@loomcycle/client 1.114.0 → 1.116.0

package/README.md

@@ -596,6 +596,33 @@ const meta = await client.getCredential({ scope: "user", name: "GIT_TOKEN" });
 console.log(meta.allowed_urls ?? "unrestricted");
 ```
 
+### Crypto keys + the Crypto tool (RFC EP)
+
+A **crypto key** is a credential with `usage: "crypto"`: a `key_type` fixed for its life, numbered versions, and a `min_version` below which versions are retired. No call ever returns key material. `getCredential` / `listCredentials` report a crypto key's `usage`, `key_type`, `current_version`, `min_version` and `versions` (`{version, created_at, retired}`).
+
+| Method | Returns | Notes |
+|---|---|---|
+| `generateCryptoKey({ scope, name, key_type, expires_at? })` | `Promise<CredentialMeta>` | The server makes the material; nobody sees it. `{op: "generate"}`. |
+| `createCryptoKey({ scope, name, key_type, value, key_encoding?, expires_at? })` | `Promise<CredentialMeta>` | Bring material you already have; `value` is write-only. `{op: "create", usage: "crypto"}`. |
+| `createKmsCryptoKey({ scope, name, key_type, external, expires_at? })` | `Promise<CredentialMeta>` | Reference a key held in Vault Transit, AWS KMS or Google Cloud KMS (`external.backend`); only the reference is stored and every op is a KMS call. Credential fields are `$cred:<name>` in the key's scope. Rotate and retire it in the KMS. `{op: "create", usage: "crypto", backend, external}`. |
+| `rotateCryptoKey({ scope, name, value?, key_encoding? })` | `Promise<CredentialMeta>` | Adds a version and makes it current (generated unless `value` is given). `{op: "rotate"}`. |
+| `setCryptoKeyMinVersion({ scope, name, min_version })` | `Promise<CredentialMeta>` | Retires every version below it. Only goes up, at most to current+1. `{op: "set_min_version"}`. |
+| `deleteCryptoKeyVersion({ scope, name, version })` | `Promise<CredentialMeta>` | Deletes one **retired** version. `{op: "delete_version"}`. |
+| `exportCryptoKey({ scope, name, passphrase })` | `Promise<CryptoKeyExport>` | `{name, scope, blob}`: every version, encrypted under the passphrase (≥ 16 chars). Admin only, outside any run. `{op: "export_key"}`. |
+| `importCryptoKey({ scope, name, blob, passphrase })` | `Promise<CredentialMeta>` | The other side of `exportCryptoKey`, under the same `name`. Admin only, outside any run. `{op: "import_key"}`. |
+
+All post to `POST /v1/_credentialdef`. To delete a crypto key, retire every version (`min_version` = current+1), then `deleteCredential`.
+
+`crypto(input)` runs one Crypto-tool operation outside any run (`POST /v1/_crypto`): `encrypt` / `decrypt` / `rewrap` / `mac` / `verify_mac` / `sign` / `verify` / `public_key` / `totp` with a held key (`key`, or `cred` + `key_type`), and `hash` / `random` with none. The input is a `CryptoRequest` discriminated by `op`, and the return type follows it (`CryptoResultByOp`). The reachable keys are the token's tenant's and its own subject's user keys; an admin may add `tenant` to use another tenant's keys. Needs `substrate:tenant` (a tenant member's token gets a 403). A refusal — including a failed decrypt, which never says why — raises `SubstrateToolRefusedError`; each call counts against the token's run-start rate, and a spent rate raises `RateLimitedError` (`retryAfterMs`).
+
+```ts
+await client.generateCryptoKey({ scope: "tenant", name: "customer-fields", key_type: "aes-256-gcm" });
+const { ciphertext } = await client.crypto({
+  op: "encrypt", key: "customer-fields", plaintext: card, context: "customer:42/card",
+});
+const { plaintext } = await client.crypto({ op: "decrypt", ciphertext, context: "customer:42/card" });
+```
+
 ### Evaluations
 
 Scores attached to runs: record a verdict on a run, read the scores back, and roll them up per definition version to compare versions. All of these post to `POST /v1/_evaluation`; `evaluation(input)` takes the op-discriminated input directly and its return type follows `op`.

package/dist/cjs/client.js

@@ -519,8 +519,10 @@ class LoomcycleClient {
      *
      * Blocking by default: resolves only when the slowest child finishes (or
      * `timeoutMs` elapses). With `mode: "detach"` it resolves once every child
-     * has started — each with `status: "running"` and its `run_id` — and the
-     * runs go on; read one with {@link LoomcycleClient.getRun}. Mirrors
+     * has started or queued — each with `status: "running"` (or `"queued"` while
+     * it waits for a run slot; it starts by itself when one frees) and its
+     * `run_id` — and the runs go on; read one with
+     * {@link LoomcycleClient.getRun}. Mirrors
      * POST /v1/runs:batch.
      */
     async spawnRunBatch(opts) {
@@ -2938,6 +2940,101 @@ class LoomcycleClient {
     async deleteCredential(input, opts) {
         return (0, fetch_helpers_js_1.postJSON)(this.ctx, "/v1/_credentialdef", { op: "delete", ...input }, opts);
     }
+    // ── Crypto keys (RFC EP) ─────────────────────────────────────────────────
+    //
+    // A crypto key is a credential with usage "crypto": a key type fixed at
+    // creation, numbered versions, and a min_version below which versions are
+    // retired. Its material is never returned by any of these calls; the Crypto
+    // tool (`crypto()` here, or an agent's Crypto tool) uses it by name. Each
+    // returns the key's metadata (`CredentialMeta` with `usage`, `key_type`,
+    // `versions`, `current_version`, `min_version`). Delete a key with
+    // `deleteCredential` once every version is retired (min_version raised to
+    // current+1). All post to `POST /v1/_credentialdef`.
+    /** Make a new crypto key nobody ever sees: the server generates the
+     *  material. Version 1 is current. Mirrors `{op:generate}`. A name another
+     *  reachable scope already uses for a crypto key is refused
+     *  ({@link SubstrateToolRefusedError}), since a bare name would then be
+     *  ambiguous. */
+    async generateCryptoKey(input, opts) {
+        return (0, fetch_helpers_js_1.postJSON)(this.ctx, "/v1/_credentialdef", { op: "generate", ...input }, opts);
+    }
+    /** Store key material you already have as a crypto key (version 1). `value`
+     *  is write-only: masked from the transcript, never returned. Use this to
+     *  bring in an existing key; to move a key from another loomcycle
+     *  deployment use {@link importCryptoKey}. Mirrors
+     *  `{op:create, usage:"crypto"}`. */
+    async createCryptoKey(input, opts) {
+        return (0, fetch_helpers_js_1.postJSON)(this.ctx, "/v1/_credentialdef", { op: "create", usage: "crypto", ...input }, opts);
+    }
+    /** Reference a key held in an external KMS (Vault Transit, AWS KMS or
+     *  Google Cloud KMS) as a crypto key: loomcycle stores only where the key
+     *  is, and every Crypto op on it is a call to the KMS. The server asks the
+     *  KMS that the key exists, is enabled and is of `key_type` before storing
+     *  it. Rotate and retire such a key in the KMS; deleting it removes only
+     *  the reference. Mirrors `{op:create, usage:"crypto", backend, external}`. */
+    async createKmsCryptoKey(input, opts) {
+        const { backend, ...external } = input.external;
+        return (0, fetch_helpers_js_1.postJSON)(this.ctx, "/v1/_credentialdef", { op: "create", usage: "crypto", ...input, backend, external }, opts);
+    }
+    /** Add a new version and make it current. Without `value` the server
+     *  generates it; with one, it is the new version's material (write-only).
+     *  Older versions keep decrypting and verifying until `min_version` passes
+     *  them; `rewrap` moves ciphertexts to the new version. Mirrors
+     *  `{op:rotate}`. */
+    async rotateCryptoKey(input, opts) {
+        return (0, fetch_helpers_js_1.postJSON)(this.ctx, "/v1/_credentialdef", { op: "rotate", ...input }, opts);
+    }
+    /** Retire every version below `min_version`: nothing decrypts or verifies
+     *  with them any more, and only they can be deleted. It only goes up, and
+     *  at most to current+1 (which retires every version — the step before
+     *  deleting the key). A lower value, or one past current+1, is refused
+     *  ({@link SubstrateToolRefusedError}). Mirrors `{op:set_min_version}`. */
+    async setCryptoKeyMinVersion(input, opts) {
+        return (0, fetch_helpers_js_1.postJSON)(this.ctx, "/v1/_credentialdef", { op: "set_min_version", ...input }, opts);
+    }
+    /** Delete one retired version (below `min_version`) and its material. A
+     *  version still in use is refused ({@link SubstrateToolRefusedError}).
+     *  Mirrors `{op:delete_version}`. */
+    async deleteCryptoKeyVersion(input, opts) {
+        return (0, fetch_helpers_js_1.postJSON)(this.ctx, "/v1/_credentialdef", { op: "delete_version", ...input }, opts);
+    }
+    /** Export a crypto key, every version of it, encrypted under `passphrase`
+     *  (at least 16 characters), to move it to another deployment with
+     *  {@link importCryptoKey}. The blob plus the passphrase IS the key: keep
+     *  them apart. Admin only (the legacy token, `substrate:admin`, or open
+     *  mode) and only outside a run; anyone else is refused
+     *  ({@link SubstrateToolRefusedError}). Mirrors `{op:export_key}`. */
+    async exportCryptoKey(input, opts) {
+        return (0, fetch_helpers_js_1.postJSON)(this.ctx, "/v1/_credentialdef", { op: "export_key", ...input }, opts);
+    }
+    /** Import what {@link exportCryptoKey} returned on another deployment, with
+     *  the passphrase it was exported with, into `scope`. `name` must be the
+     *  name it was exported under (the blob is bound to it); the server
+     *  refuses another. Versions and `min_version` come with it. Admin only
+     *  and outside a run, like export. Mirrors `{op:import_key}`. */
+    async importCryptoKey(input, opts) {
+        return (0, fetch_helpers_js_1.postJSON)(this.ctx, "/v1/_credentialdef", { op: "import_key", ...input }, opts);
+    }
+    /** Run one Crypto-tool operation outside any run (`POST /v1/_crypto`, RFC
+     *  EP): encrypt / decrypt / rewrap / mac / verify_mac / sign / verify /
+     *  public_key / totp with a key the runtime holds, or hash / random with
+     *  none. The return type follows `op`. Key material never leaves the
+     *  server.
