@loomcycle/client 1.147.0 → 1.148.0

package/README.md

@@ -600,6 +600,7 @@ The tenant is your own. `opts.tenant` names another for an admin token, and for
 | `listGateIdentities(gate, subject, opts?)` | `GET /v1/_authgate/{gate}/identities?subject=` | `GateIdentitiesResponse` — logins, `has_password`, `has_totp` |
 | `getGateTenantStatus(gate, opts?)` | `GET /v1/_authgate/{gate}/tenant-status` | `GateTenantStatus` — whether the tenant has, or ever had, a user, and whether an owner invite is live |
 | `deviceLogin({onPrompt, clientId?, signal?})` | `POST /v1/_auth/device`, then `POST /v1/_auth/device/token` | `DeviceLoginResult` — signs a person in through the server's device gate (RFC 8628): `onPrompt` gets the code to show, the person approves it at `/ui/device`, and the token is theirs, never outliving the session they approved from. Sends no bearer. `DeviceLoginError` (`code` `access_denied` / `expired_token`) otherwise |
+| `clientToolsTicket(opts?)` | `POST /v1/client-tools/ticket` | `{ticket, expiresAt}` — a one-time ticket that opens one client-tool socket within 30 s, presented as `ticket.<t>` in `Sec-WebSocket-Protocol`. `connectClientTools` mints one before every connect and reconnect; it falls back to the `bearer.<token>` entry only on a server without tickets (404/405, or 503 `ticket_unavailable`) that does not run strict sign-in. 503 `ticket_unavailable` without `LOOMCYCLE_SECRET_KEY` |
 
 None of these takes a password: the person sets their own through the invite or reset link. Hand the link's `url` to the person and do not log it — its fragment is the one-time code.
 
@@ -702,7 +703,7 @@ const tokens = await oauth.completeAuthorize({
 
 A Tauri app may register a private-use scheme instead (`loomboard://auth/callback`) and pass the deep link it receives to `parseAuthorizeResponse`. Token calls made from its webview send the origin `tauri://localhost`, which the client must list in `allowed_origins`; calls from the Rust or Node side send none.
 
-**The token provider.** `new LoomcycleClient({ tokenProvider })` (instead of `authToken`; passing both throws) asks the provider for the bearer on every request, `connectClientTools` included. `OAuthTokenProvider` refreshes 60 s before the access token expires (`refreshSkewMs`), and once after a 401: the request is retried a single time with the new token, never more. Concurrent requests share one refresh. Any other source of short-lived tokens can implement `TokenProvider` (`getToken`, optional `onUnauthorized`).
+**The token provider.** `new LoomcycleClient({ tokenProvider })` (instead of `authToken`; passing both throws) asks the provider for the bearer on every request, `connectClientTools`'s ticket mint included. `OAuthTokenProvider` refreshes 60 s before the access token expires (`refreshSkewMs`), and once after a 401: the request is retried a single time with the new token, never more. Concurrent requests share one refresh. Any other source of short-lived tokens can implement `TokenProvider` (`getToken`, optional `onUnauthorized`).
 
 Things to know:
 

package/dist/cjs/client-tools.js

@@ -8,9 +8,11 @@
 //
 // Transport note: the adapter is otherwise fetch/SSE-only and takes no WebSocket
 // dependency. connectClientTools uses the global `WebSocket` (browsers, Node
-// 22+); on older Node pass `WebSocketImpl` (e.g. the `ws` package). The bearer
-// rides the `Sec-WebSocket-Protocol` subprotocol (browsers can't set an
-// Authorization header on a WebSocket).
+// 22+); on older Node pass `WebSocketImpl` (e.g. the `ws` package). Browsers
+// can't set an Authorization header on a WebSocket, so the credential rides the
+// `Sec-WebSocket-Protocol` header: a one-time ticket (`ticket.<t>`, minted over
+// an ordinary authenticated call) where the server offers one, else the
+// bearer itself (`bearer.<token>`, older servers, never in strict sign-in).
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ClientToolHost = exports.CLIENT_TOOL_SUBPROTOCOL = void 0;
 exports.clientToolsURL = clientToolsURL;
@@ -29,9 +31,11 @@ class ClientToolHost {
     opts;
     ws;
     closed = false;
-    /** `auth` is the bearer, or a function that supplies one on each
-     *  (re)connect — a client built with a token provider passes one, so a
-     *  reconnect after the access token expired carries the refreshed one. */
+    /** `auth` is the bearer, or a function that supplies the credential on
+     *  each (re)connect — a bearer, or a fresh one-time ticket. A ticket is
+     *  spent by the handshake, so connectClientTools passes a function that
+     *  mints one per connect; a reconnect after an access token expired then
+     *  carries the refreshed one too. */
     constructor(url, auth, opts) {
         this.url = url;
         this.auth = auth;
@@ -54,7 +58,7 @@ class ClientToolHost {
             throw new Error("connectClientTools: no WebSocket implementation available — pass WebSocketImpl (e.g. the `ws` package) on Node < 22");
         }
         if (typeof this.auth === "function") {
-            this.auth().then((token) => this.open(WS, token), (err) => {
+            this.auth().then((cred) => this.open(WS, cred), (err) => {
                 this.opts.onError?.(err);
                 // A sign-in that ended does not come back by retrying: stop
                 // rather than ask again every few seconds.
@@ -69,12 +73,20 @@ class ClientToolHost {
         }
         this.open(WS, this.auth);
     }
-    open(WS, token) {
+    open(WS, cred) {
         if (this.closed)
             return;
         const protocols = [exports.CLIENT_TOOL_SUBPROTOCOL];
-        if (token)
-            protocols.push("bearer." + token);
+        if (typeof cred === "string") {
+            if (cred)
+                protocols.push("bearer." + cred);
+        }
+        else if (cred && "ticket" in cred) {
+            protocols.push("ticket." + cred.ticket);
+        }
+        else if (cred?.bearer) {
+            protocols.push("bearer." + cred.bearer);
+        }
         this.opts.onStatus?.("connecting");
         const ws = new WS(this.url, protocols);
         this.ws = ws;

package/dist/cjs/client.js

@@ -26,6 +26,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LoomcycleClient = void 0;
+const errors_js_1 = require("./errors.js");
 const fetch_helpers_js_1 = require("./fetch-helpers.js");
 const stream_js_1 = require("./stream.js");
 const interactive_js_1 = require("./interactive.js");
@@ -1684,14 +1685,50 @@ class LoomcycleClient {
      *  `.close()` to stop. Uses the global WebSocket (browsers, Node 22+); pass
      *  `WebSocketImpl` (e.g. the `ws` package) on older Node. */
     connectClientTools(opts) {
-        // A provider is asked on every (re)connect, so a host outliving one
-        // access token reconnects with the next.
-        const provider = this.tokenProvider;
-        const auth = provider ? () => provider.getToken() : this.ctx.authToken;
+        // With a credential, every (re)connect mints a fresh one-time ticket (a
+        // ticket is spent by the handshake); a host outliving one access token
+        // mints the next through the provider. Without one (an open-mode
+        // server) the socket is opened bare, as before.
+        const auth = this.tokenProvider || this.ctx.authToken ? () => this.clientToolsCredential() : undefined;
         const host = new client_tools_js_1.ClientToolHost((0, client_tools_js_1.clientToolsURL)(this.ctx.baseUrl), auth, opts);
         host.start();
         return host;
     }
+    /** Mint a one-time ticket for the client-tool socket (RFC GJ): POST
+     *  /v1/client-tools/ticket with this client's credential. The ticket opens
+     *  one socket, within 30 s of the mint, as `ticket.<t>` in
+     *  Sec-WebSocket-Protocol — the way a browser opens the socket under
+     *  strict sign-in, where the bearer is not read from that header.
+     *  connectClientTools calls it for you on every connect. */
+    async clientToolsTicket(opts) {
+        const out = await (0, fetch_helpers_js_1.postJSON)(this.ctx, "/v1/client-tools/ticket", undefined, opts);
+        return { ticket: out.ticket, expiresAt: out.expires_at };
+    }
+    /** The credential a client-tool connect presents: a fresh ticket, or —
+     *  only when the server has no ticket route (an older runtime: 404/405)
+     *  or issues no tickets (503 ticket_unavailable) and does not run strict
+     *  sign-in — the bearer itself, as before. Under strict sign-in the
+     *  bearer is never put in the handshake header: the server would not
+     *  read it, and proxies and access logs do not treat that header as a
+     *  credential. */
+    async clientToolsCredential() {
+        try {
+            return { ticket: (await this.clientToolsTicket()).ticket };
+        }
+        catch (err) {
+            const noTicket = err instanceof errors_js_1.LoomcycleError &&
+                (err.status === 404 || err.status === 405 || (err.status === 503 && err.code === "ticket_unavailable"));
+            if (!noTicket)
+                throw err;
+            const me = await this.whoami();
+            if (me.auth?.mode === "strict") {
+                throw new errors_js_1.LoomcycleError("connectClientTools: this loomcycle runs strict sign-in and issues no client-tool ticket " +
+                    "(it needs a release with POST /v1/client-tools/ticket and LOOMCYCLE_SECRET_KEY set)", { code: "ticket_unavailable" });
+            }
+            const token = this.tokenProvider ? await this.tokenProvider.getToken() : this.ctx.authToken;
+            return token ? { bearer: token } : undefined;
+        }
+    }
     /** Restore from a same-instance snapshot id OR an inline
      *  envelope JSON. Idempotent: ON CONFLICT DO NOTHING per row;
      *  the returned counters reflect rows actually written.
@@ -2914,6 +2951,31 @@ class LoomcycleClient {
     async moveDocuments(input, opts) {
         return (await this.document({ op: "move_documents", ...input }, opts));
     }
+    /** The annotations of one chunk, document (`document_id`) or folder
+     *  (`level: "path"` with `path`), each marked `stale` or current (the Document
+     *  tool's `get_annotation`). Tenant scope; `scope` defaults to `"tenant"`. A
+     *  folder's annotation is left out unless the caller may read every document
+     *  it covers. `opts` as on {@link LoomcycleClient.document}. */
+    async getAnnotation(input, opts) {
+        return (await this.document({ op: "get_annotation", scope: "tenant", ...input }, opts));
+    }
+    /** Page through the tenant's annotations with filters (the Document tool's
+     *  `list_annotations`). Pass the answer's `next_cursor` as `after` for the
+     *  next page. `opts` as on {@link LoomcycleClient.document}. */
+    async listAnnotations(input = {}, opts) {
+        return (await this.document({ op: "list_annotations", scope: "tenant", ...input }, opts));
+    }
+    /** Write an annotation (the Document tool's `set_annotation`). Without
+     *  `inputs_sha256` it is sent as an operator's manual annotation
+     *  (`manual: true`), which the annotation pass never overwrites; the operator
+     *  plane alone may write one. `opts` as on {@link LoomcycleClient.document}. */
+    async annotate(input, opts) {
+        const body = { op: "set_annotation", scope: "tenant", ...input };
+        if (input.inputs_sha256 === undefined && input.manual === undefined) {
+            body.manual = true;
+        }
+        return (await this.document(body, opts));
+    }
     /** Find the copies in a set of documents (the Document tool's
      *  `find_duplicates`, RFC GB): the same text by sha256, or the same title once
      *  copy markers are stripped, each copy pointed at its original. A report

