@arbidocs/client 0.3.135 → 0.3.136

package/dist/index.d.cts

@@ -2726,6 +2726,33 @@ interface paths {
         patch?: never;
         trace?: never;
     };
+    '/v1/connectors/{vendor_key}/admin-consent': {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Start the Microsoft org admin-consent flow (public, no login)
+         * @description Redirect an IT admin to Microsoft's org-wide admin-consent screen.
+         *
+         *     Public by design: the whole point is that the customer's Microsoft admin can
+         *     authorize ARBI for their organization WITHOUT having an ARBI account — a user
+         *     shares ``/{ADMIN_CONSENT_PAGE}`` (which links here), the admin approves on
+         *     login.microsoftonline.com, and Microsoft redirects back to the regular OAuth
+         *     callback (already registered on the Entra app) with ``state=admin-consent``.
+         *     No secrets are exposed: the URL carries only the public client id + scopes.
+         */
+        get: operations['start_admin_consent'];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     '/v1/connectors/{vendor_key}/callback': {
         parameters: {
             query?: never;
@@ -2736,6 +2763,13 @@ interface paths {
         /**
          * OAuth callback — exchange code for tokens
          * @description Handle the OAuth callback: exchange code, encrypt + store tokens, redirect.
+         *
+         *     The provider may redirect back with an error instead of a code — e.g. the user
+         *     declines consent, or a SharePoint admin-consent wall blocks the grant
+         *     (``?error=access_denied&state=...`` with no ``code``). Rather than let FastAPI
+         *     reject the missing ``code`` with a raw 422, treat that (and any explicit
+         *     ``error``) as a graceful failure: best-effort consume the one-time PKCE state and
+         *     redirect the user back to the app with ``?connect_error={vendor_key}``.
          */
         get: operations['oauth_callback'];
         put?: never;
@@ -3426,7 +3460,7 @@ interface components {
             /**
              * Subagents Enabled
              * @description Include the sub_agent tool so the agent can spawn detached background sub-agents and control them (check / steer / pause / resume / collect) while it keeps working — parallel delegation, unlike the blocking deep_research. Fan-out is one level deep and capped in concurrency.
-             * @default false
+             * @default true
              */
             SUBAGENTS_ENABLED: boolean;
             /**
@@ -3669,7 +3703,7 @@ interface components {
             /**
              * Subagents Enabled
              * @description Include the sub_agent tool so the agent can spawn detached background sub-agents and control them (check / steer / pause / resume / collect) while it keeps working — parallel delegation, unlike the blocking deep_research. Fan-out is one level deep and capped in concurrency.
-             * @default false
+             * @default true
              */
             SUBAGENTS_ENABLED: boolean;
             /**
@@ -3779,7 +3813,7 @@ interface components {
              *       "MCP_TOOLS": [],
              *       "PLANNING_ENABLED": false,
              *       "DEEP_RESEARCH_ENABLED": true,
-             *       "SUBAGENTS_ENABLED": false,
+             *       "SUBAGENTS_ENABLED": true,
              *       "SUGGESTED_QUERIES": false,
              *       "ARTIFACTS_ENABLED": false,
              *       "IMAGE_ENABLED": false,
@@ -4024,7 +4058,7 @@ interface components {
              *       "IMAGE": "arbi-sandbox:bookworm-slim",
              *       "TIMEOUT_SECONDS": 60,
              *       "MEMORY_LIMIT": "512m",
-             *       "NETWORK": "bridge"
+             *       "NETWORK": "arbi-sandbox-net"
              *     }
              */
             RunCode: components['schemas']['RunCodeConfig'];
@@ -4067,7 +4101,7 @@ interface components {
              *       },
              *       "MAX_CONCURRENT_REQUESTS": 256,
              *       "MODEL_NAME": "Qwen/Qwen3-Reranker-0.6B",
-             *       "API_TYPE": "remote",
+             *       "API_TYPE": "local",
              *       "RETRIEVAL_INSTRUCTION": "Judge whether the passage contains the specific facts, figures, names, or references mentioned in the query. Only answer yes if the passage directly contains these details"
              *     }
              */
@@ -4088,7 +4122,7 @@ interface components {
             /**
              * @default {
              *       "MODEL_NAME": "Qwen/Qwen3-Embedding-0.6B",
-             *       "API_TYPE": "remote",
+             *       "API_TYPE": "local",
              *       "BATCH_SIZE": 128,
              *       "MAX_CONCURRENT_REQUESTS": 256,
              *       "DOCUMENT_PREFIX": "",
@@ -6048,7 +6082,7 @@ interface components {
             /**
              * Api Type
              * @description The inference type (local or remote).
