@loomcycle/client 1.111.0 → 1.112.0

package/README.md

@@ -144,6 +144,8 @@ The low-level primitives (`runStreaming({interactive:true})` + `sendRunInput` +
 | `listUserAgents(userId, opts?)` | `Promise<Agent[]>` | Optional filter by status (`running` / `completed` / `failed` / `cancelled`). |
 | `listWalkRuns(walkId, { limit?, cursor? })` | `Promise<WalkRunsPage>` | One page of a team walk's runs — its own run and every member, oldest first: `{ agents, next_cursor }`. Pass `next_cursor` back as `cursor`; `""` on the last page. `limit` defaults to 100, at most 1000. Raises `NotFoundError` for a walk you cannot read. |
 | `listChildRuns(parentRunId, { limit?, cursor? })` | `Promise<WalkRunsPage>` | One page of a run's direct children (the runs it started itself), of every status, oldest first, paged like `listWalkRuns`. Not the run itself, and not its grandchildren. Raises `NotFoundError` for a run you cannot read. |
+| `deleteRunTree(runId)` | `Promise<RunTreeDeletion>` | Permanently delete a run and every run it spawned, with what is stored about them. The usage ledger is kept. Needs the `runs:delete` scope. Returns `{ deleted_runs, counts, kept, not_reached }`; an unknown, already deleted or unreadable run returns `deleted_runs: 0` instead of raising. A tree with a live or paused run deletes nothing and raises with `code: "run_tree_live"`. |
+| `deleteSession(sessionId, { cascade: "children" })` | `Promise<RunTreeDeletion>` | The same for every run of a session, each with the runs it spawned. `cascade: "children"` is required. |
 | `getTranscript(sessionId)` | `Promise<TranscriptResponse>` | Persisted event log; one row per event with seq/run_id/ts_ns/type/event. |
 | `health()` | `Promise<HealthResponse>` | Liveness probe. Hits `/healthz` (no `/v1` prefix). Unauthenticated. |
 | `getConfig(opts?)` | `Promise<ConfigResponse>` | v1.38.0 — instance configuration: build identity, the feature matrix, and the live provider/model/search cascade with `active`/`selected`. `view` names the disclosure level (`public` / `authenticated` / `admin`). Also readable with **no bearer** against a deployment running `LOOMCYCLE_PUBLIC_CONFIG=1`, which serves the narrower `public` view — the landing-page case. |

package/dist/cjs/client.js

@@ -138,6 +138,8 @@ function runBody(opts) {
         body.idempotency_key = opts.idempotencyKey;
     if (opts.maxWallSeconds !== undefined)
         body.max_wall_seconds = opts.maxWallSeconds;
+    if (opts.retention !== undefined)
+        body.retention = opts.retention;
     if (opts.metadata !== undefined)
         body.metadata = opts.metadata;
     if (opts.runTimeoutSeconds !== undefined)
@@ -601,6 +603,35 @@ class LoomcycleClient {
             body.reason = opts.reason;
         return (0, fetch_helpers_js_1.postJSON)(this.ctx, `/v1/runs/${encodeURIComponent(runId)}/compact`, body, opts);
     }
+    /** Permanently delete a run and every run it spawned, with what is stored
+     *  about them: transcripts, their sessions when no other run is left in
+     *  them, interrupts, evaluations of them, queued memory rows and indexed
+     *  turns. The usage ledger (tokens, cost) is kept. Mirrors
+     *  `DELETE /v1/runs/{run_id}/tree`.
+     *
+     *  Needs the `runs:delete` scope (an admin and a tenant operator have it;
+     *  any other token only if it was granted at mint) — a token without it
+     *  raises `LoomcycleError` with status 403. A run that does not exist, was
+     *  already deleted, or is not yours to read resolves with `deleted_runs: 0`
+     *  rather than raising, so repeating the call is safe. A tree holding a run
+     *  that is still running, awaiting input or paused deletes nothing and
+     *  raises `LoomcycleError` with `code: "run_tree_live"` (status 409): cancel
+     *  it first. `not_reached` names where a copy may remain that this call
+     *  cannot remove. To discard a configured run that never started, use
+     *  {@link LoomcycleClient.deleteConfiguredRun}. */
+    async deleteRunTree(runId, opts) {
+        return (0, fetch_helpers_js_1.deleteJSON)(this.ctx, `/v1/runs/${encodeURIComponent(runId)}/tree`, opts);
+    }
+    /** Permanently delete every run of a session, each with the runs it
+     *  spawned — {@link LoomcycleClient.deleteRunTree} for all of them at once.
+     *  `cascade: "children"` is required and is the only mode: there is no
+     *  delete that leaves sub-agent runs behind. Mirrors
+     *  `DELETE /v1/sessions/{session_id}?cascade=children`. Same scope, same
+     *  zero-count answer for a session you cannot read, same `run_tree_live`
+     *  refusal. */
+    async deleteSession(sessionId, opts) {
+        return (0, fetch_helpers_js_1.deleteJSON)(this.ctx, `/v1/sessions/${encodeURIComponent(sessionId)}?cascade=${encodeURIComponent(opts.cascade)}`, opts);
+    }
     /**
      * Replay a session's transcript into a NEW session bound to a (possibly
      * different) target agent, so that agent continues from the same context
@@ -790,6 +821,36 @@ class LoomcycleClient {
             params.set("tenant", opts.tenant);
         return (0, fetch_helpers_js_1.deleteRequest)(this.ctx, `/v1/_limits?${params.toString()}`, opts);
     }
+    /** The timed no-trace overrides in force: agents whose runs are being
+     *  stored although they normally store none. An admin sees every tenant's
+     *  (or one with `tenant`); a tenant operator sees its own. Mirrors
+     *  `GET /v1/_retention/overrides`. */
+    async listRetentionOverrides(opts) {
+        const q = opts?.tenant ? `?tenant=${encodeURIComponent(opts.tenant)}` : "";
+        return (0, fetch_helpers_js_1.jsonFetch)(this.ctx, `/v1/_retention/overrides${q}`, opts);
+    }
+    /** Store the runs of one no-trace agent until `until`, to debug it. At
+     *  most 24 hours ahead; setting one replaces the last. It lifts a mode
+     *  that came from the agent's definition or the run request, never one a
+     *  token requires. Audited. `tenant` is admin-only: a tenant operator's
+     *  override is always for its own tenant. Mirrors
+     *  `PUT /v1/_retention/overrides`. */
+    async setRetentionOverride(body, opts) {
+        const until = body.until instanceof Date ? body.until.toISOString() : body.until;
+        const wire = { agent: body.agent, until };
+        if (body.tenant !== undefined)
+            wire.tenant = body.tenant;
+        return (0, fetch_helpers_js_1.putJSON)(this.ctx, "/v1/_retention/overrides", wire, opts);
+    }
+    /** End an agent's no-trace override before it runs out. Clearing one that
+     *  is not there is not an error. Mirrors
+     *  `DELETE /v1/_retention/overrides`. */
+    async clearRetentionOverride(agent, opts) {
+        const params = new URLSearchParams({ agent });
+        if (opts?.tenant)
+            params.set("tenant", opts.tenant);
+        return (0, fetch_helpers_js_1.deleteRequest)(this.ctx, `/v1/_retention/overrides?${params.toString()}`, opts);
+    }
     /** Ask a decision model typed questions (`choice` / `noul` / `score`) about
      *  `state` and get each answer with its probabilities. A decision model does
      *  not write: there is no reply to parse and the call costs a few output
@@ -869,9 +930,51 @@ class LoomcycleClient {
      *  scopes are DERIVED server-side from the member's access_mode (never sent),
      *  and the plaintext `token` is returned exactly ONCE — store it now, it is
      *  never retrievable again. 404 for an unknown/cross-tenant subject; 409 for
-     *  a disabled user. */
+     *  a disabled user.
+     *
+     *  `ttlSeconds` gives the token a fixed lifetime: it stops authenticating
+     *  when that runs out, and the answer carries `expires_at`. It cannot run
+     *  past the end of the token making the call. `name` labels it (stored as
+     *  `u-<name>`).
+     *  `maxActive` keeps at most that many of the user's tokens alive — the
+     *  oldest beyond it are retired at once and listed in `retired`.
+     *
+     *  `agents` limits the token to starting those agents as top-level runs, and
+     *  to the run endpoints: it is refused everywhere else (403
+     *  `restricted_token`), and refused any other agent (403
+     *  `agent_not_allowed`). An agent that a listed one spawns is not limited.
+     *  An empty list is refused; omit the option for no limit.
+     *
+     *  `overrides` locks the per-run settings for runs the token starts, and
+     *  for retunes it makes: `"none"` locks them all (model, provider, tier,
+     *  effort, sampling, limits, output format and the rest), a list names the
+     *  ones it may still set. A request that sets a locked one is refused with
+     *  403 `override_not_allowed`.
+     *
+     *  `rate` bounds how often the token may start runs: `perMinute` runs a
+     *  minute, with `burst` allowed at once from idle (default: `perMinute`).
+     *  A start past the rate is refused with 429 `rate_limited` and a
+     *  `Retry-After` header.
+     *
+     *  With none of the options the request has no body, as before. */
     async mintUserToken(subject, opts) {
-        return (0, fetch_helpers_js_1.postJSON)(this.ctx, `/v1/_users/${encodeURIComponent(subject)}/tokens`, undefined, opts);
+        const body = {};
+        if (opts?.ttlSeconds !== undefined)
+            body.ttl_seconds = opts.ttlSeconds;
+        if (opts?.name !== undefined)
+            body.name = opts.name;
+        if (opts?.maxActive !== undefined)
+            body.max_active = opts.maxActive;
+        if (opts?.agents !== undefined)
+            body.agents = opts.agents;
+        if (opts?.overrides !== undefined)
+            body.overrides = opts.overrides;
+        if (opts?.rate !== undefined) {
+            body.rate = { per_minute: opts.rate.perMinute, burst: opts.rate.burst };
+        }
+        if (opts?.retention !== undefined)
+            body.retention = opts.retention;
+        return (0, fetch_helpers_js_1.postJSON)(this.ctx, `/v1/_users/${encodeURIComponent(subject)}/tokens`, Object.keys(body).length > 0 ? body : undefined, { signal: opts?.signal });
     }
     /** List the caller's own user's delegated tokens — METADATA ONLY (never the
      *  plaintext or hash). `active` applies the auth-layer validity rule so a

