreachable; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultUnavailableEncoded"}}}}},"description":"Every machine read is recorded (when, which machine, which entry names; never a value) for 30 days. An alert is raised for a machine's first read, a burst (more than 12 reads in 10 minutes from one machine) and an off-hours spike (3 or more reads in a UTC hour the vault saw none in over the previous 7 days). The newest 100 of each.","summary":"List the latest machine reads of the caller's vault, and the alerts they raised"}},"/v1/vault/machine":{"get":{"tags":["Vault (machine)"],"operationId":"vaultMachine.read","parameters":[{"name":"delivery","in":"query","schema":{"type":"string","description":"`proxy.v1`: this machine runs the egress proxy, so proxy entries carry their value. Without it a proxy entry reads `withheld` with no value.","examples":["proxy.v1"]},"required":false}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"MachineVault","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineVault"}}}},"400":{"description":"vault.invalid_name: the name is not [A-Za-z_][A-Za-z0-9_]* of at most 128, or is one the machine owns (PATH, HOME, LD_*, CMUX_*, ...). | vault.invalid_value: valueBase64 is not padded base64 of 1-16384 bytes. | vault.fingerprint_mismatch: fingerprint is not the lowercase sha256 hex of the value. | vault.invalid_hosts: allowedHosts is not 0-16 lowercase DNS names (optionally `*.` and `:port`). | vault.no_entry: the name has no active entry to set a policy on.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultBadRequestEncoded"}}}},"401":{"description":"vault.unauthorized: a valid cmux access token or machine credential is required, or the machine was revoked.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultUnauthorizedEncoded"}}}},"403":{"description":"vault.forbidden: this caller may not use this route (person routes refuse machines and agents). | vault.not_granted: the machine was never granted its owner's vault; the owner grants it with PUT /v1/machines/{id}/vault. | vault.grant_expired: the machine's grant lapsed; the owner renews it with PUT /v1/vault/grants/{kind}/{id}.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultForbiddenEncoded"}}}},"404":{"description":"vault.not_found: the vault is not enabled on this deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultNotFoundEncoded"}}}},"409":{"description":"vault.limit: the user already has 100 env entries saved; delete one first.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultConflictEncoded"}}}},"503":{"description":"vault.unconfigured: the deployment has no usable vault master key yet; retry later. | vault.unavailable: the store or a credential check is unreachable; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VaultUnavailableEncoded"}}}}},"description":"The owner's env entries, decrypted while active, so a machine they added starts with their keys; a deleted entry reads as revoked with no value, so the machine removes it. Every entry carries its `delivery` and `allowedHosts`; an active proxy entry carries its value only for `delivery=proxy.v1` and otherwise reads `withheld`, so an older machine never puts it in an agent's environment. The bearer is a joined machine's credential (`cmm_`) whose owner granted it the vault (`vault: true` on the join token or PUT /v1/machines/{id}/vault), on the owner's personal team and minted by them; or the owner's own solo Cloud machine install token. A revoked machine answers 401; one never granted answers 403 vault.not_granted, and one whose grant lapsed 403 vault.grant_expired. The answer holds only the entries the machine's grant names.","summary":"Read the owner's vault (a consenting machine)"}},"/v1/dep-cache/entries":{"get":{"tags":["Dependency caches"],"operationId":"depCache.list","parameters":[],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"DepCacheList","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DepCacheList"}}}},"400":{"description":"dep_cache.invalid_key: the key is not `<ecosystem>-<sha256 hex>`. | dep_cache.digest_mismatch: a part's SHA-256 is not x-dep-cache-sha256, or the parts' digest is not the commit's (nothing was stored). | dep_cache.body_required: a part has no body or no x-dep-cache-sha256. | dep_cache.upload_incomplete: the commit names parts that were not all uploaded, or a part other than the last is not 64 MiB.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DepCacheBadRequestEncoded"}}}},"401":{"description":"dep_cache.unauthorized: a cmux access token or a live machine credential is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DepCacheUnauthorizedEncoded"}}}},"403":{"description":"dep_cache.forbidden: agent tokens are refused, and only a person removes an archive from their own cache.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DepCacheForbiddenEncoded"}}}},"404":{"description":"dep_cache.not_found: dependency caches are not enabled on this deployment. | dep_cache.miss: no archive is stored under this key; install cold and upload one.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DepCacheNotFoundEncoded"}}}},"413":{"description":"dep_cache.too_large: a part is larger than 64 MiB, or the archive than 2 GiB or the scope's whole quota.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DepCacheTooLargeEncoded"}}}},"503":{"description":"dep_cache.unavailable: the cache or a credential check is unreachable; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DepCacheUnavailableEncoded"}}}}},"description":"The archives in the caller's scope, most recently used first, with the bytes used and the quota. A person and their own machines see the person's cache; a team machine sees its team's.","summary":"List the caller's dependency caches"}},"/v1/dep-cache/entries/{key}":{"get":{"tags":["Dependency caches"],"operationId":"depCache.read","parameters":[{"name":"key","in":"path","schema":{"type":"string","description":"`<ecosystem>-<sha256 hex>` (bun, npm, pnpm, yarn, cargo or uv), computed by the machine.","examples":["cargo-0000000000000000000000000000000000000000000000000000000000000000"]},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Success","content":{"application/octet-stream":{"schema":{"type":"string","format":"binary"}}}},"400":{"description":"dep_cache.invalid_key: the key is not `<ecosystem>-<sha256 hex>`. | dep_cache.digest_mismatch: a part's SHA-256 is not x-dep-cache-sha256, or the parts' digest is not the commit's (nothing was stored). | dep_cache.body_required: a part has no body or no x-dep-cache-sha256. | dep_cache.upload_incomplete: the commit names parts that were not all uploaded, or a part other than the last is not 64 MiB.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DepCacheBadRequestEncoded"}}}},"401":{"description":"dep_cache.unauthorized: a cmux access token or a live machine credential is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DepCacheUnauthorizedEncoded"}}}},"403":{"description":"dep_cache.forbidden: agent tokens are refused, and only a person removes an archive from their own cache.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DepCacheForbiddenEncoded"}}}},"404":{"description":"dep_cache.not_found: dependency caches are not enabled on this deployment. | dep_cache.miss: no archive is stored under this key; install cold and upload one.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DepCacheNotFoundEncoded"}}}},"413":{"description":"dep_cache.too_large: a part is larger than 64 MiB, or the archive than 2 GiB or the scope's whole quota.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DepCacheTooLargeEncoded"}}}},"503":{"description":"dep_cache.unavailable: the cache or a credential check is unreachable; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DepCacheUnavailableEncoded"}}}}},"description":"The zstd tar archive stored under the key, streamed, with its size in x-dep-cache-size and its digest (SHA-256 over each 64 MiB part's SHA-256) in x-dep-cache-sha256, so the machine verifies it as it unpacks. 404 dep_cache.miss when nothing is stored: install cold, then upload. Marks the archive used, so eviction keeps it.","summary":"Download a dependency cache"},"delete":{"tags":["Dependency caches"],"operationId":"depCache.remove","parameters":[{"name":"key","in":"path","schema":{"type":"string","description":"`<ecosystem>-<sha256 hex>` (bun, npm, pnpm, yarn, cargo or uv), computed by the machine.","examples":["cargo-0000000000000000000000000000000000000000000000000000000000000000"]},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"DepCacheRemoved","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DepCacheRemoved"}}}},"400":{"description":"dep_cache.invalid_key: the key is not `<ecosystem>-<sha256 hex>`. | dep_cache.digest_mismatch: a part's SHA-256 is not x-dep-cache-sha256, or the parts' digest is not the commit's (nothing was stored). | dep_cache.body_required: a part has no body or no x-dep-cache-sha256. | dep_cache.upload_incomplete: the commit names parts that were not all uploaded, or a part other than the last is not 64 MiB.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DepCacheBadRequestEncoded"}}}},"401":{"description":"dep_cache.unauthorized: a cmux access token or a live machine credential is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DepCacheUnauthorizedEncoded"}}}},"403":{"description":"dep_cache.forbidden: agent tokens are refused, and only a person removes an archive from their own cache.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DepCacheForbiddenEncoded"}}}},"404":{"description":"dep_cache.not_found: dependency caches are not enabled on this deployment. | dep_cache.miss: no archive is stored under this key; install cold and upload one.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DepCacheNotFoundEncoded"}}}},"413":{"description":"dep_cache.too_large: a part is larger than 64 MiB, or the archive than 2 GiB or the scope's whole quota.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DepCacheTooLargeEncoded"}}}},"503":{"description":"dep_cache.unavailable: the cache or a credential check is unreachable; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DepCacheUnavailableEncoded"}}}}},"description":"A person removes an archive from their own cache. Machines are refused.","summary":"Remove a dependency cache"}},"/v1/dep-cache/entries/{key}/uploads/{upload}/parts/{part}":{"put":{"tags":["Dependency caches"],"operationId":"depCache.writePart","parameters":[{"name":"key","in":"path","schema":{"type":"string","description":"`<ecosystem>-<sha256 hex>` (bun, npm, pnpm, yarn, cargo or uv), computed by the machine.","examples":["cargo-0000000000000000000000000000000000000000000000000000000000000000"]},"required":true},{"name":"upload","in":"path","schema":{"type":"string","description":"A client-chosen upload id (8 to 64 of A-Z, a-z, 0-9, _ and -), the same for every part and the commit."},"required":true},{"name":"part","in":"path","schema":{"type":"string"},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"DepCachePart","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DepCachePart"}}}},"400":{"description":"dep_cache.invalid_key: the key is not `<ecosystem>-<sha256 hex>`. | dep_cache.digest_mismatch: a part's SHA-256 is not x-dep-cache-sha256, or the parts' digest is not the commit's (nothing was stored). | dep_cache.body_required: a part has no body or no x-dep-cache-sha256. | dep_cache.upload_incomplete: the commit names parts that were not all uploaded, or a part other than the last is not 64 MiB.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DepCacheBadRequestEncoded"}}}},"401":{"description":"dep_cache.unauthorized: a cmux access token or a live machine credential is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DepCacheUnauthorizedEncoded"}}}},"403":{"description":"dep_cache.forbidden: agent tokens are refused, and only a person removes an archive from their own cache.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DepCacheForbiddenEncoded"}}}},"404":{"description":"dep_cache.not_found: dependency caches are not enabled on this deployment. | dep_cache.miss: no archive is stored under this key; install cold and upload one.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DepCacheNotFoundEncoded"}}}},"413":{"description":"dep_cache.too_large: a part is larger than 64 MiB, or the archive than 2 GiB or the scope's whole quota.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DepCacheTooLargeEncoded"}}}},"503":{"description":"dep_cache.unavailable: the cache or a credential check is unreachable; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DepCacheUnavailableEncoded"}}}}},"description":"Part `part` of a zstd tar archive (every part 64 MiB but the last), under a client-chosen upload id. x-dep-cache-sha256 (lowercase hex of the part) is required, and a part whose bytes do not match it is dropped; a retried part replaces the earlier attempt. When the key is already stored nothing is kept and exists is true. An upload not committed within an hour is dropped.","summary":"Upload one part of a dependency cache","requestBody":{"content":{"application/octet-stream":{"schema":{"type":"string","format":"binary"}}},"required":true}}},"/v1/dep-cache/entries/{key}/uploads/{upload}/commit":{"post":{"tags":["Dependency caches"],"operationId":"depCache.commit","parameters":[{"name":"key","in":"path","schema":{"type":"string","description":"`<ecosystem>-<sha256 hex>` (bun, npm, pnpm, yarn, cargo or uv), computed by the machine.","examples":["cargo-0000000000000000000000000000000000000000000000000000000000000000"]},"required":true},{"name":"upload","in":"path","schema":{"type":"string","description":"A client-chosen upload id (8 to 64 of A-Z, a-z, 0-9, _ and -), the same for every part and the commit."},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"DepCacheStored","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DepCacheStored"}}}},"400":{"description":"dep_cache.invalid_key: the key is not `<ecosystem>-<sha256 hex>`. | dep_cache.digest_mismatch: a part's SHA-256 is not x-dep-cache-sha256, or the parts' digest is not the commit's (nothing was stored). | dep_cache.body_required: a part has no body or no x-dep-cache-sha256. | dep_cache.upload_incomplete: the commit names parts that were not all uploaded, or a part other than the last is not 64 MiB.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DepCacheBadRequestEncoded"}}}},"401":{"description":"dep_cache.unauthorized: a cmux access token or a live machine credential is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DepCacheUnauthorizedEncoded"}}}},"403":{"description":"dep_cache.forbidden: agent tokens are refused, and only a person removes an archive from their own cache.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DepCacheForbiddenEncoded"}}}},"404":{"description":"dep_cache.not_found: dependency caches are not enabled on this deployment. | dep_cache.miss: no archive is stored under this key; install cold and upload one.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DepCacheNotFoundEncoded"}}}},"413":{"description":"dep_cache.too_large: a part is larger than 64 MiB, or the archive than 2 GiB or the scope's whole quota.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DepCacheTooLargeEncoded"}}}},"503":{"description":"dep_cache.unavailable: the cache or a credential check is unreachable; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DepCacheUnavailableEncoded"}}}}},"description":"Store the upload's parts under the key, once every part 0..parts-1 is present and the SHA-256 over the parts' digests is `sha256`. Idempotent: a key already stored keeps its archive and answers created false. Past the scope's quota the least recently used archives are evicted first.","summary":"Publish an uploaded dependency cache","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DepCacheCommit"}}},"required":true}}},"/v1/chief/me":{"get":{"tags":["Chief"],"operationId":"chief.me","parameters":[],"security":[],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"chiefId":{"type":"string"},"mainConversationId":{"type":"string"},"handle":{"type":"string"}},"required":["chiefId","mainConversationId","handle"],"additionalProperties":false}}}},"401":{"description":"ChiefUnauthorized: sign in again with a valid human cmux session.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ChiefUnauthorizedEncoded"}}}},"403":{"description":"ChiefForbidden: send cookie mutations from the configured platform origin.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ChiefForbiddenEncoded"}}}},"404":{"description":"ChiefNotFound: the current user has no accessible default Chief main conversation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ChiefNotFoundEncoded"}}}},"503":{"description":"ChiefUnavailable: the Chief service is temporarily unavailable; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ChiefUnavailableEncoded"}}}}},"description":"Returns the caller's default Chief id, main conversation id and immutable handle. Other people's Chiefs are never returned.","summary":"Read the signed-in person's Chief address"}},"/v1/chief/ticket":{"post":{"tags":["Chief"],"operationId":"chief.ticket","parameters":[],"security":[],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"ticket":{"type":"string"},"websocketUrl":{"type":"string"}},"required":["ticket","websocketUrl"],"additionalProperties":false}}}},"401":{"description":"ChiefUnauthorized: sign in again with a valid human cmux session.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ChiefUnauthorizedEncoded"}}}},"403":{"description":"ChiefForbidden: send cookie mutations from the configured platform origin.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ChiefForbiddenEncoded"}}}},"404":{"description":"ChiefNotFound: the current user has no accessible default Chief main conversation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ChiefNotFoundEncoded"}}}},"503":{"description":"ChiefUnavailable: the Chief service is temporarily unavailable; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ChiefUnavailableEncoded"}}}}},"description":"Returns a single-use ticket valid for at most 30 seconds and its websocketUrl. Open with subprotocols cmux.wire.v1 and ticket.<ticket>; the server rechecks ownership and the current main conversation.","summary":"Mint a main-conversation WebSocket ticket"}},"/v1/chief/messages":{"post":{"tags":["Chief"],"operationId":"chief.messages","parameters":[],"security":[],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"ok":{"type":"boolean"},"clientMessageId":{"type":"string"},"receipt":{"type":"object"}},"required":["ok","clientMessageId","receipt"],"additionalProperties":false}}}},"401":{"description":"ChiefUnauthorized: sign in again with a valid human cmux session.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ChiefUnauthorizedEncoded"}}}},"403":{"description":"ChiefForbidden: send cookie mutations from the configured platform origin.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ChiefForbiddenEncoded"}}}},"404":{"description":"ChiefNotFound: the current user has no accessible default Chief main conversation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ChiefNotFoundEncoded"}}}},"503":{"description":"ChiefUnavailable: the Chief service is temporarily unavailable; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ChiefUnavailableEncoded"}}}}},"description":"Submits text to the caller's current main conversation. Retain clientMessageId on retries. The authoritative Home receipt may return ok=false even on HTTP 200; only ok=true means the message was accepted.","summary":"Send a message to the caller's Chief","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"text":{"type":"string","minLength":1},"clientMessageId":{"type":"string"}},"required":["text"],"additionalProperties":false}}},"required":true}}},"/v1/chief/machine-login/{run}":{"get":{"tags":["Chief"],"operationId":"chiefMachineLogin.status","parameters":[{"name":"run","in":"path","schema":{"type":"string"},"required":true}],"security":[],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"ok":{"type":"boolean","enum":[true]},"value":{"$ref":"#/components/schemas/ChiefMachineLoginStatus"}},"required":["ok","value"],"additionalProperties":false}}}},"400":{"description":"validation.invalid: send a valid run and strict action body.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ChiefMachineLoginError400"}}}},"401":{"description":"auth.unauthenticated: sign in to cmux again.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ChiefMachineLoginError401"}}}},"403":{"description":"auth.forbidden: a same-origin owner human session is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ChiefMachineLoginError403"}}}},"404":{"description":"not_found: the owner's main run is unavailable or no longer waiting.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ChiefMachineLoginError404"}}}},"405":{"description":"method_not_allowed: use GET or POST for this run.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ChiefMachineLoginError405"}}}},"409":{"description":"chief.machine.login_changed: read the run's current sign-in status again. | chief.machine.login_busy: sign-in is starting; read its status again.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ChiefMachineLoginError409"}}}},"410":{"description":"chief.machine.login_expired: start a new provider sign-in.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ChiefMachineLoginError410"}}}},"503":{"description":"chief.machine.login_unavailable: retry provider sign-in after a delay. | owner.unreachable: retry the account policy check after a delay.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ChiefMachineLoginError503"}}}}},"description":"Observe the owner's pending main run without starting OAuth or resuming work. The Chief and main conversation are resolved server-side from the cmux session; the browser supplies only the run id. Responses are no-store and no-referrer.","summary":"Read the Chief machine's pending sign-in"},"post":{"tags":["Chief"],"operationId":"chiefMachineLogin.action","parameters":[{"name":"run","in":"path","schema":{"type":"string"},"required":true}],"security":[],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"ok":{"type":"boolean","enum":[true]},"value":{"anyOf":[{"$ref":"#/components/schemas/ChiefMachineLoginStart"},{"$ref":"#/components/schemas/ChiefMachineLoginFinish"},{"$ref":"#/components/schemas/ChiefMachineLoginCancel"}]}},"required":["ok","value"],"additionalProperties":false}}}},"400":{"description":"validation.invalid: send a valid run and strict action body.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ChiefMachineLoginError400"}}}},"401":{"description":"auth.unauthenticated: sign in to cmux again.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ChiefMachineLoginError401"}}}},"403":{"description":"auth.forbidden: a same-origin owner human session is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ChiefMachineLoginError403"}}}},"404":{"description":"not_found: the owner's main run is unavailable or no longer waiting.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ChiefMachineLoginError404"}}}},"405":{"description":"method_not_allowed: use GET or POST for this run.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ChiefMachineLoginError405"}}}},"409":{"description":"chief.machine.login_changed: read the run's current sign-in status again. | chief.machine.login_busy: sign-in is starting; read its status again.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ChiefMachineLoginError409"}}}},"410":{"description":"chief.machine.login_expired: start a new provider sign-in.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ChiefMachineLoginError410"}}}},"503":{"description":"chief.machine.login_unavailable: retry provider sign-in after a delay. | owner.unreachable: retry the account policy check after a delay.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ChiefMachineLoginError503"}}}}},"description":"Start, finish or cancel provider sign-in using the owner's human cmux session. Cookie mutations require this platform's Origin. Provider credentials stay on the machine. Finish may wait sixteen minutes for device sign-in; retry an ambiguous finish without replaying the code. A signedIn=false value does not resume work. Responses are no-store and no-referrer.","summary":"Sign in the Chief's machine and resume its run","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ChiefMachineLoginInput"}}},"required":true}}},"/v1/auth/challenge":{"post":{"tags":["Authentication"],"operationId":"auth.challenge","parameters":[],"security":[],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"install":{"type":"string"},"nonce":{"type":"string"},"expires_at":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"message_prefix":{"type":"string"}},"required":["install","nonce","expires_at","message_prefix"],"additionalProperties":false}}}},"400":{"description":"BadRequest: the request body is malformed or fails schema validation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BadRequestEncoded"}}}},"403":{"description":"Forbidden: the caller is not allowed to perform this operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ForbiddenEncoded"}}}}},"description":"Creates a one-time nonce for an install. The client signs the returned message prefix and nonce before redeeming it.","summary":"Issue an install challenge","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"user":{"type":"string"},"install":{"type":"string"},"team":{"type":"string"}},"required":["user","install"],"additionalProperties":false}}},"required":true}}},"/v1/auth/token":{"post":{"tags":["Authentication"],"operationId":"auth.token","parameters":[],"security":[],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"access_token":{"type":"string"},"token_type":{"type":"string","enum":["Bearer"]},"expires_at":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"user":{"type":"string"},"team":{"type":"string"},"install":{"type":"string"},"grant":{"type":"string"}},"required":["access_token","token_type","expires_at","user","team","install","grant"],"additionalProperties":false}}}},"400":{"description":"BadRequest: the request body is malformed or fails schema validation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BadRequestEncoded"}}}},"403":{"description":"Forbidden: the caller is not allowed to perform this operation. | PolicyRefused: the team policy refuses this sign-in.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/ForbiddenEncoded"},{"$ref":"#/components/schemas/PolicyRefusedEncoded"}]}}}},"503":{"description":"OwnerUnreachable: an owner could not be reached; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OwnerUnreachableEncoded"}}}}},"description":"Verifies the install signature and policy, then mints a short-lived cmux access token.","summary":"Redeem an install challenge","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"user":{"type":"string"},"install":{"type":"string"},"nonce":{"type":"string"},"signature":{"type":"string"},"agent":{"type":"string"}},"required":["user","install","nonce","signature"],"additionalProperties":false}}},"required":true}}},"/.well-known/jwks.json":{"get":{"tags":["JWKS"],"operationId":"jwks.get","parameters":[],"security":[],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"keys":{"type":"array"}},"required":["keys"],"additionalProperties":false}}}}},"description":"Returns the public ES256 keys used to verify cmux install access tokens.","summary":"Publish the access-token verification keys"}},"/v1/host/network/target":{"get":{"tags":["Native network"],"operationId":"nativeNetwork.target","parameters":[{"name":"mesh","in":"query","schema":{"$ref":"#/components/schemas/NativeMeshId"},"required":false}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"The server-selected Native network target for the authenticated client install.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NativeNetworkTarget"}}}},"400":{"description":"validation.invalid: the network target selector is invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NativeNetworkBadRequestEncoded"}}}},"401":{"description":"auth.unauthenticated: an install access token is required. | NativeNetworkUnauthorized: an install access token is required. | Unauthenticated: an access token is missing or invalid.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/NativeNetworkUnauthorizedEncoded"},{"$ref":"#/components/schemas/UnauthenticatedEncoded"}]}}}},"403":{"description":"auth.forbidden: the install cannot discover this network. | Forbidden: the caller is not allowed to perform this operation. | PolicyRefused: the team policy refuses this sign-in.