-             * @default remote
+             * @default local
              * @enum {string}
              */
             API_TYPE: 'local' | 'remote';
@@ -6369,7 +6403,12 @@ interface components {
         };
         /**
          * FolderRead
-         * @description A selectable mail folder (Outlook) or label (Gmail).
+         * @description A mail folder (Outlook), label (Gmail), or drive folder/site/library.
+         *
+         *     Mail folders and ordinary drive folders are always selectable. Drive listings may
+         *     also surface non-selectable grouping nodes (e.g. a SharePoint *site*, which
+         *     contains document libraries but no files of its own) — ``selectable=False`` tells
+         *     the picker to render them as expandable-only branches.
          */
         FolderRead: {
             /** Id */
@@ -6378,6 +6417,11 @@ interface components {
             name: string;
             /** Count */
             count?: number | null;
+            /**
+             * Selectable
+             * @default true
+             */
+            selectable: boolean;
         };
         /**
          * FunctionCallItem
@@ -8379,7 +8423,7 @@ interface components {
             /**
              * Api Type
              * @description The inference type (local or remote).
-             * @default remote
+             * @default local
              * @enum {string}
              */
             API_TYPE: 'local' | 'remote';
@@ -9226,8 +9270,8 @@ interface components {
             MEMORY_LIMIT: string;
             /**
              * Network
-             * @description Container network mode. 'bridge' allows internet (pip/npm install). 'none' for full isolation.
-             * @default bridge
+             * @description Container network mode. 'arbi-sandbox-net' is the dedicated internal network created at deploy time: no egress at all (no internet, no LAN, no host), and other sandboxes are unreachable. Web access belongs to web_search / deep_research, not to executed code. Do not use 'bridge' — it would give model-authored code the host's whole network.
+             * @default arbi-sandbox-net
              */
             NETWORK: string;
         };
@@ -10844,6 +10888,11 @@ interface components {
              * @default true
              */
             show_connector_microsoft: boolean;
+            /**
+             * Show Connector Sharepoint
+             * @default false
+             */
+            show_connector_sharepoint: boolean;
             /**
              * Show Connector Google
              * @default false
@@ -10949,6 +10998,8 @@ interface components {
             show_mcp_connectors?: boolean | null;
             /** Show Connector Microsoft */
             show_connector_microsoft?: boolean | null;
+            /** Show Connector Sharepoint */
+            show_connector_sharepoint?: boolean | null;
             /** Show Connector Google */
             show_connector_google?: boolean | null;
             /** Show Connector Imanage */
@@ -10999,7 +11050,7 @@ interface components {
          *     (FastAPI validates + documents the allowed set) and the catalog keys.
          * @enum {string}
          */
-        VendorKey: 'microsoft' | 'gdrive' | 'gmail' | 'imanage' | 'westlaw' | 'ms365_mail';
+        VendorKey: 'microsoft' | 'microsoft_sharepoint' | 'gdrive' | 'gmail' | 'imanage' | 'westlaw' | 'ms365_mail';
         /** VerifyEmailRequest */
         VerifyEmailRequest: {
             /**
@@ -15444,11 +15495,46 @@ interface operations {
             };
         };
     };
+    start_admin_consent: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                vendor_key: components['schemas']['VendorKey'];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Successful Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    'application/json': unknown;
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    'application/json': components['schemas']['HTTPValidationError'];
+                };
+            };
+        };
+    };
     oauth_callback: {
         parameters: {
-            query: {
-                code: string;
-                state: string;
+            query?: {
+                code?: string | null;
+                state?: string | null;
+                error?: string | null;
+                error_description?: string | null;
+                admin_consent?: string | null;
+                tenant?: string | null;
             };
             header?: never;
             path: {

package/dist/index.d.ts

@@ -2726,6 +2726,33 @@ interface paths {
         patch?: never;
         trace?: never;
     };
+    '/v1/connectors/{vendor_key}/admin-consent': {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Start the Microsoft org admin-consent flow (public, no login)
+         * @description Redirect an IT admin to Microsoft's org-wide admin-consent screen.
