@terminus-ai/cli 0.0.1

package/bin/vendor/app-runtime-v1/doors.json

@@ -0,0 +1,2867 @@
+{
+  "schema_version": 1,
+  "contract": "terminus.app-runtime.doors",
+  "runtime_api_version": 1,
+  "notation": {
+    "fields": "A field name ending in ? may be absent; $body stands for the whole JSON body when it is not an object of named fields.",
+    "types": "string, integer, number, boolean, object, json (any JSON value) and null; a PascalCase Name is a key of types; T[] is an array; a|b is a union; any other alternative is a literal value (direct, GET, 1).",
+    "paths": "path is the app-relative door under /_terminus (null when app code cannot reach it); upstream is the backend route the app host forwards to, in the route contract's notation.",
+    "response_kinds": "json, bytes (raw body), sse (see frames) or redirect (a Location answer the app host passes through)."
+  },
+  "conventions": {
+    "casing": "Every request and response field, query parameter and SSE frame field on /_terminus and /v1/app-runtime is snake_case (D1); the SDK speaks camelCase to apps, and grammar keywords inside app-authored definitions (where, permissions, validate, relations) keep the spelling their own vectors pin.",
+    "auth": "App doors authenticate with the session the app host attaches from its HttpOnly cookie; app code never holds a credential, and the app host refuses cross-origin mutations.",
+    "idempotency": "The Idempotency-Key header (1-200 visible characters) is required on record PUT/DELETE, deliver and transactions and optional on events, notifications, collect submit, jobs, connectors and services (D11); a replay is recognized before any other check (permission, write rules, version, quota) and repeats no effect, rings nobody and answers the first answer even where those checks would now refuse the request, a key reused for a different request is 409 idempotency_conflict, and a key still in flight is 409 still_pending. The platform keeps no copy of what a connector's provider or a developer-operated service answered, so those replays differ: a connector call under a resource grant answers a replayed key with the action it first staged or applied (never a second one); a plain connector call is not deduplicated; a developer-operated service receives the key in its own Idempotency-Key header, and a replayed key is 409 idempotency_conflict rather than its first answer — never a second charge (managed services replay the first answer).",
+    "space_id": "space_id rides the query string on GET and DELETE and on doors whose body is a raw value, is a JSON body field on POST/PUT/PATCH doors with JSON bodies, and is a path segment on /spaces/{space_id}/... (D12).",
+    "pagination": "Lists page with ?after=<opaque cursor>&limit=<n> and answer next_cursor (string or null); collections keep records, next_cursor, has_more and sync_cursor (D13); no page is larger than limits.page_size.",
+    "binary": "Binary never rides a JSON string field as text: JSON answers carry body (UTF-8 text or null) beside body_base64 (base64 bytes or null) (D14), and raw bytes travel as raw bodies.",
+    "echo": "An event is never delivered back to any session of the user who published it, and a presence change is not echoed to the member who made it; platform change signals reach every member who can read the change, the writer's own sessions included — a change to a member's own (personal) collection reaches only that member, even inside a space (D3).",
+    "errors": "Every non-2xx answer from any host - backend, terminus dev or the app host, extractor and body-limit rejections and admission refusals included - is JSON {error:{code, message, details?}} with a code from errors; clients branch on code and status, never on message (D16).",
+    "ids_and_times": "Ids are opaque strings (UUIDs on hosted runtimes) and times are RFC 3339 strings.",
+    "body_limits": "A door's body limit is checked before its body is parsed; doors without an explicit limit take limits.default_body_bytes (D17)."
+  },
+  "common_errors": ["method_not_allowed", "service_unavailable", "deadline_exceeded"],
+  "types": {
+    "PublicUser": {
+      "id": "string",
+      "handle": "string",
+      "display_name": "string",
+      "avatar_url": "string|null",
+      "public_profile_url": "string|null"
+    },
+    "SpaceMember": {
+      "id": "string",
+      "handle": "string",
+      "display_name": "string",
+      "avatar_url": "string|null",
+      "public_profile_url": "string|null",
+      "role": "owner|admin|editor|viewer",
+      "joined_at": "string"
+    },
+    "Space": {
+      "id": "string",
+      "name": "string",
+      "kind": "direct|group",
+      "peer": "PublicUser|null",
+      "parent_id": "string|null",
+      "meta": "object|null",
+      "my_role": "owner|admin|editor|viewer",
+      "blocked_by_me": "boolean",
+      "blocked_by_peer": "boolean",
+      "muted": "boolean",
+      "capabilities": "SpaceCapabilities"
+    },
+    "SpaceCapabilities": {
+      "can_send": "boolean",
+      "can_invite": "boolean",
+      "can_remove_members": "boolean",
+      "can_manage_roles": "boolean",
+      "can_update": "boolean",
+      "can_leave": "boolean",
+      "can_block_peer": "boolean",
+      "can_delete": "boolean"
+    },
+    "SpaceInviteReceipt": { "id": "string", "user_id": "string", "handle": "string", "created": "boolean" },
+    "SpaceInvitation": {
+      "id": "string",
+      "space_id": "string",
+      "invitee": "PublicUser",
+      "role": "admin|editor|viewer",
+      "status": "pending",
+      "created_at": "string",
+      "expires_at": "string"
+    },
+    "SpaceCursorMember": {
+      "user_id": "string",
+      "role": "owner|admin|editor|viewer|null",
+      "delivered_through": "integer",
+      "read_through": "integer"
+    },
+    "BootstrapApp": { "id": "string", "slug": "string", "name": "string", "icon_url": "string" },
+    "BootstrapInstallation": { "id": "string", "release_id": "string", "release_version": "integer" },
+    "BootstrapData": { "grants": "DataGrant[]", "resource_grants": "ResourceGrant[]" },
+    "DataGrant": {
+      "id": "string",
+      "path_prefix": "string",
+      "access": "read|read-write",
+      "expires_at": "string|null"
+    },
+    "ResourceGrant": {
+      "id": "string",
+      "connector": "string",
+      "label": "string",
+      "resource_type": "path|object|collection",
+      "resource": "string",
+      "operations": "string[]",
+      "field_rules": "object",
+      "rate_limit_per_minute": "integer",
+      "approval_mode": "manual|scoped_auto",
+      "space_id": "string|null",
+      "expires_at": "string|null",
+      "revoked_at": "string|null",
+      "created_at": "string",
+      "updated_at": "string"
+    },
+    "RuntimePolicy": {
+      "connect_src?": "string[]",
+      "font_src?": "string[]",
+      "frame_src?": "string[]",
+      "img_src?": "string[]",
+      "script_src?": "string[]",
+      "style_src?": "string[]"
+    },
+    "FileEntry": {
+      "path": "string",
+      "size_bytes": "integer",
+      "sha256": "string",
+      "media_type": "string",
+      "version": "integer",
+      "updated_at": "string"
+    },
+    "WriteReceipt": {
+      "path": "string",
+      "size_bytes": "integer",
+      "sha256": "string",
+      "media_type": "string",
+      "version": "integer",
+      "updated_at": "string"
+    },
+    "CollectionDefinition": {
+      "name?": "string",
+      "ownership?": "personal|space",
+      "search?": "string[]",
+      "indexes?": "string[]",
+      "unique?": "string[]",
+      "relations?": "object",
+      "permissions?": "object",
+      "schema?": "json",
+      "validate?": "json[]"
+    },
+    "ManagedRecord": {
+      "id": "string",
+      "value": "object",
+      "version": "integer",
+      "created_at": "string",
+      "updated_at": "string",
+      "created_by_user_id": "string|null",
+      "updated_by_user_id": "string|null",
+      "delivery_sequence": "integer|null",
+      "delivery_recipients": "string[]|null"
+    },
+    "ManagedPutReceipt": {
+      "id": "string",
+      "value": "object",
+      "version": "integer|null",
+      "created_at?": "string",
+      "updated_at?": "string",
+      "created_by_user_id?": "string|null",
+      "updated_by_user_id?": "string|null",
+      "mutation_id": "string",
+      "sync_cursor": "string",
+      "replayed?": "boolean"
+    },
+    "ManagedDeleteReceipt": {
+      "ok": "boolean",
+      "mutation_id": "string",
+      "sync_cursor": "string",
+      "cascaded?": "DeleteCascade[]",
+      "replayed?": "boolean"
+    },
+    "DeleteCascade": { "collection": "string", "record_id": "string", "sync_cursor": "string" },
+    "ManagedDelivery": {
+      "id": "string",
+      "value": "object",
+      "version?": "integer",
+      "sequence": "integer",
+      "recipients": "string[]",
+      "mutation_id": "string",
+      "sync_cursor?": "string|null",
+      "replayed?": "boolean"
+    },
+    "TransactionOperation": {
+      "action": "put|delete",
+      "collection": "string",
+      "id": "string",
+      "value?": "object",
+      "expected_version?": "integer"
+    },
+    "TransactionOperationResult": {
+      "action": "put|delete",
+      "collection": "string",
+      "id": "string",
+      "value?": "object",
+      "version?": "integer",
+      "created_at?": "string",
+      "updated_at?": "string",
+      "created_by_user_id?": "string|null",
+      "updated_by_user_id?": "string|null",
+      "ok?": "boolean",
+      "mutation_id": "string",
+      "sync_cursor": "string"
+    },
+    "TransactionCascade": {
+      "collection": "string",
+      "id": "string",
+      "mutation_id": "string",
+      "sync_cursor": "string"
+    },
+    "TransactionResult": {
+      "transaction_id": "string",
+      "replayed": "boolean",
+      "results": "TransactionOperationResult[]",
+      "cascaded": "TransactionCascade[]"
+    },
+    "ManagedRecordChange": {
+      "cursor": "string",
+      "operation": "put|delete|reset",
+      "record_id": "string",
+      "mutation_id": "string",
+      "committed_version": "integer|null",
+      "version": "integer|null",
+      "value": "object|null",
+      "actor_user_id": "string|null",
+      "created_by_user_id": "string|null",
+      "updated_by_user_id": "string|null",
+      "delivery_sequence": "integer|null",
+      "delivery_recipients": "string[]|null",
+      "changed_fields": "string[]",
+      "created_at": "string|null",
+      "committed_at": "string"
+    },
+    "CollaborationOperationInput": { "id": "string", "operation": "json" },
+    "CollaborationOperation": {
+      "cursor": "string",
+      "id": "string",
+      "operation": "json",
+      "actor_user_id": "string",
+      "actor_session_id": "string",
+      "committed_at": "string"
+    },
+    "EventNotify": { "title": "string", "body?": "string", "route?": "string|null" },
+    "WriteNotify": {
+      "title": "string",
+      "body?": "string",
+      "route?": "string|null",
+      "audience?": "absent|mentioned"
+    },
+    "EventPublishResult": {
+      "ok?": "boolean",
+      "transient?": "boolean",
+      "error?": "payload_too_large|rate_limited"
+    },
+    "EventOrigin": {
+      "kind": "member|platform|agent|server",
+      "user_id?": "string",
+      "role?": "owner|admin|editor|viewer",
+      "browser_session_id?": "string",
+      "task_id?": "string"
+    },
+    "AppNotice": {
+      "id": "string",
+      "kind": "invite|mention|message|notice",
+      "title": "string",
+      "body": "string",
+      "route": "string|null",
+      "data": "json",
+      "space_id": "string|null",
+      "read_at": "string|null",
+      "created_at": "string"
+    },
+    "AppJob": {
+      "id": "string",
+      "automation": "string",
+      "status": "queued|running|waiting|succeeded|failed|cancelled",
+      "input": "json",
+      "result": "json|null",
+      "error": "string|null",
+      "attempts": "integer",
+      "created_at": "string",
+      "finished_at": "string|null"
+    },
+    "AppSchedule": {
+      "name": "string",
+      "automation": "string",
+      "cron": "string",
+      "enabled": "boolean",
+      "next_run_at": "string",
+      "last_enqueued_at": "string|null",
+      "origin": "declared|agent"
+    },
+    "LifecycleMigration": {
+      "from": "integer",
+      "to": "integer",
+      "status": "pending|running|succeeded|failed|skipped",
+      "error": "string|null"
+    },
+    "ConnectorResponse": {
+      "connector": "string",
+      "status": "integer",
+      "ok": "boolean",
+      "content_type": "string",
+      "headers": "object",
+      "body": "string|null",
+      "body_base64": "string|null",
+      "observation_id?": "string",
+      "resource_grant_id?": "string"
+    },
+    "ConnectorAction": {
+      "status": "integer",
+      "ok": "boolean",
+      "staged": "boolean",
+      "action_id": "string",
+      "approval_status": "pending|approved|applying|applied|failed|rejected|needs_reconciliation|canceled",
+      "preview?": "object",
+      "result?": "json"
+    },
+    "ExternalServiceInvocation": {
+      "invocation_id": "string",
+      "status": "integer",
+      "content_type": "string",
+      "body": "string|null",
+      "body_base64": "string|null",
+      "billed_credits": "string",
+      "platform_fee_credits": "string",
+      "developer_earning_credits": "string",
+      "metadata?": "ServiceExecutionMetadata"
+    },
+    "ServiceExecutionMetadata": {
+      "contract": "string",
+      "provider_service_id": "string",
+      "route_revision": "integer",
+      "duration_ms": "integer",
+      "attempts": "integer",
+      "cache": "string"
+    },
+    "ServiceJob": {
+      "job_id": "string",
+      "service_id": "string",
+      "operation": "string",
+      "status": "queued|running|succeeded|failed|cancelled|reconciling",
+      "error_code": "string|null",
+      "delivery_status": "string|null",
+      "cancel_requested": "boolean",
+      "created_at": "string",
+      "completed_at": "string|null",
+      "result_expires_at": "string|null",
+      "billing_status": "string",
+      "billed_credits": "string",
+      "gateway_request_id": "string|null",
+      "result_expired": "boolean",
+      "result": "json|null",
+      "result_access_allowed": "boolean"
+    },
+    "CollectSubmission": { "id": "string", "deliver_after": "string", "delivered": "boolean" }
+  },
+  "errors": [
+    {
+      "code": "bad_request",
+      "status": 400,
+      "meaning": "The request is malformed: an invalid path, query, header or JSON body, an unknown field, or a value out of range."
