Reference

save_project

Keep the strip: save it as an editable ShotOps project with a URL to hand back.

What it does

Writes
Destructive
Account required

The persistence step, and it happens when the user asks for it. It builds a structure and look record rather than pixels, so it is fast and never hits a render timeout, and it returns a URL the user opens in the web app. Omitting the project id creates a new project; passing one updates that project in place. Reach for it once someone wants the work preserved, shared, reused or kept editable — a request for images or a bundle is not that, and a render already told them nothing was saved and offered this call.

You can ask: “Save this Tidebook strip as a new project I can reopen later.”

Annotated destructive because passing an existing project id overwrites that project’s structure. Creating a new one is not destructive; the annotation covers the worst case, as the MCP spec asks.

Input

screenshotsarrayrequiredat least 1 itemat most 10 items
Screenshots in App Store display order (1–10). Preferred common form: a FLAT array, where each entry becomes its own App Store panel, e.g. [{ "ref": "first" }, { "ref": "second" }]. Advanced multi-phone form: a NESTED array of slots, where several entries inside one slot are composited into that single panel, e.g. [[{ "ref": "left" }, { "ref": "right" }], [{ "ref": "third" }]]. Each screenshot entry is EITHER an inline base64 PNG string (capped at 3MB of image data — a full-resolution screenshot is 3-4MB and will NOT fit; use a ref for anything real), OR { "ref": "..." } from request_screenshot_upload, OR { "url": "https://..." }, OR (local stdio mode only) { "path": "/abs/or/relative/path.png" } to read a file straight off disk, OR { "locales": { "<locale>": <any of those> } } to vary that screenshot per App Store locale (missing locales fall back to the en-US variant). Prefer ref/url for real screenshots so the bytes never transit this conversation. NOTE: save_project does not render — it uses only each slot's SHAPE (phones per panel) and each entry's name (source filename, for re-load matching). The image bytes are never fetched or stored, so pass the same entries you rendered with (esp. their names).
each item
any
The published schema does not constrain this element, on purpose — a malformed entry comes back as a sentence instead of a stacked union error. What the server re-validates against is below.
panelPresetIdstringoptional
App Store screenshot size. Default r69 (6.9″ iPhone, 1290×2796). iPhone sizes only — iPad is not rendered yet.
one ofr69r65r55
outputsarrayoptionalat least 1 itemat most 2 items
The target DEVICES this project is for — iphone-6-9 (1290×2796) and/or iphone-6-5 (1242×2688), in the order they should be offered. On save_project this is saved ON the project (the same Output list the web app shows) and the first entry becomes the previewed size unless panelPresetId says otherwise; on render_project it OVERRIDES the saved set for this call. Omit it and the project's saved outputs are used unchanged.
each item
string
one ofiphone-6-9iphone-6-5
lookobjectoptional
A ShotOps "look" — per-DEVICE styling + background, exactly as read_look returns it. Its shots[] give every screenshot/phone its own styling (including multiple phones in one panel); style.shotLook is one shared style for all. COMPOSES with style: pass a look for the devices + style.captions for the words in ONE render. Validated — unknown keys are rejected (call describe_look for the full field catalog).
- schemanumberoptional
  Look schema version. The server stamps it on every save (save_look); read_look returns it. Any input value is ignored — never set it yourself.
- panelPresetIdstringoptional
  Canvas size preset, e.g. r69 = 1290×2796. Default r69.
- bgModestringoptional
  One gradient across the strip, or a flat colour per panel. Default gradient.
  one ofgradientperPanel
- gradientStopsarrayoptionalat least 1 item
  Canonical gradient stops — { color (hex), at (0–1 position) } — wins over gradientFrom/gradientTo/gradientDir when present. Read this back for the full stop list a Studio-authored look may carry; the trio below is only ever a two-stop summary.
  each item
  object
  - colorstringrequired
  - atnumberrequiredmin 0max 1
- gradientAnglenumberoptional
  Canonical gradient angle in degrees, clockwise from "to top" (CSS convention: 90 = right, 180 = down, the gradientDir:"vertical" equivalent). Paired with gradientStops.
- gradientFromstringoptional
  Gradient start (hex) — a DERIVED mirror of gradientStops[0], re-derived from the stops on every render and reload. Setting it ALONE changes nothing: set gradientStops to change the backdrop. Default #1b1b2e.
- gradientTostringoptional
  Gradient end (hex) — a DERIVED mirror of the last gradientStops entry, re-derived from the stops on every render and reload. Setting it ALONE changes nothing: set gradientStops to change the backdrop. Default #0a0a14.
