Rust SDK reference

Public signatures and types from the Rust SDK, including resource helpers and model contracts. Start with Getting started with the SDK; see Errors and recovery for connection lifetime, deadlines, and retries.

capsem_sdk::Hypervisor

pub struct Hypervisor { /* private fields */ }

// A gateway connection. Clones and VM handles share the HTTP connection pool.

pub fn new(url: &str, token: &str) -> Result<Self>

pub fn with_timeout(self, timeout: Duration) -> Result<Self>

// Set this handle’s HTTP deadline, including response body reads.

pub async fn info(&self) -> Result<HypervisorInfo>

pub async fn restart(&self) -> Result<RestartResponse>

// Restart an idle managed service. Reconnect with a fresh gateway token.

pub async fn list(&self) -> Result<ListResponse>

pub fn vm(&self, selector: VmSelector) -> Result<VM>

pub fn networks(&self) -> Networks<'_>

pub fn images(&self) -> Images<'_>

pub fn credentials(&self) -> Credentials<'_>

pub fn connections(&self) -> Connections<'_>

pub fn mcp(&self) -> Mcp<'_>

// The MCP servers every VM runs, from settings and corp config.

pub fn debug(&self) -> Debug<'_>

pub async fn create(&self, options: CreateOptions) -> Result<VM>

pub async fn log(
    &self,
    source: HostLogSource,
    options: LogOptions,
) -> Result<HostLogsResponse>

pub async fn run(
    &self,
    command: &str,
    options: RunOptions,
) -> Result<ExecResponse>

pub async fn purge(&self, all: bool) -> Result<PurgeResponse>

pub async fn update(&self) -> Result<UpdateActionResponse>

pub async fn with_managed<T, F, Fut>(
    &self,
    options: CreateOptions,
    work: F,
) -> Result<T>where
    T: Send + 'static,
    F: FnOnce(VM, CancellationToken) -> Fut + Send + 'static,
    Fut: Future<Output = Result<T>> + Send + 'static,

// Create an unnamed ephemeral VM, renew ownership, and await cleanup after the callback. Dropping this future signals cancellation; its owned task continues cleanup on the runtime.

capsem_sdk::VM

pub struct VM { /* private fields */ }

// A VM handle. Clones share canonical identity and the HTTP connection pool.

pub async fn log(&self, options: LogOptions) -> Result<LogsResponse>

pub async fn history(&self, options: HistoryOptions) -> Result<HistoryResponse>

pub async fn timeline(
    &self,
    options: TimelineOptions,
) -> Result<TimelineResponse>

pub fn container(&self) -> Container<'_>

pub fn ports(&self) -> Ports<'_>

pub fn files(&self) -> Files<'_>

pub fn networks(&self) -> VmNetworks<'_>

pub fn credential_grants(&self) -> CredentialGrants<'_>

pub fn new(url: &str, token: &str, selector: VmSelector) -> Result<Self>

pub fn with_timeout(self, timeout: Duration) -> Result<Self>

pub fn id(&self) -> Option<&str>

// Known immediately for ID selection, or after the first name lookup.

pub fn name(&self) -> Option<&str>

pub async fn info(&self) -> Result<SandboxInfo>

pub async fn exec(
    &self,
    command: &str,
    timeout_secs: Option<u64>,
) -> Result<ExecResponse>

pub async fn start(&self) -> Result<ProvisionResponse>

pub async fn stop(&self) -> Result<StopResponse>

pub async fn pause(&self) -> Result<VmActionResponse>

pub async fn resume(&self) -> Result<ProvisionResponse>

pub async fn delete(&self) -> Result<VmActionResponse>

pub async fn fork(
    &self,
    name: &str,
    description: Option<String>,
) -> Result<Self>

pub async fn persist(&self, name: &str) -> Result<PersistResponse>

pub fn stats(&self) -> Stats<'_>

capsem_sdk::ManagedSession

pub struct ManagedSession { /* private fields */ }

// Recovery authority returned with a failed close. Debug never includes its capability.

pub fn ownership(&self) -> Option<&ManagedSessionOwnership>

// Last validated metadata from this ownership generation.

pub async fn close(&mut self, outcome: ManagedSessionOutcome) -> Result<()>

// Await original-generation cleanup. Failed requests retain authority for explicit retry.

capsem_sdk::Error

pub enum Error {
    VmLookup {
        name: String,
        matches: usize,
    },
    InvalidInput(&'static str),
    InvalidResponse(&'static str),
    Cancelled,
    Managed(&'static str),
    ManagedCleanup {
        source: Box<Error>,
        session: Box<ManagedSession>,
    },
    Transport(Error),
    Http {
        status: u16,
        body: Vec<u8>,
    },
    Json(Error),
    Stream(String),
}

// Errors retain HTTP status and response bytes without exposing credentials.

pub fn credential_code(&self) -> Option<CredentialErrorCode>

// The broker’s sanitized machine-readable refusal, when present. Unknown future codes or malformed/non-JSON responses retain their HTTP error.

capsem_sdk::VmSelector

pub enum VmSelector {
    Id(String),
    Name(String),
}

// Exactly one way to select a VM; names resolve once through the gateway.

capsem_sdk::operations::attach_network_member

pub async fn attach_network_member(
    transport: &Transport,
    input: &AttachNetworkMemberParams,
    options: CallOptions,
) -> Result<NetworkInfo>

capsem_sdk::operations::authorize_google_connection

pub async fn authorize_google_connection(
    transport: &Transport,
    input: &AuthorizeGoogleConnectionParams,
    options: CallOptions,
) -> Result<AuthorizeGoogleResponse>

capsem_sdk::operations::call_mcp_tool

pub async fn call_mcp_tool(
    transport: &Transport,
    input: &CallMcpToolParams,
    options: CallOptions,
) -> Result<Value>

capsem_sdk::operations::cancel_connection_authorization

pub async fn cancel_connection_authorization(
    transport: &Transport,
    input: &CancelConnectionAuthorizationParams,
    options: CallOptions,
) -> Result<AuthorizationTransaction>

capsem_sdk::operations::claim_managed_session

pub async fn claim_managed_session(
    transport: &Transport,
    input: &ClaimManagedSessionParams,
    options: CallOptions,
) -> Result<ManagedSessionClaimResponse>

capsem_sdk::operations::close_managed_session

pub async fn close_managed_session(
    transport: &Transport,
    input: &CloseManagedSessionParams,
    options: CallOptions,
) -> Result<ManagedSessionCloseResponse>

capsem_sdk::operations::create_network

pub async fn create_network(
    transport: &Transport,
    input: &CreateNetworkParams,
    options: CallOptions,
) -> Result<NetworkInfo>

capsem_sdk::operations::create_proxy

pub async fn create_proxy(
    transport: &Transport,
    input: &CreateProxyParams,
    options: CallOptions,
) -> Result<CreateProxyResponse>

capsem_sdk::operations::create_session_credential_grant

pub async fn create_session_credential_grant(
    transport: &Transport,
    input: &CreateSessionCredentialGrantParams,
    options: CallOptions,
) -> Result<SessionGrantSummary>

capsem_sdk::operations::create_vm

pub async fn create_vm(
    transport: &Transport,
    input: &CreateVmParams,
    options: CallOptions,
) -> Result<ProvisionResponse>

capsem_sdk::operations::create_vm_exposure

pub async fn create_vm_exposure(
    transport: &Transport,
    input: &CreateVmExposureParams,
    options: CallOptions,
) -> Result<ExposureInfo>

capsem_sdk::operations::create_vm_preview_session

pub async fn create_vm_preview_session(
    transport: &Transport,
    input: &CreateVmPreviewSessionParams,
    options: CallOptions,
) -> Result<PreviewSessionResponse>

capsem_sdk::operations::delete_network

pub async fn delete_network(
    transport: &Transport,
    input: &DeleteNetworkParams,
    options: CallOptions,
) -> Result<VmActionResponse>

capsem_sdk::operations::delete_vm

pub async fn delete_vm(
    transport: &Transport,
    input: &DeleteVmParams,
    options: CallOptions,
) -> Result<VmActionResponse>

capsem_sdk::operations::delete_vm_exposure

pub async fn delete_vm_exposure(
    transport: &Transport,
    input: &DeleteVmExposureParams,
    options: CallOptions,
) -> Result<VmActionResponse>

capsem_sdk::operations::detach_network_member

pub async fn detach_network_member(
    transport: &Transport,
    input: &DetachNetworkMemberParams,
    options: CallOptions,
) -> Result<NetworkInfo>

capsem_sdk::operations::disconnect_connection

pub async fn disconnect_connection(
    transport: &Transport,
    input: &DisconnectConnectionParams,
    options: CallOptions,
) -> Result<DisconnectResponse>

capsem_sdk::operations::download_vm_file

pub async fn download_vm_file(
    transport: &Transport,
    input: &DownloadVmFileParams,
    options: CallOptions,
) -> Result<Vec<u8>>

capsem_sdk::operations::exec_vm

pub async fn exec_vm(
    transport: &Transport,
    input: &ExecVmParams,
    options: CallOptions,
) -> Result<ExecResponse>

capsem_sdk::operations::export_vm_bodies

pub async fn export_vm_bodies(
    transport: &Transport,
    input: &ExportVmBodiesParams,
    options: CallOptions,
) -> Result<Vec<u8>>

capsem_sdk::operations::fork_vm

pub async fn fork_vm(
    transport: &Transport,
    input: &ForkVmParams,
    options: CallOptions,
) -> Result<ForkResponse>

capsem_sdk::operations::get_asset_status

pub async fn get_asset_status(
    transport: &Transport,
    options: CallOptions,
) -> Result<AssetStatus>

capsem_sdk::operations::get_connection

pub async fn get_connection(
    transport: &Transport,
    input: &GetConnectionParams,
    options: CallOptions,
) -> Result<ConnectionSummary>

capsem_sdk::operations::get_connection_authorization

pub async fn get_connection_authorization(
    transport: &Transport,
    input: &GetConnectionAuthorizationParams,
    options: CallOptions,
) -> Result<AuthorizationTransaction>

capsem_sdk::operations::get_hypervisor_info

pub async fn get_hypervisor_info(
    transport: &Transport,
    options: CallOptions,
) -> Result<HypervisorInfo>

capsem_sdk::operations::get_hypervisor_logs

pub async fn get_hypervisor_logs(
    transport: &Transport,
    input: &GetHypervisorLogsParams,
    options: CallOptions,
) -> Result<HostLogsResponse>

capsem_sdk::operations::get_mcp_default

pub async fn get_mcp_default(
    transport: &Transport,
    options: CallOptions,
) -> Result<McpDefaultPermissionResponse>

capsem_sdk::operations::get_mcp_info

pub async fn get_mcp_info(
    transport: &Transport,
    options: CallOptions,
) -> Result<McpInfoResponse>

capsem_sdk::operations::get_network

pub async fn get_network(
    transport: &Transport,
    input: &GetNetworkParams,
    options: CallOptions,
) -> Result<NetworkInfo>

capsem_sdk::operations::get_network_logs

pub async fn get_network_logs(
    transport: &Transport,
    input: &GetNetworkLogsParams,
    options: CallOptions,
) -> Result<NetworkLogsResponse>

capsem_sdk::operations::get_panics

pub async fn get_panics(
    transport: &Transport,
    input: &GetPanicsParams,
    options: CallOptions,
) -> Result<PanicsResponse>

capsem_sdk::operations::get_triage

pub async fn get_triage(
    transport: &Transport,
    input: &GetTriageParams,
    options: CallOptions,
) -> Result<TriageResponse>

capsem_sdk::operations::get_update_status

pub async fn get_update_status(
    transport: &Transport,
    options: CallOptions,
) -> Result<UpdateStatusResponse>

capsem_sdk::operations::get_vm_container

pub async fn get_vm_container(
    transport: &Transport,
    input: &GetVmContainerParams,
    options: CallOptions,
) -> Result<ContainerStatusResponse>

capsem_sdk::operations::get_vm_event_bodies

pub async fn get_vm_event_bodies(
    transport: &Transport,
    input: &GetVmEventBodiesParams,
    options: CallOptions,
) -> Result<EventBodiesResponse>

capsem_sdk::operations::get_vm_history

pub async fn get_vm_history(
    transport: &Transport,
    input: &GetVmHistoryParams,
    options: CallOptions,
) -> Result<HistoryResponse>

capsem_sdk::operations::get_vm_info

pub async fn get_vm_info(
    transport: &Transport,
    input: &GetVmInfoParams,
    options: CallOptions,
) -> Result<SandboxInfo>

capsem_sdk::operations::get_vm_logs

pub async fn get_vm_logs(
    transport: &Transport,
    input: &GetVmLogsParams,
    options: CallOptions,
) -> Result<LogsResponse>

capsem_sdk::operations::get_vm_stats_detail

pub async fn get_vm_stats_detail(
    transport: &Transport,
    input: &GetVmStatsDetailParams,
    options: CallOptions,
) -> Result<VmStatsDetailResponse>

capsem_sdk::operations::get_vm_stats_summary

pub async fn get_vm_stats_summary(
    transport: &Transport,
    input: &GetVmStatsSummaryParams,
    options: CallOptions,
) -> Result<VmStatsSummaryResponse>

capsem_sdk::operations::get_vm_status

pub async fn get_vm_status(
    transport: &Transport,
    input: &GetVmStatusParams,
    options: CallOptions,
) -> Result<VmStatusResponse>

capsem_sdk::operations::get_vm_timeline

pub async fn get_vm_timeline(
    transport: &Transport,
    input: &GetVmTimelineParams,
    options: CallOptions,
) -> Result<TimelineResponse>