+    },
+    {
+      "code": "unauthorized",
+      "status": 401,
+      "meaning": "No valid app session: the cookie or token is missing or unknown — as in every window of an app whose own sign-out door removed the cookie — or a signed-out guest called a door that needs a person."
+    },
+    {
+      "code": "session_ended",
+      "status": 401,
+      "meaning": "The app session presented was revoked or has ended — the person signed out of Terminus, or the session expired; the app should stop and say so (opening the app again signs in). The SDK also answers it itself, without a request, on the device that signed out."
+    },
+    {
+      "code": "forbidden",
+      "status": 403,
+      "meaning": "Authenticated but not allowed: the release did not declare the capability, the member's role or a block forbids it, or a cross-origin mutation."
+    },
+    {
+      "code": "grant_required",
+      "status": 403,
+      "meaning": "A per-person consent grant is missing (the collect plane's first use); raise the consent ask instead of a plain refusal."
+    },
+    {
+      "code": "not_found",
+      "status": 404,
+      "meaning": "No such door, space, member, file, record, job, notification or declared resource visible to the caller."
+    },
+    {
+      "code": "not_installed",
+      "status": 404,
+      "meaning": "The person has no installation of this app, so there is nothing to pause or mute."
+    },
+    { "code": "method_not_allowed", "status": 405, "meaning": "The path exists but not with this method." },
+    {
+      "code": "conflict",
+      "status": 409,
+      "meaning": "The request conflicts with current state: the app was updated since the session began, a unique or relation constraint, a cursor frontier, a stale snapshot."
+    },
+    {
+      "code": "version_conflict",
+      "status": 409,
+      "meaning": "A compare-and-set precondition failed: expected_version or expected_sha256 does not match."
+    },
+    {
+      "code": "idempotency_conflict",
+      "status": 409,
+      "meaning": "The Idempotency-Key (or operation id) was already used for a different request."
+    },
+    {
+      "code": "still_pending",
+      "status": 409,
+      "meaning": "A request with the same Idempotency-Key is still in flight; retry later with the same key."
+    },
+    {
+      "code": "payload_too_large",
+      "status": 413,
+      "meaning": "A body, field or fetched resource exceeds its byte limit."
+    },
+    {
+      "code": "unprocessable",
+      "status": 422,
+      "meaning": "A well-formed write violates a collection's declared validate rules; details carry the rule's message."
+    },
+    {
+      "code": "rate_limited",
+      "status": 429,
+      "meaning": "A rate limit or daily budget is exhausted; Retry-After says when to try again when known."
+    },
+    {
+      "code": "quota_exceeded",
+      "status": 402,
+      "meaning": "Credits or storage quota are exhausted for this operation."
+    },
+    {
+      "code": "price_confirmation_required",
+      "status": 402,
+      "meaning": "A priced action needs the caller to confirm the current price; details.price_credits carries it and nothing was charged."
+    },
+    {
+      "code": "url_not_allowed",
+      "status": 400,
+      "meaning": "The destination is refused: not a public http(s) URL on a standard port, or it resolves to a private address."
+    },
+    {
+      "code": "upstream_failed",
+      "status": 502,
+      "meaning": "An upstream the door called (a web site, provider API, service or the app server tier) failed or answered badly."
+    },
+    {
+      "code": "server_disabled",
+      "status": 503,
+      "meaning": "App server code is switched off on this deployment."
+    },
+    {
+      "code": "server_unavailable",
+      "status": 503,
+      "meaning": "The app server tier is not configured or cannot be reached."
+    },
+    {
+      "code": "service_unavailable",
+      "status": 503,
+      "meaning": "The platform is busy (admission refused, Retry-After set) or a dependency is unavailable."
+    },
+    {
+      "code": "deadline_exceeded",
+      "status": 504,
+      "meaning": "The door or its upstream did not finish within its deadline."
+    },
+    {
+      "code": "not_implemented",
+      "status": 501,
+      "meaning": "The host cannot serve this capability (for example no object storage, or a connector without a generic API adapter)."
+    },
+    {
+      "code": "unsupported_in_dev",
+      "status": 501,
+      "meaning": "terminus dev cannot serve this door; exercise it against a real host. Only terminus dev answers it."
+    },
+    {
+      "code": "internal_error",
+      "status": 500,
+      "meaning": "An unexpected server error. Safe to retry an idempotent request."
+    }
+  ],
+  "limits": {
+    "default_body_bytes": 262144,
+    "transaction_operations": 64,
+    "transaction_body_bytes": 1048576,
+    "deliver_body_bytes": 262144,
+    "record_value_bytes": 131072,
+    "record_put_body_bytes": 262144,
+    "record_id_pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$",
+    "where_bytes": 16384,
+    "page_size": 200,
+    "event_batch": 16,
+    "mentions": 8,
+    "event_payload_bytes": 32768,
+    "presence_state_bytes": 4096,
+    "publish_durable_per_minute": 240,
+    "publish_transient_per_minute": 1200,
+    "collaboration_batch_operations": 64,
+    "collaboration_body_bytes": 262144,
+    "bucket_object_bytes": 8388608,
+    "data_object_bytes": 12582912,
+    "net_fetch_bytes": 524288,
+    "net_image_bytes": 5242880,
+    "notification_title_chars": 160,
+    "notification_body_chars": 2000,
+    "notification_route_chars": 500,
+    "log_message_chars": 2000,
+    "logs_per_minute": 60,
+    "notification_pause_days": 31,
+    "delivery_recipients": 50,
+    "space_meta_bytes": 4096,
+    "collections_per_release": 32,
+    "idempotency_key_chars": 200,
+    "collection_definition_bytes": 32768,
+    "space_name_chars": 120,
+    "notification_data_bytes": 32768,
+    "log_detail_bytes": 65536,
+    "job_input_bytes": 262144,
+    "collect_payload_bytes": 65536,
+    "collect_submissions_per_day": 100,
+    "connector_body_bytes": 2097152,
+    "connector_response_bytes": 2097152,
+    "service_body_bytes": 12582912,
+    "capability_operation_body_bytes": 1048576,
+    "egress_calls_per_day": 500,
+    "server_op_sync_ms": 10000,
+    "changes_batch": 500,
+    "user_search_results": 8
+  },
+  "doors": [
+    {
+      "id": "session.bootstrap",
+      "method": "GET",
+      "also_head": true,
+      "path": "/bootstrap",
+      "upstream": "/v1/app-runtime/session/current",
+      "summary": "The app's own view of this session, trimmed to what is read (D23): the runtime major, the guest flag, the app, the installation and release the session is pinned to, the signed-in person and their data grants. On an app open to guests the app host answers it for a signed-out visitor itself (guest true, installation and user null, no grants). The SDK refuses a platform_api_version other than its own.",
+      "auth": "app_session",
+      "guest_allowed": true,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": {},
+      "request": {},
+      "response": {
+        "kind": "json",
+        "fields": {
+          "platform_api_version": "integer",
+          "guest": "boolean",
+          "app": "BootstrapApp",
+          "installation": "BootstrapInstallation|null",
+          "user": "PublicUser|null",
+          "data": "BootstrapData"
+        }
+      },
+      "response_headers": [],
+      "errors": ["session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["ready"]
+    },
+    {
+      "id": "session.identity",
+      "method": "GET",
+      "path": null,
+      "upstream": "/v1/app-runtime/session/identity",
+      "summary": "Worker only, never reachable from app code (D20): who a session is, answered from the session cache with no manifest, grant or avatar query. The app host calls it before serving a release asset (the identity keys the asset cache) and in /_terminus/open; network_domains and runtime_policy are the inputs of the HTML page's Content-Security-Policy, derived from the pinned release's capabilities.",
+      "auth": "worker",
+      "guest_allowed": false,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": {},
+      "request": {},
+      "response": {
+        "kind": "json",
+        "fields": {
+          "app_id": "string",
+          "installation_id": "string",
+          "release_id": "string",
+          "user_id": "string|null",
+          "guest": "boolean",
+          "network_domains": "string[]",
+          "runtime_policy": "RuntimePolicy"
+        }
+      },
+      "response_headers": [],
+      "errors": ["session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": "unsupported" },
+      "sdk": []
+    },
+    {
+      "id": "users.lookup",
+      "method": "GET",
+      "path": "/users/lookup",
+      "upstream": "/v1/app-runtime/users/lookup",
+      "summary": "Resolves one exact handle (1-64 characters, leading @ ignored) to a public identity.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": { "handle": "string" },
+      "request": {},
+      "response": { "kind": "json", "fields": { "$body": "PublicUser" } },
+      "response_headers": [],
+      "errors": ["bad_request", "not_found", "session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["users.lookup"]
+    },
+    {
+      "id": "users.search",
+      "method": "GET",
+      "path": "/users/search",
+      "upstream": "/v1/app-runtime/users/search",
+      "summary": "Prefix typeahead over active people's handles and display names for recipient pickers: at most 8, never the caller; a query shorter than 2 or longer than 64 characters answers no users.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": { "q": "string" },
+      "request": {},
+      "response": { "kind": "json", "fields": { "users": "PublicUser[]" } },
+      "response_headers": [],
+      "errors": ["session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["users.search"]
+    },
+    {
+      "id": "users.avatar",
+      "method": "GET",
+      "path": "/users/{user_id}/avatar",
+      "upstream": "/v1/app-runtime/users/{user_id}/avatar",
+      "summary": "A person's avatar image: the target of PublicUser.avatar_url, which carries a version query, so the answer is cached as immutable.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": {},
+      "request": {},
+      "response": { "kind": "bytes", "fields": {} },
+      "response_headers": ["cache-control", "content-type"],
+      "errors": ["not_found", "session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": []
+    },
+    {
+      "id": "users.profile",
+      "method": "GET",
+      "path": "/users/{handle}/profile",
+      "upstream": "/v1/app-runtime/users/{handle}/profile",
+      "summary": "The target of PublicUser.public_profile_url: a temporary redirect to the person's public profile page on the platform (the app host passes the redirect through rather than following it).",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": {},
+      "request": {},
+      "response": { "kind": "redirect", "fields": {} },
+      "response_headers": ["location"],
+      "errors": ["bad_request", "not_found", "session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": []
+    },
+    {
+      "id": "spaces.list",
+      "method": "GET",
+      "path": "/spaces",
+      "upstream": "/v1/app-runtime/spaces",
+      "summary": "The spaces bound to this app that the caller is a member of, most recently updated first, at most 200 (D27; replaces /spaces/installations). A direct space's peer is its other member — or, until they answer, the person invited — and null for a group, or once nobody else is in it or invited.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": {},
+      "request": {},
+      "response": { "kind": "json", "fields": { "spaces": "Space[]" } },
+      "response_headers": [],
+      "errors": ["session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["spaces.list", "spaces.live"]
+    },
+    {
+      "id": "spaces.create",
+      "method": "POST",
+      "path": "/spaces",
+      "upstream": "/v1/app-runtime/spaces",
+      "summary": "Opens a space bound to this app with the caller as owner and invites everyone named — membership is only ever the invitee's own answer. One transaction: space, app binding and invitations; a bad handle creates nothing. The caller hears space_membership_joined for the new space on their account stream, so every one of their windows lists it. kind defaults to group; a direct space names exactly one other person and neither may have blocked the other; a group may name nobody yet. name is 1-120 characters (\"New space\" when omitted). parent_id names a space bound to the same app that the caller is a member of. meta is an app-defined JSON object of at most 4096 serialized bytes that every member can read. 409 conflict while the session's release is not the app's published release.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "json",
+      "body_limit_bytes": 262144,
+      "lane": "interactive",
+      "query": {},
+      "request": {
+        "name?": "string",
+        "kind?": "direct|group",
+        "member_handles": "string[]",
+        "parent_id?": "string",
+        "meta?": "object"
+      },
+      "response": { "kind": "json", "fields": { "space": "Space", "invitations": "SpaceInviteReceipt[]" } },
+      "response_headers": [],
+      "errors": [
+        "bad_request",
+        "conflict",
