KitService
KitService reads and changes kit repos. Its RPCs carry the names of the kit operations.
Private content requires owner authentication. The account comes from the bearer token, never from the request. No RPC returns more than the inline Cat limit of content bytes, except the proof material of Prove. Conventions and error codes: see common.proto.
A write acts only in the caller's namespace. A write names its repo with a plain repo name, not with RepoRef. The server signs every commit and tag with the account's key.
Cat
/rpc/uno.kit.v1.KitService/CatReads one file. The response holds the content inline up to the inline limit, and a URL above it. A signed URL expires at url_expires_at. Maps the MCP tool kit_cat.
Header Parameters
Request Body
application/jsonobjectNames one repo. Reads may name any owner. Writes never use this message for the target repo, because a write acts only in the caller's namespace.
At most one of namespace, handle may be set.
booleanWhen true, a file that the server would serve by a content URL comes back with neither inline_content nor url, and the server mints no grant. These are the files above 51200 bytes that lie as one raw blob in the pack. The caller signs on demand through GetObjectUrl. Every other answer stays as it is. False keeps the answer of earlier clients.
Responses
stringENTRY_MODE_UNSPECIFIEDENTRY_MODE_REGULARENTRY_MODE_EXECUTABLEENTRY_MODE_SYMLINKENTRY_MODE_TREEstringThe content URL. Set when size_bytes is above 51200, except when the request sets defer_url and the file is served by URL. A signed URL expires at url_expires_at.
stringThe status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
canceledunknowninvalid_argumentdeadline_exceedednot_foundstringA developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
DeleteRef
/rpc/uno.kit.v1.KitService/DeleteRefDeletes a branch when its current id equals expected_old_id. The change is public. A ref_name outside refs/heads/ fails with invalid_argument. Nested branch names under refs/heads/ are valid. Maps the MCP tool kit_ref_delete.
Header Parameters
Request Body
Responses
stringThe status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
canceledunknowninvalid_argumentdeadline_exceedednot_foundstringA developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
DeleteRepo
/rpc/uno.kit.v1.KitService/DeleteRepoDeletes a repo in the caller's namespace. Only the owner can call it, and a delegated credential needs the kits:write scope, checked live. The delete is soft: every ref goes (each branch head with its packmap in one step), the repo turns private (which revokes public URL tokens), it leaves the owner's listings and Discover, cached public responses are purged, and the owner's usage loses the repo's stored bytes. The response includes the retention notice: object bytes remain for at least 30 days. Unshared bytes then become eligible for cleanup, with a further 16-day restore safety delay. Shared content and held evidence stay protected. The name stays blocked from reuse while the delete settles. The delete is final; a repo with the same name later starts empty. Maps the MCP tool kit_repo_delete.
Header Parameters
Request Body
Responses
booleanTrue at deletion: object bytes remain for at least 30 days. Exclusive bytes then become eligible for cleanup, with a further 16-day restore safety delay. Shared content and held evidence stay protected. Usage is refunded at deletion; later cleanup never refunds it again.
stringThe status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
canceledunknowninvalid_argumentdeadline_exceedednot_foundstringA developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
Diff
/rpc/uno.kit.v1.KitService/DiffLists the file changes between two revisions. The response holds no content. Maps the MCP tool kit_diff.
Header Parameters
Request Body
application/jsonobjectNames one repo. Reads may name any owner. Writes never use this message for the target repo, because a write acts only in the caller's namespace.
At most one of namespace, handle may be set.
Responses
stringThe status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
canceledunknowninvalid_argumentdeadline_exceedednot_foundstringA developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
GetFileLayout
/rpc/uno.kit.v1.KitService/GetFileLayoutReturns how kit stores one file: as a single blob, or as a chunked blob with a paged list of chunks. The response holds no content.
Header Parameters
Request Body
application/jsonobjectNames one repo. Reads may name any owner. Writes never use this message for the target repo, because a write acts only in the caller's namespace.
At most one of namespace, handle may be set.
integer <int32>The server uses 256 when page_size is 0. The server refuses a page_size above 1000 and names the maximum.
Responses
stringThe status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
canceledunknowninvalid_argumentdeadline_exceedednot_foundstringA developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
GetObjectUrl
/rpc/uno.kit.v1.KitService/GetObjectUrlReturns an expiring signed URL for one object. A private repo grants that URL only to its owner, with any owner credential: an account session, an account key or an owner delegation. Maps the MCP tool kit_object_url.
Header Parameters
Request Body
application/jsonobjectNames one repo. Reads may name any owner. Writes never use this message for the target repo, because a write acts only in the caller's namespace.
