@nylorun/runtime 0.19.0-beta → 0.19.1-beta

package/dist/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Runtime API",
-    "version": "0.19.0-beta",
+    "version": "0.19.1-beta",
     "x-nylorun-protocol": {
       "min": 4,
       "max": 8,
@@ -16573,77 +16573,33 @@
     "parameters": {}
   },
   "paths": {
-    "/health": {
-      "get": {
-        "tags": [
-          "Runtime"
-        ],
-        "summary": "Check the Runtime",
-        "description": "The protocol range and features a client checks first. Refuses an `Origin`.",
-        "responses": {
-          "200": {
-            "description": "The Runtime is up",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Health"
-                }
-              }
-            }
-          }
-        }
-      }
-    },
-    "/ready": {
-      "get": {
-        "tags": [
-          "Runtime"
-        ],
-        "summary": "Check the Runtime is ready",
-        "description": "The listener, the Tenant (open), Postgres, Restate and S2, and the open Tenant's harnesses.",
-        "responses": {
-          "200": {
-            "description": "Ready",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Ready"
-                }
-              }
-            }
-          },
-          "503": {
-            "description": "Not ready: `checks` says what is not"
-          }
-        }
-      }
-    },
-    "/v1/me": {
-      "get": {
+    "/v1/agents/{agentId}": {
+      "put": {
         "tags": [
-          "Runtime"
+          "Agents"
         ],
-        "summary": "Get who the caller is",
-        "description": "The subject, scopes, agents and sandbox grants of the credential that sends it: an application key (alone or acting for a subject), a management key (`via: management:<principalId>`, no scopes, no agents), or a trusted issuer's token (`via: issuer:<name>`).",
+        "summary": "Put an agent's definition",
         "security": [
           {
             "applicationKey": []
-          },
-          {
-            "managementKey": []
-          },
-          {
-            "issuerToken": []
           }
         ],
         "x-nylorun-credentials": [
           "application",
-          "subject",
-          "management",
-          "token"
+          "subject"
+        ],
+        "x-nylorun-scopes": [
+          "agents:write"
         ],
-        "x-nylorun-scopes": "any",
         "parameters": [
+          {
+            "schema": {
+              "type": "string"
+            },
+            "required": true,
+            "name": "agentId",
+            "in": "path"
+          },
           {
             "schema": {
               "type": "string",
@@ -16675,13 +16631,23 @@
             "in": "header"
           }
         ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PutAgentRequest"
+              }
+            }
+          }
+        },
         "responses": {
           "200": {
-            "description": "The caller",
+            "description": "The definition, stored",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/MeResponse"
+                  "$ref": "#/components/schemas/PutAgentResponse"
                 }
               }
             }
@@ -16696,18 +16662,8 @@
               }
             }
           },
-          "401": {
-            "description": "The token expired (`token_expired`), or its issuer's keys cannot be fetched now (`issuer_unavailable`)",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Rejected"
-                }
-              }
-            }
-          },
           "403": {
-            "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
+            "description": "Not allowed for this credential or subject scope, a key of the other API (`key_role_mismatch`), or an application key from a browser (`origin_rejected`)",
             "content": {
               "application/json": {
                 "schema": {
@@ -16749,32 +16705,30 @@
         }
       }
     },
-    "/v1/access/jwks": {
+    "/v1/agents": {
       "get": {
         "tags": [
-          "Runtime"
+          "Agents"
         ],
-        "summary": "Get the public keys the Runtime's tokens are signed with",
-        "description": "A JSON Web Key Set, to verify a token the Runtime signed without calling it. No credential is needed.",
+        "summary": "List agents",
+        "description": "With an application key, every definition, manifest included. With a trusted issuer's token, only the agents it may use, by name.",
         "security": [
           {
             "applicationKey": []
           },
-          {
-            "managementKey": []
-          },
           {
             "issuerToken": []
-          },
-          {}
+          }
         ],
         "x-nylorun-credentials": [
           "application",
           "subject",
-          "management",
           "token"
         ],
-        "x-nylorun-scopes": "any",
+        "x-nylorun-scopes": [
+          "agents:read",
+          "agents:write"
+        ],
         "parameters": [
           {
             "schema": {
@@ -16809,11 +16763,18 @@
         ],
         "responses": {
           "200": {
-            "description": "The public keys",
+            "description": "The agents",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/Jwks"
+                  "anyOf": [
+                    {
+                      "$ref": "#/components/schemas/ListAgentsResponse"
+                    },
+                    {
+                      "$ref": "#/components/schemas/ListPublicAgentsResponse"
+                    }
+                  ]
                 }
               }
             }
@@ -16839,7 +16800,7 @@
             }
           },
           "403": {
-            "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
+            "description": "Not allowed for this credential or subject scope, a key of the other API (`key_role_mismatch`), or an application key from a browser (`origin_rejected`)",
             "content": {
               "application/json": {
                 "schema": {
@@ -16881,58 +16842,31 @@
         }
       }
     },
-    "/openapi/runtime.json": {
-      "get": {
-        "tags": [
-          "Runtime"
-        ],
-        "summary": "Get the Runtime API's document",
-        "description": "This document. `/openapi.json` is the same.",
-        "responses": {
-          "200": {
-            "description": "The Runtime API's OpenAPI document"
-          }
-        }
-      }
-    },
-    "/openapi.json": {
-      "get": {
-        "tags": [
-          "Runtime"
-        ],
-        "summary": "Get the Runtime API's document (alias)",
-        "responses": {
-          "200": {
-            "description": "The Runtime API's OpenAPI document"
-          }
-        }
-      }
-    },
-    "/v1/agents/{agentId}": {
+    "/v1/files/{file}": {
       "put": {
         "tags": [
-          "Agents"
+          "Definition files"
         ],
-        "summary": "Put an agent's definition",
+        "summary": "Upload a definition file",
+        "description": "Stores the body, at most 10485760 bytes, at the SHA-256 the path names; a body with another hash stores nothing (`400`). A file the Tenant holds already is kept as it is (`200`).",
         "security": [
           {
             "applicationKey": []
           }
         ],
         "x-nylorun-credentials": [
-          "application",
-          "subject"
-        ],
-        "x-nylorun-scopes": [
-          "agents:write"
+          "application"
         ],
+        "x-nylorun-scopes": "never",
         "parameters": [
           {
             "schema": {
-              "type": "string"
+              "type": "string",
+              "description": "`sha256:` and the SHA-256 of the file's bytes, 64 lowercase hex digits"
             },
             "required": true,
-            "name": "agentId",
+            "description": "`sha256:` and the SHA-256 of the file's bytes, 64 lowercase hex digits",
+            "name": "file",
             "in": "path"
           },
           {
@@ -16944,45 +16878,37 @@
             "description": "The protocol version, `8`",
             "name": "Nylorun-Protocol",
             "in": "header"
-          },
-          {
-            "schema": {
-              "type": "string",
-              "description": "The person an application key acts for"
-            },
-            "required": false,
-            "description": "The person an application key acts for",
-            "name": "Nylorun-Subject",
-            "in": "header"
-          },
-          {
-            "schema": {
-              "type": "string",
-              "description": "The subject's space-separated scopes; required with a subject"
-            },
-            "required": false,
-            "description": "The subject's space-separated scopes; required with a subject",
-            "name": "Nylorun-Scopes",
-            "in": "header"
           }
         ],
         "requestBody": {
           "required": true,
+          "description": "The file's bytes",
           "content": {
-            "application/json": {
+            "application/octet-stream": {
               "schema": {
-                "$ref": "#/components/schemas/PutAgentRequest"
+                "type": "string",
+                "format": "binary"
               }
             }
           }
         },
         "responses": {
           "200": {
-            "description": "The definition, stored",
+            "description": "The Tenant held the file already",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/PutAgentResponse"
+                  "$ref": "#/components/schemas/DefinitionFileView"
+                }
+              }
+            }
+          },
+          "201": {
+            "description": "The file, stored",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/DefinitionFileView"
                 }
               }
             }
@@ -17017,6 +16943,9 @@
               }
             }
           },
+          "413": {
+            "description": "Larger than 10485760 bytes (`limit_exceeded`)"
+          },
           "426": {
             "description": "`Nylorun-Protocol` missing or unsupported",
             "content": {
@@ -17038,301 +16967,37 @@
             }
           }
         }
-      }
-    },
-    "/v1/agents": {
-      "get": {
+      },
+      "head": {
         "tags": [
-          "Agents"
+          "Definition files"
         ],
-        "summary": "List agents",
-        "description": "With an application key, every definition, manifest included. With a trusted issuer's token, only the agents it may use, by name.",
+        "summary": "Whether the Runtime holds a definition file",
+        "description": "`200` when the Tenant holds the file, `404` when it does not: upload it.",
         "security": [
           {
             "applicationKey": []
-          },
-          {
-            "issuerToken": []
           }
         ],
         "x-nylorun-credentials": [
-          "application",
-          "subject",
-          "token"
-        ],
-        "x-nylorun-scopes": [
-          "agents:read",
-          "agents:write"
+          "application"
         ],
+        "x-nylorun-scopes": "never",
         "parameters": [
           {
             "schema": {
               "type": "string",
-              "description": "The protocol version, `8`"
+              "description": "`sha256:` and the SHA-256 of the file's bytes, 64 lowercase hex digits"
             },
             "required": true,
-            "description": "The protocol version, `8`",
-            "name": "Nylorun-Protocol",
-            "in": "header"
+            "description": "`sha256:` and the SHA-256 of the file's bytes, 64 lowercase hex digits",
+            "name": "file",