+        "forbidden",
+        "not_found",
+        "payload_too_large",
+        "session_ended",
+        "unauthorized"
+      ],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["spaces.create"]
+    },
+    {
+      "id": "spaces.update",
+      "method": "PATCH",
+      "path": "/spaces/{space_id}",
+      "upstream": "/v1/app-runtime/spaces/{space_id}",
+      "summary": "Renames a space or replaces its meta (D2): name is for groups only, by the owner or an admin; meta is changed by the owner or an admin in a group and by either member in a direct space; null clears meta. At least one field. Members hear space_conversation_updated.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "path",
+      "idempotency": "none",
+      "body": "json",
+      "body_limit_bytes": 262144,
+      "lane": "interactive",
+      "query": {},
+      "request": { "name?": "string", "meta?": "object|null" },
+      "response": { "kind": "json", "fields": { "space": "Space" } },
+      "response_headers": [],
+      "errors": [
+        "bad_request",
+        "forbidden",
+        "not_found",
+        "payload_too_large",
+        "session_ended",
+        "unauthorized"
+      ],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["spaces.update"]
+    },
+    {
+      "id": "spaces.delete",
+      "method": "DELETE",
+      "path": "/spaces/{space_id}",
+      "upstream": "/v1/app-runtime/spaces/{space_id}",
+      "summary": "Owner only (D2): deletes the space and all of its app data for every member; each member hears space_deleted on their account stream. 409 conflict while child spaces (parent_id = this space) exist; 429 rate_limited when another write holds the space's lock past its wait.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "path",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": {},
+      "request": {},
+      "response": { "kind": "json", "fields": { "ok": "boolean" } },
+      "response_headers": [],
+      "errors": ["conflict", "forbidden", "not_found", "rate_limited", "session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["spaces.delete"]
+    },
+    {
+      "id": "spaces.members",
+      "method": "GET",
+      "path": "/spaces/{space_id}/members",
+      "upstream": "/v1/app-runtime/spaces/{space_id}/members",
+      "summary": "The space's members: the owner, then admins, editors and viewers, each by handle.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "path",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": {},
+      "request": {},
+      "response": { "kind": "json", "fields": { "members": "SpaceMember[]" } },
+      "response_headers": [],
+      "errors": ["not_found", "session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["spaces.members", "spaces.liveMembers"]
+    },
+    {
+      "id": "spaces.invite",
+      "method": "POST",
+      "path": "/spaces/{space_id}/members",
+      "upstream": "/v1/app-runtime/spaces/{space_id}/members",
+      "summary": "Always an invitation, never direct membership: groups only, by the owner or an admin; only the owner invites an admin; a space holds at most 50 people. created is false when a pending invitation already existed; 409 conflict when the person is already a member. The invitee is told through the platform's invitation notice.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "path",
+      "idempotency": "none",
+      "body": "json",
+      "body_limit_bytes": 262144,
+      "lane": "interactive",
+      "query": {},
+      "request": { "handle": "string", "role?": "admin|editor|viewer" },
+      "response": { "kind": "json", "fields": { "invitation": "SpaceInviteReceipt" } },
+      "response_headers": [],
+      "errors": [
+        "bad_request",
+        "conflict",
+        "forbidden",
+        "not_found",
+        "payload_too_large",
+        "session_ended",
+        "unauthorized"
+      ],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["spaces.invite"]
+    },
+    {
+      "id": "spaces.update_member",
+      "method": "PATCH",
+      "path": "/spaces/{space_id}/members/{member_id}",
+      "upstream": "/v1/app-runtime/spaces/{space_id}/members/{member_id}",
+      "summary": "Changes a member's role in a group: by the owner or an admin; the owner's role never changes and only the owner manages admins.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "path",
+      "idempotency": "none",
+      "body": "json",
+      "body_limit_bytes": 262144,
+      "lane": "interactive",
+      "query": {},
+      "request": { "role": "admin|editor|viewer" },
+      "response": { "kind": "json", "fields": { "member": "SpaceMember" } },
+      "response_headers": [],
+      "errors": [
+        "bad_request",
+        "forbidden",
+        "not_found",
+        "payload_too_large",
+        "session_ended",
+        "unauthorized"
+      ],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["spaces.updateMember"]
+    },
+    {
+      "id": "spaces.remove_member",
+      "method": "DELETE",
+      "path": "/spaces/{space_id}/members/{member_id}",
+      "upstream": "/v1/app-runtime/spaces/{space_id}/members/{member_id}",
+      "summary": "Removes a member from a group: by the owner or an admin, never the owner, and only the owner removes an admin. Their access ends at once and they hear space_membership_left.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "path",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": {},
+      "request": {},
+      "response": { "kind": "json", "fields": { "ok": "boolean" } },
+      "response_headers": [],
+      "errors": ["bad_request", "forbidden", "not_found", "session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["spaces.removeMember"]
+    },
+    {
+      "id": "spaces.leave",
+      "method": "DELETE",
+      "path": "/spaces/{space_id}/membership",
+      "upstream": "/v1/app-runtime/spaces/{space_id}/membership",
+      "summary": "The caller leaves a group; anyone but the owner.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "path",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": {},
+      "request": {},
+      "response": { "kind": "json", "fields": { "ok": "boolean" } },
+      "response_headers": [],
+      "errors": ["bad_request", "forbidden", "not_found", "session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["spaces.leave"]
+    },
+    {
+      "id": "spaces.invitations",
+      "method": "GET",
+      "path": "/spaces/{space_id}/invitations",
+      "upstream": "/v1/app-runtime/spaces/{space_id}/invitations",
+      "summary": "The space's pending, unexpired invitations for a member's roster UI, oldest first, at most 200. Invitees are not members: they are never recipients, cursors or presence.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "path",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": {},
+      "request": {},
+      "response": { "kind": "json", "fields": { "invitations": "SpaceInvitation[]" } },
+      "response_headers": [],
+      "errors": ["not_found", "session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["spaces.invitations"]
+    },
+    {
+      "id": "spaces.block_peer",
+      "method": "POST",
+      "path": "/spaces/{space_id}/block",
+      "upstream": "/v1/app-runtime/spaces/{space_id}/block",
+      "summary": "Blocks the other person of a direct space (direct spaces only; 409 conflict unless it has exactly one peer). While either person blocks the other the space takes no events, cursors or messages.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "path",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": {},
+      "request": {},
+      "response": { "kind": "json", "fields": { "ok": "boolean", "peer_user_id": "string" } },
+      "response_headers": [],
+      "errors": ["bad_request", "conflict", "not_found", "session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["spaces.blockPeer"]
+    },
+    {
+      "id": "spaces.unblock_peer",
+      "method": "DELETE",
+      "path": "/spaces/{space_id}/block",
+      "upstream": "/v1/app-runtime/spaces/{space_id}/block",
+      "summary": "Lifts the caller's block of the other person of a direct space.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "path",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": {},
+      "request": {},
+      "response": { "kind": "json", "fields": { "ok": "boolean", "peer_user_id": "string" } },
+      "response_headers": [],
+      "errors": ["bad_request", "conflict", "not_found", "session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["spaces.unblockPeer"]
+    },
+    {
+      "id": "spaces.cursors",
+      "method": "GET",
+      "path": "/spaces/{space_id}/cursor",
+      "upstream": "/v1/app-runtime/spaces/{space_id}/cursor",
+      "summary": "Delivery and read high-water marks per member against the space's delivery sequence head (former members keep their row with role null).",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "path",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": {},
+      "request": {},
+      "response": {
+        "kind": "json",
+        "fields": { "head_sequence": "integer", "members": "SpaceCursorMember[]" }
+      },
+      "response_headers": [],
+      "errors": ["not_found", "session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["spaces.cursors", "spaces.liveCursors"]
+    },
+    {
+      "id": "spaces.update_cursor",
+      "method": "PUT",
+      "path": "/spaces/{space_id}/cursor",
+      "upstream": "/v1/app-runtime/spaces/{space_id}/cursor",
+      "summary": "Advances the caller's delivered/read marks; marks never move back and read <= delivered <= head (409 conflict otherwise). At least one field. Members hear space_cursor_updated only when a mark actually advanced.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "path",
+      "idempotency": "none",
+      "body": "json",
+      "body_limit_bytes": 262144,
+      "lane": "interactive",
+      "query": {},
+      "request": { "delivered_through?": "integer", "read_through?": "integer" },
+      "response": {
+        "kind": "json",
+        "fields": { "delivered_through": "integer", "read_through": "integer", "head_sequence": "integer" }
+      },
+      "response_headers": [],
+      "errors": [
+        "bad_request",
+        "conflict",
+        "forbidden",
+        "not_found",
+        "payload_too_large",
+        "session_ended",
+        "unauthorized"
+      ],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["spaces.updateCursor"]
+    },
+    {
+      "id": "spaces.mute",
+      "method": "PUT",
+      "path": "/spaces/{space_id}/mute",
+      "upstream": "/v1/app-runtime/spaces/{space_id}/mute",
+      "summary": "Mutes a space's message rings for the caller (true), lets it ring (false) or follows their default for the app (null); mentions, invitations and the app's own notices ring either way; nobody else can see it. Answers whether it is now muted; the caller's other windows hear space_notifications_updated.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "path",
+      "idempotency": "none",
+      "body": "json",
+      "body_limit_bytes": 262144,
+      "lane": "interactive",
+      "query": {},
+      "request": { "muted": "boolean|null" },
+      "response": { "kind": "json", "fields": { "muted": "boolean" } },
+      "response_headers": [],
+      "errors": ["bad_request", "not_found", "payload_too_large", "session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["notifications.mute"]
+    },
+    {
+      "id": "data.list",
+      "method": "GET",
+      "path": "/data",
+      "upstream": "/v1/app-runtime/data",
+      "summary": "The caller's files under prefix, paths relative to the zone root, ordered by path: zone private (the default) is the app's own area, output is the person's deliverables. With space_id the door addresses the caller's own member shard in that space (D4; zone must be private). limit defaults to 100, at most 200.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "query",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": {
+        "zone?": "private|output",
+        "prefix?": "string",
+        "space_id?": "string",
+        "after?": "string",
+        "limit?": "integer"
+      },
+      "request": {},
+      "response": { "kind": "json", "fields": { "files": "FileEntry[]", "next_cursor": "string|null" } },
+      "response_headers": [],
+      "errors": ["bad_request", "forbidden", "not_found", "session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["files.list"]
+    },
+    {
+      "id": "data.read",
+      "method": "GET",
+      "also_head": true,
+      "path": "/data/object",
+      "upstream": "/v1/app-runtime/data/object",
+      "summary": "One file's bytes under its stored media type; the ETag is its quoted sha256, x-terminus-data-version its version, and a file derived from a connector observation names it with its provenance (restricted or declassified). HEAD answers the headers alone.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "query",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": { "path": "string", "zone?": "private|output", "space_id?": "string" },
+      "request": {},
+      "response": { "kind": "bytes", "fields": {} },
+      "response_headers": [
+        "content-type",
+        "etag",
+        "x-terminus-data-version",
+        "x-terminus-schema-id",
+        "x-terminus-schema-version",
+        "x-terminus-observation-id",
+        "x-terminus-provenance"
+      ],
+      "errors": ["bad_request", "forbidden", "not_found", "session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["files.read", "files.readBlob", "files.stat"]