- gradientDirstringoptional
  A DERIVED mirror of gradientAngle (nearest axis), re-derived on every render and reload. Setting it ALONE changes nothing: set gradientAngle to turn the gradient. Default vertical.
  one ofhorizontalvertical
- panelColorsobjectoptional
  Per-panel flat colours (mode perPanel), keyed by panel id.
- shadowbooleanoptional
  Drop shadow under the phones. Default true.
- floorReflectionbooleanoptional
  Flipped, faded floor reflection under each phone. Default false.
- panelBackgroundsobjectoptional
  Per-frame background overrides keyed by panel id (web-authored; agents rarely set these).
- captionStylesobjectoptional
  Per-panel caption STYLE arrays keyed by panel id (styling only, no words — for caption text pass style.captions).
- shotsarrayoptionalat most 60 items
  One entry per SCREENSHOT/DEVICE, flattened in panel order. Each entry has its OWN look. For screenshots:[[left,right]], pass two shots with the SAME panelId ("panel-1") to give the two devices different colours/materials/angles. This is how a look varies devices; style.shotLook cannot.
  each item
  object
  - panelIdstringoptional
    Panel containing this screenshot/device. Panels are panel-1…panel-N in slot order; REPEAT the same panelId for multiple devices in one panel. A saved look’s own ids are remapped by ordinal.
  - lookobjectoptional
    This individual screenshot/device’s styling — the SAME fields as style.shotLook.
    anglestringoptional
    Camera preset. Default front.
    one offrontleftright
    cameraPosone of 2 shapesoptional
    Manual camera position override; null/omit = use the angle preset.
    1x
    xnumberrequired
    ynumberrequired
    znumberrequired
    2null
    rollstring or numberoptional
    -45–45° clock-hand tilt. Default 0.
    phoneHeightstring or numberoptional
    -45–45° clock-hand tilt. Default 0.
    hOffsetstring or numberoptional
    -45–45° clock-hand tilt. Default 0.
    vOffsetstring or numberoptional
    -45–45° clock-hand tilt. Default 0.
    materialstringoptional
    Device body. Default real.
    one ofrealclay
    colorwaystringoptional
    Body colour (material "real"). Default silver. These are finish SLOTS — each device binds its own real finish (silver = iPhone Silver / Pixel Moonstone). "green" is Pixel-only (Jade); other devices fall back to their first finish.
    one oforangebluesilvergreencustom
    customColorstringoptional
    Hex body colour when colorway is "custom".
    finishstring or numberoptional
    -45–45° clock-hand tilt. Default 0.
    clearcoatstring or numberoptional
    -45–45° clock-hand tilt. Default 0.
    clayTonestringoptional
    Clay tone (material "clay"). Default grey.
    one ofgreywhitecharcoalcustom
    clayCustomstringoptional
    Hex clay colour when clayTone is "custom".
    flatScreenbooleanoptional
    Render the screen flat (no curvature). Default false.
    glarebooleanoptional
    Screen glare. Default false.
    lightingbooleanoptional
    Scene lighting. Default true.
    reflectionsbooleanoptional
    Body reflections. Default false.
    clipToFramebooleanoptional
    Clip this complete device composite to its owning frame. Default false (overflow allowed).
styleobjectoptional
Structured styling — the discoverable path (call describe_look for the full field catalog + defaults). layout is the fastest way in: one named composition that settles the headline region and the device placement together, with your explicit fields still winning over it. COMPOSES with look: pass BOTH to get per-device styling from the look AND captions from style.captions in ONE render (every real App Store strip). When a look is also given it supplies the devices + background, so style.shotLook/style.background are ignored (a note says so) — use style for captions then. Alone, style styles every phone identically + captions. Also composes with useSavedLook/version.
- layoutstringoptional
  Panel COMPOSITION template — sets the headline’s reserved region and the device’s placement, camera pose, and roll in one choice. "standard" — Headline on top, whole device below it, nothing cropped. The safe default. Reserves 2 headline lines (~36 characters). Character: [safe]. "bleed" — Room for a longer headline, device running off the bottom edge. What the market looks like. Reserves 4 headline lines (~72 characters). Character: [conventional]. "top-bleed" — Device running off the TOP edge, headline underneath it. Inverts the usual reading order. Reserves 4 headline lines (~72 characters). Character: [expressive]. PRECEDENCE: the template expands FIRST into shotLook.phoneHeight/shotLook.hOffset/shotLook.vOffset/shotLook.angle/shotLook.cameraPos/shotLook.roll and captions[].sizePt/captions[].maxWidth/captions[].reserveLines/captions[].band, and THEN any of those fields you pass EXPLICITLY overrides it — so { layout: "bleed", shotLook: { vOffset: "45" } } renders bleed seated at 45, not at the template’s 38. That is how you say "bleed, but a bit lower" without the template silently winning. The reserved region is held at FULL SIZE whether or not the headline fills it, which is what makes every panel in a swiped set land on the same line. Nothing stores the template id: it is discarded at expansion, so a saved project and read_look carry only the expanded values.