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/NativeNetworkForbiddenEncoded"},{"$ref":"#/components/schemas/ForbiddenEncoded"},{"$ref":"#/components/schemas/PolicyRefusedEncoded"}]}}}},"404":{"description":"selector.not_found: the requested Native mesh was not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/NativeNetworkNotFoundEncoded"}}}},"503":{"description":"owner.unreachable: network target discovery is unavailable; retry. | OwnerUnreachable: an owner could not be reached; retry the request.","content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/NativeNetworkUnavailableEncoded"},{"$ref":"#/components/schemas/OwnerUnreachableEncoded"}]}}}}},"description":"Returns only server-selected routing metadata. The request cannot create a tenant or mesh and never accepts origin, tenant or project from the caller.","summary":"Discover the authenticated client's Native network target"}},"/v1/cloud/machines/{machine}/previews/refresh":{"post":{"tags":["Machines"],"operationId":"cloudPreviews.refresh","parameters":[{"name":"machine","in":"path","schema":{"type":"string"},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"CloudPreviewCatalog","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CloudPreviewCatalog"}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}},"description":"Discovers current TCP listeners on the caller's own new-architecture Cloud machine and reconciles private HTTPS ingress. Each returned URL authenticates before the machine wakes or receives a request. Stopped listeners lose their ingress; partial provider failures are listed by port. URLs carry short-lived credentials: keep the response private and do not cache it. Development and staging only.","summary":"Discover a Cloud machine's live previews"}},"/v1/cloud/machines/{machine}/previews/{port}":{"get":{"tags":["Machines"],"operationId":"cloudPreviews.open","parameters":[{"name":"machine","in":"path","schema":{"type":"string"},"required":true},{"name":"port","in":"path","schema":{"type":"string"},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"port":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"origin":{"type":"string"},"url":{"type":"string"},"expiresAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991}},"required":["port","origin","url","expiresAt"],"additionalProperties":false}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}}}},"/v1/cloud/machines/{machine}/previews/{port}/grants":{"get":{"tags":["Machines"],"operationId":"cloudPreviews.grants","parameters":[{"name":"machine","in":"path","schema":{"type":"string"},"required":true},{"name":"port","in":"path","schema":{"type":"string"},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"grants":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string","enum":["user","team"]},"id":{"type":"string"}},"required":["kind","id"],"additionalProperties":false}}},"required":["grants"],"additionalProperties":false}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}}},"put":{"tags":["Machines"],"operationId":"cloudPreviews.grant","parameters":[{"name":"machine","in":"path","schema":{"type":"string"},"required":true},{"name":"port","in":"path","schema":{"type":"string"},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"grants":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string","enum":["user","team"]},"id":{"type":"string"}},"required":["kind","id"],"additionalProperties":false}}},"required":["grants"],"additionalProperties":false}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}},"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"kind":{"type":"string","enum":["user","team"]},"id":{"type":"string"}},"required":["kind","id"],"additionalProperties":false}}},"required":true}},"delete":{"tags":["Machines"],"operationId":"cloudPreviews.revokeGrant","parameters":[{"name":"machine","in":"path","schema":{"type":"string"},"required":true},{"name":"port","in":"path","schema":{"type":"string"},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"grants":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string","enum":["user","team"]},"id":{"type":"string"}},"required":["kind","id"],"additionalProperties":false}}},"required":["grants"],"additionalProperties":false}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}},"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"kind":{"type":"string","enum":["user","team"]},"id":{"type":"string"}},"required":["kind","id"],"additionalProperties":false}}},"required":true}}},"/v1/cloud/machines/{machine}/previews/{port}/links":{"post":{"tags":["Machines"],"operationId":"cloudPreviews.createLink","parameters":[{"name":"machine","in":"path","schema":{"type":"string"},"required":true},{"name":"port","in":"path","schema":{"type":"string"},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"link":{"type":"object","properties":{"linkId":{"type":"string"},"creator":{"type":"string"},"team":{"type":"string"},"machine":{"type":"string"},"port":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"hostname":{"type":"string"},"ruleId":{"type":"string"},"createdAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"expiresAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"maxUses":{"anyOf":[{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},{"type":"null"}]},"redemptions":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"revokedAt":{"anyOf":[{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},{"type":"null"}]}},"required":["linkId","creator","team","machine","port","hostname","ruleId","createdAt","expiresAt","maxUses","redemptions","revokedAt"],"additionalProperties":false},"url":{"type":"string"}},"required":["link","url"],"additionalProperties":false}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}},"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"expiresAt":{"type":"integer","maximum":9007199254740991,"exclusiveMinimum":0},"maxUses":{"type":"integer","maximum":9007199254740991,"exclusiveMinimum":0}},"additionalProperties":false}}},"required":true}},"get":{"tags":["Machines"],"operationId":"cloudPreviews.links","parameters":[{"name":"machine","in":"path","schema":{"type":"string"},"required":true},{"name":"port","in":"path","schema":{"type":"string"},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"links":{"type":"array","items":{"type":"object","properties":{"linkId":{"type":"string"},"creator":{"type":"string"},"team":{"type":"string"},"machine":{"type":"string"},"port":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"hostname":{"type":"string"},"ruleId":{"type":"string"},"createdAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"expiresAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"maxUses":{"anyOf":[{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},{"type":"null"}]},"redemptions":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"revokedAt":{"anyOf":[{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},{"type":"null"}]}},"required":["linkId","creator","team","machine","port","hostname","ruleId","createdAt","expiresAt","maxUses","redemptions","revokedAt"],"additionalProperties":false}}},"required":["links"],"additionalProperties":false}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}}}},"/v1/cloud/machines/{machine}/previews/{port}/links/{linkId}":{"delete":{"tags":["Machines"],"operationId":"cloudPreviews.revokeLink","parameters":[{"name":"machine","in":"path","schema":{"type":"string"},"required":true},{"name":"port","in":"path","schema":{"type":"string"},"required":true},{"name":"linkId","in":"path","schema":{"type":"string"},"required":true}],"security":[{"cmuxAccessToken":[]}],"responses":{"200":{"description":"Success","content":{"application/json":{"schema":{"type":"object","properties":{"revoked":{"type":"boolean"}},"required":["revoked"],"additionalProperties":false}}}},"400":{"description":"MachineBadRequest: the request or current machine state conflicts with this operation; inspect its code before retrying.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineBadRequestEncoded"}}}},"401":{"description":"MachineUnauthorized: a valid machine API bearer is required; authenticate and retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnauthorizedEncoded"}}}},"403":{"description":"MachineForbidden: the current principal cannot perform this operation; check its permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineForbiddenEncoded"}}}},"404":{"description":"MachineNotFound: the machine or enabled API surface is absent; check the identifier and deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineNotFoundEncoded"}}}},"503":{"description":"MachineUnavailable: the provider or machine service cannot complete this operation; retry with the same client key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MachineUnavailableEncoded"}}}}}}}},"components":{"schemas":{"MachineUnavailableEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["MachineUnavailable"]},"code":{"type":"string"},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"MachineNotFoundEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["MachineNotFound"]},"code":{"type":"string"},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"MachineForbiddenEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["MachineForbidden"]},"code":{"type":"string"},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"MachineUnauthorizedEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["MachineUnauthorized"]},"code":{"type":"string"},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"MachineBadRequestEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["MachineBadRequest"]},"code":{"type":"string"},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"CloudPreviewCatalog":{"type":"object","properties":{"machine":{"type":"string"},"listening":{"type":"array","items":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991}},"previews":{"type":"array","items":{"type":"object","properties":{"port":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"origin":{"type":"string"},"url":{"type":"string"},"expiresAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991}},"required":["port","origin","url","expiresAt"],"additionalProperties":false}},"unavailable":{"type":"array","items":{"type":"object","properties":{"port":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"code":{"type":"string"}},"required":["port","code"],"additionalProperties":false}}},"required":["machine","listening","previews","unavailable"],"additionalProperties":false},"OwnerUnreachableEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["OwnerUnreachable"]},"code":{"type":"string","enum":["owner.unreachable"]},"message":{"type":"string"},"retryable":{"type":"boolean"}},"required":["_tag","code","message","retryable"],"additionalProperties":false},"NativeNetworkUnavailableEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["NativeNetworkUnavailable"]},"code":{"type":"string","description":"A stable error code; branch on it, never on message.","examples":["owner.unreachable"]},"message":{"type":"string","examples":["network target discovery is unavailable; retry"]}},"required":["_tag","code","message"],"additionalProperties":false},"NativeNetworkNotFoundEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["NativeNetworkNotFound"]},"code":{"type":"string","description":"A stable error code; branch on it, never on message.","examples":["selector.not_found"]},"message":{"type":"string","examples":["the requested Native mesh was not found"]}},"required":["_tag","code","message"],"additionalProperties":false},"PolicyRefusedEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["PolicyRefused"]},"code":{"type":"string","enum":["auth.sso_required","client.too_old","policy.denied"]},"message":{"type":"string"},"minimum_version":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"ForbiddenEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["Forbidden"]},"code":{"type":"string","enum":["auth.forbidden","team.not_member"]},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"NativeNetworkForbiddenEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["NativeNetworkForbidden"]},"code":{"type":"string","description":"A stable error code; branch on it, never on message.","examples":["auth.forbidden"]},"message":{"type":"string","examples":["the install cannot discover this network"]}},"required":["_tag","code","message"],"additionalProperties":false},"UnauthenticatedEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["Unauthenticated"]},"code":{"type":"string","enum":["auth.unauthenticated"]},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"NativeNetworkUnauthorizedEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["NativeNetworkUnauthorized"]},"code":{"type":"string","description":"A stable error code; branch on it, never on message.","examples":["auth.unauthenticated"]},"message":{"type":"string","examples":["an install access token is required"]}},"required":["_tag","code","message"],"additionalProperties":false},"NativeNetworkBadRequestEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["NativeNetworkBadRequest"]},"code":{"type":"string","description":"A stable error code; branch on it, never on message.","examples":["validation.invalid"]},"message":{"type":"string","examples":["invalid network target selector"]}},"required":["_tag","code","message"],"additionalProperties":false},"NativeNetworkTarget":{"type":"object","properties":{"team":{"$ref":"#/components/schemas/TeamId"},"tenant":{"$ref":"#/components/schemas/NativeTenantId"},"project":{"type":"string","minLength":1,"maxLength":256},"origin":{"type":"string","maxLength":2048,"description":"The configured Native service origin; it is selected by the server."},"mesh":{"$ref":"#/components/schemas/NativeMeshId"},"ipv4_cidr":{"type":"string"}},"required":["team","tenant","project","origin","mesh","ipv4_cidr"],"additionalProperties":false,"description":"The server-selected Native network target for the authenticated client install."},"NativeMeshId":{"type":"string"},"NativeTenantId":{"type":"string"},"TeamId":{"type":"string"},"BadRequestEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["BadRequest"]},"code":{"type":"string","enum":["validation.invalid"]},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"ChiefMachineLoginError503":{"type":"object","properties":{"ok":{"type":"boolean","enum":[false]},"error":{"type":"object","properties":{"code":{"type":"string","enum":["chief.machine.login_unavailable","owner.unreachable"]},"message":{"type":"string"},"retryable":{"type":"boolean"}},"required":["code","message"],"additionalProperties":false}},"required":["ok","error"],"additionalProperties":false,"description":"chief.machine.login_unavailable: retry provider sign-in after a delay. | owner.unreachable: retry the account policy check after a delay."},"ChiefMachineLoginError410":{"type":"object","properties":{"ok":{"type":"boolean","enum":[false]},"error":{"type":"object","properties":{"code":{"type":"string","enum":["chief.machine.login_expired"]},"message":{"type":"string"},"retryable":{"type":"boolean"}},"required":["code","message"],"additionalProperties":false}},"required":["ok","error"],"additionalProperties":false,"description":"chief.machine.login_expired: start a new provider sign-in."},"ChiefMachineLoginError409":{"type":"object","properties":{"ok":{"type":"boolean","enum":[false]},"error":{"type":"object","properties":{"code":{"type":"string","enum":["chief.machine.login_changed","chief.machine.login_busy"]},"message":{"type":"string"},"retryable":{"type":"boolean"}},"required":["code","message"],"additionalProperties":false}},"required":["ok","error"],"additionalProperties":false,"description":"chief.machine.login_changed: read the run's current sign-in status again. | chief.machine.login_busy: sign-in is starting; read its status again."},"ChiefMachineLoginError405":{"type":"object","properties":{"ok":{"type":"boolean","enum":[false]},"error":{"type":"object","properties":{"code":{"type":"string","enum":["method_not_allowed"]},"message":{"type":"string"},"retryable":{"type":"boolean"}},"required":["code","message"],"additionalProperties":false}},"required":["ok","error"],"additionalProperties":false,"description":"method_not_allowed: use GET or POST for this run."},"ChiefMachineLoginError404":{"type":"object","properties":{"ok":{"type":"boolean","enum":[false]},"error":{"type":"object","properties":{"code":{"type":"string","enum":["not_found"]},"message":{"type":"string"},"retryable":{"type":"boolean"}},"required":["code","message"],"additionalProperties":false}},"required":["ok","error"],"additionalProperties":false,"description":"not_found: the owner's main run is unavailable or no longer waiting."},"ChiefMachineLoginError403":{"type":"object","properties":{"ok":{"type":"boolean","enum":[false]},"error":{"type":"object","properties":{"code":{"type":"string","enum":["auth.forbidden"]},"message":{"type":"string"},"retryable":{"type":"boolean"}},"required":["code","message"],"additionalProperties":false}},"required":["ok","error"],"additionalProperties":false,"description":"auth.forbidden: a same-origin owner human session is required."},"ChiefMachineLoginError401":{"type":"object","properties":{"ok":{"type":"boolean","enum":[false]},"error":{"type":"object","properties":{"code":{"type":"string","enum":["auth.unauthenticated"]},"message":{"type":"string"},"retryable":{"type":"boolean"}},"required":["code","message"],"additionalProperties":false}},"required":["ok","error"],"additionalProperties":false,"description":"auth.unauthenticated: sign in to cmux again."},"ChiefMachineLoginError400":{"type":"object","properties":{"ok":{"type":"boolean","enum":[false]},"error":{"type":"object","properties":{"code":{"type":"string","enum":["validation.invalid"]},"message":{"type":"string"},"retryable":{"type":"boolean"}},"required":["code","message"],"additionalProperties":false}},"required":["ok","error"],"additionalProperties":false,"description":"validation.invalid: send a valid run and strict action body."},"ChiefMachineLoginCancel":{"type":"object","properties":{"cancelled":{"type":"boolean","enum":[true]}},"required":["cancelled"],"additionalProperties":false},"ChiefMachineLoginFinish":{"anyOf":[{"$ref":"#/components/schemas/ChiefMachineLoginResumed"},{"type":"object","properties":{"signedIn":{"type":"boolean","enum":[false]}},"required":["signedIn"],"additionalProperties":false}]},"ChiefMachineLoginResumed":{"type":"object","properties":{"signedIn":{"type":"boolean","enum":[true]},"resumed":{"type":"boolean","enum":[true]}},"required":["signedIn","resumed"],"additionalProperties":false},"ChiefMachineLoginStart":{"type":"object","properties":{"loginId":{"type":"string"},"url":{"type":"string"},"needsCode":{"type":"boolean"},"userCode":{"type":"string"},"expiresAtMs":{"type":"number"}},"required":["loginId","url","needsCode"],"additionalProperties":false},"ChiefMachineLoginInput":{"anyOf":[{"type":"object","properties":{"action":{"type":"string","enum":["start"]}},"required":["action"],"additionalProperties":false},{"type":"object","properties":{"action":{"type":"string","enum":["finish"]},"loginId":{"type":"string"},"code":{"type":"string","maxLength":8192}},"required":["action","loginId"],"additionalProperties":false},{"type":"object","properties":{"action":{"type":"string","enum":["cancel"]},"loginId":{"type":"string"}},"required":["action","loginId"],"additionalProperties":false}]},"ChiefMachineLoginStatus":{"anyOf":[{"type":"object","properties":{"waiting":{"type":"boolean","enum":[true]},"harness":{"type":"string","enum":["claude","codex"]},"login":{"anyOf":[{"$ref":"#/components/schemas/ChiefMachineLoginStart"},{"type":"null"}]}},"required":["waiting","harness","login"],"additionalProperties":false},{"$ref":"#/components/schemas/ChiefMachineLoginResumed"}]},"ChiefUnavailableEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ChiefUnavailable"]},"code":{"type":"string"},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"ChiefNotFoundEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ChiefNotFound"]},"code":{"type":"string"},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"ChiefForbiddenEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ChiefForbidden"]},"code":{"type":"string"},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"ChiefUnauthorizedEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ChiefUnauthorized"]},"code":{"type":"string"},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"DepCacheTooLargeEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["DepCacheTooLarge"]},"code":{"type":"string","enum":["dep_cache.too_large"]},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"DepCacheBadRequestEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["DepCacheBadRequest"]},"code":{"type":"string","enum":["dep_cache.invalid_key","dep_cache.digest_mismatch","dep_cache.body_required","dep_cache.upload_incomplete"]},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"DepCacheUnavailableEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["DepCacheUnavailable"]},"code":{"type":"string","enum":["dep_cache.unavailable"]},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"DepCacheNotFoundEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["DepCacheNotFound"]},"code":{"type":"string","enum":["dep_cache.not_found","dep_cache.miss"]},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"DepCacheForbiddenEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["DepCacheForbidden"]},"code":{"type":"string","enum":["dep_cache.forbidden"]},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"DepCacheUnauthorizedEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["DepCacheUnauthorized"]},"code":{"type":"string","enum":["dep_cache.unauthorized"]},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"DepCacheRemoved":{"type":"object","properties":{"key":{"type":"string"},"removed":{"type":"boolean"}},"required":["key","removed"],"additionalProperties":false},"DepCacheStored":{"type":"object","properties":{"key":{"type":"string"},"size":{"type":"integer","minimum":0,"maximum":9007199254740991},"sha256":{"type":"string"},"created":{"type":"boolean"},"evicted":{"type":"integer","minimum":0,"maximum":9007199254740991}},"required":["key","size","sha256","created","evicted"],"additionalProperties":false},"DepCacheCommit":{"type":"object","properties":{"parts":{"type":"integer","minimum":1,"maximum":32},"sha256":{"type":"string"}},"required":["parts","sha256"],"additionalProperties":false},"DepCachePart":{"type":"object","properties":{"part":{"type":"integer","minimum":0,"maximum":9007199254740991},"size":{"type":"integer","minimum":0,"maximum":9007199254740991},"exists":{"type":"boolean"}},"required":["part","size","exists"],"additionalProperties":false},"DepCacheList":{"type":"object","properties":{"scope":{"type":"string","enum":["person","team"]},"entries":{"type":"array","items":{"$ref":"#/components/schemas/DepCacheEntry"}},"usedBytes":{"type":"integer","minimum":0,"maximum":9007199254740991},"quotaBytes":{"type":"integer","minimum":0,"maximum":9007199254740991}},"required":["scope","entries","usedBytes","quotaBytes"],"additionalProperties":false},"DepCacheEntry":{"type":"object","properties":{"key":{"type":"string"},"ecosystem":{"$ref":"#/components/schemas/DepCacheEcosystem"},"size":{"type":"integer","minimum":0,"maximum":9007199254740991},"sha256":{"type":"string"},"createdAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"lastUsedAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991}},"required":["key","ecosystem","size","sha256","createdAt","lastUsedAt"],"additionalProperties":false},"DepCacheEcosystem":{"type":"string","enum":["bun","npm","pnpm","yarn","cargo","uv"]},"VaultConflictEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["VaultConflict"]},"code":{"type":"string","enum":["vault.limit"]},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"VaultBadRequestEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["VaultBadRequest"]},"code":{"type":"string","enum":["vault.invalid_name","vault.invalid_value","vault.fingerprint_mismatch","vault.invalid_hosts","vault.no_entry"]},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"VaultUnavailableEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["VaultUnavailable"]},"code":{"type":"string","enum":["vault.unconfigured","vault.unavailable"]},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"VaultNotFoundEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["VaultNotFound"]},"code":{"type":"string","enum":["vault.not_found"]},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"VaultForbiddenEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["VaultForbidden"]},"code":{"type":"string","enum":["vault.forbidden","vault.not_granted","vault.grant_expired"]},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"VaultUnauthorizedEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["VaultUnauthorized"]},"code":{"type":"string","enum":["vault.unauthorized"]},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"MachineVault":{"type":"object","properties":{"env":{"type":"array","items":{"$ref":"#/components/schemas/MachineVaultEnv"}}},"required":["env"],"additionalProperties":false},"MachineVaultEnv":{"type":"object","properties":{"name":{"type":"string"},"revision":{"type":"integer","minimum":0,"maximum":9007199254740991},"state":{"$ref":"#/components/schemas/MachineVaultEnvState"},"delivery":{"$ref":"#/components/schemas/VaultEnvDelivery"},"allowedHosts":{"type":"array","items":{"type":"string"}},"valueBase64":{"type":"string"}},"required":["name","revision","state","delivery","allowedHosts"],"additionalProperties":false},"VaultEnvDelivery":{"type":"string","enum":["proxy","env"]},"MachineVaultEnvState":{"type":"string","enum":["active","revoked","withheld"]},"VaultReadAlert":{"type":"object","properties":{"at":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"kind":{"type":"string","enum":["new_machine","burst","off_hours"]},"machine":{"type":"string"},"detail":{"type":"string"}},"required":["at","kind","machine","detail"],"additionalProperties":false},"VaultRead":{"type":"object","properties":{"at":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"machine":{"type":"string"},"entries":{"type":"array","items":{"type":"string"}}},"required":["at","machine","entries"],"additionalProperties":false},"VaultGrantRemoved":{"type":"object","properties":{"removed":{"type":"boolean"}},"required":["removed"],"additionalProperties":false},"VaultGrant":{"type":"object","properties":{"kind":{"type":"string","enum":["joined","cloud"]},"id":{"type":"string"},"entries":{"type":"array","items":{"type":"string"}},"expiresAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"grantedAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991}},"required":["kind","id","expiresAt","grantedAt"],"additionalProperties":false},"VaultGrantWrite":{"type":"object","properties":{"entries":{"type":"array","items":{"type":"string","maxLength":128},"maxItems":100},"ttlSeconds":{"type":"integer","minimum":60,"maximum":2592000}},"additionalProperties":false},"VaultEnvWritten":{"type":"object","properties":{"name":{"type":"string"},"revision":{"type":"integer","minimum":0,"maximum":9007199254740991}},"required":["name","revision"],"additionalProperties":false},"VaultErased":{"type":"object","properties":{"erased":{"type":"boolean","enum":[true]}},"required":["erased"],"additionalProperties":false},"VaultEnvPolicy":{"type":"object","properties":{"name":{"type":"string"},"revision":{"type":"integer","minimum":0,"maximum":9007199254740991},"delivery":{"$ref":"#/components/schemas/VaultEnvDelivery"},"allowedHosts":{"type":"array","items":{"type":"string"}}},"required":["name","revision","delivery","allowedHosts"],"additionalProperties":false},"VaultEnvPolicyWrite":{"type":"object","properties":{"delivery":{"$ref":"#/components/schemas/VaultEnvDelivery"},"allowedHosts":{"type":"array","items":{"type":"string"},"description":"0-16 hosts the value may be sent to: lowercase DNS names, optionally `*.` (subdomains only, never the apex) and `:port` (default 443). No scheme, path, IP literal, userinfo or trailing dot. Meaningful only for proxy.","examples":[["api.github.com","*.example.com:8443"]]}},"additionalProperties":false},"VaultEnvWrite":{"type":"object","properties":{"valueBase64":{"type":"string","minLength":1,"maxLength":21848},"fingerprint":{"type":"string","maxLength":64},"delivery":{"$ref":"#/components/schemas/VaultEnvDelivery"},"allowedHosts":{"type":"array","items":{"type":"string"},"description":"0-16 hosts the value may be sent to: lowercase DNS names, optionally `*.