package/dist/cjs/index.js

@@ -165,6 +165,7 @@
  *     document(input): Promise<DocumentToolResponse>              // 13 ops; needs SQL Memory
  *     copyDocuments(input) / moveDocuments(input): Promise<DocumentTransferResult> // RFC FT, dry run by default
  *     findDuplicates(input): Promise<DocumentFindDuplicatesResult> // RFC GB, a report unless propose: true
+ *     getAnnotation / listAnnotations / annotate                  // a brief + abstract per section, document, folder
  *
  *     // History — browse/search/annotate past chats (RFC BE; tenant-confined)
  *     history(input): Promise<HistoryToolResponse>                // list/get/search/rename/annotate/pin/archive/recap/resume

package/dist/client-tools.d.ts

@@ -27,6 +27,13 @@ export interface WebSocketLike {
     }) => void) | null;
 }
 export type WebSocketCtor = new (url: string, protocols?: string | string[]) => WebSocketLike;
+/** What a client-tool socket presents on its handshake: a one-time ticket
+ *  (preferred; see LoomcycleClient.clientToolsTicket) or the bearer itself. */
+export type ClientToolsCredential = {
+    ticket: string;
+} | {
+    bearer: string;
+};
 export interface ConnectClientToolsOptions {
     /** The tools this client provides. */
     tools: ClientToolSchema[];
@@ -59,10 +66,12 @@ export declare class ClientToolHost {
     private readonly opts;
     private ws?;
     private closed;
-    /** `auth` is the bearer, or a function that supplies one on each
-     *  (re)connect — a client built with a token provider passes one, so a
-     *  reconnect after the access token expired carries the refreshed one. */
-    constructor(url: string, auth: string | undefined | (() => Promise<string | undefined>), opts: ConnectClientToolsOptions);
+    /** `auth` is the bearer, or a function that supplies the credential on
+     *  each (re)connect — a bearer, or a fresh one-time ticket. A ticket is
+     *  spent by the handshake, so connectClientTools passes a function that
+     *  mints one per connect; a reconnect after an access token expired then
+     *  carries the refreshed one too. */
+    constructor(url: string, auth: string | undefined | (() => Promise<string | ClientToolsCredential | undefined>), opts: ConnectClientToolsOptions);
     /** Open the connection (called for you by connectClientTools). */
     start(): void;
     /** Stop the host + close the socket; suppresses reconnect. */

package/dist/client-tools.js

@@ -7,9 +7,11 @@
 //
 // Transport note: the adapter is otherwise fetch/SSE-only and takes no WebSocket
 // dependency. connectClientTools uses the global `WebSocket` (browsers, Node
-// 22+); on older Node pass `WebSocketImpl` (e.g. the `ws` package). The bearer
-// rides the `Sec-WebSocket-Protocol` subprotocol (browsers can't set an
-// Authorization header on a WebSocket).
+// 22+); on older Node pass `WebSocketImpl` (e.g. the `ws` package). Browsers
+// can't set an Authorization header on a WebSocket, so the credential rides the
+// `Sec-WebSocket-Protocol` header: a one-time ticket (`ticket.<t>`, minted over
+// an ordinary authenticated call) where the server offers one, else the
+// bearer itself (`bearer.<token>`, older servers, never in strict sign-in).
 import { OAuthError } from "./errors.js";
 /** The app-level subprotocol the server negotiates for /v1/client-tools. */
 export const CLIENT_TOOL_SUBPROTOCOL = "loomcycle.client-tools.v1";
@@ -25,9 +27,11 @@ export class ClientToolHost {
     opts;
     ws;
     closed = false;
-    /** `auth` is the bearer, or a function that supplies one on each
-     *  (re)connect — a client built with a token provider passes one, so a
-     *  reconnect after the access token expired carries the refreshed one. */
+    /** `auth` is the bearer, or a function that supplies the credential on
+     *  each (re)connect — a bearer, or a fresh one-time ticket. A ticket is
+     *  spent by the handshake, so connectClientTools passes a function that
+     *  mints one per connect; a reconnect after an access token expired then
+     *  carries the refreshed one too. */
     constructor(url, auth, opts) {
         this.url = url;
         this.auth = auth;
@@ -50,7 +54,7 @@ export class ClientToolHost {
             throw new Error("connectClientTools: no WebSocket implementation available — pass WebSocketImpl (e.g. the `ws` package) on Node < 22");
         }
         if (typeof this.auth === "function") {
-            this.auth().then((token) => this.open(WS, token), (err) => {
+            this.auth().then((cred) => this.open(WS, cred), (err) => {
                 this.opts.onError?.(err);
                 // A sign-in that ended does not come back by retrying: stop
                 // rather than ask again every few seconds.
@@ -65,12 +69,20 @@ export class ClientToolHost {
         }
         this.open(WS, this.auth);
     }
-    open(WS, token) {
+    open(WS, cred) {
         if (this.closed)
             return;
         const protocols = [CLIENT_TOOL_SUBPROTOCOL];
-        if (token)
-            protocols.push("bearer." + token);
+        if (typeof cred === "string") {
+            if (cred)
+                protocols.push("bearer." + cred);
+        }
+        else if (cred && "ticket" in cred) {
+            protocols.push("ticket." + cred.ticket);
+        }
+        else if (cred?.bearer) {
+            protocols.push("bearer." + cred.bearer);
+        }
         this.opts.onStatus?.("connecting");
         const ws = new WS(this.url, protocols);
         this.ws = ws;