  one ofstandardbleedtop-bleed
- shotLookobjectoptional
  This individual screenshot/device’s styling — the SAME fields as style.shotLook.
  - anglestringoptional
    Camera preset. Default front.
    one offrontleftright
  - cameraPosone of 2 shapesoptional
    Manual camera position override; null/omit = use the angle preset.
    1x
    xnumberrequired
    ynumberrequired
    znumberrequired
    2null
  - rollstring or numberoptional
    -45–45° clock-hand tilt. Default 0.
  - phoneHeightstring or numberoptional
    -45–45° clock-hand tilt. Default 0.
  - hOffsetstring or numberoptional
    -45–45° clock-hand tilt. Default 0.
  - vOffsetstring or numberoptional
    -45–45° clock-hand tilt. Default 0.
  - materialstringoptional
    Device body. Default real.
    one ofrealclay
  - colorwaystringoptional
    Body colour (material "real"). Default silver. These are finish SLOTS — each device binds its own real finish (silver = iPhone Silver / Pixel Moonstone). "green" is Pixel-only (Jade); other devices fall back to their first finish.
    one oforangebluesilvergreencustom
  - customColorstringoptional
    Hex body colour when colorway is "custom".
  - finishstring or numberoptional
    -45–45° clock-hand tilt. Default 0.
  - clearcoatstring or numberoptional
    -45–45° clock-hand tilt. Default 0.
  - clayTonestringoptional
    Clay tone (material "clay"). Default grey.
    one ofgreywhitecharcoalcustom
  - clayCustomstringoptional
    Hex clay colour when clayTone is "custom".
  - flatScreenbooleanoptional
    Render the screen flat (no curvature). Default false.
  - glarebooleanoptional
    Screen glare. Default false.
  - lightingbooleanoptional
    Scene lighting. Default true.
  - reflectionsbooleanoptional
    Body reflections. Default false.
  - clipToFramebooleanoptional
    Clip this complete device composite to its owning frame. Default false (overflow allowed).
- backgroundobjectoptional
  - modestringoptional
    One gradient across the strip, or a flat colour per panel.
    one ofgradientperPanel
  - stopsarrayoptionalat least 1 item
    Gradient colour stops, in order along the gradient line — { color (hex), at (0–1 position; 0 = line start, 1 = line end) }. Two stops is the classic top/bottom gradient, more make a multi-colour sweep, one stop is a solid fill. Default a two-stop navy gradient: [{color:"#1b1b2e",at:0},{color:"#0a0a14",at:1}].
    each item
    object
    colorstringrequired
    atnumberrequiredmin 0max 1
  - anglenumberoptional
    Gradient angle in degrees, clockwise from "to top" — CSS linear-gradient() convention: 90 = to right, 180 = to bottom (the old "vertical" default, and this field’s own default), 270 = to left. Any value folds into 0–360.
  - panelColorsarrayoptionalat most 10 items
    Per-panel flat colours (mode "perPanel"), one entry per slot in order; null = default.
    each item
    string or null
  - shadowbooleanoptional
    Drop shadow under the phones. Default true.
  - floorReflectionbooleanoptional
    Flipped, faded floor reflection under each phone. Default false.
- captionsarrayoptionalat most 10 items
  One entry PER PANEL in slot order; null = no caption on that panel. An entry is EITHER a single caption object OR an array of caption layers (stacked, in order) on that panel. Alongside a look, an entry is a DELTA: every style field you set wins, every field you leave out keeps the look’s styling for that panel and layer — which is what lets you re-render a layout.correctedLook without restating your captions.
  each item
  one of 2 shapes
  1one of 2 shapes
  1object
  fontIdstringoptional
  Bundled font. Default inter.
  one ofintermanropepoppinsfrauncesspace-grotesk
  sizePtnumberoptionalgreater than 0
  Font size in iOS points (preset-independent), 20–120. Default 32. Outside that range it is clamped to it and the response says so.
  colorstringoptional
  Text colour (hex). Default FFFFFF.
  alignstringoptional
  Default center.
  one ofleftcenterright
  anchorobjectoptional
  Normalized 0–1 position of the caption on the panel. Default {x:0.5, y:0.06}.
  xnumberoptionalmin 0max 1
  ynumberoptionalmin 0max 1
  maxWidthnumberoptionalgreater than 0
  Wrap width as a fraction of the panel, 0.1–1. Default 0.86. Outside that range it is clamped to it and the response says so.
  reserveLinesintegeroptionalmin 1max 8