+    },
+    {
+      "id": "data.write",
+      "method": "PUT",
+      "path": "/data/object",
+      "upstream": "/v1/app-runtime/data/object",
+      "summary": "Writes one file from the raw body, storing the request Content-Type as its media type (D15). expected_sha256=missing requires that the path does not exist; any other value must equal its current sha256 (409 version_conflict otherwise). observation_id attaches verified connector provenance. Paths under buckets/ are refused in the private zone with 400 bad_request (they belong to storage buckets). 402 quota_exceeded when the person's storage is full.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "query",
+      "idempotency": "none",
+      "body": "bytes",
+      "body_limit_bytes": 12582912,
+      "lane": "interactive",
+      "query": {
+        "path": "string",
+        "zone?": "private|output",
+        "space_id?": "string",
+        "expected_sha256?": "string",
+        "schema_id?": "string",
+        "schema_version?": "integer",
+        "observation_id?": "string"
+      },
+      "request": {},
+      "response": { "kind": "json", "fields": { "$body": "WriteReceipt" } },
+      "response_headers": [],
+      "errors": [
+        "bad_request",
+        "forbidden",
+        "not_found",
+        "payload_too_large",
+        "quota_exceeded",
+        "session_ended",
+        "unauthorized",
+        "version_conflict"
+      ],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["files.write"]
+    },
+    {
+      "id": "data.delete",
+      "method": "DELETE",
+      "path": "/data/object",
+      "upstream": "/v1/app-runtime/data/object",
+      "summary": "Removes one file; expected_sha256, when given, must equal its current sha256 (409 version_conflict otherwise); expected_sha256=missing is 400 bad_request, since a delete needs something to delete.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "query",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": {
+        "path": "string",
+        "zone?": "private|output",
+        "space_id?": "string",
+        "expected_sha256?": "string"
+      },
+      "request": {},
+      "response": { "kind": "json", "fields": { "ok": "boolean" } },
+      "response_headers": [],
+      "errors": ["bad_request", "forbidden", "not_found", "session_ended", "unauthorized", "version_conflict"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["files.remove"]
+    },
+    {
+      "id": "storage.list",
+      "method": "GET",
+      "path": "/storage/{bucket}",
+      "upstream": "/v1/app-runtime/storage/{bucket}",
+      "summary": "A bucket's files under prefix. Nothing declares a bucket: opened with space_id it is that space's (every member reads it and a file outlives its writer's membership), otherwise it is the caller's own. Bucket names are 1-64 letters, digits, '.', '-' or '_' not starting with '.'. limit defaults to 100, at most 200.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "query",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": { "space_id?": "string", "prefix?": "string", "after?": "string", "limit?": "integer" },
+      "request": {},
+      "response": { "kind": "json", "fields": { "files": "FileEntry[]", "next_cursor": "string|null" } },
+      "response_headers": [],
+      "errors": ["bad_request", "not_found", "session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["storage.bucket().list"]
+    },
+    {
+      "id": "storage.read",
+      "method": "GET",
+      "also_head": true,
+      "path": "/storage/{bucket}/object",
+      "upstream": "/v1/app-runtime/storage/{bucket}/object",
+      "summary": "One bucket object's bytes under the content type it was written with (D15); the ETag is its quoted sha256.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "query",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": { "path": "string", "space_id?": "string" },
+      "request": {},
+      "response": { "kind": "bytes", "fields": {} },
+      "response_headers": ["content-type", "etag"],
+      "errors": ["bad_request", "not_found", "session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["storage.bucket().read"]
+    },
+    {
+      "id": "storage.write",
+      "method": "PUT",
+      "path": "/storage/{bucket}/object",
+      "upstream": "/v1/app-runtime/storage/{bucket}/object",
+      "summary": "Writes one bucket object (at most 8 MiB, D31) from the raw body and stores the request Content-Type (D15). Writing a space's bucket needs space write access. expected_sha256=missing requires that the object does not exist (create-only); any other value must equal its current sha256 (409 version_conflict otherwise), so members of a space do not overwrite each other's files.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "query",
+      "idempotency": "none",
+      "body": "bytes",
+      "body_limit_bytes": 8388608,
+      "lane": "interactive",
+      "query": { "path": "string", "space_id?": "string", "expected_sha256?": "string" },
+      "request": {},
+      "response": { "kind": "json", "fields": { "$body": "WriteReceipt" } },
+      "response_headers": [],
+      "errors": [
+        "bad_request",
+        "forbidden",
+        "not_found",
+        "payload_too_large",
+        "quota_exceeded",
+        "session_ended",
+        "unauthorized",
+        "version_conflict"
+      ],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["storage.bucket().write"]
+    },
+    {
+      "id": "storage.delete",
+      "method": "DELETE",
+      "path": "/storage/{bucket}/object",
+      "upstream": "/v1/app-runtime/storage/{bucket}/object",
+      "summary": "Removes one bucket object; expected_sha256, when given, must equal its current sha256 (409 version_conflict otherwise); expected_sha256=missing is 400 bad_request, since a delete needs something to delete.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "query",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": { "path": "string", "space_id?": "string", "expected_sha256?": "string" },
+      "request": {},
+      "response": { "kind": "json", "fields": { "ok": "boolean" } },
+      "response_headers": [],
+      "errors": ["bad_request", "forbidden", "not_found", "session_ended", "unauthorized", "version_conflict"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["storage.bucket().delete"]
+    },
+    {
+      "id": "collections.define",
+      "method": "PUT",
+      "path": "/collections/{collection}/definition",
+      "upstream": "/v1/app-runtime/collections/{collection}/definition",
+      "summary": "Lazily pins the SDK's collection definition to this installation and release; the grammar is collection-definitions.json and write-rules.json. The same definition again answers the stored one; a different one is 409 conflict (a changed definition ships in a new release). At most 32 collections per release installation. Collection names are 1-64 lowercase letters, digits, '-' or '_' starting with a letter.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "json",
+      "body_limit_bytes": 32768,
+      "lane": "interactive",
+      "query": {},
+      "request": { "$body": "CollectionDefinition" },
+      "response": { "kind": "json", "fields": { "$body": "CollectionDefinition" } },
+      "response_headers": [],
+      "errors": ["bad_request", "conflict", "payload_too_large", "session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["db.collection"]
+    },
+    {
+      "id": "collections.list",
+      "method": "GET",
+      "path": "/collections/{collection}",
+      "upstream": "/v1/app-runtime/collections/{collection}",
+      "summary": "A page of records the caller may read (fields redacted by the read policy). sync_cursor is captured before the rows are read. The default order is by id and pages with after; sort (field, or -field for descending) pages by limit only and refuses after. where is the §2.6 grammar as JSON (where-grammar.json, at most 16 KiB); search is websearch syntax over the declared search fields; a blank search (empty or only spaces) is no search. limit defaults to 100, at most 200. A space-owned collection needs space_id.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "query",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": {
+        "space_id?": "string",
+        "where?": "string",
+        "after?": "string",
+        "limit?": "integer",
+        "sort?": "string",
+        "search?": "string"
+      },
+      "request": {},
+      "response": {
+        "kind": "json",
+        "fields": {
+          "records": "ManagedRecord[]",
+          "next_cursor": "string|null",
+          "has_more": "boolean",
+          "sync_cursor": "string"
+        }
+      },
+      "response_headers": [],
+      "errors": ["bad_request", "forbidden", "not_found", "session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": [
+        "db.collection().list",
+        "db.collection().find",
+        "db.collection().findPage",
+        "db.collection().search",
+        "db.collection().live"
+      ]
+    },
+    {
+      "id": "collections.get",
+      "method": "GET",
+      "path": "/collections/{collection}/{record_id}",
+      "upstream": "/v1/app-runtime/collections/{collection}/{record_id}",
+      "summary": "One record by id (limits.record_id_pattern), redacted by the read policy.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "query",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": { "space_id?": "string" },
+      "request": {},
+      "response": { "kind": "json", "fields": { "$body": "ManagedRecord" } },
+      "response_headers": [],
+      "errors": ["bad_request", "forbidden", "not_found", "session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["db.collection().get", "db.collection().getRecord"]
+    },
+    {
+      "id": "collections.put",
+      "method": "PUT",
+      "path": "/collections/{collection}/{record_id}",
+      "upstream": "/v1/app-runtime/collections/{collection}/{record_id}",
+      "summary": "Creates or replaces one record from the body (a JSON object of at most 128 KiB). expected_version 0 requires that the record is absent and a positive value must equal its version (409 version_conflict). The write, its receipt and the change cursor commit together; a replayed Idempotency-Key answers the committed result with replayed true. Declared unique fields and relations answer 409 conflict, validate rules 422 unprocessable.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "query",
+      "idempotency": "required",
+      "body": "json",
+      "body_limit_bytes": 262144,
+      "lane": "interactive",
+      "query": { "space_id?": "string", "expected_version?": "integer" },
+      "request": { "$body": "object" },
+      "response": { "kind": "json", "fields": { "$body": "ManagedPutReceipt" } },
+      "response_headers": [],
+      "errors": [
+        "bad_request",
+        "conflict",
+        "forbidden",
+        "idempotency_conflict",
+        "not_found",
+        "payload_too_large",
+        "session_ended",
+        "still_pending",
+        "unauthorized",
+        "unprocessable",
+        "version_conflict"
+      ],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["db.collection().put", "db.collection().update", "db.collection().putMany"]
+    },
+    {
+      "id": "collections.delete",
+      "method": "DELETE",
+      "path": "/collections/{collection}/{record_id}",
+      "upstream": "/v1/app-runtime/collections/{collection}/{record_id}",
+      "summary": "Deletes one record (expected_version as for put); relations declared onDelete cascade remove their dependents in the same commit and are listed in cascaded.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "query",
+      "idempotency": "required",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": { "space_id?": "string", "expected_version?": "integer" },
+      "request": {},
+      "response": { "kind": "json", "fields": { "$body": "ManagedDeleteReceipt" } },
+      "response_headers": [],
+      "errors": [
+        "bad_request",
+        "conflict",
+        "forbidden",
+        "idempotency_conflict",
+        "not_found",
+        "session_ended",
+        "still_pending",
+        "unauthorized",
+        "version_conflict"
+      ],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["db.collection().delete"]
+    },
+    {
+      "id": "collections.deliver",
+      "method": "POST",
+      "path": "/collections/{collection}/deliver",
+      "upstream": "/v1/app-runtime/collections/{collection}/deliver",
+      "summary": "Delivers one record to a space: freezes the current membership as the recipient set and writes a replica into each recipient's personal collection under one app-space delivery sequence (space-delivery.json). Personal collections only. notify and mentions ring with the commit through the one ring core (D8); a replay rings nobody and answers the original sequence and recipients. A replica that would break a declared unique field or relation in a recipient's collection refuses the whole delivery with 409 conflict; validate rules answer 422 unprocessable.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "body",
+      "idempotency": "required",
+      "body": "json",
+      "body_limit_bytes": 262144,
+      "lane": "interactive",
+      "query": {},
+      "request": {
+        "space_id": "string",
+        "record_id": "string",
+        "value": "object",
+        "notify?": "WriteNotify",
+        "mentions?": "string[]"
+      },
+      "response": { "kind": "json", "fields": { "$body": "ManagedDelivery" } },