capsem_sdk::operations::heartbeat_proxy

pub async fn heartbeat_proxy(
    transport: &Transport,
    input: &HeartbeatProxyParams,
    options: CallOptions,
) -> Result<ProxyHeartbeatResponse>

capsem_sdk::operations::inject_credential

pub async fn inject_credential(
    transport: &Transport,
    input: &InjectCredentialParams,
    options: CallOptions,
) -> Result<CredentialInjectResponse>

capsem_sdk::operations::list_connections

pub async fn list_connections(
    transport: &Transport,
    input: &ListConnectionsParams,
    options: CallOptions,
) -> Result<ConnectionListResponse>

capsem_sdk::operations::list_images

pub async fn list_images(
    transport: &Transport,
    input: &ListImagesParams,
    options: CallOptions,
) -> Result<ImageListResponse>

capsem_sdk::operations::list_mcp_servers

pub async fn list_mcp_servers(
    transport: &Transport,
    options: CallOptions,
) -> Result<McpServersListResponse>

capsem_sdk::operations::list_mcp_tools

pub async fn list_mcp_tools(
    transport: &Transport,
    input: &ListMcpToolsParams,
    options: CallOptions,
) -> Result<McpToolsListResponse>

capsem_sdk::operations::list_networks

pub async fn list_networks(
    transport: &Transport,
    options: CallOptions,
) -> Result<NetworkListResponse>

capsem_sdk::operations::list_session_credential_grants

pub async fn list_session_credential_grants(
    transport: &Transport,
    input: &ListSessionCredentialGrantsParams,
    options: CallOptions,
) -> Result<SessionGrantListResponse>

capsem_sdk::operations::list_vm_exposures

pub async fn list_vm_exposures(
    transport: &Transport,
    input: &ListVmExposuresParams,
    options: CallOptions,
) -> Result<ExposureListResponse>

capsem_sdk::operations::list_vm_files

pub async fn list_vm_files(
    transport: &Transport,
    input: &ListVmFilesParams,
    options: CallOptions,
) -> Result<FileListResponse>

capsem_sdk::operations::list_vms

pub async fn list_vms(
    transport: &Transport,
    options: CallOptions,
) -> Result<ListResponse>

capsem_sdk::operations::pause_vm

pub async fn pause_vm(
    transport: &Transport,
    input: &PauseVmParams,
    options: CallOptions,
) -> Result<VmActionResponse>

capsem_sdk::operations::persist_vm

pub async fn persist_vm(
    transport: &Transport,
    input: &PersistVmParams,
    options: CallOptions,
) -> Result<PersistResponse>

capsem_sdk::operations::pull_image

pub async fn pull_image(
    transport: &Transport,
    input: &PullImageParams,
    options: CallOptions,
) -> Result<ImagePullResponse>

capsem_sdk::operations::purge_vms

pub async fn purge_vms(
    transport: &Transport,
    input: &PurgeVmsParams,
    options: CallOptions,
) -> Result<PurgeResponse>

capsem_sdk::operations::refresh_mcp_server

pub async fn refresh_mcp_server(
    transport: &Transport,
    input: &RefreshMcpServerParams,
    options: CallOptions,
) -> Result<McpRefreshResponse>

capsem_sdk::operations::restart_hypervisor

pub async fn restart_hypervisor(
    transport: &Transport,
    options: CallOptions,
) -> Result<RestartResponse>

capsem_sdk::operations::resume_vm

pub async fn resume_vm(
    transport: &Transport,
    input: &ResumeVmParams,
    options: CallOptions,
) -> Result<ProvisionResponse>

capsem_sdk::operations::revoke_session_credential_grant

pub async fn revoke_session_credential_grant(
    transport: &Transport,
    input: &RevokeSessionCredentialGrantParams,
    options: CallOptions,
) -> Result<RevokeSessionGrantResponse>

capsem_sdk::operations::revoke_vm_preview_sessions

pub async fn revoke_vm_preview_sessions(
    transport: &Transport,
    input: &RevokeVmPreviewSessionsParams,
    options: CallOptions,
) -> Result<PreviewSessionsRevokedResponse>

capsem_sdk::operations::run_vm

pub async fn run_vm(
    transport: &Transport,
    input: &RunVmParams,
    options: CallOptions,
) -> Result<ExecResponse>

capsem_sdk::operations::start_vm

pub async fn start_vm(
    transport: &Transport,
    input: &StartVmParams,
    options: CallOptions,
) -> Result<ProvisionResponse>

capsem_sdk::operations::stop_proxy

pub async fn stop_proxy(
    transport: &Transport,
    input: &StopProxyParams,
    options: CallOptions,
) -> Result<StopProxyResponse>

capsem_sdk::operations::stop_vm

pub async fn stop_vm(
    transport: &Transport,
    input: &StopVmParams,
    options: CallOptions,
) -> Result<StopResponse>

capsem_sdk::operations::update_hypervisor

pub async fn update_hypervisor(
    transport: &Transport,
    input: &UpdateHypervisorParams,
    options: CallOptions,
) -> Result<UpdateActionResponse>

capsem_sdk::operations::upload_vm_file

pub async fn upload_vm_file(
    transport: &Transport,
    input: &UploadVmFileParams,
    options: CallOptions,
) -> Result<UploadResponse>

capsem_sdk::operations::AttachNetworkMemberParams

pub struct AttachNetworkMemberParams {
    pub id: String,
    pub vm_id: String,
}

capsem_sdk::operations::AuthorizeGoogleConnectionParams

pub struct AuthorizeGoogleConnectionParams {
    pub body: AuthorizeGoogleRequest,
}

capsem_sdk::operations::CallMcpToolParams

pub struct CallMcpToolParams {
    pub server_id: String,
    pub tool_id: String,
    pub body: Value,
}

capsem_sdk::operations::CancelConnectionAuthorizationParams

pub struct CancelConnectionAuthorizationParams {
    pub transaction_id: String,
}

capsem_sdk::operations::ClaimManagedSessionParams

pub struct ClaimManagedSessionParams {
    pub request_id: String,
    pub body: ManagedSessionClaimRequest,
}

capsem_sdk::operations::CloseManagedSessionParams

pub struct CloseManagedSessionParams {
    pub request_id: String,
    pub body: ManagedSessionCloseRequest,
}

capsem_sdk::operations::CreateNetworkParams

pub struct CreateNetworkParams {
    pub body: CreateNetworkRequest,
}

capsem_sdk::operations::CreateProxyParams

pub struct CreateProxyParams {
    pub body: CreateProxyRequest,
}

capsem_sdk::operations::CreateSessionCredentialGrantParams

pub struct CreateSessionCredentialGrantParams {
    pub id: String,
    pub body: CreateSessionGrantRequest,
}

capsem_sdk::operations::CreateVmExposureParams

pub struct CreateVmExposureParams {
    pub id: String,
    pub body: ExposureRequest,
}

capsem_sdk::operations::CreateVmParams

pub struct CreateVmParams {
    pub body: ProvisionRequest,
}

capsem_sdk::operations::CreateVmPreviewSessionParams

pub struct CreateVmPreviewSessionParams {
    pub id: String,
    pub exposure_id: String,
}

capsem_sdk::operations::DeleteNetworkParams

pub struct DeleteNetworkParams {
    pub id: String,
}

capsem_sdk::operations::DeleteVmExposureParams

pub struct DeleteVmExposureParams {
    pub id: String,
    pub exposure_id: String,
}

capsem_sdk::operations::DeleteVmParams

pub struct DeleteVmParams {
    pub id: String,
}

capsem_sdk::operations::DetachNetworkMemberParams

pub struct DetachNetworkMemberParams {
    pub id: String,
    pub vm_id: String,
}

capsem_sdk::operations::DisconnectConnectionParams

pub struct DisconnectConnectionParams {
    pub connection_id: String,
}

capsem_sdk::operations::DownloadVmFileParams

pub struct DownloadVmFileParams {
    pub id: String,
    pub path: String,
    pub exact: Option<bool>,
}

capsem_sdk::operations::ExecVmParams

pub struct ExecVmParams {
    pub id: String,
    pub body: ExecRequest,
}

capsem_sdk::operations::ExportVmBodiesParams

pub struct ExportVmBodiesParams {
    pub id: String,
}

capsem_sdk::operations::ForkVmParams

pub struct ForkVmParams {
    pub id: String,
    pub body: ForkRequest,
}

capsem_sdk::operations::GetConnectionAuthorizationParams

pub struct GetConnectionAuthorizationParams {
    pub transaction_id: String,
}

capsem_sdk::operations::GetConnectionParams

pub struct GetConnectionParams {
    pub connection_id: String,
}

capsem_sdk::operations::GetHypervisorLogsParams

pub struct GetHypervisorLogsParams {
    pub name: HostLogSource,
    pub grep: Option<String>,
    pub tail: Option<u64>,
    pub max_bytes: Option<u64>,
}

capsem_sdk::operations::GetNetworkLogsParams

pub struct GetNetworkLogsParams {
    pub id: String,
    pub cursor: Option<String>,
    pub limit: Option<u64>,
    pub vm: Option<String>,
    pub connection: Option<String>,
    pub type: Option<String>,
    pub decision: Option<String>,
    pub since: Option<i64>,
    pub until: Option<i64>,
}

capsem_sdk::operations::GetNetworkParams

pub struct GetNetworkParams {
    pub id: String,
}

capsem_sdk::operations::GetPanicsParams

pub struct GetPanicsParams {
    pub since: Option<String>,
    pub limit: Option<u64>,
    pub id: Option<String>,
}

capsem_sdk::operations::GetTriageParams

pub struct GetTriageParams {
    pub since: Option<String>,
    pub limit: Option<u64>,
    pub id: Option<String>,
}

capsem_sdk::operations::GetVmContainerParams

pub struct GetVmContainerParams {
    pub id: String,
}

capsem_sdk::operations::GetVmEventBodiesParams

pub struct GetVmEventBodiesParams {
    pub id: String,
    pub event_id: String,
    pub max_bytes: Option<u64>,
}

capsem_sdk::operations::GetVmHistoryParams

pub struct GetVmHistoryParams {
    pub id: String,
    pub limit: Option<u64>,
    pub offset: Option<u64>,
    pub search: Option<String>,
    pub layer: Option<HistoryLayerFilter>,
}

capsem_sdk::operations::GetVmInfoParams

pub struct GetVmInfoParams {
    pub id: String,
}

capsem_sdk::operations::GetVmLogsParams

pub struct GetVmLogsParams {
    pub id: String,
    pub grep: Option<String>,
    pub tail: Option<u64>,
    pub max_bytes: Option<u64>,
}

capsem_sdk::operations::GetVmStatsDetailParams

pub struct GetVmStatsDetailParams {
    pub id: String,
}

capsem_sdk::operations::GetVmStatsSummaryParams

pub struct GetVmStatsSummaryParams {
    pub id: String,
}

capsem_sdk::operations::GetVmStatusParams

pub struct GetVmStatusParams {
    pub id: String,
}

capsem_sdk::operations::GetVmTimelineParams

pub struct GetVmTimelineParams {
    pub id: String,
    pub trace_id: Option<String>,
    pub since: Option<String>,
    pub limit: Option<u64>,
    pub layers: Option<Vec<TimelineLayer>>,
}

capsem_sdk::operations::HeartbeatProxyParams

pub struct HeartbeatProxyParams {
    pub id: String,
    pub body: ProxyLeaseRequest,
}

capsem_sdk::operations::InjectCredentialParams

pub struct InjectCredentialParams {
    pub body: CredentialInjectRequest,
}

capsem_sdk::operations::ListConnectionsParams

pub struct ListConnectionsParams {
    pub limit: Option<u32>,
    pub cursor: Option<String>,
}

capsem_sdk::operations::ListImagesParams

pub struct ListImagesParams {
    pub refresh: Option<bool>,
}

capsem_sdk::operations::ListMcpToolsParams

pub struct ListMcpToolsParams {
    pub server_id: String,
}

capsem_sdk::operations::ListSessionCredentialGrantsParams

pub struct ListSessionCredentialGrantsParams {
    pub id: String,
}

capsem_sdk::operations::ListVmExposuresParams

pub struct ListVmExposuresParams {
    pub id: String,
}

capsem_sdk::operations::ListVmFilesParams

pub struct ListVmFilesParams {
    pub id: String,
    pub path: Option<String>,
    pub depth: Option<i64>,
    pub exact: Option<bool>,
}

capsem_sdk::operations::PauseVmParams

pub struct PauseVmParams {
    pub id: String,
}

capsem_sdk::operations::PersistVmParams

pub struct PersistVmParams {
    pub id: String,
    pub body: PersistRequest,
}

capsem_sdk::operations::PullImageParams

pub struct PullImageParams {
    pub body: ImagePullRequest,
}

capsem_sdk::operations::PurgeVmsParams

pub struct PurgeVmsParams {
    pub body: PurgeRequest,
}

capsem_sdk::operations::RefreshMcpServerParams

pub struct RefreshMcpServerParams {
    pub server_id: String,
}

capsem_sdk::operations::ResumeVmParams

pub struct ResumeVmParams {
    pub id: String,
}

capsem_sdk::operations::RevokeSessionCredentialGrantParams

pub struct RevokeSessionCredentialGrantParams {
    pub id: String,
    pub grant_id: String,
}

capsem_sdk::operations::RevokeVmPreviewSessionsParams

pub struct RevokeVmPreviewSessionsParams {
    pub id: String,
    pub exposure_id: String,
}

capsem_sdk::operations::RunVmParams

pub struct RunVmParams {
    pub body: RunRequest,
}

capsem_sdk::operations::StartVmParams

pub struct StartVmParams {
    pub id: String,
}

capsem_sdk::operations::StopProxyParams

pub struct StopProxyParams {
    pub id: String,
    pub body: ProxyLeaseRequest,
}

capsem_sdk::operations::StopVmParams

pub struct StopVmParams {
    pub id: String,
}

capsem_sdk::operations::UpdateHypervisorParams

pub struct UpdateHypervisorParams {
    pub body: UpdateApplyRequest,
}

capsem_sdk::operations::UploadVmFileParams

pub struct UploadVmFileParams {
    pub id: String,
    pub path: String,
    pub exact: Option<bool>,
    pub body: Vec<u8>,
}

capsem_sdk::resources::Container

pub struct Container<'a>(/* private fields */);

pub async fn status(&self) -> Result<ContainerStatusResponse>

capsem_sdk::resources::Debug

pub struct Debug<'a>(/* private fields */);

pub async fn panics(&self, options: DiagnosticOptions) -> Result<PanicsResponse>

pub async fn triage(&self, options: TriageOptions) -> Result<TriageResponse>

capsem_sdk::resources::Files

pub struct Files<'a>(/* private fields */);