+            "in": "path"
           },
           {
             "schema": {
               "type": "string",
-              "description": "The person an application key acts for"
-            },
-            "required": false,
-            "description": "The person an application key acts for",
-            "name": "Nylorun-Subject",
-            "in": "header"
-          },
-          {
-            "schema": {
-              "type": "string",
-              "description": "The subject's space-separated scopes; required with a subject"
-            },
-            "required": false,
-            "description": "The subject's space-separated scopes; required with a subject",
-            "name": "Nylorun-Scopes",
-            "in": "header"
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "The agents",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "anyOf": [
-                    {
-                      "$ref": "#/components/schemas/ListAgentsResponse"
-                    },
-                    {
-                      "$ref": "#/components/schemas/ListPublicAgentsResponse"
-                    }
-                  ]
-                }
-              }
-            }
-          },
-          "400": {
-            "description": "Invalid headers, path, body or cursor",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Rejected"
-                }
-              }
-            }
-          },
-          "401": {
-            "description": "The token expired (`token_expired`), or its issuer's keys cannot be fetched now (`issuer_unavailable`)",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Rejected"
-                }
-              }
-            }
-          },
-          "403": {
-            "description": "Not allowed for this credential or subject scope, a key of the other API (`key_role_mismatch`), or an application key from a browser (`origin_rejected`)",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Rejected"
-                }
-              }
-            }
-          },
-          "404": {
-            "description": "Not found, or a credential the Tenant does not know (`not_found`)",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Rejected"
-                }
-              }
-            }
-          },
-          "426": {
-            "description": "`Nylorun-Protocol` missing or unsupported",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ProtocolRejected"
-                }
-              }
-            }
-          },
-          "503": {
-            "description": "The Tenant's storage or streams are unavailable",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Rejected"
-                }
-              }
-            }
-          }
-        }
-      }
-    },
-    "/v1/files/{file}": {
-      "put": {
-        "tags": [
-          "Definition files"
-        ],
-        "summary": "Upload a definition file",
-        "description": "Stores the body, at most 10485760 bytes, at the SHA-256 the path names; a body with another hash stores nothing (`400`). A file the Tenant holds already is kept as it is (`200`).",
-        "security": [
-          {
-            "applicationKey": []
-          }
-        ],
-        "x-nylorun-credentials": [
-          "application"
-        ],
-        "x-nylorun-scopes": "never",
-        "parameters": [
-          {
-            "schema": {
-              "type": "string",
-              "description": "`sha256:` and the SHA-256 of the file's bytes, 64 lowercase hex digits"
-            },
-            "required": true,
-            "description": "`sha256:` and the SHA-256 of the file's bytes, 64 lowercase hex digits",
-            "name": "file",
-            "in": "path"
-          },
-          {
-            "schema": {
-              "type": "string",
-              "description": "The protocol version, `8`"
-            },
-            "required": true,
-            "description": "The protocol version, `8`",
-            "name": "Nylorun-Protocol",
-            "in": "header"
-          }
-        ],
-        "requestBody": {
-          "required": true,
-          "description": "The file's bytes",
-          "content": {
-            "application/octet-stream": {
-              "schema": {
-                "type": "string",
-                "format": "binary"
-              }
-            }
-          }
-        },
-        "responses": {
-          "200": {
-            "description": "The Tenant held the file already",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/DefinitionFileView"
-                }
-              }
-            }
-          },
-          "201": {
-            "description": "The file, stored",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/DefinitionFileView"
-                }
-              }
-            }
-          },
-          "400": {
-            "description": "Invalid headers, path, body or cursor",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Rejected"
-                }
-              }
-            }
-          },
-          "403": {
-            "description": "Not allowed for this credential or subject scope, a key of the other API (`key_role_mismatch`), or an application key from a browser (`origin_rejected`)",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Rejected"
-                }
-              }
-            }
-          },
-          "404": {
-            "description": "Not found, or a credential the Tenant does not know (`not_found`)",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Rejected"
-                }
-              }
-            }
-          },
-          "413": {
-            "description": "Larger than 10485760 bytes (`limit_exceeded`)"
-          },
-          "426": {
-            "description": "`Nylorun-Protocol` missing or unsupported",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ProtocolRejected"
-                }
-              }
-            }
-          },
-          "503": {
-            "description": "The Tenant's storage or streams are unavailable",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Rejected"
-                }
-              }
-            }
-          }
-        }
-      },
-      "head": {
-        "tags": [
-          "Definition files"
-        ],
-        "summary": "Whether the Runtime holds a definition file",
-        "description": "`200` when the Tenant holds the file, `404` when it does not: upload it.",
-        "security": [
-          {
-            "applicationKey": []
-          }
-        ],
-        "x-nylorun-credentials": [
-          "application"
-        ],
-        "x-nylorun-scopes": "never",
-        "parameters": [
-          {
-            "schema": {
-              "type": "string",
-              "description": "`sha256:` and the SHA-256 of the file's bytes, 64 lowercase hex digits"
-            },
-            "required": true,
-            "description": "`sha256:` and the SHA-256 of the file's bytes, 64 lowercase hex digits",
-            "name": "file",
-            "in": "path"
-          },
-          {
-            "schema": {
-              "type": "string",
-              "description": "The protocol version, `8`"
+              "description": "The protocol version, `8`"
             },
             "required": true,
             "description": "The protocol version, `8`",
@@ -19070,13 +18735,323 @@
         }
       }
     },
-    "/v1/ag-ui/agents/{agentId}/threads/{threadId}/events": {
-      "get": {
+    "/v1/ag-ui/agents/{agentId}/threads/{threadId}/events": {
+      "get": {
+        "tags": [
+          "AG-UI"
+        ],
+        "summary": "Reattach to a run",
+        "description": "The rest of a run after a dropped connection, from `Last-Event-ID` or `cursor`.",
+        "security": [
+          {
+            "applicationKey": []
+          },
+          {
+            "issuerToken": []
+          }
+        ],
+        "x-nylorun-credentials": [
+          "subject",
+          "token"
+        ],
+        "x-nylorun-scopes": [
+          "sessions:own"
+        ],
+        "parameters": [
+          {
+            "schema": {
+              "type": "string"
+            },
+            "required": true,
+            "name": "agentId",
+            "in": "path"
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "required": true,
+            "name": "threadId",
+            "in": "path"
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "required": false,
+            "name": "cursor",
+            "in": "query"
+          },
+          {
+            "schema": {
+              "type": "string",
+              "description": "The run to report events as"
+            },
+            "required": false,
+            "description": "The run to report events as",
+            "name": "runId",
+            "in": "query"
+          },
+          {
+            "schema": {
+              "type": "string",
+              "description": "The protocol version, `8`"
+            },
+            "required": true,
+            "description": "The protocol version, `8`",
+            "name": "Nylorun-Protocol",
+            "in": "header"
+          },
+          {
+            "schema": {
+              "type": "string",
+              "description": "The person an application key acts for"
+            },
+            "required": false,
+            "description": "The person an application key acts for",
+            "name": "Nylorun-Subject",
+            "in": "header"
+          },
+          {
+            "schema": {
+              "type": "string",
+              "description": "The subject's space-separated scopes; required with a subject"
+            },
+            "required": false,
+            "description": "The subject's space-separated scopes; required with a subject",
+            "name": "Nylorun-Scopes",
+            "in": "header"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "The run's remaining events",
+            "content": {
+              "text/event-stream": {
+                "itemSchema": {
+                  "$ref": "#/components/schemas/AgUiEvent"
+                }
+              }
+            }
+          },
+          "204": {
+            "description": "Nothing to send: no run is going, and none ended after the cursor"
+          },
+          "400": {
+            "description": "Invalid headers, path, body or cursor",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "The token expired (`token_expired`), or its issuer's keys cannot be fetched now (`issuer_unavailable`)",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "Not allowed for this credential or subject scope, a key of the other API (`key_role_mismatch`), or an application key from a browser (`origin_rejected`)",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Not found, or a credential the Tenant does not know (`not_found`)",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
+          "426": {
+            "description": "`Nylorun-Protocol` missing or unsupported",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProtocolRejected"
+                }
+              }
+            }
+          },
+          "503": {
+            "description": "The Tenant's storage or streams are unavailable",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/v1/ag-ui/agents/{agentId}/threads/{threadId}/messages": {
+      "get": {
+        "tags": [
+          "AG-UI"
+        ],
+        "summary": "Get a thread's messages",
+        "security": [
+          {
+            "applicationKey": []
+          },
+          {
+            "issuerToken": []
+          }
+        ],
+        "x-nylorun-credentials": [
+          "subject",
+          "token"
+        ],
+        "x-nylorun-scopes": [