` (subdomains only, never the apex) and `:port` (default 443). No scheme, path, IP literal, userinfo or trailing dot. Meaningful only for proxy.","examples":[["api.github.com","*.example.com:8443"]]}},"required":["valueBase64","fingerprint"],"additionalProperties":false},"VaultEnvSummary":{"type":"object","properties":{"name":{"type":"string"},"revision":{"type":"integer","minimum":0,"maximum":9007199254740991},"updatedAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"delivery":{"$ref":"#/components/schemas/VaultEnvDelivery"},"allowedHosts":{"type":"array","items":{"type":"string"}}},"required":["name","revision","updatedAt","delivery","allowedHosts"],"additionalProperties":false},"TaskResultUnavailableEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["TaskResultUnavailable"]},"code":{"type":"string","enum":["task_result.unavailable","task_result.provider_unavailable"]},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"TaskResultConflictEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["TaskResultConflict"]},"code":{"type":"string","enum":["task_result.conflict","task_result.task_not_finished"]},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"TaskResultNotFoundEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["TaskResultNotFound"]},"code":{"type":"string","enum":["task_result.not_found"]},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"TaskResultForbiddenEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["TaskResultForbidden"]},"code":{"type":"string","enum":["task_result.forbidden","task_result.machine_unavailable"]},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"TaskResultUnauthorizedEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["TaskResultUnauthorized"]},"code":{"type":"string","enum":["task_result.unauthorized"]},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"TaskResultBadRequestEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["TaskResultBadRequest"]},"code":{"type":"string","enum":["task_result.invalid","task_result.idempotency_conflict"]},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"TaskResult":{"type":"object","properties":{"id":{"type":"string","description":"The opaque task id assigned by the machine task owner.","examples":["task_01J8Z7Q4M6N2K5P8R3T1V9W0X2"]},"taskId":{"type":"string","description":"The opaque task id assigned by the machine task owner.","examples":["task_01J8Z7Q4M6N2K5P8R3T1V9W0X2"]},"repository":{"type":"string","description":"A GitHub repository in owner/name form.","examples":["manaflow-ai/cmux"]},"baseRef":{"type":"string","minLength":1,"maxLength":200,"description":"The base branch, tag or commit from which to compute the task diff.","examples":["main"]},"baseSha":{"type":"string","description":"A lowercase hexadecimal git commit id.","examples":["0123456789abcdef0123456789abcdef01234567"]},"branch":{"type":"string","minLength":1,"maxLength":256},"headSha":{"type":"string","description":"A lowercase hexadecimal git commit id.","examples":["0123456789abcdef0123456789abcdef01234567"]},"diff":{"$ref":"#/components/schemas/TaskDiffCard"},"pullRequest":{"anyOf":[{"$ref":"#/components/schemas/TaskPullRequest"},{"type":"null"}]}},"required":["id","taskId","repository","baseRef","baseSha","branch","headSha","diff","pullRequest"],"additionalProperties":false,"description":"The branch, bounded diff card and optional pull request produced from a finished task."},"TaskPullRequest":{"type":"object","properties":{"number":{"type":"integer","minimum":1,"maximum":9007199254740991},"url":{"type":"string"},"state":{"type":"string","enum":["open","closed"]}},"required":["number","url","state"],"additionalProperties":false},"TaskDiffCard":{"type":"object","properties":{"filesChanged":{"type":"integer","minimum":0,"maximum":9007199254740991},"additions":{"type":"integer","minimum":0,"maximum":9007199254740991},"deletions":{"type":"integer","minimum":0,"maximum":9007199254740991},"files":{"type":"array","items":{"$ref":"#/components/schemas/TaskDiffFile"},"maxItems":300},"truncated":{"type":"boolean"}},"required":["filesChanged","additions","deletions","files","truncated"],"additionalProperties":false,"description":"A bounded summary suitable for rendering as a task result card."},"TaskDiffFile":{"type":"object","properties":{"path":{"type":"string","minLength":1,"maxLength":1024},"status":{"type":"string","enum":["added","modified","deleted","renamed","copied","changed"]},"additions":{"type":"integer","minimum":0,"maximum":9007199254740991},"deletions":{"type":"integer","minimum":0,"maximum":9007199254740991}},"required":["path","status","additions","deletions"],"additionalProperties":false},"TaskResultRequest":{"type":"object","properties":{"taskId":{"type":"string","description":"The opaque task id assigned by the machine task owner.","examples":["task_01J8Z7Q4M6N2K5P8R3T1V9W0X2"]},"machineId":{"type":"string","description":"The machine that completed the task; its owner verifies the result before publication.","examples":["machine_mac_01"]},"repository":{"type":"string","description":"A GitHub repository in owner/name form.","examples":["manaflow-ai/cmux"]},"baseRef":{"type":"string","minLength":1,"maxLength":200,"description":"The base branch, tag or commit from which to compute the task diff.","examples":["main"]},"commitSha":{"type":"string","description":"The finished task commit to compare with baseRef.","examples":["0123456789abcdef0123456789abcdef01234567"]},"title":{"type":"string","minLength":1,"maxLength":256,"description":"The branch and pull request title.","examples":["Fix login redirect"]},"openPullRequest":{"type":"boolean","description":"When true, open a GitHub pull request after publishing the branch.","examples":[true]},"idempotencyKey":{"type":"string","description":"A caller-generated key. Repeating it with the same task returns the original result.","examples":["task-result-01"]},"connectionId":{"type":"string","description":"An optional selected GitHub connection reference.","examples":["conn_0123456789abcdefghij"]}},"required":["taskId","machineId","repository","baseRef","commitSha","title","openPullRequest","idempotencyKey"],"additionalProperties":false,"description":"A finished task and the repository destination for its generated branch and diff.","examples":[{"taskId":"task_01J8Z7Q4M6N2K5P8R3T1V9W0X2","machineId":"machine_mac_01","repository":"manaflow-ai/cmux","baseRef":"main","commitSha":"0123456789abcdef0123456789abcdef01234567","title":"Fix login redirect","openPullRequest":true,"idempotencyKey":"task-result-01"}]},"ResourceUnsupportedEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ResourceUnsupported"]},"code":{"type":"string","description":"A stable resource error code; branch on it, never on `message`.","examples":["resource.unsupported"]},"message":{"type":"string","description":"One line for a person.","examples":["this provider or resource kind is unsupported"]}},"required":["_tag","code","message"],"additionalProperties":false},"ResourceUnavailableEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ResourceUnavailable"]},"code":{"type":"string","description":"A stable resource error code; branch on it, never on `message`.","examples":["resource.provider_unavailable"]},"message":{"type":"string","description":"One line for a person.","examples":["the provider is unavailable; retry"]}},"required":["_tag","code","message"],"additionalProperties":false},"ResourceRevokedEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ResourceRevoked"]},"code":{"type":"string","description":"A stable resource error code; branch on it, never on `message`.","examples":["resource.revoked"]},"message":{"type":"string","description":"One line for a person.","examples":["the resource reference was revoked"]}},"required":["_tag","code","message"],"additionalProperties":false},"ResourceNotFoundEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ResourceNotFound"]},"code":{"type":"string","description":"A stable resource error code; branch on it, never on `message`.","examples":["resource.not_found"]},"message":{"type":"string","description":"One line for a person.","examples":["no such resource reference"]}},"required":["_tag","code","message"],"additionalProperties":false},"ResourceInsufficientScopeEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ResourceInsufficientScope"]},"code":{"type":"string","description":"A stable resource error code; branch on it, never on `message`.","examples":["resource.insufficient_scope"]},"message":{"type":"string","description":"One line for a person.","examples":["the token cannot use this connection"]}},"required":["_tag","code","message"],"additionalProperties":false},"ResourceWrongAccountEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ResourceWrongAccount"]},"code":{"type":"string","description":"A stable resource error code; branch on it, never on `message`.","examples":["resource.wrong_account"]},"message":{"type":"string","description":"One line for a person.","examples":["the resource belongs to another team"]}},"required":["_tag","code","message"],"additionalProperties":false},"ResourceUnauthorizedEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ResourceUnauthorized"]},"code":{"type":"string","description":"A stable resource error code; branch on it, never on `message`.","examples":["resource.unauthorized"]},"message":{"type":"string","description":"One line for a person.","examples":["a cmux access token is required"]}},"required":["_tag","code","message"],"additionalProperties":false},"ResourceBadRequestEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ResourceBadRequest"]},"code":{"type":"string","description":"A stable resource error code; branch on it, never on `message`.","examples":["resource.invalid","resource.invalid_locator"]},"message":{"type":"string","description":"One line for a person.","examples":["the resource selector or locator is not valid"]}},"required":["_tag","code","message"],"additionalProperties":false},"ResourceResolved":{"type":"object","properties":{"ref":{"$ref":"#/components/schemas/ResourceRef"},"locator":{"anyOf":[{"type":"string","maxLength":2048},{"type":"string","maxLength":512}],"allOf":[{"description":"Opaque provider id or HTTPS URL without userinfo (username or password) or credential query parameters. Query names are decoded and checked case-insensitively: token, access_token, key, api_key, sig, signature, secret, password, auth, code, X-Amz-* and X-Goog-* are forbidden."}]},"observedVersion":{"type":"string"}},"required":["ref","locator"],"additionalProperties":false},"ResourceRef":{"type":"object","properties":{"refId":{"type":"string"},"provider":{"type":"string"},"connectionId":{"type":"string"},"kind":{"type":"string"},"providerObjectId":{"type":"string","maxLength":512},"parentId":{"type":"string","maxLength":512},"title":{"type":"string","minLength":1,"maxLength":512},"canonicalUrl":{"type":"string","maxLength":2048,"allOf":[{"description":"HTTPS URL without userinfo (username or password) or credential query parameters. Query names are decoded and checked case-insensitively: token, access_token, key, api_key, sig, signature, secret, password, auth, code, X-Amz-* and X-Goog-* are forbidden."}]},"observedVersion":{"type":"string"},"createdAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991}},"required":["refId","provider","connectionId","kind","providerObjectId","title","createdAt"],"additionalProperties":false},"ResourceSelection":{"type":"object","properties":{"provider":{"type":"string"},"connectionId":{"type":"string"},"kind":{"type":"string"},"providerObjectId":{"type":"string","maxLength":512},"parentId":{"type":"string","maxLength":512},"title":{"type":"string","minLength":1,"maxLength":512},"canonicalUrl":{"type":"string","maxLength":2048,"allOf":[{"description":"HTTPS URL without userinfo (username or password) or credential query parameters. Query names are decoded and checked case-insensitively: token, access_token, key, api_key, sig, signature, secret, password, auth, code, X-Amz-* and X-Goog-* are forbidden."}]},"observedVersion":{"type":"string"}},"required":["provider","connectionId","kind","providerObjectId","title"],"additionalProperties":false},"NodeUnavailableEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["NodeUnavailable"]},"code":{"type":"string","description":"A stable dotted error code; branch on it rather than on message.","examples":["mesh.node.unavailable"]},"message":{"type":"string","description":"A human-readable explanation of the error.","examples":["node registry is unavailable"]}},"required":["_tag","code","message"],"additionalProperties":false},"NodeNotFoundEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["NodeNotFound"]},"code":{"type":"string","description":"A stable dotted error code; branch on it rather than on message.","examples":["mesh.node.not_found"]},"message":{"type":"string","description":"A human-readable explanation of the error.","examples":["the node is not registered"]}},"required":["_tag","code","message"],"additionalProperties":false},"NodeForbiddenEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["NodeForbidden"]},"code":{"type":"string","description":"A stable dotted error code; branch on it rather than on message.","examples":["node.forbidden"]},"message":{"type":"string","description":"A human-readable explanation of the error.","examples":["node ACL operation is forbidden"]}},"required":["_tag","code","message"],"additionalProperties":false},"NodeUnauthorizedEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["NodeUnauthorized"]},"code":{"type":"string","description":"A stable dotted error code; branch on it rather than on message.","examples":["machine.unauthorized"]},"message":{"type":"string","description":"A human-readable explanation of the error.","examples":["a machine credential is required"]}},"required":["_tag","code","message"],"additionalProperties":false},"NodeBadRequestEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["NodeBadRequest"]},"code":{"type":"string","description":"A stable dotted error code; branch on it rather than on message.","examples":["mesh.node.invalid"]},"message":{"type":"string","description":"A human-readable explanation of the error.","examples":["invalid node registration"]}},"required":["_tag","code","message"],"additionalProperties":false},"MeshNode":{"type":"object","properties":{"nodeId":{"type":"string","minLength":1,"maxLength":256,"description":"The registered node id.","examples":["node-a"]},"teamId":{"type":"string","minLength":1,"maxLength":256,"description":"The team that owns this node.","examples":["team-a"]},"machineId":{"type":"string","minLength":1,"maxLength":256,"description":"The joined machine id backing this node.","examples":["machine-a"]},"name":{"type":"string","minLength":1,"maxLength":128,"description":"The node display name.","examples":["builder-a"]},"platform":{"type":"string","enum":["macos","linux"],"description":"The joined machine platform.","examples":["linux"]},"wgPublicKey":{"type":"string","description":"The registered padded base64 WireGuard public key.","examples":["AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="]},"endpoints":{"type":"array","items":{"type":"string","minLength":1,"maxLength":512,"description":"A peer endpoint in host:port form."},"description":"WireGuard endpoints advertised by this node."},"allowedStreams":{"type":"array","items":{"type":"string","minLength":1,"maxLength":128,"description":"A non-empty node label.","examples":["builder-a"]},"maxItems":32,"description":"Streams this peer may carry; v1 registers sessions and files.","examples":[["sessions","files"]]},"lastSeenAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991,"description":"When this node last registered, as Unix milliseconds.","examples":[1761800000000]},"revokedAt":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"When the node was revoked, as an ISO timestamp; null when active.","examples":[null]}},"required":["nodeId","teamId","machineId","name","platform","wgPublicKey","endpoints","allowedStreams","lastSeenAt","revokedAt"],"additionalProperties":false,"description":"A registered WireGuard mesh node and its current visibility state.","examples":[{"nodeId":"node-a","teamId":"team-a","machineId":"machine-a","name":"builder-a","platform":"linux","wgPublicKey":"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=","endpoints":[],"allowedStreams":["sessions","files"],"lastSeenAt":1761800000000,"revokedAt":null}]},"MeshNodeAcl":{"type":"object","properties":{"denied":{"type":"array","items":{"$ref":"#/components/schemas/NodeAclDeny"},"maxItems":4096,"description":"The complete directed deny list; replacing this list removes omitted rules.","examples":[[]]}},"required":["denied"],"additionalProperties":false,"description":"The team's complete directed node-to-node deny list.","examples":[{"denied":[]}]},"NodeAclDeny":{"type":"object","properties":{"fromNodeId":{"type":"string","minLength":1,"maxLength":256,"description":"The source node denied access.","examples":["node-a"]},"toNodeId":{"type":"string","minLength":1,"maxLength":256,"description":"The destination node hidden from the source.","examples":["node-b"]}},"required":["fromNodeId","toNodeId"],"additionalProperties":false,"description":"One directed node-to-node deny rule.","examples":[{"fromNodeId":"node-a","toNodeId":"node-b"}]},"MeshPeerMap":{"type":"object","properties":{"version":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991,"description":"The monotonic team peer-map revision.","examples":[3]},"changed":{"type":"boolean","description":"Whether this response contains a changed map; false means sinceVersion was current.","examples":[true]},"nodes":{"type":"array","items":{"$ref":"#/components/schemas/MeshNode"},"description":"Visible peers for the requesting node; the requesting node itself is omitted."}},"required":["version","changed","nodes"],"additionalProperties":false,"description":"The current peer map for one registered node.","examples":[{"version":3,"changed":true,"nodes":[]}]},"NodeRegister":{"type":"object","properties":{"nodeId":{"type":"string","minLength":1,"maxLength":256,"description":"The node id; it must equal the authenticated machine id.","examples":["node-a"]},"name":{"type":"string","minLength":1,"maxLength":128,"description":"The display name for this node.","examples":["builder-a"]},"platform":{"type":"string","enum":["macos","linux"],"description":"The machine platform, matching the joined machine credential.","examples":["linux"]},"wgPublicKey":{"type":"string","description":"The node's padded base64 WireGuard public key.","examples":["AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="]},"endpoints":{"type":"array","items":{"type":"string","minLength":1,"maxLength":512,"description":"A peer endpoint in host:port form."},"maxItems":32,"description":"WireGuard endpoints where peers can reach this node."},"privateKey":{"not":{},"description":"Private key material is rejected; send only the public key.","examples":[]}},"required":["nodeId","name","platform","wgPublicKey","endpoints"],"additionalProperties":false,"description":"The public node registration sent by an authenticated machine.","examples":[{"nodeId":"node-a","name":"builder-a","platform":"linux","wgPublicKey":"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=","endpoints":[]}]},"JoinUnavailableEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["JoinUnavailable"]},"code":{"type":"string","description":"A stable dotted error code; branch on it instead of message.","examples":["machine.join.unavailable"]},"message":{"type":"string","description":"A human-readable explanation of the refusal.","examples":["machine onboarding is unavailable"]}},"required":["_tag","code","message"],"additionalProperties":false},"JoinRateLimitedEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["JoinRateLimited"]},"code":{"type":"string","description":"A stable dotted error code; branch on it instead of message.","examples":["join.rate_limited"]},"message":{"type":"string","description":"A human-readable explanation of the refusal.","examples":["the join request is rate limited"]},"retryAfterSeconds":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991,"description":"Seconds to wait before retrying.","examples":[60]}},"required":["_tag","code","message","retryAfterSeconds"],"additionalProperties":false},"JoinConflictEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["JoinConflict"]},"code":{"type":"string","description":"A stable dotted error code; branch on it instead of message.","examples":["join.used"]},"message":{"type":"string","description":"A human-readable explanation of the refusal.","examples":["the join credential was already used"]}},"required":["_tag","code","message"],"additionalProperties":false},"JoinGoneEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["JoinGone"]},"code":{"type":"string","description":"A stable dotted error code; branch on it instead of message.","examples":["join.expired"]},"message":{"type":"string","description":"A human-readable explanation of the refusal.","examples":["the join credential expired"]}},"required":["_tag","code","message"],"additionalProperties":false},"JoinNotFoundEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["JoinNotFound"]},"code":{"type":"string","description":"A stable dotted error code; branch on it instead of message.","examples":["machine.not_found"]},"message":{"type":"string","description":"A human-readable explanation of the refusal.","examples":["the machine was not found"]}},"required":["_tag","code","message"],"additionalProperties":false},"JoinUnauthorizedEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["JoinUnauthorized"]},"code":{"type":"string","description":"A stable dotted error code; branch on it instead of message.","examples":["machine.unknown","machine.revoked","machine.unauthorized"]},"message":{"type":"string","description":"A human-readable explanation of the refusal.","examples":["the machine credential is unknown"]}},"required":["_tag","code","message"],"additionalProperties":false},"JoinBadRequestEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["JoinBadRequest"]},"code":{"type":"string","description":"A stable dotted error code; branch on it instead of message.","examples":["join.malformed"]},"message":{"type":"string","description":"A human-readable explanation of the refusal.","examples":["the join request is malformed"]}},"required":["_tag","code","message"],"additionalProperties":false},"JoinRedeemed":{"type":"object","properties":{"credential":{"type":"string","description":"A machine credential used as a bearer.","examples":[]},"machineId":{"type":"string","minLength":1,"maxLength":256,"description":"The resulting machine identifier.","examples":["machine_01"]},"joinTokenId":{"type":"string","minLength":1,"maxLength":256,"description":"The consumed join-token identifier.","examples":["join_01"]},"teamId":{"type":"string","minLength":1,"maxLength":256,"description":"The owning team identifier.","examples":["team_01"]},"wgPublicKey":{"type":"string","description":"A WireGuard public key in standard base64.","examples":[]},"expiresAt":{"type":"string","description":"When the credential expires as an ISO 8601 timestamp.","examples":["2027-10-30T12:00:00.000Z"]},"userId":{"type":"string","minLength":1,"maxLength":256,"description":"The person who minted the join credential (mintedBy). The machine acts as them on the team mesh, so a mesh message whose from.user equals this came from one of the same person's machines or sessions.","examples":["user_abc"]}},"required":["machineId","joinTokenId","teamId","wgPublicKey"],"additionalProperties":false,"description":"The machine identity created or refreshed by redemption."},"JoinRedeem":{"type":"object","properties":{"token":{"type":"string","description":"A single-use machine join credential.","examples":[]},"proposedCredential":{"type":"string","description":"An optional client-generated credential proposal for safe retries.","examples":[]},"replaceCredential":{"type":"string","description":"The current credential proving replacement of an existing machine.","examples":[]},"platform":{"type":"string","enum":["macos","linux"],"description":"The machine operating system.","examples":["linux"]},"hostname":{"type":"string","minLength":1,"maxLength":256,"description":"The joining machine's reported hostname."},"name":{"type":"string","minLength":1,"maxLength":128,"description":"An optional display name; defaults from the join metadata.","examples":["worker"]},"wgPublicKey":{"type":"string","description":"A WireGuard public key in standard base64.","examples":[]}},"required":["token","platform","hostname","wgPublicKey"],"additionalProperties":false,"description":"Machine details used to redeem a single-use join credential."},"MachineCredentialRevoked":{"type":"object","properties":{"machineId":{"type":"string","minLength":1,"maxLength":256,"description":"The unenrolled machine's identifier.","examples":["machine_01"]},"teamId":{"type":"string","minLength":1,"maxLength":256,"description":"The team it left.","examples":["team_01"]},"revoked":{"type":"boolean","description":"Always true: the credential is revoked.","examples":[true]}},"required":["machineId","teamId","revoked"],"additionalProperties":false,"description":"The calling machine's credential, now revoked; the machine has left its team's mesh.","examples":[{"machineId":"machine_01","teamId":"team_01","revoked":true}]},"MachineCredentialSelf":{"type":"object","properties":{"machineId":{"type":"string","minLength":1,"maxLength":256,"description":"The machine identifier.","examples":["machine_01"]},"teamId":{"type":"string","minLength":1,"maxLength":256,"description":"The owning team identifier.","examples":["team_01"]},"joinTokenId":{"type":"string","minLength":1,"maxLength":256,"description":"The join-token identifier used to enroll it.","examples":["join_01"]},"platform":{"type":"string","enum":["macos","linux"],"description":"The machine operating system.","examples":["linux"]},"hostname":{"type":"string","description":"The machine's reported hostname."},"name":{"type":"string","description":"The machine display name.","examples":["worker"]},"wgPublicKey":{"type":"string","description":"A WireGuard public key in standard base64.","examples":[]},"credentialGeneration":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991,"description":"The number of times the credential has been issued.","examples":[1]},"expiresAt":{"type":"string","description":"When the credential expires as an ISO 8601 timestamp.","examples":["2027-10-30T12:00:00.000Z"]},"userId":{"type":"string","minLength":1,"maxLength":256,"description":"The person who minted the join credential (mintedBy). The machine acts as them on the team mesh, so a mesh message whose from.user equals this came from one of the same person's machines or sessions.","examples":["user_abc"]}},"required":["machineId","teamId","joinTokenId","platform","hostname","name","wgPublicKey","credentialGeneration","expiresAt"],"additionalProperties":false,"description":"Metadata for the calling machine credential."},"JoinForbiddenEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["JoinForbidden"]},"code":{"type":"string","description":"A stable dotted error code; branch on it instead of message.","examples":["machine.revoked","machine.not_member","machine.vault_personal_only"]},"message":{"type":"string","description":"A human-readable explanation of the refusal.","examples":["a revoked machine cannot be rotated"]}},"required":["_tag","code","message"],"additionalProperties":false},"MachineVaultGranted":{"type":"object","properties":{"machineId":{"type":"string","minLength":1,"maxLength":256,"description":"The machine identifier.","examples":["machine_01"]},"granted":{"type":"boolean","description":"The machine's vault grant now.","examples":[true]}},"required":["machineId","granted"],"additionalProperties":false,"description":"A joined machine's vault grant."