// Paths are the guest’s: /root/x in a VM, /workspace/x in its container, or x relative to the workspace; see Files::exact.

pub const fn exact(self) -> Self

// Take every path literally, relative to the workspace root, even when it is absolute: /root/x is then the workspace’s root/x.

pub async fn read(&self, path: &str) -> Result<Vec<u8>>

pub async fn write(&self, path: &str, data: Vec<u8>) -> Result<UploadResponse>

pub async fn list(
    &self,
    path: &str,
    depth: Option<i64>,
) -> Result<FileListResponse>

// An empty path lists the workspace root.

capsem_sdk::resources::Mcp

pub struct Mcp<'a>(/* private fields */);

// The MCP servers every VM runs: settings.toml [mcp] with corp’s over it.

pub async fn info(&self) -> Result<McpInfoResponse>

pub async fn servers(&self) -> Result<McpServersListResponse>

pub async fn default_permission(&self) -> Result<McpDefaultPermissionResponse>

pub async fn get(&self, name: &str) -> Result<McpServer<'a>>

capsem_sdk::resources::McpServer

pub struct McpServer<'a> {
    pub info: McpServerInfoResponse,
    /* private fields */
}

pub fn tools(&self) -> McpTools<'a>

pub async fn refresh(&self) -> Result<McpRefreshResponse>

capsem_sdk::resources::McpTools

pub struct McpTools<'a> { /* private fields */ }

pub async fn list(&self) -> Result<McpToolsListResponse>

pub async fn call(&self, name: &str, arguments: Value) -> Result<Value>

capsem_sdk::resources::Networks

pub struct Networks<'a>(/* private fields */);

pub async fn create(&self, name: &str) -> Result<NetworkInfo>

pub async fn list(&self) -> Result<Vec<NetworkInfo>>

pub async fn inspect(&self, network_id: &str) -> Result<NetworkInfo>

pub async fn delete(&self, network: &NetworkInfo) -> Result<VmActionResponse>

pub async fn logs(
    &self,
    network: &NetworkInfo,
    options: NetworkLogOptions,
) -> Result<NetworkLogsResponse>

capsem_sdk::resources::Port

pub struct Port {
    pub id: String,
    pub guest: u16,
    pub host: Option<u16>,
    pub authenticate: bool,
    pub url: Option<String>,
    pub bootstrap_token: Option<String>,
    pub expires_in_seconds: Option<u16>,
}

capsem_sdk::resources::PortOptions

pub struct PortOptions {
    pub host: u16,
    pub authenticate: bool,
}

capsem_sdk::resources::Ports

pub struct Ports<'a>(/* private fields */);

pub async fn open(&self, guest: u16) -> Result<Port>

pub async fn open_with(&self, guest: u16, options: PortOptions) -> Result<Port>

pub async fn list(&self) -> Result<Vec<Port>>

pub async fn close(&self, port: &Port) -> Result<VmActionResponse>

capsem_sdk::resources::Stats

pub struct Stats<'a>(/* private fields */);

pub async fn summary(&self) -> Result<VmStatsSummaryResponse>

pub async fn details(&self) -> Result<VmStatsDetailResponse>

capsem_sdk::resources::VmNetworks

pub struct VmNetworks<'a>(/* private fields */);

pub async fn list(&self) -> Result<Vec<NetworkInfo>>

pub async fn attach(&self, network: &NetworkInfo) -> Result<NetworkInfo>

pub async fn detach(&self, network: &NetworkInfo) -> Result<NetworkInfo>

capsem_sdk::CancellationToken

pub struct CancellationToken { /* private fields */ }

// A token which can be used to signal a cancellation request to one or more tasks. Tasks can call CancellationToken::cancelled() in order to obtain a Future which will be resolved when cancellation is requested. Cancellation can be requested through the CancellationToken::cancel method. §Examples use tokio::select; use tokio_util::sync::CancellationToken; #[tokio::main] async fn main() { let token = CancellationToken::new(); let cloned_token = token.clone(); let join_handle = tokio::spawn(async move { // Wait for either cancellation or a very long time select! { _ = cloned_token.cancelled() => { // The token was cancelled 5 } _ = tokio::time::sleep(std::time::Duration::from_secs(9999)) => { 99 } } }); tokio::spawn(async move { tokio::time::sleep(std::time::Duration::from_millis(10)).await; token.cancel(); }); assert_eq!(5, join_handle.await.unwrap()); }

pub fn new() -> CancellationToken

// Creates a new CancellationToken in the non-cancelled state.

pub fn child_token(&self) -> CancellationToken

// Creates a CancellationToken which will get cancelled whenever the current token gets cancelled. Unlike a cloned CancellationToken, cancelling a child token does not cancel the parent token. If the current token is already cancelled, the child token will get returned in cancelled state. §Examples use tokio::select; use tokio_util::sync::CancellationToken; #[tokio::main] async fn main() { let token = CancellationToken::new(); let child_token = token.child_token(); let join_handle = tokio::spawn(async move { // Wait for either cancellation or a very long time select! { _ = child_token.cancelled() => { // The token was cancelled 5 } _ = tokio::time::sleep(std::time::Duration::from_secs(9999)) => { 99 } } }); tokio::spawn(async move { tokio::time::sleep(std::time::Duration::from_millis(10)).await; token.cancel(); }); assert_eq!(5, join_handle.await.unwrap()); }

pub fn cancel(&self)

// Cancel the CancellationToken and all child tokens which had been derived from it. This will wake up all tasks which are waiting for cancellation. Be aware that cancellation is not an atomic operation. It is possible for another thread running in parallel with a call to cancel to first receive true from is_cancelled on one child node, and then receive false from is_cancelled on another child node. However, once the call to cancel returns, all child nodes have been fully cancelled.

pub fn is_cancelled(&self) -> bool

// Returns true if the CancellationToken is cancelled.

pub fn cancelled(&self) -> WaitForCancellationFuture<'_>

// Returns a Future that gets fulfilled when cancellation is requested. Equivalent to: ⓘasync fn cancelled(&self); The future will complete immediately if the token is already cancelled when this method is called. §Cancellation safety This method is cancel safe.

pub fn cancelled_owned(self) -> WaitForCancellationFutureOwned

// Returns a Future that gets fulfilled when cancellation is requested. Equivalent to: ⓘasync fn cancelled_owned(self); The future will complete immediately if the token is already cancelled when this method is called. The function takes self by value and returns a future that owns the token. §Cancellation safety This method is cancel safe.

pub fn drop_guard(self) -> DropGuard

// Creates a [DropGuard] for this token. Returned guard will cancel this token (and all its children) on drop unless disarmed.

pub fn drop_guard_ref(&self) -> DropGuardRef<'_>

// Creates a [DropGuardRef] for this token. Returned guard will cancel this token (and all its children) on drop unless disarmed.

pub async fn run_until_cancelled<F>(
    &self,
    fut: F,
) -> Option<<F as Future>::Output>where
    F: Future,

// Runs a future to completion and returns its result wrapped inside of an Option unless the CancellationToken is cancelled. In that case the function returns None and the future gets dropped. §Fairness Calling this on an already-cancelled token directly returns None. For all subsequent polls, in case of concurrent completion and cancellation, this is biased towards the future completion. §Cancellation safety This method is only cancel safe if fut is cancel safe.

pub async fn run_until_cancelled_owned<F>(
    self,
    fut: F,
) -> Option<<F as Future>::Output>where
    F: Future,

// Runs a future to completion and returns its result wrapped inside of an Option unless the CancellationToken is cancelled. In that case the function returns None and the future gets dropped. The function takes self by value and returns a future that owns the token. §Fairness Calling this on an already-cancelled token directly returns None. For all subsequent polls, in case of concurrent completion and cancellation, this is biased towards the future completion. §Cancellation safety This method is only cancel safe if fut is cancel safe.

capsem_sdk::Connections

pub struct Connections<'a>(/* private fields */);

// User-owned connections; connecting never grants a VM access implicitly.

pub async fn list(&self) -> Result<ConnectionListResponse>

// List redacted connections and configured capabilities. Consent alone does not establish that a native consumer supports credential handoff.

pub async fn list_page(
    &self,
    query: ConnectionListQuery,
) -> Result<ConnectionListResponse>

pub async fn authorize_google(
    &self,
    request: AuthorizeGoogleRequest,
) -> Result<AuthorizeGoogleResponse>

// Begin consent using a host-configured profile. The caller decides how to open the returned URL and when to poll; no browser is launched here. Retain the request ID for an explicit retry of the same request.

pub async fn authorization(&self, id: &str) -> Result<AuthorizationTransaction>

pub async fn cancel_authorization(
    &self,
    id: &str,
) -> Result<AuthorizationTransaction>

pub async fn get(&self, id: &str) -> Result<ConnectionSummary>

pub async fn disconnect(&self, id: &str) -> Result<DisconnectResponse>

// Fence local grants and begin provider retirement. A revoking result requires explicit status polling; it does not confirm completed cleanup.

capsem_sdk::CreateOptions

pub struct CreateOptions {
    pub name: Option<String>,
    pub cpus: Option<u32>,
    pub memory: Option<u64>,
    pub env: Option<HashMap<String, String>>,
    pub networks: Vec<NetworkInfo>,
    pub image: Option<String>,
    pub command: Vec<String>,
    pub registry: Option<Registry>,
}

// Omitted CPU and memory values take the hypervisor’s defaults.

// Guest memory in GiB.

capsem_sdk::CredentialGrants

pub struct CredentialGrants<'a>(/* private fields */);

// Explicit approval for the canonical session resolved by this borrowed VM.

pub async fn list(&self) -> Result<SessionGrantListResponse>

pub async fn create(
    &self,
    request: CreateSessionGrantRequest,
) -> Result<SessionGrantSummary>

// Explicitly approve configured capabilities for this ownership generation. This never reconnects, acquires consent, or retries a mutation implicitly.

pub async fn revoke(&self, grant_id: &str) -> Result<RevokeSessionGrantResponse>

capsem_sdk::Credentials

pub struct Credentials<'a>(/* private fields */);

// Register host credentials and supply their opaque references to workloads.

pub async fn inject(
    &self,
    provider: CredentialInjectProvider,
    value: &str,
    storage: CredentialStorage,
) -> Result<CredentialInjectResponse>

// Memory values last for the service lifetime. Supplied OAuth tokens are not automatically refreshed, and injection never initiates consent.

capsem_sdk::DiagnosticOptions

pub struct DiagnosticOptions {
    pub since: Option<String>,
    pub limit: Option<u64>,
}

capsem_sdk::HistoryOptions

pub struct HistoryOptions {
    pub limit: Option<u64>,
    pub offset: Option<u64>,
    pub search: Option<String>,
    pub layer: Option<HistoryLayerFilter>,
}

capsem_sdk::Images

pub struct Images<'a>(/* private fields */);

// Registry catalog and prefetch through the service’s admission policy.

pub async fn list(&self, refresh: bool) -> Result<ImageListResponse>

// Catalog entries with compatible pins and current local disk observations.

pub async fn pull(
    &self,
    image: &str,
    registry: Option<Registry>,
) -> Result<ImagePullResponse>

// Prefetch an image without creating a VM. Registry access lasts one call.

capsem_sdk::LogOptions

pub struct LogOptions {
    pub grep: Option<String>,
    pub tail: Option<u64>,
    pub max_bytes: Option<u64>,
}

capsem_sdk::NetworkLogOptions

pub struct NetworkLogOptions {
    pub cursor: Option<String>,
    pub limit: Option<u64>,
    pub vm: Option<String>,
    pub connection: Option<String>,
    pub event_type: Option<String>,
    pub decision: Option<String>,
    pub since: Option<i64>,
    pub until: Option<i64>,
}

capsem_sdk::Registry

pub struct Registry {
    pub username: Option<String>,
    pub password: Option<String>,
    pub ca_pem: Option<String>,
}

// Credentials and optional trust material used for one registry pull.

capsem_sdk::RunOptions

pub struct RunOptions {
    pub timeout_secs: Option<u64>,
    pub cpus: Option<u32>,
    pub memory: Option<u64>,
    pub env: Option<HashMap<String, String>>,
}

// Guest memory in GiB.