+          "sessions:own"
+        ],
+        "parameters": [
+          {
+            "schema": {
+              "type": "string"
+            },
+            "required": true,
+            "name": "agentId",
+            "in": "path"
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "required": true,
+            "name": "threadId",
+            "in": "path"
+          },
+          {
+            "schema": {
+              "type": "string",
+              "description": "The protocol version, `8`"
+            },
+            "required": true,
+            "description": "The protocol version, `8`",
+            "name": "Nylorun-Protocol",
+            "in": "header"
+          },
+          {
+            "schema": {
+              "type": "string",
+              "description": "The person an application key acts for"
+            },
+            "required": false,
+            "description": "The person an application key acts for",
+            "name": "Nylorun-Subject",
+            "in": "header"
+          },
+          {
+            "schema": {
+              "type": "string",
+              "description": "The subject's space-separated scopes; required with a subject"
+            },
+            "required": false,
+            "description": "The subject's space-separated scopes; required with a subject",
+            "name": "Nylorun-Scopes",
+            "in": "header"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "The thread's messages; none before its first run",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/AgUiMessage"
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Invalid headers, path, body or cursor",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "The token expired (`token_expired`), or its issuer's keys cannot be fetched now (`issuer_unavailable`)",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "Not allowed for this credential or subject scope, a key of the other API (`key_role_mismatch`), or an application key from a browser (`origin_rejected`)",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Not found, or a credential the Tenant does not know (`not_found`)",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          },
+          "426": {
+            "description": "`Nylorun-Protocol` missing or unsupported",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProtocolRejected"
+                }
+              }
+            }
+          },
+          "503": {
+            "description": "The Tenant's storage or streams are unavailable",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/v1/ag-ui/agents/{agentId}/threads/{threadId}/cancel": {
+      "post": {
         "tags": [
           "AG-UI"
         ],
-        "summary": "Reattach to a run",
-        "description": "The rest of a run after a dropped connection, from `Last-Event-ID` or `cursor`.",
+        "summary": "Cancel a thread's running turn",
         "security": [
           {
             "applicationKey": []
@@ -19109,24 +19084,6 @@
             "name": "threadId",
             "in": "path"
           },
-          {
-            "schema": {
-              "type": "string"
-            },
-            "required": false,
-            "name": "cursor",
-            "in": "query"
-          },
-          {
-            "schema": {
-              "type": "string",
-              "description": "The run to report events as"
-            },
-            "required": false,
-            "description": "The run to report events as",
-            "name": "runId",
-            "in": "query"
-          },
           {
             "schema": {
               "type": "string",
@@ -19159,18 +19116,8 @@
           }
         ],
         "responses": {
-          "200": {
-            "description": "The run's remaining events",
-            "content": {
-              "text/event-stream": {
-                "itemSchema": {
-                  "$ref": "#/components/schemas/AgUiEvent"
-                }
-              }
-            }
-          },
           "204": {
-            "description": "Nothing to send: no run is going, and none ended after the cursor"
+            "description": "Cancelled"
           },
           "400": {
             "description": "Invalid headers, path, body or cursor",
@@ -19235,12 +19182,16 @@
         }
       }
     },
-    "/v1/ag-ui/agents/{agentId}/threads/{threadId}/messages": {
+    "/v1/a2a/agents/{agentId}/card": {
       "get": {
         "tags": [
-          "AG-UI"
+          "A2A"
         ],
-        "summary": "Get a thread's messages",
+        "summary": "Get an agent's A2A card",
+        "externalDocs": {
+          "description": "The A2A specification",
+          "url": "https://a2a-protocol.org/latest/specification/"
+        },
         "security": [
           {
             "applicationKey": []
@@ -19250,10 +19201,12 @@
           }
         ],
         "x-nylorun-credentials": [
+          "application",
           "subject",
           "token"
         ],
         "x-nylorun-scopes": [
+          "agents:read",
           "sessions:own"
         ],
         "parameters": [
@@ -19265,14 +19218,6 @@
             "name": "agentId",
             "in": "path"
           },
-          {
-            "schema": {
-              "type": "string"
-            },
-            "required": true,
-            "name": "threadId",
-            "in": "path"
-          },
           {
             "schema": {
               "type": "string",
@@ -19306,14 +19251,11 @@
         ],
         "responses": {
           "200": {
-            "description": "The thread's messages; none before its first run",
+            "description": "The card",
             "content": {
               "application/json": {
                 "schema": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/components/schemas/AgUiMessage"
-                  }
+                  "$ref": "#/components/schemas/A2aAgentCard"
                 }
               }
             }
@@ -19381,12 +19323,17 @@
         }
       }
     },
-    "/v1/ag-ui/agents/{agentId}/threads/{threadId}/cancel": {
+    "/v1/a2a/agents/{agentId}": {
       "post": {
         "tags": [
-          "AG-UI"
+          "A2A"
         ],
-        "summary": "Cancel a thread's running turn",
+        "summary": "Call an agent over A2A",
+        "description": "A2A 1.0 JSON-RPC, for a subject: `SendMessage` (blocking up to 5 minutes, or `returnImmediately`), `GetTask` and `CancelTask`. A context is one session per subject, agent and `contextId`; a task is one turn. JSON-RPC errors are answered with 200; limits, scopes and unavailable streams stay HTTP errors.",
+        "externalDocs": {
+          "description": "The A2A specification",
+          "url": "https://a2a-protocol.org/latest/specification/"
+        },
         "security": [
           {
             "applicationKey": []
@@ -19413,11 +19360,13 @@
           },
           {
             "schema": {
-              "type": "string"
+              "type": "string",
+              "description": "Or the `A2A-Version` header: `1.0`"
             },
-            "required": true,
-            "name": "threadId",
-            "in": "path"
+            "required": false,
+            "description": "Or the `A2A-Version` header: `1.0`",
+            "name": "A2A-Version",
+            "in": "query"
           },
           {
             "schema": {
@@ -19450,9 +19399,26 @@
             "in": "header"
           }
         ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/A2aJsonRpcRequest"
+              }
+            }
+          }
+        },
         "responses": {
-          "204": {
-            "description": "Cancelled"
+          "200": {
+            "description": "The JSON-RPC answer: a result, or an A2A error",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/A2aJsonRpcResponse"
+                }
+              }
+            }
           },
           "400": {
             "description": "Invalid headers, path, body or cursor",
@@ -19517,16 +19483,13 @@
         }
       }
     },
-    "/v1/a2a/agents/{agentId}/card": {
-      "get": {
+    "/v1/sandboxes/{sandboxId}": {
+      "put": {
         "tags": [
-          "A2A"
+          "Sandboxes"
         ],
-        "summary": "Get an agent's A2A card",
-        "externalDocs": {
-          "description": "The A2A specification",
-          "url": "https://a2a-protocol.org/latest/specification/"
-        },
+        "summary": "Create or find a sandbox",
+        "description": "Creates the sandbox within the Tenant's limits, or answers the one with this id, so get-or-create is one call. Its spec is fixed once it exists; labels, when sent, replace its labels. Kind `pod` needs sandbox pods (`nylorun sandbox enable`): it is created at once, and a PUT on an existing pod sandbox starts it again when it was stopped, or revives it with a longer `lifecycle.ttl`.",
         "security": [
           {
             "applicationKey": []
@@ -19541,16 +19504,17 @@
           "token"
         ],
         "x-nylorun-scopes": [
-          "agents:read",
-          "sessions:own"
+          "sandboxes:write"
         ],
         "parameters": [
           {
             "schema": {
-              "type": "string"
+              "type": "string",
+              "description": "The sandbox id, percent-encoded: `team-a%2Fproj-42` for `team-a/proj-42`"
             },
             "required": true,
-            "name": "agentId",
+            "description": "The sandbox id, percent-encoded: `team-a%2Fproj-42` for `team-a/proj-42`",
+            "name": "sandboxId",
             "in": "path"
           },
           {
@@ -19584,13 +19548,23 @@
             "in": "header"
           }
         ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PutSandboxRequest"
+              }
+            }
+          }
+        },
         "responses": {
           "200": {
-            "description": "The card",
+            "description": "The sandbox",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/A2aAgentCard"
+                  "$ref": "#/components/schemas/SandboxView"
                 }
               }
             }
@@ -19635,6 +19609,9 @@
               }
             }
           },
+          "409": {
+            "description": "A sandbox with this id has another spec, the Tenant holds as many sandboxes as it allows (`limit_exceeded`), kind pod without sandbox pods (`sandbox_unavailable`), or a lost pod sandbox (`sandbox_lost`)"
+          },
           "426": {
             "description": "`Nylorun-Protocol` missing or unsupported",
             "content": {
@@ -19656,19 +19633,13 @@
             }
           }
         }
-      }
-    },
-    "/v1/a2a/agents/{agentId}": {
-      "post": {
+      },
+      "get": {
         "tags": [
-          "A2A"
+          "Sandboxes"
         ],
-        "summary": "Call an agent over A2A",
-        "description": "A2A 1.0 JSON-RPC, for a subject: `SendMessage` (blocking up to 5 minutes, or `returnImmediately`), `GetTask` and `CancelTask`. A context is one session per subject, agent and `contextId`; a task is one turn. JSON-RPC errors are answered with 200; limits, scopes and unavailable streams stay HTTP errors.",
-        "externalDocs": {
-          "description": "The A2A specification",
-          "url": "https://a2a-protocol.org/latest/specification/"
-        },
+        "summary": "Get a sandbox",
+        "description": "Its spec, labels, state and the sessions attached to it (acting for a person, only theirs).",
         "security": [
           {
             "applicationKey": []
@@ -19678,31 +19649,25 @@
           }
         ],
         "x-nylorun-credentials": [
+          "application",
           "subject",
           "token"
         ],