+      "response_headers": [],
+      "errors": [
+        "bad_request",
+        "conflict",
+        "forbidden",
+        "idempotency_conflict",
+        "not_found",
+        "payload_too_large",
+        "session_ended",
+        "still_pending",
+        "unauthorized",
+        "unprocessable"
+      ],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["db.collection().deliver"]
+    },
+    {
+      "id": "collections.changes",
+      "method": "GET",
+      "path": "/collections/{collection}/changes",
+      "upstream": "/v1/app-runtime/collections/{collection}/changes",
+      "summary": "Ordered committed changes after a collection cursor (at most 500 per answer), filtered and redacted by the read policy. reset_required means retention no longer bridges after: read a fresh snapshot.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "query",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": { "space_id?": "string", "after?": "string" },
+      "request": {},
+      "response": {
+        "kind": "json",
+        "fields": {
+          "reset_required": "boolean",
+          "reason?": "cursor_expired",
+          "cursor": "string",
+          "retained_after": "string",
+          "has_more": "boolean",
+          "changes": "ManagedRecordChange[]"
+        }
+      },
+      "response_headers": [],
+      "errors": ["bad_request", "forbidden", "not_found", "session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["db.collection().live"]
+    },
+    {
+      "id": "collections.rebuild",
+      "method": "POST",
+      "path": "/collections/{collection}/rebuild",
+      "upstream": "/v1/app-runtime/collections/{collection}/rebuild",
+      "summary": "One call (D25): counts the canonical records and commits a reset change, so every live projection of the collection re-reads a fresh snapshot.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "query",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": { "space_id?": "string" },
+      "request": {},
+      "response": { "kind": "json", "fields": { "rebuilt": "integer", "sync_cursor": "string" } },
+      "response_headers": [],
+      "errors": ["bad_request", "forbidden", "not_found", "session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["db.collection().rebuild"]
+    },
+    {
+      "id": "transactions.commit",
+      "method": "POST",
+      "path": "/transactions",
+      "upstream": "/v1/app-runtime/transactions",
+      "summary": "Commits 1-64 record puts and deletes in one database transaction within one capsule scope, each address at most once; preconditions, declared constraints, cascades, cursors and the replay receipt commit or roll back together. notify and mentions need space_id and ring with the commit (D8); a replay rings nobody and answers the first result with replayed true.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "body",
+      "idempotency": "required",
+      "body": "json",
+      "body_limit_bytes": 1048576,
+      "lane": "interactive",
+      "query": {},
+      "request": {
+        "space_id?": "string",
+        "notify?": "WriteNotify",
+        "mentions?": "string[]",
+        "operations": "TransactionOperation[]"
+      },
+      "response": { "kind": "json", "fields": { "$body": "TransactionResult" } },
+      "response_headers": [],
+      "errors": [
+        "bad_request",
+        "conflict",
+        "forbidden",
+        "idempotency_conflict",
+        "not_found",
+        "payload_too_large",
+        "session_ended",
+        "still_pending",
+        "unauthorized",
+        "unprocessable",
+        "version_conflict"
+      ],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["db.transact"]
+    },
+    {
+      "id": "collaboration.append",
+      "method": "POST",
+      "path": "/collaboration/{document_id}/operations",
+      "upstream": "/v1/app-runtime/collaboration/{document_id}/operations",
+      "summary": "Appends 1-64 operations to a document's ordered journal, the only durable-journal family (D21). An operation id is idempotent per author: a retried id answers its committed position, and the same id with different content is 409 idempotency_conflict. The journal commits before collaboration_changed is published. Document ids are 1-128 safe characters; the SDK names a durable stream's journal stream.<id>. Opened with space_id the journal is the space's (writing needs space write access), otherwise the caller's own.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "body",
+      "idempotency": "none",
+      "body": "json",
+      "body_limit_bytes": 262144,
+      "lane": "interactive",
+      "query": {},
+      "request": { "operations": "CollaborationOperationInput[]", "space_id?": "string" },
+      "response": {
+        "kind": "json",
+        "fields": { "cursor": "string", "operations": "CollaborationOperation[]" }
+      },
+      "response_headers": [],
+      "errors": [
+        "bad_request",
+        "conflict",
+        "forbidden",
+        "idempotency_conflict",
+        "not_found",
+        "payload_too_large",
+        "session_ended",
+        "unauthorized"
+      ],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["streams.open"]
+    },
+    {
+      "id": "collaboration.read",
+      "method": "GET",
+      "path": "/collaboration/{document_id}/operations",
+      "upstream": "/v1/app-runtime/collaboration/{document_id}/operations",
+      "summary": "Journal operations after a cursor (limit defaults to 200, at most 200). A read from the start carries the latest snapshot; a reader behind the compaction frontier gets reset_required with the snapshot and resumes at snapshot_cursor.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "query",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": { "space_id?": "string", "after?": "string", "limit?": "integer" },
+      "request": {},
+      "response": {
+        "kind": "json",
+        "fields": {
+          "cursor": "string",
+          "operations": "CollaborationOperation[]",
+          "has_more": "boolean",
+          "reset_required": "boolean",
+          "reason?": "cursor_expired",
+          "snapshot_cursor?": "string",
+          "snapshot?": "json"
+        }
+      },
+      "response_headers": [],
+      "errors": ["bad_request", "forbidden", "not_found", "session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["streams.open"]
+    },
+    {
+      "id": "collaboration.snapshot",
+      "method": "PUT",
+      "path": "/collaboration/{document_id}/snapshot",
+      "upstream": "/v1/app-runtime/collaboration/{document_id}/snapshot",
+      "summary": "Compare-and-set checkpoint of the document's projected state through a journal cursor: through may not be behind the current snapshot or ahead of the head (409 conflict). Operations covered by a committed snapshot may then be compacted.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "body",
+      "idempotency": "none",
+      "body": "json",
+      "body_limit_bytes": 262144,
+      "lane": "interactive",
+      "query": {},
+      "request": { "snapshot": "json", "through": "string", "space_id?": "string" },
+      "response": {
+        "kind": "json",
+        "fields": { "ok": "boolean", "cursor": "string", "snapshot_cursor": "string" }
+      },
+      "response_headers": [],
+      "errors": [
+        "bad_request",
+        "conflict",
+        "forbidden",
+        "not_found",
+        "payload_too_large",
+        "session_ended",
+        "unauthorized"
+      ],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["streams.open"]
+    },
+    {
+      "id": "events.publish",
+      "method": "POST",
+      "path": "/events",
+      "upstream": "/v1/app-runtime/events",
+      "summary": "Publishes an app event (or a batch of 1-16) to a space: each payload is at most 32 KiB and reaches every other member's account stream, never any session of the publisher (D3). transient events are live-only and carry no mentions or notify; batches carry neither. mentions (at most 8 handles) ring the members named; notify rings the members not looking at the space, through the one ring core (D8). Budget: 240 durable and 1200 transient publishes per minute per publisher and topic. A replayed Idempotency-Key rings nobody and answers the first answer (D8).",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "body",
+      "idempotency": "optional",
+      "body": "json",
+      "body_limit_bytes": 262144,
+      "lane": "interactive",
+      "query": {},
+      "request": {
+        "event?": "json",
+        "events?": "json[]",
+        "space_id": "string",
+        "mentions?": "string[]",
+        "transient?": "boolean",
+        "notify?": "EventNotify"
+      },
+      "response": {
+        "kind": "json",
+        "fields": { "ok": "boolean", "transient": "boolean" },
+        "variants": [
+          {
+            "when": "the request carried events[] (a batch)",
+            "fields": { "results": "EventPublishResult[]" }
+          }
+        ]
+      },
+      "response_headers": [],
+      "errors": [
+        "bad_request",
+        "forbidden",
+        "idempotency_conflict",
+        "not_found",
+        "payload_too_large",
+        "rate_limited",
+        "session_ended",
+        "still_pending",
+        "unauthorized"
+      ],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["rooms.open"]
+    },
+    {
+      "id": "events.stream",
+      "method": "GET",
+      "path": "/events",
+      "upstream": "/v1/app-runtime/events",
+      "summary": "The session's one live stream (SSE; frames in `frames`): the caller's account stream for this app, which hears every space-scoped frame of the app in every space they share plus account frames. rooms narrows room_event frames to the listed rooms (comma-separated); every other frame flows.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": { "rooms?": "string" },
+      "request": {},
+      "response": { "kind": "sse", "fields": {} },
+      "response_headers": ["cache-control", "content-type"],
+      "errors": ["session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": [
+        "rooms.open",
+        "spaces.live",
+        "spaces.liveMembers",
+        "spaces.liveCursors",
+        "db.collection().live",
+        "streams.open",
+        "jobs.wait"
+      ]
+    },
+    {
+      "id": "events.presence",
+      "method": "GET",
+      "path": "/events/presence",
+      "upstream": "/v1/app-runtime/events/presence",
+      "summary": "The space's members holding a live stream for this app right now, with each one's presence state (states maps user id to state).",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "query",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": { "space_id": "string" },
+      "request": {},
+      "response": { "kind": "json", "fields": { "online": "string[]", "states": "object" } },
+      "response_headers": [],
+      "errors": ["bad_request", "not_found", "session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["rooms.open"]
+    },
+    {
+      "id": "events.set_presence",
+      "method": "POST",
+      "path": "/events/presence",
+      "upstream": "/v1/app-runtime/events/presence",
+      "summary": "Sets (or with null clears) the caller's presence state, at most 4 KiB: with space_id it parks on that space, without one on the caller's account topic. window (1-64 letters, digits, '-' or '_') and visible say whether that window is showing the space; a hidden window or a cleared state is not looking. An unchanged re-assert is a silent heartbeat, and a change is never echoed to the caller (D3). Co-members hear a cleared state, and the member's last stream closing, as online false; a heartbeat that lapses without either is not announced.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "body",
+      "idempotency": "none",
+      "body": "json",
+      "body_limit_bytes": 262144,
+      "lane": "interactive",
+      "query": {},
+      "request": { "state?": "json|null", "space_id?": "string", "window?": "string", "visible?": "boolean" },
+      "response": { "kind": "json", "fields": { "ok": "boolean" } },
+      "response_headers": [],
+      "errors": [
+        "bad_request",
+        "forbidden",
+        "not_found",
+        "payload_too_large",
+        "rate_limited",
+        "session_ended",
+        "unauthorized"
+      ],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["rooms.open"]
+    },
+    {
+      "id": "notifications.create",
+      "method": "POST",
+      "path": "/notifications",
+      "upstream": "/v1/app-runtime/notifications",
+      "summary": "The app's own notice to the signed-in person, never to anyone else; needs the release's shell.notifications. title 1-160 characters, body at most 2000, route at most 500, data at most 32 KiB. While the person paused the app's notifications nothing is written and the answer says so.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "none",
+      "idempotency": "optional",
+      "body": "json",
+      "body_limit_bytes": 262144,
+      "lane": "interactive",
+      "query": {},
+      "request": { "title": "string", "body?": "string", "route?": "string|null", "data?": "json" },
+      "response": {
+        "kind": "json",
+        "fields": { "id": "string", "created": "boolean" },
+        "variants": [
+          {
+            "when": "the person paused this app's notifications",
+            "fields": { "created": "boolean", "paused": "boolean" }
+          }
+        ]
+      },
+      "response_headers": [],
+      "errors": [