package/dist/client.d.ts

@@ -26,7 +26,7 @@
 import { InteractiveSession } from "./interactive.js";
 import { LoomcycleOAuth } from "./oauth.js";
 import { ClientToolHost, type ConnectClientToolsOptions } from "./client-tools.js";
-import type { ChangeFeedFrame, StreamChangesOptions, DocumentFeedFrame, DocumentFeedOptions, CredentialListResponse, CredentialMeta, OAuthConnectStart, OAuthCredentialConfig, CryptoKeyEncoding, CryptoKeyExport, CryptoKeyExternal, CryptoKeyType, CryptoRequest, CryptoResultByOp, DecideRequest, DecideResponse, DecisionModelsResponse, SpeechOptions, SpeechResult, TranscribeOptions, TranscribeResult, SpeechInfo, CredentialScope, DirectoryInspection, DirectoryTenant, DirectoryUser, ErasureReport, ErasureResult, MergeSubjectsResult, ReviewQueueFilter, ReviewQueueResult, RuleStatementsResult, RevertRulingResult, ListRulingsResult, ApplyReviewPolicyResult, BindSubjectPrincipalResult, Agent, AgentEvent, AgentList, CancelAgentResult, ClientOptions, ContinueOptions, RunOverrideOptions, EffectiveConfigResponse, RunFileInput, RunInboxDownload, AgentOverridableResponse, RetuneRunResponse, RunConfigResponse, RunPromptResponse, CreateSnapshotOptions, EnsureCodeAgentOptions, EnsureCodeAgentResult, EnsureHookDefOptions, EnsureHookDefResult, HookDefInput, HookDefOverlay, HookDefRowResponse, CreateDefOptions, ForkDefOptions, HookDefForkOverlay, ScheduleDefInput, ScheduleDefOverlay, ScheduleDefRowResponse, WebhookDefInput, WebhookDefOverlay, WebhookDefRowResponse, EnsureMcpServerOptions, EnsureMcpServerResult, HealthResponse, InterruptListResponse, InterruptStatus, ListUserAgentsOptions, WalkRunsPage, AckChannelOptions, AwaitChannelsOptions, BroadcastChannelsOptions, ChannelAckResult, ChannelAwaitResult, ChannelBroadcastResult, ChannelDescriptor, ChannelPeekResult, ListTeamChannelsOptions, PeekTeamChannelOptions, ReleaseTeamChannelOptions, TeamChannelPeekResult, TeamChannelReleaseResult, TeamChannelsResult, ChannelPublishResult, ChannelPurgeResult, ChannelReleaseResult, ChannelSubscribeResult, CreateChannelOptions, ListChannelsResponse, PeekChannelOptions, PublishChannelOptions, ReleaseChannelOptions, SetMemoryEntryOptions, SetMemoryEntryResponse, SubscribeChannelOptions, UpdateChannelOptions, LibraryAgentDefinition, LibraryListResponse, LibraryMcpServerDefinition, LibrarySkillDefinition, ListUsersResponse, UserRecord, CreateUserBody, UpdateUserBody, MintedUserToken, TokenSurface, ListUserTokensResponse, UserIdentitiesResponse, AppSignInsResponse, AuthGateListResponse, CreateInviteBody, CreatedInvite, AuthInviteListResponse, CreatedPasswordReset, GateIdentitiesResponse, GateTenantStatus, RunnableAgentsResponse, LLMChatOptions, LLMChatResponse, LLMChatStreamItem, LLMEmbeddingsOptions, LLMEmbeddingsResponse, MCPServerDefVerifyResult, MemoryEmbedStatsResponse, MemoryEntriesResponse, MemoryEntryResponse, MemoryBackfillResponse, MemoryPurgeResponse, MemoryReembedResponse, MemoryScopeIDsResponse, MemoryScopesResponse, MemorySearchInput, MemorySearchResponse, PauseResult, RetentionOverride, PersistentVolumesResponse, EphemeralVolumesResponse, ResolveInterruptOptions, ResumeResult, ResolverMatrix, CompactRunResult, RunTreeDeletion, ReplaySessionResult, CancelTurnResult, ReviewRunResult, RunBatchOptions, RunBatchResult, RunOptions, ConfiguredRun, ConfiguredRunPatch, RunStateStreamItem, RuntimeStateResponse, SnapshotCreateResponse, SnapshotDescriptor, SnapshotEnvelope, SnapshotRestoreResponse, StreamUserRunStatesOptions, SubstrateToolInput, SubstrateToolResponse, CreatedTeam, CreateTeamOptions, DefNamesResponse, ForkTeamOptions, ModelAliasesResponse, OperatorTokenDefNamesResponse, ProviderModelsResponse, RoutingResponse, ScheduleListResponse, SchedulePauseResult, ScheduleRunNowResult, ScheduleStateView, ListTeamsResponse, PromotedTeam, RetiredTeam, TeamBreakpoints, TeamDefDetail, TeamRunDetached, TeamRunTarget, TeamVerification, TeamDraft, TeamDraftVerification, TeamVersionList, TeamDiagram, TeamRunResult, PathToolInput, PathToolResponse, DocumentToolInput, DocumentToolResponse, DocumentCopyInput, DocumentMoveInput, DocumentFindDuplicatesInput, DocumentFindDuplicatesResult, DocumentTransferResult, HistoryToolInput, HistoryToolResponse, EvaluationSubmitInput, EvaluationGetInput, EvaluationListForRunInput, EvaluationListForDefInput, EvaluationAggregateInput, EvaluationInput, EvaluationSubmitResult, EvaluationRecord, EvaluationListForRunResult, EvaluationListForDefResult, EvaluationAggregate, TranscriptResponse, WhoamiResponse, UsageDimension, UsageBucket, UsageReportResponse, TokenLimit, TokenLimitsResponse, ConfigResponse, SetTokenLimitRequest, AclBinding, AclBindingListResponse, AclCatalog, AclDefInput, AclDefListResponse, AclDefNamesResponse, AclDefRow, AclRule, AclValidateResult, AuthzDecision, AuthzEvaluationRequest, AuthzEvaluationsRequest, AuthzEvaluationsResponse, AuthzExplainResponse, AuthzSimulateRequest, AuthzSimulateResponse, CreateAclBindingBody, CreateGroupBody, GroupDetail, GroupEffective, GroupListResponse, GroupMemberChange, GroupMemberKind, GroupRow, AppClientConfig, AppClientEntry, ClientDefInput, ClientDefListResponse, ClientDefNamesResponse, ClientDefRecord, ClientDefRetireResult, ClientDefVerifyResult, DeviceLoginOptions, DeviceLoginResult } from "./types.js";
+import type { ChangeFeedFrame, StreamChangesOptions, DocumentFeedFrame, DocumentFeedOptions, CredentialListResponse, CredentialMeta, OAuthConnectStart, OAuthCredentialConfig, CryptoKeyEncoding, CryptoKeyExport, CryptoKeyExternal, CryptoKeyType, CryptoRequest, CryptoResultByOp, DecideRequest, DecideResponse, DecisionModelsResponse, SpeechOptions, SpeechResult, TranscribeOptions, TranscribeResult, SpeechInfo, CredentialScope, DirectoryInspection, DirectoryTenant, DirectoryUser, ErasureReport, ErasureResult, MergeSubjectsResult, ReviewQueueFilter, ReviewQueueResult, RuleStatementsResult, RevertRulingResult, ListRulingsResult, ApplyReviewPolicyResult, BindSubjectPrincipalResult, Agent, AgentEvent, AgentList, CancelAgentResult, ClientOptions, ContinueOptions, RunOverrideOptions, EffectiveConfigResponse, RunFileInput, RunInboxDownload, AgentOverridableResponse, RetuneRunResponse, RunConfigResponse, RunPromptResponse, CreateSnapshotOptions, EnsureCodeAgentOptions, EnsureCodeAgentResult, EnsureHookDefOptions, EnsureHookDefResult, HookDefInput, HookDefOverlay, HookDefRowResponse, CreateDefOptions, ForkDefOptions, HookDefForkOverlay, ScheduleDefInput, ScheduleDefOverlay, ScheduleDefRowResponse, WebhookDefInput, WebhookDefOverlay, WebhookDefRowResponse, EnsureMcpServerOptions, EnsureMcpServerResult, HealthResponse, InterruptListResponse, InterruptStatus, ListUserAgentsOptions, WalkRunsPage, AckChannelOptions, AwaitChannelsOptions, BroadcastChannelsOptions, ChannelAckResult, ChannelAwaitResult, ChannelBroadcastResult, ChannelDescriptor, ChannelPeekResult, ListTeamChannelsOptions, PeekTeamChannelOptions, ReleaseTeamChannelOptions, TeamChannelPeekResult, TeamChannelReleaseResult, TeamChannelsResult, ChannelPublishResult, ChannelPurgeResult, ChannelReleaseResult, ChannelSubscribeResult, CreateChannelOptions, ListChannelsResponse, PeekChannelOptions, PublishChannelOptions, ReleaseChannelOptions, SetMemoryEntryOptions, SetMemoryEntryResponse, SubscribeChannelOptions, UpdateChannelOptions, LibraryAgentDefinition, LibraryListResponse, LibraryMcpServerDefinition, LibrarySkillDefinition, ListUsersResponse, UserRecord, CreateUserBody, UpdateUserBody, MintedUserToken, TokenSurface, ListUserTokensResponse, UserIdentitiesResponse, AppSignInsResponse, AuthGateListResponse, CreateInviteBody, CreatedInvite, AuthInviteListResponse, CreatedPasswordReset, GateIdentitiesResponse, GateTenantStatus, RunnableAgentsResponse, LLMChatOptions, LLMChatResponse, LLMChatStreamItem, LLMEmbeddingsOptions, LLMEmbeddingsResponse, MCPServerDefVerifyResult, MemoryEmbedStatsResponse, MemoryEntriesResponse, MemoryEntryResponse, MemoryBackfillResponse, MemoryPurgeResponse, MemoryReembedResponse, MemoryScopeIDsResponse, MemoryScopesResponse, MemorySearchInput, MemorySearchResponse, PauseResult, RetentionOverride, PersistentVolumesResponse, EphemeralVolumesResponse, ResolveInterruptOptions, ResumeResult, ResolverMatrix, CompactRunResult, RunTreeDeletion, ReplaySessionResult, CancelTurnResult, ReviewRunResult, RunBatchOptions, RunBatchResult, RunOptions, ConfiguredRun, ConfiguredRunPatch, RunStateStreamItem, RuntimeStateResponse, SnapshotCreateResponse, SnapshotDescriptor, SnapshotEnvelope, SnapshotRestoreResponse, StreamUserRunStatesOptions, SubstrateToolInput, SubstrateToolResponse, CreatedTeam, CreateTeamOptions, DefNamesResponse, ForkTeamOptions, ModelAliasesResponse, OperatorTokenDefNamesResponse, ProviderModelsResponse, RoutingResponse, ScheduleListResponse, SchedulePauseResult, ScheduleRunNowResult, ScheduleStateView, ListTeamsResponse, PromotedTeam, RetiredTeam, TeamBreakpoints, TeamDefDetail, TeamRunDetached, TeamRunTarget, TeamVerification, TeamDraft, TeamDraftVerification, TeamVersionList, TeamDiagram, TeamRunResult, PathToolInput, PathToolResponse, DocumentToolInput, DocumentToolResponse, DocumentCopyInput, DocumentMoveInput, DocumentFindDuplicatesInput, DocumentFindDuplicatesResult, DocumentAnnotation, DocumentListAnnotationsInput, DocumentListAnnotationsResult, DocumentAnnotateInput, DocumentTransferResult, HistoryToolInput, HistoryToolResponse, EvaluationSubmitInput, EvaluationGetInput, EvaluationListForRunInput, EvaluationListForDefInput, EvaluationAggregateInput, EvaluationInput, EvaluationSubmitResult, EvaluationRecord, EvaluationListForRunResult, EvaluationListForDefResult, EvaluationAggregate, TranscriptResponse, WhoamiResponse, UsageDimension, UsageBucket, UsageReportResponse, TokenLimit, TokenLimitsResponse, ConfigResponse, SetTokenLimitRequest, AclBinding, AclBindingListResponse, AclCatalog, AclDefInput, AclDefListResponse, AclDefNamesResponse, AclDefRow, AclRule, AclValidateResult, AuthzDecision, AuthzEvaluationRequest, AuthzEvaluationsRequest, AuthzEvaluationsResponse, AuthzExplainResponse, AuthzSimulateRequest, AuthzSimulateResponse, CreateAclBindingBody, CreateGroupBody, GroupDetail, GroupEffective, GroupListResponse, GroupMemberChange, GroupMemberKind, GroupRow, AppClientConfig, AppClientEntry, ClientDefInput, ClientDefListResponse, ClientDefNamesResponse, ClientDefRecord, ClientDefRetireResult, ClientDefVerifyResult, DeviceLoginOptions, DeviceLoginResult } from "./types.js";
 export declare class LoomcycleClient {
     private ctx;
     private readonly tokenProvider?;
@@ -1185,6 +1185,26 @@ export declare class LoomcycleClient {
      *  `.close()` to stop. Uses the global WebSocket (browsers, Node 22+); pass
      *  `WebSocketImpl` (e.g. the `ws` package) on older Node. */
     connectClientTools(opts: ConnectClientToolsOptions): ClientToolHost;
+    /** Mint a one-time ticket for the client-tool socket (RFC GJ): POST
+     *  /v1/client-tools/ticket with this client's credential. The ticket opens
+     *  one socket, within 30 s of the mint, as `ticket.<t>` in
+     *  Sec-WebSocket-Protocol — the way a browser opens the socket under
+     *  strict sign-in, where the bearer is not read from that header.
+     *  connectClientTools calls it for you on every connect. */
+    clientToolsTicket(opts?: {
+        signal?: AbortSignal;
+    }): Promise<{
+        ticket: string;
+        expiresAt: string;
+    }>;
+    /** The credential a client-tool connect presents: a fresh ticket, or —
+     *  only when the server has no ticket route (an older runtime: 404/405)
+     *  or issues no tickets (503 ticket_unavailable) and does not run strict
+     *  sign-in — the bearer itself, as before. Under strict sign-in the
+     *  bearer is never put in the handshake header: the server would not
+     *  read it, and proxies and access logs do not treat that header as a
+     *  credential. */
+    private clientToolsCredential;
     /** Restore from a same-instance snapshot id OR an inline
      *  envelope JSON. Idempotent: ON CONFLICT DO NOTHING per row;
      *  the returned counters reflect rows actually written.
@@ -2167,6 +2187,43 @@ export declare class LoomcycleClient {
         scopeId?: string;
         tenant?: string;
     }): Promise<DocumentTransferResult>;
+    /** The annotations of one chunk, document (`document_id`) or folder
+     *  (`level: "path"` with `path`), each marked `stale` or current (the Document
+     *  tool's `get_annotation`). Tenant scope; `scope` defaults to `"tenant"`. A
+     *  folder's annotation is left out unless the caller may read every document
+     *  it covers. `opts` as on {@link LoomcycleClient.document}. */
+    getAnnotation(input: {
+        scope?: "tenant";
+        id?: string;
+        document_id?: string;
+        path?: string;
+        level?: "branch" | "document" | "path";
+    }, opts?: {
+        signal?: AbortSignal;
+        scopeId?: string;
+        tenant?: string;
+    }): Promise<{
+        annotations: DocumentAnnotation[];
+    }>;
+    /** Page through the tenant's annotations with filters (the Document tool's
+     *  `list_annotations`). Pass the answer's `next_cursor` as `after` for the
+     *  next page. `opts` as on {@link LoomcycleClient.document}. */
+    listAnnotations(input?: DocumentListAnnotationsInput, opts?: {
+        signal?: AbortSignal;
+        scopeId?: string;
+        tenant?: string;
+    }): Promise<DocumentListAnnotationsResult>;
+    /** Write an annotation (the Document tool's `set_annotation`). Without
+     *  `inputs_sha256` it is sent as an operator's manual annotation
+     *  (`manual: true`), which the annotation pass never overwrites; the operator
+     *  plane alone may write one. `opts` as on {@link LoomcycleClient.document}. */
+    annotate(input: DocumentAnnotateInput, opts?: {
+        signal?: AbortSignal;
+        scopeId?: string;
+        tenant?: string;
+    }): Promise<{
+        annotation: DocumentAnnotation;
+    }>;
     /** Find the copies in a set of documents (the Document tool's
      *  `find_duplicates`, RFC GB): the same text by sha256, or the same title once
      *  copy markers are stripped, each copy pointed at its original. A report