         "x-nylorun-scopes": [
-          "sessions:own"
+          "sessions:own",
+          "sandboxes:write"
         ],
         "parameters": [
           {
             "schema": {
-              "type": "string"
+              "type": "string",
+              "description": "The sandbox id, percent-encoded: `team-a%2Fproj-42` for `team-a/proj-42`"
             },
             "required": true,
-            "name": "agentId",
+            "description": "The sandbox id, percent-encoded: `team-a%2Fproj-42` for `team-a/proj-42`",
+            "name": "sandboxId",
             "in": "path"
           },
-          {
-            "schema": {
-              "type": "string",
-              "description": "Or the `A2A-Version` header: `1.0`"
-            },
-            "required": false,
-            "description": "Or the `A2A-Version` header: `1.0`",
-            "name": "A2A-Version",
-            "in": "query"
-          },
           {
             "schema": {
               "type": "string",
@@ -19734,23 +19699,13 @@
             "in": "header"
           }
         ],
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/A2aJsonRpcRequest"
-              }
-            }
-          }
-        },
         "responses": {
           "200": {
-            "description": "The JSON-RPC answer: a result, or an A2A error",
+            "description": "The sandbox",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/A2aJsonRpcResponse"
+                  "$ref": "#/components/schemas/SandboxView"
                 }
               }
             }
@@ -19816,15 +19771,13 @@
             }
           }
         }
-      }
-    },
-    "/v1/sandboxes/{sandboxId}": {
-      "put": {
+      },
+      "delete": {
         "tags": [
           "Sandboxes"
         ],
-        "summary": "Create or find a sandbox",
-        "description": "Creates the sandbox within the Tenant's limits, or answers the one with this id, so get-or-create is one call. Its spec is fixed once it exists; labels, when sent, replace its labels. Kind `pod` needs sandbox pods (`nylorun sandbox enable`): it is created at once, and a PUT on an existing pod sandbox starts it again when it was stopped, or revives it with a longer `lifecycle.ttl`.",
+        "summary": "Delete a sandbox",
+        "description": "Deletes the sandbox and its files. Sessions attached to it stay attached by id; their next turn is refused until a sandbox with this id exists again.",
         "security": [
           {
             "applicationKey": []
@@ -19883,23 +19836,13 @@
             "in": "header"
           }
         ],
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/PutSandboxRequest"
-              }
-            }
-          }
-        },
         "responses": {
           "200": {
-            "description": "The sandbox",
+            "description": "Deleted, or there was none",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SandboxView"
+                  "$ref": "#/components/schemas/DeleteSandboxResponse"
                 }
               }
             }
@@ -19945,7 +19888,7 @@
             }
           },
           "409": {
-            "description": "A sandbox with this id has another spec, the Tenant holds as many sandboxes as it allows (`limit_exceeded`), kind pod without sandbox pods (`sandbox_unavailable`), or a lost pod sandbox (`sandbox_lost`)"
+            "description": "A session attached to it has a turn running (`sandbox_busy`)"
           },
           "426": {
             "description": "`Nylorun-Protocol` missing or unsupported",
@@ -19968,13 +19911,15 @@
             }
           }
         }
-      },
+      }
+    },
+    "/v1/sandboxes": {
       "get": {
         "tags": [
           "Sandboxes"
         ],
-        "summary": "Get a sandbox",
-        "description": "Its spec, labels, state and the sessions attached to it (acting for a person, only theirs).",
+        "summary": "List sandboxes",
+        "description": "Every sandbox with all the labels asked for. A token caller sees only the sandboxes its grants reach.",
         "security": [
           {
             "applicationKey": []
@@ -19995,13 +19940,41 @@
         "parameters": [
           {
             "schema": {
-              "type": "string",
-              "description": "The sandbox id, percent-encoded: `team-a%2Fproj-42` for `team-a/proj-42`"
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 200
+            },
+            "required": false,
+            "name": "limit",
+            "in": "query"
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "required": false,
+            "name": "cursor",
+            "in": "query"
+          },
+          {
+            "schema": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  }
+                }
+              ],
+              "description": "`key=value`; repeat it to require several labels"
             },
-            "required": true,
-            "description": "The sandbox id, percent-encoded: `team-a%2Fproj-42` for `team-a/proj-42`",
-            "name": "sandboxId",
-            "in": "path"
+            "required": false,
+            "description": "`key=value`; repeat it to require several labels",
+            "name": "label",
+            "in": "query"
           },
           {
             "schema": {
@@ -20036,11 +20009,18 @@
         ],
         "responses": {
           "200": {
-            "description": "The sandbox",
+            "description": "The sandboxes; limit opts into pagination",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SandboxView"
+                  "anyOf": [
+                    {
+                      "$ref": "#/components/schemas/ListSandboxesResponse"
+                    },
+                    {
+                      "$ref": "#/components/schemas/SandboxPage"
+                    }
+                  ]
                 }
               }
             }
@@ -20106,13 +20086,15 @@
             }
           }
         }
-      },
-      "delete": {
+      }
+    },
+    "/v1/sandboxes/{sandboxId}/events": {
+      "get": {
         "tags": [
           "Sandboxes"
         ],
-        "summary": "Delete a sandbox",
-        "description": "Deletes the sandbox and its files. Sessions attached to it stay attached by id; their next turn is refused until a sandbox with this id exists again.",
+        "summary": "Read a sandbox's lifecycle events",
+        "description": "`sandbox.created`, `sandbox.attached`, `sandbox.detached` and `sandbox.deleted`, in order, numbered from 0.",
         "security": [
           {
             "applicationKey": []
@@ -20127,6 +20109,7 @@
           "token"
         ],
         "x-nylorun-scopes": [
+          "sessions:own",
           "sandboxes:write"
         ],
         "parameters": [
@@ -20140,6 +20123,16 @@
             "name": "sandboxId",
             "in": "path"
           },
+          {
+            "schema": {
+              "type": "string",
+              "description": "The first `seq` to return"
+            },
+            "required": false,
+            "description": "The first `seq` to return",
+            "name": "from",
+            "in": "query"
+          },
           {
             "schema": {
               "type": "string",
@@ -20173,11 +20166,11 @@
         ],
         "responses": {
           "200": {
-            "description": "Deleted, or there was none",
+            "description": "The events",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/DeleteSandboxResponse"
+                  "$ref": "#/components/schemas/ListSandboxEventsResponse"
                 }
               }
             }
@@ -20222,9 +20215,6 @@
               }
             }
           },
-          "409": {
-            "description": "A session attached to it has a turn running (`sandbox_busy`)"
-          },
           "426": {
             "description": "`Nylorun-Protocol` missing or unsupported",
             "content": {
@@ -20248,13 +20238,13 @@
         }
       }
     },
-    "/v1/sandboxes": {
-      "get": {
+    "/v1/sandboxes/{sandboxId}/stop": {
+      "post": {
         "tags": [
           "Sandboxes"
         ],
-        "summary": "List sandboxes",
-        "description": "Every sandbox with all the labels asked for. A token caller sees only the sandboxes its grants reach.",
+        "summary": "Stop a pod sandbox",
+        "description": "Suspends the pod: its volume is kept, and the next turn of a session attached to it (or a PUT) starts it again. Refused during a turn (`sandbox_busy`).",
         "security": [
           {
             "applicationKey": []
@@ -20269,47 +20259,18 @@
           "token"
         ],
         "x-nylorun-scopes": [
-          "sessions:own",
           "sandboxes:write"
         ],
         "parameters": [
           {
             "schema": {
-              "type": "integer",
-              "minimum": 1,
-              "maximum": 200
-            },
-            "required": false,
-            "name": "limit",
-            "in": "query"
-          },
-          {
-            "schema": {
-              "type": "string"
-            },
-            "required": false,
-            "name": "cursor",
-            "in": "query"
-          },
-          {
-            "schema": {
-              "anyOf": [
-                {
-                  "type": "string"
-                },
-                {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  }
-                }
-              ],
-              "description": "`key=value`; repeat it to require several labels"
+              "type": "string",
+              "description": "The sandbox id, percent-encoded: `team-a%2Fproj-42` for `team-a/proj-42`"
             },
-            "required": false,
-            "description": "`key=value`; repeat it to require several labels",
-            "name": "label",
-            "in": "query"
+            "required": true,
+            "description": "The sandbox id, percent-encoded: `team-a%2Fproj-42` for `team-a/proj-42`",
+            "name": "sandboxId",
+            "in": "path"
           },
           {
             "schema": {
@@ -20344,31 +20305,17 @@
         ],
         "responses": {
           "200": {
-            "description": "The sandboxes; limit opts into pagination",
+            "description": "The sandbox",
             "content": {
               "application/json": {
                 "schema": {
-                  "anyOf": [
-                    {
-                      "$ref": "#/components/schemas/ListSandboxesResponse"
-                    },
-                    {
-                      "$ref": "#/components/schemas/SandboxPage"
-                    }
-                  ]
+                  "$ref": "#/components/schemas/SandboxView"
                 }
               }
             }
           },
           "400": {
-            "description": "Invalid headers, path, body or cursor",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Rejected"
-                }
-              }
-            }
+            "description": "The sandbox is virtual"
           },
           "401": {
             "description": "The token expired (`token_expired`), or its issuer's keys cannot be fetched now (`issuer_unavailable`)",
@@ -20400,6 +20347,9 @@
               }
             }
           },
+          "409": {
+            "description": "A turn holds it (`sandbox_busy`), or no sandbox pods (`sandbox_unavailable`)"
+          },
           "426": {
             "description": "`Nylorun-Protocol` missing or unsupported",
             "content": {
@@ -20423,13 +20373,13 @@
         }
       }
     },
-    "/v1/sandboxes/{sandboxId}/events": {
-      "get": {
+    "/v1/sandboxes/{sandboxId}/reset": {
+      "post": {
         "tags": [