At most one of namespace, handle may be set.
Responses
stringThe status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
canceledunknowninvalid_argumentdeadline_exceedednot_foundstringA developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
GetReadGate
/rpc/uno.kit.v1.KitService/GetReadGateGives a cache the facts under which a read of the Public view may repeat. The answer never changes what a read returns. A cache may reuse a read only when cacheable is true, and only under the same facts.
Header Parameters
Request Body
Responses
booleanTrue only when every cache fence is open. When false, tips and tips_digest are empty and no cache may reuse a read.
stringA digest of all visible refs and their tips: 64 lowercase hex characters. A caller treats it as opaque.
booleanTrue only for a cacheable gate with no active denial entries of any kind. Permits separately keyed immutable snapshots, not dynamic source metadata. An absent field is false and must refuse denial-independent snapshot reuse.
stringThe status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
canceledunknowninvalid_argumentdeadline_exceedednot_foundstringA developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
ListRefs
/rpc/uno.kit.v1.KitService/ListRefsLists the refs of a repo, sorted by name. Maps the MCP tool kit_ref_list.
Header Parameters
Request Body
application/jsonobjectNames one repo. Reads may name any owner. Writes never use this message for the target repo, because a write acts only in the caller's namespace.
At most one of namespace, handle may be set.
Responses
stringThe status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
canceledunknowninvalid_argumentdeadline_exceedednot_foundstringA developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
ListRepos
/rpc/uno.kit.v1.KitService/ListReposLists the repos of one owner, most recently updated first. Maps the MCP tool kit_repo_list.
Header Parameters
Request Body
Responses
stringThe status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
canceledunknowninvalid_argumentdeadline_exceedednot_foundstringA developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
Log
/rpc/uno.kit.v1.KitService/LogLists the commits reachable from a revision, newest first. Maps the MCP tool kit_log.
Header Parameters
Request Body
application/jsonobjectNames one repo. Reads may name any owner. Writes never use this message for the target repo, because a write acts only in the caller's namespace.
At most one of namespace, handle may be set.
stringThe revision where the walk starts. Paging requires a full ref, such as refs/heads/main. A raw commit id returns page one without a continuation.
integer <int32>Commits per page. Zero selects 10. A value above 100 is refused with a failed_precondition that names the maximum. A page can hold fewer commits than requested when the call reaches its work budget, because each commit costs storage reads. Follow next_page_token to read more history.
Responses
stringThe status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
canceledunknowninvalid_argumentdeadline_exceedednot_foundstringA developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
Prove
/rpc/uno.kit.v1.KitService/ProveReturns a kit disclosure bundle that proves one path at a commit. The engine builds it with kit_core::verify::build_disclosure_from. The bytes equal kit_core::verify::build_disclosure over the same objects. A client verifies the bundle with verify_disclosure from the npm package @officialunofficial/kit-wasm, without further calls. The format is KDPB, in SPEC-DISCLOSURE.md section 3. Maps the MCP tool kit_prove.
Header Parameters
Request Body
Responses
stringThe status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
canceledunknowninvalid_argumentdeadline_exceedednot_foundstringA developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
Header Parameters
Request Body
Responses
stringThe status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
canceledunknowninvalid_argumentdeadline_exceedednot_foundstringA developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
Remix
/rpc/uno.kit.v1.KitService/RemixCopies a commit of any public repo into a new repo in the caller's namespace. The copy runs as a job and is public. Poll it with StagingService.GetJobStatus. An OAuth delegation cannot remix a public repo: the call fails with failed_precondition, because a copy has the privacy of its source and an agent cannot publish. Maps the MCP tool kit_remix.
Header Parameters
Request Body
application/jsonobjectNames one repo. Reads may name any owner. Writes never use this message for the target repo, because a write acts only in the caller's namespace.
At most one of namespace, handle may be set.
stringThe name of the new repo in the caller's namespace. A name in use fails with already_exists.
Responses
stringThe status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
canceledunknowninvalid_argumentdeadline_exceedednot_foundstringA developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
RemixPreflight
/rpc/uno.kit.v1.KitService/RemixPreflightResolves a published source tip and estimates its full-history bytes. This read creates no job. Fork admission sets the authoritative charge.
Header Parameters
Request Body
application/jsonobjectNames one repo. Reads may name any owner. Writes never use this message for the target repo, because a write acts only in the caller's namespace.
At most one of namespace, handle may be set.