package/dist/client.js

@@ -23,6 +23,7 @@
  * via fetch-helpers.ts:raiseFromResponse — see README.md for the
  * full mapping table.
  */
+import { LoomcycleError } from "./errors.js";
 import { authHeaders, authorizedFetch, deleteRequest, deleteJSON, jsonFetch, patchJSON, postJSON, putJSON, raiseFromResponse, } from "./fetch-helpers.js";
 import { parseSSE } from "./stream.js";
 import { InteractiveSession } from "./interactive.js";
@@ -1681,14 +1682,50 @@ export class LoomcycleClient {
      *  `.close()` to stop. Uses the global WebSocket (browsers, Node 22+); pass
      *  `WebSocketImpl` (e.g. the `ws` package) on older Node. */
     connectClientTools(opts) {
-        // A provider is asked on every (re)connect, so a host outliving one
-        // access token reconnects with the next.
-        const provider = this.tokenProvider;
-        const auth = provider ? () => provider.getToken() : this.ctx.authToken;
+        // With a credential, every (re)connect mints a fresh one-time ticket (a
+        // ticket is spent by the handshake); a host outliving one access token
+        // mints the next through the provider. Without one (an open-mode
+        // server) the socket is opened bare, as before.
+        const auth = this.tokenProvider || this.ctx.authToken ? () => this.clientToolsCredential() : undefined;
         const host = new ClientToolHost(clientToolsURL(this.ctx.baseUrl), auth, opts);
         host.start();
         return host;
     }
+    /** Mint a one-time ticket for the client-tool socket (RFC GJ): POST
+     *  /v1/client-tools/ticket with this client's credential. The ticket opens
+     *  one socket, within 30 s of the mint, as `ticket.<t>` in
+     *  Sec-WebSocket-Protocol — the way a browser opens the socket under
+     *  strict sign-in, where the bearer is not read from that header.
+     *  connectClientTools calls it for you on every connect. */
+    async clientToolsTicket(opts) {
+        const out = await postJSON(this.ctx, "/v1/client-tools/ticket", undefined, opts);
+        return { ticket: out.ticket, expiresAt: out.expires_at };
+    }
+    /** The credential a client-tool connect presents: a fresh ticket, or —
+     *  only when the server has no ticket route (an older runtime: 404/405)
+     *  or issues no tickets (503 ticket_unavailable) and does not run strict
+     *  sign-in — the bearer itself, as before. Under strict sign-in the
+     *  bearer is never put in the handshake header: the server would not
+     *  read it, and proxies and access logs do not treat that header as a
+     *  credential. */
+    async clientToolsCredential() {
+        try {
+            return { ticket: (await this.clientToolsTicket()).ticket };
+        }
+        catch (err) {
+            const noTicket = err instanceof LoomcycleError &&
+                (err.status === 404 || err.status === 405 || (err.status === 503 && err.code === "ticket_unavailable"));
+            if (!noTicket)
+                throw err;
+            const me = await this.whoami();
+            if (me.auth?.mode === "strict") {
+                throw new LoomcycleError("connectClientTools: this loomcycle runs strict sign-in and issues no client-tool ticket " +
+                    "(it needs a release with POST /v1/client-tools/ticket and LOOMCYCLE_SECRET_KEY set)", { code: "ticket_unavailable" });
+            }
+            const token = this.tokenProvider ? await this.tokenProvider.getToken() : this.ctx.authToken;
+            return token ? { bearer: token } : undefined;
+        }
+    }
     /** Restore from a same-instance snapshot id OR an inline
      *  envelope JSON. Idempotent: ON CONFLICT DO NOTHING per row;
      *  the returned counters reflect rows actually written.
@@ -2911,6 +2948,31 @@ export class LoomcycleClient {
     async moveDocuments(input, opts) {
         return (await this.document({ op: "move_documents", ...input }, opts));
     }
+    /** The annotations of one chunk, document (`document_id`) or folder
+     *  (`level: "path"` with `path`), each marked `stale` or current (the Document
+     *  tool's `get_annotation`). Tenant scope; `scope` defaults to `"tenant"`. A
+     *  folder's annotation is left out unless the caller may read every document
+     *  it covers. `opts` as on {@link LoomcycleClient.document}. */
+    async getAnnotation(input, opts) {
+        return (await this.document({ op: "get_annotation", scope: "tenant", ...input }, opts));
+    }
+    /** Page through the tenant's annotations with filters (the Document tool's
+     *  `list_annotations`). Pass the answer's `next_cursor` as `after` for the
+     *  next page. `opts` as on {@link LoomcycleClient.document}. */
+    async listAnnotations(input = {}, opts) {
+        return (await this.document({ op: "list_annotations", scope: "tenant", ...input }, opts));
+    }
+    /** Write an annotation (the Document tool's `set_annotation`). Without
+     *  `inputs_sha256` it is sent as an operator's manual annotation
+     *  (`manual: true`), which the annotation pass never overwrites; the operator
+     *  plane alone may write one. `opts` as on {@link LoomcycleClient.document}. */
+    async annotate(input, opts) {
+        const body = { op: "set_annotation", scope: "tenant", ...input };
+        if (input.inputs_sha256 === undefined && input.manual === undefined) {
+            body.manual = true;
+        }
+        return (await this.document(body, opts));
+    }
     /** Find the copies in a set of documents (the Document tool's
      *  `find_duplicates`, RFC GB): the same text by sha256, or the same title once
      *  copy markers are stripped, each copy pointed at its original. A report