           "Sandboxes"
         ],
-        "summary": "Read a sandbox's lifecycle events",
-        "description": "`sandbox.created`, `sandbox.attached`, `sandbox.detached` and `sandbox.deleted`, in order, numbered from 0.",
+        "summary": "Reset a pod sandbox",
+        "description": "A new pod on a new, empty volume; the old pod and volume are deleted. The way out of `sandbox_lost`. Refused during a turn (`sandbox_busy`).",
         "security": [
           {
             "applicationKey": []
@@ -20444,7 +20394,6 @@
           "token"
         ],
         "x-nylorun-scopes": [
-          "sessions:own",
           "sandboxes:write"
         ],
         "parameters": [
@@ -20458,16 +20407,6 @@
             "name": "sandboxId",
             "in": "path"
           },
-          {
-            "schema": {
-              "type": "string",
-              "description": "The first `seq` to return"
-            },
-            "required": false,
-            "description": "The first `seq` to return",
-            "name": "from",
-            "in": "query"
-          },
           {
             "schema": {
               "type": "string",
@@ -20501,24 +20440,17 @@
         ],
         "responses": {
           "200": {
-            "description": "The events",
+            "description": "The sandbox",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ListSandboxEventsResponse"
+                  "$ref": "#/components/schemas/SandboxView"
                 }
               }
             }
           },
           "400": {
-            "description": "Invalid headers, path, body or cursor",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Rejected"
-                }
-              }
-            }
+            "description": "The sandbox is virtual"
           },
           "401": {
             "description": "The token expired (`token_expired`), or its issuer's keys cannot be fetched now (`issuer_unavailable`)",
@@ -20550,6 +20482,9 @@
               }
             }
           },
+          "409": {
+            "description": "A turn holds it (`sandbox_busy`), or no sandbox pods (`sandbox_unavailable`)"
+          },
           "426": {
             "description": "`Nylorun-Protocol` missing or unsupported",
             "content": {
@@ -20573,13 +20508,13 @@
         }
       }
     },
-    "/v1/sandboxes/{sandboxId}/stop": {
+    "/v1/artifacts": {
       "post": {
         "tags": [
-          "Sandboxes"
+          "Artifacts"
         ],
-        "summary": "Stop a pod sandbox",
-        "description": "Suspends the pod: its volume is kept, and the next turn of a session attached to it (or a PUT) starts it again. Refused during a turn (`sandbox_busy`).",
+        "summary": "Upload a file as a new artifact",
+        "description": "Streams the body to the Object store in one request, up to the Tenant's per-file limit and within its total; a body past either stores nothing (`413 limit_exceeded`). Its `Content-Type` is the file's media type (default: from the name). Acting for a person, the artifact belongs to one of their sessions. A session's artifact appears in its history as `artifact.created`.",
         "security": [
           {
             "applicationKey": []
@@ -20594,18 +20529,48 @@
           "token"
         ],
         "x-nylorun-scopes": [
-          "sandboxes:write"
+          "sessions:own"
         ],
         "parameters": [
           {
             "schema": {
               "type": "string",
-              "description": "The sandbox id, percent-encoded: `team-a%2Fproj-42` for `team-a/proj-42`"
+              "description": "The file's name, e.g. `brief.pdf`"
             },
             "required": true,
-            "description": "The sandbox id, percent-encoded: `team-a%2Fproj-42` for `team-a/proj-42`",
-            "name": "sandboxId",
-            "in": "path"
+            "description": "The file's name, e.g. `brief.pdf`",
+            "name": "name",
+            "in": "query"
+          },
+          {
+            "schema": {
+              "type": "string",
+              "description": "The session it belongs to"
+            },
+            "required": false,
+            "description": "The session it belongs to",
+            "name": "sessionId",
+            "in": "query"
+          },
+          {
+            "schema": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  }
+                }
+              ],
+              "description": "`key=value`; repeat it for several labels"
+            },
+            "required": false,
+            "description": "`key=value`; repeat it for several labels",
+            "name": "label",
+            "in": "query"
           },
           {
             "schema": {
@@ -20638,19 +20603,38 @@
             "in": "header"
           }
         ],
+        "requestBody": {
+          "required": true,
+          "description": "The file's bytes; `Content-Type` is its media type",
+          "content": {
+            "*/*": {
+              "schema": {
+                "type": "string",
+                "format": "binary"
+              }
+            }
+          }
+        },
         "responses": {
-          "200": {
-            "description": "The sandbox",
+          "201": {
+            "description": "The artifact and its first version",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SandboxView"
+                  "$ref": "#/components/schemas/UploadArtifactResponse"
                 }
               }
             }
           },
           "400": {
-            "description": "The sandbox is virtual"
+            "description": "Invalid headers, path, body or cursor",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
           },
           "401": {
             "description": "The token expired (`token_expired`), or its issuer's keys cannot be fetched now (`issuer_unavailable`)",
@@ -20682,8 +20666,8 @@
               }
             }
           },
-          "409": {
-            "description": "A turn holds it (`sandbox_busy`), or no sandbox pods (`sandbox_unavailable`)"
+          "413": {
+            "description": "Larger than the per-file limit, or past the Tenant's total (`limit_exceeded`)"
           },
           "426": {
             "description": "`Nylorun-Protocol` missing or unsupported",
@@ -20706,15 +20690,13 @@
             }
           }
         }
-      }
-    },
-    "/v1/sandboxes/{sandboxId}/reset": {
-      "post": {
+      },
+      "get": {
         "tags": [
-          "Sandboxes"
+          "Artifacts"
         ],
-        "summary": "Reset a pod sandbox",
-        "description": "A new pod on a new, empty volume; the old pod and volume are deleted. The way out of `sandbox_lost`. Refused during a turn (`sandbox_busy`).",
+        "summary": "List artifacts",
+        "description": "Oldest first: of one session, or of every session the caller reaches (an application key: every artifact).",
         "security": [
           {
             "applicationKey": []
@@ -20729,18 +20711,18 @@
           "token"
         ],
         "x-nylorun-scopes": [
-          "sandboxes:write"
+          "sessions:own"
         ],
         "parameters": [
           {
             "schema": {
               "type": "string",
-              "description": "The sandbox id, percent-encoded: `team-a%2Fproj-42` for `team-a/proj-42`"
+              "description": "Only this session's"
             },
-            "required": true,
-            "description": "The sandbox id, percent-encoded: `team-a%2Fproj-42` for `team-a/proj-42`",
-            "name": "sandboxId",
-            "in": "path"
+            "required": false,
+            "description": "Only this session's",
+            "name": "sessionId",
+            "in": "query"
           },
           {
             "schema": {
@@ -20775,17 +20757,24 @@
         ],
         "responses": {
           "200": {
-            "description": "The sandbox",
+            "description": "The artifacts",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SandboxView"
+                  "$ref": "#/components/schemas/ListArtifactsResponse"
                 }
               }
             }
           },
           "400": {
-            "description": "The sandbox is virtual"
+            "description": "Invalid headers, path, body or cursor",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Rejected"
+                }
+              }
+            }
           },
           "401": {
             "description": "The token expired (`token_expired`), or its issuer's keys cannot be fetched now (`issuer_unavailable`)",
@@ -20817,9 +20806,6 @@
               }
             }
           },
-          "409": {
-            "description": "A turn holds it (`sandbox_busy`), or no sandbox pods (`sandbox_unavailable`)"
-          },
           "426": {
             "description": "`Nylorun-Protocol` missing or unsupported",
             "content": {
@@ -20843,13 +20829,13 @@
         }
       }
     },
-    "/v1/artifacts": {
-      "post": {
+    "/v1/artifacts/{artifactId}": {
+      "get": {
         "tags": [
           "Artifacts"
         ],
-        "summary": "Upload a file as a new artifact",
-        "description": "Streams the body to the Object store in one request, up to the Tenant's per-file limit and within its total; a body past either stores nothing (`413 limit_exceeded`). Its `Content-Type` is the file's media type (default: from the name). Acting for a person, the artifact belongs to one of their sessions. A session's artifact appears in its history as `artifact.created`.",
+        "summary": "Get an artifact",
+        "description": "Its metadata and every version, oldest first.",
         "security": [
           {
             "applicationKey": []
@@ -20869,43 +20855,11 @@
         "parameters": [
           {
             "schema": {
-              "type": "string",
-              "description": "The file's name, e.g. `brief.pdf`"
+              "type": "string"
             },
             "required": true,
-            "description": "The file's name, e.g. `brief.pdf`",
-            "name": "name",
-            "in": "query"
-          },
-          {
-            "schema": {
-              "type": "string",
-              "description": "The session it belongs to"
-            },
-            "required": false,
-            "description": "The session it belongs to",
-            "name": "sessionId",
-            "in": "query"
-          },
-          {
-            "schema": {
-              "anyOf": [
-                {
-                  "type": "string"
-                },
-                {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  }
-                }
-              ],
-              "description": "`key=value`; repeat it for several labels"
-            },
-            "required": false,
-            "description": "`key=value`; repeat it for several labels",
-            "name": "label",
-            "in": "query"
+            "name": "artifactId",
+            "in": "path"
           },
           {
             "schema": {
@@ -20938,25 +20892,13 @@
             "in": "header"
           }
         ],
-        "requestBody": {
-          "required": true,
-          "description": "The file's bytes; `Content-Type` is its media type",
-          "content": {
-            "*/*": {
-              "schema": {
-                "type": "string",
-                "format": "binary"
-              }
-            }
-          }
-        },
         "responses": {
-          "201": {
-            "description": "The artifact and its first version",
+          "200": {
+            "description": "The artifact",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/UploadArtifactResponse"
+                  "$ref": "#/components/schemas/ArtifactView"
