Mint serial-over-SSH credentials so the USER can open their own interactive console session on a virtual machine, and return the exact ssh command to run. Use this when a person wants to drive the console themselves — poke around, watch a boot, run an interactive installer or a TUI. To run a specific command and get its output back, use run_vm_command instead; do NOT take these credentials and try to drive an interactive shell yourself.
What comes back: the ssh command, the connection address, the connection secret (used at ssh's own password prompt), and the token's expiry. The credentials reach the VM's serial console through the Cycle gateway — no VM networking required, so this works even with public networking disabled or the guest's network broken.
Logging IN to the guest is separate: past ssh, the console lands at the guest's own login prompt. The response includes the generated root password when it is still retrievable (~10 minutes after creation); after that the user needs their own guest credentials or an attached SSH key.
Relay the credentials to the user plainly so they can paste the command. They are short-lived and they grant root-capable console access — treat them as a secret, do not write them into files, commits, or issues.
action:"revoke" expires ALL serial-over-SSH tokens for the VM, immediately disconnecting every active console session on it (including a session the user is in the middle of, and anyone else's). It is a mutation: confirm with the user before calling it.