+         *
+         *     Public by design: the whole point is that the customer's Microsoft admin can
+         *     authorize ARBI for their organization WITHOUT having an ARBI account — a user
+         *     shares ``/{ADMIN_CONSENT_PAGE}`` (which links here), the admin approves on
+         *     login.microsoftonline.com, and Microsoft redirects back to the regular OAuth
+         *     callback (already registered on the Entra app) with ``state=admin-consent``.
+         *     No secrets are exposed: the URL carries only the public client id + scopes.
+         */
+        get: operations['start_admin_consent'];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     '/v1/connectors/{vendor_key}/callback': {
         parameters: {
             query?: never;
@@ -2736,6 +2763,13 @@ interface paths {
         /**
          * OAuth callback — exchange code for tokens
          * @description Handle the OAuth callback: exchange code, encrypt + store tokens, redirect.
+         *
+         *     The provider may redirect back with an error instead of a code — e.g. the user
+         *     declines consent, or a SharePoint admin-consent wall blocks the grant
+         *     (``?error=access_denied&state=...`` with no ``code``). Rather than let FastAPI
+         *     reject the missing ``code`` with a raw 422, treat that (and any explicit
+         *     ``error``) as a graceful failure: best-effort consume the one-time PKCE state and
+         *     redirect the user back to the app with ``?connect_error={vendor_key}``.
          */
         get: operations['oauth_callback'];
         put?: never;
@@ -3426,7 +3460,7 @@ interface components {
             /**
              * Subagents Enabled
              * @description Include the sub_agent tool so the agent can spawn detached background sub-agents and control them (check / steer / pause / resume / collect) while it keeps working — parallel delegation, unlike the blocking deep_research. Fan-out is one level deep and capped in concurrency.
-             * @default false
+             * @default true
              */
             SUBAGENTS_ENABLED: boolean;
             /**
@@ -3669,7 +3703,7 @@ interface components {
             /**
              * Subagents Enabled
              * @description Include the sub_agent tool so the agent can spawn detached background sub-agents and control them (check / steer / pause / resume / collect) while it keeps working — parallel delegation, unlike the blocking deep_research. Fan-out is one level deep and capped in concurrency.
-             * @default false
+             * @default true
              */
             SUBAGENTS_ENABLED: boolean;
             /**
@@ -3779,7 +3813,7 @@ interface components {
              *       "MCP_TOOLS": [],
              *       "PLANNING_ENABLED": false,
              *       "DEEP_RESEARCH_ENABLED": true,
-             *       "SUBAGENTS_ENABLED": false,
+             *       "SUBAGENTS_ENABLED": true,
              *       "SUGGESTED_QUERIES": false,
              *       "ARTIFACTS_ENABLED": false,
              *       "IMAGE_ENABLED": false,
@@ -4024,7 +4058,7 @@ interface components {
              *       "IMAGE": "arbi-sandbox:bookworm-slim",
              *       "TIMEOUT_SECONDS": 60,
              *       "MEMORY_LIMIT": "512m",
-             *       "NETWORK": "bridge"
+             *       "NETWORK": "arbi-sandbox-net"
              *     }
              */
             RunCode: components['schemas']['RunCodeConfig'];
@@ -4067,7 +4101,7 @@ interface components {
              *       },
              *       "MAX_CONCURRENT_REQUESTS": 256,
              *       "MODEL_NAME": "Qwen/Qwen3-Reranker-0.6B",
-             *       "API_TYPE": "remote",
+             *       "API_TYPE": "local",
              *       "RETRIEVAL_INSTRUCTION": "Judge whether the passage contains the specific facts, figures, names, or references mentioned in the query. Only answer yes if the passage directly contains these details"
              *     }
              */
@@ -4088,7 +4122,7 @@ interface components {
             /**
              * @default {
              *       "MODEL_NAME": "Qwen/Qwen3-Embedding-0.6B",
-             *       "API_TYPE": "remote",
+             *       "API_TYPE": "local",
              *       "BATCH_SIZE": 128,
              *       "MAX_CONCURRENT_REQUESTS": 256,
              *       "DOCUMENT_PREFIX": "",
@@ -6048,7 +6082,7 @@ interface components {
             /**
              * Api Type
              * @description The inference type (local or remote).