  How many lines of headline room to HOLD, whether or not the text fills it. A shorter headline is centred in the reserved space rather than leaving all the slack beneath it, and the space is held so every panel in the strip lands on the same line. Omit to let the caption be exactly as tall as its text. Set for you by style.layout.
  bandstringoptional
  Put this caption in the BOTTOM band, growing upward from the lower margin, instead of the default top band. This is how a headline sits UNDER the device (see the top-bleed layout). The caption stays auto-placed — it still reflows and still stacks; use this rather than pinning an anchor, which would freeze it.
  one ofbottom
  bandInsetnumberoptionalmin 0max 0.5
  Inset of the auto caption band from its own panel edge, as a 0–0.5 fraction of panel height. The top band measures down; the bottom band mirrors it upward. Default 0.06.
  lineHeightnumberoptionalmin 0.5max 3
  Line spacing as a multiple of font size, 0.5–3. Default 1.2.
  bandCenternumberoptionalmin 0max 1
  Horizontal reference of the auto caption block as a 0–1 fraction of panel width. Text alignment decides which edge sits there. Default 0.5.
  textstringoptionalat most 200 characters
  The headline — per-RENDER input, never stored in a look.
  subtitlestringoptionalat most 300 characters
  Optional subtitle under the headline — also per-render input.
  2array
  each item
  object
  fontIdstringoptional
  Bundled font. Default inter.
  one ofintermanropepoppinsfrauncesspace-grotesk
  sizePtnumberoptionalgreater than 0
  Font size in iOS points (preset-independent), 20–120. Default 32. Outside that range it is clamped to it and the response says so.
  colorstringoptional
  Text colour (hex). Default FFFFFF.
  alignstringoptional
  Default center.
  one ofleftcenterright
  anchorobjectoptional
  Normalized 0–1 position of the caption on the panel. Default {x:0.5, y:0.06}.
  xnumberoptionalmin 0max 1
  ynumberoptionalmin 0max 1
  maxWidthnumberoptionalgreater than 0
  Wrap width as a fraction of the panel, 0.1–1. Default 0.86. Outside that range it is clamped to it and the response says so.
  reserveLinesintegeroptionalmin 1max 8
  How many lines of headline room to HOLD, whether or not the text fills it. A shorter headline is centred in the reserved space rather than leaving all the slack beneath it, and the space is held so every panel in the strip lands on the same line. Omit to let the caption be exactly as tall as its text. Set for you by style.layout.
  bandstringoptional
  Put this caption in the BOTTOM band, growing upward from the lower margin, instead of the default top band. This is how a headline sits UNDER the device (see the top-bleed layout). The caption stays auto-placed — it still reflows and still stacks; use this rather than pinning an anchor, which would freeze it.
  one ofbottom
  bandInsetnumberoptionalmin 0max 0.5
  Inset of the auto caption band from its own panel edge, as a 0–0.5 fraction of panel height. The top band measures down; the bottom band mirrors it upward. Default 0.06.
  lineHeightnumberoptionalmin 0.5max 3
  Line spacing as a multiple of font size, 0.5–3. Default 1.2.
  bandCenternumberoptionalmin 0max 1
  Horizontal reference of the auto caption block as a 0–1 fraction of panel width. Text alignment decides which edge sits there. Default 0.5.
  textstringoptionalat most 200 characters
  The headline — per-RENDER input, never stored in a look.
  subtitlestringoptionalat most 300 characters
  Optional subtitle under the headline — also per-render input.
  2null
useSavedLookbooleanoptional
If true, style the strip with the project's saved look (ignored when look/style is given).
projectstringoptionalat least 1 character
Which ShotOps project to target: its id (as returned by read_look/save_project), OR its NAME as the user says it — matched exactly, ignoring case and surrounding spaces. Omit = your most recently edited project. A name that matches none or several is refused with the account's projects listed, never resolved by guessing.
versionintegeroptionalmin 1
Render a specific saved look version of the project (implies the saved look). Omit = the project's HELD version if one is held (hold_look), else the latest saved look.
localestringoptional
App Store locale, e.g. "de-DE" (default en-US). Labels the render, selects which { "locales": … } screenshot variants render, and, for emit_bundle, selects the fastlane screenshots folder. Does not select caption text — pass the copy for this locale yourself via style.captions[].text (see the README's captions.<locale>.json convention).
projectNamestringoptional
Name for the created project (when createProject makes a new one). Default "ShotOps render".
sourceDirstringoptional
Advanced: the on-disk folder these screenshots were read from (only meaningful when they came from local { path } entries on the SAME machine). When set, the saved project remembers this folder as its screen source (kind: "local-path") instead of just filenames. Used by the local stdio bridge — most callers should omit it.