+     *
+     *  Keys reachable: the token's tenant's and its own subject's user keys
+     *  (agent keys belong to their agent's runs, and there are no `run`
+     *  credentials outside a run). An admin may pass `tenant` to use another
+     *  tenant's keys (and then no user keys). A ciphertext sealed here
+     *  decrypts in that tenant's runs, and the reverse.
+     *
+     *  Needs `substrate:tenant`; a tenant member's or run token gets a 403. A
+     *  refusal (a wrong key name, a key type that does not do the op, a failed
+     *  decrypt — which never says why) raises {@link SubstrateToolRefusedError};
+     *  each call takes one from the token's run-start rate, and a spent rate
+     *  raises {@link RateLimitedError} with the server's `retryAfterMs`. */
+    async crypto(input, opts) {
+        return (0, fetch_helpers_js_1.postJSON)(this.ctx, "/v1/_crypto", input, opts);
+    }
 }
 exports.LoomcycleClient = LoomcycleClient;
 /** Lightweight SSE parser tailored to the run-state stream. Each

package/dist/client.d.ts

@@ -25,7 +25,7 @@
  */
 import { InteractiveSession } from "./interactive.js";
 import { ClientToolHost, type ConnectClientToolsOptions } from "./client-tools.js";
-import type { ChangeFeedFrame, StreamChangesOptions, CredentialListResponse, CredentialMeta, DecideRequest, DecideResponse, DecisionModelsResponse, CredentialScope, DirectoryInspection, DirectoryTenant, DirectoryUser, ErasureReport, ErasureResult, Agent, AgentEvent, AgentList, CancelAgentResult, ClientOptions, ContinueOptions, RunOverrideOptions, EffectiveConfigResponse, AgentOverridableResponse, RetuneRunResponse, RunConfigResponse, RunPromptResponse, CreateSnapshotOptions, EnsureCodeAgentOptions, EnsureCodeAgentResult, EnsureHookDefOptions, EnsureHookDefResult, HookDefInput, HookDefOverlay, HookDefRowResponse, CreateDefOptions, ForkDefOptions, HookDefForkOverlay, ScheduleDefInput, ScheduleDefOverlay, ScheduleDefRowResponse, WebhookDefInput, WebhookDefOverlay, WebhookDefRowResponse, EnsureMcpServerOptions, EnsureMcpServerResult, HealthResponse, InterruptListResponse, InterruptStatus, ListUserAgentsOptions, WalkRunsPage, AckChannelOptions, AwaitChannelsOptions, BroadcastChannelsOptions, ChannelAckResult, ChannelAwaitResult, ChannelBroadcastResult, ChannelDescriptor, ChannelPeekResult, ListTeamChannelsOptions, PeekTeamChannelOptions, ReleaseTeamChannelOptions, TeamChannelPeekResult, TeamChannelReleaseResult, TeamChannelsResult, ChannelPublishResult, ChannelPurgeResult, ChannelReleaseResult, ChannelSubscribeResult, CreateChannelOptions, ListChannelsResponse, PeekChannelOptions, PublishChannelOptions, ReleaseChannelOptions, SetMemoryEntryOptions, SetMemoryEntryResponse, SubscribeChannelOptions, UpdateChannelOptions, LibraryAgentDefinition, LibraryListResponse, LibraryMcpServerDefinition, LibrarySkillDefinition, ListUsersResponse, UserRecord, CreateUserBody, UpdateUserBody, MintedUserToken, ListUserTokensResponse, RunnableAgentsResponse, LLMChatOptions, LLMChatResponse, LLMChatStreamItem, LLMEmbeddingsOptions, LLMEmbeddingsResponse, MCPServerDefVerifyResult, MemoryEmbedStatsResponse, MemoryEntriesResponse, MemoryEntryResponse, MemoryBackfillResponse, MemoryPurgeResponse, MemoryReembedResponse, MemoryScopeIDsResponse, MemoryScopesResponse, MemorySearchInput, MemorySearchResponse, PauseResult, RetentionOverride, PersistentVolumesResponse, EphemeralVolumesResponse, ResolveInterruptOptions, ResumeResult, ResolverMatrix, CompactRunResult, RunTreeDeletion, ReplaySessionResult, CancelTurnResult, ReviewRunResult, RunBatchOptions, RunBatchResult, RunOptions, ConfiguredRun, ConfiguredRunPatch, RunStateStreamItem, RuntimeStateResponse, SnapshotCreateResponse, SnapshotDescriptor, SnapshotEnvelope, SnapshotRestoreResponse, StreamUserRunStatesOptions, SubstrateToolInput, SubstrateToolResponse, CreatedTeam, CreateTeamOptions, DefNamesResponse, ForkTeamOptions, ModelAliasesResponse, OperatorTokenDefNamesResponse, ProviderModelsResponse, RoutingResponse, ScheduleListResponse, SchedulePauseResult, ScheduleRunNowResult, ScheduleStateView, ListTeamsResponse, PromotedTeam, RetiredTeam, TeamBreakpoints, TeamDefDetail, TeamRunDetached, TeamRunTarget, TeamVerification, TeamDraft, TeamDraftVerification, TeamVersionList, TeamDiagram, TeamRunResult, PathToolInput, PathToolResponse, DocumentToolInput, DocumentToolResponse, HistoryToolInput, HistoryToolResponse, EvaluationSubmitInput, EvaluationGetInput, EvaluationListForRunInput, EvaluationListForDefInput, EvaluationAggregateInput, EvaluationInput, EvaluationSubmitResult, EvaluationRecord, EvaluationListForRunResult, EvaluationListForDefResult, EvaluationAggregate, TranscriptResponse, WhoamiResponse, UsageDimension, UsageReportResponse, TokenLimit, TokenLimitsResponse, ConfigResponse, SetTokenLimitRequest } from "./types.js";
+import type { ChangeFeedFrame, StreamChangesOptions, CredentialListResponse, CredentialMeta, CryptoKeyEncoding, CryptoKeyExport, CryptoKeyExternal, CryptoKeyType, CryptoRequest, CryptoResultByOp, DecideRequest, DecideResponse, DecisionModelsResponse, CredentialScope, DirectoryInspection, DirectoryTenant, DirectoryUser, ErasureReport, ErasureResult, Agent, AgentEvent, AgentList, CancelAgentResult, ClientOptions, ContinueOptions, RunOverrideOptions, EffectiveConfigResponse, AgentOverridableResponse, RetuneRunResponse, RunConfigResponse, RunPromptResponse, CreateSnapshotOptions, EnsureCodeAgentOptions, EnsureCodeAgentResult, EnsureHookDefOptions, EnsureHookDefResult, HookDefInput, HookDefOverlay, HookDefRowResponse, CreateDefOptions, ForkDefOptions, HookDefForkOverlay, ScheduleDefInput, ScheduleDefOverlay, ScheduleDefRowResponse, WebhookDefInput, WebhookDefOverlay, WebhookDefRowResponse, EnsureMcpServerOptions, EnsureMcpServerResult, HealthResponse, InterruptListResponse, InterruptStatus, ListUserAgentsOptions, WalkRunsPage, AckChannelOptions, AwaitChannelsOptions, BroadcastChannelsOptions, ChannelAckResult, ChannelAwaitResult, ChannelBroadcastResult, ChannelDescriptor, ChannelPeekResult, ListTeamChannelsOptions, PeekTeamChannelOptions, ReleaseTeamChannelOptions, TeamChannelPeekResult, TeamChannelReleaseResult, TeamChannelsResult, ChannelPublishResult, ChannelPurgeResult, ChannelReleaseResult, ChannelSubscribeResult, CreateChannelOptions, ListChannelsResponse, PeekChannelOptions, PublishChannelOptions, ReleaseChannelOptions, SetMemoryEntryOptions, SetMemoryEntryResponse, SubscribeChannelOptions, UpdateChannelOptions, LibraryAgentDefinition, LibraryListResponse, LibraryMcpServerDefinition, LibrarySkillDefinition, ListUsersResponse, UserRecord, CreateUserBody, UpdateUserBody, MintedUserToken, ListUserTokensResponse, RunnableAgentsResponse, LLMChatOptions, LLMChatResponse, LLMChatStreamItem, LLMEmbeddingsOptions, LLMEmbeddingsResponse, MCPServerDefVerifyResult, MemoryEmbedStatsResponse, MemoryEntriesResponse, MemoryEntryResponse, MemoryBackfillResponse, MemoryPurgeResponse, MemoryReembedResponse, MemoryScopeIDsResponse, MemoryScopesResponse, MemorySearchInput, MemorySearchResponse, PauseResult, RetentionOverride, PersistentVolumesResponse, EphemeralVolumesResponse, ResolveInterruptOptions, ResumeResult, ResolverMatrix, CompactRunResult, RunTreeDeletion, ReplaySessionResult, CancelTurnResult, ReviewRunResult, RunBatchOptions, RunBatchResult, RunOptions, ConfiguredRun, ConfiguredRunPatch, RunStateStreamItem, RuntimeStateResponse, SnapshotCreateResponse, SnapshotDescriptor, SnapshotEnvelope, SnapshotRestoreResponse, StreamUserRunStatesOptions, SubstrateToolInput, SubstrateToolResponse, CreatedTeam, CreateTeamOptions, DefNamesResponse, ForkTeamOptions, ModelAliasesResponse, OperatorTokenDefNamesResponse, ProviderModelsResponse, RoutingResponse, ScheduleListResponse, SchedulePauseResult, ScheduleRunNowResult, ScheduleStateView, ListTeamsResponse, PromotedTeam, RetiredTeam, TeamBreakpoints, TeamDefDetail, TeamRunDetached, TeamRunTarget, TeamVerification, TeamDraft, TeamDraftVerification, TeamVersionList, TeamDiagram, TeamRunResult, PathToolInput, PathToolResponse, DocumentToolInput, DocumentToolResponse, HistoryToolInput, HistoryToolResponse, EvaluationSubmitInput, EvaluationGetInput, EvaluationListForRunInput, EvaluationListForDefInput, EvaluationAggregateInput, EvaluationInput, EvaluationSubmitResult, EvaluationRecord, EvaluationListForRunResult, EvaluationListForDefResult, EvaluationAggregate, TranscriptResponse, WhoamiResponse, UsageDimension, UsageReportResponse, TokenLimit, TokenLimitsResponse, ConfigResponse, SetTokenLimitRequest } from "./types.js";
 export declare class LoomcycleClient {
     private ctx;
     constructor(opts?: ClientOptions);
@@ -244,8 +244,10 @@ export declare class LoomcycleClient {
      *
      * Blocking by default: resolves only when the slowest child finishes (or
      * `timeoutMs` elapses). With `mode: "detach"` it resolves once every child
-     * has started — each with `status: "running"` and its `run_id` — and the
-     * runs go on; read one with {@link LoomcycleClient.getRun}. Mirrors
+     * has started or queued — each with `status: "running"` (or `"queued"` while
+     * it waits for a run slot; it starts by itself when one frees) and its
+     * `run_id` — and the runs go on; read one with
+     * {@link LoomcycleClient.getRun}. Mirrors
      * POST /v1/runs:batch.