+        "bad_request",
+        "forbidden",
+        "idempotency_conflict",
+        "payload_too_large",
+        "session_ended",
+        "still_pending",
+        "unauthorized"
+      ],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["notifications.create"]
+    },
+    {
+      "id": "notifications.list",
+      "method": "GET",
+      "path": "/notifications",
+      "upstream": "/v1/app-runtime/notifications",
+      "summary": "The app's notifications for the signed-in person, newest first; limit defaults to 50, at most 200.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": { "after?": "string", "limit?": "integer" },
+      "request": {},
+      "response": {
+        "kind": "json",
+        "fields": { "notifications": "AppNotice[]", "next_cursor": "string|null" }
+      },
+      "response_headers": [],
+      "errors": ["bad_request", "session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["notifications.list"]
+    },
+    {
+      "id": "notifications.read",
+      "method": "POST",
+      "path": "/notifications/{notification_id}/read",
+      "upstream": "/v1/app-runtime/notifications/{notification_id}/read",
+      "summary": "Marks one of the app's notifications read, idempotently, through the one core it shares with the platform bell (D22); an unknown id is 404 not_found.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": {},
+      "request": {},
+      "response": { "kind": "json", "fields": { "ok": "boolean" } },
+      "response_headers": [],
+      "errors": ["bad_request", "not_found", "session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["notifications.markRead"]
+    },
+    {
+      "id": "notifications.pause_status",
+      "method": "GET",
+      "path": "/notifications/pause",
+      "upstream": "/v1/app-runtime/notifications/pause",
+      "summary": "Until when the signed-in person paused this app's notifications, or null.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": {},
+      "request": {},
+      "response": { "kind": "json", "fields": { "paused_until": "string|null" } },
+      "response_headers": [],
+      "errors": ["session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["notifications.pausedUntil"]
+    },
+    {
+      "id": "notifications.pause",
+      "method": "PUT",
+      "path": "/notifications/pause",
+      "upstream": "/v1/app-runtime/notifications/pause",
+      "summary": "Pauses the signed-in person's notifications from this app until a moment at most 31 days ahead; null or a past moment resumes. While paused nothing but invitations rings, and nothing is saved up.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "json",
+      "body_limit_bytes": 262144,
+      "lane": "interactive",
+      "query": {},
+      "request": { "until": "string|null" },
+      "response": { "kind": "json", "fields": { "paused_until": "string|null" } },
+      "response_headers": [],
+      "errors": ["bad_request", "not_installed", "payload_too_large", "session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["notifications.pause"]
+    },
+    {
+      "id": "notifications.default_mute_status",
+      "method": "GET",
+      "path": "/notifications/default-mute",
+      "upstream": "/v1/app-runtime/notifications/default-mute",
+      "summary": "Whether the spaces the signed-in person has not decided for are muted for them.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": {},
+      "request": {},
+      "response": { "kind": "json", "fields": { "muted": "boolean" } },
+      "response_headers": [],
+      "errors": ["session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["notifications.mutedByDefault"]
+    },
+    {
+      "id": "notifications.default_mute",
+      "method": "PUT",
+      "path": "/notifications/default-mute",
+      "upstream": "/v1/app-runtime/notifications/default-mute",
+      "summary": "Mutes (or stops muting) every space the signed-in person has not decided for, including future ones; a space they muted or unmuted themselves keeps its answer.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "json",
+      "body_limit_bytes": 262144,
+      "lane": "interactive",
+      "query": {},
+      "request": { "muted": "boolean" },
+      "response": { "kind": "json", "fields": { "muted": "boolean" } },
+      "response_headers": [],
+      "errors": ["bad_request", "not_installed", "payload_too_large", "session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["notifications.muteByDefault"]
+    },
+    {
+      "id": "jobs.run",
+      "method": "POST",
+      "path": "/jobs",
+      "upstream": "/v1/app-runtime/jobs",
+      "summary": "Enqueues one automation the release declared, with a JSON object input of at most 256 KiB; the platform interprets its declarative steps. A replayed Idempotency-Key answers the job it already made (D11). A job's terminal state is pushed as job.updated on the installation owner's account stream (D29). 429 rate_limited when a daily job budget is spent (a draft's Test window world has one).",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "body",
+      "idempotency": "optional",
+      "body": "json",
+      "body_limit_bytes": 262144,
+      "lane": "interactive",
+      "query": {},
+      "request": { "automation": "string", "input": "object", "space_id?": "string" },
+      "response": { "kind": "json", "fields": { "id": "string", "automation": "string", "status": "queued" } },
+      "response_headers": [],
+      "errors": [
+        "bad_request",
+        "forbidden",
+        "idempotency_conflict",
+        "not_found",
+        "payload_too_large",
+        "rate_limited",
+        "session_ended",
+        "still_pending",
+        "unauthorized"
+      ],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["jobs.run"]
+    },
+    {
+      "id": "jobs.get",
+      "method": "GET",
+      "path": "/jobs/{job_id}",
+      "upstream": "/v1/app-runtime/jobs/{job_id}",
+      "summary": "One of this installation's jobs.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": {},
+      "request": {},
+      "response": { "kind": "json", "fields": { "$body": "AppJob" } },
+      "response_headers": [],
+      "errors": ["bad_request", "not_found", "session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["jobs.get", "jobs.wait"]
+    },
+    {
+      "id": "jobs.cancel",
+      "method": "DELETE",
+      "path": "/jobs/{job_id}",
+      "upstream": "/v1/app-runtime/jobs/{job_id}",
+      "summary": "Cancels a queued job; only queued, non-migration jobs can be cancelled (409 conflict otherwise).",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": {},
+      "request": {},
+      "response": { "kind": "json", "fields": { "ok": "boolean" } },
+      "response_headers": [],
+      "errors": ["bad_request", "conflict", "session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["jobs.cancel"]
+    },
+    {
+      "id": "schedules.list",
+      "method": "GET",
+      "path": "/schedules",
+      "upstream": "/v1/app-runtime/schedules",
+      "summary": "This installation's schedules, by name.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": {},
+      "request": {},
+      "response": { "kind": "json", "fields": { "schedules": "AppSchedule[]" } },
+      "response_headers": [],
+      "errors": ["session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["schedules.list"]
+    },
+    {
+      "id": "schedules.set_enabled",
+      "method": "PATCH",
+      "path": "/schedules/{schedule_name}",
+      "upstream": "/v1/app-runtime/schedules/{schedule_name}",
+      "summary": "Switches a schedule on or off; the person's decision sticks against provisioning, and switching on also clears a fatigue pause and the failure streak.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "json",
+      "body_limit_bytes": 262144,
+      "lane": "interactive",
+      "query": {},
+      "request": { "enabled": "boolean" },
+      "response": { "kind": "json", "fields": { "name": "string", "enabled": "boolean" } },
+      "response_headers": [],
+      "errors": ["bad_request", "not_found", "payload_too_large", "session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["schedules.setEnabled"]
+    },
+    {
+      "id": "lifecycle.status",
+      "method": "GET",
+      "path": "/lifecycle",
+      "upstream": "/v1/app-runtime/lifecycle",
+      "summary": "The installation's data version, the release's target version, and its lifecycle migrations.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": {},
+      "request": {},
+      "response": {
+        "kind": "json",
+        "fields": {
+          "installed_data_version": "integer",
+          "target_data_version": "integer",
+          "migrations": "LifecycleMigration[]"
+        }
+      },
+      "response_headers": [],
+      "errors": ["session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["lifecycle.status"]
+    },
+    {
+      "id": "logs.write",
+      "method": "POST",
+      "path": "/logs",
+      "upstream": "/v1/app-runtime/logs",
+      "summary": "One browser log line for the app's maintainers: message 1-2000 characters, detail at most 64 KiB, level defaults to info; at most 60 per installation per minute.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "json",
+      "body_limit_bytes": 262144,
+      "lane": "interactive",
+      "query": {},
+      "request": { "level?": "debug|info|warn|error", "message": "string", "detail?": "json" },
+      "response": { "kind": "json", "fields": { "ok": "boolean" } },
+      "response_headers": [],
+      "errors": ["bad_request", "payload_too_large", "rate_limited", "session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["log.debug", "log.info", "log.warn", "log.error"]
+    },
+    {
+      "id": "net.fetch",
+      "method": "GET",
+      "path": "/net/fetch",
+      "upstream": "/v1/app-runtime/net/fetch",
+      "summary": "SSRF-guarded fetch of a public text resource for a release with network_proxy public-text: http(s) on default ports, every resolved address and every redirect hop public, at most 3 redirects, text, XML, JSON or calendar content only. A body over 512 KiB is refused with 413 unless partial=1, which answers its first 512 KiB with truncated true (D28). Spends the caller's per-user daily fetch budget and rate limit and writes an activity receipt (D28). A private or disallowed address or scheme is 400 url_not_allowed; content the door does not serve (not text), a DNS failure or an unreachable upstream is 502 upstream_failed; an upstream slower than the door's own timeout is 504 deadline_exceeded.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "heavy",
+      "query": { "url": "string", "partial?": "1|true" },
+      "request": {},
+      "response": {
+        "kind": "json",
+        "fields": {
+          "url": "string",
+          "status": "integer",
+          "content_type": "string",
+          "body": "string",
+          "truncated": "boolean"
+        }
+      },
+      "response_headers": [],
+      "errors": [
+        "bad_request",
+        "deadline_exceeded",
+        "forbidden",
+        "payload_too_large",
+        "rate_limited",
+        "session_ended",
+        "unauthorized",
+        "upstream_failed",
+        "url_not_allowed"
+      ],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["net.fetch"]
+    },
+    {
+      "id": "net.image",
+      "method": "GET",
+      "path": "/net/image",
+      "upstream": "/v1/app-runtime/net/image",
+      "summary": "A public raster image (PNG, JPEG, GIF, WebP or AVIF by its own bytes, at most 5 MiB) for a release with network_proxy public-image, through the same guarded path as net.fetch (D28); served under the sniffed type, never cached, x-terminus-url naming the final URL. A private or disallowed address is 400 url_not_allowed; bytes that are not a supported raster image, a DNS failure or an unreachable upstream are 502 upstream_failed; over 5 MiB is 413 payload_too_large.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "heavy",
+      "query": { "url": "string" },
+      "request": {},
+      "response": { "kind": "bytes", "fields": {} },
+      "response_headers": ["cache-control", "content-type", "x-terminus-url"],
+      "errors": [
+        "bad_request",
+        "deadline_exceeded",
+        "forbidden",
+        "payload_too_large",
+        "session_ended",
+        "unauthorized",
+        "upstream_failed",
+        "url_not_allowed"
+      ],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["net.image"]
+    },
+    {
+      "id": "connectors.request",
+      "method": "POST",
+      "path": "/connectors/{slug}/request",
+      "upstream": "/v1/app-runtime/connectors/{slug}/request",
+      "summary": "Calls a declared connector's provider API with the person's own credential, which never reaches the app. path is an absolute provider path under the connector's configured base (base_url may only restate that base); platform-controlled headers (authorization, cookie, host, content-length, content-type, proxy-*, x-forwarded-*, x-terminus-*) are refused; the body is sent as JSON and both it and the response are at most 2 MiB. Without resource_grant_id only GET, or a declared tool profile, is allowed. With a resource grant a read is recorded as an observation and a write is staged for approval or applied under scoped_auto. The body comes back as UTF-8 text, or as body_base64 when it is not UTF-8 (D14).",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "body",
+      "idempotency": "optional",
+      "body": "json",
+      "body_limit_bytes": 2097152,
+      "lane": "heavy",