package/dist/index.d.ts

@@ -164,6 +164,7 @@
  *     document(input): Promise<DocumentToolResponse>              // 13 ops; needs SQL Memory
  *     copyDocuments(input) / moveDocuments(input): Promise<DocumentTransferResult> // RFC FT, dry run by default
  *     findDuplicates(input): Promise<DocumentFindDuplicatesResult> // RFC GB, a report unless propose: true
+ *     getAnnotation / listAnnotations / annotate                  // a brief + abstract per section, document, folder
  *
  *     // History — browse/search/annotate past chats (RFC BE; tenant-confined)
  *     history(input): Promise<HistoryToolResponse>                // list/get/search/rename/annotate/pin/archive/recap/resume
@@ -220,8 +221,8 @@ export type { InteractiveSessionOps } from "./interactive.js";
 export { verifyLoomcycleSignature, verifyLoomcycleDelivery } from "./signature.js";
 export type { VerifySignatureOptions, VerifiedDelivery } from "./signature.js";
 export { ClientToolHost, clientToolsURL, CLIENT_TOOL_SUBPROTOCOL } from "./client-tools.js";
-export type { ClientToolSchema, ClientToolInvocation, ConnectClientToolsOptions, WebSocketLike, WebSocketCtor, } from "./client-tools.js";
+export type { ClientToolSchema, ClientToolInvocation, ConnectClientToolsOptions, ClientToolsCredential, WebSocketLike, WebSocketCtor, } from "./client-tools.js";
 export { LoomcycleOAuth, OAuthTokenProvider, parseAuthorizeResponse, pkceChallenge } from "./oauth.js";
 export type { LoomcycleOAuthOptions, OAuthTokenProviderOptions } from "./oauth.js";
-export type { AgentEvent, ClientOptions, ContinueOptions, EventType, HostWidening, ImageMediaType, ParentContext, PromptContent, PromptSegment, RetryInfo, RunOptions, RunOverrideOptions, SamplingOptions, CompactionOptions, ContextOptions, ToolUse, Usage, CallTiming, Agent, AgentStatus, AwaitedState, AgentUsage, RunResult, RunSpec, RunSpecTeam, ConfiguredRun, ConfiguredRunPatch, ToolChoiceOptions, OutputFormatOptions, CancelAgentResult, ListAgentsResponse, ListUserAgentsOptions, AgentList, WalkRunsPage, RunBatchOptions, RunBatchResult, SpawnRunResult, CompactRunResult, RunTreeDeletion, RunTreeNotReached, DirectoryBudget, DirectoryInspection, DirectoryTenant, DirectoryUser, ErasureAccess, ErasureReport, ErasureResidue, ErasureResult, ErasureTier, MergeSubjectsResult, SubjectRef, BindSubjectPrincipalResult, ReviewQueueFilter, ReviewQueueGroup, ReviewQueueResult, RuleStatementsResult, RevertRulingResult, RulingBreakdown, RulingItem, RulingSelector, RulingRecord, ListRulingsResult, PolicyRuleCount, ApplyReviewPolicyResult, ErasureBoundSubject, ErasureTokenRef, CancelTurnResult, ReviewRunResult, ReplaySessionResult, TranscriptEvent, TranscriptResponse, HealthResponse, ListUsersResponse, UserSummary, UserStatus, UserRecord, CreateUserBody, UpdateUserBody, MintedUserToken, TokenRestrictions, TokenSurface, UserTokenMeta, ListUserTokensResponse, UserIdentity, UserIdentitiesResponse, AppSignIn, AppSignInsResponse, AuthGateKind, AuthGate, AuthGateKey, AuthGateRemoval, AuthGateProbe, AuthGateListResponse, CreateInviteBody, CreatedInvite, AuthInviteState, AuthInvite, AuthInviteListResponse, CreatedPasswordReset, GateIdentity, GateIdentitiesResponse, GateTenantStatus, RunnableAgent, RunnableAgentsResponse, WhoamiResponse, WhoamiEffective, WhoamiAuth, PauseResult, RetentionOverride, ResumeResult, RuntimeStateResponse, RuntimeStateStatus, ResolverMatrix, ResolverModelStatus, ResolverProviderAvailability, CreateSnapshotOptions, SnapshotCreateResponse, SnapshotDescriptor, SnapshotEnvelope, SnapshotListResponse, SnapshotRestoreResponse, MemoryEntriesResponse, MemoryEntry, MemoryEntryResponse, MemoryScopeIDsResponse, MemoryScopeIDSummary, MemoryScopeKind, MemoryScopesResponse, MemorySearchDocumentFilter, MemorySearchInput, MemorySource, MemoryWhen, MemoryTimeFilter, MemorySearchEntry, MemorySearchResponse, MemoryEmbedModelStats, MemoryEmbedStatsResponse, MemoryReembedConfigured, MemoryReembedResponse, MemoryBackfillResponse, MemoryPurgeResponse, InterruptListResponse, InterruptRow, InterruptStatus, ResolveInterruptOptions, ChannelHookCall, ChannelHookResult, HookFailMode, HookPhase, HookToolCall, HookToolResult, PostHookCall, PostHookResult, PreHookCall, PreHookResult, SubstrateToolInput, SubstrateToolResponse, TeamNameSummary, ListTeamsResponse, TeamDiagram, CreatedTeam, PromotedTeam, RetiredTeam, TeamDefDetail, TeamVerification, TeamDraft, TeamDraftVerification, TeamIssue, TeamIssueKind, TeamVersion, TeamVersionList, TeamBreakpoints, TeamRunDetached, TeamRunResult, TeamRunTarget, CreateTeamOptions, ForkTeamOptions, DefNameSummary, DefNamesResponse, OperatorTokenDefNameSummary, OperatorTokenDefNamesResponse, ScheduleListEntry, ScheduleListResponse, ScheduleActiveRun, ScheduleStateView, ScheduleRunNowResult, SchedulePauseResult, ModelAlias, ModelAliasesResponse, RoutingResponse, RoutingUserTier, RoutingTier, RoutingCandidate, RoutingThroughput, RoutingProvider, SearchRoutingProvider, RoutingEmbedder, RoutingDecision, RoutingDecisionModel, ProviderModelsResponse, TeamRunStep, TeamDecisionHandler, TeamDecisionQuestion, TeamDecisionAnswer, PathToolInput, PathToolResponse, DocumentToolInput, DocumentEdgeEvidence, DocumentToolResponse, DocumentCopyInput, DocumentMoveInput, DocumentTransferEntry, DocumentTransferResult, DocumentFindDuplicatesInput, DocumentDuplicatePair, DocumentFindDuplicatesResult, DocumentSearchFilter, DocumentSearchHit, DocumentSearchResult, DocumentRelatedResult, GraphSnapshot, HistoryToolInput, HistoryToolResponse, EvaluationEmitterRole, EvaluationSubmitInput, EvaluationGetInput, EvaluationListForRunInput, EvaluationListForDefInput, EvaluationAggregateInput, EvaluationInput, EvaluationSubmitResult, EvaluationRecord, EvaluationListForRunResult, EvaluationListForDefResult, EvaluationScoreStats, EvaluationAggregate, VolumeMode, PersistentVolumeEntry, PersistentVolumesResponse, EphemeralVolumeEntry, EphemeralVolumesResponse, SystemPromptPayload, UserInputPayload, ChannelDescriptor, ListChannelsResponse, RunStateEvent, RunStateStreamClose, RunStateStreamItem, RunStateStreamOpen, StreamUserRunStatesOptions, ChangeFeedError, ChangeFeedFrame, ChangeFeedStatus, EmbedderHealth, MemoryChange, MemoryChangeScope, MemoryChangeType, StreamChangesOptions, DocumentFeedChange, DocumentFeedChangeType, DocumentFeedFrame, DocumentFeedOptions, DocumentFeedStatus, AckChannelOptions, ChannelAckResult, ChannelMessageItem, ChannelPeekResult, ListTeamChannelsOptions, PeekTeamChannelOptions, ReleaseTeamChannelOptions, TeamChannelReleaseResult, TeamChannelDeclaredIn, TeamChannelDescriptor, TeamChannelPeekResult, TeamChannelsResult, ChannelPublishResult, ChannelPurgeResult, ChannelReleaseResult, ChannelScope, ChannelSubscribeResult, PeekChannelOptions, PublishChannelOptions, SubscribeChannelOptions, AwaitChannelsOptions, BroadcastChannelsOptions, ChannelAwaitEntry, ChannelAwaitMode, ChannelAwaitResult, ChannelBroadcastEntry, ChannelBroadcastResult, CreateChannelOptions, ReleaseChannelOptions, UpdateChannelOptions, SetMemoryEntryOptions, SetMemoryEntryResponse, AgentDefRowResponse, AgentDefVerifyResult, SkillDefVerifyResult, EnsureMcpServerOptions, EnsureMcpServerResult, MCPServerDefRowResponse, MCPServerDefVerifyResult, AgentDefOverlay, AgentRouting, AgentChannelACL, AgentInterruptionACL, AgentDecision, MemoryRerank, AgentSampling, AgentCompaction, AgentTranscription, AgentSpeech, AgentContext, TierCandidate, CoreBlock, HookEvent, InlineWebhook, HookEntry, EventHooks, ToolEntry, ToolHooksByTool, EnsureCodeAgentOptions, EnsureCodeAgentResult, CreateDefOptions, ForkDefOptions, EnsureHookDefOptions, EnsureHookDefResult, HookDefBody, HookDefForkOverlay, HookDefInput, HookDefMatch, HookDefOverlay, HookDefRowResponse, HookDefVerifyResult, ScheduleDefInput, ScheduleDefOverlay, ScheduleDefRowResponse, ScheduledRunHook, ScheduledRunPromptContent, ScheduledRunPromptSegment, WebhookDefAuth, WebhookDefFilter, WebhookDefInput, WebhookDefOverlay, WebhookDefRateLimit, WebhookDefRowResponse, WebhookDefDeliveries, WebhookDefSyncResponse, LibraryAgentDefinition, LibraryEntry, LibraryListResponse, LibraryMcpServerDefinition, LibrarySkillDefinition, LLMChatContent, LLMChatMessage, LLMChatOptions, LLMChatResponse, LLMChatStreamDelta, LLMChatStreamItem, LLMChatToolCall, LLMChatUsage, LLMTool, LLMEmbeddingItem, LLMEmbeddingsOptions, LLMEmbeddingsResponse, LLMEmbeddingsUsage, UsageDimension, UsageBucket, UsageAggregate, UsageReportResponse, CapabilityInertInfo, LimitInfo, FileCapturedInfo, TranscriptionInfo, AdmissionInfo, ErrorInfo, CallFormat, CallRef, HookDecisionInfo, TeamDecisionInfo, OverrideInfo, FallbackInfo, InterruptionEventInfo, SpawnChildInfo, TurnCancelledInfo, ChannelEventInfo, ContextCompactionInfo, ContextRecapInfo, ContextStateInfo, ContextExhaustedInfo, ContextTierVerdict, ContextDistillDeclinedInfo, EffectiveConfigResponse, RunFileInput, RunFileImportSource, RunFileExtractStructure, RunFileImportHeading, RunInboxDownload, EffectiveConfigSource, EffectiveValue, InertContextSetting, AgentOverridableResponse, OverridableField, OverrideLockReason, RetuneRunResponse, RunConfigRecord, SubagentHoldInfo, RunConfigResponse, RunPromptResponse, RunPromptSnapshot, PromptBlock, TokenLimit, TokenLimitsResponse, ConfigResponse, ConfigProvider, ConfigModel, ConfigSearch, ConfigInstance, SetTokenLimitRequest, CredentialScope, CredentialMeta, OAuthConnectStart, OAuthCredentialConfig, OAuthCredentialState, OAuthCredentialStatus, OAuthTokenEndpointAuth, CredentialListResponse, CryptoKeyVersion, CryptoKeyExport, CryptoKeyType, CryptoKeyEncoding, CryptoKeyBackend, CryptoKeyExternal, CryptoOp, CryptoRequestBase, CryptoKeyRef, CryptoEncryptRequest, CryptoDecryptRequest, CryptoRewrapRequest, CryptoMacRequest, CryptoVerifyMacRequest, CryptoSignRequest, CryptoVerifyRequest, CryptoPublicKeyRequest, CryptoTotpRequest, CryptoHashRequest, CryptoRandomRequest, CryptoHashPasswordRequest, CryptoVerifyPasswordRequest, CryptoRequest, CryptoEncryptResult, CryptoDecryptResult, CryptoRewrapResult, CryptoMacResult, CryptoVerifyResult, CryptoSignResult, CryptoPublicJWK, CryptoPublicKeyResult, CryptoTotpResult, CryptoHashResult, CryptoRandomResult, CryptoHashPasswordResult, CryptoVerifyPasswordResult, CryptoResultByOp, CryptoResult, DecideRequest, DecideResponse, DecisionQuestion, DecisionChoiceQuestion, DecisionNoulQuestion, DecisionScoreQuestion, DecisionAnswer, DecisionChoiceAnswer, DecisionNoulAnswer, DecisionScoreAnswer, DecisionModel, DecisionModelsResponse, SpeechFormat, SpeechOptions, SpeechResult, TranscribeOptions, TranscribeResult, TranscriptSegment, SpeechInfo, SpeechDirectionInfo, SpeechLanguageInfo, TranscriptionDirectionInfo, AclMode, AclSource, AclEffect, AclSubjectKind, AclCondition, AclRule, AclList, AclDefRow, AclDefListResponse, AclDefNamesResponse, AclValidateResult, AclCatalogType, AclCatalog, AclDefOp, AclDefInput, GroupRow, GroupMemberKind, GroupMember, GroupListResponse, GroupDetail, GroupEffective, CreateGroupBody, GroupMemberChange, AclBinding, AclBindingListResponse, CreateAclBindingBody, AuthzReason, AuthzDecision, AuthzRequestContext, AuthzEvaluationRequest, AuthzEvaluationsSemantic, AuthzEvaluationsRequest, AuthzEvaluationsResponse, AuthzTrace, AuthzAppliedBinding, AuthzExplainResponse, AuthzDraftBinding, AuthzSimulateRequest, AuthzSimulateResult, AuthzSimulateResponse, OAuthServerMetadata, OAuthTokenResponse, OAuthTokenSet, BeginAuthorizeOptions, AuthorizeRequest, AuthorizeResponseParams, CompleteAuthorizeOptions, RefreshTokenOptions, RevokeTokenOptions, TokenProvider, AppClientRefresh, AppClientConfig, ClientDefInput, ClientDefRecord, ConfigAppClient, AppClientEntry, ClientDefListResponse, ClientDefVerifyResult, ClientDefRetireResult, ClientDefNameSummary, ClientDefNamesResponse, DeviceLoginPrompt, DeviceLoginOptions, DeviceLoginResult, } from "./types.js";