Responses
string <int64>Conservative estimate from all distinct source packs, not an exact branch quote. Concurrent writes can change this counter. Admission sets the exact charge.
stringThe status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
canceledunknowninvalid_argumentdeadline_exceedednot_foundstringA developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
Revert
/rpc/uno.kit.v1.KitService/RevertStarts a job that reverses a single-parent commit on a branch. A changed current tree conflicts. Poll with StagingService.GetJobStatus. Maps the MCP tool kit_revert.
Header Parameters
Request Body
application/jsonstringThe id that the branch must have now. A mismatch fails with failed_precondition. A revert that conflicts also fails with failed_precondition.
stringEmpty selects a default message. Otherwise the text must contain a non-whitespace character. At most 65536 UTF-8 bytes; NUL is forbidden. Whitespace follows Unicode White_Space. Accepted text stays unchanged. Invalid text fails with invalid_argument before admission.
Responses
stringThe status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
canceledunknowninvalid_argumentdeadline_exceedednot_foundstringA developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
SetVisibility
/rpc/uno.kit.v1.KitService/SetVisibilityOnly the owner can change a repo's visibility in either direction. Repos are public by default. Making a repo private returns a warning because public content may already have been copied. An OAuth delegation (an agent) cannot make a repo public: the call fails with permission_denied, and the owner must approve with an account session. A delegation can make a repo private.
Header Parameters
Request Body
Responses
stringA repo is public by default. Its owner can change visibility unless a private-origin lock prevents public visibility.
REPO_VISIBILITY_UNSPECIFIEDREPO_VISIBILITY_PUBLICREPO_VISIBILITY_PRIVATEstringThe status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
canceledunknowninvalid_argumentdeadline_exceedednot_foundstringA developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
Show
/rpc/uno.kit.v1.KitService/ShowShows a commit and its tree, or a tree alone. Maps the MCP tool kit_show.
Header Parameters
Request Body
application/jsonobjectNames one repo. Reads may name any owner. Writes never use this message for the target repo, because a write acts only in the caller's namespace.
At most one of namespace, handle may be set.
Responses
stringThe status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
canceledunknowninvalid_argumentdeadline_exceedednot_foundstringA developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
Tag
/rpc/uno.kit.v1.KitService/TagCreates a signed tag. Fails with already_exists when the tag exists. The tag is public. Maps the MCP tool kit_tag.
Header Parameters
Request Body
application/jsonstringEmpty selects a default message. Otherwise the text must contain a non-whitespace character. At most 65536 UTF-8 bytes; NUL is forbidden. Whitespace follows Unicode White_Space. Accepted text stays unchanged. Invalid text fails with invalid_argument before admission.
Responses
stringThe status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
canceledunknowninvalid_argumentdeadline_exceedednot_foundstringA developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
UpdateRef
/rpc/uno.kit.v1.KitService/UpdateRefMoves a branch when its current id equals expected_old_id. The change is public. A ref_name outside refs/heads/ fails with invalid_argument. Nested branch names under refs/heads/ are valid. Tags are immutable, and the engine owns refs/kit/. Maps the MCP tool kit_ref_update.
Header Parameters
Request Body
Responses
stringThe status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
canceledunknowninvalid_argumentdeadline_exceedednot_foundstringA developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
Verify
/rpc/uno.kit.v1.KitService/VerifyChecks the signatures of the signed objects that a revision leads to: each tag on the way, then the commit or remix. For each object it gives three separate answers (see ObjectVerification): whether the signature is valid, whether the signer was an authorized keyring member when the server accepted the object, and whether a later revocation reaches back to that time. The membership and revocation answers are attested by Uno. Maps the MCP tool kit_verify.
Header Parameters
Request Body
Responses
stringThe id of the commit or remix that the revision resolved to. A revision can name a tag. When the signature of a tag on the way fails, the check stops at that tag, and this is the tag id.
booleanTrue when every signature in objects verifies. This is answer 1 alone. It needs nothing from Uno: anyone can check it again with kit. It says nothing about the keyring. Read the authorization of each object for that.
stringThe signer of the object at commit_id, as "ed25519:" followed by 64 lowercase hex characters.
stringWho vouches for the answers about the keyring in objects. Always TRUST_MODEL_UNO_ATTESTED.
TRUST_MODEL_UNSPECIFIEDTRUST_MODEL_UNO_ATTESTEDobject[]The signed objects on the way, outermost first: each tag that the revision passes through, then the commit or remix. A tag whose signature fails ends the list. The list holds no ancestor of the commit. An ancestor has its own verification, so a rotation never changes the answer for a parent.
stringThe status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
canceledunknowninvalid_argumentdeadline_exceedednot_foundstringA developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.