},"MachineVaultGrant":{"type":"object","properties":{"granted":{"type":"boolean","description":"Whether the machine may read the minter's vault.","examples":[true]}},"required":["granted"],"additionalProperties":false,"description":"Grant or withdraw a joined machine's read of its minter's vault.","examples":[{"granted":true}]},"MachineCredentialList":{"type":"object","properties":{"machines":{"type":"array","items":{"$ref":"#/components/schemas/MachineCredentialRow"},"description":"The team's enrolled machine credentials.","examples":[[]]}},"required":["machines"],"additionalProperties":false,"description":"The team's machine credential list.","examples":[{"machines":[]}]},"MachineCredentialRow":{"type":"object","properties":{"machineId":{"type":"string","minLength":1,"maxLength":256,"description":"The machine identifier.","examples":["machine_01"]},"joinTokenId":{"type":"string","minLength":1,"maxLength":256,"description":"The join-token identifier used to enroll it.","examples":["join_01"]},"teamId":{"type":"string","minLength":1,"maxLength":256,"description":"The owning team identifier.","examples":["team_01"]},"label":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"The optional enrollment label.","examples":[null]},"role":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"The optional enrollment role.","examples":[null]},"createdAt":{"type":"string","description":"Enrollment time as an ISO 8601 timestamp.","examples":["2026-10-30T12:00:00.000Z"]},"lastHeartbeat":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"The last machine heartbeat, or null.","examples":[null]},"revoked":{"type":"boolean","description":"Whether the credential has been revoked.","examples":[false]},"credentialGeneration":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991,"description":"The number of times the credential has been issued.","examples":[1]},"platform":{"type":"string","enum":["macos","linux"],"description":"The machine operating system.","examples":["linux"]},"hostname":{"type":"string","description":"The machine's reported hostname."},"name":{"type":"string","description":"The machine display name.","examples":["worker"]},"wgPublicKey":{"type":"string","description":"A WireGuard public key in standard base64.","examples":[]},"mintedBy":{"type":"string","minLength":1,"maxLength":256,"description":"The user who minted the join credential.","examples":["user_abc"]},"vault":{"type":"boolean","description":"Whether the minter granted this machine read access to their vault.","examples":[false]}},"required":["machineId","joinTokenId","teamId","label","role","createdAt","lastHeartbeat","revoked","credentialGeneration","platform","hostname","name","wgPublicKey","mintedBy","vault"],"additionalProperties":false,"description":"One team machine credential record."},"JoinTokenMinted":{"type":"object","properties":{"joinTokenId":{"type":"string","minLength":1,"maxLength":256,"description":"The persisted join-token identifier.","examples":["join_01"]},"token":{"type":"string","description":"A single-use machine join credential.","examples":[]},"expiresAt":{"type":"string","description":"When the join credential expires as an ISO 8601 timestamp.","examples":["2026-10-30T12:10:00.000Z"]},"teamId":{"type":"string","minLength":1,"maxLength":256,"description":"The owning team identifier.","examples":["team_01"]},"label":{"type":"string","description":"The stored display label, when set.","examples":["agent"]},"role":{"type":"string","description":"The stored machine role, when set.","examples":["worker"]}},"required":["joinTokenId","token","expiresAt","teamId"],"additionalProperties":false,"description":"A newly minted join credential and its metadata."},"JoinTokenMint":{"type":"object","properties":{"label":{"type":"string","minLength":1,"maxLength":63,"description":"An optional display label.","examples":["agent"]},"role":{"type":"string","maxLength":64,"description":"An optional machine role.","examples":["worker"]},"ttlSeconds":{"type":"integer","minimum":60,"maximum":600,"description":"Token lifetime in seconds; defaults to 600.","examples":[600]},"vault":{"type":"boolean","description":"Grant the joined machine read access to the minter's vault (their env entries). Only on the minter's personal team; defaults to false.","examples":[false]}},"additionalProperties":false,"description":"Options for minting a single-use join credential.","examples":[{"label":"agent","role":"worker","ttlSeconds":600}]},"ConnectorUnavailableEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ConnectorUnavailable"]},"message":{"type":"string"}},"required":["_tag","message"],"additionalProperties":false},"ConnectorRateLimitedEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ConnectorRateLimited"]},"message":{"type":"string"},"retryAfter":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991}},"required":["_tag","message"],"additionalProperties":false},"ConnectorNotFoundEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ConnectorNotFound"]},"message":{"type":"string"}},"required":["_tag","message"],"additionalProperties":false},"ConnectorNotBuiltEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ConnectorNotBuilt"]},"message":{"type":"string"}},"required":["_tag","message"],"additionalProperties":false},"ConnectorNeedsAuthEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ConnectorNeedsAuth"]},"message":{"type":"string"}},"required":["_tag","message"],"additionalProperties":false},"ConnectorInvalidEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ConnectorInvalid"]},"message":{"type":"string"}},"required":["_tag","message"],"additionalProperties":false},"ConnectorForbiddenEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ConnectorForbidden"]},"message":{"type":"string"}},"required":["_tag","message"],"additionalProperties":false},"ConnectorAuthRequiredEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ConnectorAuthRequired"]},"code":{"type":"string","enum":["connector.auth_required"]},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"ConnectorCursorStaleEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ConnectorCursorStale"]},"message":{"type":"string"}},"required":["_tag","message"],"additionalProperties":false},"RegisteredMachineHeartbeatAck":{"type":"object","properties":{"host_id":{"type":"string","minLength":1,"maxLength":128},"accepted":{"type":"boolean","enum":[true]},"reported_at":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991}},"required":["host_id","accepted","reported_at"],"additionalProperties":false},"RegisteredMachineHeartbeat":{"type":"object","properties":{"machine_token":{"type":"string","minLength":8,"maxLength":256},"host_id":{"type":"string","minLength":1,"maxLength":128},"region":{"type":"string","minLength":1,"maxLength":128},"capabilities":{"$ref":"#/components/schemas/MachineCapabilities"},"free_vcpu":{"type":"number","minimum":0},"free_mem_gib":{"type":"number","minimum":0},"free_disk_gib":{"type":"number","minimum":0},"amortized_cost_per_hour_usd":{"type":"number","minimum":0},"sessions_running":{"type":"integer","minimum":0,"maximum":9007199254740991,"description":"Sessions running on the machine. Replaces lanes_running; send at least one of the two."},"lanes_running":{"type":"integer","minimum":0,"maximum":9007199254740991,"description":"Deprecated: the old name of sessions_running, still accepted. If both are sent they must be equal."},"load":{"type":"number","minimum":0},"state":{"type":"string"}},"required":["machine_token","host_id","region","capabilities","free_vcpu","free_mem_gib","free_disk_gib","load"],"additionalProperties":false},"MachineCapabilities":{"type":"object","properties":{"memoryPause":{"type":"boolean"},"fork":{"type":"boolean"},"gpu":{"type":"boolean"},"arch":{"type":"string","enum":["arm64","x86_64"]},"os":{"type":"string","enum":["linux","macos"]},"maxVcpu":{"anyOf":[{"type":"number"},{"type":"string","enum":["Infinity","-Infinity","NaN"]}]},"maxMemGiB":{"anyOf":[{"type":"number"},{"type":"string","enum":["Infinity","-Infinity","NaN"]}]}},"required":["memoryPause","fork","gpu","arch","os","maxVcpu","maxMemGiB"],"additionalProperties":false},"ForkRunConflictEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ForkRunConflict"]},"code":{"type":"string","enum":["fork_run.conflict","fork_run.selection_conflict"]},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"ForkRunUnavailableEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ForkRunUnavailable"]},"code":{"type":"string","enum":["fork_run.unavailable","fork_run.provider_unavailable","fork_run.placement_unavailable"]},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"ForkRunBadRequestEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ForkRunBadRequest"]},"code":{"type":"string","enum":["fork_run.invalid","fork_run.empty_harnesses","fork_run.duplicate_harness","fork_run.child_not_ready"]},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"ForkRun":{"type":"object","properties":{"id":{"type":"string","minLength":1,"maxLength":256},"workspace":{"type":"string","minLength":1,"maxLength":256},"sourceMachine":{"type":"string","minLength":1,"maxLength":256},"sourceSnapshot":{"type":"string","minLength":1,"maxLength":256},"session":{"type":"string","minLength":1,"maxLength":256},"prompt":{"type":"string","minLength":1},"clientKey":{"type":"string","minLength":1,"maxLength":128},"state":{"type":"string","enum":["admitting","snapshotting","restoring","ready","failed"]},"children":{"type":"array","items":{"$ref":"#/components/schemas/ForkRunChild"}},"selectedChild":{"type":"string","minLength":1,"maxLength":256},"version":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"createdAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"updatedAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991}},"required":["id","workspace","sourceMachine","clientKey","state","children","version","createdAt","updatedAt"],"additionalProperties":false,"description":"A durable copy-on-write fork: one source snapshot restored into one machine per requested harness. The client seeds each child and syncs back exactly one selected bundle."},"ForkRunChild":{"type":"object","properties":{"id":{"type":"string","minLength":1,"maxLength":256},"harness":{"type":"string"},"state":{"type":"string","enum":["pending","restoring","ready","failed"]},"machineId":{"type":"string","minLength":1,"maxLength":256},"error":{"type":"string"}},"required":["id","harness","state"],"additionalProperties":false},"AutoSizeStatus":{"type":"object","properties":{"armed":{"type":"boolean"},"log":{"type":"array","items":{"$ref":"#/components/schemas/AutoSizeLogEntry"}},"sample":{"type":"object"},"policy":{"type":"object"}},"required":["armed","log","policy"],"additionalProperties":false},"AutoSizeLogEntry":{"type":"object","properties":{"at":{"anyOf":[{"type":"number"},{"type":"string","enum":["Infinity","-Infinity","NaN"]}]},"kind":{"type":"string","enum":["grow","shrink","hold","failed"]},"from":{"type":"string"},"to":{"type":"string"},"reason":{"type":"string"},"text":{"type":"string"},"hold":{"type":"string"},"detail":{"type":"string"},"snapshot":{"type":"string"},"line":{"type":"string"},"noticed":{"type":"boolean"},"step":{"type":"string"},"starvedMs":{"anyOf":[{"type":"number"},{"type":"string","enum":["Infinity","-Infinity","NaN"]}]},"tookMs":{"anyOf":[{"type":"number"},{"type":"string","enum":["Infinity","-Infinity","NaN"]}]}},"required":["at","kind"],"additionalProperties":false},"TurnCapabilityUnavailableEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["TurnCapabilityUnavailable"]},"code":{"type":"string","enum":["machine.turn_capability_unavailable"]},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"TurnCapabilityConflictEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["TurnCapabilityConflict"]},"code":{"type":"string","enum":["machine.turn_capability_scope_mismatch","machine.turn_capability_replay","machine.turn_generation_conflict"]},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"TurnCapabilityBadRequestEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["TurnCapabilityBadRequest"]},"code":{"type":"string","enum":["machine.turn_capability_invalid"]},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"TurnCapabilityUnauthorizedEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["TurnCapabilityUnauthorized"]},"code":{"type":"string","enum":["machine.turn_capability_unauthorized"]},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"TriggerUnavailableEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["TriggerUnavailable"]},"code":{"type":"string","examples":["trigger.unavailable"]},"message":{"type":"string","examples":["the trigger store is unavailable; retry"]}},"required":["_tag","code","message"],"additionalProperties":false},"TriggerConflictEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["TriggerConflict"]},"code":{"type":"string","examples":["trigger.conflict"]},"message":{"type":"string","examples":["the trigger changed; retry from the latest revision"]}},"required":["_tag","code","message"],"additionalProperties":false},"TriggerNotFoundEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["TriggerNotFound"]},"code":{"type":"string","examples":["trigger.not_found"]},"message":{"type":"string","examples":["no such trigger exists"]}},"required":["_tag","code","message"],"additionalProperties":false},"TriggerForbiddenEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["TriggerForbidden"]},"code":{"type":"string","examples":["trigger.forbidden"]},"message":{"type":"string","examples":["the caller cannot use this machine or trigger"]}},"required":["_tag","code","message"],"additionalProperties":false},"TriggerUnauthorizedEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["TriggerUnauthorized"]},"code":{"type":"string","examples":["trigger.unauthorized"]},"message":{"type":"string","examples":["a cmux access token is required"]}},"required":["_tag","code","message"],"additionalProperties":false},"TriggerBadRequestEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["TriggerBadRequest"]},"code":{"type":"string","examples":["trigger.invalid"]},"message":{"type":"string","examples":["the trigger configuration is invalid"]}},"required":["_tag","code","message"],"additionalProperties":false},"TriggerIngressResult":{"anyOf":[{"$ref":"#/components/schemas/TriggerDelivery"},{"$ref":"#/components/schemas/TriggerIngressIgnored"}]},"TriggerIngressIgnored":{"type":"object","properties":{"accepted":{"type":"boolean","enum":[false]},"reason":{"type":"string","enum":["payload_too_large","invalid_signature","invalid_payload","ignored","expired","invalid_headers","delivery_conflict","not_found","disabled","not_matched"]}},"required":["accepted","reason"],"additionalProperties":false},"TriggerDelivery":{"type":"object","properties":{"accepted":{"type":"boolean","enum":[true]},"id":{"type":"string","pattern":"^[A-Za-z0-9_-]{8,128}$"},"state":{"type":"string","enum":["queued","delivered","failed"]},"duplicate":{"type":"boolean"},"attempts":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"lastError":{"anyOf":[{"type":"string"},{"type":"null"}]},"nextAttemptAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"receipt":{"type":"string"},"turn":{"$ref":"#/components/schemas/TriggerTurn"}},"required":["accepted","id","state","duplicate","attempts","lastError","nextAttemptAt"],"additionalProperties":false},"TriggerTurn":{"type":"object","properties":{"id":{"type":"string"},"state":{"type":"string","enum":["running","completed","attention","failed"]},"reply":{"type":"string"}},"required":["id","state"],"additionalProperties":false},"TriggerAuthorizeResult":{"type":"object","properties":{"active":{"type":"boolean"},"principal":{}},"required":["active"],"additionalProperties":false},"TriggerAuthorize":{"type":"object","properties":{"token":{"type":"string","minLength":1,"maxLength":8192},"operation":{}},"required":["token","operation"],"additionalProperties":false},"Trigger":{"anyOf":[{"type":"object","properties":{"id":{"type":"string"},"owner":{"type":"string"},"team":{"type":"string"},"repository":{"type":"string"},"environment":{"type":"string"},"prompt":{"type":"string"},"target":{"$ref":"#/components/schemas/TriggerTarget"},"enabled":{"type":"boolean"},"revision":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"source":{"type":"string","enum":["github"]},"installation":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"events":{"type":"array","items":{"type":"string","enum":["ci_failure","pr_review_comment","pr_opened","pr_comment"]}}},"required":["id","owner","team","repository","prompt","target","enabled","revision","installation","events"],"additionalProperties":false},{"type":"object","properties":{"id":{"type":"string"},"owner":{"type":"string"},"team":{"type":"string"},"repository":{"type":"string"},"environment":{"type":"string"},"prompt":{"type":"string"},"target":{"$ref":"#/components/schemas/TriggerTarget"},"enabled":{"type":"boolean"},"revision":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"source":{"type":"string","enum":["webhook"]},"events":{"type":"array","items":{"type":"string"}}},"required":["id","owner","team","repository","prompt","target","enabled","revision","source","events"],"additionalProperties":false}]},"TriggerTarget":{"type":"object","properties":{"machine":{"type":"string","minLength":1,"maxLength":256},"workspace":{"type":"string","minLength":1,"maxLength":256},"session":{"type":"string","minLength":1,"maxLength":256},"cwd":{"type":"string","pattern":"^\\/","maxLength":4096},"harness":{"type":"string","minLength":1,"maxLength":128},"policy":{"type":"string","enum":["wake_existing"]}},"required":["machine","workspace","session","cwd","harness"],"additionalProperties":false},"TriggerCreated":{"type":"object","properties":{"trigger":{"$ref":"#/components/schemas/Trigger"},"secret":{"type":"string"}},"required":["trigger","secret"],"additionalProperties":false},"TriggerCreate":{"anyOf":[{"type":"object","properties":{"repository":{"type":"string"},"environment":{"type":"string","minLength":1,"maxLength":256,"description":"Environment reference recorded with the trigger. The wake_existing policy uses the target's existing environment and does not reprovision it."},"prompt":{"type":"string","minLength":1,"maxLength":16384},"target":{"$ref":"#/components/schemas/TriggerTarget"},"source":{"type":"string","enum":["github"]},"installation":{"type":"integer","maximum":9007199254740991,"exclusiveMinimum":0},"events":{"type":"array","items":{"type":"string","enum":["ci_failure","pr_review_comment","pr_opened","pr_comment"]},"minItems":1,"maxItems":4}},"required":["repository","prompt","target","installation","events"],"additionalProperties":false},{"type":"object","properties":{"repository":{"type":"string"},"environment":{"type":"string","minLength":1,"maxLength":256,"description":"Environment reference recorded with the trigger. The wake_existing policy uses the target's existing environment and does not reprovision it."},"prompt":{"type":"string","minLength":1,"maxLength":16384},"target":{"$ref":"#/components/schemas/TriggerTarget"},"source":{"type":"string","enum":["webhook"]},"events":{"type":"array","items":{"type":"string","pattern":"^[A-Za-z0-9][A-Za-z0-9_.:-]{0,63}$"},"minItems":1,"maxItems":32}},"required":["repository","prompt","target","source","events"],"additionalProperties":false}]},"DefaultMachine":{"type":"object","properties":{"workspace":{"type":"string"},"scopeWorkspace":{"type":"string"},"machine":{"$ref":"#/components/schemas/TeamMachine"},"team":{"type":"string"},"snapshot":{"type":"string"},"environment":{"$ref":"#/components/schemas/WorkspaceEnvironment"},"created":{"type":"boolean"},"boundAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"connectionMachine":{"type":"string"}},"required":["workspace","machine","team","created","boundAt","connectionMachine"],"additionalProperties":false},"WorkspaceEnvironment":{"type":"object","properties":{"id":{"type":"string"},"status":{"type":"string","enum":["building","ready","failed"]}},"required":["id","status"],"additionalProperties":false},"TeamMachine":{"type":"object","properties":{"provider":{"type":"string"},"id":{"type":"string"},"region":{"type":"string"},"shape":{"$ref":"#/components/schemas/MachineShape"},"state":{"type":"string","enum":["starting","waking","running","paused","stopped","failed","gone"]},"pauseMode":{"type":"string","enum":["suspend","stop"]},"error":{"$ref":"#/components/schemas/MachineFailure"},"capabilities":{"$ref":"#/components/schemas/MachineClientCapabilities"},"creator":{"type":"string"},"visibility":{"$ref":"#/components/schemas/MachineVisibility"},"createdAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"kind":{"$ref":"#/components/schemas/MachineKind"},"workspace":{"anyOf":[{"type":"string"},{"type":"null"}]},"present":{"type":"array","items":{"$ref":"#/components/schemas/MachinePresence"}},"cost":{"$ref":"#/components/schemas/MachineCost"}},"required":["provider","id","region","shape","state","capabilities","creator","visibility","createdAt","kind","present","cost"],"additionalProperties":false},"MachineCost":{"type":"object","properties":{"currency":{"type":"string","enum":["USD"]},"estimated":{"type":"boolean","enum":[true]},"hourlyUsd":{"type":"number","minimum":0},"idleHourlyUsd":{"type":"number","minimum":0},"accruedUsd":{"type":"number","minimum":0},"runningUsd":{"type":"number","minimum":0},"totalUsd":{"type":"number","minimum":0},"runningSince":{"anyOf":[{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},{"type":"null"}]}},"required":["currency","estimated","hourlyUsd","idleHourlyUsd","accruedUsd","runningUsd","totalUsd","runningSince"],"additionalProperties":false},"MachinePresence":{"type":"object","properties":{"user":{"type":"string"},"since":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991}},"required":["user","since"],"additionalProperties":false},"MachineKind":{"type":"string","enum":["user","fleet"]},"MachineVisibility":{"type":"string","enum":["team","private"]},"MachineClientCapabilities":{"type":"object","properties":{"snapshot":{"type":"boolean"},"restore":{"type":"boolean"},"fork":{"type":"boolean"},"exec":{"type":"boolean"},"stats":{"type":"boolean"},"restart":{"type":"boolean"},"ports":{"type":"boolean"},"desktop":{"type":"boolean"},"clientSession":{"type":"boolean"},"sizing":{"type":"boolean"},"persistentHome":{"type":"boolean"},"attachTransports":{"type":"array","items":{"type":"string"}}},"required":["snapshot","restore","fork","exec","stats","restart","ports","desktop","clientSession","sizing","persistentHome","attachTransports"],"additionalProperties":false},"MachineFailure":{"type":"object","properties":{"code":{"type":"string"},"message":{"type":"string"}},"required":["code","message"],"additionalProperties":false},"MachineShape":{"type":"object","properties":{"vcpu":{"anyOf":[{"type":"number"},{"type":"string","enum":["Infinity","-Infinity","NaN"]}]},"memGiB":{"anyOf":[{"type":"number"},{"type":"string","enum":["Infinity","-Infinity","NaN"]}]},"diskGiB":{"anyOf":[{"type":"number"},{"type":"string","enum":["Infinity","-Infinity","NaN"]}]},"gpu":{"type":"string"}},"required":["vcpu","memGiB","diskGiB"],"additionalProperties":false},"TurnMachineCapture":{"type":"object","properties":{"id":{"type":"string"},"workspace":{"type":"string"},"session":{"type":"string","minLength":1,"maxLength":256},"turn":{"type":"string"},"machineId":{"type":"string"},"machineGeneration":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"snapshotId":{"type":"string"},"status":{"type":"string","enum":["capturing","ready"]},"createdAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"updatedAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991}},"required":["id","workspace","session","turn","machineId","machineGeneration","status","createdAt","updatedAt"],"additionalProperties":false},"WorkspaceMachine":{"type":"object","properties":{"workspace":{"type":"string"},"scopeWorkspace":{"type":"string"},"machine":{"$ref":"#/components/schemas/TeamMachine"},"team":{"type":"string"},"snapshot":{"type":"string"},"environment":{"$ref":"#/components/schemas/WorkspaceEnvironment"},"created":{"type":"boolean"},"boundAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991}},"required":["workspace","machine","team","created","boundAt"],"additionalProperties":false},"MachineMessage":{"type":"object","properties":{"messageId":{"type":"string"},"machineId":{"type":"string"},"workspace":{"type":"string"},"session":{"type":"string"},"state":{"type":"string","enum":["queued","waking","delivered"]},"queuedAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991}},"required":["messageId","machineId","state","queuedAt"],"additionalProperties":false},"MachineChatAccess":{"type":"object","properties":{"machineId":{"type":"string"},"creator":{"type":"string"},"chatStart":{"type":"string","enum":["owner","granted","none"]},"canShare":{"type":"boolean"},"grants":{"type":"array","items":{"type":"string"}}},"required":["machineId","creator","chatStart","canShare","grants"],"additionalProperties":false},"MachineResize":{"type":"object","properties":{"machine":{"$ref":"#/components/schemas/TeamMachine"},"snapshot":{"$ref":"#/components/schemas/MachineSnapshot"},"size":{"type":"string"},"change":{"type":"string","enum":["grow","unchanged","shrink"]},"shrink":{"$ref":"#/components/schemas/MachineShrink"}},"required":["machine","snapshot","size","change"],"additionalProperties":false},"MachineShrink":{"type":"object","properties":{"state":{"type":"string","enum":["copying","done"]},"phase":{"type":"string"},"processes":{"type":"string","enum":["lost"]},"copiedBytes":{"anyOf":[{"type":"number"},{"type":"string","enum":["Infinity","-Infinity","NaN"]}]},"folderBytes":{"anyOf":[{"type":"number"},{"type":"string","enum":["Infinity","-Infinity","NaN"]}]},"entries":{"anyOf":[{"type":"number"},{"type":"string","enum":["Infinity","-Infinity","NaN"]}]},"seconds":{"anyOf":[{"type":"number"},{"type":"string","enum":["Infinity","-Infinity","NaN"]}]}},"required":["state","phase","processes"],"additionalProperties":false},"MachineSnapshot":{"type":"object","properties":{"id":{"type":"string"},"provider":{"type":"string"},"machineId":{"type":"string"},"creator":{"type":"string"},"visibility":{"$ref":"#/components/schemas/MachineVisibility"},"createdAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991}},"required":["id","provider","machineId","creator","visibility","createdAt"],"additionalProperties":false},"MachineUsage":{"type":"object","properties":{"since":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"until":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"intervals":{"type":"array","items":{"$ref":"#/components/schemas/MachineInterval"}},"coverage":{"type":"object","properties":{"scope":{"type":"string","enum":["team","visible"]},"recordedHistory":{"type":"string","enum":["all","truncated"]}},"required":["scope","recordedHistory"],"additionalProperties":false},"knownCostUsd":{"type":"number","minimum":0},"totalCostUsd":{"anyOf":[{"type":"number","minimum":0},{"type":"null"}]},"byStartedBy":{"type":"array","items":{"$ref":"#/components/schemas/MachineHoursByStarter"}},"byCreator":{"type":"array","items":{"$ref":"#/components/schemas/MachineHoursByCreator"}},"byMachine":{"type":"array","items":{"$ref":"#/components/schemas/MachineHoursByMachine"}}},"required":["since","until","intervals","coverage","knownCostUsd","totalCostUsd","byStartedBy","byCreator","byMachine"],"additionalProperties":false},"MachineHoursByMachine":{"type":"object","properties":{"machineId":{"type":"string"},"hours":{"anyOf":[{"type":"number"},{"type":"string","enum":["Infinity","-Infinity","NaN"]}]},"costUsd":{"type":"number","minimum":0}},"required":["machineId","hours","costUsd"],"additionalProperties":false},"MachineHoursByCreator":{"type":"object","properties":{"user":{"type":"string"},"hours":{"anyOf":[{"type":"number"},{"type":"string","enum":["Infinity","-Infinity","NaN"]}]},"costUsd":{"type":"number","minimum":0}},"required":["user","hours","costUsd"],"additionalProperties":false},"MachineHoursByStarter":{"type":"object","properties":{"user":{"type":"string"},"hours":{"anyOf":[{"type":"number"},{"type":"string","enum":["Infinity","-Infinity","NaN"]}]},"costUsd":{"type":"number","minimum":0}},"required":["user","hours","costUsd"],"additionalProperties":false},"MachineInterval":{"type":"object","properties":{"machineId":{"type":"string"},"creator":{"type":"string"},"visibility":{"$ref":"#/components/schemas/MachineVisibility"},"startedBy":{"type":"string"},"startedAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"endedAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"endedBy":{"type":"string"},"hours":{"anyOf":[{"type":"number"},{"type":"string","enum":["Infinity","-Infinity","NaN"]}]},"hourlyUsd":{"type":"number","minimum":0},"costUsd":{"type":"number","minimum":0}},"required":["machineId","creator","visibility","startedBy","startedAt","hours","hourlyUsd","costUsd"],"additionalProperties":false},"MachineAuditRow":{"type":"object","properties":{"at":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"target":{"type":"string","enum":["machine","snapshot"]},"targetId":{"type":"string"},"creator":{"type":"string"},"visibility":{"$ref":"#/components/schemas/MachineVisibility"},"actor":{"type":"string"},"actorKind":{"type":"string","enum":["person","agent"]},"action":{"type":"string"},"result":{"type":"string"},"made":{"type":"string"}},"required":["at","target","targetId","creator","visibility","actor","actorKind","action","result"],"additionalProperties":false},"MachineOffer":{"type":"object","properties":{"provider":{"type":"string"},"region":{"type":"string"},"shape":{"$ref":"#/components/schemas/MachineShape"},"image":{"type":"string"},"pricePerHourUsd":{"anyOf":[{"type":"number"},{"type":"string","enum":["Infinity","-Infinity","NaN"]}]},"idlePricePerHourUsd":{"anyOf":[{"type":"number"},{"type":"string","enum":["Infinity","-Infinity","NaN"]}]},"coldStartSec":{"anyOf":[{"type":"number"},{"type":"string","enum":["Infinity","-Infinity","NaN"]}]},"warmStartSec":{"anyOf":[{"type":"number"},{"type":"string","enum":["Infinity","-Infinity","NaN"]}]},"risk":{"anyOf":[{"type":"number"},{"type":"string","enum":["Infinity","-Infinity","NaN"]}]},"capabilities":{"$ref":"#/components/schemas/MachineCapabilities"},"warm":{"type":"boolean"}},"required":["provider","region","shape","pricePerHourUsd","idlePricePerHourUsd","coldStartSec","warmStartSec","risk","capabilities","warm"],"additionalProperties":false},"MachineConflictEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["MachineConflict"]},"code":{"type":"string"},"message":{"type":"string"}},"required":["_tag","code","message"],"additionalProperties":false},"MachineRef":{"type":"object","properties":{"provider":{"type":"string"},"id":{"type":"string"},"region":{"type":"string"},"shape":{"$ref":"#/components/schemas/MachineShape"},"state":{"type":"string","enum":["starting","waking","running","paused","stopped","failed","gone"]},"pauseMode":{"type":"string","enum":["suspend","stop"]},"error":{"$ref":"#/components/schemas/MachineFailure"},"capabilities":{"$ref":"#/components/schemas/MachineClientCapabilities"}},"required":["provider","id","region","shape","state"],"additionalProperties":false},"PlacementDecision":{"type":"object","properties":{"offer":{"anyOf":[{"$ref":"#/components/schemas/MachineOffer"},{"type":"null"}]},"reason":{"type":"string"},"runnerUp":{"$ref":"#/components/schemas/MachineOffer_1"},"fallback":{"$ref":"#/components/schemas/MachineOffer_1"},"admitted":{"type":"string","enum":["admit","queue","downsize","upgrade"]},"estimatedCostUsd":{"type":"number","minimum":0},"capacity":{"type":"object","properties":{"accounting":{"type":"object","properties":{"status":{"type":"string","enum":["unmetered","unverified"]},"actualSpendUsd":{"type":"null"},"actualRemainingUsd":{"type":"null"},"purchasePriceUsd":{"type":"null"}},"required":["status","actualSpendUsd","actualRemainingUsd","purchasePriceUsd"],"additionalProperties":false},"budget":{"type":"object","properties":{"spendCapUsd":{"type":"number","minimum":0},"concurrentMachineCap":{"type":"number","minimum":0}},"required":["spendCapUsd","concurrentMachineCap"],"additionalProperties":false},"usage":{"type":"object","properties":{"spentUsd":{"type":"number","minimum":0},"reservedUsd":{"type":"number","minimum":0},"concurrentMachines":{"type":"number","minimum":0}},"required":["spentUsd","reservedUsd","concurrentMachines"],"additionalProperties":false},"buyUsageUsd":{"anyOf":[{"type":"number","minimum":0},{"type":"null"}]},"buyMachineSlots":{"type":"number","minimum":0},"available":{"type":"boolean"}},"required":["accounting","budget","usage","buyUsageUsd","buyMachineSlots","available"],"additionalProperties":false}},"required":["offer","reason","admitted"],"additionalProperties":false},"MachineOffer_1":{"type":"object","properties":{"provider":{"type":"string"},"region":{"type":"string"},"shape":{"$ref":"#/components/schemas/MachineShape"},"image":{"type":"string"},"pricePerHourUsd":{"anyOf":[{"type":"number"},{"type":"string","enum":["Infinity","-Infinity","NaN"]}]},"idlePricePerHourUsd":{"anyOf":[{"type":"number"},{"type":"string","enum":["Infinity","-Infinity","NaN"]}]},"coldStartSec":{"anyOf":[{"type":"number"},{"type":"string","enum":["Infinity","-Infinity","NaN"]}]},"warmStartSec":{"anyOf":[{"type":"number"},{"type":"string","enum":["Infinity","-Infinity","NaN"]}]},"risk":{"anyOf":[{"type":"number"},{"type":"string","enum":["Infinity","-Infinity","NaN"]}]},"capabilities":{"$ref":"#/components/schemas/MachineCapabilities"},"warm":{"type":"boolean"}},"required":["provider","region","shape","pricePerHourUsd","idlePricePerHourUsd","coldStartSec","warmStartSec","risk","capabilities","warm"],"additionalProperties":false},"PlacementShape":{"type":"object","properties":{"vcpu":{"type":"number","exclusiveMinimum":0},"memGiB":{"type":"number","exclusiveMinimum":0},"diskGiB":{"type":"number","exclusiveMinimum":0},"gpu":{"type":"string"}},"required":["vcpu","memGiB","diskGiB"],"additionalProperties":false},"PlacementCapabilities":{"type":"object","properties":{"memoryPause":{"type":"boolean"},"fork":{"type":"boolean"},"gpu":{"type":"boolean"},"arch":{"type":"string","enum":["arm64","x86_64"]},"os":{"type":"string","enum":["linux","macos"]},"maxVcpu":{"type":"number","exclusiveMinimum":0},"maxMemGiB":{"type":"number","exclusiveMinimum":0}},"additionalProperties":false},"PlacementRequest":{"type":"object","properties":{"capabilities":{"$ref":"#/components/schemas/PlacementCapabilities"},"size":{"anyOf":[{"type":"string","enum":["auto"]},{"$ref":"#/components/schemas/PlacementShape"}]},"taskKind":{"type":"string","enum":["agent","review","build"]},"region":{"type":"string","minLength":1,"maxLength":100},"minimum":{"$ref":"#/components/schemas/PlacementShape"}},"additionalProperties":false},"MeshUnauthorizedEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["MeshUnauthorized"]},"code":{"type":"string","description":"A stable dotted error code; branch on it rather than on message.","examples":["mesh.unauthorized"]},"message":{"type":"string","description":"A human-readable explanation of the error.","examples":["a team install credential is required"]}},"required":["_tag","code","message"],"additionalProperties":false},"MeshUnavailableEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["MeshUnavailable"]},"code":{"type":"string","description":"A stable dotted error code; branch on it rather than on message.","examples":["mesh.unavailable"]},"message":{"type":"string","description":"A human-readable explanation of the error.","examples":["mesh store is unavailable"]}},"required":["_tag","code","message"],"additionalProperties":false},"MeshRateLimitedEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["MeshRateLimited"]},"code":{"type":"string","description":"A stable dotted error code; branch on it rather than on message.","examples":["mesh.rate_limited"]},"message":{"type":"string","description":"A human-readable explanation of the error.","examples":["mesh request rate limit exceeded"]},"retryAfterSeconds":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991}},"required":["_tag","code","message","retryAfterSeconds"],"additionalProperties":false},"MeshConflictEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["MeshConflict"]},"code":{"type":"string","description":"A stable dotted error code; branch on it rather than on message.","examples":["mesh.ambiguous"]},"message":{"type":"string","description":"A human-readable explanation of the error.","examples":["several recipients match"]},"candidates":{"type":"array","items":{"$ref":"#/components/schemas/MeshCandidate"}}},"required":["_tag","code","message"],"additionalProperties":false},"MeshCandidate":{"type":"object","properties":{"daemonId":{"type":"string","description":"A candidate daemon id.","examples":["daemon-2"]},"host":{"type":"string","description":"A candidate host.","examples":["builder-b"]},"name":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"The candidate session name, when applicable.","examples":["agent-b"]},"sessionId":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"The candidate session id, when applicable.","examples":["session-2"]}},"required":["daemonId","host","name","sessionId"],"additionalProperties":false},"MeshForbiddenEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["MeshForbidden"]},"code":{"type":"string","description":"A stable dotted error code; branch on it rather than on message.","examples":["mesh.forbidden"]},"message":{"type":"string","description":"A human-readable explanation of the error.","examples":["the credential is not allowed for this operation"]}},"required":["_tag","code","message"],"additionalProperties":false},"MeshBadRequestEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["MeshBadRequest"]},"code":{"type":"string","description":"A stable dotted error code; branch on it rather than on message.","examples":["mesh.invalid"]},"message":{"type":"string","description":"A human-readable explanation of the error.","examples":["invalid mesh request"]}},"required":["_tag","code","message"],"additionalProperties":false},"MeshNotFoundEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["MeshNotFound"]},"code":{"type":"string","description":"A stable dotted error code; branch on it rather than on message.","examples":["mesh.not_found"]},"message":{"type":"string","description":"A human-readable explanation of the error.","examples":["no such mesh resource"]}},"required":["_tag","code","message"],"additionalProperties":false},"MeshTeamDisabledEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["MeshTeamDisabled"]},"code":{"type":"string","description":"A stable dotted error code; branch on it rather than on message.","examples":["mesh.team_disabled"]},"message":{"type":"string","description":"A human-readable explanation of the error.","examples":["team addresses are disabled"]}},"required":["_tag","code","message"],"additionalProperties":false},"MeshTeamAddresses":{"type":"object","properties":{"addresses":{"type":"array","items":{"$ref":"#/components/schemas/MeshTeamAddress"},"description":"Team addresses and their current routing and permission state."}},"required":["addresses"],"additionalProperties":false},"MeshTeamAddress":{"type":"object","properties":{"teamAddress":{"type":"string","description":"The address: `@member/agent` for a member's agent, or `@team/role` for a role alias.","examples":["@user_abc/reviewer","@team/reviewer"]},"member":{"type":"string","description":"The resolved team member id.","examples":["user_abc"]},"agent":{"type":"string","description":"The agent name at this address.","examples":["reviewer"]},"daemonId":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"The currently registered daemon id, or null when offline.","examples":["daemon-2"]},"host":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"The currently registered host, or null when offline.","examples":["builder-b"]},"sessionId":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"The currently registered session id, or null when offline.","examples":["session-2"]},"name":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"The currently registered session name, or null when offline.","examples":["agent-b"]},"live":{"type":"boolean","description":"Whether a current heartbeat is registered at this address.","examples":[true]},"mayStartWork":{"type":"boolean","description":"Whether senders may ask this agent to start work.","examples":[false]},"allowedSenders":{"anyOf":[{"type":"array","items":{"type":"string"}},{"type":"null"}],"description":"Allowed sender user ids; null means every current member and [] refuses every new sender.","examples":[null]}},"required":["teamAddress","member","agent","daemonId","host","sessionId","name","live","mayStartWork","allowedSenders"],"additionalProperties":false},"MeshTeamPermission":{"type":"object","properties":{"teamAddress":{"type":"string","description":"The canonical `@member/agent` address to configure.","examples":["@user_abc/reviewer"]},"mayStartWork":{"type":"boolean","description":"Whether senders may ask this agent to start work.","examples":[true]},"allowedSenders":{"anyOf":[{"type":"array","items":{"type":"string","description":"A member user id allowed to send.","examples":["user_abc"]},"maxItems":4096},{"type":"null"}],"description":"Omit to preserve the current policy; null allows every current member; [] refuses every new sender.","examples":[null]}},"required":["teamAddress","mayStartWork"],"additionalProperties":false},"MeshTeamRole":{"type":"object","properties":{"role":{"type":"string","minLength":1,"maxLength":128,"description":"The role name used in `@team/{role}` addresses.","examples":["reviewer"]},"member":{"type":"string","minLength":1,"maxLength":128,"description":"The member id assigned to the role.","examples":["user_abc"]},"agent":{"type":"string","minLength":1,"maxLength":128,"description":"The agent name assigned to the role.","examples":["reviewer"]}},"required":["role","member","agent"],"additionalProperties":false},"MeshTeamHandle":{"type":"object","properties":{"handle":{"type":"string","description":"A 2–32 character member handle.","examples":["alice"]},"release":{"type":"boolean","description":"When true, release the handle; otherwise claim it.","examples":[false]},"user":{"type":"string","minLength":1,"maxLength":128,"description":"The member id whose handle is changed; defaults to the authenticated person.","examples":["user_abc"]}},"required":["handle"],"additionalProperties":false},"MeshMessages":{"type":"object","properties":{"messages":{"type":"array","items":{"$ref":"#/components/schemas/MeshInboxMessage"},"description":"Matching team messages; browsing does not create a delivery lease."},"next":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991,"description":"Cursor for an older page; pass it as `before`.","examples":[1761800000000]}},"required":["messages"],"additionalProperties":false},"MeshInboxMessage":{"type":"object","properties":{"messageId":{"type":"string","description":"The hub-assigned message id.","examples":["msg_0123456789abcdef0123456789abcdef"]},"kind":{"type":"string","enum":["prompt","control"],"description":"prompt or control.","examples":["prompt"]},"op":{"anyOf":[{"type":"string","enum":["start","resume","stop","read"],"description":"The daemon operation for a control message. read asks the receiving daemon for one read-only page of a session (its events or info) and is answered in the ack's result; only the same person's daemons may send it.","examples":["resume"]},{"type":"null"}],"description":"The control operation, or null for a prompt.","examples":[null]},"mode":{"type":"string","enum":["turn-end","now"],"description":"Delivery timing used for this message.","examples":["turn-end"]},"state":{"type":"string","enum":["queued","leased","read","delivered","refused","acked","expired"],"description":"The message lifecycle state.","examples":["leased"]},"to":{"type":"object","properties":{"sessionId":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"The destination session id, when addressed to a session.","examples":["session-2"]},"name":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"The destination session name, when addressed by name.","examples":["agent-b"]},"teamAddress":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"The resolved Labs address, when addressed by team address.","examples":["@user_def/reviewer"]}},"required":["sessionId","name","teamAddress"],"additionalProperties":false,"description":"The destination hints carried with the inbox message."},"from":{"type":"object","properties":{"daemonId":{"type":"string","description":"The sender daemon id.","examples":["daemon-1"]},"user":{"type":"string","description":"The user authenticated by the sender token.","examples":["user_abc"]},"host":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"The sender host, when supplied by its heartbeat.","examples":["builder-a"]},"name":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"The sender session name, when supplied.","examples":["agent-a"]},"sessionId":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"The sender session id, when supplied.","examples":["session-1"]},"teamAddress":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"The sender Labs address, when supplied.","examples":["@user_abc/reviewer"]}},"required":["daemonId","user","host","name","sessionId","teamAddress"],"additionalProperties":false,"description":"The sender identity resolved from the token and registration."},"body":{"type":"string","description":"The UTF-8 message body.","examples":["Please review the build."]},"attempt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991,"description":"How many times the hub has leased this message.","examples":[1]},"createdAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991,"description":"When the hub created the message, as Unix milliseconds.","examples":[1761800000000]},"leasedUntil":{"anyOf":[{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},{"type":"null"}],"description":"When the current delivery lease ends, as Unix milliseconds.","examples":[1761800060000]},"startWork":{"type":"string","enum":["allowed","information"],"description":"Whether the target owner granted start-work permission for this delivery.","examples":["information"]}},"required":["messageId","kind","op","mode","state","to","from","body","attempt","createdAt","leasedUntil","startWork"],"additionalProperties":false},"MeshReceipt":{"type":"object","properties":{"messageId":{"type":"string","description":"The hub-assigned message id.","examples":["msg_0123456789abcdef0123456789abcdef"]},"state":{"type":"string","enum":["queued","leased","read","delivered","refused","acked","expired"],"description":"The message lifecycle state.","examples":["queued"]},"resolution":{"anyOf":[{"type":"string","enum":["delivered","refused"]},{"type":"null"}],"description":"The receiver's final delivery answer, or null before delivery.","examples":[null]},"kind":{"type":"string","enum":["prompt","control"],"description":"prompt or control.","examples":["prompt"]},"op":{"anyOf":[{"type":"string","enum":["start","resume","stop","read"],"description":"The daemon operation for a control message. read asks the receiving daemon for one read-only page of a session (its events or info) and is answered in the ack's result; only the same person's daemons may send it.","examples":["resume"]},{"type":"null"}],"description":"The control operation, or null for a prompt.","examples":[null]},"mode":{"type":"string","enum":["turn-end","now"],"description":"Delivery timing used for this message.","examples":["turn-end"]},"to":{"type":"object","properties":{"daemonId":{"type":"string","description":"The destination daemon id.","examples":["daemon-2"]},"host":{"type":"string","description":"The destination host.","examples":["builder-b"]},"sessionId":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"The destination session id, when addressed to a session.","examples":["session-2"]},"name":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"The destination session name, when addressed by name.","examples":["agent-b"]},"teamAddress":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"The resolved Labs address, when addressed by team address.","examples":["@user_def/reviewer"]}},"required":["daemonId","host","sessionId","name","teamAddress"],"additionalProperties":false,"description":"The resolved destination selected by the hub."},"attempt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991,"description":"How many times the hub has leased this message.","examples":[1]},"createdAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991,"description":"When the hub created the message, as Unix milliseconds.","examples":[1761800000000]},"expiresAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991,"description":"When the message expires if it is never acknowledged, as Unix milliseconds.","examples":[1762404800000]},"leasedUntil":{"anyOf":[{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},{"type":"null"}],"description":"When the current delivery lease ends, as Unix milliseconds.","examples":[1761800060000]},"deliveredAt":{"anyOf":[{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},{"type":"null"}],"description":"When the receiving daemon answered delivery, as Unix milliseconds.","examples":[null]},"ackedAt":{"anyOf":[{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},{"type":"null"}],"description":"When the recipient explicitly acknowledged the message, as Unix milliseconds.","examples":[null]},"promptId":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"The receiver's prompt id after delivery, when available.","examples":["prompt-1"]},"detail":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"The receiver's refusal reason, when refused.","examples":["session is busy"]},"startWork":{"type":"string","enum":["allowed","information"],"description":"Whether the target owner granted start-work permission.","examples":["information"]},"readBy":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"The person who marked a team message read, when applicable.","examples":["user_abc"]},"readAt":{"anyOf":[{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},{"type":"null"}],"description":"When a person marked the message read, as Unix milliseconds.","examples":[1761800005000]},"ackedBy":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"The recipient that explicitly acknowledged the message, when applicable.","examples":["user_abc"]},"result":{"type":"string","description":"The receiving daemon's answer to a read control message; present only for its sender.","examples":["{\"events\":[]}"]}},"required":["messageId","state","resolution","kind","op","mode","to","attempt","createdAt","expiresAt","leasedUntil","deliveredAt","ackedAt","promptId","detail","startWork","readBy","readAt","ackedBy"],"additionalProperties":false},"MeshAcknowledge":{"not":{"type":"null"},"description":"An empty payload confirming receipt of a team message.","examples":[{}]},"MeshRead":{"not":{"type":"null"},"description":"An empty payload marking a team message read.","examples":[{}]},"MeshInbox":{"type":"object","properties":{"messages":{"type":"array","items":{"$ref":"#/components/schemas/MeshInboxMessage"},"description":"Messages leased to this daemon in this poll."},"leaseSeconds":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991,"description":"Seconds before an unacknowledged lease is available again.","examples":[60]}},"required":["messages","leaseSeconds"],"additionalProperties":false},"MeshAck":{"type":"object","properties":{"state":{"type":"string","enum":["delivered","refused"],"description":"The receiver's delivery answer.","examples":["delivered"]},"promptId":{"type":"string","maxLength":256,"description":"The receiver's prompt id after delivery.","examples":["prompt-1"]},"detail":{"type":"string","maxLength":1024,"description":"The receiver's refusal reason, when refused.","examples":["session is busy"]},"result":{"type":"string","description":"The answer to a read control message (JSON text, at most 64 KiB of UTF-8; a larger one turns the ack into refused mesh.too_large). Kept only for a delivered read, until the read expires; only the sender reads it, in the receipt.","examples":["{\"events\":[]}"]}},"required":["state"],"additionalProperties":false},"MeshTooLargeEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["MeshTooLarge"]},"code":{"type":"string","description":"A stable dotted error code; branch on it rather than on message.","examples":["mesh.too_large"]},"message":{"type":"string","description":"A human-readable explanation of the error.","examples":["message body is too large"]}},"required":["_tag","code","message"],"additionalProperties":false},"MeshSend":{"type":"object","properties":{"to":{"$ref":"#/components/schemas/MeshRecipient"},"from":{"$ref":"#/components/schemas/MeshSender"},"kind":{"type":"string","enum":["prompt","control"],"description":"prompt delivers text; control requests a daemon operation.","examples":["prompt"]},"op":{"type":"string","enum":["start","resume","stop","read"],"description":"The daemon operation; required for control and forbidden for prompts.","examples":["resume"]},"body":{"type":"string","description":"UTF-8 message text; at most 64 KiB by encoded byte length.","examples":["Please review the build."]},"mode":{"type":"string","enum":["turn-end","now"],"description":"Delivery timing; defaults to turn-end.","examples":["turn-end"]},"idempotencyKey":{"type":"string","description":"A caller-chosen key; retrying the same key and payload returns the original receipt.","examples":["send-review-001"]}},"required":["to","kind","body","idempotencyKey"],"additionalProperties":false},"MeshSender":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":128,"description":"The sender's session name, when supplied.","examples":["agent-a"]},"sessionId":{"type":"string","minLength":1,"maxLength":128,"description":"The sender's session id, when supplied.","examples":["session-1"]},"host":{"type":"string","minLength":1,"maxLength":128,"description":"The sender's host, when supplied.","examples":["builder-a"]},"teamAddress":{"type":"string","description":"The sender's Labs team address, when supplied.","examples":["@user_abc/reviewer"]}},"additionalProperties":false,"description":"Optional sender hints; the hub verifies sender identity from the token."},"MeshRecipient":{"type":"object","properties":{"sessionId":{"type":"string","minLength":1,"maxLength":128,"description":"Match this session id.","examples":["session-1"]},"name":{"type":"string","minLength":1,"maxLength":128,"description":"Match this session name.","examples":["agent-a"]},"host":{"type":"string","minLength":1,"maxLength":128,"description":"Match this host name.","examples":["builder-a"]},"daemonId":{"type":"string","minLength":1,"maxLength":128,"description":"Match this daemon id.","examples":["daemon-1"]},"teamAddress":{"type":"string","description":"A Labs address in `@member/agent` or `@team/role` form.","examples":["@user_abc/reviewer"]}},"additionalProperties":false,"description":"The live session or daemon that should receive the message."},"MeshAddressBook":{"type":"object","properties":{"daemons":{"type":"array","items":{"$ref":"#/components/schemas/MeshDaemon"},"description":"Live daemons matching the lookup filters."},"sessions":{"type":"array","items":{"$ref":"#/components/schemas/MeshSession"},"description":"Live sessions matching the lookup filters."}},"required":["daemons","sessions"],"additionalProperties":false},"MeshSession":{"type":"object","properties":{"name":{"type":"string","description":"The session name on its daemon.","examples":["agent-a"]},"sessionId":{"type":"string","description":"The session id on its daemon.","examples":["session-1"]},"host":{"type":"string","description":"The host running the session.","examples":["builder-a"]},"daemonId":{"type":"string","description":"The daemon install id running the session.","examples":["daemon-1"]},"harness":{"type":"string","description":"The harness hosting the session.","examples":["codex"]},"state":{"type":"string","description":"The daemon's current state for the session.","examples":["running"]},"stuckReason":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"Why the session is stuck, when state is stuck.","examples":["capacity"]},"cwd":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"The session working directory, when known.","examples":["/work/app"]},"pr":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"The pull request this session is working on, when known.","examples":["owner/repo#42"]},"teamAddress":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"The Labs team address for this session, when registered.","examples":["reviewer"]},"lastSeenAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991,"description":"When the daemon last heartbeated, as Unix milliseconds.","examples":[1761800000000]},"expiresAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991,"description":"When this session row expires, as Unix milliseconds.","examples":[1761800060000]}},"required":["name","sessionId","host","daemonId","harness","state","stuckReason","cwd","pr","teamAddress","lastSeenAt","expiresAt"],"additionalProperties":false},"MeshDaemon":{"type":"object","properties":{"daemonId":{"type":"string","description":"The daemon install id.","examples":["daemon-1"]},"host":{"type":"string","description":"The daemon's host name.","examples":["builder-a"]},"user":{"type":"string","description":"The cmux user authenticated by this daemon.","examples":["user_abc"]},"lastSeenAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991,"description":"When the daemon last heartbeated, as Unix milliseconds.","examples":[1761800000000]},"expiresAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991,"description":"When this daemon row expires, as Unix milliseconds.","examples":[1761800060000]}},"required":["daemonId","host","user","lastSeenAt","expiresAt"],"additionalProperties":false},"MeshHeartbeatAccepted":{"type":"object","properties":{"daemonId":{"type":"string","description":"The authenticated daemon's install id.","examples":["daemon-1"]},"ttlSeconds":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991,"description":"How long the heartbeat rows remain current unless replaced.","examples":[90]},"expiresAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991,"description":"When the heartbeat rows expire, as Unix milliseconds.","examples":[1761800090000]}},"required":["daemonId","ttlSeconds","expiresAt"],"additionalProperties":false},"MeshHeartbeat":{"type":"object","properties":{"host":{"type":"string","minLength":1,"maxLength":128,"description":"The host name reported by the daemon.","examples":["builder-a"]},"sessions":{"type":"array","items":{"$ref":"#/components/schemas/MeshSessionAnnouncement"},"maxItems":256,"description":"The daemon's complete current session list; it replaces its previous heartbeat list."