package/dist/cjs/index.js

@@ -17,6 +17,8 @@
  *     cancelAgent(agentId, opts?): Promise<CancelAgentResult>
  *     listUserAgents(userId, opts?): Promise<Agent[]>
  *     listWalkRuns(walkId, opts?): Promise<WalkRunsPage>
+ *     deleteRunTree(runId, opts?): Promise<RunTreeDeletion>     // needs runs:delete
+ *     deleteSession(sessionId, {cascade: "children"}): Promise<RunTreeDeletion>
  *     getTranscript(sessionId): Promise<TranscriptResponse>
  *     health(): Promise<HealthResponse>
  *     listUsers(opts?): Promise<ListUsersResponse>   // tenant-scoped (RFC L)

package/dist/client.d.ts

@@ -25,7 +25,7 @@
  */
 import { InteractiveSession } from "./interactive.js";
 import { ClientToolHost, type ConnectClientToolsOptions } from "./client-tools.js";
-import type { CredentialListResponse, CredentialMeta, DecideRequest, DecideResponse, DecisionModelsResponse, CredentialScope, DirectoryInspection, DirectoryTenant, DirectoryUser, ErasureReport, ErasureResult, Agent, AgentEvent, AgentStatus, CancelAgentResult, ClientOptions, ContinueOptions, RunOverrideOptions, EffectiveConfigResponse, RetuneRunResponse, RunConfigResponse, RunPromptResponse, CreateSnapshotOptions, EnsureCodeAgentOptions, EnsureCodeAgentResult, EnsureMcpServerOptions, EnsureMcpServerResult, HealthResponse, InterruptListResponse, InterruptStatus, WalkRunsPage, AckChannelOptions, AwaitChannelsOptions, BroadcastChannelsOptions, ChannelAckResult, ChannelAwaitResult, ChannelBroadcastResult, ChannelDescriptor, ChannelPeekResult, ListTeamChannelsOptions, PeekTeamChannelOptions, ReleaseTeamChannelOptions, TeamChannelPeekResult, TeamChannelReleaseResult, TeamChannelsResult, ChannelPublishResult, ChannelPurgeResult, ChannelReleaseResult, ChannelSubscribeResult, CreateChannelOptions, ListChannelsResponse, PeekChannelOptions, PublishChannelOptions, ReleaseChannelOptions, SetMemoryEntryOptions, SetMemoryEntryResponse, SubscribeChannelOptions, UpdateChannelOptions, LibraryAgentDefinition, LibraryListResponse, LibraryMcpServerDefinition, LibrarySkillDefinition, ListUsersResponse, UserRecord, CreateUserBody, UpdateUserBody, MintedUserToken, ListUserTokensResponse, RunnableAgentsResponse, LLMChatOptions, LLMChatResponse, LLMChatStreamItem, LLMEmbeddingsOptions, LLMEmbeddingsResponse, MCPServerDefVerifyResult, MemoryEmbedStatsResponse, MemoryEntriesResponse, MemoryEntryResponse, MemoryBackfillResponse, MemoryPurgeResponse, MemoryReembedResponse, MemoryScopeIDsResponse, MemoryScopesResponse, MemorySearchInput, MemorySearchResponse, PauseResult, PersistentVolumesResponse, EphemeralVolumesResponse, ResolveInterruptOptions, ResumeResult, ResolverMatrix, CompactRunResult, ReplaySessionResult, CancelTurnResult, ReviewRunResult, RunBatchOptions, RunBatchResult, RunOptions, ConfiguredRun, ConfiguredRunPatch, RunStateStreamItem, RuntimeStateResponse, SnapshotCreateResponse, SnapshotDescriptor, SnapshotEnvelope, SnapshotRestoreResponse, StreamUserRunStatesOptions, SubstrateToolInput, SubstrateToolResponse, CreatedTeam, ListTeamsResponse, PromotedTeam, RetiredTeam, TeamBreakpoints, TeamDefDetail, TeamRunDetached, TeamRunTarget, TeamVerification, TeamDraft, TeamDraftVerification, TeamVersionList, TeamDiagram, TeamRunResult, PathToolInput, PathToolResponse, DocumentToolInput, DocumentToolResponse, HistoryToolInput, HistoryToolResponse, TranscriptResponse, WhoamiResponse, UsageDimension, UsageReportResponse, TokenLimit, TokenLimitsResponse, ConfigResponse, SetTokenLimitRequest } from "./types.js";
+import type { CredentialListResponse, CredentialMeta, DecideRequest, DecideResponse, DecisionModelsResponse, CredentialScope, DirectoryInspection, DirectoryTenant, DirectoryUser, ErasureReport, ErasureResult, Agent, AgentEvent, AgentStatus, CancelAgentResult, ClientOptions, ContinueOptions, RunOverrideOptions, EffectiveConfigResponse, RetuneRunResponse, RunConfigResponse, RunPromptResponse, CreateSnapshotOptions, EnsureCodeAgentOptions, EnsureCodeAgentResult, EnsureMcpServerOptions, EnsureMcpServerResult, HealthResponse, InterruptListResponse, InterruptStatus, WalkRunsPage, AckChannelOptions, AwaitChannelsOptions, BroadcastChannelsOptions, ChannelAckResult, ChannelAwaitResult, ChannelBroadcastResult, ChannelDescriptor, ChannelPeekResult, ListTeamChannelsOptions, PeekTeamChannelOptions, ReleaseTeamChannelOptions, TeamChannelPeekResult, TeamChannelReleaseResult, TeamChannelsResult, ChannelPublishResult, ChannelPurgeResult, ChannelReleaseResult, ChannelSubscribeResult, CreateChannelOptions, ListChannelsResponse, PeekChannelOptions, PublishChannelOptions, ReleaseChannelOptions, SetMemoryEntryOptions, SetMemoryEntryResponse, SubscribeChannelOptions, UpdateChannelOptions, LibraryAgentDefinition, LibraryListResponse, LibraryMcpServerDefinition, LibrarySkillDefinition, ListUsersResponse, UserRecord, CreateUserBody, UpdateUserBody, MintedUserToken, ListUserTokensResponse, RunnableAgentsResponse, LLMChatOptions, LLMChatResponse, LLMChatStreamItem, LLMEmbeddingsOptions, LLMEmbeddingsResponse, MCPServerDefVerifyResult, MemoryEmbedStatsResponse, MemoryEntriesResponse, MemoryEntryResponse, MemoryBackfillResponse, MemoryPurgeResponse, MemoryReembedResponse, MemoryScopeIDsResponse, MemoryScopesResponse, MemorySearchInput, MemorySearchResponse, PauseResult, RetentionOverride, PersistentVolumesResponse, EphemeralVolumesResponse, ResolveInterruptOptions, ResumeResult, ResolverMatrix, CompactRunResult, RunTreeDeletion, ReplaySessionResult, CancelTurnResult, ReviewRunResult, RunBatchOptions, RunBatchResult, RunOptions, ConfiguredRun, ConfiguredRunPatch, RunStateStreamItem, RuntimeStateResponse, SnapshotCreateResponse, SnapshotDescriptor, SnapshotEnvelope, SnapshotRestoreResponse, StreamUserRunStatesOptions, SubstrateToolInput, SubstrateToolResponse, CreatedTeam, ListTeamsResponse, PromotedTeam, RetiredTeam, TeamBreakpoints, TeamDefDetail, TeamRunDetached, TeamRunTarget, TeamVerification, TeamDraft, TeamDraftVerification, TeamVersionList, TeamDiagram, TeamRunResult, PathToolInput, PathToolResponse, DocumentToolInput, DocumentToolResponse, HistoryToolInput, HistoryToolResponse, TranscriptResponse, WhoamiResponse, UsageDimension, UsageReportResponse, TokenLimit, TokenLimitsResponse, ConfigResponse, SetTokenLimitRequest } from "./types.js";
 export declare class LoomcycleClient {
     private ctx;
     constructor(opts?: ClientOptions);
@@ -312,6 +312,36 @@ export declare class LoomcycleClient {
         reason?: string;
         signal?: AbortSignal;