What the server actually accepts

The published schema above deliberately accepts a wider shape for screenshots, so a malformed entry comes back as a sentence rather than a stack of union errors. The server re-validates against these shapes and refuses anything else.

screenshotsone of 2 shapesrequired
Screenshots in App Store display order (1–10). Preferred common form: a FLAT array, where each entry becomes its own App Store panel, e.g. [{ "ref": "first" }, { "ref": "second" }]. Advanced multi-phone form: a NESTED array of slots, where several entries inside one slot are composited into that single panel, e.g. [[{ "ref": "left" }, { "ref": "right" }], [{ "ref": "third" }]]. Each screenshot entry is EITHER an inline base64 PNG string (capped at 3MB of image data — a full-resolution screenshot is 3-4MB and will NOT fit; use a ref for anything real), OR { "ref": "..." } from request_screenshot_upload, OR { "url": "https://..." }, OR (local stdio mode only) { "path": "/abs/or/relative/path.png" } to read a file straight off disk, OR { "locales": { "<locale>": <any of those> } } to vary that screenshot per App Store locale (missing locales fall back to the en-US variant). Prefer ref/url for real screenshots so the bytes never transit this conversation. NOTE: save_project does not render — it uses only each slot's SHAPE (phones per panel) and each entry's name (source filename, for re-load matching). The image bytes are never fetched or stored, so pass the same entries you rendered with (esp. their names).
1array
Preferred: one screenshot entry per App Store panel, in display order.
each item
one of 5 shapes
1string
Inline base64-encoded PNG (no "data:" prefix). Capped at 3MB of image data — a real full-resolution screenshot is 3-4MB and will NOT fit. Use request_screenshot_upload and pass { ref } instead; inline is for thumbnails and tests.
2ref
A ref returned by request_screenshot_upload — resolved server-side, never re-sent inline.
refstringrequiredat least 1 character
namestringoptionalat most 200 characters
The screenshot's original filename (e.g. "03_statistics.png"). Pass it so that, if this render is saved as a project, the user's own screenshots folder re-loads exactly this file by name. Optional if the ref already carries a name (from request_screenshot_upload({ names })); omit entirely and the record falls back to a positional name (screen-N.png).
3url
An https URL to a PNG or JPEG — fetched server-side, converted to PNG when needed (no redirects, ~20MB cap).
urlstringrequiredat least 1 character
namestringoptionalat most 200 characters
The screenshot's original filename (e.g. "03_statistics.png"). Pass it so that, if this render is saved as a project, the user's own screenshots folder re-loads exactly this file by name. Optional if the ref already carries a name (from request_screenshot_upload({ names })); omit entirely and the record falls back to a positional name (screen-N.png).
4path
A local filesystem path to a PNG, read straight off disk — ONLY available over the local stdio server (npx shotops-mcp); the hosted server rejects this entry shape.
pathstringrequiredat least 1 character
namestringoptionalat most 200 characters
The screenshot's original filename (e.g. "03_statistics.png"). Pass it so that, if this render is saved as a project, the user's own screenshots folder re-loads exactly this file by name. Optional if the ref already carries a name (from request_screenshot_upload({ names })); omit entirely and the record falls back to a positional name (screen-N.png).
5locales
Per-locale variants of ONE screenshot: { "locales": { "en-US": <entry>, "de-DE": <entry> } } (each variant is an inline base64 / ref / url / path entry). render_strip picks the top-level locale's variant; emit_bundle with locales renders/packages every listed locale. A locale with no variant of its own falls back to the en-US variant (else the first declared), so you can localize only some screenshots.
localesobjectrequired
2array
Advanced: one nested slot per panel; put several screenshot entries in a slot for a multi-phone panel.
each item
array
One App Store slot: 1–6 screenshots. Several entries = several phones composited into that one slot.
each item
one of 5 shapes
1string
Inline base64-encoded PNG (no "data:" prefix). Capped at 3MB of image data — a real full-resolution screenshot is 3-4MB and will NOT fit. Use request_screenshot_upload and pass { ref } instead; inline is for thumbnails and tests.
2ref
A ref returned by request_screenshot_upload — resolved server-side, never re-sent inline.
refstringrequiredat least 1 character
namestringoptionalat most 200 characters
The screenshot's original filename (e.g. "03_statistics.png"). Pass it so that, if this render is saved as a project, the user's own screenshots folder re-loads exactly this file by name. Optional if the ref already carries a name (from request_screenshot_upload({ names })); omit entirely and the record falls back to a positional name (screen-N.png).
3url
An https URL to a PNG or JPEG — fetched server-side, converted to PNG when needed (no redirects, ~20MB cap).
urlstringrequiredat least 1 character
namestringoptionalat most 200 characters
The screenshot's original filename (e.g. "03_statistics.png"). Pass it so that, if this render is saved as a project, the user's own screenshots folder re-loads exactly this file by name. Optional if the ref already carries a name (from request_screenshot_upload({ names })); omit entirely and the record falls back to a positional name (screen-N.png).
4path
A local filesystem path to a PNG, read straight off disk — ONLY available over the local stdio server (npx shotops-mcp); the hosted server rejects this entry shape.
pathstringrequiredat least 1 character
namestringoptionalat most 200 characters
The screenshot's original filename (e.g. "03_statistics.png"). Pass it so that, if this render is saved as a project, the user's own screenshots folder re-loads exactly this file by name. Optional if the ref already carries a name (from request_screenshot_upload({ names })); omit entirely and the record falls back to a positional name (screen-N.png).
5locales
Per-locale variants of ONE screenshot: { "locales": { "en-US": <entry>, "de-DE": <entry> } } (each variant is an inline base64 / ref / url / path entry). render_strip picks the top-level locale's variant; emit_bundle with locales renders/packages every listed locale. A locale with no variant of its own falls back to the en-US variant (else the first declared), so you can localize only some screenshots.
localesobjectrequired