},"leaving":{"type":"boolean","description":"True on the daemon's last heartbeat before it stops. Its waiting inbox polls end empty, so a message sent before the restarted daemon polls again is not leased to a connection nobody reads."}},"required":["host","sessions"],"additionalProperties":false},"MeshSessionAnnouncement":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":128,"description":"The session name on its daemon.","examples":["agent-a"]},"sessionId":{"type":"string","minLength":1,"maxLength":128,"description":"The session id on its daemon.","examples":["session-1"]},"harness":{"type":"string","maxLength":64,"description":"The harness hosting the session.","examples":["codex"]},"state":{"type":"string","minLength":1,"maxLength":32,"description":"The daemon's current state for the session.","examples":["running"]},"stuckReason":{"anyOf":[{"type":"string","maxLength":512},{"type":"null"}],"description":"Why the session is stuck, when state is stuck.","examples":["capacity"]},"cwd":{"anyOf":[{"type":"string","maxLength":1024},{"type":"null"}],"description":"The session working directory, when known.","examples":["/work/app"]},"pr":{"anyOf":[{"type":"string","maxLength":256},{"type":"null"}],"description":"The pull request this session is working on, when known.","examples":["owner/repo#42"]},"teamAddress":{"type":"string","minLength":1,"maxLength":128,"description":"The Labs team address for this session, when registered.","examples":["coordinator"]}},"required":["name","sessionId","harness","state"],"additionalProperties":false},"InferenceUnauthorizedEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["InferenceUnauthorized"]},"error":{"type":"object","properties":{"code":{"type":"string","description":"A stable error code; branch on it instead of the human-readable message.","examples":["auth.required"]},"message":{"type":"string","description":"A human-readable explanation.","examples":["a cmux access token is required"]},"type":{"type":"string","description":"An OpenAI-compatible error type, such as `invalid_request_error` or `server_error`.","examples":["invalid_request_error"]}},"required":["code","message","type"],"additionalProperties":false,"description":"The OpenAI-compatible error envelope."}},"required":["_tag","error"],"additionalProperties":false},"InferenceUnavailableEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["InferenceUnavailable"]},"error":{"type":"object","properties":{"code":{"type":"string","description":"A stable error code; branch on it instead of the human-readable message.","examples":["provider.unavailable","inference.unavailable"]},"message":{"type":"string","description":"A human-readable explanation.","examples":["no provider can serve this model now"]},"type":{"type":"string","description":"An OpenAI-compatible error type, such as `invalid_request_error` or `server_error`.","examples":["server_error"]}},"required":["code","message","type"],"additionalProperties":false,"description":"The OpenAI-compatible error envelope."}},"required":["_tag","error"],"additionalProperties":false},"InferenceUpstreamFailedEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["InferenceUpstreamFailed"]},"error":{"type":"object","properties":{"code":{"type":"string","description":"A stable error code; branch on it instead of the human-readable message.","examples":["upstream.failed"]},"message":{"type":"string","description":"A human-readable explanation.","examples":["the model provider failed; retry"]},"type":{"type":"string","description":"An OpenAI-compatible error type, such as `invalid_request_error` or `server_error`.","examples":["server_error"]}},"required":["code","message","type"],"additionalProperties":false,"description":"The OpenAI-compatible error envelope."}},"required":["_tag","error"],"additionalProperties":false},"InferenceRateLimitedEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["InferenceRateLimited"]},"error":{"type":"object","properties":{"code":{"type":"string","description":"A stable error code; branch on it instead of the human-readable message.","examples":["inference.daily_limit"]},"message":{"type":"string","description":"A human-readable explanation.","examples":["this team reached its daily request limit"]},"type":{"type":"string","description":"An OpenAI-compatible error type, such as `invalid_request_error` or `server_error`.","examples":["insufficient_quota"]}},"required":["code","message","type"],"additionalProperties":false,"description":"The OpenAI-compatible error envelope."}},"required":["_tag","error"],"additionalProperties":false},"InferenceTooLargeEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["InferenceTooLarge"]},"error":{"type":"object","properties":{"code":{"type":"string","description":"A stable error code; branch on it instead of the human-readable message.","examples":["validation.too_large","upstream.rejected"]},"message":{"type":"string","description":"A human-readable explanation.","examples":["request body is too large"]},"type":{"type":"string","description":"An OpenAI-compatible error type, such as `invalid_request_error` or `server_error`.","examples":["invalid_request_error"]}},"required":["code","message","type"],"additionalProperties":false,"description":"The OpenAI-compatible error envelope."}},"required":["_tag","error"],"additionalProperties":false},"InferenceNotFoundEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["InferenceNotFound"]},"error":{"type":"object","properties":{"code":{"type":"string","description":"A stable error code; branch on it instead of the human-readable message.","examples":["inference.not_found","model.not_found"]},"message":{"type":"string","description":"A human-readable explanation.","examples":["the inference surface is not enabled"]},"type":{"type":"string","description":"An OpenAI-compatible error type, such as `invalid_request_error` or `server_error`.","examples":["invalid_request_error"]}},"required":["code","message","type"],"additionalProperties":false,"description":"The OpenAI-compatible error envelope."}},"required":["_tag","error"],"additionalProperties":false},"InferenceForbiddenEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["InferenceForbidden"]},"error":{"type":"object","properties":{"code":{"type":"string","description":"A stable error code; branch on it instead of the human-readable message.","examples":["auth.forbidden"]},"message":{"type":"string","description":"A human-readable explanation.","examples":["this token cannot use the model router"]},"type":{"type":"string","description":"An OpenAI-compatible error type, such as `invalid_request_error` or `server_error`.","examples":["invalid_request_error"]}},"required":["code","message","type"],"additionalProperties":false,"description":"The OpenAI-compatible error envelope."}},"required":["_tag","error"],"additionalProperties":false},"InferenceBadRequestEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["InferenceBadRequest"]},"error":{"type":"object","properties":{"code":{"type":"string","description":"A stable error code; branch on it instead of the human-readable message.","examples":["validation.invalid","upstream.rejected"]},"message":{"type":"string","description":"A human-readable explanation.","examples":["body must be JSON"]},"type":{"type":"string","description":"An OpenAI-compatible error type, such as `invalid_request_error` or `server_error`.","examples":["invalid_request_error"]}},"required":["code","message","type"],"additionalProperties":false,"description":"The OpenAI-compatible error envelope."}},"required":["_tag","error"],"additionalProperties":false},"ChatCompletion":{"type":"object","properties":{"id":{"type":"string","description":"The provider completion id.","examples":["cmpl_example_001"]},"object":{"type":"string","description":"The provider response object type.","examples":["chat.completion"]},"created":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991,"description":"Unix seconds when the completion was created.","examples":[1761800000]},"model":{"type":"string","description":"The provider model id used for the completion.","examples":["zai-org/GLM-5.3"]},"choices":{"type":"array","description":"The provider's completion choices."},"usage":{}},"required":["id","object","created","model","choices"],"additionalProperties":false,"description":"The provider's OpenAI-compatible answer, passed through unchanged for non-streaming calls.","examples":[{"id":"cmpl_example_001","object":"chat.completion","created":1761800000,"model":"zai-org/GLM-5.3","choices":[{"index":0,"message":{"role":"assistant","content":"Hello."}}],"usage":{"prompt_tokens":8,"completion_tokens":2,"total_tokens":10}}]},"ChatCompletionRequest":{"type":"object","properties":{"model":{"type":"string","description":"A model id from GET /v1/inference/models.","examples":["z-ai/glm-5.3"]},"messages":{"type":"array","description":"A non-empty array of chat messages; message content may be text or text parts only.","examples":[[{"role":"user","content":"Hello"}]]},"stream":{"type":"boolean","description":"When `true`, return the provider's answer as server-sent events."},"max_tokens":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991,"description":"Requested output token ceiling; `max_completion_tokens` takes precedence when both are sent.","examples":[512]},"max_completion_tokens":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991,"description":"Requested output token ceiling; takes precedence over `max_tokens`. Must be positive; clamped to the model and deployment ceilings.","examples":[512]},"tools":{"type":"array","description":"Function tools for models whose catalog entry has `tools: true`."},"tool_choice":{},"parallel_tool_calls":{"type":"boolean","description":"Whether the provider may make parallel tool calls."},"temperature":{"anyOf":[{"type":"number"},{"type":"string","enum":["Infinity","-Infinity","NaN"]}]},"top_p":{"anyOf":[{"type":"number"},{"type":"string","enum":["Infinity","-Infinity","NaN"]}]},"stop":{},"response_format":{},"seed":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991,"description":"Provider random seed, passed through."},"frequency_penalty":{"anyOf":[{"type":"number"},{"type":"string","enum":["Infinity","-Infinity","NaN"]}]},"presence_penalty":{"anyOf":[{"type":"number"},{"type":"string","enum":["Infinity","-Infinity","NaN"]}]},"reasoning_effort":{"type":"string","description":"Provider reasoning effort setting, passed through.","examples":["medium"]}},"required":["model","messages"],"additionalProperties":false,"description":"An OpenAI-compatible request. The router keeps the fields listed here and drops other provider-routing fields; messages must be non-empty and contain text content only.","examples":[{"model":"z-ai/glm-5.3","messages":[{"role":"user","content":"Hello"}],"max_completion_tokens":512,"stream":false}]},"MessagesCountTokensResponse":{"type":"object","properties":{"input_tokens":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991}},"required":["input_tokens"],"additionalProperties":false},"MessagesCountTokensRequest":{"type":"object","properties":{"model":{"type":"string","minLength":1},"messages":{"type":"array","items":{"type":"object","properties":{"role":{"type":"string","enum":["user","assistant"]},"content":{"anyOf":[{"type":"string"},{"type":"array","items":{"$ref":"#/components/schemas/MessagesContentBlock"}}]}},"required":["role","content"],"additionalProperties":false},"minItems":1},"system":{"anyOf":[{"type":"string"},{"type":"array","items":{"$ref":"#/components/schemas/MessagesContentBlock"}}]},"tools":{"type":"array","items":{"$ref":"#/components/schemas/MessagesTool"}}},"required":["model","messages"],"additionalProperties":false},"MessagesTool":{"type":"object","properties":{"type":{"type":"string"},"name":{"type":"string"},"description":{"type":"string"},"input_schema":{}},"required":["name","input_schema"],"additionalProperties":false},"MessagesContentBlock":{"type":"object","properties":{"type":{"type":"string"},"text":{"type":"string"},"id":{"type":"string"},"name":{"type":"string"},"input":{},"tool_use_id":{"type":"string"},"content":{},"is_error":{"type":"boolean"}},"required":["type"],"additionalProperties":false},"MessagesUpstreamError_1":{"type":"object","properties":{"type":{"type":"string","enum":["error"]},"error":{"type":"object","properties":{"type":{"type":"string","enum":["invalid_request_error","request_too_large"]},"message":{"type":"string"}},"required":["type","message"],"additionalProperties":false}},"required":["type","error"],"additionalProperties":false,"description":"request_too_large: the model provider found the request too large for this model; shorten the context."},"MessagesUpstreamError":{"type":"object","properties":{"type":{"type":"string","enum":["error"]},"error":{"type":"object","properties":{"type":{"type":"string","enum":["invalid_request_error","request_too_large"]},"message":{"type":"string"}},"required":["type","message"],"additionalProperties":false}},"required":["type","error"],"additionalProperties":false,"description":"invalid_request_error: the model provider rejected the request; check messages, tools, max_tokens and the context length."},"MessagesStreamEvent":{"type":"object","properties":{"type":{"type":"string"},"index":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"message":{},"content_block":{},"delta":{},"usage":{"$ref":"#/components/schemas/MessagesUsage"},"error":{}},"required":["type"],"additionalProperties":false},"MessagesUsage":{"type":"object","properties":{"input_tokens":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"output_tokens":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991}},"required":["input_tokens","output_tokens"],"additionalProperties":false},"MessagesResponse":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","enum":["message"]},"role":{"type":"string","enum":["assistant"]},"model":{"type":"string"},"content":{"type":"array","items":{"$ref":"#/components/schemas/MessagesResponseBlock"}},"stop_reason":{"type":"string"},"stop_sequence":{"anyOf":[{"type":"string"},{"type":"null"}]},"usage":{"$ref":"#/components/schemas/MessagesUsage"}},"required":["id","type","role","model","content","stop_reason","stop_sequence","usage"],"additionalProperties":false},"MessagesResponseBlock":{"type":"object","properties":{"type":{"type":"string"},"text":{"type":"string"},"id":{"type":"string"},"name":{"type":"string"},"input":{}},"required":["type"],"additionalProperties":false},"MessagesRequest":{"type":"object","properties":{"model":{"type":"string"},"messages":{"type":"array","items":{"type":"object","properties":{"role":{"type":"string","enum":["user","assistant"]},"content":{"anyOf":[{"type":"string"},{"type":"array","items":{"$ref":"#/components/schemas/MessagesContentBlock"}}]}},"required":["role","content"],"additionalProperties":false}},"max_tokens":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"system":{"anyOf":[{"type":"string"},{"type":"array","items":{"$ref":"#/components/schemas/MessagesContentBlock"}}]},"stream":{"type":"boolean"},"temperature":{"anyOf":[{"type":"number"},{"type":"string","enum":["Infinity","-Infinity","NaN"]}]},"top_p":{"anyOf":[{"type":"number"},{"type":"string","enum":["Infinity","-Infinity","NaN"]}]},"stop_sequences":{"type":"array","items":{"type":"string"}},"tools":{"type":"array","items":{"$ref":"#/components/schemas/MessagesTool"}},"tool_choice":{},"metadata":{}},"required":["model","messages","max_tokens"],"additionalProperties":false},"InferenceModelList":{"type":"object","properties":{"object":{"type":"string","enum":["list"],"description":"Always `list`."},"data":{"type":"array","items":{"$ref":"#/components/schemas/InferenceModel"},"description":"Models that have at least one configured route."}},"required":["object","data"],"additionalProperties":false,"description":"The models that this deployment can serve now.","examples":[{"object":"list","data":[{"id":"z-ai/glm-5.3","object":"model","created":0,"owned_by":"cmux","name":"GLM-5.3","context_length":1000000,"max_output_tokens":65536,"tools":true,"billable":false}]}]},"InferenceModel":{"type":"object","properties":{"id":{"type":"string","description":"The public model id; pass it as `model` to chat completions.","examples":["z-ai/glm-5.3"]},"object":{"type":"string","enum":["model"],"description":"Always `model` for an entry in this list."},"created":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991,"description":"Unix seconds when the model was created; currently `0`."},"owned_by":{"type":"string","enum":["cmux"],"description":"Always `cmux` for this router's catalog."},"name":{"type":"string","description":"A human-readable model name.","examples":["GLM-5.3"]},"context_length":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991,"description":"Maximum input context in tokens.","examples":[1000000]},"max_output_tokens":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991,"description":"Catalog output limit; a deployment may impose a lower ceiling on requests.","examples":[65536]},"tools":{"type":"boolean","description":"Whether this model accepts function tools."},"billable":{"type":"boolean","description":"Whether this model has a price; `false` means calls are recorded but nothing is billed."}},"required":["id","object","created","owned_by","name","context_length","max_output_tokens","tools","billable"],"additionalProperties":false,"description":"One model currently available through the inference router.","examples":[{"id":"z-ai/glm-5.3","object":"model","created":0,"owned_by":"cmux","name":"GLM-5.3","context_length":1000000,"max_output_tokens":65536,"tools":true,"billable":false}]},"ExecutionUnavailableEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ExecutionUnavailable"]},"code":{"type":"string","description":"A stable dotted error code; branch on it, never on `message`.","examples":["execution.unavailable","execution.provider_unavailable"]},"message":{"type":"string","description":"One line for a person.","examples":["execution authority unavailable"]}},"required":["_tag","code","message"],"additionalProperties":false},"ExecutionGoneEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ExecutionGone"]},"code":{"type":"string","description":"A stable dotted error code; branch on it, never on `message`.","examples":["execution.expired","execution.turn_attestation_expired"]},"message":{"type":"string","description":"One line for a person.","examples":["execution receipt expired"]}},"required":["_tag","code","message"],"additionalProperties":false},"ExecutionConflictEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ExecutionConflict"]},"code":{"type":"string","description":"A stable dotted error code; branch on it, never on `message`.","examples":["execution.idempotency_conflict","execution.output_unavailable","execution.turn_attestation_replay","execution.stale_target","execution.target_gone"]},"message":{"type":"string","description":"One line for a person.","examples":["execution receipt conflict"]}},"required":["_tag","code","message"],"additionalProperties":false},"ExecutionNotFoundEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ExecutionNotFound"]},"code":{"type":"string","description":"A stable dotted error code; branch on it, never on `message`.","examples":["execution.not_found"]},"message":{"type":"string","description":"One line for a person.","examples":["no such execution receipt"]}},"required":["_tag","code","message"],"additionalProperties":false},"ExecutionForbiddenEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ExecutionForbidden"]},"code":{"type":"string","description":"A stable dotted error code; branch on it, never on `message`.","examples":["execution.forbidden","execution.turn_attestation_mismatch","execution.grant_required","execution.grant_revoked","execution.account_mismatch","execution.scope_denied"]},"message":{"type":"string","description":"One line for a person.","examples":["execution authority unavailable"]}},"required":["_tag","code","message"],"additionalProperties":false},"ExecutionUnauthorizedEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ExecutionUnauthorized"]},"code":{"type":"string","description":"A stable dotted error code; branch on it, never on `message`.","examples":["execution.unauthorized"]},"message":{"type":"string","description":"One line for a person.","examples":["a signed cmux team-install access token is required"]}},"required":["_tag","code","message"],"additionalProperties":false},"ExecutionBadRequestEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ExecutionBadRequest"]},"code":{"type":"string","description":"A stable dotted error code; branch on it, never on `message`.","examples":["execution.invalid","execution.turn_attestation_invalid"]},"message":{"type":"string","description":"One line for a person.","examples":["invalid execution reference"]}},"required":["_tag","code","message"],"additionalProperties":false},"ExecutionReceipt":{"type":"object","properties":{"schema":{"type":"string","enum":["cmux.execution.receipt/v1"]},"sessionId":{"type":"string"},"turnId":{"type":"string"},"executionId":{"type":"string"},"parentExecutionId":{"anyOf":[{"type":"string"},{"type":"null"}]},"idempotencyKey":{"type":"string"},"target":{"type":"object","properties":{"kind":{"type":"string","enum":["ephemeral_code","machine_job","connected_action"]},"id":{"type":"string","maxLength":256},"provider":{"anyOf":[{"type":"string"},{"type":"null"}]},"generation":{"anyOf":[{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},{"type":"null"}]},"runtimeGeneration":{"anyOf":[{"type":"string"},{"type":"null"}]},"environmentId":{"anyOf":[{"type":"string"},{"type":"null"}]},"environmentAttempt":{"anyOf":[{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},{"type":"null"}]}},"required":["kind","id","provider","generation","environmentId","environmentAttempt"],"additionalProperties":false},"source":{"anyOf":[{"type":"object","properties":{"repository":{"type":"string","maxLength":256},"ref":{"anyOf":[{"type":"string"},{"type":"null"}]},"commit":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["repository","ref","commit"],"additionalProperties":false},{"type":"null"}]},"sourceRefs":{"type":"array","items":{"$ref":"#/components/schemas/ExecutionSourceRef"},"maxItems":32},"capabilities":{"type":"object","properties":{"files":{"type":"array","items":{"type":"object","properties":{"root":{"type":"string","maxLength":256},"access":{"type":"string","enum":["read","read_write"]}},"required":["root","access"],"additionalProperties":false}},"network":{"type":"object","properties":{"mode":{"type":"string","enum":["denied","allowlist","unrestricted"]},"hosts":{"type":"array","items":{"type":"string","maxLength":256}}},"required":["mode","hosts"],"additionalProperties":false},"tools":{"type":"array","items":{"type":"string","maxLength":256}}},"required":["files","network","tools"],"additionalProperties":false},"connector":{"anyOf":[{"type":"object","properties":{"provider":{"type":"string","maxLength":256},"installation":{"type":"string","enum":["absent","installed"]},"authentication":{"type":"string","enum":["missing","valid","expired"]},"accountRef":{"anyOf":[{"type":"string"},{"type":"null"}]},"grantRef":{"anyOf":[{"type":"string"},{"type":"null"}]},"grant":{"type":"string","enum":["absent","active","revoked"]},"scopes":{"type":"array","items":{"type":"string","maxLength":256}}},"required":["provider","installation","authentication","accountRef","grantRef","grant","scopes"],"additionalProperties":false},{"type":"null"}]},"evidence":{"type":"object","properties":{"authority":{"type":"string","enum":["acpmux","cmux_run","machine_lease","connector_gateway"]},"id":{"type":"string"}},"required":["authority","id"],"additionalProperties":false},"state":{"type":"string","enum":["pending","running","succeeded","failed","cancelled","outcome_unknown"]},"reasonCode":{"anyOf":[{"type":"string"},{"type":"null"}]},"exitCode":{"anyOf":[{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},{"type":"null"}]},"createdAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"updatedAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"deadlineAt":{"anyOf":[{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},{"type":"null"}]},"expiresAt":{"anyOf":[{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},{"type":"null"}]},"cleanup":{"type":"string","enum":["destroyed","pending","not_applicable"]},"outputs":{"type":"array","items":{"$ref":"#/components/schemas/ExecutionOutput"}}},"required":["schema","sessionId","turnId","executionId","parentExecutionId","idempotencyKey","target","source","capabilities","connector","evidence","state","reasonCode","exitCode","createdAt","updatedAt","deadlineAt","expiresAt","outputs"],"additionalProperties":false},"ExecutionOutput":{"type":"object","properties":{"backend":{"type":"string","enum":["cmux_artifacts","cmux_run"]},"artifactId":{"type":"string"},"ownerScope":{"type":"string","enum":["user","team"]},"path":{"anyOf":[{"type":"string"},{"type":"null"}]},"revision":{"anyOf":[{"type":"string"},{"type":"null"}]},"digest":{"type":"string"},"mimeType":{"type":"string","maxLength":256},"sizeBytes":{"type":"integer","minimum":0,"maximum":9007199254740991},"retention":{"type":"object","properties":{"kind":{"type":"string","enum":["versioned","expires"]},"expiresAt":{"anyOf":[{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},{"type":"null"}]}},"required":["kind","expiresAt"],"additionalProperties":false}},"required":["backend","artifactId","ownerScope","path","revision","digest","mimeType","sizeBytes","retention"],"additionalProperties":false},"ExecutionSourceRef":{"type":"object","properties":{"resourceRefId":{"type":"string"},"kind":{"type":"string","enum":["repository","pull_request","issue","file","document","message","conversation","other"]},"connectionRef":{"anyOf":[{"type":"string"},{"type":"null"}]},"observedRevision":{"anyOf":[{"type":"string"},{"type":"null"}]}},"required":["resourceRefId","kind","connectionRef","observedRevision"],"additionalProperties":false},"ExecutionOutputLink":{"type":"object","properties":{"backend":{"type":"string","enum":["cmux_artifacts","cmux_run"]},"artifactId":{"type":"string"},"revision":{"anyOf":[{"type":"string"},{"type":"null"}]},"path":{"anyOf":[{"type":"string","maxLength":1024},{"type":"null"}]}},"required":["backend","artifactId"],"additionalProperties":false},"ExecutionLink":{"type":"object","properties":{"sessionId":{"type":"string"},"turnId":{"type":"string"},"executionId":{"type":"string"},"parentExecutionId":{"anyOf":[{"type":"string"},{"type":"null"}]},"idempotencyKey":{"type":"string"},"authorityRef":{"$ref":"#/components/schemas/ExecutionAuthorityRef"},"turnAttestation":{"$ref":"#/components/schemas/ExecutionTurnAttestation"}},"required":["sessionId","turnId","executionId","parentExecutionId","idempotencyKey","authorityRef"],"additionalProperties":false},"ExecutionTurnAttestation":{"type":"object","properties":{"sessionId":{"type":"string"},"turnSeq":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"teamInstall":{"type":"string"},"team":{"type":"string"},"user":{"type":"string"},"issuedAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"expiry":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"nonce":{"type":"string","minLength":1,"maxLength":128},"signature":{"type":"string"}},"required":["sessionId","turnSeq","teamInstall","team","user","issuedAt","expiry","nonce","signature"],"additionalProperties":false},"ExecutionAuthorityRef":{"type":"object","properties":{"kind":{"type":"string","enum":["acpmux","cmux_run","machine_lease","connector_gateway"]},"id":{"type":"string"},"attemptId":{"type":"string"}},"required":["kind","id"],"additionalProperties":false},"CloudEnvironment":{"type":"object","properties":{"id":{"type":"string","description":"A cloud environment's id: `env_` and 24 hex digits.","examples":["env_0123456789abcdef01234567"]},"scope":{"type":"string","enum":["personal","team"]},"name":{"type":"string"},"is_default":{"type":"boolean"},"setup_script":{"anyOf":[{"type":"string"},{"type":"null"}]},"env_vars":{"type":"array","items":{"$ref":"#/components/schemas/EnvironmentVariable"}},"secrets":{"type":"array","items":{"$ref":"#/components/schemas/CloudEnvironmentSecret"}},"network":{"$ref":"#/components/schemas/NetworkAccess"},"created_at":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"updated_at":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"updated_by":{"type":"string"}},"required":["id","scope","name","is_default","setup_script","env_vars","secrets","network","created_at","updated_at","updated_by"],"additionalProperties":false,"description":"What a Cloud chat's machine is set up with. Times are Unix milliseconds."