Inputs

Only for a bundle source; omitted, this server's copy, which must have been uploaded.

Required when the publisher is not enrolled on this server.

Opaque cursor from the previous page's nextCursor.

Only channels the viewer has joined (the sidebar list).

Include archived channels.

Required in an encrypted conversation: unpadded base64url SHA-256 of the blob.

For DM conversations.

For Group conversations.

For Channel conversations.

Channels only: visible to invited members alone. Cannot be changed later.

DMs and groups only: end-to-end encrypted from creation. Every member needs a device set up for encryption. Defaults to false.

People from other servers, in the direct space only. With no otherUserId or memberIds and one remote member, the conversation is a DM with them.

The conversation this one succeeds, when its home is gone.

Optional recipient to email the invite link to. Validated server-side; malformed addresses return a validation error.

Role granted on join: MEMBER (default) or GUEST. Any other value is a VALIDATION error.

The workspace's name, typed again to confirm.

"HH:MM" (or "HH:MM:SS").

"HH:MM" (or "HH:MM:SS"); must differ from start.

IANA timezone name, e.g. Europe/Prague.

The whole key log, inception first.

Certificate of the device enrolling; this session becomes its session.

A login statement signed by that device over a fresh keyLoginChallenge, proving the caller holds the device key.

Confirmation proof from a previous executeCommand that returned status: CONFIRMATION_REQUIRED. Required when re-submitting that call. The server binds the proof to the actor, command id, arguments and context, so it cannot confirm a different call.

Who issued this command. When omitted, the server treats the call as PALETTE, a human action, never as an agent action. AGENT fails with FEATURE_DISABLED while the instance has the AI command surface off.

Confirmation proof, as in ExecuteCommandInput.confirmation. One proof issued for the macro covers every step of it.

Who triggered this macro, as in ExecuteCommandInput.initiator: PALETTE when omitted. Every step runs with this initiator.

The host's origin, from the invite link.

The invite token; null for a current member.

A login statement over a remoteJoinChallenge, naming the host's server id.

A delegation of the signing device for this relay, the host and the workspace.

The cursor a previous messageChanges call returned for this conversation. Opaque. Omit (or pass null) to read the conversation's whole history from the beginning.

At most 100 conversations. One the caller cannot read comes back with status NO_ACCESS.

Maximum changes per conversation. Clamped to 1..=200; defaults to 100.

Their relays, tried in order to fetch their identity.

The decrypted content, exactly as committed to.

Decimal microseconds.

The account's username, typed again to confirm.

The mls-readd statement, signed by the session's device key.

Device certificate under the new identity key. Required for a recovery rotation.

Optional explicit single-conversation scope, in addition to the in: search operator.

Clamped server-side; defaults to 25 if omitted.

Defaults to AFTER (most-recent-first) if omitted.

Chosen by the client (UUID v7).

The message this one forwards by sending its content again (an encrypted message's content, after the person confirmed it is posted unencrypted). The caller must be able to read it.

Required. The user's email address. Trimmed and lowercased before storage. Must look like local@domain.tld and be at most 254 characters.

Optional display name (1–80 chars when present). Falls back to username when absent or blank after trim.

The terms of service the person accepted: serverInfo.termsUrl, sent back unchanged. Required when the server has terms (VALIDATION when missing or different); ignored when it has none.

Optional display name (1–80 chars when present). Falls back to username when absent or blank after trim.

The whole key log, inception first.

Certificate of the device signing up; the new session belongs to it.

A login statement signed by that device over a fresh keyLoginChallenge.

In pow registration mode: an 8-byte nonce, unpadded base64url, such that SHA-256("rim.pow.v1\0" || server id || "\0" || inception payload || nonce) starts with the descriptor's powBits zero bits.

The terms of service the person accepted, as for signupWithInvite.

Required for an incarnation's first Commit (epoch 0).

Required when the Commit adds devices.

The member, not a guest, who becomes the owner.

At most 20, each 2 to 40 characters; stored lower-cased and deduplicated.

Null turns the daily window off.

Whether reactions to the viewer's messages notify them; null keeps the current value.

A new version, or a re-signed one, of the same plugin.