                 }
               }
             }
@@ -21001,9 +20943,6 @@
               }
             }
           },
-          "413": {
-            "description": "Larger than the per-file limit, or past the Tenant's total (`limit_exceeded`)"
-          },
           "426": {
             "description": "`Nylorun-Protocol` missing or unsupported",
             "content": {
@@ -21026,12 +20965,12 @@
           }
         }
       },
-      "get": {
+      "delete": {
         "tags": [
           "Artifacts"
         ],
-        "summary": "List artifacts",
-        "description": "Oldest first: of one session, or of every session the caller reaches (an application key: every artifact).",
+        "summary": "Delete an artifact",
+        "description": "Deletes every version and its bytes; its links stop working. A session's artifact gets `artifact.deleted` in its history.",
         "security": [
           {
             "applicationKey": []
@@ -21051,13 +20990,11 @@
         "parameters": [
           {
             "schema": {
-              "type": "string",
-              "description": "Only this session's"
+              "type": "string"
             },
-            "required": false,
-            "description": "Only this session's",
-            "name": "sessionId",
-            "in": "query"
+            "required": true,
+            "name": "artifactId",
+            "in": "path"
           },
           {
             "schema": {
@@ -21092,11 +21029,11 @@
         ],
         "responses": {
           "200": {
-            "description": "The artifacts",
+            "description": "Deleted",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ListArtifactsResponse"
+                  "$ref": "#/components/schemas/DeleteArtifactResponse"
                 }
               }
             }
@@ -21164,13 +21101,13 @@
         }
       }
     },
-    "/v1/artifacts/{artifactId}": {
-      "get": {
+    "/v1/artifacts/{artifactId}/versions": {
+      "post": {
         "tags": [
           "Artifacts"
         ],
-        "summary": "Get an artifact",
-        "description": "Its metadata and every version, oldest first.",
+        "summary": "Upload a new version of an artifact",
+        "description": "Streams the body as the artifact's next version, with the same limits as a new artifact. A session's artifact gets `artifact.version.created` in its history.",
         "security": [
           {
             "applicationKey": []
@@ -21227,13 +21164,25 @@
             "in": "header"
           }
         ],
+        "requestBody": {
+          "required": true,
+          "description": "The file's bytes; `Content-Type` is its media type",
+          "content": {
+            "*/*": {
+              "schema": {
+                "type": "string",
+                "format": "binary"
+              }
+            }
+          }
+        },
         "responses": {
-          "200": {
-            "description": "The artifact",
+          "201": {
+            "description": "The artifact and the version the upload created",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ArtifactView"
+                  "$ref": "#/components/schemas/UploadArtifactResponse"
                 }
               }
             }
@@ -21278,6 +21227,9 @@
               }
             }
           },
+          "413": {
+            "description": "Larger than the per-file limit, or past the Tenant's total (`limit_exceeded`)"
+          },
           "426": {
             "description": "`Nylorun-Protocol` missing or unsupported",
             "content": {
@@ -21299,13 +21251,15 @@
             }
           }
         }
-      },
-      "delete": {
+      }
+    },
+    "/v1/artifacts/{artifactId}/versions/{version}/content": {
+      "get": {
         "tags": [
           "Artifacts"
         ],
-        "summary": "Delete an artifact",
-        "description": "Deletes every version and its bytes; its links stop working. A session's artifact gets `artifact.deleted` in its history.",
+        "summary": "Download a version of an artifact",
+        "description": "Streams the bytes through the Runtime. One `Range: bytes=…` gives `206` with `Content-Range`; several ranges give the whole file. A folder is a `400`: read its tree, its files or its zip.",
         "security": [
           {
             "applicationKey": []
@@ -21331,6 +21285,16 @@
             "name": "artifactId",
             "in": "path"
           },
+          {
+            "schema": {
+              "type": "string",
+              "description": "A version number, or `latest`"
+            },
+            "required": true,
+            "description": "A version number, or `latest`",
+            "name": "version",
+            "in": "path"
+          },
           {
             "schema": {
               "type": "string",
@@ -21364,11 +21328,75 @@
         ],
         "responses": {
           "200": {
-            "description": "Deleted",
+            "description": "The file",
+            "headers": {
+              "Accept-Ranges": {
+                "schema": {
+                  "type": "string",
+                  "description": "`bytes`"
+                },
+                "required": true,
+                "description": "`bytes`"
+              },
+              "Content-Range": {
+                "schema": {
+                  "type": "string",
+                  "description": "The bytes sent, on a `206`: `bytes <start>-<end>/<size>`"
+                },
+                "required": false,
+                "description": "The bytes sent, on a `206`: `bytes <start>-<end>/<size>`"
+              },
+              "ETag": {
+                "schema": {
+                  "type": "string",
+                  "description": "The version's SHA-256, quoted"
+                },
+                "required": true,
+                "description": "The version's SHA-256, quoted"
+              }
+            },
             "content": {
-              "application/json": {
+              "*/*": {
                 "schema": {
-                  "$ref": "#/components/schemas/DeleteArtifactResponse"
+                  "type": "string",
+                  "format": "binary"
+                }
+              }
+            }
+          },
+          "206": {
+            "description": "The bytes the `Range` header asked for",
+            "headers": {
+              "Accept-Ranges": {
+                "schema": {
+                  "type": "string",
+                  "description": "`bytes`"
+                },
+                "required": true,
+                "description": "`bytes`"
+              },
+              "Content-Range": {
+                "schema": {
+                  "type": "string",
+                  "description": "The bytes sent, on a `206`: `bytes <start>-<end>/<size>`"
+                },
+                "required": false,
+                "description": "The bytes sent, on a `206`: `bytes <start>-<end>/<size>`"
+              },
+              "ETag": {
+                "schema": {
+                  "type": "string",
+                  "description": "The version's SHA-256, quoted"
+                },
+                "required": true,
+                "description": "The version's SHA-256, quoted"
+              }
+            },
+            "content": {
+              "*/*": {
+                "schema": {
+                  "type": "string",
+                  "format": "binary"
                 }
               }
             }
@@ -21413,6 +21441,9 @@
               }
             }
           },
+          "416": {
+            "description": "The `Range` starts past the end of the file"
+          },
           "426": {
             "description": "`Nylorun-Protocol` missing or unsupported",
             "content": {
@@ -21436,13 +21467,13 @@
         }
       }
     },
-    "/v1/artifacts/{artifactId}/versions": {
-      "post": {
+    "/v1/artifacts/{artifactId}/versions/{version}/tree": {
+      "get": {
         "tags": [
           "Artifacts"
         ],
-        "summary": "Upload a new version of an artifact",
-        "description": "Streams the body as the artifact's next version, with the same limits as a new artifact. A session's artifact gets `artifact.version.created` in its history.",
+        "summary": "List a folder version's files",
+        "description": "The folder version's manifest: every file's path, size, SHA-256 and media type, sorted by path. A file artifact is a `400`.",
         "security": [
           {
             "applicationKey": []
@@ -21468,6 +21499,16 @@
             "name": "artifactId",
             "in": "path"
           },
+          {
+            "schema": {
+              "type": "string",
+              "description": "A version number, or `latest`"
+            },
+            "required": true,
+            "description": "A version number, or `latest`",
+            "name": "version",
+            "in": "path"
+          },
           {
             "schema": {
               "type": "string",
@@ -21499,25 +21540,13 @@
             "in": "header"
           }
         ],
-        "requestBody": {
-          "required": true,
-          "description": "The file's bytes; `Content-Type` is its media type",
-          "content": {
-            "*/*": {
-              "schema": {
-                "type": "string",
-                "format": "binary"
-              }
-            }
-          }
-        },
         "responses": {
-          "201": {
-            "description": "The artifact and the version the upload created",
+          "200": {
+            "description": "The files",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/UploadArtifactResponse"
+                  "$ref": "#/components/schemas/ArtifactTree"
                 }
               }
             }
@@ -21562,9 +21591,6 @@
               }
             }
           },
-          "413": {
-            "description": "Larger than the per-file limit, or past the Tenant's total (`limit_exceeded`)"
-          },
           "426": {
             "description": "`Nylorun-Protocol` missing or unsupported",
             "content": {
@@ -21588,13 +21614,13 @@
         }
       }
     },
-    "/v1/artifacts/{artifactId}/versions/{version}/content": {
+    "/v1/artifacts/{artifactId}/versions/{version}/files/{path}": {
       "get": {
         "tags": [
           "Artifacts"
         ],
-        "summary": "Download a version of an artifact",
-        "description": "Streams the bytes through the Runtime. One `Range: bytes=…` gives `206` with `Content-Range`; several ranges give the whole file. A folder is a `400`: read its tree, its files or its zip.",
+        "summary": "Download one file of a folder version",
+        "description": "Streams the file at `path` (its path in the folder, with `/` percent-encoded as `%2F`) through the Runtime, with Range as for a file artifact.",
         "security": [
           {
             "applicationKey": []
@@ -21630,6 +21656,16 @@
             "name": "version",
             "in": "path"
           },
+          {
+            "schema": {
+              "type": "string",
+              "description": "The file's path in the folder, percent-encoded"
+            },
+            "required": true,
+            "description": "The file's path in the folder, percent-encoded",
+            "name": "path",
+            "in": "path"
+          },
           {
             "schema": {
               "type": "string",
@@ -21802,13 +21838,13 @@
         }
       }
     },
-    "/v1/artifacts/{artifactId}/versions/{version}/tree": {
+    "/v1/artifacts/{artifactId}/versions/{version}/diff": {
       "get": {
         "tags": [
           "Artifacts"