Result

okbooleanoptional
projectIdstringoptional
statusstringoptionalalways "pending_claim"
ownershipstringoptionalalways "pending"
claimIdstringoptional
openUrlstringoptionalformat uri
countnumberoptional
panelPresetIdstringoptional
localestringoptional
messagestringoptional
outputsarrayoptional
each item
string
notestringoptional
Free-text advisories about THIS call, joined into one string. Written when the server did something you did not literally ask for or could not have known: a look/version fallback, an output-mode downgrade, a device this server cannot render, a style.shotLook a look overrode, or placement set by hand where a style.layout template would have produced the same composition. Never an error — the call succeeded. Read it, and act on it next call.
disclosureobjectoptional
Stated because this call moved caller bytes into ShotOps storage. Relay it before or with the result; do not paraphrase the retention window.
- movesstringrequired
  The bytes that left the caller’s control, in plain words.
- whystringrequired
  What the move buys — never a restatement of the mechanism.
- retentionDaysintegerrequiredgreater than 0
  How long ShotOps keeps it without an explicit retaining action. Read from the retention policy, never typed.
- retainedBystringrequired
  The explicit action that keeps it past that window.
- statementstringrequired
  The same four facts as one sentence, safe to relay verbatim.
contractobjectoptional
The versioned ShotOps result contract (#662): what ran, where, what it changed, what it cost, what it produced and — on a refusal — a typed failure over a closed code catalog. Structured content is authoritative; the prose beside it is a rendering of this block.
- contractVersionstringrequired
  The version of THIS envelope, REPORTED. Compare it against the version you were written for. There is no version negotiation: no tool accepts a requested version, so this is never a refusal — it moves only when a field changes meaning, and additive fields never move it.
- statusstringrequired
  one ofsucceededpartialfailedrefusedacceptedqueuedrunningcancel_requestedcancelled
- terminalbooleanrequired
  false ⟹ this operation is still running and will be reported again (#666).
- operationobjectrequired
  - idstringrequired
    Identity for THIS call, unique per invocation. Quote it in a bug report.
  - toolstringrequired
    The registered tool name that produced this result.
  - kindstringrequired
    one ofrenderbundlereadmutateuploaddeletestatus
  - durableobjectoptional
    #666 domain handle for addressable long-running work. Absent from synchronous calls.
    - operationIdstringrequired
    - pollWithstringoptional
- executionobjectrequired
  - locationstringrequired
    Where the work RAN. local is the caller’s own machine over stdio.
    one oflocalhosted
  - inputModesarrayrequired
    Every way this door accepts screenshots and assets.
    each item
    string
    one ofinline_base64stored_refremote_urllocal_pathproject_stored
  - deliveryModesarrayrequired
    Every way this door can hand a result back.
    each item
    string
    one ofinline_base64signed_urllocal_pathshare_link
- effectsobjectrequired
  What this call DID to the world, independent of what it returned. Every flag is stated on every result, false included: an absent flag would be indistinguishable from an effect nobody thought to declare.
  - networkFetchbooleanrequired
    This call fetched bytes from a host neither ShotOps nor the caller controls.
  - uploadbooleanrequired
    Caller bytes were uploaded into ShotOps storage.
  - retainedStoragebooleanrequired
    Something survives this call in ShotOps storage.
  - projectMutationbooleanrequired
    A saved project or its look history changed.
  - publicationbooleanrequired
    Something became reachable outside the account — a share link.
  - deletionbooleanrequired
    Something was permanently removed.
- costobjectrequired
  - unitstringrequiredalways "credit"
    Public cloud credits — the same unit every ShotOps surface quotes.
  - modelstringrequired
    How this connection pays. unmetered is local stdio, which renders on the caller’s own machine; anonymous_allowance is the unsigned hosted taste.
    one ofmeteredanonymous_allowanceunmetered
  - estimatednumberoptional
    What the call was expected to cost, before it ran.
  - reservednumberoptional
    Held against the wallet for the duration of the call (#666).
  - releasednumberoptional
    Given back — an unused reservation or a refund after a post-charge failure (#666).
  - settlednumberoptional
    Actually taken. Absent when nothing was charged.
  - balanceAfternumberoptional
    The wallet’s public cloud credit balance once this call settled.
  - refillAtstringoptional
    ISO 8601. When the wallet is next topped up; absent when none is scheduled.
- progressobjectoptional
  Persisted monotonic durable-operation progress. Never inferred from transient render metadata. Relay panelsCompleted/panelsTotal and the estimate to the waiting user; the item counters are internal bookkeeping and do not match what they asked for.
  - completedintegerrequiredmin 0
    Internal scheduling items done — panels PLUS the bundle and result items. Do not quote this to a person.
  - totalintegerrequiredmin 0
    Internal scheduling items in total. Larger than the panel count.
  - panelsCompletedintegeroptionalmin 0
    Panels finished, in the unit the caller asked in. THIS is the number to report.
  - panelsTotalintegeroptionalmin 0