},"NetworkAccess":{"type":"object","properties":{"mode":{"type":"string","enum":["full","limited"]},"package_managers":{"type":"boolean"},"domains":{"type":"array","items":{"type":"string","description":"A lowercase host name, optionally `*.` for its subdomains.","examples":["api.example.com","*.githubusercontent.com"]},"maxItems":200}},"required":["mode","package_managers","domains"],"additionalProperties":false,"description":"The machine's internet access. Full by default. Limited allows package managers (when on) and the listed domains, and nothing else.","examples":[{"mode":"limited","package_managers":true,"domains":["api.example.com"]}]},"CloudEnvironmentSecret":{"type":"object","properties":{"name":{"type":"string","description":"A shell variable name.","examples":["NODE_ENV"]},"updated_at":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991}},"required":["name","updated_at"],"additionalProperties":false,"description":"A secret's name. Its value is never answered; machines of this environment get it."},"EnvironmentVariable":{"type":"object","properties":{"name":{"type":"string","description":"A shell variable name.","examples":["NODE_ENV"]},"value":{"type":"string","maxLength":32768}},"required":["name","value"],"additionalProperties":false,"description":"Set in the setup script's and the agent's shell."},"UpdateCloudEnvironment":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":80,"description":"Shown in the environment picker.","examples":["Default"]},"setup_script":{"anyOf":[{"type":"string","maxLength":65536,"description":"A bash script run in the repository's checkout on a fresh machine before the agent starts; its result is snapshotted so later chats start set up. Up to 64 KB.","examples":["#!/bin/bash\nnpm install"]},{"type":"null"}]},"env_vars":{"type":"array","items":{"$ref":"#/components/schemas/EnvironmentVariable"},"maxItems":200},"set_secrets":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"A shell variable name.","examples":["NODE_ENV"]},"value":{"type":"string","minLength":1,"maxLength":32768}},"required":["name","value"],"additionalProperties":false},"maxItems":100},"remove_secrets":{"type":"array","items":{"type":"string","description":"A shell variable name.","examples":["NODE_ENV"]},"maxItems":100},"network":{"$ref":"#/components/schemas/NetworkAccess"}},"additionalProperties":false,"description":"Only the fields given change."},"CreateCloudEnvironment":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":80,"description":"Shown in the environment picker.","examples":["Default"]},"scope":{"type":"string","enum":["personal","team"]},"setup_script":{"anyOf":[{"type":"string","maxLength":65536,"description":"A bash script run in the repository's checkout on a fresh machine before the agent starts; its result is snapshotted so later chats start set up. Up to 64 KB.","examples":["#!/bin/bash\nnpm install"]},{"type":"null"}]},"env_vars":{"type":"array","items":{"$ref":"#/components/schemas/EnvironmentVariable"},"maxItems":200},"secrets":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"A shell variable name.","examples":["NODE_ENV"]},"value":{"type":"string","minLength":1,"maxLength":32768}},"required":["name","value"],"additionalProperties":false},"maxItems":100},"network":{"$ref":"#/components/schemas/NetworkAccess"}},"required":["name"],"additionalProperties":false},"EnvironmentUnavailableEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["EnvironmentUnavailable"]},"code":{"type":"string","description":"A stable, dotted error code; branch on it, never on `message`.","examples":["environment.unavailable"]},"message":{"type":"string","description":"One line for a person.","examples":["the environment could not be reached; retry"]}},"required":["_tag","code","message"],"additionalProperties":false},"EnvironmentNotFoundEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["EnvironmentNotFound"]},"code":{"type":"string","description":"A stable, dotted error code; branch on it, never on `message`.","examples":["environment.not_found"]},"message":{"type":"string","description":"One line for a person.","examples":["no such environment"]}},"required":["_tag","code","message"],"additionalProperties":false},"EnvironmentForbiddenEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["EnvironmentForbidden"]},"code":{"type":"string","description":"A stable, dotted error code; branch on it, never on `message`.","examples":["environment.forbidden"]},"message":{"type":"string","description":"One line for a person.","examples":["a machine's token cannot derive environments"]}},"required":["_tag","code","message"],"additionalProperties":false},"EnvironmentUnauthorizedEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["EnvironmentUnauthorized"]},"code":{"type":"string","description":"A stable, dotted error code; branch on it, never on `message`.","examples":["environment.unauthorized"]},"message":{"type":"string","description":"One line for a person.","examples":["a cmux access token is required"]}},"required":["_tag","code","message"],"additionalProperties":false},"EnvironmentBadRequestEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["EnvironmentBadRequest"]},"code":{"type":"string","description":"A stable, dotted error code; branch on it, never on `message`.","examples":["environment.invalid"]},"message":{"type":"string","description":"One line for a person.","examples":["repo must be a GitHub repository as owner/name"]}},"required":["_tag","code","message"],"additionalProperties":false},"DerivedEnvironment":{"type":"object","properties":{"id":{"type":"string","description":"An environment's id: `denv_` and 24 hex digits, the same for every derive of one team, repo and ref.","examples":["denv_0123456789abcdef01234567"]},"repo":{"type":"string","description":"The repository, as `owner/name`.","examples":["manaflow-ai/cmux"]},"ref":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"The ref; null is the default branch.","examples":["main"]},"status":{"type":"string","enum":["building","ready","failed"],"description":"building: a setup runs (poll GET until it ends); ready: new chats boot from `snapshot`; failed: the last setup failed (`error`), and a derive after `retry_at` starts a new one. For the first needs_github failure `retry_at` is null, because the client may derive again right after connecting GitHub; if that retry also needs GitHub, the normal cooldown applies."},"attempt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991,"description":"Starts at 1; each new setup of this environment adds one."},"steps":{"type":"array","items":{"$ref":"#/components/schemas/EnvironmentStep"}},"started_at":{"anyOf":[{"$ref":"#/components/schemas/UnixMillis"},{"type":"null"}],"description":"When the current or last setup started."},"deadline_at":{"anyOf":[{"$ref":"#/components/schemas/UnixMillis"},{"type":"null"}],"description":"A setup still running at this time fails with environment.setup_timeout."},"finished_at":{"anyOf":[{"$ref":"#/components/schemas/UnixMillis"},{"type":"null"}],"description":"When the last setup ended; null while one runs."},"retry_at":{"anyOf":[{"$ref":"#/components/schemas/UnixMillis"},{"type":"null"}],"description":"When status is failed: the earliest time a derive starts a new setup."},"error":{"anyOf":[{"type":"object","properties":{"code":{"type":"string","description":"Why the last setup failed; branch on it. Every code is dotted except needs_github. needs_github: connect GitHub at `install_url`, then derive again at once. environment.ref_not_found: no such branch, tag or commit. environment.repo_access: the repository is private or missing for the connected GitHub account. environment.repo_failed: the clone failed. environment.machines_unavailable: this deployment cannot boot builders. environment.provider_failed, environment.inspect_failed, environment.install_failed, environment.source_missing: the setup itself failed (see `log_tail`). environment.setup_timeout and environment.refresh_timeout: it ran past `deadline_at`. environment.snapshot_delete_unavailable: a replaced snapshot awaits cleanup; the environment still works. Derive again after `retry_at`.","examples":["environment.ref_not_found"]},"message":{"type":"string","description":"One line for a person."},"log_tail":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"The last 4 KB of the setup's output, when it got that far."},"install_url":{"type":"string","description":"For needs_github: open this URL to connect GitHub, then derive again; only the repo step reruns."}},"required":["code","message","log_tail"],"additionalProperties":false},{"type":"null"}],"description":"When status is failed: why. Null otherwise."},"snapshot":{"anyOf":[{"type":"object","properties":{"id":{"type":"string"},"built_at":{"$ref":"#/components/schemas/UnixMillis"},"source":{"type":"object","properties":{"commit":{"type":"string"},"lockfiles":{"type":"string"},"setup":{"type":"string"}},"required":["commit","lockfiles","setup"],"additionalProperties":false},"start":{"type":"array","items":{"type":"string"},"description":"The startup command pinned to this snapshot. Use this while a replacement setup is running; absent on legacy snapshots or when no server command was found."}},"required":["id","built_at"],"additionalProperties":false},{"type":"null"}],"description":"The snapshot new chats boot from, once a setup succeeded. `source` names the commit, the lockfiles and the setup it was built from."},"setup":{"anyOf":[{"type":"object","properties":{"install":{"type":"array","items":{"type":"string"}},"verify":{"type":"array","items":{"type":"string"}},"start":{"type":"array","items":{"type":"string"},"description":"At most one server command to start after restoring the snapshot. Absent on older snapshots or when no startup command was found. Never run during installation or snapshot capture."},"sources":{"type":"array","items":{"type":"string"}},"script":{"type":"string"}},"required":["install","verify","sources"],"additionalProperties":false},{"type":"null"}],"description":"The setup agent's choice of install, verify and optional post-restore startup commands, once it has read the repository, and the files it based them on, or the cloud environment's script. `script` is the setup as one bash script, to prefill the cloud environment's Setup script editor. Never required."},"environment":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"The cloud environment's `env_` id; null before them."},"created_at":{"$ref":"#/components/schemas/UnixMillis"},"updated_at":{"$ref":"#/components/schemas/UnixMillis"}},"required":["id","repo","ref","status","attempt","steps","started_at","deadline_at","finished_at","retry_at","error","snapshot","setup","created_at","updated_at"],"additionalProperties":false,"description":"A derived environment. `status` is building while a setup runs (read it again with GET until it ends), ready once new chats can boot from `snapshot`, or failed with `error` set; a derive after `retry_at` starts a new setup. Times are Unix milliseconds.","examples":[{"id":"denv_0123456789abcdef01234567","repo":"manaflow-ai/cmux","ref":"main","status":"building","attempt":1,"steps":[{"id":"machine","state":"done","detail":null,"started_at":1761800000000,"finished_at":1761800003000},{"id":"repo","state":"running","detail":"manaflow-ai/cmux@main","started_at":1761800003000,"finished_at":null}],"started_at":1761800000000,"deadline_at":1761801800000,"finished_at":null,"retry_at":null,"error":null,"snapshot":null,"setup":null,"created_at":1761800000000,"updated_at":1761800003000}]},"UnixMillis":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991},"EnvironmentStep":{"type":"object","properties":{"id":{"type":"string","enum":["machine","repo","secrets","network","install","verify","snapshot"]},"state":{"type":"string","enum":["pending","running","done","failed","skipped"]},"detail":{"$ref":"#/components/schemas/TextOrNull"},"started_at":{"$ref":"#/components/schemas/UnixMillisOrNull"},"finished_at":{"$ref":"#/components/schemas/UnixMillisOrNull"}},"required":["id","state","detail","started_at","finished_at"],"additionalProperties":false,"description":"One step of a setup, in order: machine (boot a builder), repo (clone), secrets (what the setup needs), network (the builder's internet access), install and verify (the setup agent's commands), snapshot (save the result for the next chat). `detail` is one line for a progress card.","examples":[{"id":"repo","state":"done","detail":"manaflow-ai/cmux@main","started_at":1761800000000,"finished_at":1761800004000}]},"UnixMillisOrNull":{"anyOf":[{"$ref":"#/components/schemas/UnixMillis"},{"type":"null"}]},"TextOrNull":{"anyOf":[{"type":"string"},{"type":"null"}]},"DeriveEnvironment":{"type":"object","properties":{"repo":{"type":"string","minLength":2,"maxLength":140,"description":"The GitHub repository of the chat's working directory, as `owner/name`.","examples":["manaflow-ai/cmux"]},"ref":{"anyOf":[{"type":"string","minLength":1,"maxLength":200,"description":"A branch, tag or commit. Absent or null is the repository's default branch.","examples":["main"]},{"type":"null"}]},"environment":{"type":"string","description":"The cloud environment (`/v1/cloud-environments`) to set up with: its setup script replaces the derived one and its variables are set. Absent: the caller's personal Default."}},"required":["repo"],"additionalProperties":false,"description":"The chat's repository, ref and cloud environment. The same team, repo, ref and cloud environment always answer the same environment.","examples":[{"repo":"manaflow-ai/cmux","ref":"main"}]},"SyncUnavailableEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["SyncUnavailable"]},"code":{"type":"string","description":"A stable dotted error code; branch on it instead of message.","examples":["sync.unavailable"]},"message":{"type":"string","description":"A human-readable explanation of the refusal.","examples":["the sync store could not be reached"]}},"required":["_tag","code","message"],"additionalProperties":false},"SyncTooLargeEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["SyncTooLarge"]},"code":{"type":"string","description":"A stable dotted error code; branch on it instead of message.","examples":["sync.too_large"]},"message":{"type":"string","description":"A human-readable explanation of the refusal.","examples":["a blob is at most 64 MiB"]}},"required":["_tag","code","message"],"additionalProperties":false},"SyncNotFoundEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["SyncNotFound"]},"code":{"type":"string","description":"A stable dotted error code; branch on it instead of message.","examples":["sync.not_found","sync.blob_not_found"]},"message":{"type":"string","description":"A human-readable explanation of the refusal.","examples":["blob not found"]}},"required":["_tag","code","message"],"additionalProperties":false},"SyncForbiddenEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["SyncForbidden"]},"code":{"type":"string","description":"A stable dotted error code; branch on it instead of message.","examples":["sync.forbidden"]},"message":{"type":"string","description":"A human-readable explanation of the refusal.","examples":["machine tokens cannot access the sync store"]}},"required":["_tag","code","message"],"additionalProperties":false},"SyncUnauthorizedEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["SyncUnauthorized"]},"code":{"type":"string","description":"A stable dotted error code; branch on it instead of message.","examples":["sync.unauthorized"]},"message":{"type":"string","description":"A human-readable explanation of the refusal.","examples":["a cmux access token of a team install is required"]}},"required":["_tag","code","message"],"additionalProperties":false},"SyncBadRequestEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["SyncBadRequest"]},"code":{"type":"string","description":"A stable dotted error code; branch on it instead of message.","examples":["sync.bad_request","sync.digest_mismatch"]},"message":{"type":"string","description":"A human-readable explanation of the refusal.","examples":["sha256 must be 64 lowercase hexadecimal characters"]}},"required":["_tag","code","message"],"additionalProperties":false},"SyncGrantResult":{"type":"object","properties":{"grant":{"type":"string","description":"A read-only bearer for this user's blobs: `csg_` and 43 base64url characters.","examples":["csg_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"]},"expiresAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991,"description":"When the grant stops working, as Unix milliseconds (one hour after issue).","examples":[1762200000000]}},"required":["grant","expiresAt"],"additionalProperties":false,"description":"A read grant to hand to the caller's own Cloud machine.","examples":[{"grant":"csg_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","expiresAt":1762200000000}]},"SyncBlobResult":{"type":"object","properties":{"sha256":{"type":"string","description":"The SHA-256 of the blob's bytes: 64 lowercase hexadecimal characters.","examples":["9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"]},"size":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991,"description":"The stored blob's size in bytes.","examples":[4]}},"required":["sha256","size"],"additionalProperties":false,"description":"The stored blob.","examples":[{"sha256":"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08","size":4}]},"SyncMissingResult":{"type":"object","properties":{"missing":{"type":"array","items":{"type":"string","description":"The SHA-256 of the blob's bytes: 64 lowercase hexadecimal characters.","examples":["9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"]},"description":"The requested hashes this user's store lacks, in request order, without duplicates.","examples":[["9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"]]}},"required":["missing"],"additionalProperties":false,"description":"The hashes to upload.","examples":[{"missing":["9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"]}]},"SyncMissingRequest":{"type":"object","properties":{"sha256":{"type":"array","items":{"type":"string","description":"The SHA-256 of the blob's bytes: 64 lowercase hexadecimal characters.","examples":["9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"]},"description":"1 to 1000 blob hashes to check; duplicates are answered once.","examples":[["9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"]]}},"required":["sha256"],"additionalProperties":false,"description":"The blob hashes a client is about to upload.","examples":[{"sha256":["9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"]}]},"ArtifactsUnavailableEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ArtifactsUnavailable"]},"code":{"type":"string","description":"A stable dotted error code; branch on it instead of message.","examples":["artifacts.unavailable"]},"message":{"type":"string","description":"A human-readable explanation of the refusal.","examples":["the artifact store could not be reached"]}},"required":["_tag","code","message"],"additionalProperties":false},"ArtifactsTooLargeEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ArtifactsTooLarge"]},"code":{"type":"string","description":"A stable dotted error code; branch on it instead of message.","examples":["artifacts.too_large"]},"message":{"type":"string","description":"A human-readable explanation of the refusal.","examples":["the upload exceeds the service limit"]}},"required":["_tag","code","message"],"additionalProperties":false},"ArtifactsConflictEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ArtifactsConflict"]},"code":{"type":"string","description":"A stable dotted error code; branch on it instead of message.","examples":["artifacts.conflict"]},"message":{"type":"string","description":"A human-readable explanation of the refusal.","examples":["the repository head changed"]},"currentHeadSha":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"The current branch head to use for a retry.","examples":[null]}},"required":["_tag","code","message","currentHeadSha"],"additionalProperties":false},"ArtifactsNotFoundEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ArtifactsNotFound"]},"code":{"type":"string","description":"A stable dotted error code; branch on it instead of message.","examples":["artifacts.not_found"]},"message":{"type":"string","description":"A human-readable explanation of the refusal.","examples":["the artifact repository or path is absent"]}},"required":["_tag","code","message"],"additionalProperties":false},"ArtifactsForbiddenEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ArtifactsForbidden"]},"code":{"type":"string","description":"A stable dotted error code; branch on it instead of message.","examples":["artifacts.forbidden"]},"message":{"type":"string","description":"A human-readable explanation of the refusal.","examples":["machine credentials cannot access artifacts"]}},"required":["_tag","code","message"],"additionalProperties":false},"ArtifactsUnauthorizedEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ArtifactsUnauthorized"]},"code":{"type":"string","description":"A stable dotted error code; branch on it instead of message.","examples":["artifacts.unauthorized"]},"message":{"type":"string","description":"A human-readable explanation of the refusal.","examples":["a team-install access token is required"]}},"required":["_tag","code","message"],"additionalProperties":false},"ArtifactsBadRequestEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ArtifactsBadRequest"]},"code":{"type":"string","description":"A stable dotted error code; branch on it instead of message.","examples":["artifacts.bad_path"]},"message":{"type":"string","description":"A human-readable explanation of the refusal.","examples":["the artifact path or upload is invalid"]}},"required":["_tag","code","message"],"additionalProperties":false},"ArtifactCommit":{"type":"object","properties":{"sha":{"type":"string","description":"The commit id.","examples":["0123456789abcdef0123456789abcdef01234567"]},"parents":{"type":"array","items":{"type":"string"},"description":"Parent commit ids.","examples":[[]]},"message":{"type":"string","description":"The stored commit message.","examples":["Add report"]},"authorName":{"type":"string","description":"The authenticated user that made the commit.","examples":["user_abc"]},"time":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991,"description":"Commit time as Unix milliseconds.","examples":[1761800000000]},"trailers":{"$ref":"#/components/schemas/ArtifactTrailers"},"paths":{"type":"array","items":{"type":"string"},"description":"Paths changed by the commit.","examples":[["reports/index.html"]]}},"required":["sha","parents","message","authorName","time","trailers"],"additionalProperties":false,"description":"Commit metadata returned after writes and from history.","examples":[{"sha":"0123456789abcdef0123456789abcdef01234567","parents":[],"message":"Add report","authorName":"user_abc","time":1761800000000,"trailers":{}}]},"ArtifactTrailers":{"type":"object","properties":{"session":{"type":"string","maxLength":256,"description":"The agent session associated with the commit.","examples":["session_abc123"]},"machine":{"type":"string","maxLength":256,"description":"The machine associated with the commit.","examples":["machine_01"]},"harness":{"type":"string","maxLength":128,"description":"The client harness that made the commit.","examples":["codex"]}},"additionalProperties":false,"description":"Optional commit metadata copied into listings and history.","examples":[{"session":"session_abc123","machine":"machine_01","harness":"codex"}]},"ArtifactItem":{"type":"object","properties":{"id":{"type":"string","description":"The generated artifact id.","examples":["01J8Z7Q4M6N2K5P8R3T1V9W0X2"]},"path":{"type":"string","description":"The logical repository path.","examples":["artifacts/01J8Z7Q4M6N2K5P8R3T1V9W0X2"]},"title":{"type":"string","description":"The artifact title, when this row is an artifact.","examples":["Build report"]},"kind":{"type":"string","enum":["html","markdown","json","image","other"],"description":"The artifact's presentation kind.","examples":["html"]},"size":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991,"description":"Logical size in bytes.","examples":[128]},"updatedAt":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991,"description":"Latest change time as Unix milliseconds.","examples":[1761800000000]},"session":{"type":"string","description":"The associated agent session, when present.","examples":["session_abc123"]},"machine":{"type":"string","description":"The associated machine, when present.","examples":["machine_01"]},"harness":{"type":"string","description":"The associated harness, when present.","examples":["codex"]},"commit":{"type":"string","description":"The commit containing this item.","examples":["0123456789abcdef0123456789abcdef01234567"]}},"required":["path","kind","size","updatedAt","commit"],"additionalProperties":false,"description":"One listed artifact or regular repository file.","examples":[{"id":"01J8Z7Q4M6N2K5P8R3T1V9W0X2","path":"artifacts/01J8Z7Q4M6N2K5P8R3T1V9W0X2","title":"Build report","kind":"html","size":128,"updatedAt":1761800000000,"commit":"0123456789abcdef0123456789abcdef01234567"}]},"ArtifactCreate":{"type":"object","properties":{"title":{"type":"string","maxLength":512,"description":"The artifact display title.","examples":["Build report"]},"kind":{"type":"string","enum":["html","markdown","json","image","other"],"description":"The artifact's presentation kind.","examples":["html"]},"files":{"type":"array","items":{"$ref":"#/components/schemas/ArtifactFile"},"description":"Files stored below the generated artifact id; upload bytes through /blobs and pass their SHA-256 references.","examples":[[]]},"trailers":{"$ref":"#/components/schemas/ArtifactTrailers"},"expectedHeadSha":{"anyOf":[{"type":"string","description":"A lowercase hexadecimal commit id.","examples":["0123456789abcdef0123456789abcdef01234567"]},{"type":"null"}],"description":"The repository head read by the caller; null creates from an empty repository.","examples":[null]}},"required":["title","kind","files","trailers","expectedHeadSha"],"additionalProperties":false,"description":"The title, kind and files for a new artifact.","examples":[{"title":"Build report","kind":"html","files":[],"trailers":{},"expectedHeadSha":null}]},"ArtifactFile":{"type":"object","properties":{"name":{"type":"string","maxLength":1024,"description":"The artifact-relative file name.","examples":["index.html"]},"contentBase64":{"type":"string","description":"Inline file bytes in base64; use exactly one content source for a put.","examples":["SGVsbG8="]},"blobSha256":{"type":"string","description":"The SHA-256 of a