+      "query": {},
+      "request": {
+        "method?": "GET|POST|PUT|PATCH|DELETE",
+        "path": "string",
+        "base_url?": "string",
+        "query?": "object",
+        "headers?": "object",
+        "body?": "json",
+        "resource_grant_id?": "string",
+        "space_id?": "string"
+      },
+      "response": {
+        "kind": "json",
+        "fields": { "$body": "ConnectorResponse" },
+        "variants": [
+          {
+            "when": "a write under a resource grant (staged or applied)",
+            "fields": { "$body": "ConnectorAction" }
+          }
+        ]
+      },
+      "response_headers": [],
+      "errors": [
+        "bad_request",
+        "deadline_exceeded",
+        "forbidden",
+        "idempotency_conflict",
+        "not_found",
+        "not_implemented",
+        "payload_too_large",
+        "rate_limited",
+        "session_ended",
+        "still_pending",
+        "unauthorized",
+        "unsupported_in_dev",
+        "upstream_failed"
+      ],
+      "hosts": { "production": true, "dev": "unsupported" },
+      "sdk": ["connectors.request"]
+    },
+    {
+      "id": "services.invoke",
+      "method": "POST",
+      "path": "/services/{publisher}/{slug}/{operation}",
+      "upstream": "/v1/app-runtime/services/{publisher}/{slug}/{operation}",
+      "summary": "Invokes one exact operation of a service the release declared (capabilities.services address and operation; publisher is the handle without '@'). The provider receives a short-lived Terminus invocation token, never the person's or the app's credential. input and body_base64 are mutually exclusive. Bills the caller's credits (402 quota_exceeded when short); a job-contract operation answers status 202 with the ServiceJob as JSON text in body.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "none",
+      "idempotency": "optional",
+      "body": "json",
+      "body_limit_bytes": 12582912,
+      "lane": "heavy",
+      "query": {},
+      "request": { "input?": "json", "body_base64?": "string", "query?": "object" },
+      "response": { "kind": "json", "fields": { "$body": "ExternalServiceInvocation" } },
+      "response_headers": [],
+      "errors": [
+        "bad_request",
+        "deadline_exceeded",
+        "forbidden",
+        "idempotency_conflict",
+        "not_found",
+        "payload_too_large",
+        "quota_exceeded",
+        "session_ended",
+        "still_pending",
+        "unauthorized",
+        "unsupported_in_dev",
+        "upstream_failed"
+      ],
+      "hosts": { "production": true, "dev": "unsupported" },
+      "sdk": [
+        "services.invoke",
+        "services.json",
+        "services.search",
+        "services.fetch",
+        "services.generateImage",
+        "services.convertDocument",
+        "services.executeCode",
+        "services.sendEmail"
+      ]
+    },
+    {
+      "id": "service_jobs.get",
+      "method": "GET",
+      "path": "/service-jobs/{id}",
+      "upstream": "/v1/app-runtime/service-jobs/{id}",
+      "summary": "A service job this installation submitted; result is null unless the caller may read it.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": {},
+      "request": {},
+      "response": { "kind": "json", "fields": { "$body": "ServiceJob" } },
+      "response_headers": ["cache-control"],
+      "errors": ["bad_request", "not_found", "session_ended", "unauthorized", "unsupported_in_dev"],
+      "hosts": { "production": true, "dev": "unsupported" },
+      "sdk": ["services.jobs.get", "services.jobs.wait"]
+    },
+    {
+      "id": "service_jobs.cancel",
+      "method": "POST",
+      "path": "/service-jobs/{id}/cancel",
+      "upstream": "/v1/app-runtime/service-jobs/{id}/cancel",
+      "summary": "Requests cancellation of a queued or running service job and answers the job.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": {},
+      "request": {},
+      "response": { "kind": "json", "fields": { "$body": "ServiceJob" } },
+      "response_headers": ["cache-control"],
+      "errors": ["bad_request", "not_found", "session_ended", "unauthorized", "unsupported_in_dev"],
+      "hosts": { "production": true, "dev": "unsupported" },
+      "sdk": ["services.jobs.cancel"]
+    },
+    {
+      "id": "service_jobs.file",
+      "method": "GET",
+      "path": "/service-jobs/{id}/files/{file}",
+      "upstream": "/v1/app-runtime/service-jobs/{id}/files/{file}",
+      "summary": "One result file of a service job, as an attachment, never cached.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "heavy",
+      "query": {},
+      "request": {},
+      "response": { "kind": "bytes", "fields": {} },
+      "response_headers": ["cache-control", "content-disposition", "content-type"],
+      "errors": [
+        "bad_request",
+        "forbidden",
+        "not_found",
+        "session_ended",
+        "unauthorized",
+        "unsupported_in_dev"
+      ],
+      "hosts": { "production": true, "dev": "unsupported" },
+      "sdk": ["services.jobs.file"]
+    },
+    {
+      "id": "service_jobs.save",
+      "method": "POST",
+      "path": "/service-jobs/{id}/files/{file}/save",
+      "upstream": "/v1/app-runtime/service-jobs/{id}/files/{file}/save",
+      "summary": "Saves a result file into the person's home/, which needs a write grant covering the destination; without expected_sha256 the destination must not exist, with it the value must equal the current sha256.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "json",
+      "body_limit_bytes": 262144,
+      "lane": "heavy",
+      "query": {},
+      "request": { "path": "string", "expected_sha256?": "string" },
+      "response": { "kind": "json", "fields": { "path": "string" } },
+      "response_headers": [],
+      "errors": [
+        "bad_request",
+        "forbidden",
+        "not_found",
+        "payload_too_large",
+        "quota_exceeded",
+        "session_ended",
+        "unauthorized",
+        "unsupported_in_dev",
+        "version_conflict"
+      ],
+      "hosts": { "production": true, "dev": "unsupported" },
+      "sdk": ["services.jobs.save"]
+    },
+    {
+      "id": "capabilities.list",
+      "method": "GET",
+      "path": "/capabilities",
+      "upstream": "/v1/capabilities",
+      "summary": "The horizontal capability registry, narrowed to the capabilities this release declared.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": {},
+      "request": {},
+      "response": { "kind": "json", "fields": { "$body": "json" } },
+      "response_headers": [],
+      "errors": ["session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["horizontal.list"]
+    },
+    {
+      "id": "capabilities.describe",
+      "method": "GET",
+      "path": "/capabilities/{id}/{major}",
+      "upstream": "/v1/capabilities/{id}/{major}",
+      "summary": "One declared capability's descriptor; major is 'v' and the integer major version (v1).",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": {},
+      "request": {},
+      "response": { "kind": "json", "fields": { "$body": "json" } },
+      "response_headers": [],
+      "errors": ["bad_request", "forbidden", "not_found", "session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["horizontal.describe", "horizontal.require"]
+    },
+    {
+      "id": "capabilities.invoke",
+      "method": "POST",
+      "path": "/capabilities/{id}/{major}/operations/{operation_id}",
+      "upstream": "/v1/capabilities/{id}/{major}/operations/{operation_id}",
+      "summary": "Runs one declared operation of a declared capability with a JSON input of at most 1 MiB and answers its JSON result. Brokered operations (web-search, maps geocode and provider-session) spend platform-held provider credentials, the per-user budget and any registry price in credits.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "json",
+      "body_limit_bytes": 1048576,
+      "lane": "interactive",
+      "query": {},
+      "request": { "$body": "json" },
+      "response": { "kind": "json", "fields": { "$body": "json" } },
+      "response_headers": [],
+      "errors": [
+        "bad_request",
+        "forbidden",
+        "not_found",
+        "payload_too_large",
+        "quota_exceeded",
+        "rate_limited",
+        "session_ended",
+        "unauthorized",
+        "upstream_failed"
+      ],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["horizontal.invoke"]
+    },
+    {
+      "id": "capabilities.asset",
+      "method": "GET",
+      "path": "/capabilities/{id}/{major}/assets/{*path}",
+      "upstream": "/v1/capabilities/{id}/{major}/assets/{*path}",
+      "summary": "A platform-served capability asset (module, stylesheet, font). It answers an ETag with Cache-Control no-cache and 304 to a matching If-None-Match, so an updated capability is never served stale (D30); only content-named files are immutable. A guest of an app open to guests reaches it too, for a capability the app's current release declares.",
+      "auth": "app_session",
+      "guest_allowed": true,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": {},
+      "request": {},
+      "response": { "kind": "bytes", "fields": {} },
+      "response_headers": ["cache-control", "content-type", "etag"],
+      "errors": ["forbidden", "not_found", "session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": [
+        "horizontal.assetUrl",
+        "horizontal.moduleUrl",
+        "horizontal.loadModule",
+        "horizontal.loadStyle",
+        "horizontal.require"
+      ]
+    },
+    {
+      "id": "egress.request",
+      "method": "POST",
+      "path": "/egress/{template}",
+      "upstream": "/v1/app-runtime/egress/{template}",
+      "summary": "Runs one egress template the release declared: the platform renders its URL, query, headers (sealed secrets included) and body from params, pins the connection to a public address of the template's literal host (same-host redirects only, at most 3) and answers the upstream response, at most the template's max_response_bytes (2 MiB by default). At most 500 calls per app and person per day. 403 forbidden when the caller may not use the release's sealed secrets (a draft's Test window whose maker cannot publish the app).",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "json",
+      "body_limit_bytes": 262144,
+      "lane": "heavy",
+      "query": {},
+      "request": { "params?": "object" },
+      "response": {
+        "kind": "json",
+        "fields": {
+          "status": "integer",
+          "content_type": "string",
+          "body": "string|null",
+          "body_base64": "string|null"
+        }
+      },
+      "response_headers": [],
+      "errors": [
+        "bad_request",
+        "deadline_exceeded",
+        "forbidden",
+        "not_found",
+        "payload_too_large",
+        "rate_limited",
+        "session_ended",
+        "unauthorized",
+        "unsupported_in_dev",
+        "upstream_failed",
+        "url_not_allowed"
+      ],
+      "hosts": { "production": true, "dev": "unsupported" },
+      "sdk": ["egress.request"]
+    },
+    {
+      "id": "server.call",
+      "method": "POST",
+      "path": "/server/{op}",
+      "upstream": "/v1/app-runtime/server/{op}",
+      "summary": "Runs one of the app's own server ops (compiled from its server/ code) on the app server tier under the interactive cap (at most 10 s); a background-only op is refused. 503 server_disabled while app server code is switched off, 503 server_unavailable when the tier is not configured or unreachable.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "json",
+      "body_limit_bytes": 262144,
+      "lane": "heavy",
+      "query": {},
+      "request": { "input?": "json" },
+      "response": { "kind": "json", "fields": { "result": "json" } },
+      "response_headers": [],
+      "errors": [
+        "bad_request",
+        "deadline_exceeded",
+        "not_found",
+        "payload_too_large",
+        "server_disabled",
+        "server_unavailable",
+        "session_ended",
+        "unauthorized",
+        "upstream_failed"
+      ],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["server.call"]
+    },
+    {
+      "id": "collect.submit",
+      "method": "POST",
+      "path": "/collect/{channel}",
+      "upstream": "/v1/app-runtime/collect/{channel}",
+      "summary": "Sends what the person submits to the app's maintainers over a declared documents channel. The first use needs the person's one-time consent (403 grant_required); the payload is at most 64 KiB; 100 submissions per installation, channel and day. Delivery waits out a 120-second undo window.",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "none",
+      "idempotency": "optional",
+      "body": "json",
+      "body_limit_bytes": 262144,
+      "lane": "interactive",
+      "query": {},
+      "request": { "payload": "json" },
+      "response": { "kind": "json", "fields": { "$body": "CollectSubmission" } },
+      "response_headers": [],
+      "errors": [
+        "bad_request",
+        "forbidden",
+        "grant_required",
+        "idempotency_conflict",
+        "payload_too_large",
+        "rate_limited",
+        "session_ended",
+        "still_pending",
+        "unauthorized"
+      ],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["collect.submit"]
+    },
+    {
+      "id": "collect.retract",
+      "method": "POST",
+      "path": "/collect/{channel}/{document_id}/retract",
+      "upstream": "/v1/app-runtime/collect/{channel}/{document_id}/retract",