     }): Promise<CompactRunResult>;
+    /** Permanently delete a run and every run it spawned, with what is stored
+     *  about them: transcripts, their sessions when no other run is left in
+     *  them, interrupts, evaluations of them, queued memory rows and indexed
+     *  turns. The usage ledger (tokens, cost) is kept. Mirrors
+     *  `DELETE /v1/runs/{run_id}/tree`.
+     *
+     *  Needs the `runs:delete` scope (an admin and a tenant operator have it;
+     *  any other token only if it was granted at mint) — a token without it
+     *  raises `LoomcycleError` with status 403. A run that does not exist, was
+     *  already deleted, or is not yours to read resolves with `deleted_runs: 0`
+     *  rather than raising, so repeating the call is safe. A tree holding a run
+     *  that is still running, awaiting input or paused deletes nothing and
+     *  raises `LoomcycleError` with `code: "run_tree_live"` (status 409): cancel
+     *  it first. `not_reached` names where a copy may remain that this call
+     *  cannot remove. To discard a configured run that never started, use
+     *  {@link LoomcycleClient.deleteConfiguredRun}. */
+    deleteRunTree(runId: string, opts?: {
+        signal?: AbortSignal;
+    }): Promise<RunTreeDeletion>;
+    /** Permanently delete every run of a session, each with the runs it
+     *  spawned — {@link LoomcycleClient.deleteRunTree} for all of them at once.
+     *  `cascade: "children"` is required and is the only mode: there is no
+     *  delete that leaves sub-agent runs behind. Mirrors
+     *  `DELETE /v1/sessions/{session_id}?cascade=children`. Same scope, same
+     *  zero-count answer for a session you cannot read, same `run_tree_live`
+     *  refusal. */
+    deleteSession(sessionId: string, opts: {
+        cascade: "children";
+        signal?: AbortSignal;
+    }): Promise<RunTreeDeletion>;
     /**
      * Replay a session's transcript into a NEW session bound to a (possibly
      * different) target agent, so that agent continues from the same context
@@ -478,6 +508,38 @@ export declare class LoomcycleClient {
         tenant?: string;
         signal?: AbortSignal;
     }): Promise<void>;
+    /** The timed no-trace overrides in force: agents whose runs are being
+     *  stored although they normally store none. An admin sees every tenant's
+     *  (or one with `tenant`); a tenant operator sees its own. Mirrors
+     *  `GET /v1/_retention/overrides`. */
+    listRetentionOverrides(opts?: {
+        /** Admin-only tenant focus; ignored for a tenant operator. */
+        tenant?: string;
+        signal?: AbortSignal;
+    }): Promise<{
+        overrides: RetentionOverride[];
+    }>;
+    /** Store the runs of one no-trace agent until `until`, to debug it. At
+     *  most 24 hours ahead; setting one replaces the last. It lifts a mode
+     *  that came from the agent's definition or the run request, never one a
+     *  token requires. Audited. `tenant` is admin-only: a tenant operator's
+     *  override is always for its own tenant. Mirrors
+     *  `PUT /v1/_retention/overrides`. */
+    setRetentionOverride(body: {
+        agent: string;
+        until: string | Date;
+        tenant?: string;
+    }, opts?: {
+        signal?: AbortSignal;
+    }): Promise<RetentionOverride>;
+    /** End an agent's no-trace override before it runs out. Clearing one that
+     *  is not there is not an error. Mirrors
+     *  `DELETE /v1/_retention/overrides`. */
+    clearRetentionOverride(agent: string, opts?: {
+        /** Admin-only target tenant; ignored for a tenant operator. */
+        tenant?: string;
+        signal?: AbortSignal;
+    }): Promise<void>;
     /** Ask a decision model typed questions (`choice` / `noul` / `score`) about
      *  `state` and get each answer with its probabilities. A decision model does
      *  not write: there is no reply to parse and the call costs a few output
@@ -544,9 +606,47 @@ export declare class LoomcycleClient {
      *  scopes are DERIVED server-side from the member's access_mode (never sent),
      *  and the plaintext `token` is returned exactly ONCE — store it now, it is
      *  never retrievable again. 404 for an unknown/cross-tenant subject; 409 for
-     *  a disabled user. */
+     *  a disabled user.
+     *
+     *  `ttlSeconds` gives the token a fixed lifetime: it stops authenticating
+     *  when that runs out, and the answer carries `expires_at`. It cannot run
+     *  past the end of the token making the call. `name` labels it (stored as
+     *  `u-<name>`).
+     *  `maxActive` keeps at most that many of the user's tokens alive — the
+     *  oldest beyond it are retired at once and listed in `retired`.
+     *
+     *  `agents` limits the token to starting those agents as top-level runs, and
+     *  to the run endpoints: it is refused everywhere else (403
+     *  `restricted_token`), and refused any other agent (403
+     *  `agent_not_allowed`). An agent that a listed one spawns is not limited.
+     *  An empty list is refused; omit the option for no limit.
+     *
+     *  `overrides` locks the per-run settings for runs the token starts, and
+     *  for retunes it makes: `"none"` locks them all (model, provider, tier,
+     *  effort, sampling, limits, output format and the rest), a list names the
+     *  ones it may still set. A request that sets a locked one is refused with
+     *  403 `override_not_allowed`.
+     *
+     *  `rate` bounds how often the token may start runs: `perMinute` runs a
+     *  minute, with `burst` allowed at once from idle (default: `perMinute`).
+     *  A start past the rate is refused with 429 `rate_limited` and a
+     *  `Retry-After` header.
+     *
+     *  With none of the options the request has no body, as before. */
     mintUserToken(subject: string, opts?: {
         signal?: AbortSignal;
+        ttlSeconds?: number;
+        name?: string;
+        maxActive?: number;
+        agents?: string[];
+        overrides?: "none" | string[];
+        rate?: {
+            perMinute: number;
+            burst?: number;
+        };
+        /** `"none"`: every run the token starts is a no-trace run, whatever
+         *  the request or the agent says. */
+        retention?: "none";
     }): Promise<MintedUserToken>;
     /** List the caller's own user's delegated tokens — METADATA ONLY (never the
      *  plaintext or hash). `active` applies the auth-layer validity rule so a