capsem_sdk::TimelineOptions

pub struct TimelineOptions {
    pub trace_id: Option<String>,
    pub since: Option<String>,
    pub limit: Option<u64>,
    pub layers: Option<Vec<TimelineLayer>>,
}

capsem_sdk::TriageOptions

pub struct TriageOptions {
    pub since: Option<String>,
    pub limit: Option<u64>,
    pub vm_id: Option<String>,
}

capsem_sdk::transport::MediaType

pub enum MediaType {
    Json,
    Binary,
    Gzip,
}

capsem_sdk::transport::StreamEvent

pub enum StreamEvent {
    Output(Vec<u8>),
    ErrorOutput(Vec<u8>),
    Exit {
        code: i32,
        truncated: bool,
    },
}

capsem_sdk::transport::CallOptions

pub struct CallOptions {
    pub timeout: Option<Duration>,
}

// An optional deadline for one request, including reading the response body.

pub fn command_timeout(timeout_secs: Option<u64>) -> Duration

// Exec/run may use the service ceiling plus gateway readiness/teardown.

capsem_sdk::transport::GatewayStream

pub struct GatewayStream { /* private fields */ }

pub async fn send_stdin(&mut self, bytes: &[u8]) -> Result<()>

pub async fn close_stdin(&mut self) -> Result<()>

pub async fn next(&mut self) -> Result<StreamEvent>

capsem_sdk::transport::Request

pub struct Request<'a> {
    pub parameters: &'a [(&'a str, &'a str)],
    pub query: &'a [(&'a str, String)],
    pub body: Option<Vec<u8>>,
    pub content_type: MediaType,
    pub accept: MediaType,
    pub options: CallOptions,
}

capsem_sdk::transport::Response

pub struct Response {
    pub body: Vec<u8>,
    pub content_type: Option<String>,
}

// Exact response bytes and the gateway’s declared media type.

capsem_sdk::transport::Transport

pub struct Transport { /* private fields */ }

// Clones share a connection pool; no local discovery, subprocesses or UDS access. use capsem_sdk::transport::{Transport, Request}; use std::time::Duration; let client = Transport::new("http://127.0.0.1:19222", "token", Duration::from_secs(30))?; let bytes = client.request(reqwest::Method::GET, "/status", Request::default()).await?; let info: capsem_sdk::models::HypervisorInfo = serde_json::from_slice(&bytes)?; assert_eq!(info.service, capsem_sdk::models::ServiceAvailability::Running);

pub async fn open_stream(
    &self,
    id: &str,
    start: StreamControl,
    options: CallOptions,
) -> Result<GatewayStream>

// Authenticate and wait for the start receipt within one request deadline. Established terminals may remain idle; callers cancel by dropping them.

pub fn new(url: &str, token: &str, timeout: Duration) -> Result<Self>

pub fn timeout(&self) -> Duration

// The default deadline for one request, including its response body.

pub async fn request(
    &self,
    method: Method,
    path: &str,
    request: Request<'_>,
) -> Result<Vec<u8>>

pub async fn request_response(
    &self,
    method: Method,
    path: &str,
    request: Request<'_>,
) -> Result<Response>

// Read response metadata without introducing a second HTTP client.

capsem_sdk::Result

pub type Result<T> = Result<T, Error>;

pub enum Result<T> {
    Ok(T),
    Err(Error),
}

// Contains the success value

// Contains the error value

capsem_api::bodies::BodyEncoding

pub enum BodyEncoding {
    Utf8,
    Base64,
}

capsem_api::bodies::ArchivedEventBody

pub struct ArchivedEventBody {
    pub event_id: String,
    pub source_table: String,
    pub direction: String,
    pub content_type: Option<String>,
    pub original_bytes: u64,
    pub stored_bytes: u64,
    pub truncated: bool,
    pub truncated_for_transport: bool,
    pub body_hash: String,
    pub encoding: BodyEncoding,
    pub content: String,
}

capsem_api::bodies::EventBodiesQuery

pub struct EventBodiesQuery {
    pub max_bytes: Option<usize>,
}

// Maximum decoded bytes returned per body. The service clamps this to its protocol limit.

capsem_api::bodies::EventBodiesResponse

pub struct EventBodiesResponse {
    pub event_id: String,
    pub bodies: Vec<ArchivedEventBody>,
}

capsem_api::CONTRACT_VERSION

pub const CONTRACT_VERSION: &str = "3.3.0";

// The gateway HTTP contract’s own version. It does not track the binary version: a patch release must not invalidate a checked-in specification or force every generated SDK to be regenerated, and an SDK built against the contract keeps working across binary releases. Raise it when the contract changes in a way clients must notice.

capsem_api::DEFAULT_EXEC_TIMEOUT_SECS

pub const DEFAULT_EXEC_TIMEOUT_SECS: u64 = MAX_EXEC_TIMEOUT_SECS; // 3_600u64

// Exec timeout applied when a request does not name one. Absent used to mean “wait forever”; it now means the ceiling.

capsem_api::MAX_EXEC_TIMEOUT_SECS

pub const MAX_EXEC_TIMEOUT_SECS: u64 = _; // 3_600u64

// Longest a single exec or run command may wait for its result, in seconds.

capsem_api::MAX_REQUEST_BODY_BYTES

pub const MAX_REQUEST_BODY_BYTES: usize = _; // 10_485_760usize

// Largest request body and workspace file the HTTP API accepts, in bytes. One value for every layer: the gateway refuses larger bodies, the service router’s body limit and its file transfer limit use it too. They were three literals, and the service router’s unset limit fell back to axum’s 2 MiB, refusing uploads the other two allowed.

capsem_api::AssetFileState

pub enum AssetFileState {
    Present,
    Missing,
    Invalid,
}

// On disk with a size the manifest does not record for it.

capsem_api::CaptureStatus

pub enum CaptureStatus {
    Complete,
    Truncated,
    Unknown,
}

// The ledger retained a preview without recording its original length.

capsem_api::CapturedContent

pub enum CapturedContent {
    Json(JsonContent),
    Text(TextContent),
    Raw(RawContent),
}

capsem_api::ConnectionProvider

pub enum ConnectionProvider {
    Google,
}

capsem_api::ConnectionState

pub enum ConnectionState {
    Connected,
    ReauthRequired,
    Disconnecting,
    Disconnected,
    Degraded,
}

capsem_api::ContainerState

pub enum ContainerState {
    Pulling,
    Staging,
    Staged,
    Starting,
    Running,
    Exited,
    Failed,
}

// Where a VM’s container workload is in its life.

// The service is pulling and verifying the image.

// Verified blobs are being written into the VM’s workspace.

// Staged for an attached start; waiting for a container stream.

// The guest launcher has been started and the workload is not yet up.

// The guest reports the workload running.

// The workload ended; exit_code says how.

// Setup or the workload failed; error says why.

capsem_api::ContainerSurfaceKind

pub enum ContainerSurfaceKind {
    Xpra,
}

// How a graphical workload presents itself.

// An Xpra websocket server: one application window, no desktop.

capsem_api::CredentialErrorCode

pub enum CredentialErrorCode {
Show 19 variants    ConfigurationRequired,
    UnsupportedCapability,
    UnknownScopeProfile,
    PolicyDenied,
    ScopeDenied,
    ConnectionUnavailable,
    ReauthRequired,
    StorageUnavailable,
    StorageCommitFailed,
    TransactionExpired,
    TransactionCancelled,
    InvalidCallback,
    ProviderRejected,
    ProviderTimeout,
    OwnerChanged,
    SessionUnavailable,
    GrantUnavailable,
    RequestConflict,
    RevocationPending,
}

capsem_api::CredentialEventType

pub enum CredentialEventType {
Show 16 variants    HttpRequest,
    HttpResponse,
    ModelCall,
    McpToolCall,
    McpToolList,
    McpEvent,
    DnsQuery,
    FileEvent,
    FileImport,
    FileExport,
    ProcessExec,
    ProcessExecComplete,
    ProcessAudit,
    CredentialSubstitution,
    SecurityRule,
    SecurityAsk,
}

// Boundary that observed or injected credential material.

capsem_api::CredentialInjectProvider

pub enum CredentialInjectProvider {
    Anthropic,
    Google,
    Openai,
    Github,
    Mcp,
}

pub fn as_str(self) -> &'static str

capsem_api::CredentialOutcome

pub enum CredentialOutcome {
    Captured,
    Brokered,
    Injected,
    Error,
}

capsem_api::CredentialStorage

pub enum CredentialStorage {
    File,
    Memory,
}

capsem_api::EnrollmentKind

pub enum EnrollmentKind {
    OwnedOauthClient,
    NativeConsumerSignIn,
}

capsem_api::ExecOutputEncoding

pub enum ExecOutputEncoding {
    Utf8,
    Base64,
}

capsem_api::ExecSource

pub enum ExecSource {
    Api,
    Cli,
    Mcp,
    Frontend,
}

capsem_api::ExecTarget

pub enum ExecTarget {
    Workload,
    Vm,
}

// Where an exec runs.

// The session’s OCI workload, as the image’s own user, under the workload’s namespaces, seccomp filter, capabilities and cgroup.

// The VM, as VM root: Capsem’s diagnostics and the image runtime.

capsem_api::ExposureAccess

pub enum ExposureAccess {
    LoopbackTcp,
    HttpPreview,
}

// How host clients may reach an exposure.

// An ordinary host-loopback TCP listener.

// Browser HTTP carried only after a scoped preview-session admission.

capsem_api::ExposureTarget

pub enum ExposureTarget {
    Container,
    Vm,
}

// The guest network namespace an exposure reaches. There is no fallback between them.

// Loopback inside the VM’s running container workload.

// The VM’s own loopback. Capsem’s guest service ports are refused.

capsem_api::FileEntryType

pub enum FileEntryType {
    File,
    Directory,
}

capsem_api::FileEventAction

pub enum FileEventAction {
    Created,
    Modified,
    Deleted,
    Restored,
    Read,
    Imported,
    Exported,
}

capsem_api::GrantState

pub enum GrantState {
    Active,
    Revoked,
    Expired,
}

capsem_api::HistoryDetails

pub enum HistoryDetails {
    Exec(ExecHistoryDetails),
    Audit(AuditHistoryDetails),
}

capsem_api::HistoryLayer

pub enum HistoryLayer {
    Exec,
    Audit,
}

capsem_api::HistoryLayerFilter

pub enum HistoryLayerFilter {
    All,
    Exec,
    Audit,
}

pub fn includes(self, layer: HistoryLayer) -> bool

capsem_api::HostLogSource

pub enum HostLogSource {
    Service,
    Mcp,
    Gateway,
    Tray,
    App,
}

// Symbolic host log streams. Paths supplied by clients are never accepted.

capsem_api::ImageCacheState

pub enum ImageCacheState {
    Unknown,
    Missing,
    Partial,
    Ready,
}

// The service cache owner’s current observation of the selected image’s local bytes. This does not grant execution or describe registry freshness.

// The owner has no current proof, including startup or invalidation.

// No complete retained image receipt is present.

// Retained image metadata or bytes are incomplete or known invalid.

// The owner verified all required local bytes for the retained image.

capsem_api::InteractionBlockKind

pub enum InteractionBlockKind {
    Text,
    Reasoning,
}

capsem_api::InteractionContent

pub enum InteractionContent {
    Request(InteractionRequest),
    Message(InteractionMessage),
    ToolCall(InteractionToolCall),
    ToolResult(InteractionToolResult),
}

capsem_api::InteractionMessageKind

pub enum InteractionMessageKind {
    Message,
}

capsem_api::InteractionRequestKind

pub enum InteractionRequestKind {
    RequestPreview,
}

capsem_api::InteractionRole

pub enum InteractionRole {
    Assistant,
}

capsem_api::InteractionToolCallKind

pub enum InteractionToolCallKind {
    ToolCall,
}

capsem_api::InteractionToolResultKind

pub enum InteractionToolResultKind {
    ToolResult,
}

capsem_api::JsonContentKind

pub enum JsonContentKind {
    Json,
}

capsem_api::LocalCredentialAuthority

pub enum LocalCredentialAuthority {
    Revoking,
    Revoked,
}

capsem_api::ManagedSessionClosedState

pub enum ManagedSessionClosedState {
    Closed,
}

capsem_api::ManagedSessionErrorCode

pub enum ManagedSessionErrorCode {
    InvalidRequest,
    Forbidden,
    NotFound,
    DuplicateRequest,
    Expired,
    CreationFailed,
    CleanupFailed,
    RecoveryPending,
    StoreUnavailable,
}

capsem_api::ManagedSessionOutcome

pub enum ManagedSessionOutcome {
    Completed,
    Failed,
    Cancelled,
}

capsem_api::ManagedSessionState

pub enum ManagedSessionState {
    Pending,
    Active,
    Closing,
    Closed,
    Failed,
}

capsem_api::MaterialClass

pub enum MaterialClass {
    Credential,
}

capsem_api::McpPermissionAction

pub enum McpPermissionAction {
    Allow,
    Ask,
    Block,
    Preprocess,
    Rewrite,
    Postprocess,
}

capsem_api::NetworkDecision

pub enum NetworkDecision {
    Allowed,
    Denied,
    Error,
    Redirected,
}

capsem_api::NetworkMemberState

pub enum NetworkMemberState {
    Declared,
    Attaching,
    Ready,
    Failed,
}

capsem_api::NetworkProtocol

pub enum NetworkProtocol {
    Tcp,
    Udp,
}

capsem_api::PreviewAdmissionKind

pub enum PreviewAdmissionKind {
    Request,
    WebsocketUpgrade,
}

capsem_api::ProviderRevocationState

pub enum ProviderRevocationState {
    NotStarted,
    Pending,
    Succeeded,
    Failed,
}