      */
     spawnRunBatch(opts: RunBatchOptions): Promise<RunBatchResult>;
@@ -2008,4 +2010,128 @@ export declare class LoomcycleClient {
         scope: string;
         deleted: boolean;
     }>;
+    /** Make a new crypto key nobody ever sees: the server generates the
+     *  material. Version 1 is current. Mirrors `{op:generate}`. A name another
+     *  reachable scope already uses for a crypto key is refused
+     *  ({@link SubstrateToolRefusedError}), since a bare name would then be
+     *  ambiguous. */
+    generateCryptoKey(input: {
+        scope: CredentialScope;
+        name: string;
+        key_type: CryptoKeyType;
+        expires_at?: string;
+    }, opts?: {
+        signal?: AbortSignal;
+    }): Promise<CredentialMeta>;
+    /** Store key material you already have as a crypto key (version 1). `value`
+     *  is write-only: masked from the transcript, never returned. Use this to
+     *  bring in an existing key; to move a key from another loomcycle
+     *  deployment use {@link importCryptoKey}. Mirrors
+     *  `{op:create, usage:"crypto"}`. */
+    createCryptoKey(input: {
+        scope: CredentialScope;
+        name: string;
+        key_type: CryptoKeyType;
+        value: string;
+        key_encoding?: CryptoKeyEncoding;
+        expires_at?: string;
+    }, opts?: {
+        signal?: AbortSignal;
+    }): Promise<CredentialMeta>;
+    /** Reference a key held in an external KMS (Vault Transit, AWS KMS or
+     *  Google Cloud KMS) as a crypto key: loomcycle stores only where the key
+     *  is, and every Crypto op on it is a call to the KMS. The server asks the
+     *  KMS that the key exists, is enabled and is of `key_type` before storing
+     *  it. Rotate and retire such a key in the KMS; deleting it removes only
+     *  the reference. Mirrors `{op:create, usage:"crypto", backend, external}`. */
+    createKmsCryptoKey(input: {
+        scope: CredentialScope;
+        name: string;
+        key_type: CryptoKeyType;
+        external: CryptoKeyExternal;
+        expires_at?: string;
+    }, opts?: {
+        signal?: AbortSignal;
+    }): Promise<CredentialMeta>;
+    /** Add a new version and make it current. Without `value` the server
+     *  generates it; with one, it is the new version's material (write-only).
+     *  Older versions keep decrypting and verifying until `min_version` passes
+     *  them; `rewrap` moves ciphertexts to the new version. Mirrors
+     *  `{op:rotate}`. */
+    rotateCryptoKey(input: {
+        scope: CredentialScope;
+        name: string;
+        value?: string;
+        key_encoding?: CryptoKeyEncoding;
+    }, opts?: {
+        signal?: AbortSignal;
+    }): Promise<CredentialMeta>;
+    /** Retire every version below `min_version`: nothing decrypts or verifies
+     *  with them any more, and only they can be deleted. It only goes up, and
+     *  at most to current+1 (which retires every version — the step before
+     *  deleting the key). A lower value, or one past current+1, is refused
+     *  ({@link SubstrateToolRefusedError}). Mirrors `{op:set_min_version}`. */
+    setCryptoKeyMinVersion(input: {
+        scope: CredentialScope;
+        name: string;
+        min_version: number;
+    }, opts?: {
+        signal?: AbortSignal;
+    }): Promise<CredentialMeta>;
+    /** Delete one retired version (below `min_version`) and its material. A
+     *  version still in use is refused ({@link SubstrateToolRefusedError}).
+     *  Mirrors `{op:delete_version}`. */
+    deleteCryptoKeyVersion(input: {
+        scope: CredentialScope;
+        name: string;
+        version: number;
+    }, opts?: {
+        signal?: AbortSignal;
+    }): Promise<CredentialMeta>;
+    /** Export a crypto key, every version of it, encrypted under `passphrase`
+     *  (at least 16 characters), to move it to another deployment with
+     *  {@link importCryptoKey}. The blob plus the passphrase IS the key: keep
+     *  them apart. Admin only (the legacy token, `substrate:admin`, or open
+     *  mode) and only outside a run; anyone else is refused
+     *  ({@link SubstrateToolRefusedError}). Mirrors `{op:export_key}`. */
+    exportCryptoKey(input: {
+        scope: CredentialScope;
+        name: string;
+        passphrase: string;
+    }, opts?: {
+        signal?: AbortSignal;
+    }): Promise<CryptoKeyExport>;
+    /** Import what {@link exportCryptoKey} returned on another deployment, with
+     *  the passphrase it was exported with, into `scope`. `name` must be the
+     *  name it was exported under (the blob is bound to it); the server
+     *  refuses another. Versions and `min_version` come with it. Admin only
+     *  and outside a run, like export. Mirrors `{op:import_key}`. */
+    importCryptoKey(input: {
+        scope: CredentialScope;
+        name: string;
+        blob: string;
+        passphrase: string;
+    }, opts?: {
+        signal?: AbortSignal;
+    }): Promise<CredentialMeta>;
+    /** Run one Crypto-tool operation outside any run (`POST /v1/_crypto`, RFC
+     *  EP): encrypt / decrypt / rewrap / mac / verify_mac / sign / verify /
+     *  public_key / totp with a key the runtime holds, or hash / random with
+     *  none. The return type follows `op`. Key material never leaves the
+     *  server.
+     *
+     *  Keys reachable: the token's tenant's and its own subject's user keys
+     *  (agent keys belong to their agent's runs, and there are no `run`
+     *  credentials outside a run). An admin may pass `tenant` to use another
+     *  tenant's keys (and then no user keys). A ciphertext sealed here
+     *  decrypts in that tenant's runs, and the reverse.
+     *
+     *  Needs `substrate:tenant`; a tenant member's or run token gets a 403. A
+     *  refusal (a wrong key name, a key type that does not do the op, a failed
+     *  decrypt — which never says why) raises {@link SubstrateToolRefusedError};
+     *  each call takes one from the token's run-start rate, and a spent rate
+     *  raises {@link RateLimitedError} with the server's `retryAfterMs`. */
+    crypto<R extends CryptoRequest>(input: R, opts?: {
+        signal?: AbortSignal;
+    }): Promise<CryptoResultByOp[R["op"]]>;
 }

package/dist/client.js

@@ -516,8 +516,10 @@ export class LoomcycleClient {
      *
      * Blocking by default: resolves only when the slowest child finishes (or
      * `timeoutMs` elapses). With `mode: "detach"` it resolves once every child
-     * has started — each with `status: "running"` and its `run_id` — and the
-     * runs go on; read one with {@link LoomcycleClient.getRun}. Mirrors
+     * has started or queued — each with `status: "running"` (or `"queued"` while
+     * it waits for a run slot; it starts by itself when one frees) and its
+     * `run_id` — and the runs go on; read one with
+     * {@link LoomcycleClient.getRun}. Mirrors
      * POST /v1/runs:batch.
      */
     async spawnRunBatch(opts) {
@@ -2935,6 +2937,101 @@ export class LoomcycleClient {
     async deleteCredential(input, opts) {
         return postJSON(this.ctx, "/v1/_credentialdef", { op: "delete", ...input }, opts);
     }
+    // ── Crypto keys (RFC EP) ─────────────────────────────────────────────────
+    //
+    // A crypto key is a credential with usage "crypto": a key type fixed at
+    // creation, numbered versions, and a min_version below which versions are
+    // retired. Its material is never returned by any of these calls; the Crypto
+    // tool (`crypto()` here, or an agent's Crypto tool) uses it by name. Each
+    // returns the key's metadata (`CredentialMeta` with `usage`, `key_type`,
+    // `versions`, `current_version`, `min_version`). Delete a key with
+    // `deleteCredential` once every version is retired (min_version raised to
+    // current+1). All post to `POST /v1/_credentialdef`.
+    /** Make a new crypto key nobody ever sees: the server generates the
+     *  material. Version 1 is current. Mirrors `{op:generate}`. A name another
+     *  reachable scope already uses for a crypto key is refused
+     *  ({@link SubstrateToolRefusedError}), since a bare name would then be
+     *  ambiguous. */
+    async generateCryptoKey(input, opts) {
+        return postJSON(this.ctx, "/v1/_credentialdef", { op: "generate", ...input }, opts);
+    }
+    /** Store key material you already have as a crypto key (version 1). `value`
+     *  is write-only: masked from the transcript, never returned. Use this to
+     *  bring in an existing key; to move a key from another loomcycle
+     *  deployment use {@link importCryptoKey}. Mirrors
+     *  `{op:create, usage:"crypto"}`. */
+    async createCryptoKey(input, opts) {
+        return postJSON(this.ctx, "/v1/_credentialdef", { op: "create", usage: "crypto", ...input }, opts);
+    }
+    /** Reference a key held in an external KMS (Vault Transit, AWS KMS or
+     *  Google Cloud KMS) as a crypto key: loomcycle stores only where the key
+     *  is, and every Crypto op on it is a call to the KMS. The server asks the
+     *  KMS that the key exists, is enabled and is of `key_type` before storing
+     *  it. Rotate and retire such a key in the KMS; deleting it removes only
+     *  the reference. Mirrors `{op:create, usage:"crypto", backend, external}`. */
+    async createKmsCryptoKey(input, opts) {
+        const { backend, ...external } = input.external;
+        return postJSON(this.ctx, "/v1/_credentialdef", { op: "create", usage: "crypto", ...input, backend, external }, opts);
+    }
+    /** Add a new version and make it current. Without `value` the server
+     *  generates it; with one, it is the new version's material (write-only).