package/dist/client.js

@@ -135,6 +135,8 @@ function runBody(opts) {
         body.idempotency_key = opts.idempotencyKey;
     if (opts.maxWallSeconds !== undefined)
         body.max_wall_seconds = opts.maxWallSeconds;
+    if (opts.retention !== undefined)
+        body.retention = opts.retention;
     if (opts.metadata !== undefined)
         body.metadata = opts.metadata;
     if (opts.runTimeoutSeconds !== undefined)
@@ -598,6 +600,35 @@ export class LoomcycleClient {
             body.reason = opts.reason;
         return postJSON(this.ctx, `/v1/runs/${encodeURIComponent(runId)}/compact`, body, opts);
     }
+    /** Permanently delete a run and every run it spawned, with what is stored
+     *  about them: transcripts, their sessions when no other run is left in
+     *  them, interrupts, evaluations of them, queued memory rows and indexed
+     *  turns. The usage ledger (tokens, cost) is kept. Mirrors
+     *  `DELETE /v1/runs/{run_id}/tree`.
+     *
+     *  Needs the `runs:delete` scope (an admin and a tenant operator have it;
+     *  any other token only if it was granted at mint) — a token without it
+     *  raises `LoomcycleError` with status 403. A run that does not exist, was
+     *  already deleted, or is not yours to read resolves with `deleted_runs: 0`
+     *  rather than raising, so repeating the call is safe. A tree holding a run
+     *  that is still running, awaiting input or paused deletes nothing and
+     *  raises `LoomcycleError` with `code: "run_tree_live"` (status 409): cancel
+     *  it first. `not_reached` names where a copy may remain that this call
+     *  cannot remove. To discard a configured run that never started, use
+     *  {@link LoomcycleClient.deleteConfiguredRun}. */
+    async deleteRunTree(runId, opts) {
+        return deleteJSON(this.ctx, `/v1/runs/${encodeURIComponent(runId)}/tree`, opts);
+    }
+    /** Permanently delete every run of a session, each with the runs it
+     *  spawned — {@link LoomcycleClient.deleteRunTree} for all of them at once.
+     *  `cascade: "children"` is required and is the only mode: there is no
+     *  delete that leaves sub-agent runs behind. Mirrors
+     *  `DELETE /v1/sessions/{session_id}?cascade=children`. Same scope, same
+     *  zero-count answer for a session you cannot read, same `run_tree_live`
+     *  refusal. */
+    async deleteSession(sessionId, opts) {
+        return deleteJSON(this.ctx, `/v1/sessions/${encodeURIComponent(sessionId)}?cascade=${encodeURIComponent(opts.cascade)}`, opts);
+    }
     /**
      * Replay a session's transcript into a NEW session bound to a (possibly
      * different) target agent, so that agent continues from the same context
@@ -787,6 +818,36 @@ export class LoomcycleClient {
             params.set("tenant", opts.tenant);
         return deleteRequest(this.ctx, `/v1/_limits?${params.toString()}`, opts);
     }
+    /** The timed no-trace overrides in force: agents whose runs are being
+     *  stored although they normally store none. An admin sees every tenant's
+     *  (or one with `tenant`); a tenant operator sees its own. Mirrors
+     *  `GET /v1/_retention/overrides`. */
+    async listRetentionOverrides(opts) {
+        const q = opts?.tenant ? `?tenant=${encodeURIComponent(opts.tenant)}` : "";
+        return jsonFetch(this.ctx, `/v1/_retention/overrides${q}`, opts);
+    }
+    /** Store the runs of one no-trace agent until `until`, to debug it. At
+     *  most 24 hours ahead; setting one replaces the last. It lifts a mode
+     *  that came from the agent's definition or the run request, never one a
+     *  token requires. Audited. `tenant` is admin-only: a tenant operator's
+     *  override is always for its own tenant. Mirrors
+     *  `PUT /v1/_retention/overrides`. */
+    async setRetentionOverride(body, opts) {
+        const until = body.until instanceof Date ? body.until.toISOString() : body.until;
+        const wire = { agent: body.agent, until };
+        if (body.tenant !== undefined)
+            wire.tenant = body.tenant;
+        return putJSON(this.ctx, "/v1/_retention/overrides", wire, opts);
+    }
+    /** End an agent's no-trace override before it runs out. Clearing one that
+     *  is not there is not an error. Mirrors
+     *  `DELETE /v1/_retention/overrides`. */
+    async clearRetentionOverride(agent, opts) {
+        const params = new URLSearchParams({ agent });
+        if (opts?.tenant)
+            params.set("tenant", opts.tenant);
+        return deleteRequest(this.ctx, `/v1/_retention/overrides?${params.toString()}`, opts);
+    }
     /** Ask a decision model typed questions (`choice` / `noul` / `score`) about
      *  `state` and get each answer with its probabilities. A decision model does
      *  not write: there is no reply to parse and the call costs a few output
@@ -866,9 +927,51 @@ export class LoomcycleClient {
      *  scopes are DERIVED server-side from the member's access_mode (never sent),
      *  and the plaintext `token` is returned exactly ONCE — store it now, it is
      *  never retrievable again. 404 for an unknown/cross-tenant subject; 409 for
-     *  a disabled user. */
+     *  a disabled user.
+     *
+     *  `ttlSeconds` gives the token a fixed lifetime: it stops authenticating
+     *  when that runs out, and the answer carries `expires_at`. It cannot run
+     *  past the end of the token making the call. `name` labels it (stored as
+     *  `u-<name>`).
+     *  `maxActive` keeps at most that many of the user's tokens alive — the
+     *  oldest beyond it are retired at once and listed in `retired`.
+     *
+     *  `agents` limits the token to starting those agents as top-level runs, and
+     *  to the run endpoints: it is refused everywhere else (403
+     *  `restricted_token`), and refused any other agent (403
+     *  `agent_not_allowed`). An agent that a listed one spawns is not limited.
+     *  An empty list is refused; omit the option for no limit.
+     *
+     *  `overrides` locks the per-run settings for runs the token starts, and
+     *  for retunes it makes: `"none"` locks them all (model, provider, tier,
+     *  effort, sampling, limits, output format and the rest), a list names the
+     *  ones it may still set. A request that sets a locked one is refused with
+     *  403 `override_not_allowed`.
+     *
+     *  `rate` bounds how often the token may start runs: `perMinute` runs a
+     *  minute, with `burst` allowed at once from idle (default: `perMinute`).
+     *  A start past the rate is refused with 429 `rate_limited` and a
+     *  `Retry-After` header.
+     *
+     *  With none of the options the request has no body, as before. */
     async mintUserToken(subject, opts) {
-        return postJSON(this.ctx, `/v1/_users/${encodeURIComponent(subject)}/tokens`, undefined, opts);
+        const body = {};
+        if (opts?.ttlSeconds !== undefined)
+            body.ttl_seconds = opts.ttlSeconds;
+        if (opts?.name !== undefined)
+            body.name = opts.name;
+        if (opts?.maxActive !== undefined)
+            body.max_active = opts.maxActive;
+        if (opts?.agents !== undefined)
+            body.agents = opts.agents;
+        if (opts?.overrides !== undefined)
+            body.overrides = opts.overrides;
+        if (opts?.rate !== undefined) {
+            body.rate = { per_minute: opts.rate.perMinute, burst: opts.rate.burst };
+        }
+        if (opts?.retention !== undefined)
+            body.retention = opts.retention;
+        return postJSON(this.ctx, `/v1/_users/${encodeURIComponent(subject)}/tokens`, Object.keys(body).length > 0 ? body : undefined, { signal: opts?.signal });
     }
     /** List the caller's own user's delegated tokens — METADATA ONLY (never the
      *  plaintext or hash). `active` applies the auth-layer validity rule so a