capsem_api::RawContentKind

pub enum RawContentKind {
    Raw,
}

capsem_api::RawContentReason

pub enum RawContentReason {
    Truncated,
    InvalidJson,
    Unparsed,
}

capsem_api::RestartAuthentication

pub enum RestartAuthentication {
    NewTokenRequired,
}

capsem_api::RestartStatus

pub enum RestartStatus {
    Accepted,
}

capsem_api::RevokedCredentialAuthority

pub enum RevokedCredentialAuthority {
    Revoked,
}

capsem_api::ServiceAvailability

pub enum ServiceAvailability {
    Running,
    Unavailable,
}

capsem_api::ServiceManager

pub enum ServiceManager {
    Launchd,
    Systemd,
}

capsem_api::TextContentKind

pub enum TextContentKind {
    Text,
}

capsem_api::TimelineLayer

pub enum TimelineLayer {
    Exec,
    Tool,
    Net,
    Fs,
    Model,
}

capsem_api::TimelineReference

pub enum TimelineReference {
    Id(i64),
    EventId(String),
}

capsem_api::TimelineStatus

pub enum TimelineStatus {
    Code(i32),
    Decision(ToolDecision),
}

capsem_api::ToolDecision

pub enum ToolDecision {
    Allowed,
    Denied,
    Warned,
    Error,
}

capsem_api::ToolOrigin

pub enum ToolOrigin {
    Model,
    Native,
    Mcp,
    Builtin,
    Local,
    McpProxy,
}

capsem_api::TransactionState

pub enum TransactionState {
    Pending,
    Connected,
    Denied,
    Expired,
    Cancelled,
    Failed,
}

capsem_api::UpdateActionStatus

pub enum UpdateActionStatus {
    Planned,
    Succeeded,
    Failed,
}

capsem_api::UpdateCompatibilityState

pub enum UpdateCompatibilityState {
    Compatible,
    Unknown,
    NotApplicable,
}

capsem_api::UpdateTrackState

pub enum UpdateTrackState {
    Current,
    UpdateAvailable,
    Unknown,
    NotPublished,
}

capsem_api::ValidationStatus

pub enum ValidationStatus {
    Valid,
    Invalid,
    Missing,
    FetchError,
}

capsem_api::VmAction

pub enum VmAction {
    Pause,
    Stop,
    Start,
    Resume,
    Fork,
    Delete,
}

capsem_api::VmLifecycleState

pub enum VmLifecycleState {
    Running,
    Stopped,
    Suspended,
    Defunct,
    Incompatible,
}

pub fn available_actions(self, can_resume: bool) -> Vec<VmAction>

capsem_api::exec_target

pub fn exec_target(
    requested: Option<ExecTarget>,
    runs_workload: bool,
) -> Result<ExecTarget, String>

// Resolve a request’s exec target for a session that does or does not run a container workload. A workload is refused where there is none, never quietly replaced by the VM.

capsem_api::exec_timeout_secs

pub fn exec_timeout_secs(requested: Option<u64>) -> Result<u64, String>

// Resolve a request’s exec timeout, refusing zero and values above the ceiling.

capsem_api::openapi

pub fn openapi() -> OpenApi

// Build the same contract served by the gateway and exported for SDK generation.

capsem_api::validate_managed_request_id

pub fn validate_managed_request_id(value: &str) -> Result<(), &'static str>

// The managed wire identity rule, shared by deserializers and SDK generation checks.

capsem_api::validate_name

pub fn validate_name(kind: &str, value: &str) -> Result<(), String>

// Validate a VM name or identifier (1..=64 ASCII [A-Za-z0-9_-] characters, starting with an ASCII letter or digit) so service paths and gateway routes enforce one rule.

capsem_api::stream::MAX_STREAM_FRAME_BYTES

pub const MAX_STREAM_FRAME_BYTES: usize = _; // 262_144usize

// Largest frame either side accepts, channel byte included.

capsem_api::stream::STREAM_SUBPROTOCOL

pub const STREAM_SUBPROTOCOL: &str = "capsem.stream.v1";

// WebSocket subprotocol a client must request.

capsem_api::stream::ClientFrame

pub enum ClientFrame<'a> {
    Stdin(&'a [u8]),
    Control(StreamControl),
}

capsem_api::stream::ServerFrame

pub enum ServerFrame<'a> {
    Stdout(&'a [u8]),
    Stderr(&'a [u8]),
    Status(StreamStatus),
}

capsem_api::stream::StreamChannel

#[repr(u8)]pub enum StreamChannel {
    Stdin = 0,
    Stdout = 1,
    Stderr = 2,
    Control = 3,
    Status = 4,
}

// Client to server: bytes for the stream’s stdin or terminal.

// Server to client: standard output.

// Server to client: standard error.

// Client to server: StreamControl.

// Server to client: StreamStatus.

capsem_api::stream::StreamControl

pub enum StreamControl {
    Start {
        kind: StreamKind,
        command: Option<String>,
    },
    Resize {
        cols: u16,
        rows: u16,
    },
    CloseStdin,
}

// First control message of every stream. command is required for exec and refused for the others.

// Terminal window size; both dimensions must be non-zero.

// No more stdin will follow.

capsem_api::stream::StreamFrameError

pub enum StreamFrameError {
    Empty,
    TooLarge(usize),
    UnknownChannel(u8),
    WrongDirection(u8),
    Control(String),
}

// A channel the receiving side never accepts.

// A control or status payload that is not valid for the protocol.

capsem_api::stream::StreamKind

pub enum StreamKind {
    Terminal,
    Exec,
    Container,
}

// What a stream attaches to.

// The VM’s interactive terminal, with its replayed recent output.

// One command, streaming its output until it exits.

// The VM’s container workload, attached until it exits.

capsem_api::stream::StreamStatus

pub enum StreamStatus {
    Started,
    Exit {
        code: i32,
        truncated: bool,
    },
    Error {
        message: String,
    },
}

// The stream is attached; data may follow.

// The command or workload ended. truncated means output was dropped.

// The stream ended without an exit status.

capsem_api::stream::decode_client_frame

pub fn decode_client_frame(
    frame: &[u8],
) -> Result<ClientFrame<'_>, StreamFrameError>

capsem_api::stream::decode_server_frame

pub fn decode_server_frame(
    frame: &[u8],
) -> Result<ServerFrame<'_>, StreamFrameError>

capsem_api::stream::encode_control

pub fn encode_control(control: &StreamControl) -> Vec<u8>

capsem_api::stream::encode_data

pub fn encode_data(channel: StreamChannel, data: &[u8]) -> Vec<u8>

// A data frame on channel.

capsem_api::stream::encode_status

pub fn encode_status(status: &StreamStatus) -> Vec<u8>

capsem_api::stream::golden_frames

pub fn golden_frames() -> Value

// The frames every other implementation of this protocol is held to, exported as sdk/specification/stream-v1.json. Client frames are what this module encodes; each server frame’s expectation is this module’s own decoding of it, refusals included, so the fixture cannot disagree with Rust.

capsem_api::AssetFileStatus

pub struct AssetFileStatus {
    pub kind: String,
    pub name: String,
    pub path: String,
    pub status: AssetFileState,
    pub expected_hash: String,
    pub expected_size: Option<u64>,
    pub actual_size: Option<u64>,
}

// kernel, initrd or rootfs.

// Logical asset name in the manifest, e.g. vmlinuz.

capsem_api::AssetManifestStatus

pub struct AssetManifestStatus {Show 13 fields
    pub origin: String,
    pub path: String,
    pub validation_status: ValidationStatus,
    pub blake3: Option<String>,
    pub refreshed_at: Option<String>,
    pub validation_error: Option<String>,
    pub origin_path: Option<String>,
    pub origin_source: Option<String>,
    pub packaged_at: Option<String>,
    pub format: Option<u32>,
    pub refresh_policy: Option<String>,
    pub assets_current: Option<String>,
    pub binaries_current: Option<String>,
}

// Provenance label recorded by the installer or channel metadata.

capsem_api::AssetStatus

pub struct AssetStatus {Show 13 fields
    pub ready: bool,
    pub downloading: bool,
    pub current_arch: String,
    pub asset_version: Option<String>,
    pub assets: Vec<AssetFileStatus>,
    pub errors: Vec<String>,
    pub manifest: AssetManifestStatus,
    pub current_asset: Option<String>,
    pub bytes_done: Option<u64>,
    pub bytes_total: Option<u64>,
    pub downloaded: Option<usize>,
    pub reconcile_error: Option<String>,
    pub started: Option<bool>,
}

// Whether the one runtime asset set every new VM boots – kernel, initrd and rootfs of the installed manifest’s current release – is on disk.

// An asset reconciliation (startup or /assets/ensure) is running.

// Assets the last finished reconciliation downloaded.

// Set by /assets/ensure: whether this call started a reconciliation.

capsem_api::AuditEvent

pub struct AuditEvent {Show 17 fields
    pub event_id: String,
    pub timestamp: String,
    pub pid: u32,
    pub ppid: u32,
    pub uid: u32,
    pub exe: String,
    pub comm: Option<String>,
    pub argv: String,
    pub cwd: Option<String>,
    pub exit_code: Option<i32>,
    pub session_id: Option<u32>,
    pub tty: Option<String>,
    pub audit_id: Option<String>,
    pub exec_event_id: Option<i64>,
    pub parent_exe: Option<String>,
    pub trace_id: Option<String>,
    pub credential_ref: Option<String>,
}

capsem_api::AuditHistoryDetails

pub struct AuditHistoryDetails {
    pub pid: u32,
    pub ppid: u32,
    pub uid: u32,
    pub exe: String,
    pub comm: Option<String>,
    pub cwd: Option<String>,
    pub tty: Option<String>,
    pub session_id: Option<u32>,
    pub audit_id: Option<String>,
    pub parent_exe: Option<String>,
}

capsem_api::AuthorizationTransaction

pub struct AuthorizationTransaction {
    pub id: String,
    pub state: TransactionState,
    pub expires_at: String,
    pub connection_id: Option<String>,
    pub error_code: Option<CredentialErrorCode>,
}

capsem_api::AuthorizeGoogleRequest

pub struct AuthorizeGoogleRequest {
    pub request_id: String,
    pub scope_profile_id: String,
    pub reconnect_connection_id: Option<String>,
}

capsem_api::AuthorizeGoogleResponse

pub struct AuthorizeGoogleResponse {
    pub transaction: AuthorizationTransaction,
    pub authorization_url: Option<String>,
}

capsem_api::CapabilitySummary

pub struct CapabilitySummary {
    pub id: String,
    pub label: String,
    pub consumer: String,
    pub required_scopes: Vec<String>,
    pub supported: bool,
}

capsem_api::CapturedPayload

pub struct CapturedPayload {
    pub status: CaptureStatus,
    pub content: CapturedContent,
}

capsem_api::CatalogInfo

pub struct CatalogInfo {
    pub reference: String,
    pub digest: String,
    pub channel: String,
    pub generated_at: Option<String>,
}

// One catalog version, identified by its manifest digest.

// The reference the catalog was read from, usually a moving channel tag.

// The catalog version’s manifest digest.

// stable or nightly.

// When the publishing workflow wrote this version, as it recorded it.

capsem_api::ConnectionListQuery

pub struct ConnectionListQuery {
    pub limit: Option<u32>,
    pub cursor: Option<String>,
}

// Bounded connection inventory. Profiles are returned on every page.

// Page size, at most the host’s configured connection capacity. Omission uses that capacity; zero and larger values are refused.

// Continue after this canonical server-issued connection UUID. Keyset ordering permits the previous page’s last connection to be removed.

capsem_api::ConnectionListResponse

pub struct ConnectionListResponse {
    pub connections: Vec<ConnectionSummary>,
    pub scope_profiles: Vec<ScopeProfileSummary>,
    pub next_cursor: Option<String>,
}

capsem_api::ConnectionSummary

pub struct ConnectionSummary {Show 13 fields
    pub id: String,
    pub provider: ConnectionProvider,
    pub scope_profile_id: String,
    pub account_label: Option<String>,
    pub state: ConnectionState,
    pub revision: u64,
    pub granted_scopes: Vec<String>,
    pub available_capabilities: Vec<String>,
    pub created_at: String,
    pub updated_at: String,
    pub last_refresh_at: Option<String>,
    pub provider_revocation: ProviderRevocationState,
    pub error_code: Option<CredentialErrorCode>,
}

capsem_api::ContainerSpec

pub struct ContainerSpec {
    pub image: String,
    pub args: Vec<String>,
    pub env: BTreeMap<String, String>,
    pub registry: Option<RegistryAccess>,
    pub attach: bool,
}

// An OCI image run as a VM’s workload. Debug shows the image and environment names only: arguments and environment values can carry secrets, and registry access always does.

// A catalog name (codex-cli), docker://IMAGE, or a registry-qualified registry/repository:tag. A catalog name is looked up first, so a name that is also a Docker Hub short name never reaches Docker Hub.

// Command replacing the image’s default command, as docker run IMAGE CMD....

// Container environment, applied over the image’s.

// Access to a private registry, used for this pull only and never stored.

// Stage the image and wait for a container stream to start the workload attached, instead of starting it detached.

capsem_api::ContainerStatusResponse

pub struct ContainerStatusResponse {
    pub state: ContainerState,
    pub image: String,
    pub digest: Option<String>,
    pub resolved: Option<String>,
    pub exit_code: Option<i32>,
    pub error: Option<String>,
    pub surface: Option<ContainerSurface>,
}

// A VM’s container workload status.

// The image reference as requested.

// Content digest of the verified image, once pulled.

// What the request resolved to, as repository@digest, once admitted: a catalog name or tag pinned, so the session never follows a moved tag.

// Workload exit status reported by the guest, when state is exited.

// Why setup or the workload failed, when state is failed.

// The graphical surface the image declares, when it declares one.

capsem_api::ContainerSurface

pub struct ContainerSurface {
    pub kind: ContainerSurfaceKind,
    pub port: u16,
    pub exposure_id: Option<String>,
}

// A graphical surface an image declares (org.capsem.surface), and the browser-preview exposure the service granted for it.