previously uploaded blob; use exactly one content source for a put.","examples":["0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"]},"contentType":{"type":"string","maxLength":256,"description":"The file MIME type.","examples":["text/html"]}},"required":["name"],"additionalProperties":false,"description":"One file included when creating an artifact.","examples":[{"name":"index.html","contentBase64":"SGVsbG8=","contentType":"text/html"}]},"ArtifactSave":{"type":"object","properties":{"expectedHeadSha":{"anyOf":[{"type":"string","description":"A lowercase hexadecimal commit id.","examples":["0123456789abcdef0123456789abcdef01234567"]},{"type":"null"}],"description":"The head read by the caller; null saves an empty repository.","examples":[null]},"branch":{"type":"string","description":"A repository ref.","examples":["main"]},"message":{"type":"string","maxLength":4096,"description":"The human-readable commit message.","examples":["Update report"]},"trailers":{"$ref":"#/components/schemas/ArtifactTrailers"},"changes":{"type":"array","items":{"$ref":"#/components/schemas/ArtifactChange"},"maxItems":10000,"description":"Changes to apply atomically.","examples":[[{"path":"reports/index.html","op":"put","contentBase64":"SGVsbG8="}]]}},"required":["expectedHeadSha","message","trailers","changes"],"additionalProperties":false,"description":"A compare-and-swap commit to an artifact repository.","examples":[{"expectedHeadSha":null,"message":"Add report","trailers":{},"changes":[]}]},"ArtifactChange":{"type":"object","properties":{"path":{"type":"string","description":"A repository-relative file path.","examples":["reports/index.html"]},"op":{"type":"string","enum":["put","delete"],"description":"Whether to write or remove the path.","examples":["put"]},"contentBase64":{"type":"string","description":"Inline file bytes in base64; use exactly one content source for a put.","examples":["SGVsbG8="]},"blobSha256":{"type":"string","description":"The SHA-256 of a previously uploaded blob; use exactly one content source for a put.","examples":["0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"]},"contentType":{"type":"string","maxLength":256,"description":"The file MIME type; inferred from the path when omitted.","examples":["text/html"]}},"required":["path","op"],"additionalProperties":false,"description":"One file change in a compare-and-swap save.","examples":[{"path":"reports/index.html","op":"put","contentBase64":"SGVsbG8="}]},"ShareUnavailableEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ShareUnavailable"]},"code":{"type":"string","description":"A stable share refusal code; branch on it instead of `message`.","examples":["share.host_offline","share.host_timeout","share.host_error","share.unavailable","share.sign_in_unavailable"]},"message":{"type":"string","description":"A fixed human-readable explanation.","examples":["the owner's cmux is offline"]}},"required":["_tag","code","message"],"additionalProperties":false},"ShareRateLimitedEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ShareRateLimited"]},"code":{"type":"string","description":"A stable share refusal code; branch on it instead of `message`.","examples":["share.rate_limited"]},"message":{"type":"string","description":"A fixed human-readable explanation.","examples":["too many requests; retry later"]}},"required":["_tag","code","message"],"additionalProperties":false},"ShareGoneEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ShareGone"]},"code":{"type":"string","description":"A stable share refusal code; branch on it instead of `message`.","examples":["share.revoked","share.expired","share.closed"]},"message":{"type":"string","description":"A fixed human-readable explanation.","examples":["the share was revoked"]}},"required":["_tag","code","message"],"additionalProperties":false},"ShareConflictEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ShareConflict"]},"code":{"type":"string","description":"A stable share refusal code; branch on it instead of `message`.","examples":["share.conflict"]},"message":{"type":"string","description":"A fixed human-readable explanation.","examples":["another provision key owns this share"]}},"required":["_tag","code","message"],"additionalProperties":false},"ShareNotFoundEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ShareNotFound"]},"code":{"type":"string","description":"A stable share refusal code; branch on it instead of `message`.","examples":["share.not_found"]},"message":{"type":"string","description":"A fixed human-readable explanation.","examples":["no such share exists"]}},"required":["_tag","code","message"],"additionalProperties":false},"ShareForbiddenEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ShareForbidden"]},"code":{"type":"string","description":"A stable share refusal code; branch on it instead of `message`.","examples":["share.forbidden","share.bad_secret","share.secret","share.refused","share.used","share.kicked","share.left","share.not_invited","share.unverified"]},"message":{"type":"string","description":"A fixed human-readable explanation.","examples":["not allowed for this caller"]}},"required":["_tag","code","message"],"additionalProperties":false},"ShareUnauthorizedEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ShareUnauthorized"]},"code":{"type":"string","description":"A stable share refusal code; branch on it instead of `message`.","examples":["share.unauthorized"]},"message":{"type":"string","description":"A fixed human-readable explanation.","examples":["missing or invalid credentials"]}},"required":["_tag","code","message"],"additionalProperties":false},"ShareBadRequestEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["ShareBadRequest"]},"code":{"type":"string","description":"A stable share refusal code; branch on it instead of `message`.","examples":["share.bad_expiry","share.name"]},"message":{"type":"string","description":"A fixed human-readable explanation.","examples":["expires_at is outside the allowed window"]}},"required":["_tag","code","message"],"additionalProperties":false},"AcceptedShare":{"type":"object","properties":{"guest_id":{"type":"string","description":"The guest id assigned by the owner's daemon.","examples":["guest-a"]},"expires_at":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991,"description":"Unix milliseconds when the guest cookie expires."},"role":{"type":"string","enum":["view","talk"],"description":"The invite's role when the daemon names it: `view` watches only (no composer), `talk` may also send held messages."}},"required":["guest_id","expires_at"],"additionalProperties":false,"description":"The invited guest's identity, expiry and role after accept."},"AcceptShare":{"type":"object","properties":{"attempt_id":{"type":"string","pattern":"^[A-Za-z0-9_-]{16,128}$","description":"The page's opaque attempt id; reuse it when retrying the same accept."}},"required":["attempt_id"],"additionalProperties":false,"description":"An invited person's join. The account is never a request field: the room takes it from this request's own cmux sign-in (its verified email, lowercased) and the name from the account's display name."},"RedeemedShare":{"type":"object","properties":{"guest_id":{"type":"string","description":"The guest id assigned by the owner's daemon.","examples":["guest-a"]},"expires_at":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991,"description":"Unix milliseconds when the guest cookie expires."}},"required":["guest_id","expires_at"],"additionalProperties":false,"description":"The guest identity and expiry after redemption."},"RedeemShare":{"type":"object","properties":{"attempt_id":{"type":"string","pattern":"^[A-Za-z0-9_-]{16,128}$","description":"The daemon's opaque attempt id; reuse it when retrying the same redemption."},"secret":{"type":"string","minLength":1,"maxLength":256,"description":"The secret from the guest link fragment."},"name":{"type":"string","minLength":1,"maxLength":64,"description":"The guest display name, from 1 through 64 characters.","examples":["Ada"]}},"required":["attempt_id","secret","name"],"additionalProperties":false,"description":"The guest's link secret and daemon redemption details."},"EndedShare":{"type":"object","properties":{"state":{"type":"string","enum":["revoked","expired","closed"],"description":"Why the share ended: owner/host revoked it, its expiry passed, or the host closed it."}},"required":["state"],"additionalProperties":false,"description":"The terminal state of a chat share."},"ProvisionedShare":{"type":"object","properties":{"host_token":{"type":"string","description":"A bearer for the owner's host WebSocket and DELETE request."},"url_base":{"type":"string","description":"The guest link base; append `#` and the guest secret."}},"required":["host_token","url_base"],"additionalProperties":false,"description":"Credentials and link base returned after a share is provisioned."},"ProvisionShare":{"type":"object","properties":{"provision_key":{"type":"string","pattern":"^[A-Za-z0-9_-]{16,128}$","description":"An opaque key that makes retries idempotent for this share."},"secret_sha256":{"type":"string","pattern":"^[0-9a-f]{64}$","description":"The SHA-256 digest of the secret in the guest link."},"expires_at":{"type":"integer","minimum":-9007199254740991,"maximum":9007199254740991,"description":"Unix milliseconds when the share expires; at most 7 days ahead."},"uses":{"type":"integer","minimum":1,"maximum":8,"description":"Requested use count, from 1 through 8, stored with the room; the daemon is responsible for enforcing redemption limits.","examples":[1]}},"required":["provision_key","secret_sha256","expires_at","uses"],"additionalProperties":false,"description":"The owner-supplied configuration for a hosted chat share."},"NotFoundEncoded":{"type":"object","properties":{"_tag":{"type":"string","enum":["NotFound"]},"message":{"type":"string"}},"required":["_tag","message"],"additionalProperties":false},"McpAuthorizationServerMetadata":{"type":"object","properties":{"issuer":{"type":"string"},"authorization_endpoint":{"type":"string"},"token_endpoint":{"type":"string"},"registration_endpoint":{"type":"string"},"revocation_endpoint":{"type":"string"},"response_types_supported":{"type":"array","items":{"type":"string"}},"response_modes_supported":{"type":"array","items":{"type":"string"}},"grant_types_supported":{"type":"array","items":{"type":"string"}},"code_challenge_methods_supported":{"type":"array","items":{"type":"string"}},"token_endpoint_auth_methods_supported":{"type":"array","items":{"type":"string"}},"revocation_endpoint_auth_methods_supported":{"type":"array","items":{"type":"string"}},"scopes_supported":{"type":"array","items":{"type":"string"}},"authorization_response_iss_parameter_supported":{"type":"boolean"}},"required":["issuer","authorization_endpoint","token_endpoint","registration_endpoint","revocation_endpoint","response_types_supported","response_modes_supported","grant_types_supported","code_challenge_methods_supported","token_endpoint_auth_methods_supported","revocation_endpoint_auth_methods_supported","scopes_supported","authorization_response_iss_parameter_supported"],"additionalProperties":false,"description":"RFC 8414 metadata for the hosted MCP's development authorization server."},"McpProtectedResourceMetadata":{"type":"object","properties":{"resource":{"type":"string","description":"The MCP resource URL for this deployment."},"authorization_servers":{"type":"array","items":{"type":"string"},"description":"Advertised authorization server issuers; in development this origin serves the authorization server."},"scopes_supported":{"type":"array","items":{"type":"string"},"description":"Advertised OAuth scopes; deployments with the AgentGateway advertise mcp:write for approved issue comments, while read-only deployments advertise mcp:read. This does not establish an enforced OAuth grant.","examples":[["mcp:read"],["mcp:read","mcp:write"]]},"bearer_methods_supported":{"type":"array","items":{"type":"string"},"description":"Bearer transport methods accepted by the resource.","examples":[["header"]]}},"required":["resource","authorization_servers","scopes_supported","bearer_methods_supported"],"additionalProperties":false,"description":"OAuth protected-resource metadata for the hosted MCP endpoint."},"ClientConfig":{"type":"object","properties":{"version":{"type":"number","enum":[1]},"name":{"type":"string"},"api_origin":{"type":"string"},"auth_web_origin":{"type":"string"},"vm_origin":{"type":"string"},"platform_origin":{"type":"string"},"mobile_origin":{"type":"string"},"device_hub_origin":{"type":"string"},"share_room_origin":{"type":"string"},"share_api_origin":{"type":"string"},"stack_origin":{"type":"string"},"stack_project_id":{"type":"string"},"stack_client_key":{"type":"string"},"image_channel":{"type":"string"},"link_hosts":{"type":"array","items":{"type":"string"}},"share_hosts":{"type":"array","items":{"type":"string"}},"capabilities":{"type":"object","properties":{"machine_create":{"type":"object","properties":{"size_name":{"type":"boolean"},"idle_seconds":{"type":"boolean"},"name":{"type":"boolean"},"bootstrap":{"type":"boolean"},"machine_config_base64":{"type":"boolean"}},"required":["size_name","idle_seconds","name","bootstrap","machine_config_base64"],"additionalProperties":false},"sizes":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"vcpu":{"anyOf":[{"type":"number"},{"type":"string","enum":["Infinity","-Infinity","NaN"]}]},"memGiB":{"anyOf":[{"type":"number"},{"type":"string","enum":["Infinity","-Infinity","NaN"]}]},"diskGiB":{"anyOf":[{"type":"number"},{"type":"string","enum":["Infinity","-Infinity","NaN"]}]}},"required":["name","vcpu","memGiB","diskGiB"],"additionalProperties":false}},"create":{"type":"object","properties":{"size":{"type":"boolean"},"idlePause":{"type":"boolean"},"name":{"type":"boolean"},"bootstrap":{"type":"boolean"}},"required":["size","idlePause","name","bootstrap"],"additionalProperties":false},"stats":{"type":"boolean"},"snapshot":{"type":"boolean"},"fork":{"type":"boolean"},"network":{"type":"boolean"},"publish":{"type":"boolean"},"client_session":{"type":"boolean"}},"required":["machine_create","sizes","create","stats","snapshot","fork","network","publish","client_session"],"additionalProperties":false}},"required":["version","name","api_origin","auth_web_origin","vm_origin","platform_origin","mobile_origin","device_hub_origin","share_room_origin","share_api_origin","stack_origin","stack_project_id","stack_client_key","image_channel","link_hosts","share_hosts","capabilities"],"additionalProperties":false},"SlackError503":{"type":"object","properties":{"code":{"type":"string","enum":["slack.not_configured","slack.chief_unavailable","slack.upstream_unavailable","slack.unavailable"],"examples":["slack.not_configured","slack.chief_unavailable","slack.upstream_unavailable","slack.unavailable"]},"message":{"type":"string"}},"required":["code","message"],"additionalProperties":false,"description":"slack.not_configured: the bridge is not ready; check deployment secrets and bindings then retry | slack.chief_unavailable: the bridge is not ready; check deployment secrets and bindings then retry | slack.upstream_unavailable: the bridge is not ready; check deployment secrets and bindings then retry | slack.unavailable: the bridge is not ready; check deployment secrets and bindings then retry"},"SlackError413":{"type":"object","properties":{"code":{"anyOf":[{"type":"string","enum":["slack.payload_too_large"]}],"examples":["slack.payload_too_large"]},"message":{"type":"string"}},"required":["code","message"],"additionalProperties":false,"description":"slack.payload_too_large: the request exceeds one MiB; reduce the payload"},"SlackError409":{"type":"object","properties":{"code":{"anyOf":[{"type":"string","enum":["slack.owner_conflict"]}],"examples":["slack.owner_conflict"]},"message":{"type":"string"}},"required":["code","message"],"additionalProperties":false,"description":"slack.owner_conflict: the workspace already belongs to another cmux owner or team; disconnect it first"},"SlackError404":{"type":"object","properties":{"code":{"type":"string","enum":["slack.not_found","slack.not_connected"],"examples":["slack.not_found","slack.not_connected"]},"message":{"type":"string"}},"required":["code","message"],"additionalProperties":false,"description":"slack.not_found: the surface or installation is unavailable; use an installed development workspace | slack.not_connected: the surface or installation is unavailable; use an installed development workspace"},"SlackError403":{"type":"object","properties":{"code":{"anyOf":[{"type":"string","enum":["slack.forbidden"]}],"examples":["slack.forbidden"]},"message":{"type":"string"}},"required":["code","message"],"additionalProperties":false,"description":"slack.forbidden: requires a person with a selected cmux team, or the post's specified owner must match the install"},"SlackError401":{"type":"object","properties":{"code":{"type":"string","enum":["slack.unauthorized","slack.invalid_signature"],"examples":["slack.unauthorized","slack.invalid_signature"]},"message":{"type":"string"}},"required":["code","message"],"additionalProperties":false,"description":"slack.unauthorized: authentication failed; supply the required bearer or a fresh Slack signature | slack.invalid_signature: authentication failed; supply the required bearer or a fresh Slack signature"},"SlackError400":{"type":"object","properties":{"code":{"type":"string","enum":["slack.invalid_state","slack.invalid_ticket","slack.oauth_denied","slack.invalid_event","slack.invalid_message","slack.invalid_owner"],"examples":["slack.invalid_state","slack.invalid_ticket","slack.oauth_denied","slack.invalid_event","slack.invalid_message","slack.invalid_owner"]},"message":{"type":"string"}},"required":["code","message"],"additionalProperties":false,"description":"slack.invalid_state: the request is invalid; restart installation or correct the request | slack.invalid_ticket: the request is invalid; restart installation or correct the request | slack.oauth_denied: the request is invalid; restart installation or correct the request | slack.invalid_event: the request is invalid; restart installation or correct the request | slack.invalid_message: the request is invalid; restart installation or correct the request | slack.invalid_owner: the request is invalid; restart installation or correct the request"}},"securitySchemes":{"cmuxAccessToken":{"type":"http","scheme":"Bearer"},"meshRecipientBearer":{"description":"A recipient's team install or cmm_ machine credential, or signed-in Stack person session. Person sessions select a team with x-cmux-team; daemon credentials use their authenticated team.","type":"http","scheme":"Bearer"},"stackPersonSession":{"description":"A signed-in person's Stack session access token. Install and cmm_ machine credentials are refused.","type":"http","scheme":"Bearer"},"bearer":{"type":"http","scheme":"Bearer"}}},"security":[],"tags":[{"name":"Slack","description":"Development-only Chief bridge. Disabled deployments return 404 before authentication; missing Slack secrets return 503 slack.not_configured."},{"name":"System","description":"Liveness and build info"},{"name":"Hosted MCP (development only)","description":"Stateless Streamable HTTP. POST supports MCP 2026-07-28 and legacy initialization; GET and DELETE /mcp return 405. OAuth discovery and a development authorization server (/oauth/*) let a client add /mcp as a connector; see docs/hosted-mcp.md."},{"name":"Projects","description":"Example typed resource, kept in one isolate's memory: a project may vanish between calls. Useful only as a smoke test of a client."},{"name":"Chat shares","description":"Hosted rooms for agent chat shares. The owner's cmux daemon provisions a room and holds its host socket (WS /v1/chat-shares/{shareId}/host); guests redeem a link, or an invited person accepts after signing in, and get a cookie for WS /v1/chat-shares/{shareId}/guest."},{"name":"Artifacts","description":"Versioned, per-user artifacts and synced memory. Served in development only; elsewhere every path answers 404 artifacts.not_found before auth."},{"name":"Sync","description":"The per-user content-addressed blob store behind `cmux link sync push`. Served in development only; elsewhere every path answers 404 sync.not_found before auth."},{"name":"Environments","description":"The environment a cloud chat runs in, derived from the chat's repository and ref with no user step. POST /derive answers it, creating it and starting its setup in the background on first use; a derive while a setup runs joins it. GET /{environmentId} reads its progress for the chat's progress card."},{"name":"Cloud environments","description":"Development-only. What a Cloud chat's machine is set up with: a name, an optional setup script, environment variables, secrets and network access, per person or per team, with a Default in each."},{"name":"Execution receipts","description":"Redacted, permissioned projections of existing acpmux, Cloud Run, machine lease and connector evidence. Linking an execution or artifact never dispatches work or mints credentials. Off in every deployment until source ownership and retained-output verification are wired."},{"name":"Inference","description":"OpenAI-compatible model router: one endpoint, several providers. GET /models lists the models this deployment can serve now. POST /chat/completions takes the OpenAI request (stream with `stream: true`, answered as server-sent events) and routes it to the cheapest configured provider, falling back to the next one only before the first byte and only on an error that bills nothing."},{"name":"Mesh","description":"The team's agent mesh: every acpmux daemon heartbeats its sessions (POST /heartbeat), finds a session by name (GET /sessions), sends to it (POST /messages, a durable receipt at GET /messages/{messageId}), and long-polls its own inbox (GET /inbox), acking each message (POST /messages/{messageId}/ack). Delivery is at-least-once: a message stays leased to the receiving daemon until acked and expires after 7 days. The hub grants nothing; the receiving daemon applies its own rules."},{"name":"Machine placement","description":"Development-only Auto placement. Pick (formerly place) is a dry run; create reserves team budget and creates idempotently by clientKey. Budget caps and usage come from the server's lease store, never the request. Queue and upgrade return no machine. A fallback is advisory and requires fresh admission; it never triggers a second create after an ambiguous error."},{"name":"machineReservations"},{"name":"Machines","description":"Development-only team machines. The offers endpoint merges normalized offers from every configured provider. Every other call is checked by the team machine policy (docs/team-machines.md): a team machine is listed, opened, resumed, paused and forked by any member; a private one only by its creator; deleting takes the creator or an admin; visibility is the creator's. A snapshot records who took it and inherits its machine's visibility at that moment; it is listed and forked under the same rules. A machine or snapshot the caller may not see answers 404. Every action but a read leaves an audit row, refusals included; members read the rows of what they can see and their own, admins all, billing the rows that change spend. Usage reports running hours by who started them, by creator and by machine; the team pays for all of them. A client attached to a machine posts its presence about every minute and deletes it on detach; every machine lists who is present. App-started chats on a machine (chat-access) are its creator's; the creator or an admin shares them with a member (chat-grants, PUT) and takes the share back in one call (DELETE). A grant never opens a private machine."},{"name":"Workspace machines","description":"Development-only. One workspace per small machine for now (Cloud is just a button; machines stay hidden). A workspace's machine is its creator's own: private, in their personal team."},{"name":"defaultMachines"},{"name":"Cloud triggers","description":"Per-owner GitHub event triggers for quiet Cloud chat turns."},{"name":"Cloud trigger ingress","description":"Signed external events and exact guest operation introspection; no person bearer is accepted as trigger authority."},{"name":"Cloud turn execution","description":"Validate preparation, claim execution once, and finish a turn using its scoped capability bearer."},{"name":"Cloud turn capabilities","description":"Owners issue short-lived capabilities scoped to a turn, machine generation, purpose and attempt."},{"name":"Machine automatic sizing","description":"Development-only. Read-only: sizing happens on its own, with no request."},{"name":"Cloud fork runs","description":"Durable copy-on-write chat forks across harnesses. A run owns its source snapshot and restored child machines; the client owns git seeding, transfer copies and sync-back bundle application."},{"name":"Registered machines","description":"Development-only heartbeats from machines already owned by cmux."},{"name":"Connectors","description":"Development-only repository connectors"},{"name":"Me","description":"The signed-in account's own connections"},{"name":"Machine join credentials","description":"Development-only machine onboarding."},{"name":"Machine join redemption","description":"Development-only single-use join."},{"name":"Mesh node registry","description":"Machine-credential-authenticated WireGuard node registration and team peer maps. Register a node, then poll its peer map with its current machine credential."},{"name":"Mesh node ACL","description":"Team members, with a cmux access token, set explicit directed node-to-node denies and revoke registered nodes; a machine's own token cannot."},{"name":"Hosted connector resources","description":"Hosted connector resources are off in this deployment and return 404 resource.not_found until a resolver is enabled. When enabled: durable, connection-bound references to provider resources."},{"name":"Cloud task results","description":"Turn a finished machine task into a branch, bounded diff card and optional GitHub pull request."},{"name":"Vault env","description":"A person's own env entries (API keys and other variables). Machine and agent tokens are refused. On where VAULT_ENABLED is set, with its own master key (VAULT_MASTER_KEK) wrapping one data key per user; elsewhere every path answers 404 before any auth. Every answer is no-store."},{"name":"Vault grants","description":"Which of a person's machines read which of their entries, until when. A machine with consent and no grant yet gets every entry for 7 days at its first read. On where VAULT_ENABLED is set, with its own master key (VAULT_MASTER_KEK) wrapping one data key per user; elsewhere every path answers 404 before any auth. Every answer is no-store."},{"name":"Vault reads","description":"Who read a person's vault, and the reads worth a look. On where VAULT_ENABLED is set, with its own master key (VAULT_MASTER_KEK) wrapping one data key per user; elsewhere every path answers 404 before any auth. Every answer is no-store."},{"name":"Vault (machine)","description":"A person's vault as the machines they consented to read it. On where VAULT_ENABLED is set, with its own master key (VAULT_MASTER_KEK) wrapping one data key per user; elsewhere every path answers 404 before any auth. Every answer is no-store."},{"name":"Dependency caches","description":"Installed dependencies (node_modules, Cargo's registry and git caches, uv's cache) as archives keyed by lockfile, so a new Cloud machine installs warm. Archives hold no credentials: the machine never packs .npmrc, .yarnrc, .netrc, .env or any credentials file. Development-only (DEP_CACHE_ENABLED with the DEP_CACHE object); elsewhere every path answers 404 before any auth."},{"name":"Chief","description":"The signed-in person's own Chief. Authenticate with the HttpOnly __Host-cmux-chief cookie after /chief/sign-in, or a human Stack bearer. Cookie mutations require this platform's Origin. Tickets expire in 30 seconds, are single-use, and open only the returned main-conversation socket using subprotocols cmux.wire.v1 and ticket.<ticket>. Messages return the authoritative Home receipt; ok=false is a rejected operation, never a sent message."},{"name":"Authentication","description":"Install challenge and token minting"},{"name":"JWKS","description":"Public JSON Web Key Set for access-token verification."},{"name":"Native network","description":"Native client network discovery."}]}