    Panels this operation will produce — the count the user asked for.
  - attemptintegerrequiredmin 0
  - heartbeatAtstring or nulloptional
  - estimatedRemainingSecondsnumberoptionalmin 0
    Rough seconds of rendering left, from this operation’s own measured pace once a panel has landed. An estimate, not a deadline — say “about”. Absent when nothing is left to render.
- resolvedInputobjectoptional
  #661 — what the server actually resolved the request to, before any pixel was produced.
  - snapshotIdstringoptional
    psi_ + the first 32 hex of the fingerprint. Quote it in a bug report.
  - fingerprintstringoptional
    sha256 over every resolved fact. Equal fingerprints ⟹ equal production input.
  - sourcesarrayoptional
    One entry per source cell, resolved or not. slot is the cell the bytes came FROM — a shot id and coordinate on a saved project, an ordered slot label on a direct render. Never a filename, a ref or a URL. origin is absent exactly when status is not resolved: there is nothing the cell came from.
    each item
    object
    slotstringrequired
    statusstringrequired
    one ofresolvedmissingambiguous
    originstringoptional
    one ofinline_base64stored_refremote_urllocal_pathproject_stored
  - defaultsAppliedarrayoptional
    What the server chose because the caller said nothing.
    each item
    string
  - overridesarrayoptional
    What the caller said that changed the outcome.
    each item
    string
- readinessobjectoptional
  #665 — the readiness verdict and any waiver receipt.
  - statestringoptional
    blocked ⟹ nothing was delivered. ready_with_findings ⟹ delivered, and here is what to know.
    one ofreadyready_with_findingswaivedblocked
  - policyVersionstringoptional
    The readiness policy this verdict was computed under. A waiver granted under another one is rejected.
  - findingsarrayoptional
    Every finding, with code, waivable and digest. A waiver names one id AND its digest; there is no wildcard and no code-level waiver.
    each item
    object
    idstringrequired
    rf_ + 24 hex. Quote it in a waiver.
    severitystringrequired
    one ofinfowarnblock
    messagestringrequired
    targetobjectrequired
    The exact shot, panel, locale, output or frames this finding is about.
    shotIdstringoptional
    panelIndexnumberoptional
    localestringoptional
    outputstringoptional
    captionLayernumberoptional
    framesarrayoptional
    each item
    number
    evidenceobjectrequired
    Bounded redacted facts used to derive the finding and its digest.
  - waiversarrayoptional
    The waivers this call ACCEPTED. Pass these objects back verbatim to reuse them; a rebuilt one is rejected.
    each item
    object
    findingIdstringrequired
    findingDigeststringrequired
    policyVersionstringrequired
    waivedBystringrequired
    waivedAtstringrequired
    codestringrequired
    one ofsource_identity_ambiguousoutput_unsupportedoutput_omittedlook_exact_unavailableno_panelspanel_invalid_pngpanel_dimensions_invalidrenderer_failedinput_changed_during_runpanel_source_emptylocale_source_fallbackdevice_source_fallbackcaption_inheritedcaption_locale_fallbacklook_source_fallbackcaption_device_collisioncaption_caption_collisiondevice_device_collisioncaption_legibility_unresolvedscope_filteredlocale_not_live_on_applelook_hold_inactivecaption_text_empty
    reasonstringoptional
- artifactsarrayoptional
  each item
  object
  - idstringrequired
    The opaque asset id from the custody registry (#663) — or, for kind: "share", the link’s own token. Never a storage path, and never a signed URL.
  - kindstringrequired
    one ofpanelbundlescreenshotshareproject
  - deliveryobjectrequired
    modestringrequired
    one ofinline_base64signed_urllocal_pathshare_link
    urlstringoptional
    THE ONE FIELD a signed URL may appear in. Nothing else in this envelope carries one.
    expiresAtstringoptional
    ISO 8601, when the grant above stops working.
  - bytesnumberoptional
  - retainedUntilstringoptional
    ISO 8601, when ShotOps stops keeping the artifact itself.
- failureobjectoptional
  Present exactly when status is failed or refused.
  - codestringrequired
    The closed failure code. Branch on this, never on the sentence.
    one ofinvalid_inputunsupported_inputproject_not_foundproject_ambiguousno_projectsversion_not_foundresolution_incompletereadiness_requiredreadiness_unmetasset_not_foundasset_in_useauthentication_requiredplan_requiredtrial_choice_requiredquota_exhaustedanonymous_limit_reachedcapability_deniedbilling_unavailablerender_failedstorage_failedpersistence_failedupstream_unavailablepayload_too_largerate_limitedoperation_not_foundidempotency_conflictoperation_unavailableoperation_not_readycontract_version_unsupportedinternal_error
  - phasestringrequired
    How far the call got. input and authorization guarantee nothing was rendered, stored, written or charged.
    one ofinputauthorizationresolutionreservationexecutiondeliverypersistence
  - retryablebooleanrequired
    true ⟹ the identical call may succeed later with nothing changed.
  - nextActionstringrequired
    The one move that resolves this, machine-readable.
    one ofnonefix_inputchoose_projectupload_assetsreduce_scopesign_inchoose_planupgrade_planretrywait_and_retrypoll_operationupgrade_clientcontact_support
  - detailsobjectoptional
    Bounded, redacted, code-specific facts (the offending field name, the candidate project ids, the required plan). Never a credential, a signed URL or screenshot bytes.