+     *  Older versions keep decrypting and verifying until `min_version` passes
+     *  them; `rewrap` moves ciphertexts to the new version. Mirrors
+     *  `{op:rotate}`. */
+    async rotateCryptoKey(input, opts) {
+        return postJSON(this.ctx, "/v1/_credentialdef", { op: "rotate", ...input }, opts);
+    }
+    /** Retire every version below `min_version`: nothing decrypts or verifies
+     *  with them any more, and only they can be deleted. It only goes up, and
+     *  at most to current+1 (which retires every version — the step before
+     *  deleting the key). A lower value, or one past current+1, is refused
+     *  ({@link SubstrateToolRefusedError}). Mirrors `{op:set_min_version}`. */
+    async setCryptoKeyMinVersion(input, opts) {
+        return postJSON(this.ctx, "/v1/_credentialdef", { op: "set_min_version", ...input }, opts);
+    }
+    /** Delete one retired version (below `min_version`) and its material. A
+     *  version still in use is refused ({@link SubstrateToolRefusedError}).
+     *  Mirrors `{op:delete_version}`. */
+    async deleteCryptoKeyVersion(input, opts) {
+        return postJSON(this.ctx, "/v1/_credentialdef", { op: "delete_version", ...input }, opts);
+    }
+    /** Export a crypto key, every version of it, encrypted under `passphrase`
+     *  (at least 16 characters), to move it to another deployment with
+     *  {@link importCryptoKey}. The blob plus the passphrase IS the key: keep
+     *  them apart. Admin only (the legacy token, `substrate:admin`, or open
+     *  mode) and only outside a run; anyone else is refused
+     *  ({@link SubstrateToolRefusedError}). Mirrors `{op:export_key}`. */
+    async exportCryptoKey(input, opts) {
+        return postJSON(this.ctx, "/v1/_credentialdef", { op: "export_key", ...input }, opts);
+    }
+    /** Import what {@link exportCryptoKey} returned on another deployment, with
+     *  the passphrase it was exported with, into `scope`. `name` must be the
+     *  name it was exported under (the blob is bound to it); the server
+     *  refuses another. Versions and `min_version` come with it. Admin only
+     *  and outside a run, like export. Mirrors `{op:import_key}`. */
+    async importCryptoKey(input, opts) {
+        return postJSON(this.ctx, "/v1/_credentialdef", { op: "import_key", ...input }, opts);
+    }
+    /** Run one Crypto-tool operation outside any run (`POST /v1/_crypto`, RFC
+     *  EP): encrypt / decrypt / rewrap / mac / verify_mac / sign / verify /
+     *  public_key / totp with a key the runtime holds, or hash / random with
+     *  none. The return type follows `op`. Key material never leaves the
+     *  server.
+     *
+     *  Keys reachable: the token's tenant's and its own subject's user keys
+     *  (agent keys belong to their agent's runs, and there are no `run`
+     *  credentials outside a run). An admin may pass `tenant` to use another
+     *  tenant's keys (and then no user keys). A ciphertext sealed here
+     *  decrypts in that tenant's runs, and the reverse.
+     *
+     *  Needs `substrate:tenant`; a tenant member's or run token gets a 403. A
+     *  refusal (a wrong key name, a key type that does not do the op, a failed
+     *  decrypt — which never says why) raises {@link SubstrateToolRefusedError};
+     *  each call takes one from the token's run-start rate, and a spent rate
+     *  raises {@link RateLimitedError} with the server's `retryAfterMs`. */
+    async crypto(input, opts) {
+        return postJSON(this.ctx, "/v1/_crypto", input, opts);
+    }
 }
 /** Lightweight SSE parser tailored to the run-state stream. Each
  *  frame's event name distinguishes the two kinds; data is JSON.

package/dist/index.d.ts

@@ -176,5 +176,5 @@ export { verifyLoomcycleSignature, verifyLoomcycleDelivery } from "./signature.j
 export type { VerifySignatureOptions, VerifiedDelivery } from "./signature.js";
 export { ClientToolHost, clientToolsURL, CLIENT_TOOL_SUBPROTOCOL } from "./client-tools.js";
 export type { ClientToolSchema, ClientToolInvocation, ConnectClientToolsOptions, WebSocketLike, WebSocketCtor, } from "./client-tools.js";
-export type { AgentEvent, ClientOptions, ContinueOptions, EventType, HostWidening, ImageMediaType, ParentContext, PromptContent, PromptSegment, RetryInfo, RunOptions, RunOverrideOptions, SamplingOptions, CompactionOptions, ContextOptions, ToolUse, Usage, CallTiming, Agent, AgentStatus, AwaitedState, AgentUsage, RunResult, RunSpec, RunSpecTeam, ConfiguredRun, ConfiguredRunPatch, ToolChoiceOptions, OutputFormatOptions, CancelAgentResult, ListAgentsResponse, ListUserAgentsOptions, AgentList, WalkRunsPage, RunBatchOptions, RunBatchResult, SpawnRunResult, CompactRunResult, RunTreeDeletion, RunTreeNotReached, DirectoryBudget, DirectoryInspection, DirectoryTenant, DirectoryUser, ErasureReport, ErasureResidue, ErasureResult, ErasureTier, CancelTurnResult, ReviewRunResult, ReplaySessionResult, TranscriptEvent, TranscriptResponse, HealthResponse, ListUsersResponse, UserSummary, UserRecord, CreateUserBody, UpdateUserBody, MintedUserToken, TokenRestrictions, UserTokenMeta, ListUserTokensResponse, RunnableAgent, RunnableAgentsResponse, WhoamiResponse, PauseResult, RetentionOverride, ResumeResult, RuntimeStateResponse, RuntimeStateStatus, ResolverMatrix, ResolverModelStatus, ResolverProviderAvailability, CreateSnapshotOptions, SnapshotCreateResponse, SnapshotDescriptor, SnapshotEnvelope, SnapshotListResponse, SnapshotRestoreResponse, MemoryEntriesResponse, MemoryEntry, MemoryEntryResponse, MemoryScopeIDsResponse, MemoryScopeIDSummary, MemoryScopeKind, MemoryScopesResponse, MemorySearchInput, MemorySource, MemoryWhen, MemoryTimeFilter, MemorySearchEntry, MemorySearchResponse, MemoryEmbedModelStats, MemoryEmbedStatsResponse, MemoryReembedConfigured, MemoryReembedResponse, MemoryBackfillResponse, MemoryPurgeResponse, InterruptListResponse, InterruptRow, InterruptStatus, ResolveInterruptOptions, ChannelHookCall, ChannelHookResult, HookFailMode, HookPhase, HookToolCall, HookToolResult, PostHookCall, PostHookResult, PreHookCall, PreHookResult, SubstrateToolInput, SubstrateToolResponse, TeamNameSummary, ListTeamsResponse, TeamDiagram, CreatedTeam, PromotedTeam, RetiredTeam, TeamDefDetail, TeamVerification, TeamDraft, TeamDraftVerification, TeamIssue, TeamIssueKind, TeamVersion, TeamVersionList, TeamBreakpoints, TeamRunDetached, TeamRunResult, TeamRunTarget, CreateTeamOptions, ForkTeamOptions, DefNameSummary, DefNamesResponse, OperatorTokenDefNameSummary, OperatorTokenDefNamesResponse, ScheduleListEntry, ScheduleListResponse, ScheduleActiveRun, ScheduleStateView, ScheduleRunNowResult, SchedulePauseResult, ModelAlias, ModelAliasesResponse, RoutingResponse, RoutingUserTier, RoutingTier, RoutingCandidate, RoutingThroughput, RoutingProvider, SearchRoutingProvider, ProviderModelsResponse, TeamRunStep, TeamDecisionHandler, TeamDecisionQuestion, TeamDecisionAnswer, PathToolInput, PathToolResponse, DocumentToolInput, DocumentToolResponse, HistoryToolInput, HistoryToolResponse, EvaluationEmitterRole, EvaluationSubmitInput, EvaluationGetInput, EvaluationListForRunInput, EvaluationListForDefInput, EvaluationAggregateInput, EvaluationInput, EvaluationSubmitResult, EvaluationRecord, EvaluationListForRunResult, EvaluationListForDefResult, EvaluationScoreStats, EvaluationAggregate, VolumeMode, PersistentVolumeEntry, PersistentVolumesResponse, EphemeralVolumeEntry, EphemeralVolumesResponse, SystemPromptPayload, UserInputPayload, ChannelDescriptor, ListChannelsResponse, RunStateEvent, RunStateStreamClose, RunStateStreamItem, RunStateStreamOpen, StreamUserRunStatesOptions, ChangeFeedError, ChangeFeedFrame, ChangeFeedStatus, EmbedderHealth, MemoryChange, MemoryChangeScope, MemoryChangeType, StreamChangesOptions, AckChannelOptions, ChannelAckResult, ChannelMessageItem, ChannelPeekResult, ListTeamChannelsOptions, PeekTeamChannelOptions, ReleaseTeamChannelOptions, TeamChannelReleaseResult, TeamChannelDeclaredIn, TeamChannelDescriptor, TeamChannelPeekResult, TeamChannelsResult, ChannelPublishResult, ChannelPurgeResult, ChannelReleaseResult, ChannelScope, ChannelSubscribeResult, PeekChannelOptions, PublishChannelOptions, SubscribeChannelOptions, AwaitChannelsOptions, BroadcastChannelsOptions, ChannelAwaitEntry, ChannelAwaitMode, ChannelAwaitResult, ChannelBroadcastEntry, ChannelBroadcastResult, CreateChannelOptions, ReleaseChannelOptions, UpdateChannelOptions, SetMemoryEntryOptions, SetMemoryEntryResponse, AgentDefRowResponse, AgentDefVerifyResult, SkillDefVerifyResult, EnsureMcpServerOptions, EnsureMcpServerResult, MCPServerDefRowResponse, MCPServerDefVerifyResult, AgentDefOverlay, AgentRouting, AgentChannelACL, AgentInterruptionACL, AgentDecision, MemoryRerank, AgentSampling, AgentCompaction, AgentContext, TierCandidate, CoreBlock, HookEvent, InlineWebhook, HookEntry, EventHooks, ToolEntry, ToolHooksByTool, EnsureCodeAgentOptions, EnsureCodeAgentResult, CreateDefOptions, ForkDefOptions, EnsureHookDefOptions, EnsureHookDefResult, HookDefBody, HookDefForkOverlay, HookDefInput, HookDefMatch, HookDefOverlay, HookDefRowResponse, HookDefVerifyResult, ScheduleDefInput, ScheduleDefOverlay, ScheduleDefRowResponse, ScheduledRunHook, ScheduledRunPromptContent, ScheduledRunPromptSegment, WebhookDefAuth, WebhookDefFilter, WebhookDefInput, WebhookDefOverlay, WebhookDefRateLimit, WebhookDefRowResponse, WebhookDefDeliveries, WebhookDefSyncResponse, LibraryAgentDefinition, LibraryEntry, LibraryListResponse, LibraryMcpServerDefinition, LibrarySkillDefinition, LLMChatContent, LLMChatMessage, LLMChatOptions, LLMChatResponse, LLMChatStreamDelta, LLMChatStreamItem, LLMChatToolCall, LLMChatUsage, LLMTool, LLMEmbeddingItem, LLMEmbeddingsOptions, LLMEmbeddingsResponse, LLMEmbeddingsUsage, UsageDimension, UsageAggregate, UsageReportResponse, CapabilityInertInfo, LimitInfo, AdmissionInfo, ErrorInfo, CallFormat, CallRef, HookDecisionInfo, TeamDecisionInfo, OverrideInfo, FallbackInfo, InterruptionEventInfo, SpawnChildInfo, TurnCancelledInfo, ChannelEventInfo, ContextCompactionInfo, ContextRecapInfo, ContextStateInfo, ContextExhaustedInfo, ContextTierVerdict, ContextDistillDeclinedInfo, EffectiveConfigResponse, EffectiveConfigSource, EffectiveValue, InertContextSetting, AgentOverridableResponse, OverridableField, OverrideLockReason, RetuneRunResponse, RunConfigRecord, SubagentHoldInfo, RunConfigResponse, RunPromptResponse, RunPromptSnapshot, PromptBlock, TokenLimit, TokenLimitsResponse, ConfigResponse, ConfigProvider, ConfigModel, ConfigSearch, ConfigInstance, SetTokenLimitRequest, CredentialScope, CredentialMeta, CredentialListResponse, DecideRequest, DecideResponse, DecisionQuestion, DecisionChoiceQuestion, DecisionNoulQuestion, DecisionScoreQuestion, DecisionAnswer, DecisionChoiceAnswer, DecisionNoulAnswer, DecisionScoreAnswer, DecisionModel, DecisionModelsResponse, } from "./types.js";
+export type { AgentEvent, ClientOptions, ContinueOptions, EventType, HostWidening, ImageMediaType, ParentContext, PromptContent, PromptSegment, RetryInfo, RunOptions, RunOverrideOptions, SamplingOptions, CompactionOptions, ContextOptions, ToolUse, Usage, CallTiming, Agent, AgentStatus, AwaitedState, AgentUsage, RunResult, RunSpec, RunSpecTeam, ConfiguredRun, ConfiguredRunPatch, ToolChoiceOptions, OutputFormatOptions, CancelAgentResult, ListAgentsResponse, ListUserAgentsOptions, AgentList, WalkRunsPage, RunBatchOptions, RunBatchResult, SpawnRunResult, CompactRunResult, RunTreeDeletion, RunTreeNotReached, DirectoryBudget, DirectoryInspection, DirectoryTenant, DirectoryUser, ErasureReport, ErasureResidue, ErasureResult, ErasureTier, CancelTurnResult, ReviewRunResult, ReplaySessionResult, TranscriptEvent, TranscriptResponse, HealthResponse, ListUsersResponse, UserSummary, UserRecord, CreateUserBody, UpdateUserBody, MintedUserToken, TokenRestrictions, UserTokenMeta, ListUserTokensResponse, RunnableAgent, RunnableAgentsResponse, WhoamiResponse, PauseResult, RetentionOverride, ResumeResult, RuntimeStateResponse, RuntimeStateStatus, ResolverMatrix, ResolverModelStatus, ResolverProviderAvailability, CreateSnapshotOptions, SnapshotCreateResponse, SnapshotDescriptor, SnapshotEnvelope, SnapshotListResponse, SnapshotRestoreResponse, MemoryEntriesResponse, MemoryEntry, MemoryEntryResponse, MemoryScopeIDsResponse, MemoryScopeIDSummary, MemoryScopeKind, MemoryScopesResponse, MemorySearchInput, MemorySource, MemoryWhen, MemoryTimeFilter, MemorySearchEntry, MemorySearchResponse, MemoryEmbedModelStats, MemoryEmbedStatsResponse, MemoryReembedConfigured, MemoryReembedResponse, MemoryBackfillResponse, MemoryPurgeResponse, InterruptListResponse, InterruptRow, InterruptStatus, ResolveInterruptOptions, ChannelHookCall, ChannelHookResult, HookFailMode, HookPhase, HookToolCall, HookToolResult, PostHookCall, PostHookResult, PreHookCall, PreHookResult, SubstrateToolInput, SubstrateToolResponse, TeamNameSummary, ListTeamsResponse, TeamDiagram, CreatedTeam, PromotedTeam, RetiredTeam, TeamDefDetail, TeamVerification, TeamDraft, TeamDraftVerification, TeamIssue, TeamIssueKind, TeamVersion, TeamVersionList, TeamBreakpoints, TeamRunDetached, TeamRunResult, TeamRunTarget, CreateTeamOptions, ForkTeamOptions, DefNameSummary, DefNamesResponse, OperatorTokenDefNameSummary, OperatorTokenDefNamesResponse, ScheduleListEntry, ScheduleListResponse, ScheduleActiveRun, ScheduleStateView, ScheduleRunNowResult, SchedulePauseResult, ModelAlias, ModelAliasesResponse, RoutingResponse, RoutingUserTier, RoutingTier, RoutingCandidate, RoutingThroughput, RoutingProvider, SearchRoutingProvider, ProviderModelsResponse, TeamRunStep, TeamDecisionHandler, TeamDecisionQuestion, TeamDecisionAnswer, PathToolInput, PathToolResponse, DocumentToolInput, DocumentToolResponse, HistoryToolInput, HistoryToolResponse, EvaluationEmitterRole, EvaluationSubmitInput, EvaluationGetInput, EvaluationListForRunInput, EvaluationListForDefInput, EvaluationAggregateInput, EvaluationInput, EvaluationSubmitResult, EvaluationRecord, EvaluationListForRunResult, EvaluationListForDefResult, EvaluationScoreStats, EvaluationAggregate, VolumeMode, PersistentVolumeEntry, PersistentVolumesResponse, EphemeralVolumeEntry, EphemeralVolumesResponse, SystemPromptPayload, UserInputPayload, ChannelDescriptor, ListChannelsResponse, RunStateEvent, RunStateStreamClose, RunStateStreamItem, RunStateStreamOpen, StreamUserRunStatesOptions, ChangeFeedError, ChangeFeedFrame, ChangeFeedStatus, EmbedderHealth, MemoryChange, MemoryChangeScope, MemoryChangeType, StreamChangesOptions, AckChannelOptions, ChannelAckResult, ChannelMessageItem, ChannelPeekResult, ListTeamChannelsOptions, PeekTeamChannelOptions, ReleaseTeamChannelOptions, TeamChannelReleaseResult, TeamChannelDeclaredIn, TeamChannelDescriptor, TeamChannelPeekResult, TeamChannelsResult, ChannelPublishResult, ChannelPurgeResult, ChannelReleaseResult, ChannelScope, ChannelSubscribeResult, PeekChannelOptions, PublishChannelOptions, SubscribeChannelOptions, AwaitChannelsOptions, BroadcastChannelsOptions, ChannelAwaitEntry, ChannelAwaitMode, ChannelAwaitResult, ChannelBroadcastEntry, ChannelBroadcastResult, CreateChannelOptions, ReleaseChannelOptions, UpdateChannelOptions, SetMemoryEntryOptions, SetMemoryEntryResponse, AgentDefRowResponse, AgentDefVerifyResult, SkillDefVerifyResult, EnsureMcpServerOptions, EnsureMcpServerResult, MCPServerDefRowResponse, MCPServerDefVerifyResult, AgentDefOverlay, AgentRouting, AgentChannelACL, AgentInterruptionACL, AgentDecision, MemoryRerank, AgentSampling, AgentCompaction, AgentContext, TierCandidate, CoreBlock, HookEvent, InlineWebhook, HookEntry, EventHooks, ToolEntry, ToolHooksByTool, EnsureCodeAgentOptions, EnsureCodeAgentResult, CreateDefOptions, ForkDefOptions, EnsureHookDefOptions, EnsureHookDefResult, HookDefBody, HookDefForkOverlay, HookDefInput, HookDefMatch, HookDefOverlay, HookDefRowResponse, HookDefVerifyResult, ScheduleDefInput, ScheduleDefOverlay, ScheduleDefRowResponse, ScheduledRunHook, ScheduledRunPromptContent, ScheduledRunPromptSegment, WebhookDefAuth, WebhookDefFilter, WebhookDefInput, WebhookDefOverlay, WebhookDefRateLimit, WebhookDefRowResponse, WebhookDefDeliveries, WebhookDefSyncResponse, LibraryAgentDefinition, LibraryEntry, LibraryListResponse, LibraryMcpServerDefinition, LibrarySkillDefinition, LLMChatContent, LLMChatMessage, LLMChatOptions, LLMChatResponse, LLMChatStreamDelta, LLMChatStreamItem, LLMChatToolCall, LLMChatUsage, LLMTool, LLMEmbeddingItem, LLMEmbeddingsOptions, LLMEmbeddingsResponse, LLMEmbeddingsUsage, UsageDimension, UsageAggregate, UsageReportResponse, CapabilityInertInfo, LimitInfo, AdmissionInfo, ErrorInfo, CallFormat, CallRef, HookDecisionInfo, TeamDecisionInfo, OverrideInfo, FallbackInfo, InterruptionEventInfo, SpawnChildInfo, TurnCancelledInfo, ChannelEventInfo, ContextCompactionInfo, ContextRecapInfo, ContextStateInfo, ContextExhaustedInfo, ContextTierVerdict, ContextDistillDeclinedInfo, EffectiveConfigResponse, EffectiveConfigSource, EffectiveValue, InertContextSetting, AgentOverridableResponse, OverridableField, OverrideLockReason, RetuneRunResponse, RunConfigRecord, SubagentHoldInfo, RunConfigResponse, RunPromptResponse, RunPromptSnapshot, PromptBlock, TokenLimit, TokenLimitsResponse, ConfigResponse, ConfigProvider, ConfigModel, ConfigSearch, ConfigInstance, SetTokenLimitRequest, CredentialScope, CredentialMeta, CredentialListResponse, CryptoKeyVersion, CryptoKeyExport, CryptoKeyType, CryptoKeyEncoding, CryptoKeyBackend, CryptoKeyExternal, CryptoOp, CryptoRequestBase, CryptoKeyRef, CryptoEncryptRequest, CryptoDecryptRequest, CryptoRewrapRequest, CryptoMacRequest, CryptoVerifyMacRequest, CryptoSignRequest, CryptoVerifyRequest, CryptoPublicKeyRequest, CryptoTotpRequest, CryptoHashRequest, CryptoRandomRequest, CryptoHashPasswordRequest, CryptoVerifyPasswordRequest, CryptoRequest, CryptoEncryptResult, CryptoDecryptResult, CryptoRewrapResult, CryptoMacResult, CryptoVerifyResult, CryptoSignResult, CryptoPublicJWK, CryptoPublicKeyResult, CryptoTotpResult, CryptoHashResult, CryptoRandomResult, CryptoHashPasswordResult, CryptoVerifyPasswordResult, CryptoResultByOp, CryptoResult, DecideRequest, DecideResponse, DecisionQuestion, DecisionChoiceQuestion, DecisionNoulQuestion, DecisionScoreQuestion, DecisionAnswer, DecisionChoiceAnswer, DecisionNoulAnswer, DecisionScoreAnswer, DecisionModel, DecisionModelsResponse, } from "./types.js";
 export { AgentIDInUseError, AgentNotFoundError, AlreadyPausingError, AuthError, BackpressureError, NotFoundError, InsufficientScopeError, InvalidArgumentError, ChannelCursorRegressionError, LoomcycleError, NotPausedError, PauseNotConfiguredError, PerUserQuotaExhaustedError, PromptTooLargeError, RateLimitedError, RequestTooLargeError, SessionBusyError, SessionNotFoundError, SnapshotNotFoundError, SnapshotTooLargeError, SnapshotVersionError, SubstrateToolRefusedError, TokenLimitExceededError, UnavailableError, } from "./errors.js";