// Container loopback port the surface listens on (org.capsem.surface.port).

// The http_preview exposure that reaches it, once the workload runs and the VM’s policy admitted it.

capsem_api::CreateNetworkRequest

pub struct CreateNetworkRequest {
    pub name: String,
}

capsem_api::CreateProxyRequest

pub struct CreateProxyRequest {
    pub provider: String,
    pub bind: String,
    pub port: u16,
}

// Start one VM-free, OpenAI-compatible model proxy lease.

// Provider key from the effective built-in/settings/corp policy.

// Local address on which the unauthenticated data listener binds.

// Requested data-listener port. Zero asks the OS to select one.

capsem_api::CreateProxyResponse

pub struct CreateProxyResponse {
    pub session_id: String,
    pub provider: String,
    pub bind: String,
    pub port: u16,
    pub base_url: String,
    pub lease_token: String,
    pub lease_expires_unix_ms: u64,
}

// SDK-compatible URL, including the configured provider path prefix.

// Opaque proof required to renew or stop this lease.

capsem_api::CreateSessionGrantRequest

pub struct CreateSessionGrantRequest {
    pub request_id: String,
    pub expected_owner_generation: String,
    pub connection_id: String,
    pub capability_ids: Vec<String>,
    pub expires_at: Option<String>,
}

capsem_api::CredentialEvent

pub struct CredentialEvent {
    pub event_id: String,
    pub timestamp: String,
    pub material_class: MaterialClass,
    pub source: String,
    pub event_type: Option<CredentialEventType>,
    pub origin: Option<CredentialEventType>,
    pub verb: CredentialOutcome,
    pub provider: Option<String>,
    pub trace_id: Option<String>,
    pub context_json: Option<String>,
}

capsem_api::CredentialInjectRequest

pub struct CredentialInjectRequest {
    pub provider: CredentialInjectProvider,
    pub value: String,
    pub storage: CredentialStorage,
}

capsem_api::CredentialInjectResponse

pub struct CredentialInjectResponse {
    pub credential_ref: String,
    pub storage: CredentialStorage,
}

capsem_api::DisconnectResponse

pub struct DisconnectResponse {
    pub connection: ConnectionSummary,
    pub revoked_grant_count: u32,
    pub local_authority: LocalCredentialAuthority,
}

capsem_api::DnsEvent

pub struct DnsEvent {Show 14 fields
    pub event_id: String,
    pub timestamp: String,
    pub qname: String,
    pub qtype: u16,
    pub qclass: u16,
    pub rcode: u16,
    pub decision: NetworkDecision,
    pub matched_rule: Option<String>,
    pub policy_rule: Option<String>,
    pub source_proto: Option<NetworkProtocol>,
    pub process_name: Option<String>,
    pub upstream_resolver_ms: Option<u64>,
    pub trace_id: Option<String>,
    pub credential_ref: Option<String>,
}

capsem_api::ErrorEvent

pub struct ErrorEvent {
    pub ts: String,
    pub binary: String,
    pub level: String,
    pub target: Option<String>,
    pub message: String,
}

capsem_api::ErrorResponse

pub struct ErrorResponse {
    pub error: String,
    pub code: Option<String>,
}

capsem_api::EventBody

pub struct EventBody {
    pub event_id: String,
    pub source_table: String,
    pub direction: String,
    pub content_type: Option<String>,
    pub original_bytes: u64,
    pub stored_bytes: u64,
    pub truncated: bool,
    pub body_hash: String,
}

capsem_api::ExecHistoryDetails

pub struct ExecHistoryDetails {
    pub source: ExecSource,
    pub trace_id: Option<String>,
    pub process_name: Option<String>,
    pub exec_id: u64,
}

capsem_api::ExecOutput

pub struct ExecOutput {
    pub encoding: ExecOutputEncoding,
    pub data: String,
}

pub fn from_bytes(bytes: Vec<u8>) -> Self

pub fn decode(&self) -> Result<Vec<u8>, DecodeError>

capsem_api::ExecRequest

pub struct ExecRequest {
    pub command: String,
    pub timeout_secs: Option<u64>,
    pub target: Option<ExecTarget>,
}

// Where the command runs. Absent means the session’s workload when it runs an image, otherwise the VM.

capsem_api::ExecResponse

pub struct ExecResponse {
    pub stdout: ExecOutput,
    pub stderr: ExecOutput,
    pub exit_code: i32,
    pub truncated: bool,
}

// The guest produced more output than the per-exec cap allows, so stdout is a prefix. Defaulted so an older client still decodes.

pub fn truncation_notice(&self) -> Option<&'static str>

capsem_api::ExposureInfo

pub struct ExposureInfo {
    pub id: String,
    pub host_port: Option<u16>,
    pub guest_port: u16,
    pub target: ExposureTarget,
    pub access: ExposureAccess,
}

// One live exposure as the VM owner declares it.

// Stable identity used to revoke it: the host port, as a string.

// Loopback host port that forwards to the guest. Present only for an ordinary loopback TCP listener. Browser previews use the gateway’s dedicated preview origin and expose no bypass port.

pub fn loopback(host_port: u16, guest_port: u16, target: ExposureTarget) -> Self

pub fn preview(id: String, guest_port: u16, target: ExposureTarget) -> Self

capsem_api::ExposureListResponse

pub struct ExposureListResponse {
    pub owner_generation: String,
    pub exposures: Vec<ExposureInfo>,
}

// A VM’s live exposures.

// Identity of the VM owner process that holds the listeners. It changes when the owner restarts and restores them; a string so JavaScript clients keep every bit.

capsem_api::ExposureRequest

pub struct ExposureRequest {
    pub guest_port: u16,
    pub host_port: u16,
    pub target: ExposureTarget,
    pub access: ExposureAccess,
}

// Expose a guest port on a host loopback port.

// Loopback host port to listen on; 0 or absent picks a free one.

capsem_api::FileActionCount

pub struct FileActionCount {
    pub action: FileEventAction,
    pub count: u64,
}

capsem_api::FileEvent

pub struct FileEvent {
    pub event_id: String,
    pub timestamp: String,
    pub action: FileEventAction,
    pub path: String,
    pub size: Option<u64>,
    pub trace_id: Option<String>,
    pub credential_ref: Option<String>,
}

capsem_api::FileListEntry

pub struct FileListEntry {
    pub name: String,
    pub path: String,
    pub entry_type: FileEntryType,
    pub size: u64,
    pub mtime: u64,
    pub mime: Option<String>,
    pub label: Option<String>,
    pub is_text: Option<bool>,
    pub children: Option<Vec<FileListEntry>>,
}

// A single entry in a workspace file listing.

capsem_api::FileListResponse

pub struct FileListResponse {
    pub entries: Vec<FileListEntry>,
}

// Response for GET /vms/{id}/files/list.

capsem_api::ForkRequest

pub struct ForkRequest {
    pub name: String,
    pub description: Option<String>,
}

capsem_api::ForkResponse

pub struct ForkResponse {
    pub id: String,
    pub name: String,
    pub size_bytes: u64,
}

capsem_api::HistoryEntry

pub struct HistoryEntry {
    pub timestamp: String,
    pub layer: HistoryLayer,
    pub command: String,
    pub exit_code: Option<i32>,
    pub duration_ms: Option<u64>,
    pub stdout_preview: Option<String>,
    pub stderr_preview: Option<String>,
    pub details: HistoryDetails,
}

capsem_api::HistoryQuery

pub struct HistoryQuery {
    pub limit: usize,
    pub offset: usize,
    pub search: Option<String>,
    pub layer: HistoryLayerFilter,
}

// Maximum commands to return. Defaults to 500, capped at 2000.

// Literal, case-sensitive search over commands, previews and details.

capsem_api::HistoryResponse

pub struct HistoryResponse {
    pub commands: Vec<HistoryEntry>,
    pub total: u64,
    pub has_more: bool,
}

capsem_api::HostLogsResponse

pub struct HostLogsResponse {
    pub source: HostLogSource,
    pub text: String,
}

capsem_api::HostTriageResponse

pub struct HostTriageResponse {
    pub panics: Vec<PanicEvent>,
    pub errors: Vec<ErrorEvent>,
    pub slow_ops: Vec<SlowOpEvent>,
}

capsem_api::HttpEvent

pub struct HttpEvent {Show 18 fields
    pub event_id: String,
    pub timestamp: String,
    pub domain: String,
    pub port: Option<u16>,
    pub method: Option<String>,
    pub path: Option<String>,
    pub query: Option<String>,
    pub status_code: Option<u16>,
    pub decision: NetworkDecision,
    pub duration_ms: Option<u64>,
    pub bytes_sent: Option<u64>,
    pub bytes_received: Option<u64>,
    pub matched_rule: Option<String>,
    pub policy_rule: Option<String>,
    pub trace_id: Option<String>,
    pub credential_ref: Option<String>,
    pub request_headers: Option<String>,
    pub response_headers: Option<String>,
}

capsem_api::HypervisorInfo

pub struct HypervisorInfo {
    pub service: ServiceAvailability,
    pub gateway_version: String,
    pub vm_count: usize,
    pub vms: Vec<VmSummary>,
    pub resource_summary: Option<ResourceSummary>,
    pub assets: Option<AssetStatus>,
    pub updates: Option<UpdateStatusResponse>,
}

capsem_api::ImageInfo

pub struct ImageInfo {
    pub name: String,
    pub description: String,
    pub architectures: Vec<String>,
    pub image: Option<String>,
    pub cached: ImageCacheState,
}

// One catalog entry.

// The catalog name, as capsem create --image and POST /images/pull take it.

// Every architecture some version is built for (arm64, amd64).

// The newest version this host can run, as repository@digest; absent when no version is built for this host’s architecture and runtime.

capsem_api::ImageListQuery

pub struct ImageListQuery {
    pub refresh: bool,
}

// GET /images query.

// Read the catalog from its registry now instead of from the copy the service keeps for up to 30 minutes.

capsem_api::ImageListResponse

pub struct ImageListResponse {
    pub catalog: Option<CatalogInfo>,
    pub images: Vec<ImageInfo>,
}

// GET /images: the catalog entries the current image policy permits.

// The catalog version listed; absent when the policy turns the catalog off or no catalog could ever be read, and then images is empty.

// Entries in name order.

capsem_api::ImagePullRequest

pub struct ImagePullRequest {
    pub image: String,
    pub registry: Option<RegistryAccess>,
}

// POST /images/pull: fetch an image into the host cache ahead of a create. Debug redacts registry access the way RegistryAccess does.

// A catalog name, docker://IMAGE, or a registry-qualified registry/repository:tag or @sha256: reference.

// Access to a private registry, used for this pull only and never stored.

capsem_api::ImagePullResponse

pub struct ImagePullResponse {
    pub image: String,
    pub resolved: String,
    pub digest: String,
}

// A pulled and admitted image.

// The image as requested.

// What the request resolved to, as repository@digest: the pin a session records, never a tag.

// The platform manifest pulled for this host.

capsem_api::Interaction

pub struct Interaction {
    pub event_id: String,
    pub timestamp: String,
    pub model_call_id: Option<i64>,
    pub model_event_id: Option<String>,
    pub trace_id: Option<String>,
    pub turn_id: Option<String>,
    pub item_index: Option<u64>,
    pub content: InteractionContent,
}

// One retained item. IDs refer to the session ledger, never a list position.

// Null when there is no parent or its row is no longer retained.

capsem_api::InteractionBlock

pub struct InteractionBlock {
    pub kind: InteractionBlockKind,
    pub payload: Option<CapturedPayload>,
}

capsem_api::InteractionBody

pub struct InteractionBody {
    pub event_id: String,
    pub source_table: String,
    pub direction: String,
    pub content_type: Option<String>,
    pub original_bytes: u64,
    pub stored_bytes: u64,
    pub truncated: bool,
    pub body_hash: String,
}

capsem_api::InteractionMessage

pub struct InteractionMessage {
    pub kind: InteractionMessageKind,
    pub role: InteractionRole,
    pub blocks: Vec<InteractionBlock>,
}

capsem_api::InteractionReport

pub struct InteractionReport {
    pub items: Vec<Interaction>,
    pub bodies: Vec<InteractionBody>,
}

// Latest 200 model items and latest 200 tool calls, in chronological order. This bounded report is not a complete conversation or a pagination API.

capsem_api::InteractionRequest

pub struct InteractionRequest {
    pub kind: InteractionRequestKind,
    pub payload: Option<CapturedPayload>,
}

// A retained request preview, not an inferred user message.

capsem_api::InteractionToolCall

pub struct InteractionToolCall {
    pub kind: InteractionToolCallKind,
    pub call_id: String,
    pub tool_name: String,
    pub server_name: Option<String>,
    pub origin: ToolOrigin,
    pub decision: ToolDecision,
    pub arguments: Option<CapturedPayload>,
    pub request: Option<CapturedPayload>,
    pub result: Option<InteractionToolResult>,
}

// Provider/server scoped: use the enclosing trace and model IDs to correlate.

// Captured JSON-RPC request when the ledger stored an MCP envelope.

// Only the result stored on this call; unrelated call IDs are never joined.

capsem_api::InteractionToolResult

pub struct InteractionToolResult {
    pub kind: InteractionToolResultKind,
    pub call_id: String,
    pub payload: Option<CapturedPayload>,
    pub response: Option<CapturedPayload>,
    pub is_error: Option<bool>,
    pub error_message: Option<String>,
}

// Captured JSON-RPC response when payload is its extracted result.