package/dist/index.d.ts

@@ -16,6 +16,8 @@
  *     cancelAgent(agentId, opts?): Promise<CancelAgentResult>
  *     listUserAgents(userId, opts?): Promise<Agent[]>
  *     listWalkRuns(walkId, opts?): Promise<WalkRunsPage>
+ *     deleteRunTree(runId, opts?): Promise<RunTreeDeletion>     // needs runs:delete
+ *     deleteSession(sessionId, {cascade: "children"}): Promise<RunTreeDeletion>
  *     getTranscript(sessionId): Promise<TranscriptResponse>
  *     health(): Promise<HealthResponse>
  *     listUsers(opts?): Promise<ListUsersResponse>   // tenant-scoped (RFC L)
@@ -132,5 +134,5 @@ export { InteractiveSession } from "./interactive.js";
 export type { InteractiveSessionOps } from "./interactive.js";
 export { ClientToolHost, clientToolsURL, CLIENT_TOOL_SUBPROTOCOL } from "./client-tools.js";
 export type { ClientToolSchema, ClientToolInvocation, ConnectClientToolsOptions, WebSocketLike, WebSocketCtor, } from "./client-tools.js";
-export type { AgentEvent, ClientOptions, ContinueOptions, EventType, HostWidening, ImageMediaType, ParentContext, PromptContent, PromptSegment, RetryInfo, RunOptions, SamplingOptions, CompactionOptions, ContextOptions, ToolUse, Usage, CallTiming, Agent, AgentStatus, AwaitedState, AgentUsage, RunResult, RunSpec, RunSpecTeam, ConfiguredRun, ConfiguredRunPatch, ToolChoiceOptions, OutputFormatOptions, CancelAgentResult, ListAgentsResponse, WalkRunsPage, RunBatchOptions, RunBatchResult, SpawnRunResult, CompactRunResult, DirectoryBudget, DirectoryInspection, DirectoryTenant, DirectoryUser, ErasureReport, ErasureResidue, ErasureResult, ErasureTier, CancelTurnResult, ReviewRunResult, TranscriptEvent, TranscriptResponse, HealthResponse, ListUsersResponse, UserSummary, UserRecord, CreateUserBody, UpdateUserBody, MintedUserToken, UserTokenMeta, ListUserTokensResponse, RunnableAgent, RunnableAgentsResponse, WhoamiResponse, PauseResult, ResumeResult, RuntimeStateResponse, RuntimeStateStatus, ResolverMatrix, ResolverModelStatus, ResolverProviderAvailability, CreateSnapshotOptions, SnapshotCreateResponse, SnapshotDescriptor, SnapshotEnvelope, SnapshotListResponse, SnapshotRestoreResponse, MemoryEntriesResponse, MemoryEntry, MemoryEntryResponse, MemoryScopeIDsResponse, MemoryScopeIDSummary, MemoryScopeKind, MemoryScopesResponse, MemorySearchInput, MemorySource, MemoryWhen, MemoryTimeFilter, MemorySearchEntry, MemorySearchResponse, MemoryEmbedModelStats, MemoryEmbedStatsResponse, MemoryReembedConfigured, MemoryReembedResponse, MemoryBackfillResponse, MemoryPurgeResponse, InterruptListResponse, InterruptRow, InterruptStatus, ResolveInterruptOptions, ChannelHookCall, ChannelHookResult, HookFailMode, HookPhase, HookToolCall, HookToolResult, PostHookCall, PostHookResult, PreHookCall, PreHookResult, SubstrateToolInput, SubstrateToolResponse, TeamNameSummary, ListTeamsResponse, TeamDiagram, CreatedTeam, PromotedTeam, RetiredTeam, TeamDefDetail, TeamVerification, TeamDraft, TeamDraftVerification, TeamIssue, TeamIssueKind, TeamVersion, TeamVersionList, TeamBreakpoints, TeamRunDetached, TeamRunResult, TeamRunTarget, PathToolInput, PathToolResponse, DocumentToolInput, DocumentToolResponse, HistoryToolInput, HistoryToolResponse, VolumeMode, PersistentVolumeEntry, PersistentVolumesResponse, EphemeralVolumeEntry, EphemeralVolumesResponse, SystemPromptPayload, UserInputPayload, ChannelDescriptor, ListChannelsResponse, RunStateEvent, RunStateStreamClose, RunStateStreamItem, RunStateStreamOpen, StreamUserRunStatesOptions, AckChannelOptions, ChannelAckResult, ChannelMessageItem, ChannelPeekResult, ListTeamChannelsOptions, PeekTeamChannelOptions, ReleaseTeamChannelOptions, TeamChannelReleaseResult, TeamChannelDeclaredIn, TeamChannelDescriptor, TeamChannelPeekResult, TeamChannelsResult, ChannelPublishResult, ChannelPurgeResult, ChannelReleaseResult, ChannelScope, ChannelSubscribeResult, PeekChannelOptions, PublishChannelOptions, SubscribeChannelOptions, AwaitChannelsOptions, BroadcastChannelsOptions, ChannelAwaitEntry, ChannelAwaitMode, ChannelAwaitResult, ChannelBroadcastEntry, ChannelBroadcastResult, CreateChannelOptions, ReleaseChannelOptions, UpdateChannelOptions, SetMemoryEntryOptions, SetMemoryEntryResponse, AgentDefRowResponse, AgentDefVerifyResult, SkillDefVerifyResult, EnsureMcpServerOptions, EnsureMcpServerResult, MCPServerDefRowResponse, MCPServerDefVerifyResult, AgentDefOverlay, HookEvent, InlineWebhook, HookEntry, EventHooks, ToolEntry, ToolHooksByTool, EnsureCodeAgentOptions, EnsureCodeAgentResult, LibraryAgentDefinition, LibraryEntry, LibraryListResponse, LibraryMcpServerDefinition, LibrarySkillDefinition, LLMChatContent, LLMChatMessage, LLMChatOptions, LLMChatResponse, LLMChatStreamDelta, LLMChatStreamItem, LLMChatToolCall, LLMChatUsage, LLMTool, LLMEmbeddingItem, LLMEmbeddingsOptions, LLMEmbeddingsResponse, LLMEmbeddingsUsage, UsageDimension, UsageAggregate, UsageReportResponse, CapabilityInertInfo, LimitInfo, ErrorInfo, CallFormat, CallRef, HookDecisionInfo, TeamDecisionInfo, EffectiveConfigResponse, EffectiveConfigSource, EffectiveValue, RetuneRunResponse, RunConfigRecord, SubagentHoldInfo, RunConfigResponse, RunPromptResponse, RunPromptSnapshot, PromptBlock, TokenLimit, TokenLimitsResponse, ConfigResponse, ConfigProvider, ConfigModel, ConfigSearch, ConfigInstance, SetTokenLimitRequest, CredentialScope, CredentialMeta, CredentialListResponse, DecideRequest, DecideResponse, DecisionQuestion, DecisionChoiceQuestion, DecisionNoulQuestion, DecisionScoreQuestion, DecisionAnswer, DecisionChoiceAnswer, DecisionNoulAnswer, DecisionScoreAnswer, DecisionModel, DecisionModelsResponse, } from "./types.js";