+export type { AgentEvent, ClientOptions, ContinueOptions, EventType, HostWidening, ImageMediaType, ParentContext, PromptContent, PromptSegment, RetryInfo, RunOptions, RunOverrideOptions, SamplingOptions, CompactionOptions, ContextOptions, ToolUse, Usage, CallTiming, Agent, AgentStatus, AwaitedState, AgentUsage, RunResult, RunSpec, RunSpecTeam, ConfiguredRun, ConfiguredRunPatch, ToolChoiceOptions, OutputFormatOptions, CancelAgentResult, ListAgentsResponse, ListUserAgentsOptions, AgentList, WalkRunsPage, RunBatchOptions, RunBatchResult, SpawnRunResult, CompactRunResult, RunTreeDeletion, RunTreeNotReached, DirectoryBudget, DirectoryInspection, DirectoryTenant, DirectoryUser, ErasureAccess, ErasureReport, ErasureResidue, ErasureResult, ErasureTier, MergeSubjectsResult, SubjectRef, BindSubjectPrincipalResult, ReviewQueueFilter, ReviewQueueGroup, ReviewQueueResult, RuleStatementsResult, RevertRulingResult, RulingBreakdown, RulingItem, RulingSelector, RulingRecord, ListRulingsResult, PolicyRuleCount, ApplyReviewPolicyResult, ErasureBoundSubject, ErasureTokenRef, CancelTurnResult, ReviewRunResult, ReplaySessionResult, TranscriptEvent, TranscriptResponse, HealthResponse, ListUsersResponse, UserSummary, UserStatus, UserRecord, CreateUserBody, UpdateUserBody, MintedUserToken, TokenRestrictions, TokenSurface, UserTokenMeta, ListUserTokensResponse, UserIdentity, UserIdentitiesResponse, AppSignIn, AppSignInsResponse, AuthGateKind, AuthGate, AuthGateKey, AuthGateRemoval, AuthGateProbe, AuthGateListResponse, CreateInviteBody, CreatedInvite, AuthInviteState, AuthInvite, AuthInviteListResponse, CreatedPasswordReset, GateIdentity, GateIdentitiesResponse, GateTenantStatus, RunnableAgent, RunnableAgentsResponse, WhoamiResponse, WhoamiEffective, WhoamiAuth, PauseResult, RetentionOverride, ResumeResult, RuntimeStateResponse, RuntimeStateStatus, ResolverMatrix, ResolverModelStatus, ResolverProviderAvailability, CreateSnapshotOptions, SnapshotCreateResponse, SnapshotDescriptor, SnapshotEnvelope, SnapshotListResponse, SnapshotRestoreResponse, MemoryEntriesResponse, MemoryEntry, MemoryEntryResponse, MemoryScopeIDsResponse, MemoryScopeIDSummary, MemoryScopeKind, MemoryScopesResponse, MemorySearchDocumentFilter, MemorySearchInput, MemorySource, MemoryWhen, MemoryTimeFilter, MemorySearchEntry, MemorySearchResponse, MemoryEmbedModelStats, MemoryEmbedStatsResponse, MemoryReembedConfigured, MemoryReembedResponse, MemoryBackfillResponse, MemoryPurgeResponse, InterruptListResponse, InterruptRow, InterruptStatus, ResolveInterruptOptions, ChannelHookCall, ChannelHookResult, HookFailMode, HookPhase, HookToolCall, HookToolResult, PostHookCall, PostHookResult, PreHookCall, PreHookResult, SubstrateToolInput, SubstrateToolResponse, TeamNameSummary, ListTeamsResponse, TeamDiagram, CreatedTeam, PromotedTeam, RetiredTeam, TeamDefDetail, TeamVerification, TeamDraft, TeamDraftVerification, TeamIssue, TeamIssueKind, TeamVersion, TeamVersionList, TeamBreakpoints, TeamRunDetached, TeamRunResult, TeamRunTarget, CreateTeamOptions, ForkTeamOptions, DefNameSummary, DefNamesResponse, OperatorTokenDefNameSummary, OperatorTokenDefNamesResponse, ScheduleListEntry, ScheduleListResponse, ScheduleActiveRun, ScheduleStateView, ScheduleRunNowResult, SchedulePauseResult, ModelAlias, ModelAliasesResponse, RoutingResponse, RoutingUserTier, RoutingTier, RoutingCandidate, RoutingThroughput, RoutingProvider, SearchRoutingProvider, RoutingEmbedder, RoutingDecision, RoutingDecisionModel, ProviderModelsResponse, TeamRunStep, TeamDecisionHandler, TeamDecisionQuestion, TeamDecisionAnswer, PathToolInput, PathToolResponse, DocumentToolInput, DocumentEdgeEvidence, DocumentToolResponse, DocumentCopyInput, DocumentMoveInput, DocumentTransferEntry, DocumentTransferResult, DocumentFindDuplicatesInput, DocumentDuplicatePair, DocumentFindDuplicatesResult, DocumentAnnotation, DocumentListAnnotationsInput, DocumentListAnnotationsResult, DocumentAnnotateInput, DocumentSearchFilter, DocumentSearchHit, DocumentSearchResult, DocumentRelatedResult, GraphSnapshot, HistoryToolInput, HistoryToolResponse, EvaluationEmitterRole, EvaluationSubmitInput, EvaluationGetInput, EvaluationListForRunInput, EvaluationListForDefInput, EvaluationAggregateInput, EvaluationInput, EvaluationSubmitResult, EvaluationRecord, EvaluationListForRunResult, EvaluationListForDefResult, EvaluationScoreStats, EvaluationAggregate, VolumeMode, PersistentVolumeEntry, PersistentVolumesResponse, EphemeralVolumeEntry, EphemeralVolumesResponse, SystemPromptPayload, UserInputPayload, ChannelDescriptor, ListChannelsResponse, RunStateEvent, RunStateStreamClose, RunStateStreamItem, RunStateStreamOpen, StreamUserRunStatesOptions, ChangeFeedError, ChangeFeedFrame, ChangeFeedStatus, EmbedderHealth, MemoryChange, MemoryChangeScope, MemoryChangeType, StreamChangesOptions, DocumentFeedChange, DocumentFeedChangeType, DocumentFeedFrame, DocumentFeedOptions, DocumentFeedStatus, AckChannelOptions, ChannelAckResult, ChannelMessageItem, ChannelPeekResult, ListTeamChannelsOptions, PeekTeamChannelOptions, ReleaseTeamChannelOptions, TeamChannelReleaseResult, TeamChannelDeclaredIn, TeamChannelDescriptor, TeamChannelPeekResult, TeamChannelsResult, ChannelPublishResult, ChannelPurgeResult, ChannelReleaseResult, ChannelScope, ChannelSubscribeResult, PeekChannelOptions, PublishChannelOptions, SubscribeChannelOptions, AwaitChannelsOptions, BroadcastChannelsOptions, ChannelAwaitEntry, ChannelAwaitMode, ChannelAwaitResult, ChannelBroadcastEntry, ChannelBroadcastResult, CreateChannelOptions, ReleaseChannelOptions, UpdateChannelOptions, SetMemoryEntryOptions, SetMemoryEntryResponse, AgentDefRowResponse, AgentDefVerifyResult, SkillDefVerifyResult, EnsureMcpServerOptions, EnsureMcpServerResult, MCPServerDefRowResponse, MCPServerDefVerifyResult, AgentDefOverlay, AgentRouting, AgentChannelACL, AgentInterruptionACL, AgentDecision, MemoryRerank, AgentSampling, AgentCompaction, AgentTranscription, AgentSpeech, AgentContext, TierCandidate, CoreBlock, HookEvent, InlineWebhook, HookEntry, EventHooks, ToolEntry, ToolHooksByTool, EnsureCodeAgentOptions, EnsureCodeAgentResult, CreateDefOptions, ForkDefOptions, EnsureHookDefOptions, EnsureHookDefResult, HookDefBody, HookDefForkOverlay, HookDefInput, HookDefMatch, HookDefOverlay, HookDefRowResponse, HookDefVerifyResult, ScheduleDefInput, ScheduleDefOverlay, ScheduleDefRowResponse, ScheduledRunHook, ScheduledRunPromptContent, ScheduledRunPromptSegment, WebhookDefAuth, WebhookDefFilter, WebhookDefInput, WebhookDefOverlay, WebhookDefRateLimit, WebhookDefRowResponse, WebhookDefDeliveries, WebhookDefSyncResponse, LibraryAgentDefinition, LibraryEntry, LibraryListResponse, LibraryMcpServerDefinition, LibrarySkillDefinition, LLMChatContent, LLMChatMessage, LLMChatOptions, LLMChatResponse, LLMChatStreamDelta, LLMChatStreamItem, LLMChatToolCall, LLMChatUsage, LLMTool, LLMEmbeddingItem, LLMEmbeddingsOptions, LLMEmbeddingsResponse, LLMEmbeddingsUsage, UsageDimension, UsageBucket, UsageAggregate, UsageReportResponse, CapabilityInertInfo, LimitInfo, FileCapturedInfo, TranscriptionInfo, AdmissionInfo, ErrorInfo, CallFormat, CallRef, HookDecisionInfo, TeamDecisionInfo, OverrideInfo, FallbackInfo, InterruptionEventInfo, SpawnChildInfo, TurnCancelledInfo, ChannelEventInfo, ContextCompactionInfo, ContextRecapInfo, ContextStateInfo, ContextExhaustedInfo, ContextTierVerdict, ContextDistillDeclinedInfo, EffectiveConfigResponse, RunFileInput, RunFileImportSource, RunFileExtractStructure, RunFileImportHeading, RunInboxDownload, EffectiveConfigSource, EffectiveValue, InertContextSetting, AgentOverridableResponse, OverridableField, OverrideLockReason, RetuneRunResponse, RunConfigRecord, SubagentHoldInfo, RunConfigResponse, RunPromptResponse, RunPromptSnapshot, PromptBlock, TokenLimit, TokenLimitsResponse, ConfigResponse, ConfigProvider, ConfigModel, ConfigSearch, ConfigInstance, SetTokenLimitRequest, CredentialScope, CredentialMeta, OAuthConnectStart, OAuthCredentialConfig, OAuthCredentialState, OAuthCredentialStatus, OAuthTokenEndpointAuth, CredentialListResponse, CryptoKeyVersion, CryptoKeyExport, CryptoKeyType, CryptoKeyEncoding, CryptoKeyBackend, CryptoKeyExternal, CryptoOp, CryptoRequestBase, CryptoKeyRef, CryptoEncryptRequest, CryptoDecryptRequest, CryptoRewrapRequest, CryptoMacRequest, CryptoVerifyMacRequest, CryptoSignRequest, CryptoVerifyRequest, CryptoPublicKeyRequest, CryptoTotpRequest, CryptoHashRequest, CryptoRandomRequest, CryptoHashPasswordRequest, CryptoVerifyPasswordRequest, CryptoRequest, CryptoEncryptResult, CryptoDecryptResult, CryptoRewrapResult, CryptoMacResult, CryptoVerifyResult, CryptoSignResult, CryptoPublicJWK, CryptoPublicKeyResult, CryptoTotpResult, CryptoHashResult, CryptoRandomResult, CryptoHashPasswordResult, CryptoVerifyPasswordResult, CryptoResultByOp, CryptoResult, DecideRequest, DecideResponse, DecisionQuestion, DecisionChoiceQuestion, DecisionNoulQuestion, DecisionScoreQuestion, DecisionAnswer, DecisionChoiceAnswer, DecisionNoulAnswer, DecisionScoreAnswer, DecisionModel, DecisionModelsResponse, SpeechFormat, SpeechOptions, SpeechResult, TranscribeOptions, TranscribeResult, TranscriptSegment, SpeechInfo, SpeechDirectionInfo, SpeechLanguageInfo, TranscriptionDirectionInfo, AclMode, AclSource, AclEffect, AclSubjectKind, AclCondition, AclRule, AclList, AclDefRow, AclDefListResponse, AclDefNamesResponse, AclValidateResult, AclCatalogType, AclCatalog, AclDefOp, AclDefInput, GroupRow, GroupMemberKind, GroupMember, GroupListResponse, GroupDetail, GroupEffective, CreateGroupBody, GroupMemberChange, AclBinding, AclBindingListResponse, CreateAclBindingBody, AuthzReason, AuthzDecision, AuthzRequestContext, AuthzEvaluationRequest, AuthzEvaluationsSemantic, AuthzEvaluationsRequest, AuthzEvaluationsResponse, AuthzTrace, AuthzAppliedBinding, AuthzExplainResponse, AuthzDraftBinding, AuthzSimulateRequest, AuthzSimulateResult, AuthzSimulateResponse, OAuthServerMetadata, OAuthTokenResponse, OAuthTokenSet, BeginAuthorizeOptions, AuthorizeRequest, AuthorizeResponseParams, CompleteAuthorizeOptions, RefreshTokenOptions, RevokeTokenOptions, TokenProvider, AppClientRefresh, AppClientConfig, ClientDefInput, ClientDefRecord, ConfigAppClient, AppClientEntry, ClientDefListResponse, ClientDefVerifyResult, ClientDefRetireResult, ClientDefNameSummary, ClientDefNamesResponse, DeviceLoginPrompt, DeviceLoginOptions, DeviceLoginResult, } from "./types.js";
 export { AclDeniedError, AgentIDInUseError, AgentNotFoundError, AlreadyPausingError, AuthError, BackpressureError, DeviceLoginError, NotFoundError, InsufficientScopeError, InvalidArgumentError, ChannelCursorRegressionError, LoomcycleError, NotPausedError, OAuthError, PauseNotConfiguredError, PerUserQuotaExhaustedError, PromptTooLargeError, RateLimitedError, RequestTooLargeError, SessionBusyError, SessionNotFoundError, SnapshotNotFoundError, SnapshotTooLargeError, SnapshotVersionError, SubstrateToolRefusedError, TokenLimitExceededError, UnavailableError, } from "./errors.js";