// Null when the source ledger did not record a result error flag.

capsem_api::JsonContent

pub struct JsonContent {
    pub kind: JsonContentKind,
    pub value: Value,
}

// Arbitrary tool/provider JSON, including arrays, scalars and JSON null.

capsem_api::ListResponse

pub struct ListResponse {
    pub sandboxes: Vec<SandboxInfo>,
}

capsem_api::LogQuery

pub struct LogQuery {
    pub grep: Option<String>,
    pub tail: Option<usize>,
    pub max_bytes: Option<u64>,
}

// Keep lines containing this literal substring, before applying tail.

// Return the last matching lines. Zero returns no lines.

// Read at most this many bytes per stream, capped at 5 MiB. Defaults to 100 KiB for host logs and 5 MiB for VM logs.

capsem_api::LogsResponse

pub struct LogsResponse {
    pub logs: String,
    pub serial_logs: Option<String>,
    pub process_logs: Option<String>,
}

capsem_api::ManagedOwnershipToken

pub struct ManagedOwnershipToken(/* private fields */);

// Lowercase hex encodes the client’s 256-bit capability without URL transport.

pub fn new(value: String) -> Result<Self, &'static str>

pub fn as_str(&self) -> &str

capsem_api::ManagedSessionClaimRequest

pub struct ManagedSessionClaimRequest {
    pub ownership_token: ManagedOwnershipToken,
}

capsem_api::ManagedSessionClaimResponse

pub struct ManagedSessionClaimResponse {
    pub ownership: ManagedSessionOwnership,
    pub state: ManagedSessionState,
    pub session: Option<ProvisionResponse>,
    pub error: Option<ManagedSessionFailure>,
}

capsem_api::ManagedSessionCloseRequest

pub struct ManagedSessionCloseRequest {
    pub ownership_token: ManagedOwnershipToken,
    pub outcome: ManagedSessionOutcome,
}

capsem_api::ManagedSessionCloseResponse

pub struct ManagedSessionCloseResponse {
    pub request_id: String,
    pub generation: String,
    pub state: ManagedSessionClosedState,
    pub session_id: Option<String>,
    pub evidence_retained: bool,
}

capsem_api::ManagedSessionCreate

pub struct ManagedSessionCreate {
    pub request_id: String,
    pub ownership_token: ManagedOwnershipToken,
}

capsem_api::ManagedSessionFailure

pub struct ManagedSessionFailure {
    pub code: ManagedSessionErrorCode,
    pub error: String,
}

capsem_api::ManagedSessionOwnership

pub struct ManagedSessionOwnership {
    pub request_id: String,
    pub generation: String,
    pub expires_at: String,
    pub lease_seconds: u32,
    pub renew_after_seconds: u32,
}

capsem_api::McpDefaultPermissionResponse

pub struct McpDefaultPermissionResponse {
    pub action: McpPermissionAction,
    pub source: String,
    pub rule_id: Option<String>,
}

capsem_api::McpInfoResponse

pub struct McpInfoResponse {
    pub server_count: usize,
    pub manual_server_count: usize,
    pub builtin_local_enabled: bool,
}

capsem_api::McpRefreshResponse

pub struct McpRefreshResponse {
    pub success: bool,
    pub server_id: String,
    pub instances: usize,
}

capsem_api::McpServerInfoResponse

pub struct McpServerInfoResponse {
    pub name: String,
    pub url: String,
    pub has_auth_credential: bool,
    pub custom_header_count: usize,
    pub source: String,
    pub enabled: bool,
    pub running: bool,
    pub tool_count: usize,
    pub is_stdio: bool,
}

capsem_api::McpServersListResponse

pub struct McpServersListResponse(pub Vec<McpServerInfoResponse>);

capsem_api::McpToolInfoResponse

pub struct McpToolInfoResponse {
    pub namespaced_name: String,
    pub original_name: String,
    pub description: Option<String>,
    pub server_name: String,
    pub annotations: Option<Value>,
    pub pin_hash: Option<String>,
    pub pin_changed: bool,
    pub permission_action: McpPermissionAction,
    pub permission_source: String,
}

// MCP annotations are protocol-extensible JSON.

capsem_api::McpToolsListResponse

pub struct McpToolsListResponse(pub Vec<McpToolInfoResponse>);

capsem_api::McpUsage

pub struct McpUsage {
    pub server_name: Option<String>,
    pub tool_name: String,
    pub call_count: u64,
    pub duration_ms: u64,
    pub bytes_sent: u64,
    pub bytes_received: u64,
}

capsem_api::ModelEvent

pub struct ModelEvent {Show 14 fields
    pub event_id: String,
    pub timestamp: String,
    pub provider: String,
    pub model: Option<String>,
    pub method: String,
    pub path: String,
    pub status_code: Option<u16>,
    pub input_tokens: Option<u64>,
    pub output_tokens: Option<u64>,
    pub duration_ms: Option<u64>,
    pub response_bytes: Option<u64>,
    pub stop_reason: Option<String>,
    pub trace_id: Option<String>,
    pub credential_ref: Option<String>,
}

capsem_api::ModelUsage

pub struct ModelUsage {
    pub provider: String,
    pub model: String,
    pub call_count: u64,
    pub input_tokens: u64,
    pub output_tokens: u64,
    pub estimated_cost_usd: f64,
    pub duration_ms: u64,
}

// Provider identifiers and model names are open namespaces.

capsem_api::NetworkInfo

pub struct NetworkInfo {
    pub id: String,
    pub name: String,
    pub subnet: String,
    pub created_unix_ms: i64,
    pub members: Vec<NetworkMemberInfo>,
}

// CIDR allocated to this network.

capsem_api::NetworkListResponse

pub struct NetworkListResponse {
    pub networks: Vec<NetworkInfo>,
}

capsem_api::NetworkLogEvent

pub struct NetworkLogEvent {
    pub sequence: i64,
    pub event_id: String,
    pub timestamp_unix_ms: i64,
    pub event_type: String,
    pub connection_id: Option<String>,
    pub event: Value,
}

capsem_api::NetworkLogsQuery

pub struct NetworkLogsQuery {
    pub cursor: Option<String>,
    pub limit: Option<usize>,
    pub vm: Option<String>,
    pub connection: Option<String>,
    pub event_type: Option<String>,
    pub decision: Option<String>,
    pub since: Option<i64>,
    pub until: Option<i64>,
}

capsem_api::NetworkLogsResponse

pub struct NetworkLogsResponse {
    pub events: Vec<NetworkLogEvent>,
    pub cursor: String,
    pub next_cursor: Option<String>,
}

capsem_api::NetworkMemberInfo

pub struct NetworkMemberInfo {
    pub vm_id: String,
    pub address: Ipv4Addr,
    pub state: NetworkMemberState,
    pub updated_unix_ms: i64,
}

capsem_api::PanicEvent

pub struct PanicEvent {
    pub ts: String,
    pub binary: String,
    pub thread: Option<String>,
    pub location: Option<String>,
    pub message: String,
    pub frames: Vec<String>,
}

capsem_api::PanicsResponse

pub struct PanicsResponse {
    pub panics: Vec<PanicEvent>,
}

capsem_api::PersistRequest

pub struct PersistRequest {
    pub name: String,
}

capsem_api::PersistResponse

pub struct PersistResponse {
    pub success: bool,
    pub name: String,
}

capsem_api::PreviewBootstrapExchangeRequest

pub struct PreviewBootstrapExchangeRequest {
    pub bootstrap_token: String,
}

capsem_api::PreviewBootstrapExchangeResponse

pub struct PreviewBootstrapExchangeResponse {
    pub session_token: String,
    pub expires_in_seconds: u16,
}

capsem_api::PreviewConnectionAdmissionRequest

pub struct PreviewConnectionAdmissionRequest {
    pub session_token: String,
    pub kind: PreviewAdmissionKind,
}

capsem_api::PreviewConnectionAdmissionResponse

pub struct PreviewConnectionAdmissionResponse {
    pub handoff_socket: String,
    pub handoff_token: u64,
    pub owner_generation: String,
    pub owner_pid: u32,
    pub owner_uid: u32,
}

capsem_api::PreviewSessionMaterial

pub struct PreviewSessionMaterial {
    pub exposure: ExposureInfo,
    pub owner_generation: String,
    pub bootstrap_token: String,
    pub expires_in_seconds: u16,
}

capsem_api::PreviewSessionResponse

pub struct PreviewSessionResponse {
    pub url: String,
    pub bootstrap_token: String,
    pub expires_in_seconds: u16,
}

// A single-use browser bootstrap. The token is submitted in a POST body to url; it must never be appended to that URL.

capsem_api::PreviewSessionsRevokedResponse

pub struct PreviewSessionsRevokedResponse {
    pub revoked: u32,
}

// How many preview sessions a revoke ended. Every flow they admitted closes; the exposure stays, so a legitimate user bootstraps a fresh session.

capsem_api::ProcessEvent

pub struct ProcessEvent {Show 13 fields
    pub event_id: String,
    pub timestamp: String,
    pub exec_id: u64,
    pub command: String,
    pub exit_code: Option<i32>,
    pub duration_ms: Option<u64>,
    pub stdout_bytes: Option<u64>,
    pub stderr_bytes: Option<u64>,
    pub source: ExecSource,
    pub process_name: Option<String>,
    pub pid: Option<u32>,
    pub trace_id: Option<String>,
    pub credential_ref: Option<String>,
}

capsem_api::ProvisionRequest

pub struct ProvisionRequest {
    pub name: Option<String>,
    pub ram_mb: Option<u64>,
    pub cpus: Option<u32>,
    pub persistent: bool,
    pub env: Option<HashMap<String, String>>,
    pub from: Option<String>,
    pub networks: Vec<String>,
    pub container: Option<ContainerSpec>,
    pub managed: Option<ManagedSessionCreate>,
}

// Unknown fields are refused rather than ignored.

// RAM in megabytes. If absent, the service’s default (12 GiB).

// CPU count. If absent, the service’s default (4).

// When true, the VM is persistent (named VMs). Ephemeral VMs are destroyed on stop.

// Environment variables to inject into the guest at boot.

// Sandbox to clone state from. If provided, the new sandbox’s session will be cloned from this existing persistent sandbox.

// Existing named networks joined atomically during provisioning.

// OCI image the service pulls, stages and starts as this VM’s workload.

// Optional finite ownership for an unnamed ephemeral SDK session.

capsem_api::ProvisionResponse

pub struct ProvisionResponse {
    pub id: String,
    pub name: String,
    pub status: VmLifecycleState,
    pub persistent: bool,
    pub can_resume: bool,
    pub available_actions: Vec<VmAction>,
    pub ownership: Option<ManagedSessionOwnership>,
}

pub fn new(
    id: String,
    name: String,
    status: VmLifecycleState,
    persistent: bool,
    can_resume: bool,
    available_actions: Vec<VmAction>,
) -> Self

capsem_api::ProxyHeartbeatResponse

pub struct ProxyHeartbeatResponse {
    pub session_id: String,
    pub lease_expires_unix_ms: u64,
}

capsem_api::ProxyLeaseRequest

pub struct ProxyLeaseRequest {
    pub lease_token: String,
}

capsem_api::PurgeRequest

pub struct PurgeRequest {
    pub all: bool,
}

capsem_api::PurgeResponse

pub struct PurgeResponse {
    pub purged: u32,
    pub persistent_purged: u32,
    pub ephemeral_purged: u32,
}

capsem_api::RawContent

pub struct RawContent {
    pub kind: RawContentKind,
    pub raw: String,
    pub reason: RawContentReason,
}

capsem_api::RegistryAccess

pub struct RegistryAccess {
    pub username: Option<String>,
    pub password: Option<String>,
    pub ca_pem: Option<String>,
}

// Credentials and trust for one registry pull.

// Password or token for username.

// Additional PEM certificate trusted only for this registry.

capsem_api::ResourceSummary

pub struct ResourceSummary {
    pub total_ram_mb: u64,
    pub total_cpus: u32,
    pub running_count: usize,
    pub stopped_count: usize,
    pub suspended_count: usize,
}

capsem_api::RestartResponse

pub struct RestartResponse {
    pub status: RestartStatus,
    pub manager: ServiceManager,
    pub authentication: RestartAuthentication,
}

// The restarted gateway rotates its token. Obtain fresh credentials and construct a new SDK client; never replay the restart mutation.

capsem_api::RevokeSessionGrantResponse

pub struct RevokeSessionGrantResponse {
    pub grant: SessionGrantSummary,
    pub local_authority: RevokedCredentialAuthority,
}

capsem_api::RunRequest

pub struct RunRequest {
    pub command: String,
    pub timeout_secs: Option<u64>,
    pub ram_mb: Option<u64>,
    pub cpus: Option<u32>,
    pub env: Option<HashMap<String, String>>,
}

// Guest RAM in MiB. If absent, the service’s default (12 GiB).

// Guest CPU count. If absent, the service’s default (4).

// Environment variables to inject into the guest at boot.

capsem_api::SandboxInfo

pub struct SandboxInfo {Show 32 fields
    pub id: String,
    pub name: Option<String>,
    pub pid: u32,
    pub status: VmLifecycleState,
    pub persistent: bool,
    pub ram_mb: Option<u64>,
    pub cpus: Option<u32>,
    pub version: Option<String>,
    pub forked_from: Option<String>,
    pub description: Option<String>,
    pub size_bytes: Option<u64>,
    pub storage: Option<StorageDiagnostics>,
    pub session_db: Option<SessionDbStatus>,
    pub ai: Option<VmAiInfo>,
    pub network: Option<VmNetworkInfo>,
    pub files: Option<VmFilesInfo>,
    pub created_at: Option<String>,
    pub uptime_secs: Option<u64>,
    pub total_input_tokens: Option<u64>,
    pub total_thinking_tokens: Option<u64>,
    pub total_output_tokens: Option<u64>,
    pub total_estimated_cost: Option<f64>,
    pub total_tool_calls: Option<u64>,
    pub total_requests: Option<u64>,
    pub allowed_requests: Option<u64>,
    pub denied_requests: Option<u64>,
    pub total_file_events: Option<u64>,
    pub model_call_count: Option<u64>,
    pub last_error: Option<String>,
    pub can_resume: bool,
    pub resume_blocked_reason: Option<String>,
    pub available_actions: Vec<VmAction>,
}

// On-disk size of the session dir in bytes. Populated for /info on persistent VMs; useful for verifying that fork produced a compact overlay and not a bloated sparse file.