+export type { AgentEvent, ClientOptions, ContinueOptions, EventType, HostWidening, ImageMediaType, ParentContext, PromptContent, PromptSegment, RetryInfo, RunOptions, SamplingOptions, CompactionOptions, ContextOptions, ToolUse, Usage, CallTiming, Agent, AgentStatus, AwaitedState, AgentUsage, RunResult, RunSpec, RunSpecTeam, ConfiguredRun, ConfiguredRunPatch, ToolChoiceOptions, OutputFormatOptions, CancelAgentResult, ListAgentsResponse, WalkRunsPage, RunBatchOptions, RunBatchResult, SpawnRunResult, CompactRunResult, RunTreeDeletion, RunTreeNotReached, DirectoryBudget, DirectoryInspection, DirectoryTenant, DirectoryUser, ErasureReport, ErasureResidue, ErasureResult, ErasureTier, CancelTurnResult, ReviewRunResult, TranscriptEvent, TranscriptResponse, HealthResponse, ListUsersResponse, UserSummary, UserRecord, CreateUserBody, UpdateUserBody, MintedUserToken, TokenRestrictions, UserTokenMeta, ListUserTokensResponse, RunnableAgent, RunnableAgentsResponse, WhoamiResponse, PauseResult, RetentionOverride, ResumeResult, RuntimeStateResponse, RuntimeStateStatus, ResolverMatrix, ResolverModelStatus, ResolverProviderAvailability, CreateSnapshotOptions, SnapshotCreateResponse, SnapshotDescriptor, SnapshotEnvelope, SnapshotListResponse, SnapshotRestoreResponse, MemoryEntriesResponse, MemoryEntry, MemoryEntryResponse, MemoryScopeIDsResponse, MemoryScopeIDSummary, MemoryScopeKind, MemoryScopesResponse, MemorySearchInput, MemorySource, MemoryWhen, MemoryTimeFilter, MemorySearchEntry, MemorySearchResponse, MemoryEmbedModelStats, MemoryEmbedStatsResponse, MemoryReembedConfigured, MemoryReembedResponse, MemoryBackfillResponse, MemoryPurgeResponse, InterruptListResponse, InterruptRow, InterruptStatus, ResolveInterruptOptions, ChannelHookCall, ChannelHookResult, HookFailMode, HookPhase, HookToolCall, HookToolResult, PostHookCall, PostHookResult, PreHookCall, PreHookResult, SubstrateToolInput, SubstrateToolResponse, TeamNameSummary, ListTeamsResponse, TeamDiagram, CreatedTeam, PromotedTeam, RetiredTeam, TeamDefDetail, TeamVerification, TeamDraft, TeamDraftVerification, TeamIssue, TeamIssueKind, TeamVersion, TeamVersionList, TeamBreakpoints, TeamRunDetached, TeamRunResult, TeamRunTarget, PathToolInput, PathToolResponse, DocumentToolInput, DocumentToolResponse, HistoryToolInput, HistoryToolResponse, VolumeMode, PersistentVolumeEntry, PersistentVolumesResponse, EphemeralVolumeEntry, EphemeralVolumesResponse, SystemPromptPayload, UserInputPayload, ChannelDescriptor, ListChannelsResponse, RunStateEvent, RunStateStreamClose, RunStateStreamItem, RunStateStreamOpen, StreamUserRunStatesOptions, AckChannelOptions, ChannelAckResult, ChannelMessageItem, ChannelPeekResult, ListTeamChannelsOptions, PeekTeamChannelOptions, ReleaseTeamChannelOptions, TeamChannelReleaseResult, TeamChannelDeclaredIn, TeamChannelDescriptor, TeamChannelPeekResult, TeamChannelsResult, ChannelPublishResult, ChannelPurgeResult, ChannelReleaseResult, ChannelScope, ChannelSubscribeResult, PeekChannelOptions, PublishChannelOptions, SubscribeChannelOptions, AwaitChannelsOptions, BroadcastChannelsOptions, ChannelAwaitEntry, ChannelAwaitMode, ChannelAwaitResult, ChannelBroadcastEntry, ChannelBroadcastResult, CreateChannelOptions, ReleaseChannelOptions, UpdateChannelOptions, SetMemoryEntryOptions, SetMemoryEntryResponse, AgentDefRowResponse, AgentDefVerifyResult, SkillDefVerifyResult, EnsureMcpServerOptions, EnsureMcpServerResult, MCPServerDefRowResponse, MCPServerDefVerifyResult, AgentDefOverlay, HookEvent, InlineWebhook, HookEntry, EventHooks, ToolEntry, ToolHooksByTool, EnsureCodeAgentOptions, EnsureCodeAgentResult, LibraryAgentDefinition, LibraryEntry, LibraryListResponse, LibraryMcpServerDefinition, LibrarySkillDefinition, LLMChatContent, LLMChatMessage, LLMChatOptions, LLMChatResponse, LLMChatStreamDelta, LLMChatStreamItem, LLMChatToolCall, LLMChatUsage, LLMTool, LLMEmbeddingItem, LLMEmbeddingsOptions, LLMEmbeddingsResponse, LLMEmbeddingsUsage, UsageDimension, UsageAggregate, UsageReportResponse, CapabilityInertInfo, LimitInfo, ErrorInfo, CallFormat, CallRef, HookDecisionInfo, TeamDecisionInfo, EffectiveConfigResponse, EffectiveConfigSource, EffectiveValue, RetuneRunResponse, RunConfigRecord, SubagentHoldInfo, RunConfigResponse, RunPromptResponse, RunPromptSnapshot, PromptBlock, TokenLimit, TokenLimitsResponse, ConfigResponse, ConfigProvider, ConfigModel, ConfigSearch, ConfigInstance, SetTokenLimitRequest, CredentialScope, CredentialMeta, CredentialListResponse, DecideRequest, DecideResponse, DecisionQuestion, DecisionChoiceQuestion, DecisionNoulQuestion, DecisionScoreQuestion, DecisionAnswer, DecisionChoiceAnswer, DecisionNoulAnswer, DecisionScoreAnswer, DecisionModel, DecisionModelsResponse, } from "./types.js";
 export { AgentIDInUseError, AgentNotFoundError, AlreadyPausingError, AuthError, BackpressureError, NotFoundError, InvalidArgumentError, ChannelCursorRegressionError, LoomcycleError, NotPausedError, PauseNotConfiguredError, PerUserQuotaExhaustedError, PromptTooLargeError, RequestTooLargeError, SessionBusyError, SessionNotFoundError, SnapshotNotFoundError, SnapshotTooLargeError, SnapshotVersionError, SubstrateToolRefusedError, TokenLimitExceededError, UnavailableError, } from "./errors.js";