package/dist/types.d.ts

@@ -1492,6 +1492,10 @@ export interface RunSpec {
          *  replica that does not hold it; its own replica reads it before it
          *  reaps the child as idle. */
         addressed_at?: number;
+        /** The parent run's Crypto key scopes at spawn — the ceiling the child's
+         *  own `crypto_scopes` were narrowed to, and are narrowed to again on
+         *  resume. Absent: the parent held none. */
+        crypto_scopes?: string[];
     };
     /** The iteration limit the run started with. Absent for a run with none
      *  (unbounded, or an interactive run with no `max_iterations` of its own)
@@ -1668,9 +1672,10 @@ export interface CancelAgentResult {
 export interface RunBatchOptions {
     spawns: RunOptions[];
     /** "join" (default) — block until all children settle, returning the
-     *  combined envelope. "detach" — resolve once every child has started:
-     *  each started child reports `status: "running"` with its `run_id`, keeps
-     *  running after the call, and is read with {@link LoomcycleClient.getRun}
+     *  combined envelope. "detach" — resolve once every child has started or
+     *  queued: each reports `status: "running"` (or `"queued"` while it waits
+     *  for a run slot, starting by itself when one frees) with its `run_id`,
+     *  goes on after the call, and is read with {@link LoomcycleClient.getRun}
      *  and stopped with {@link LoomcycleClient.cancelAgent}; a child that could
      *  not start is reported in its slot, as in join. */
     mode?: "join" | "detach";
@@ -4146,6 +4151,11 @@ export interface AgentDefOverlay {
     /** Evaluation tool scope gate, e.g. `["submit_self", "read_any"]`. The
      *  Evaluation tool default-denies until granted. */
     evaluation_scopes?: string[];
+    /** Crypto tool key scopes the agent's key-backed ops may use: `agent` |
+     *  `user` | `tenant` | `run`. Unset (or `["-*"]`) grants none — keyless ops
+     *  only. Held to the author's own grant; a sub-agent holds only what its
+     *  parent run also holds. */
+    crypto_scopes?: string[];
     /** Channel tool ACL (default-deny until set). */
     channels?: AgentChannelACL;
     /** Interruption tool gate — `enabled: true` REQUIRED for the tool to work. */
@@ -4464,6 +4474,9 @@ export interface ScheduledRunPromptContent {
      *  input. */
     type?: "trusted-text" | "untrusted-block";
     text: string;
+    /** An untrusted-block's source label, as on a run's segments; `"code"`
+     *  keeps the text exactly as written. Default `"untrusted"`. */
+    kind?: string;
 }
 /** One segment of a scheduled run's prompt. */
 export interface ScheduledRunPromptSegment {
@@ -5219,12 +5232,336 @@ export interface CredentialMeta {
     /** The user name sent with the value where a destination takes one (HTTP
      *  basic auth for a git source). Absent when none is stored. */
     username?: string;
+    /** Present with `expires_at`: true once that time has passed. An expired
+     *  credential is kept so it can be seen and rotated, but resolves nowhere. */
+    expired?: boolean;
+    /** `"crypto"` for a key the Crypto tool uses (RFC EP); absent for an
+     *  ordinary secret. The fields below are present only for a crypto key. */
+    usage?: "crypto";
+    /** The crypto key's type, fixed for its life. */
+    key_type?: CryptoKeyType;
+    /** The external KMS holding the key; absent for a key held by loomcycle.
+     *  Such a key's versions are the KMS's, rotated and retired there. */
+    key_backend?: CryptoKeyBackend;
+    /** The version new encryptions and signatures use. */
+    current_version?: number;
+    /** The lowest version still used; every version below it is retired. */
+    min_version?: number;
+    /** Every stored version, never its material. */
+    versions?: CryptoKeyVersion[];
+}
+/** One version of a crypto key: when it was made and whether it is retired
+ *  (below `min_version` — nothing decrypts or verifies with it, and only a
+ *  retired version can be deleted). */
+export interface CryptoKeyVersion {
+    version: number;
+    /** RFC3339. */
+    created_at: string;
+    retired: boolean;
 }
 /** CredentialListResponse is the {op:list} result: metadata for the given scope. */
 export interface CredentialListResponse {
     scope: string;
     credentials: CredentialMeta[];
 }
+/** What {@link LoomcycleClient.exportCryptoKey} returns: the key, every
+ *  version of it, encrypted under the passphrase. Hand `blob` and the
+ *  passphrase to {@link LoomcycleClient.importCryptoKey} on the other
+ *  deployment. Anyone holding both holds the key. */
+export interface CryptoKeyExport {
+    name: string;
+    scope: string;
+    blob: string;
+}
+/** A crypto key's type. AEAD (`aes-256-gcm`, `xchacha20-poly1305`):
+ *  encrypt / decrypt / rewrap. HMAC (`hmac-sha256`, `hmac-sha512`): mac /
+ *  verify_mac, and sign / verify as a JWS. Signing (`ed25519`, `ecdsa-p256`,
+ *  `rsa-pss-*`): sign / verify / public_key. Recipient (`x25519`,
+ *  `rsa-oaep-*`): encrypt (a JWE to its public half) / decrypt / public_key.
+ *  `totp`: totp. An RSA key either signs or decrypts, never both. */
+export type CryptoKeyType = "aes-256-gcm" | "xchacha20-poly1305" | "hmac-sha256" | "hmac-sha512" | "ed25519" | "ecdsa-p256" | "totp" | "x25519" | "rsa-oaep-2048" | "rsa-oaep-3072" | "rsa-oaep-4096" | "rsa-pss-2048" | "rsa-pss-3072" | "rsa-pss-4096";
+/** An external KMS that can hold a crypto key. */
+export type CryptoKeyBackend = "vault" | "aws_kms" | "gcp_kms";
+/** Where a key held in an external KMS lives, for
+ *  {@link LoomcycleClient.createKmsCryptoKey}. Each credential field is a
+ *  `$cred:<name>` reference to an ordinary credential in the same scope as
+ *  the key; loomcycle stores only the reference. */
+export type CryptoKeyExternal = {
+    /** Vault Transit. The address's host must be on the operator's host
+     *  allowlist. */
+    backend: "vault";
+    address: string;
+    /** The Transit mount (default `transit`). */
+    mount?: string;
+    /** The Transit key name. */
+    key: string;
+    namespace?: string;
+    /** `$cred:<name>` holding a Vault token. */
+    token: string;
+} | {
+    backend: "aws_kms";
+    region: string;
+    /** A key id, key ARN, `alias/<name>` or alias ARN. */
+    key_id: string;
+    access_key_id: string;
+    secret_access_key: string;
+    session_token?: string;
+} | {
+    backend: "gcp_kms";
+    /** `projects/<p>/locations/<l>/keyRings/<r>/cryptoKeys/<k>`, optionally
+     *  `/cryptoKeyVersions/<n>` (signing and RSA keys only). */
+    key: string;
+    /** `$cred:<name>` holding a service-account key JSON. */
+    service_account: string;
+};
+/** How key material handed in as a string is written. Default by key type:
+ *  base64 for AEAD and HMAC, base32 for totp, pem for the asymmetric types. */
+export type CryptoKeyEncoding = "raw" | "base64" | "hex" | "base32" | "pem";
+/** The Crypto tool's operations. */
+export type CryptoOp = "encrypt" | "decrypt" | "rewrap" | "mac" | "verify_mac" | "sign" | "verify" | "public_key" | "totp" | "hash" | "random" | "hash_password" | "verify_password";
+/** The fields every {@link CryptoRequest} may carry. */
+export interface CryptoRequestBase {
+    /** Admin only (or the legacy token, or open mode): run the op with another
+     *  tenant's keys. It then reaches that tenant's keys and no user keys. A
+     *  non-admin naming a tenant other than its own is refused. */
+    tenant?: string;
+}
+/** Which key an op uses: exactly one of `key` (a crypto key stored with
+ *  CredentialDef — type and versions come with it), `cred` (an ordinary
+ *  stored credential used as key material — needs `key_type`) or `run` (a
+ *  credential a run's caller passed; there is none outside a run, so the
+ *  operator API refuses it). Outside a run the reachable stored keys are the
+ *  token's tenant's and its own subject's user keys. */
+export interface CryptoKeyRef {
+    key?: string;
+    cred?: string;
+    run?: string;
+    /** `key` and `cred`: which scope's key, when more than one reachable scope
+     *  holds that name. An envelope already records it. */
+    key_scope?: "agent" | "user" | "tenant";
+    /** `cred` and `run`: what kind of key the value is. */
+    key_type?: CryptoKeyType;
+    /** `cred` and `run`: how the value is written. */
+    key_encoding?: CryptoKeyEncoding;
+    /** `cred` and `run`: derive an AEAD or HMAC key from any secret instead of
+     *  reading the value as a key. */
+    derive?: boolean;
+    /** `key` only: a version, for public_key or a raw ciphertext. Default: the
+     *  current one (decrypt of a raw ciphertext tries every usable version). */
+    version?: number;
+}
+export interface CryptoEncryptRequest extends CryptoRequestBase, CryptoKeyRef {
+    op: "encrypt";
+    /** Text, or base64 bytes with `input_encoding: "base64"`. */
+    plaintext: string;
+    input_encoding?: "text" | "base64";
+    /** Associated data: the ciphertext decrypts only with the same context.