-             * @default remote
+             * @default local
              * @enum {string}
              */
             API_TYPE: 'local' | 'remote';
@@ -6369,7 +6403,12 @@ interface components {
         };
         /**
          * FolderRead
-         * @description A selectable mail folder (Outlook) or label (Gmail).
+         * @description A mail folder (Outlook), label (Gmail), or drive folder/site/library.
+         *
+         *     Mail folders and ordinary drive folders are always selectable. Drive listings may
+         *     also surface non-selectable grouping nodes (e.g. a SharePoint *site*, which
+         *     contains document libraries but no files of its own) — ``selectable=False`` tells
+         *     the picker to render them as expandable-only branches.
          */
         FolderRead: {
             /** Id */
@@ -6378,6 +6417,11 @@ interface components {
             name: string;
             /** Count */
             count?: number | null;
+            /**
+             * Selectable
+             * @default true
+             */
+            selectable: boolean;
         };
         /**
          * FunctionCallItem
@@ -8379,7 +8423,7 @@ interface components {
             /**
              * Api Type
              * @description The inference type (local or remote).
-             * @default remote
+             * @default local
              * @enum {string}
              */
             API_TYPE: 'local' | 'remote';
@@ -9226,8 +9270,8 @@ interface components {
             MEMORY_LIMIT: string;
             /**
              * Network
-             * @description Container network mode. 'bridge' allows internet (pip/npm install). 'none' for full isolation.
-             * @default bridge
+             * @description Container network mode. 'arbi-sandbox-net' is the dedicated internal network created at deploy time: no egress at all (no internet, no LAN, no host), and other sandboxes are unreachable. Web access belongs to web_search / deep_research, not to executed code. Do not use 'bridge' — it would give model-authored code the host's whole network.
+             * @default arbi-sandbox-net
              */
             NETWORK: string;
         };
@@ -10844,6 +10888,11 @@ interface components {
              * @default true
              */
             show_connector_microsoft: boolean;
+            /**
+             * Show Connector Sharepoint
+             * @default false
+             */
+            show_connector_sharepoint: boolean;
             /**
              * Show Connector Google
              * @default false
@@ -10949,6 +10998,8 @@ interface components {
             show_mcp_connectors?: boolean | null;
             /** Show Connector Microsoft */
             show_connector_microsoft?: boolean | null;
+            /** Show Connector Sharepoint */
+            show_connector_sharepoint?: boolean | null;
             /** Show Connector Google */
             show_connector_google?: boolean | null;
             /** Show Connector Imanage */
@@ -10999,7 +11050,7 @@ interface components {
          *     (FastAPI validates + documents the allowed set) and the catalog keys.
          * @enum {string}
          */
-        VendorKey: 'microsoft' | 'gdrive' | 'gmail' | 'imanage' | 'westlaw' | 'ms365_mail';
+        VendorKey: 'microsoft' | 'microsoft_sharepoint' | 'gdrive' | 'gmail' | 'imanage' | 'westlaw' | 'ms365_mail';
         /** VerifyEmailRequest */
         VerifyEmailRequest: {
             /**
@@ -15444,11 +15495,46 @@ interface operations {
             };
         };
     };
+    start_admin_consent: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                vendor_key: components['schemas']['VendorKey'];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Successful Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    'application/json': unknown;
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    'application/json': components['schemas']['HTTPValidationError'];
+                };
+            };
+        };
+    };
     oauth_callback: {
         parameters: {
-            query: {
-                code: string;
-                state: string;
+            query?: {
+                code?: string | null;
+                state?: string | null;
+                error?: string | null;
+                error_description?: string | null;
+                admin_consent?: string | null;
+                tenant?: string | null;
             };
             header?: never;
             path: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbidocs/client",
-  "version": "0.3.135",
+  "version": "0.3.136",
   "description": "TypeScript SDK for the ARBI API — zero-knowledge auth, E2E encryption, and type-safe REST client",
   "type": "module",
   "main": "dist/index.cjs",