package/dist/index.js

@@ -16,6 +16,8 @@
  *     cancelAgent(agentId, opts?): Promise<CancelAgentResult>
  *     listUserAgents(userId, opts?): Promise<Agent[]>
  *     listWalkRuns(walkId, opts?): Promise<WalkRunsPage>
+ *     deleteRunTree(runId, opts?): Promise<RunTreeDeletion>     // needs runs:delete
+ *     deleteSession(sessionId, {cascade: "children"}): Promise<RunTreeDeletion>
  *     getTranscript(sessionId): Promise<TranscriptResponse>
  *     health(): Promise<HealthResponse>
  *     listUsers(opts?): Promise<ListUsersResponse>   // tenant-scoped (RFC L)

package/dist/types.d.ts

@@ -859,6 +859,17 @@ export interface RunOptions extends RunOverrideOptions {
      *  is the time bound for a `mode: "detach"` batch child, where `timeoutMs`
      *  is refused. Any agent, model-driven or code-js. */
     maxWallSeconds?: number;
+    /** `"none"` makes this a no-trace run: what it says is delivered on this
+     *  stream and stored nowhere — the server keeps a marker for each event
+     *  (its type and size) and a class for an error, never the text. Omit (or
+     *  `"default"`) to leave the mode to the agent and your token, either of
+     *  which may still make the run no-trace: the strictest wins.
+     *
+     *  A no-trace run cannot be interactive, held for review, put in an
+     *  existing session, continued, compacted or retuned; each is refused with
+     *  `retention_none_unsupported`. A detached one returns its id and nothing
+     *  readable afterwards, so the agent must deliver its own result. */
+    retention?: "none" | "default";
     /** Optional NON-SECRET structured metadata passed to the agent (repo
      *  name, review policy, preferred skills, …) — symmetric with the
      *  WebHook/Schedule trigger paths. As a first-party (bearer-authed)
@@ -1237,6 +1248,9 @@ export interface Agent {
     started_at: string;
     completed_at: string | null;
     stop_reason: string | null;
+    /** `"none"` for a no-trace run: its transcript holds markers, not content,
+     *  and `error` is a class. Absent on every other run. */
+    retention?: string;
     error: string | null;
     usage: AgentUsage;
     last_heartbeat_at: string | null;
@@ -1299,6 +1313,10 @@ export type ConfiguredRunPatch = Partial<Omit<RunOptions, "agent" | "sessionId"
  *  Keys and nested values are the server's snake_case wire names (not the
  *  camelCase request options), so nested blocks are left untyped. */
 export interface RunSpec {
+    /** `"none"` for a no-trace run, whose record holds its mode and none of
+     *  its settings: such a run stores no content and is never resumed. Absent
+     *  on every other run. */
+    retention?: string;
     sampling?: Record<string, unknown>;
     tool_choice?: ToolChoiceOptions;
     output_format?: OutputFormatOptions;
@@ -1663,6 +1681,35 @@ export interface CompactRunResult {
     after_tokens: number;
     applied: "live" | "marker" | "noop";
 }
+/** One place a run-tree delete could not reach: a copy of the deleted
+ *  content may still be there. */
+export interface RunTreeNotReached {
+    /** `snapshots`, `retention_exports`, `derived_facts` or `trace_index`. */
+    name: string;
+    /** How many items may be affected. Absent when that is not cheap to know. */
+    count?: number;
+    /** The count stopped at a bound: there may be more. */
+    count_is_floor?: boolean;
+    reason: string;
+}
+/** Result of {@link LoomcycleClient.deleteRunTree} and
+ *  {@link LoomcycleClient.deleteSession}. */
+export interface RunTreeDeletion {
+    /** The root that was asked for (one of the two). */
+    run_id?: string;
+    session_id?: string;
+    /** How many runs went: the root and its descendants. 0 when the root does
+     *  not exist, was already deleted, or is not the caller's to read. */
+    deleted_runs: number;
+    /** Rows removed, by table (`runs`, `events`, `sessions`,
+     *  `session_embeddings`, `interrupts`, `evaluations`, `memory_pending`,
+     *  `trace_index`). Every table is present, at 0 when nothing went. */
+    counts: Record<string, number>;
+    /** What is left in place on purpose, and why (the usage ledger). */
+    kept: Record<string, string>;
+    /** Empty when nothing was deleted. */
+    not_reached: RunTreeNotReached[];
+}
 /** Result of {@link LoomcycleClient.replaySession} (RFC BJ Phase 4) — a NEW
  * session bound to the target agent, seeded with the source conversation.
  * Continue `new_session_id` with the normal message/run path; the carried
@@ -1800,8 +1847,31 @@ export interface MintedUserToken {
     name: string;
     scopes: string[];
     created_at: string;
+    /** Set when the token was minted with a lifetime: it stops authenticating
+     *  at this instant. */
+    expires_at?: string;
+    /** def_ids of the user's older tokens that `maxActive` retired. */
+    retired?: string[];
+    /** What narrows the token below its scopes, when anything does. */
+    restrictions?: TokenRestrictions;
     warning: string;
 }
+/** A token's restrictions. `agents` is the complete list of agents the token
+ *  may start as top-level runs; a token carrying one is also limited to the
+ *  run endpoints. */
+export interface TokenRestrictions {
+    agents?: string[];
+    /** `"none"` when every per-run override is locked, or the overrides the
+     *  token may still set. Absent when nothing is locked. */
+    overrides?: "none" | string[];
+    /** How often the token may start runs. */
+    rate?: {
+        per_minute: number;
+        burst?: number;
+    };
+    /** `"none"` when every run the token starts is a no-trace run. */
+    retention?: "none";
+}
 /** One token row from GET /v1/_users/{subject}/tokens — METADATA ONLY (never
  *  the plaintext or hash). `active` applies the auth-layer validity rule. */
 export interface UserTokenMeta {
@@ -1810,6 +1880,9 @@ export interface UserTokenMeta {
     scopes: string[];
     created_at: string;
     retired_at?: string;
+    expires_at?: string;
+    restrictions?: TokenRestrictions;
+    /** False once the token is retired or expired. */
     active: boolean;
 }
 export interface ListUserTokensResponse {
@@ -1838,12 +1911,28 @@ export interface WhoamiResponse {
     open_mode?: boolean;
 }
 export type RuntimeStateStatus = "running" | "pausing" | "paused";
+/** A timed override of an agent's no-trace mode: until `until`, runs of
+ *  `agent` in `tenant` are stored like any other. It lifts a mode that came
+ *  from the agent's definition or the run request, never one a token
+ *  requires. */
+export interface RetentionOverride {
+    tenant: string;
+    agent: string;
+    /** RFC 3339. */
+    until: string;
+    set_by?: string;
+    created_at?: string;
+}
 export interface PauseResult {
     state: string;
     duration_ms: number;
     /** Always 0: pause cancels no tool call. Kept for wire compatibility. */
     force_cancelled_count: number;
     paused_runs_count: number;
+    /** No-trace runs on the serving replica that the pause did not park: they
+     *  have nothing stored to resume from, keep running, and are left out of a
+     *  snapshot. Absent when there are none. */
+    unpausable_runs_count?: number;
     warnings?: string[];
 }
 export interface ResumeResult {
@@ -3680,6 +3769,15 @@ export interface AgentDefOverlay {
      *  (only where an operator generated them). A chunk found through a unit carries
      *  `matched_unit: {kind, text}`. */
     memory_units?: boolean;
+    /** `false` locks the agent's per-run overrides for every caller: a run
+     *  request that sets one (model, effort, limits, sampling, hooks, …) is
+     *  refused with `override_not_allowed`. Unset or `true` leaves them to the
+     *  caller. A fork that does not send it keeps its parent's. */
+    allow_overrides?: boolean;
+    /** `"none"` makes every run of the agent a no-trace run: its content is
+     *  delivered to the caller and stored nowhere. A fork that does not send it
+     *  keeps its parent's, and `"default"` on a no-trace parent is refused. */
+    retention?: "none" | "default";
     memory_quota_bytes?: number;
     memory_backend?: string;
     retry_attempts?: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@loomcycle/client",
-  "version": "1.111.0",
+  "version": "1.112.0",