package/dist/index.js

@@ -164,6 +164,7 @@
  *     document(input): Promise<DocumentToolResponse>              // 13 ops; needs SQL Memory
  *     copyDocuments(input) / moveDocuments(input): Promise<DocumentTransferResult> // RFC FT, dry run by default
  *     findDuplicates(input): Promise<DocumentFindDuplicatesResult> // RFC GB, a report unless propose: true
+ *     getAnnotation / listAnnotations / annotate                  // a brief + abstract per section, document, folder
  *
  *     // History — browse/search/annotate past chats (RFC BE; tenant-confined)
  *     history(input): Promise<HistoryToolResponse>                // list/get/search/rename/annotate/pin/archive/recap/resume

package/dist/types.d.ts

@@ -810,6 +810,9 @@ export interface AgentEvent {
      *  the flag would re-feed the model a successful-looking result. */
     is_error?: boolean;
     stop_reason?: string;
+    /** On `event: started`: the OpenTelemetry trace the run is recorded in.
+     *  Absent when tracing is off or the trace is not sampled. */
+    trace_id?: string;
     /** Retry payload on `event: retry`. Nil on all other event types. */
     retry?: RetryInfo;
     /** Host-widening payload on `event: host_widened`. Nil on all other
@@ -1526,6 +1529,9 @@ export interface Agent {
     /** `"none"` for a no-trace run: its transcript holds markers, not content,
      *  and `error` is a class. Absent on every other run. */
     retention?: string;
+    /** The OpenTelemetry trace the run was recorded in. Absent when tracing was
+     *  off or the trace was not sampled. */
+    trace_id?: string;
     error: string | null;
     usage: AgentUsage;
     last_heartbeat_at: string | null;
@@ -3806,6 +3812,12 @@ export type PathToolInput = {
     cursor?: string;
     /** rm: also delete the backing resource (NOT supported in v1). */
     resource_too?: boolean;
+    /** ls (tenant scope): add each entry's annotation as `summary` (a folder's
+     *  from its `_annotation` document; `folder_summary` on a document with names
+     *  below it). */
+    with_summary?: boolean;
+    /** ls with_summary: the most abstract characters the page carries (default 2000). */
+    summary_chars?: number;
     [extra: string]: unknown;
 };
 /** Input for {@link LoomcycleClient.document} — the RFC AK chunked-graph
@@ -3835,7 +3847,7 @@ export type DocumentEdgeEvidence = {
     part?: "body" | "title";
 };
 export type DocumentToolInput = {
-    op: "create_document" | "get_document" | "documents_summary" | "query_documents" | "graph_snapshot" | "delete_document" | "set_path" | "copy_documents" | "move_documents" | "find_duplicates" | "mark_source" | "create_chunk" | "upsert_chunk" | "get_chunk" | "update_chunk" | "delete_chunk" | "supersede_chunk" | "graph_recall" | "move_chunk" | "reorder_chunk" | "link_chunks" | "unlink_chunks" | "get_edges" | "get_edge" | "propose_statement" | "accept_statement" | "reject_statement" | "list_statements" | "judge_statements" | "maintain_statement" | "resolve_anchor" | "lease" | "release" | "describe_ontology" | "extract_citations" | "classify" | "accept_classification" | "query_chunks" | "add_tags" | "remove_tags" | "list_tags" | "define_type" | "list_types" | "set_asset" | "get_asset" | "export_md" | "import_md" | "backlinks" | "related" | "unlinked_mentions" | "history" | "get_version" | "diff" | "export_canvas" | "import_canvas" | "list_facts" | "judge_fact" | "verbatim_answer" | "verification_stats" | "remember" | "propose_entity" | "propose_subject" | "search" | "set_remote" | "sync" | "diff_remote";
+    op: "create_document" | "get_document" | "documents_summary" | "query_documents" | "graph_snapshot" | "delete_document" | "set_path" | "copy_documents" | "move_documents" | "find_duplicates" | "mark_source" | "create_chunk" | "upsert_chunk" | "get_chunk" | "update_chunk" | "delete_chunk" | "supersede_chunk" | "graph_recall" | "move_chunk" | "reorder_chunk" | "link_chunks" | "unlink_chunks" | "get_edges" | "get_edge" | "propose_statement" | "accept_statement" | "reject_statement" | "list_statements" | "judge_statements" | "maintain_statement" | "resolve_anchor" | "lease" | "release" | "set_annotation" | "get_annotation" | "annotation_inputs" | "list_annotations" | "delete_annotation" | "describe_ontology" | "extract_citations" | "classify" | "accept_classification" | "query_chunks" | "add_tags" | "remove_tags" | "list_tags" | "define_type" | "list_types" | "set_asset" | "get_asset" | "export_md" | "import_md" | "backlinks" | "related" | "unlinked_mentions" | "history" | "get_version" | "diff" | "export_canvas" | "import_canvas" | "list_facts" | "judge_fact" | "verbatim_answer" | "verification_stats" | "remember" | "propose_entity" | "propose_subject" | "search" | "set_remote" | "sync" | "diff_remote";
     scope?: "agent" | "user" | "tenant";
     /** Document id (get/delete_document) or chunk id (get/update/delete/move_chunk). */
     id?: string;
@@ -4065,6 +4077,40 @@ export type DocumentToolInput = {
     name?: string;
     /** lease: how long to hold it, in milliseconds (default 60000, max one hour). */
     ttl_ms?: number;
+    /** set_annotation / get_annotation / annotation_inputs / delete_annotation /
+     *  list_annotations: which annotation of the target — "branch" (a section) or
+     *  "document" (on the document's root chunk). Default: what the chunk is. */
+    level?: "branch" | "document" | "path";
+    /** set_annotation: one sentence (at most 240 characters) for choosing. */
+    brief?: string;
+    /** set_annotation: one paragraph (at most 2000 characters) standing in for reading. */
+    abstract?: string;
+    /** set_annotation: the annotation's language code (default: the document's). */
+    language?: string;
+    /** set_annotation: the hash annotation_inputs returned; refused when the text moved since. */
+    inputs_sha256?: string;
+    /** annotation_inputs / set_annotation: the prompt's version, part of the hash. */
+    prompt_version?: number;
+    /** set_annotation: the model that wrote it. */
+    model?: string;
+    /** set_annotation: an operator's own text (no hash; never overwritten by the walk).
+     *  list_annotations: only these. */
+    manual?: boolean;
+    /** list_annotations: only annotations whose target changed since they were written. */
+    stale?: boolean;
+    /** list_annotations: only annotations written before this RFC 3339 time. */
+    written_before?: string;
+    /** get_document / get_chunk / search / related / graph_recall / documents_summary /
+     *  query_documents: add each row's nearest annotation as `summary`
+     *  ({level, brief, abstract?, stale?, chunk_id?}). */
+    with_summary?: boolean;
+    /** with_summary: the most abstract characters a response carries (default 2000, max 8000). */
+    summary_chars?: number;
+    /** search: rank the annotations too — "include" fuses them with the passages,
+     *  "only" answers from them alone (a question about the corpus as a whole). */
+    annotations?: "none" | "include" | "only";
+    /** search with annotations: which levels to rank (default all). */
+    annotation_levels?: Array<"branch" | "document" | "path">;
     /** classify: "propose" (default) applies an unambiguous rule match and files the
      *  rest for review; "report" writes nothing. judge_statements: "rule"
      *  (default) or "recommend". */
@@ -5588,9 +5634,11 @@ export interface AgentDefOverlay {
      *  `'judge'` (it records the judge's verdicts) are for `provider: 'code-js'`
      *  only. `'link'`: its `link_chunks` in the tenant scope is asserted rather
      *  than filed for review. `'remember'`: its runs may call Document
-     *  `remember`. Unset or `[]` = none. A new agent may list only what its
-     *  author holds; a fork only what the version it forks held. */
-    statement_methods?: Array<'rule' | 'extractor' | 'judge' | 'link' | 'remember'>;
+     *  `remember`. `'annotate'` (code-js only): its runs may write document
+     *  annotations (Document `set_annotation`) and hold the `annotator` lease.
+     *  Unset or `[]` = none. A new agent may list only what its author holds; a
+     *  fork only what the version it forks held. */
+    statement_methods?: Array<'rule' | 'extractor' | 'judge' | 'link' | 'remember' | 'annotate'>;
     /** Channel tool ACL (default-deny until set). */
     channels?: AgentChannelACL;
     /** Interruption tool gate — `enabled: true` REQUIRED for the tool to work. */
@@ -7884,6 +7932,10 @@ export interface AclCatalogType {
     verbs: string[];
     scopes?: string[];
     separator?: string;
+    /** The verbs asked only of every instance of this type: a rule on one of
+     *  them must name `<type>:*` (a selector naming some instances is refused
+     *  with `rule_not_enforceable`). Absent on a type with none. */
+    type_level_only?: string[];
 }
 /** `aclDef({op: "catalog"})`: what a rule may name. */
 export interface AclCatalog {
@@ -8369,3 +8421,62 @@ export interface DeviceLoginResult {
     expiresIn?: number;
     scope?: string[];
 }
+/** One stored annotation (the Document tool's annotation ops): an indicative
+ *  `brief` and an informative `abstract` written about a section (`branch`), a
+ *  document (`document`, on its root chunk) or a Path folder (`path`). Kept for
+ *  the tenant scope only. `stale` is computed on read: the text it was written
+ *  from has changed since. */
+export type DocumentAnnotation = {
+    chunk_id: string;
+    document_id: string;
+    level: "branch" | "document" | "path";
+    brief: string;
+    abstract: string;
+    language: string;
+    class?: string;
+    inputs_sha256: string;
+    prompt_version: number;
+    model?: string;
+    manual: boolean;
+    written_at: string;
+    written_by: string;
+    /** A path record's folder. */
+    folder?: string;
+    stale?: boolean;
+};
+/** The filters of {@link LoomcycleClient.listAnnotations}. */
+export type DocumentListAnnotationsInput = {
+    scope?: "tenant";
+    level?: "branch" | "document" | "path";
+    document_id?: string;
+    under_path?: string;
+    stale?: boolean;
+    manual?: boolean;
+    /** RFC 3339. */
+    written_before?: string;
+    limit?: number;
+    /** The previous page's `next_cursor`. */
+    after?: string;
+};
+export type DocumentListAnnotationsResult = {
+    annotations: DocumentAnnotation[];
+    next_cursor?: string;
+};
+/** What {@link LoomcycleClient.annotate} writes: a target (`id` a chunk,
+ *  `document_id`, or with `level: "path"` the folder's `path`) and the two
+ *  texts. Without `inputs_sha256` (from `annotation_inputs`) it is an
+ *  operator's manual annotation, which the annotation pass never overwrites. */
+export type DocumentAnnotateInput = {
+    scope?: "tenant";
+    id?: string;
+    document_id?: string;
+    path?: string;
+    level?: "branch" | "document" | "path";
+    brief: string;
+    abstract: string;
+    language?: string;
+    inputs_sha256?: string;
+    prompt_version?: number;
+    model?: string;
+    manual?: boolean;
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@loomcycle/client",