// Session summaries returned by /info when the ledger is ready. Missing summaries are accompanied by session_db readiness/error details.

// Short tail of process.log from the last failed boot. Populated only when status == VmLifecycleState::Defunct. Renders in capsem list / capsem status so a crashed VM tells the user why without requiring a separate capsem logs <id> round-trip.

// True only when an inactive persistent VM can be started/resumed: its pinned boot assets are installed and its shape is current.

// Human-readable reason can_resume is false for an inactive persistent VM, e.g. a pinned boot asset that is no longer installed.

pub fn new(
    id: String,
    pid: u32,
    status: VmLifecycleState,
    persistent: bool,
) -> Self

// Construct with only the core fields; all telemetry fields default to None.

pub fn refresh_available_actions(&mut self)

capsem_api::ScopeProfileSummary

pub struct ScopeProfileSummary {
    pub id: String,
    pub enrollment_kind: EnrollmentKind,
    pub label: String,
    pub application_label: String,
    pub requested_scopes: Vec<String>,
    pub capabilities: Vec<CapabilitySummary>,
    pub enabled: bool,
}

capsem_api::SessionDbStatus

pub struct SessionDbStatus {
    pub ready: bool,
    pub error: Option<String>,
}

capsem_api::SessionGrantListResponse

pub struct SessionGrantListResponse {
    pub session_id: String,
    pub owner_generation: String,
    pub grants: Vec<SessionGrantSummary>,
    pub denied_capability_ids: Vec<String>,
}

capsem_api::SessionGrantSummary

pub struct SessionGrantSummary {
    pub id: String,
    pub session_id: String,
    pub owner_generation: String,
    pub connection_id: String,
    pub capability_ids: Vec<String>,
    pub state: GrantState,
    pub revision: u64,
    pub created_at: String,
    pub expires_at: String,
    pub revoked_at: Option<String>,
    pub runtime_bound: bool,
}

capsem_api::SlowOpEvent

pub struct SlowOpEvent {
    pub ts: String,
    pub binary: String,
    pub op: String,
    pub duration_ms: u64,
}

capsem_api::StopProxyResponse

pub struct StopProxyResponse {
    pub session_id: String,
    pub stopped: bool,
}

capsem_api::StopResponse

pub struct StopResponse {
    pub success: bool,
    pub persistent: bool,
}

// Stop completes after the VM process exits. Persistent workspace state remains.

capsem_api::StorageDiagnostics

pub struct StorageDiagnostics {
    pub rootfs_image_path: String,
    pub rootfs_image_logical_bytes: u64,
    pub rootfs_image_physical_bytes: u64,
    pub host_total_bytes: u64,
    pub host_free_bytes: u64,
    pub host_available_bytes: u64,
    pub guest_overlay_device: String,
    pub guest_overlay_mount: String,
}

capsem_api::SupplyChainChannelEvidence

pub struct SupplyChainChannelEvidence {
    pub url: Option<String>,
    pub sha256: Option<String>,
}

capsem_api::SupplyChainEvidence

pub struct SupplyChainEvidence {
    pub manifest: SupplyChainManifestEvidence,
    pub channel_index: SupplyChainChannelEvidence,
    pub host_sbom: SupplyChainReference,
    pub vm_obom: SupplyChainReference,
    pub attestations: Vec<SupplyChainReference>,
}

capsem_api::SupplyChainManifestEvidence

pub struct SupplyChainManifestEvidence {
    pub origin: Option<String>,
    pub source: Option<String>,
    pub path: String,
    pub blake3: Option<String>,
}

capsem_api::SupplyChainReference

pub struct SupplyChainReference {
    pub name: String,
    pub format: Option<String>,
    pub scope: Option<String>,
    pub generator: Option<String>,
    pub release_artifact: Option<String>,
    pub route: Option<String>,
    pub workflow: Option<String>,
}

capsem_api::TextContent

pub struct TextContent {
    pub kind: TextContentKind,
    pub text: String,
}

capsem_api::TimelineEvent

pub struct TimelineEvent {
    pub timestamp: String,
    pub layer: TimelineLayer,
    pub reference: TimelineReference,
    pub summary: String,
    pub status: Option<TimelineStatus>,
    pub duration_ms: Option<u64>,
    pub trace_id: Option<String>,
}

// Exit code for exec, HTTP code for net/model, decision for tool, null for fs.

capsem_api::TimelineQuery

pub struct TimelineQuery {
    pub trace_id: Option<String>,
    pub since: Option<String>,
    pub limit: Option<usize>,
    pub layers: Option<Vec<TimelineLayer>>,
}

// Filter to a trace, also retaining legacy records without a trace ID.

// Lookback duration (30m, 1h, 7d) or RFC3339 timestamp.

// Maximum events. Defaults to 200, capped at 2000.

// Comma-separated layers. Defaults to all five layers.

capsem_api::TimelineResponse

pub struct TimelineResponse {
    pub events: Vec<TimelineEvent>,
}

capsem_api::ToolEvent

pub struct ToolEvent {Show 18 fields
    pub event_id: String,
    pub timestamp: Option<String>,
    pub process_name: Option<String>,
    pub server_name: String,
    pub tool_name: String,
    pub method: Option<String>,
    pub call_id: String,
    pub model_call_id: Option<i64>,
    pub model_parent_missing: bool,
    pub decision: ToolDecision,
    pub duration_ms: u64,
    pub bytes: u64,
    pub arguments: Option<String>,
    pub response_preview: Option<String>,
    pub response_event_id: Option<String>,
    pub error_message: Option<String>,
    pub source: ToolOrigin,
    pub credential_ref: Option<String>,
}

// The event id the reported response is archived under. It is not event_id: the response is its own ledger row, so its full text past response_preview is fetched from /vms/{id}/bodies/{response_event_id}.

capsem_api::TriageQuery

pub struct TriageQuery {
    pub since: Option<String>,
    pub limit: Option<usize>,
    pub id: Option<String>,
}

// Lookback window such as 30m, 2h, or an RFC3339 timestamp.

// Maximum events per category; the service caps this at 200.

// Optional VM identity used to include session-ledger diagnostics.

capsem_api::TriageResponse

pub struct TriageResponse {
    pub since: String,
    pub session_id: Option<String>,
    pub host: HostTriageResponse,
    pub session: Value,
    pub rank: Vec<String>,
}

// Session-ledger categories are extensible and retain their native JSON shape.

capsem_api::UpdateActionResponse

pub struct UpdateActionResponse {
    pub status: UpdateActionStatus,
    pub command: UpdateCommandPlan,
    pub exit_code: Option<i32>,
    pub stdout: Option<String>,
    pub stderr: Option<String>,
}

capsem_api::UpdateApplyRequest

pub struct UpdateApplyRequest {
    pub dry_run: bool,
    pub confirmed: bool,
}

capsem_api::UpdateCheckRequest

pub struct UpdateCheckRequest {
    pub dry_run: bool,
}

capsem_api::UpdateCommandPlan

pub struct UpdateCommandPlan {
    pub program: String,
    pub args: Vec<String>,
}

capsem_api::UpdateStatusResponse

pub struct UpdateStatusResponse {
    pub checked_at: Option<u64>,
    pub channel_url: Option<String>,
    pub channel_hash: Option<String>,
    pub validation_status: Option<ValidationStatus>,
    pub validation_error: Option<String>,
    pub stale: bool,
    pub last_error: Option<String>,
    pub binary: UpdateTrackStatus,
    pub assets: UpdateTrackStatus,
    pub images: UpdateTrackStatus,
    pub supply_chain: SupplyChainEvidence,
}

capsem_api::UpdateTrackStatus

pub struct UpdateTrackStatus {
    pub current: Option<String>,
    pub latest: Option<String>,
    pub blocked_reason: Option<String>,
    pub update_available: bool,
    pub state: UpdateTrackState,
    pub compatibility: UpdateCompatibilityState,
}

capsem_api::UploadResponse

pub struct UploadResponse {
    pub success: bool,
    pub size: u64,
    pub vm_path: String,
    pub container_path: Option<String>,
}

// Response for POST /vms/{id}/files/content.

// Where the file is in the VM, whatever form the request named it in.

// Where the container sees it, when the VM runs one.

capsem_api::VmActionResponse

pub struct VmActionResponse {
    pub success: bool,
}

// Acknowledgement returned after a VM pause or deletion completes.

capsem_api::VmAiInfo

pub struct VmAiInfo {
    pub model_call_count: u64,
    pub total_input_tokens: u64,
    pub total_thinking_tokens: u64,
    pub total_output_tokens: u64,
    pub total_tool_calls: u64,
    pub total_estimated_cost_usd: f64,
    pub models: Vec<ModelUsage>,
    pub mcp: Vec<McpUsage>,
}

// Recorded model and tool activity for this VM’s session.

// Models observed in the session, grouped by provider and model identity.

// Recorded MCP tool calls, grouped by server and tool identity.

capsem_api::VmFilesInfo

pub struct VmFilesInfo {
    pub total_events: u64,
    pub actions: Vec<FileActionCount>,
}

// Recorded filesystem activity, not a recursive workspace inventory.

capsem_api::VmNetworkInfo

pub struct VmNetworkInfo {
    pub total_requests: u64,
    pub allowed_requests: u64,
    pub denied_requests: u64,
    pub errors: u64,
    pub bytes_sent: u64,
    pub bytes_received: u64,
}

capsem_api::VmStatsDetailResponse

pub struct VmStatsDetailResponse {
    pub interactions: InteractionReport,
    pub model_stats: Vec<ModelUsage>,
    pub model_events: Vec<ModelEvent>,
    pub tool_events: Vec<ToolEvent>,
    pub http_events: Vec<HttpEvent>,
    pub dns_events: Vec<DnsEvent>,
    pub file_events: Vec<FileEvent>,
    pub process_events: Vec<ProcessEvent>,
    pub audit_events: Vec<AuditEvent>,
    pub credential_events: Vec<CredentialEvent>,
    pub body_blobs: BTreeMap<String, Vec<EventBody>>,
}

// Latest retained events (200 per model/tool/network/file family, 100 per process/audit/credential family), session model totals, and captured bodies. This is a bounded inspection report; it is not the complete session ledger.

// Captured request/response bodies grouped by event ID.

capsem_api::VmStatsSummaryResponse

pub struct VmStatsSummaryResponse {
    pub total_requests: u64,
    pub allowed_requests: u64,
    pub denied_requests: u64,
    pub total_input_tokens: u64,
    pub total_thinking_tokens: u64,
    pub total_output_tokens: u64,
    pub total_tool_calls: u64,
    pub total_estimated_cost: f64,
}

capsem_api::VmStatusResponse

pub struct VmStatusResponse {
    pub id: String,
    pub name: String,
    pub status: VmLifecycleState,
    pub pid: Option<u32>,
    pub persistent: bool,
    pub uptime_secs: Option<u64>,
    pub created_at: Option<String>,
    pub last_error: Option<String>,
    pub can_resume: bool,
    pub resume_blocked_reason: Option<String>,
    pub storage: Option<StorageDiagnostics>,
    pub available_actions: Vec<VmAction>,
}

capsem_api::VmSummary

pub struct VmSummary {Show 18 fields
    pub id: String,
    pub name: Option<String>,
    pub status: VmLifecycleState,
    pub persistent: bool,
    pub uptime_secs: Option<u64>,
    pub total_input_tokens: Option<u64>,
    pub total_output_tokens: Option<u64>,
    pub total_estimated_cost: Option<f64>,
    pub total_tool_calls: Option<u64>,
    pub total_requests: Option<u64>,
    pub allowed_requests: Option<u64>,
    pub denied_requests: Option<u64>,
    pub total_file_events: Option<u64>,
    pub model_call_count: Option<u64>,
    pub can_resume: bool,
    pub resume_blocked_reason: Option<String>,
    pub last_error: Option<String>,
    pub available_actions: Vec<VmAction>,
}

// Why a crashed VM died: the process.log tail the service captured. The service splits the two on purpose – a defunct session carries its reason here and leaves resume_blocked_reason empty – so a consumer that reads only the latter has nothing to show for the one state where the user most needs a reason.

capsem_api::Value

pub type Value = Value;

// Extensible MCP arguments and results retain their native JSON shape.

pub enum Value {
    Null,
    Bool(bool),
    Number(Number),
    String(String),
    Array(Vec<Value>),
    Object(Map<String, Value>),
}

// Represents a JSON null value. let v = json!(null);

// Represents a JSON boolean. let v = json!(true);

// Represents a JSON number, whether integer or floating point. let v = json!(12.5);

// Represents a JSON string. let v = json!("a string");

// Represents a JSON array. let v = json!(["an", "array"]);

// Represents a JSON object. By default the map is backed by a BTreeMap. Enable the preserve_order feature of serde_json to use IndexMap instead, which preserves entries in the order they are inserted into the map. In particular, this allows JSON data to be deserialized into a Value and serialized to a string while retaining the order of map keys in the input. let v = json!({ "an": "object" });