Example

That request maps to this call:

{
  "name": "save_project",
  "arguments": {
    "screenshots": [
      {
        "ref": "uploads/you/tidebook/01-today.png",
        "name": "01-today.png"
      },
      {
        "ref": "uploads/you/tidebook/02-forecast.png",
        "name": "02-forecast.png"
      },
      {
        "ref": "uploads/you/tidebook/03-spots.png",
        "name": "03-spots.png"
      }
    ],
    "projectName": "Tidebook 2.4 launch"
  }
}

A project id and an openUrl to give the user. From an unsigned local server it returns an explicit seven-day pending claim instead — the user owns the project once they open the URL and sign in.

Access and cost

Needs an account on the hosted server. On local stdio an unsigned save is allowed and becomes a pending claim.
Free, on both doors. Saving spends no cloud credits and renders nothing.
An unsigned local save is the one local path that uploads pixels — the raw PNGs go to temporary private claim storage so the user can claim them. Ordinary local rendering and exporting upload nothing.
A Free account may own 2 projects. Pro is unlimited.

When it refuses

The reply says the project allowance is used up.: Delete a project in the web app, or upgrade. Nothing was saved.
A pending claim expires unclaimed.: The seven-day window closed and the temporary upload is gone. Save again and open the URL this time.
You passed a project id and it updated something the user did not expect.: Only pass an id when the user explicitly says the work belongs in that project. Omit it and a new project is created instead.

Where this fits

What the agent is told

The title and description the server publishes on tools/list — this is the copy a model chooses between, reproduced verbatim.

Save as editable project

Let the user keep the strip: save it as an editable ShotOps project they can open in the web app, refine by hand, and have re-rendered later by render_project. Returns an openUrl to hand back and, when already authenticated, a projectId. Unsigned local stdio instead returns an explicit pending claim; the user owns it after opening the URL and signing in. No panel PNGs are returned. Fast, and it does NOT render: it builds a byte-free structure + look record, so no panel bytes are returned and it never hits the render timeout. `outputs` names the device sizes the project targets; an existing `project` id updates that project in place, omitting it creates a new one. CALL IT WHEN THE USER ASKS FOR PERSISTENCE, not as the closing step of every job: this is the door for someone who said they want to keep, share, reuse or keep editing the work. A request for images, full-resolution panels or a bundle is not that, and neither is silence — a render already told them nothing was saved and offered this call. Pass `project` only when they named an existing project as the target; never infer one from the most recently edited. An UNSIGNED local save is the one local path that moves bytes: it stages the raw PNGs in private claim storage so the claimed project reopens whole, and its result carries a `disclosure` block naming what moved, why, how long it is kept and what retains it. Ordinary local render/export never uploads.