         ],
-        "summary": "List a folder version's files",
-        "description": "The folder version's manifest: every file's path, size, SHA-256 and media type, sorted by path. A file artifact is a `400`.",
+        "summary": "Compare two folder versions",
+        "description": "The files added, removed and changed from version `from` (default: the one before) to this one. Version 1 without `from` lists every file as added.",
         "security": [
           {
             "applicationKey": []
@@ -21844,6 +21880,16 @@
             "name": "version",
             "in": "path"
           },
+          {
+            "schema": {
+              "type": "string",
+              "description": "The version to compare against"
+            },
+            "required": false,
+            "description": "The version to compare against",
+            "name": "from",
+            "in": "query"
+          },
           {
             "schema": {
               "type": "string",
@@ -21877,11 +21923,11 @@
         ],
         "responses": {
           "200": {
-            "description": "The files",
+            "description": "What changed",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ArtifactTree"
+                  "$ref": "#/components/schemas/ArtifactDiff"
                 }
               }
             }
@@ -21949,13 +21995,13 @@
         }
       }
     },
-    "/v1/artifacts/{artifactId}/versions/{version}/files/{path}": {
+    "/v1/artifacts/{artifactId}/versions/{version}/zip": {
       "get": {
         "tags": [
           "Artifacts"
         ],
-        "summary": "Download one file of a folder version",
-        "description": "Streams the file at `path` (its path in the folder, with `/` percent-encoded as `%2F`) through the Runtime, with Range as for a file artifact.",
+        "summary": "Download a folder version as a zip",
+        "description": "Streams the folder's files as one zip archive (deflated, UTF-8 names), read from the Object store as it goes. A file artifact is a `400`.",
         "security": [
           {
             "applicationKey": []
@@ -21991,16 +22037,6 @@
             "name": "version",
             "in": "path"
           },
-          {
-            "schema": {
-              "type": "string",
-              "description": "The file's path in the folder, percent-encoded"
-            },
-            "required": true,
-            "description": "The file's path in the folder, percent-encoded",
-            "name": "path",
-            "in": "path"
-          },
           {
             "schema": {
               "type": "string",
@@ -22034,72 +22070,9 @@
         ],
         "responses": {
           "200": {
-            "description": "The file",
-            "headers": {
-              "Accept-Ranges": {
-                "schema": {
-                  "type": "string",
-                  "description": "`bytes`"
-                },
-                "required": true,
-                "description": "`bytes`"
-              },
-              "Content-Range": {
-                "schema": {
-                  "type": "string",
-                  "description": "The bytes sent, on a `206`: `bytes <start>-<end>/<size>`"
-                },
-                "required": false,
-                "description": "The bytes sent, on a `206`: `bytes <start>-<end>/<size>`"
-              },
-              "ETag": {
-                "schema": {
-                  "type": "string",
-                  "description": "The version's SHA-256, quoted"
-                },
-                "required": true,
-                "description": "The version's SHA-256, quoted"
-              }
-            },
-            "content": {
-              "*/*": {
-                "schema": {
-                  "type": "string",
-                  "format": "binary"
-                }
-              }
-            }
-          },
-          "206": {
-            "description": "The bytes the `Range` header asked for",
-            "headers": {
-              "Accept-Ranges": {
-                "schema": {
-                  "type": "string",
-                  "description": "`bytes`"
-                },
-                "required": true,
-                "description": "`bytes`"
-              },
-              "Content-Range": {
-                "schema": {
-                  "type": "string",
-                  "description": "The bytes sent, on a `206`: `bytes <start>-<end>/<size>`"
-                },
-                "required": false,
-                "description": "The bytes sent, on a `206`: `bytes <start>-<end>/<size>`"
-              },
-              "ETag": {
-                "schema": {
-                  "type": "string",
-                  "description": "The version's SHA-256, quoted"
-                },
-                "required": true,
-                "description": "The version's SHA-256, quoted"
-              }
-            },
+            "description": "The zip archive",
             "content": {
-              "*/*": {
+              "application/zip": {
                 "schema": {
                   "type": "string",
                   "format": "binary"
@@ -22147,9 +22120,6 @@
               }
             }
           },
-          "416": {
-            "description": "The `Range` starts past the end of the file"
-          },
           "426": {
             "description": "`Nylorun-Protocol` missing or unsupported",
             "content": {
@@ -22173,13 +22143,13 @@
         }
       }
     },
-    "/v1/artifacts/{artifactId}/versions/{version}/diff": {
-      "get": {
+    "/v1/artifacts/{artifactId}/links": {
+      "post": {
         "tags": [
           "Artifacts"
         ],
-        "summary": "Compare two folder versions",
-        "description": "The files added, removed and changed from version `from` (default: the one before) to this one. Version 1 without `from` lists every file as added.",
+        "summary": "Mint a capability link",
+        "description": "A short-lived path that downloads one version, with Range, with no other credential: for `<img>` tags, UIs and sharing. Signed by the Runtime with the Tenant's signing key; at most 15 minutes; it opens nothing once the artifact is deleted. A folder's link opens its zip, or with `file` that one file.",
         "security": [
           {
             "applicationKey": []
@@ -22205,26 +22175,6 @@
             "name": "artifactId",
             "in": "path"
           },
-          {
-            "schema": {
-              "type": "string",
-              "description": "A version number, or `latest`"
-            },
-            "required": true,
-            "description": "A version number, or `latest`",
-            "name": "version",
-            "in": "path"
-          },
-          {
-            "schema": {
-              "type": "string",
-              "description": "The version to compare against"
-            },
-            "required": false,
-            "description": "The version to compare against",
-            "name": "from",
-            "in": "query"
-          },
           {
             "schema": {
               "type": "string",
@@ -22256,13 +22206,23 @@
             "in": "header"
           }
         ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CreateArtifactLinkRequest"
+              }
+            }
+          }
+        },
         "responses": {
           "200": {
-            "description": "What changed",
+            "description": "The link",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ArtifactDiff"
+                  "$ref": "#/components/schemas/ArtifactLink"
                 }
               }
             }
@@ -22330,46 +22290,35 @@
         }
       }
     },
-    "/v1/artifacts/{artifactId}/versions/{version}/zip": {
+    "/v1/artifact-links/{token}": {
       "get": {
         "tags": [
           "Artifacts"
         ],
-        "summary": "Download a folder version as a zip",
-        "description": "Streams the folder's files as one zip archive (deflated, UTF-8 names), read from the Object store as it goes. A file artifact is a `400`.",
+        "summary": "Open a capability link",
+        "description": "Downloads the version the link names, with Range, until it expires (`401 token_expired`): a file, a folder's file, or a folder's zip. Needs no credential and no `Nylorun-Protocol`.",
         "security": [
           {
             "applicationKey": []
           },
           {
             "issuerToken": []
-          }
+          },
+          {}
         ],
         "x-nylorun-credentials": [
           "application",
           "subject",
           "token"
         ],
-        "x-nylorun-scopes": [
-          "sessions:own"
-        ],
+        "x-nylorun-scopes": "any",
         "parameters": [
           {
             "schema": {
               "type": "string"
             },
             "required": true,
-            "name": "artifactId",
-            "in": "path"
-          },
-          {
-            "schema": {
-              "type": "string",
-              "description": "A version number, or `latest`"
-            },
-            "required": true,
-            "description": "A version number, or `latest`",
-            "name": "version",
+            "name": "token",
             "in": "path"
           },
           {
@@ -22377,7 +22326,7 @@
               "type": "string",
               "description": "The protocol version, `8`"
             },
-            "required": true,
+            "required": false,
             "description": "The protocol version, `8`",
             "name": "Nylorun-Protocol",
             "in": "header"
@@ -22397,17 +22346,80 @@
               "type": "string",
               "description": "The subject's space-separated scopes; required with a subject"
             },
-            "required": false,
-            "description": "The subject's space-separated scopes; required with a subject",
-            "name": "Nylorun-Scopes",
-            "in": "header"
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "The zip archive",
+            "required": false,
+            "description": "The subject's space-separated scopes; required with a subject",
+            "name": "Nylorun-Scopes",
+            "in": "header"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "The file",
+            "headers": {
+              "Accept-Ranges": {
+                "schema": {
+                  "type": "string",
+                  "description": "`bytes`"
+                },
+                "required": true,
+                "description": "`bytes`"
+              },
+              "Content-Range": {
+                "schema": {
+                  "type": "string",
+                  "description": "The bytes sent, on a `206`: `bytes <start>-<end>/<size>`"
+                },
+                "required": false,
+                "description": "The bytes sent, on a `206`: `bytes <start>-<end>/<size>`"
+              },
+              "ETag": {
+                "schema": {
+                  "type": "string",
+                  "description": "The version's SHA-256, quoted"
+                },
+                "required": true,
+                "description": "The version's SHA-256, quoted"
+              }
+            },
+            "content": {
+              "*/*": {
+                "schema": {
+                  "type": "string",
+                  "format": "binary"
+                }
+              }
+            }
+          },
+          "206": {
+            "description": "The bytes the `Range` header asked for",
+            "headers": {
+              "Accept-Ranges": {
+                "schema": {
+                  "type": "string",
+                  "description": "`bytes`"