+      "summary": "The author takes a submission back: inside the undo window it is deleted outright (undone), afterwards its payload is shed and a tombstone stays (retracted).",
+      "auth": "app_session",
+      "guest_allowed": false,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": {},
+      "request": {},
+      "response": {
+        "kind": "json",
+        "fields": { "id": "string", "undone?": "boolean", "retracted?": "boolean" }
+      },
+      "response_headers": [],
+      "errors": ["bad_request", "not_found", "session_ended", "unauthorized"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["collect.retract"]
+    },
+    {
+      "id": "host.icon",
+      "method": "GET",
+      "also_head": true,
+      "path": "/icon",
+      "upstream": "/v1/app-runtime/icon",
+      "upstream_method": "GET",
+      "worker_handled": true,
+      "summary": "The platform-owned app icon (bootstrap app.icon_url), sessionless so it works on consent screens and for guests; the app host asks the backend by its own host name and passes If-None-Match through.",
+      "auth": "none",
+      "guest_allowed": true,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": {},
+      "request": {},
+      "response": { "kind": "bytes", "fields": {} },
+      "response_headers": ["cache-control", "content-type", "etag"],
+      "errors": ["not_found"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": []
+    },
+    {
+      "id": "host.logout",
+      "method": "POST",
+      "path": "/logout",
+      "upstream": "/v1/app-runtime/session/current",
+      "upstream_method": "DELETE",
+      "worker_handled": true,
+      "summary": "Signs the person out of this app on this device: the app host revokes the session (DELETE upstream), clears its cookie and redirects to the platform's sign-in page for the app; on an app open to guests it also marks the browser a guest (guest.marker_cookie), so the app opens as a guest next time instead of signing straight back in. Same-origin only. terminus dev forgets the member's sign-in instead (a guest seat becomes a guest again).",
+      "auth": "none",
+      "guest_allowed": true,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": {},
+      "request": {},
+      "response": { "kind": "redirect", "fields": {} },
+      "response_headers": ["location"],
+      "errors": ["forbidden"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["session.signOut"]
+    },
+    {
+      "id": "host.callback",
+      "method": "GET",
+      "path": "/callback",
+      "upstream": "/v1/app-runtime/session",
+      "upstream_method": "POST",
+      "worker_handled": true,
+      "summary": "Sign-in landing: the app host exchanges the one-time code (POST upstream), sets its HttpOnly session cookie and redirects to return_to or the path a signed-out visit asked for (same-origin paths only). A navigation: failures render an HTML page.",
+      "auth": "none",
+      "guest_allowed": true,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": { "code": "string", "return_to?": "string" },
+      "request": {},
+      "response": { "kind": "redirect", "fields": {} },
+      "response_headers": ["location"],
+      "errors": ["bad_request", "unauthorized", "unsupported_in_dev"],
+      "hosts": { "production": true, "dev": "unsupported" },
+      "sdk": []
+    },
+    {
+      "id": "host.open",
+      "method": "GET",
+      "path": "/open",
+      "upstream": "/v1/app-runtime/session/identity",
+      "upstream_method": "GET",
+      "worker_handled": true,
+      "summary": "How a place reaches an app that may already be open: with a live session (checked against the identity door) it redirects to /, otherwise it clears the cookie and redirects to the platform's authorization page for the app. A navigation.",
+      "auth": "none",
+      "guest_allowed": true,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": {},
+      "request": {},
+      "response": { "kind": "redirect", "fields": {} },
+      "response_headers": ["location"],
+      "errors": ["not_found", "unsupported_in_dev"],
+      "hosts": { "production": true, "dev": "unsupported" },
+      "sdk": []
+    },
+    {
+      "id": "host.signin",
+      "method": "GET",
+      "path": "/signin",
+      "upstream": "/v1/app-runtime/session/identity",
+      "upstream_method": "GET",
+      "worker_handled": true,
+      "summary": "Sign in, then come back: the app host keeps return_to (a path on the app's own origin; anything else is /) and sends the navigation to the platform's authorization page with sign-in required, where a guest signs in or makes an account and comes back to return_to signed in. A live session (checked against the identity door) goes straight to return_to. terminus dev answers a guest seat with a page that picks the member to sign in as, and a member's port straight to return_to. A navigation.",
+      "auth": "none",
+      "guest_allowed": true,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": { "return_to?": "string" },
+      "request": {},
+      "response": { "kind": "redirect", "fields": {} },
+      "response_headers": ["location"],
+      "errors": ["not_found"],
+      "hosts": { "production": true, "dev": true },
+      "sdk": ["session.signIn"]
+    },
+    {
+      "id": "host.guest",
+      "method": "GET",
+      "path": "/guest",
+      "upstream": "/v1/app-runtime/resolve",
+      "upstream_method": "GET",
+      "worker_handled": true,
+      "summary": "Where the platform's authorization page sends a signed-out visitor of an app open to guests: the app host marks the browser a guest (guest.marker_cookie, for guest.marker_max_age_seconds) so its page navigations are not sent to ask again, and redirects to the path the visit asked for. An app not open to guests goes to the authorization page instead. A navigation.",
+      "auth": "none",
+      "guest_allowed": true,
+      "space_id": "none",
+      "idempotency": "none",
+      "body": "none",
+      "body_limit_bytes": null,
+      "lane": "interactive",
+      "query": {},
+      "request": {},
+      "response": { "kind": "redirect", "fields": {} },
+      "response_headers": ["location"],
+      "errors": ["not_found", "unsupported_in_dev"],
+      "hosts": { "production": true, "dev": "unsupported" },
+      "sdk": []
+    }
+  ],
+  "frames": {
+    "door": "events.stream",
+    "encoding": "Each SSE message is one data line holding one JSON object; keep-alive comments carry no data.",
+    "control": { "stream_open": { "type": "stream_open" }, "stream_gap": { "type": "stream_gap" } },
+    "envelope": {
+      "type": "space_event|account_event|presence",
+      "transient": "boolean",
+      "space_id": "string|null",
+      "app_id": "string",
+      "from": "EventOrigin",
+      "event": "object",
+      "published_at": "string"
+    },
+    "rules": [
+      "The first frame is stream_open. On buffer lag or a dropped platform signal the server sends stream_gap and every durable reader (collections, collaboration journals, spaces, members, cursors) drains through its JSON door.",
+      "No sequence number, no epoch and no replay: a (re)connect starts at stream_open and recovers state from the durable doors.",
+      "Echo rule (D3): an event published through events.publish is never delivered to any session of its publisher, and a presence change is not echoed to the member who made it. Platform change signals (record_changed, record_delivered, collaboration_changed, object_changed, space_cursor_updated and the platform space updates) reach every member who can read the change, the writer's own sessions included: a change to a member's own (personal) collection reaches only that member even when opened in a space, a delivery sends each recipient the record_delivered frame of their own replica, and space-owned records and space updates reach every member.",
+      "Every space-scoped frame of the app fans out to each member's account stream, so one stream per session hears every space it shares; account_event frames carry space_id null and name the space inside the event when they concern one.",
+      "A durable record_changed frame carries the ledger's cursor and prev_cursor (a recovered wake — re-sent, with recovered true, for a commit whose live frame was never acknowledged as sent — carries the ledger's prev_cursor too, or none once retention has pruned it; a reader skips any frame at or below its cursor); it carries value (with created_by_user_id, updated_by_user_id, created_at and committed_at) only when the frame fits the 32 KiB payload limit and the collection's read policy grants the full record to every member. A frame without prev_cursor, or whose prev_cursor is not the reader's cursor, means drain the changes door.",
+      "Transient frames (transient true: typing, object_changed, presence) are live-only and never retained.",
+      "rooms=a,b narrows room_event frames to the listed rooms; every other frame flows."
+    ],
+    "space_events": {
+      "record_changed": {
+        "type": "record_changed",
+        "operation": "put|delete|reset",
+        "collection": "string",
+        "record_id?": "string",
+        "version?": "integer|null",
+        "mutation_id": "string",
+        "cursor": "string",
+        "prev_cursor?": "string",
+        "transaction_id?": "string",
+        "recovered?": "boolean",
+        "value?": "object",
+        "created_by_user_id?": "string|null",
+        "updated_by_user_id?": "string|null",
+        "created_at?": "string",
+        "committed_at?": "string"
+      },
+      "record_delivered": {
+        "type": "record_delivered",
+        "collection": "string",
+        "record_id": "string",
+        "sequence": "integer",
+        "mutation_id": "string"
+      },
+      "collaboration_changed": {
+        "type": "collaboration_changed",
+        "document_id": "string",
+        "cursor": "string"
+      },
+      "object_changed": {
+        "type": "object_changed",
+        "plane": "data|storage",
+        "zone?": "private|output",
+        "bucket?": "string",
+        "path": "string",
+        "operation": "put|delete"
+      },
+      "space_cursor_updated": {
+        "type": "space_cursor_updated",
+        "user_id": "string",
+        "delivered_through": "integer",
+        "read_through": "integer"
+      },
+      "space_members_updated": { "type": "space_members_updated" },
+      "space_invitations_updated": { "type": "space_invitations_updated" },
+      "space_conversation_updated": { "type": "space_conversation_updated" },
+      "space_relationship_updated": { "type": "space_relationship_updated" },
+      "room_event": { "type": "room_event", "room_id": "string", "payload": "json" }
+    },
+    "account_events": {
+      "notification.created": {
+        "type": "notification.created",
+        "notification_id": "string",
+        "title": "string",
+        "body": "string",
+        "data": "json"
+      },
+      "space_membership_joined": { "type": "space_membership_joined", "space_id": "string" },
+      "space_membership_left": { "type": "space_membership_left", "space_id": "string" },
+      "space_invitation_resolved": { "type": "space_invitation_resolved", "space_id": "string" },
+      "space_notifications_updated": { "type": "space_notifications_updated", "space_id": "string|null" },
+      "space_deleted": { "type": "space_deleted", "space_id": "string" },
+      "job.updated": {
+        "type": "job.updated",
+        "job_id": "string",
+        "status": "queued|running|waiting|succeeded|failed|cancelled"
+      }
+    },
+    "presence_event": { "online": "boolean", "state?": "json" }
+  },
+  "plumbing": [
+    {
+      "method": "GET",
+      "upstream": "/v1/app-runtime/resolve",
+      "caller": "worker",
+      "summary": "Public discovery of an app by host (or by id, for the platform's authorization page): identity, whether it is open to guests and the release their files come from, and whether it has a browser interface."
+    },
+    {
+      "method": "GET",
+      "upstream": "/v1/app-runtime/icon",
+      "caller": "worker",
+      "summary": "The platform-owned app icon by host, behind /_terminus/icon."
+    },
+    {
+      "method": "POST",
+      "upstream": "/v1/app-runtime/session",
+      "caller": "worker",
+      "summary": "One-time authorization-code exchange for an app session token, behind /_terminus/callback."
+    },
+    {
+      "method": "DELETE",
+      "upstream": "/v1/app-runtime/session/current",
+      "caller": "worker",
+      "summary": "Revokes the app session, behind /_terminus/logout."
+    },
+    {
+      "method": "GET",
+      "upstream": "/v1/app-runtime/assets/{*path}",
+      "caller": "worker",
+      "summary": "Release assets of the session's pinned release."
+    },
+    {
+      "method": "GET",
+      "upstream": "/v1/app-runtime/guest-assets/{release_id}/{*path}",
+      "caller": "worker",
+      "summary": "Release files for guests, while the app is open to them: the release resolve names, and any other published, free release of the app, so a page a guest is loading stays whole in the minute after a publish. Never a draft's Test build."
+    },
+    {
+      "method": "POST",
+      "upstream": "/v1/app-runtime/authorizations",
+      "caller": "web",
+      "summary": "The product (and terminus dev --remote) mints a one-time authorization code to open an installed app."
+    },
+    {
+      "method": "POST",
+      "upstream": "/v1/app-runtime/dev-sessions",
+      "caller": "cli",
+      "summary": "terminus dev mints a capability dev session for the /v1/capabilities plane."
+    }
+  ]
+}