+     *  Not with a JWE, which carries none. */
+    context?: string;
+    /** `envelope` (default for symmetric keys, names its key), `raw` (base64
+     *  nonce+ct+tag) or `jwe` (aes-256-gcm; the only form for an x25519 or
+     *  rsa-oaep key and for `public_key`). */
+    format?: "envelope" | "raw" | "jwe";
+    /** A PEM or JWK X25519 or RSA public key to encrypt to, in place of a held
+     *  key: the result is a JWE only that key's holder can open. */
+    public_key?: string;
+}
+export interface CryptoDecryptRequest extends CryptoRequestBase, CryptoKeyRef {
+    op: "decrypt";
+    /** Exactly as encrypt returned it: an envelope, raw base64 or a JWE. An
+     *  envelope from a crypto key names its key, so `key` / `cred` / `run` may
+     *  be left out. */
+    ciphertext: string;
+    context?: string;
+    /** Keeps the plaintext out of a run's stored transcript. */
+    sensitive?: boolean;
+    /** `text` (default when the plaintext is UTF-8) or `base64`. */
+    output_encoding?: "text" | "base64";
+}
+export interface CryptoRewrapRequest extends CryptoRequestBase, CryptoKeyRef {
+    op: "rewrap";
+    /** A crypto key's ciphertext; `key` is needed only for a raw one. */
+    ciphertext: string;
+    context?: string;
+}
+export interface CryptoMacRequest extends CryptoRequestBase, CryptoKeyRef {
+    op: "mac";
+    data: string;
+    input_encoding?: "text" | "base64";
+    /** `hex` (default) or `base64`. */
+    output_encoding?: "hex" | "base64";
+}
+export interface CryptoVerifyMacRequest extends CryptoRequestBase, CryptoKeyRef {
+    op: "verify_mac";
+    data: string;
+    /** The MAC to check, hex or base64, with any `sha256=` prefix stripped. */
+    mac: string;
+    input_encoding?: "text" | "base64";
+}
+export interface CryptoSignRequest extends CryptoRequestBase, CryptoKeyRef {
+    op: "sign";
+    /** What to sign; for a JWS, the token's payload. */
+    data: string;
+    input_encoding?: "text" | "base64";
+    /** `raw` (default for signing keys) or `jws` (the only form for a MAC key). */
+    format?: "raw" | "jws";
+}
+export interface CryptoVerifyRequest extends CryptoRequestBase, CryptoKeyRef {
+    op: "verify";
+    /** A raw base64 signature, or a JWS token (then leave `data` out). */
+    signature: string;
+    data?: string;
+    input_encoding?: "text" | "base64";
+    /** A PEM or JWK Ed25519, P-256 or RSA (PS256) public key, in place of a
+     *  held key. */
+    public_key?: string;
+}
+export interface CryptoPublicKeyRequest extends CryptoRequestBase, CryptoKeyRef {
+    op: "public_key";
+}
+export interface CryptoTotpRequest extends CryptoRequestBase, CryptoKeyRef {
+    op: "totp";
+    /** Code length, 6 to 8 (default 6). */
+    digits?: number;
+    /** Seconds per code (default 30). */
+    period?: number;
+}
+/** A digest; needs no key. Never a password store. */
+export interface CryptoHashRequest extends CryptoRequestBase {
+    op: "hash";
+    data: string;
+    input_encoding?: "text" | "base64";
+    /** Default `sha256`. */
+    algorithm?: "sha256" | "sha512" | "sha3-256" | "sha3-512";
+    /** `hex` (default) or `base64`. */
+    output_encoding?: "hex" | "base64";
+}
+/** Secure random values; needs no key. */
+export interface CryptoRandomRequest extends CryptoRequestBase {
+    op: "random";
+    /** `token` (default, URL-safe base64 without padding), `bytes` or `uuid`. */
+    kind?: "token" | "bytes" | "uuid";
+    /** Random bytes for `token` and `bytes`, 1 to 4096 (default 32). */
+    length?: number;
+    /** `bytes` only: `hex` (default) or `base64`. */
+    output_encoding?: "hex" | "base64";
+}
+/** An Argon2id hash of a password to store; needs no key. */
+export interface CryptoHashPasswordRequest extends CryptoRequestBase {
+    op: "hash_password";
+    /** Up to 1024 bytes. */
+    password: string;
+}
+/** Checks a password against a hash from hash_password; needs no key. */
+export interface CryptoVerifyPasswordRequest extends CryptoRequestBase {
+    op: "verify_password";
+    password: string;
+    /** Exactly as hash_password returned it. */
+    password_hash: string;
+}
+/** The body of {@link LoomcycleClient.crypto}, discriminated by `op`. */
+export type CryptoRequest = CryptoEncryptRequest | CryptoDecryptRequest | CryptoRewrapRequest | CryptoMacRequest | CryptoVerifyMacRequest | CryptoSignRequest | CryptoVerifyRequest | CryptoPublicKeyRequest | CryptoTotpRequest | CryptoHashRequest | CryptoRandomRequest | CryptoHashPasswordRequest | CryptoVerifyPasswordRequest;
+/** `key_version` on a result is the crypto key version used; 0 for a `cred`
+ *  or `run` key, which has no versions. */
+export interface CryptoEncryptResult {
+    /** An envelope (`lcx1:…`), base64 with `format: "raw"`, or a compact JWE. */
+    ciphertext: string;
+    /** `"jwe"` when the ciphertext is a JWE. */
+    format?: "jwe";
+    /** Absent when encrypting to a `public_key`. */
+    key_version?: number;
+}
+export interface CryptoDecryptResult {
+    plaintext: string;
+    /** How `plaintext` is written. */
+    encoding: "text" | "base64";
+    key_version: number;
+}
+export interface CryptoRewrapResult {
+    /** Store it in place of the old ciphertext. A JWE stays a JWE. */
+    ciphertext: string;
+    format?: "jwe";
+    from_version: number;
+    key_version: number;
+}
+export interface CryptoMacResult {
+    mac: string;
+    key_version: number;
+}
+/** verify_mac and verify. `valid: false` never says why and carries no
+ *  `key_version`. */
+export interface CryptoVerifyResult {
+    valid: boolean;
+    /** The held key's version that verified. */
+    key_version?: number;
+    /** verify of a JWS token: its `kid` header. */
+    kid?: string;
+    /** verify of a JWS token: its payload. */
+    payload?: string;
+}
+export interface CryptoSignResult {
+    signature: string;
+    format: "raw" | "jws";
+    key_version: number;
+}
+/** A public key as a JWK: `OKP`/`Ed25519` or `OKP`/`X25519` (x), `EC`/`P-256`
+ *  (x, y) or `RSA` (n, e). The `kid` matches the `kid` in tokens the key signs
+ *  or JWEs made to it; an RSA or X25519 key also names its `use` and `alg`. */
+export interface CryptoPublicJWK {
+    kty: "OKP" | "EC" | "RSA";
+    crv?: "Ed25519" | "X25519" | "P-256";
+    x?: string;
+    y?: string;
+    n?: string;
+    e?: string;
+    use?: "sig" | "enc";
+    alg?: "PS256" | "RSA-OAEP-256" | "ECDH-ES";
+    kid?: string;
+}
+export interface CryptoPublicKeyResult {
+    pem: string;
+    jwk: CryptoPublicJWK;
+    key_version: number;
+}
+export interface CryptoTotpResult {
+    code: string;
+    /** RFC3339. */
+    valid_until: string;
+}
+export interface CryptoHashResult {
+    algorithm: string;
+    digest: string;
+}
+export interface CryptoRandomResult {
+    kind: "token" | "bytes" | "uuid";
+    value: string;
+}
+export interface CryptoHashPasswordResult {
+    /** A PHC string (`$argon2id$v=19$m=…,t=…,p=…$salt$hash`), safe to store. */
+    password_hash: string;
+    algorithm: "argon2id";
+}
+export interface CryptoVerifyPasswordResult {
+    valid: boolean;
+}
+/** The result type of each Crypto op. */
+export interface CryptoResultByOp {
+    encrypt: CryptoEncryptResult;
+    decrypt: CryptoDecryptResult;
+    rewrap: CryptoRewrapResult;
+    mac: CryptoMacResult;
+    verify_mac: CryptoVerifyResult;
+    sign: CryptoSignResult;
+    verify: CryptoVerifyResult;
+    public_key: CryptoPublicKeyResult;
+    totp: CryptoTotpResult;
+    hash: CryptoHashResult;
+    random: CryptoRandomResult;
+    hash_password: CryptoHashPasswordResult;
+    verify_password: CryptoVerifyPasswordResult;
+}
+/** Any Crypto op's result. */
+export type CryptoResult = CryptoResultByOp[CryptoOp];
 /** A `choice` question: pick one of the options. Each key of `criteria` is an
  *  option and its value describes it, or is `null` when the key explains
  *  itself. The key is what comes back as the answer. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@loomcycle/client",
-  "version": "1.114.0",
+  "version": "1.116.0",
   "description": "TypeScript client for the loomcycle sidecar (HTTP+SSE). 