-  "version": "1.147.0",
+  "version": "1.148.0",
   "description": "TypeScript client for the loomcycle sidecar (HTTP+SSE). 71 methods covering run streaming, agent metadata, pause/resume/state, resolver re-probe (resolveProbe — issue #88 operator escape hatch), operator-token admin (operatorTokenDef — RFC L OSS multi-tenant auth) + whoami (RFC L authoritative principal, v0.17.0) + tenant-scoped listUsers / listUserAgents, dynamic MCP registration (mcpServerDef + v0.18.0 typed mcpServerDefVerify + ensureMcpServer idempotent register-if-changed), snapshot lifecycle, memory admin (incl. v0.9.0 Vector Memory embed_stats + reembed AND v0.11.5 setMemoryEntry + deleteMemoryEntry), interruption resolve, hook management, v0.8.22 substrate admin (agentDef + skillDef), v0.9.x n8n Phase 0 (listChannels + streamUserRunStates), v0.9.x Channel CRUD (publishChannel + subscribeChannel + peekChannel + ackChannel), v0.11.5 Channel admin CRUD (createChannel + updateChannel + deleteChannel — runtime substrate; yaml channels refuse mutation with HTTP 409), v0.9.x content_sha256 verify, v0.9.1 transcript first-cycle, v0.9.x dynamic MCP server registration (mcpServerDef + MCPServerDefVerifyResult), v0.10.3 Library v2 enumeration (listLibraryAgents + listLibrarySkills + listLibraryMcpServers), and v0.11.0 LLM Gateway (llmChat + llmStream — direct provider routing without agent overhead; primary target is n8n's LoomCycleChatModel AI Agent sub-node and any LangChain-compatible consumer). v0.10.1 — dual ESM + CommonJS distribution (additive — ESM consumers unchanged; CJS consumers like n8n's community-node loader now work). v0.19.0 — typed inline code-js agent ingestion (AgentDefOverlay.code_body + ensureCodeAgent — register a deterministic code agent through the substrate with no host filesystem bind; RFC J). v0.20.0 — ensureMcpServer surfaces discoveredToolCount straight from create (loomcycle now auto-discovers MCP tools at ingestion); rediscover is now an explicit force-refresh. v0.21.0 — run/continue accept optional non-secret `metadata` (repo name, review policy, …) passed to the agent, symmetric with the WebHook/Schedule trigger paths. v0.22.0 — version-aligned lockstep release; no client-surface change (RFC N tenant isolation of the agent/skill/MCP/Schedule/Webhook definition plane + real op-schemas on the builtin MCP meta-tools are both server-side). v0.23.0 — version-aligned lockstep release; no client-surface change (RFCs O/P/R MCP-server hardening + thin client and the RFC Q DeepSeek tool-content fix are all server-side / MCP-transport-side). v0.24.0 — purgeChannel clears a channel's buffered messages without deleting its definition (allowed on yaml-declared channels too, unlike deleteChannel — F20); AgentDefOverlay gains channels / evaluation_scopes / interruption so a COMPLETE interactive/multi-agent agent round-trips over the substrate (F14). (Consolidates the interim 0.24/0.25 package bumps, which were never tag-published, back into lockstep with the loomcycle v0.24.0 tag.) v0.25.0 — adds the RFC S channel fan-in/fan-out client twins: awaitChannels() (wait for any/all/at_least N messages across channels, or a timeout — non-committing) + broadcastChannels() (publish one payload to N channels in one atomic-pre-flight call), the client-facing counterparts of the in-band Channel.await / Channel.broadcast tool ops (the rest of v0.25.0 — the manual-management Web UI console + Context op=time + max_fires self-retiring schedules — is server-side / in-band, no client-surface change). v0.29.1 — Usage gains optional `max_context_tokens` (the serving model's context-window ceiling, stamped by the loop from Provider.Capabilities() on each usage event) so a consumer can render a 'context used / max' gauge without a hard-coded per-model table; additive + optional, no behavior change. (Lockstep catch-up: the field landed in loomcycle v0.29.0 but the adapter publish skipped on a version mismatch; v0.29.1 realigns the package version with the release tag so it publishes.) v0.33.0 — gRPC + TS client parity for the RFC Y external fan-out and the compaction surface: spawnRunBatch() (POST /v1/runs:batch — spawn up to 32 fresh runs concurrently in one call, combined index-aligned envelope, per-child failures in-envelope) + compactRun(runId) (POST /v1/runs/{run_id}/compact — summarize a parked run's context); plus per-run sampling + compaction overrides now accepted on runStreaming / continueSession (an explicit temperature 0 is preserved as deterministic, not dropped as falsy). (The gRPC half adds the matching SpawnRunBatch / CompactRun RPCs + the sampling/compaction fields on RunRequest/ContinueRequest — server-side.) v0.34.0 — version-aligned lockstep release; no client-surface change (context-transform plugins / RFC Z Phase 1a are server-side config; the exp7 hardening pass is server-side; the R2 cross-provider thinking-model downgrade surfaces a new `model_downgraded` SSE event the generic stream passes through unchanged). v0.35.0 — RFC AH dynamic filesystem volumes: volumeDef() (POST /v1/_volumedef — op-discriminated create/get/list/delete/purge; a Volume is flat, so delete unmaps + purge RemoveAll's, no retire/promote/fork) + listVolumes() / listEphemeralVolumes() (GET /v1/_volumes[/ephemeral] — tenant-scoped; host paths redacted for non-operator callers). Tenant-confined; the runtime derives the path inside an operator-blessed dynamic_root, so callers pass name + mode, never a host path. v1.1.1 — RFC AI interactive agentic sessions: an `interactive: true` flag on runStreaming/continueSession (a run that parks at end_turn for steering) + sendRunInput(runId, text) (POST /v1/runs/{id}/input — steer a live run) + streamRunByID(runId, {fromSeq}) (GET /v1/runs/{id}/stream — re-attach by run_id; the operator's prior turns replay as `steer` events so a cold client reconstructs the whole conversation) + a high-level InteractiveSession driver (client.interactiveSession / attachInteractiveSession — events()/send()/cancel(), the adapter port of the Web UI run terminal). The AgentEvent union gains awaiting_input/steer/context_compaction frames. Version-aligned with the loomcycle v1.1.x line so the v1.1.1 tag publishes it (also carrying the previously-unpublished v0.35.0 volume surface). v1.4.0 — RFC AL Path VFS + RFC AK Document on the wire: path(input) (POST /v1/_path — a Unix-like filesystem over Memory/Volumes/Documents; resolve/ls/stat/mkdir/mv/rm) + document(input) (POST /v1/_document — chunked-graph documents; 13 ops, needs SQL Memory on the sidecar). Scope (agent/user/tenant) + tenant are resolved server-side from the authenticated principal, never the wire; an off-run scope:'user' op keys on the principal subject so it interoperates with that user's agent runs. New PathToolInput / DocumentToolInput types; responses are op-varying (unknown — narrow as needed). v1.7.0 — RFC AT image/vision input: the PromptContent union gains an `image` variant ({ type:'image'; media_type: ImageMediaType; data: base64-no-prefix }) accepted in a user segment by runStreaming / continueSession (segments pass through unchanged — no method change). The model must be vision-capable or the run errors before the call. New ImageMediaType type (image/png|jpeg|gif|webp). v1.12.1 — Path/Document browse-by-subject + the full Document op set (RFC AS/AK): path(input, opts) / document(input, opts) accept optional scopeId / tenant browse overrides sent as ?scope_id= / ?tenant= query params (server reads them from the URL, re-checks authorization; omit both to browse your own subject — byte-identical to the pre-RFC-AS request), and DocumentToolInput.op now covers all 16 backend ops (adds set_path, export_md, import_md) with the matching include_metadata / markdown fields. Additive — existing path() / document() callers are unchanged. v1.16.0 — RFC BC client-executed tools (local tool host): connectClientTools({tools,onInvoke}) opens a persistent WebSocket to /v1/client-tools, registers tools this client runs on the user's machine (browser DOM / files / shell), and answers the invoke frames loomcycle routes when an agent of your principal calls a client:<tool> — returning your reply as an ordinary tool result. Returns a ClientToolHost driver (.close() to stop; auto-reconnect); dependency-free (global WebSocket in browsers / Node 22+, or an injected WebSocketImpl like the ws package on older Node); the bearer rides the Sec-WebSocket-Protocol subprotocol (browsers can't set an Authorization header on a WebSocket). The runtime's first WebSocket surface. v1.45.0 — RFC BL P5 subject erasure: erasureReport(subject, {tenant}) (GET /v1/_erasure — what this deployment holds about one subject, in three tiers: deletable with existing primitives, subject-keyed but not deletable, and facts ABOUT the subject in scopes they do not own) + erasureExecute(subject, {dryRun, confirm, tenant}) (POST /v1/_erasure — removes tiers 1 and 2). DEFAULTS TO A DRY RUN: dryRun defaults true and a live run also requires confirm === subject. The tier-3 residue is traceable only through the subject's chats, which a live run deletes, so a report afterwards shows rows: 0 while those facts remain — the returned object is the only durable record of what was not reached; persist it. New ErasureReport / ErasureResult / ErasureTier / ErasureResidue types. v1.47.0 — RFC BV memory-view SDK: memorySearch() (POST /v1/_memory/search — off-run unified semantic search spanning k/v entries AND document-chunk bodies in one ranked list, each hit tagged kind memory|document with chunk_id on document hits) + memoryEmbedStats(scope) + reembedMemory(scope, scopeId, {dryRun,limit}) (the Vector Memory embed-admin reads the memory-view console needs; dry_run defaults true). Fact reads (list_facts + get_chunk's entity block) ride the existing document() passthrough. Additive — existing callers unchanged. v1.61.0 — RFC CJ per-run context-window override: runStreaming / continueSession accept an optional maxContextTokens (integer tokens) that wins over the agent's own max_context_tokens; omitted inherits it (which defers to the provider/driver default). Distinct from a model's output cap; primarily for local inference (Ollama num_ctx). Serialized as the snake_case max_context_tokens field on POST /v1/runs + the continuation body; additive, existing callers unchanged. v1.72.1 — the TeamDef version lifecycle: listTeamVersions(name) (op=list — every version of one team, newest first), promoteTeam(defId) (op=promote — point the active pointer, which is what a run BY NAME executes; forkTeam defaults to promote:false, so authoring and putting in force stay two steps), retireTeam(defId, retired) (op=retire — reversible and version-scoped, unlike deleteTeam) and verifyTeam(name, contentSha256) (op=verify — the drift check for a workflow kept in source control and pushed to several deployments; an absent team answers deployed:false rather than raising). The ops existed on the substrate and over HTTP; a client that could author a team could not put one in force.",
   "license": "Apache-2.0",
   "type": "module",