+                },
+                "required": true,
+                "description": "`bytes`"
+              },
+              "Content-Range": {
+                "schema": {
+                  "type": "string",
+                  "description": "The bytes sent, on a `206`: `bytes <start>-<end>/<size>`"
+                },
+                "required": false,
+                "description": "The bytes sent, on a `206`: `bytes <start>-<end>/<size>`"
+              },
+              "ETag": {
+                "schema": {
+                  "type": "string",
+                  "description": "The version's SHA-256, quoted"
+                },
+                "required": true,
+                "description": "The version's SHA-256, quoted"
+              }
+            },
             "content": {
-              "application/zip": {
+              "*/*": {
                 "schema": {
                   "type": "string",
                   "format": "binary"
@@ -22455,6 +22467,9 @@
               }
             }
           },
+          "416": {
+            "description": "The `Range` starts past the end of the file"
+          },
           "426": {
             "description": "`Nylorun-Protocol` missing or unsupported",
             "content": {
@@ -22478,17 +22493,65 @@
         }
       }
     },
-    "/v1/artifacts/{artifactId}/links": {
-      "post": {
+    "/health": {
+      "get": {
         "tags": [
-          "Artifacts"
+          "Service"
         ],
-        "summary": "Mint a capability link",
-        "description": "A short-lived path that downloads one version, with Range, with no other credential: for `<img>` tags, UIs and sharing. Signed by the Runtime with the Tenant's signing key; at most 15 minutes; it opens nothing once the artifact is deleted. A folder's link opens its zip, or with `file` that one file.",
+        "summary": "Check the Runtime",
+        "description": "The protocol range and features a client checks first. Refuses an `Origin`.",
+        "responses": {
+          "200": {
+            "description": "The Runtime is up",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Health"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/ready": {
+      "get": {
+        "tags": [
+          "Service"
+        ],
+        "summary": "Check the Runtime is ready",
+        "description": "The listener, the Tenant (open), Postgres, Restate and S2, and the open Tenant's harnesses.",
+        "responses": {
+          "200": {
+            "description": "Ready",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Ready"
+                }
+              }
+            }
+          },
+          "503": {
+            "description": "Not ready: `checks` says what is not"
+          }
+        }
+      }
+    },
+    "/v1/me": {
+      "get": {
+        "tags": [
+          "Service"
+        ],
+        "summary": "Get who the caller is",
+        "description": "The subject, scopes, agents and sandbox grants of the credential that sends it: an application key (alone or acting for a subject), a management key (`via: management:<principalId>`, no scopes, no agents), or a trusted issuer's token (`via: issuer:<name>`).",
         "security": [
           {
             "applicationKey": []
           },
+          {
+            "managementKey": []
+          },
           {
             "issuerToken": []
           }
@@ -22496,20 +22559,11 @@
         "x-nylorun-credentials": [
           "application",
           "subject",
+          "management",
           "token"
         ],
-        "x-nylorun-scopes": [
-          "sessions:own"
-        ],
+        "x-nylorun-scopes": "any",
         "parameters": [
-          {
-            "schema": {
-              "type": "string"
-            },
-            "required": true,
-            "name": "artifactId",
-            "in": "path"
-          },
           {
             "schema": {
               "type": "string",
@@ -22541,23 +22595,13 @@
             "in": "header"
           }
         ],
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/CreateArtifactLinkRequest"
-              }
-            }
-          }
-        },
         "responses": {
           "200": {
-            "description": "The link",
+            "description": "The caller",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ArtifactLink"
+                  "$ref": "#/components/schemas/MeResponse"
                 }
               }
             }
@@ -22583,7 +22627,7 @@
             }
           },
           "403": {
-            "description": "Not allowed for this credential or subject scope, a key of the other API (`key_role_mismatch`), or an application key from a browser (`origin_rejected`)",
+            "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
             "content": {
               "application/json": {
                 "schema": {
@@ -22625,17 +22669,20 @@
         }
       }
     },
-    "/v1/artifact-links/{token}": {
+    "/v1/access/jwks": {
       "get": {
         "tags": [
-          "Artifacts"
+          "Service"
         ],
-        "summary": "Open a capability link",
-        "description": "Downloads the version the link names, with Range, until it expires (`401 token_expired`): a file, a folder's file, or a folder's zip. Needs no credential and no `Nylorun-Protocol`.",
+        "summary": "Get the public keys the Runtime's tokens are signed with",
+        "description": "A JSON Web Key Set, to verify a token the Runtime signed without calling it. No credential is needed.",
         "security": [
           {
             "applicationKey": []
           },
+          {
+            "managementKey": []
+          },
           {
             "issuerToken": []
           },
@@ -22644,24 +22691,17 @@
         "x-nylorun-credentials": [
           "application",
           "subject",
+          "management",
           "token"
         ],
         "x-nylorun-scopes": "any",
         "parameters": [
-          {
-            "schema": {
-              "type": "string"
-            },
-            "required": true,
-            "name": "token",
-            "in": "path"
-          },
           {
             "schema": {
               "type": "string",
               "description": "The protocol version, `8`"
             },
-            "required": false,
+            "required": true,
             "description": "The protocol version, `8`",
             "name": "Nylorun-Protocol",
             "in": "header"
@@ -22689,75 +22729,11 @@
         ],
         "responses": {
           "200": {
-            "description": "The file",
-            "headers": {
-              "Accept-Ranges": {
-                "schema": {
-                  "type": "string",
-                  "description": "`bytes`"
-                },
-                "required": true,
-                "description": "`bytes`"
-              },
-              "Content-Range": {
-                "schema": {
-                  "type": "string",
-                  "description": "The bytes sent, on a `206`: `bytes <start>-<end>/<size>`"
-                },
-                "required": false,
-                "description": "The bytes sent, on a `206`: `bytes <start>-<end>/<size>`"
-              },
-              "ETag": {
-                "schema": {
-                  "type": "string",
-                  "description": "The version's SHA-256, quoted"
-                },
-                "required": true,
-                "description": "The version's SHA-256, quoted"
-              }
-            },
-            "content": {
-              "*/*": {
-                "schema": {
-                  "type": "string",
-                  "format": "binary"
-                }
-              }
-            }
-          },
-          "206": {
-            "description": "The bytes the `Range` header asked for",
-            "headers": {
-              "Accept-Ranges": {
-                "schema": {
-                  "type": "string",
-                  "description": "`bytes`"
-                },
-                "required": true,
-                "description": "`bytes`"
-              },
-              "Content-Range": {
-                "schema": {
-                  "type": "string",
-                  "description": "The bytes sent, on a `206`: `bytes <start>-<end>/<size>`"
-                },
-                "required": false,
-                "description": "The bytes sent, on a `206`: `bytes <start>-<end>/<size>`"
-              },
-              "ETag": {
-                "schema": {
-                  "type": "string",
-                  "description": "The version's SHA-256, quoted"
-                },
-                "required": true,
-                "description": "The version's SHA-256, quoted"
-              }
-            },
+            "description": "The public keys",
             "content": {
-              "*/*": {
+              "application/json": {
                 "schema": {
-                  "type": "string",
-                  "format": "binary"
+                  "$ref": "#/components/schemas/Jwks"
                 }
               }
             }
@@ -22783,7 +22759,7 @@
             }
           },
           "403": {
-            "description": "Not allowed for this credential or subject scope, a key of the other API (`key_role_mismatch`), or an application key from a browser (`origin_rejected`)",
+            "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
             "content": {
               "application/json": {
                 "schema": {
@@ -22802,9 +22778,6 @@
               }
             }
           },
-          "416": {
-            "description": "The `Range` starts past the end of the file"
-          },
           "426": {
             "description": "`Nylorun-Protocol` missing or unsupported",
             "content": {
@@ -22827,14 +22800,24 @@
           }
         }
       }
+    },
+    "/openapi/runtime.json": {
+      "get": {
+        "tags": [
+          "Service"
+        ],
+        "summary": "Get the Runtime API's document",
+        "description": "This document. `/openapi.json` is the same.",
+        "responses": {
+          "200": {
+            "description": "The Runtime API's OpenAPI document"
+          }
+        }
+      }
     }
   },
   "webhooks": {},
   "tags": [
-    {
-      "name": "Runtime",
-      "description": "Check a Runtime is up and speaks your protocol, ask who your credential is, and read the public keys of the tokens it signs. `/health`, `/ready`, the JWKS and the documents need no key."
-    },
     {
       "name": "Agents",
       "description": "The agents a Tenant can run: put a definition, list what is there. In `@nylorun/agents`."
@@ -22862,15 +22845,13 @@
     {
       "name": "Artifacts",
       "description": "Files and folders agents and people produce, versioned, with short-lived capability links to share them. In `@nylorun/agents`."
+    },
+    {
+      "name": "Service",
+      "description": "Check a Runtime is up and speaks your protocol, ask who your credential is, and read the public keys of the tokens it signs. `/health`, `/ready`, the JWKS and the documents need no key."
     }
   ],
   "x-tagGroups": [
-    {
-      "name": "Get started",
-      "tags": [
-        "Runtime"
-      ]
-    },
     {
       "name": "Agents",
       "tags": [
@@ -22887,11 +22868,22 @@
       ]
     },
     {
-      "name": "Sandboxes & artifacts",
+      "name": "Sandboxes",
+      "tags": [
+        "Sandboxes"
+      ]
+    },
+    {
+      "name": "Artifacts",
       "tags": [
-        "Sandboxes",
         "Artifacts"
       ]
+    },
+    {
+      "name": "Service",
+      "tags": [
+        "Service"
+      ]
     }
   ]
 }