   "description": "TypeScript client for the loomcycle sidecar (HTTP+SSE). 71 methods covering run streaming, agent metadata, pause/resume/state, resolver re-probe (resolveProbe — issue #88 operator escape hatch), operator-token admin (operatorTokenDef — RFC L OSS multi-tenant auth) + whoami (RFC L authoritative principal, v0.17.0) + tenant-scoped listUsers / listUserAgents, dynamic MCP registration (mcpServerDef + v0.18.0 typed mcpServerDefVerify + ensureMcpServer idempotent register-if-changed), snapshot lifecycle, memory admin (incl. v0.9.0 Vector Memory embed_stats + reembed AND v0.11.5 setMemoryEntry + deleteMemoryEntry), interruption resolve, hook management, v0.8.22 substrate admin (agentDef + skillDef), v0.9.x n8n Phase 0 (listChannels + streamUserRunStates), v0.9.x Channel CRUD (publishChannel + subscribeChannel + peekChannel + ackChannel), v0.11.5 Channel admin CRUD (createChannel + updateChannel + deleteChannel — runtime substrate; yaml channels refuse mutation with HTTP 409), v0.9.x content_sha256 verify, v0.9.1 transcript first-cycle, v0.9.x dynamic MCP server registration (mcpServerDef + MCPServerDefVerifyResult), v0.10.3 Library v2 enumeration (listLibraryAgents + listLibrarySkills + listLibraryMcpServers), and v0.11.0 LLM Gateway (llmChat + llmStream — direct provider routing without agent overhead; primary target is n8n's LoomCycleChatModel AI Agent sub-node and any LangChain-compatible consumer). v0.10.1 — dual ESM + CommonJS distribution (additive — ESM consumers unchanged; CJS consumers like n8n's community-node loader now work). v0.19.0 — typed inline code-js agent ingestion (AgentDefOverlay.code_body + ensureCodeAgent — register a deterministic code agent through the substrate with no host filesystem bind; RFC J). v0.20.0 — ensureMcpServer surfaces discoveredToolCount straight from create (loomcycle now auto-discovers MCP tools at ingestion); rediscover is now an explicit force-refresh. v0.21.0 — run/continue accept optional non-secret `metadata` (repo name, review policy, …) passed to the agent, symmetric with the WebHook/Schedule trigger paths. v0.22.0 — version-aligned lockstep release; no client-surface change (RFC N tenant isolation of the agent/skill/MCP/Schedule/Webhook definition plane + real op-schemas on the builtin MCP meta-tools are both server-side). v0.23.0 — version-aligned lockstep release; no client-surface change (RFCs O/P/R MCP-server hardening + thin client and the RFC Q DeepSeek tool-content fix are all server-side / MCP-transport-side). v0.24.0 — purgeChannel clears a channel's buffered messages without deleting its definition (allowed on yaml-declared channels too, unlike deleteChannel — F20); AgentDefOverlay gains channels / evaluation_scopes / interruption so a COMPLETE interactive/multi-agent agent round-trips over the substrate (F14). (Consolidates the interim 0.24/0.25 package bumps, which were never tag-published, back into lockstep with the loomcycle v0.24.0 tag.) v0.25.0 — adds the RFC S channel fan-in/fan-out client twins: awaitChannels() (wait for any/all/at_least N messages across channels, or a timeout — non-committing) + broadcastChannels() (publish one payload to N channels in one atomic-pre-flight call), the client-facing counterparts of the in-band Channel.await / Channel.broadcast tool ops (the rest of v0.25.0 — the manual-management Web UI console + Context op=time + max_fires self-retiring schedules — is server-side / in-band, no client-surface change). v0.29.1 — Usage gains optional `max_context_tokens` (the serving model's context-window ceiling, stamped by the loop from Provider.Capabilities() on each usage event) so a consumer can render a 'context used / max' gauge without a hard-coded per-model table; additive + optional, no behavior change. (Lockstep catch-up: the field landed in loomcycle v0.29.0 but the adapter publish skipped on a version mismatch; v0.29.1 realigns the package version with the release tag so it publishes.) v0.33.0 — gRPC + TS client parity for the RFC Y external fan-out and the compaction surface: spawnRunBatch() (POST /v1/runs:batch — spawn up to 32 fresh runs concurrently in one call, combined index-aligned envelope, per-child failures in-envelope) + compactRun(runId) (POST /v1/runs/{run_id}/compact — summarize a parked run's context); plus per-run sampling + compaction overrides now accepted on runStreaming / continueSession (an explicit temperature 0 is preserved as deterministic, not dropped as falsy). (The gRPC half adds the matching SpawnRunBatch / CompactRun RPCs + the sampling/compaction fields on RunRequest/ContinueRequest — server-side.) v0.34.0 — version-aligned lockstep release; no client-surface change (context-transform plugins / RFC Z Phase 1a are server-side config; the exp7 hardening pass is server-side; the R2 cross-provider thinking-model downgrade surfaces a new `model_downgraded` SSE event the generic stream passes through unchanged). v0.35.0 — RFC AH dynamic filesystem volumes: volumeDef() (POST /v1/_volumedef — op-discriminated create/get/list/delete/purge; a Volume is flat, so delete unmaps + purge RemoveAll's, no retire/promote/fork) + listVolumes() / listEphemeralVolumes() (GET /v1/_volumes[/ephemeral] — tenant-scoped; host paths redacted for non-operator callers). Tenant-confined; the runtime derives the path inside an operator-blessed dynamic_root, so callers pass name + mode, never a host path. v1.1.1 — RFC AI interactive agentic sessions: an `interactive: true` flag on runStreaming/continueSession (a run that parks at end_turn for steering) + sendRunInput(runId, text) (POST /v1/runs/{id}/input — steer a live run) + streamRunByID(runId, {fromSeq}) (GET /v1/runs/{id}/stream — re-attach by run_id; the operator's prior turns replay as `steer` events so a cold client reconstructs the whole conversation) + a high-level InteractiveSession driver (client.interactiveSession / attachInteractiveSession — events()/send()/cancel(), the adapter port of the Web UI run terminal). The AgentEvent union gains awaiting_input/steer/context_compaction frames. Version-aligned with the loomcycle v1.1.x line so the v1.1.1 tag publishes it (also carrying the previously-unpublished v0.35.0 volume surface). v1.4.0 — RFC AL Path VFS + RFC AK Document on the wire: path(input) (POST /v1/_path — a Unix-like filesystem over Memory/Volumes/Documents; resolve/ls/stat/mkdir/mv/rm) + document(input) (POST /v1/_document — chunked-graph documents; 13 ops, needs SQL Memory on the sidecar). Scope (agent/user/tenant) + tenant are resolved server-side from the authenticated principal, never the wire; an off-run scope:'user' op keys on the principal subject so it interoperates with that user's agent runs. New PathToolInput / DocumentToolInput types; responses are op-varying (unknown — narrow as needed). v1.7.0 — RFC AT image/vision input: the PromptContent union gains an `image` variant ({ type:'image'; media_type: ImageMediaType; data: base64-no-prefix }) accepted in a user segment by runStreaming / continueSession (segments pass through unchanged — no method change). The model must be vision-capable or the run errors before the call. New ImageMediaType type (image/png|jpeg|gif|webp). v1.12.1 — Path/Document browse-by-subject + the full Document op set (RFC AS/AK): path(input, opts) / document(input, opts) accept optional scopeId / tenant browse overrides sent as ?scope_id= / ?tenant= query params (server reads them from the URL, re-checks authorization; omit both to browse your own subject — byte-identical to the pre-RFC-AS request), and DocumentToolInput.op now covers all 16 backend ops (adds set_path, export_md, import_md) with the matching include_metadata / markdown fields. Additive — existing path() / document() callers are unchanged. v1.16.0 — RFC BC client-executed tools (local tool host): connectClientTools({tools,onInvoke}) opens a persistent WebSocket to /v1/client-tools, registers tools this client runs on the user's machine (browser DOM / files / shell), and answers the invoke frames loomcycle routes when an agent of your principal calls a client:<tool> — returning your reply as an ordinary tool result. Returns a ClientToolHost driver (.close() to stop; auto-reconnect); dependency-free (global WebSocket in browsers / Node 22+, or an injected WebSocketImpl like the ws package on older Node); the bearer rides the Sec-WebSocket-Protocol subprotocol (browsers can't set an Authorization header on a WebSocket). The runtime's first WebSocket surface. v1.45.0 — RFC BL P5 subject erasure: erasureReport(subject, {tenant}) (GET /v1/_erasure — what this deployment holds about one subject, in three tiers: deletable with existing primitives, subject-keyed but not deletable, and facts ABOUT the subject in scopes they do not own) + erasureExecute(subject, {dryRun, confirm, tenant}) (POST /v1/_erasure — removes tiers 1 and 2). DEFAULTS TO A DRY RUN: dryRun defaults true and a live run also requires confirm === subject. The tier-3 residue is traceable only through the subject's chats, which a live run deletes, so a report afterwards shows rows: 0 while those facts remain — the returned object is the only durable record of what was not reached; persist it. New ErasureReport / ErasureResult / ErasureTier / ErasureResidue types. v1.47.0 — RFC BV memory-view SDK: memorySearch() (POST /v1/_memory/search — off-run unified semantic search spanning k/v entries AND document-chunk bodies in one ranked list, each hit tagged kind memory|document with chunk_id on document hits) + memoryEmbedStats(scope) + reembedMemory(scope, scopeId, {dryRun,limit}) (the Vector Memory embed-admin reads the memory-view console needs; dry_run defaults true). Fact reads (list_facts + get_chunk's entity block) ride the existing document() passthrough. Additive — existing callers unchanged. v1.61.0 — RFC CJ per-run context-window override: runStreaming / continueSession accept an optional maxContextTokens (integer tokens) that wins over the agent's own max_context_tokens; omitted inherits it (which defers to the provider/driver default). Distinct from a model's output cap; primarily for local inference (Ollama num_ctx). Serialized as the snake_case max_context_tokens field on POST /v1/runs + the continuation body; additive, existing callers unchanged. v1.72.1 — the TeamDef version lifecycle: listTeamVersions(name) (op=list — every version of one team, newest first), promoteTeam(defId) (op=promote — point the active pointer, which is what a run BY NAME executes; forkTeam defaults to promote:false, so authoring and putting in force stay two steps), retireTeam(defId, retired) (op=retire — reversible and version-scoped, unlike deleteTeam) and verifyTeam(name, contentSha256) (op=verify — the drift check for a workflow kept in source control and pushed to several deployments; an absent team answers deployed:false rather than raising). The ops existed on the substrate and over HTTP; a client that could author a team could not put one in force.",
   "license": "Apache-2.0",
   "type": "module",