71 methods covering run streaming, agent metadata, pause/resume/state, resolver re-probe (resolveProbe — issue #88 operator escape hatch), operator-token admin (operatorTokenDef — RFC L OSS multi-tenant auth) + whoami (RFC L authoritative principal, v0.17.0) + tenant-scoped listUsers / listUserAgents, dynamic MCP registration (mcpServerDef + v0.18.0 typed mcpServerDefVerify + ensureMcpServer idempotent register-if-changed), snapshot lifecycle, memory admin (incl. v0.9.0 Vector Memory embed_stats + reembed AND v0.11.5 setMemoryEntry + deleteMemoryEntry), interruption resolve, hook management, v0.8.22 substrate admin (agentDef + skillDef), v0.9.x n8n Phase 0 (listChannels + streamUserRunStates), v0.9.x Channel CRUD (publishChannel + subscribeChannel + peekChannel + ackChannel), v0.11.5 Channel admin CRUD (createChannel + updateChannel + deleteChannel — runtime substrate; yaml channels refuse mutation with HTTP 409), v0.9.x content_sha256 verify, v0.9.1 transcript first-cycle, v0.9.x dynamic MCP server registration (mcpServerDef + MCPServerDefVerifyResult), v0.10.3 Library v2 enumeration (listLibraryAgents + listLibrarySkills + listLibraryMcpServers), and v0.11.0 LLM Gateway (llmChat + llmStream — direct provider routing without agent overhead; primary target is n8n's LoomCycleChatModel AI Agent sub-node and any LangChain-compatible consumer). v0.10.1 — dual ESM + CommonJS distribution (additive — ESM consumers unchanged; CJS consumers like n8n's community-node loader now work). v0.19.0 — typed inline code-js agent ingestion (AgentDefOverlay.code_body + ensureCodeAgent — register a deterministic code agent through the substrate with no host filesystem bind; RFC J). v0.20.0 — ensureMcpServer surfaces discoveredToolCount straight from create (loomcycle now auto-discovers MCP tools at ingestion); rediscover is now an explicit force-refresh. v0.21.0 — run/continue accept optional non-secret `metadata` (repo name, review policy, …) passed to the agent, symmetric with the WebHook/Schedule trigger paths. v0.22.0 — version-aligned lockstep release; no client-surface change (RFC N tenant isolation of the agent/skill/MCP/Schedule/Webhook definition plane + real op-schemas on the builtin MCP meta-tools are both server-side). v0.23.0 — version-aligned lockstep release; no client-surface change (RFCs O/P/R MCP-server hardening + thin client and the RFC Q DeepSeek tool-content fix are all server-side / MCP-transport-side). v0.24.0 — purgeChannel clears a channel's buffered messages without deleting its definition (allowed on yaml-declared channels too, unlike deleteChannel — F20); AgentDefOverlay gains channels / evaluation_scopes / interruption so a COMPLETE interactive/multi-agent agent round-trips over the substrate (F14). (Consolidates the interim 0.24/0.25 package bumps, which were never tag-published, back into lockstep with the loomcycle v0.24.0 tag.) v0.25.0 — adds the RFC S channel fan-in/fan-out client twins: awaitChannels() (wait for any/all/at_least N messages across channels, or a timeout — non-committing) + broadcastChannels() (publish one payload to N channels in one atomic-pre-flight call), the client-facing counterparts of the in-band Channel.await / Channel.broadcast tool ops (the rest of v0.25.0 — the manual-management Web UI console + Context op=time + max_fires self-retiring schedules — is server-side / in-band, no client-surface change). v0.29.1 — Usage gains optional `max_context_tokens` (the serving model's context-window ceiling, stamped by the loop from Provider.Capabilities() on each usage event) so a consumer can render a 'context used / max' gauge without a hard-coded per-model table; additive + optional, no behavior change. (Lockstep catch-up: the field landed in loomcycle v0.29.0 but the adapter publish skipped on a version mismatch; v0.29.1 realigns the package version with the release tag so it publishes.) v0.33.0 — gRPC + TS client parity for the RFC Y external fan-out and the compaction surface: spawnRunBatch() (POST /v1/runs:batch — spawn up to 32 fresh runs concurrently in one call, combined index-aligned envelope, per-child failures in-envelope) + compactRun(runId) (POST /v1/runs/{run_id}/compact — summarize a parked run's context); plus per-run sampling + compaction overrides now accepted on runStreaming / continueSession (an explicit temperature 0 is preserved as deterministic, not dropped as falsy). (The gRPC half adds the matching SpawnRunBatch / CompactRun RPCs + the sampling/compaction fields on RunRequest/ContinueRequest — server-side.) v0.34.0 — version-aligned lockstep release; no client-surface change (context-transform plugins / RFC Z Phase 1a are server-side config; the exp7 hardening pass is server-side; the R2 cross-provider thinking-model downgrade surfaces a new `model_downgraded` SSE event the generic stream passes through unchanged). v0.35.0 — RFC AH dynamic filesystem volumes: volumeDef() (POST /v1/_volumedef — op-discriminated create/get/list/delete/purge; a Volume is flat, so delete unmaps + purge RemoveAll's, no retire/promote/fork) + listVolumes() / listEphemeralVolumes() (GET /v1/_volumes[/ephemeral] — tenant-scoped; host paths redacted for non-operator callers). Tenant-confined; the runtime derives the path inside an operator-blessed dynamic_root, so callers pass name + mode, never a host path. v1.1.1 — RFC AI interactive agentic sessions: an `interactive: true` flag on runStreaming/continueSession (a run that parks at end_turn for steering) + sendRunInput(runId, text) (POST /v1/runs/{id}/input — steer a live run) + streamRunByID(runId, {fromSeq}) (GET /v1/runs/{id}/stream — re-attach by run_id; the operator's prior turns replay as `steer` events so a cold client reconstructs the whole conversation) + a high-level InteractiveSession driver (client.interactiveSession / attachInteractiveSession — events()/send()/cancel(), the adapter port of the Web UI run terminal). The AgentEvent union gains awaiting_input/steer/context_compaction frames. Version-aligned with the loomcycle v1.1.x line so the v1.1.1 tag publishes it (also carrying the previously-unpublished v0.35.0 volume surface). v1.4.0 — RFC AL Path VFS + RFC AK Document on the wire: path(input) (POST /v1/_path — a Unix-like filesystem over Memory/Volumes/Documents; resolve/ls/stat/mkdir/mv/rm) + document(input) (POST /v1/_document — chunked-graph documents; 13 ops, needs SQL Memory on the sidecar). Scope (agent/user/tenant) + tenant are resolved server-side from the authenticated principal, never the wire; an off-run scope:'user' op keys on the principal subject so it interoperates with that user's agent runs. New PathToolInput / DocumentToolInput types; responses are op-varying (unknown — narrow as needed). v1.7.0 — RFC AT image/vision input: the PromptContent union gains an `image` variant ({ type:'image'; media_type: ImageMediaType; data: base64-no-prefix }) accepted in a user segment by runStreaming / continueSession (segments pass through unchanged — no method change). The model must be vision-capable or the run errors before the call. New ImageMediaType type (image/png|jpeg|gif|webp). v1.12.1 — Path/Document browse-by-subject + the full Document op set (RFC AS/AK): path(input, opts) / document(input, opts) accept optional scopeId / tenant browse overrides sent as ?scope_id= / ?tenant= query params (server reads them from the URL, re-checks authorization; omit both to browse your own subject — byte-identical to the pre-RFC-AS request), and DocumentToolInput.op now covers all 16 backend ops (adds set_path, export_md, import_md) with the matching include_metadata / markdown fields. Additive — existing path() / document() callers are unchanged. v1.16.0 — RFC BC client-executed tools (local tool host): connectClientTools({tools,onInvoke}) opens a persistent WebSocket to /v1/client-tools, registers tools this client runs on the user's machine (browser DOM / files / shell), and answers the invoke frames loomcycle routes when an agent of your principal calls a client:<tool> — returning your reply as an ordinary tool result. Returns a ClientToolHost driver (.close() to stop; auto-reconnect); dependency-free (global WebSocket in browsers / Node 22+, or an injected WebSocketImpl like the ws package on older Node); the bearer rides the Sec-WebSocket-Protocol subprotocol (browsers can't set an Authorization header on a WebSocket). The runtime's first WebSocket surface. v1.45.0 — RFC BL P5 subject erasure: erasureReport(subject, {tenant}) (GET /v1/_erasure — what this deployment holds about one subject, in three tiers: deletable with existing primitives, subject-keyed but not deletable, and facts ABOUT the subject in scopes they do not own) + erasureExecute(subject, {dryRun, confirm, tenant}) (POST /v1/_erasure — removes tiers 1 and 2). DEFAULTS TO A DRY RUN: dryRun defaults true and a live run also requires confirm === subject. The tier-3 residue is traceable only through the subject's chats, which a live run deletes, so a report afterwards shows rows: 0 while those facts remain — the returned object is the only durable record of what was not reached; persist it. New ErasureReport / ErasureResult / ErasureTier / ErasureResidue types. v1.47.0 — RFC BV memory-view SDK: memorySearch() (POST /v1/_memory/search — off-run unified semantic search spanning k/v entries AND document-chunk bodies in one ranked list, each hit tagged kind memory|document with chunk_id on document hits) + memoryEmbedStats(scope) + reembedMemory(scope, scopeId, {dryRun,limit}) (the Vector Memory embed-admin reads the memory-view console needs; dry_run defaults true). Fact reads (list_facts + get_chunk's entity block) ride the existing document() passthrough. Additive — existing callers unchanged. v1.61.0 — RFC CJ per-run context-window override: runStreaming / continueSession accept an optional maxContextTokens (integer tokens) that wins over the agent's own max_context_tokens; omitted inherits it (which defers to the provider/driver default). Distinct from a model's output cap; primarily for local inference (Ollama num_ctx). Serialized as the snake_case max_context_tokens field on POST /v1/runs + the continuation body; additive, existing callers unchanged. v1.72.1 — the TeamDef version lifecycle: listTeamVersions(name) (op=list — every version of one team, newest first), promoteTeam(defId) (op=promote — point the active pointer, which is what a run BY NAME executes; forkTeam defaults to promote:false, so authoring and putting in force stay two steps), retireTeam(defId, retired) (op=retire — reversible and version-scoped, unlike deleteTeam) and verifyTeam(name, contentSha256) (op=verify — the drift check for a workflow kept in source control and pushed to several deployments; an absent team answers deployed:false rather than raising). The ops existed on the substrate and over HTTP; a client that could author a team could not put one in force.",
   "license": "Apache-2.0",
   "type": "module",