@arbidocs/client 0.3.168 → 0.3.170

package/dist/index.d.cts

@@ -427,10 +427,11 @@ interface paths {
         head?: never;
         /**
          * Patch Session
-         * @description Expire (ttl=0) or reset the remaining TTL of one of the caller's own sessions.
+         * @description Expire (ttl=0) or shorten the remaining TTL of one of the caller's own sessions.
          *
          *     Agents (as with /logout) may only touch their own session; principals may target
          *     any session in their session set, including ones other than the one they're on.
+         *     Cannot increase a session's TTL — see patch_session_ttl's docstring for why.
          */
         patch: operations['patch_session'];
         trace?: never;
@@ -2345,6 +2346,53 @@ interface paths {
         patch?: never;
         trace?: never;
     };
+    '/v1/agents/authorize-limits': {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Get Authorize Limits */
+        get: operations['get_authorize_limits'];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    '/v1/agents/{agent_ext_id}/authorize': {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Authorize Agent
+         * @description Mint a fresh, TTL'd session for the caller's own agent.
+         *
+         *     Standalone version of the session-mint step ``useRunTaskWithAuth`` performs
+         *     inline for a task run (``POST /v1/tasks/{id}/run``) — same primitive
+         *     (:func:`mint_agent_session`), just triggerable on its own instead of bundled
+         *     into running something. Returns the session's public key so the caller's
+         *     client can immediately deposit a temporary workspace key onto it via the
+         *     ordinary ``POST /v1/workspace/users`` (``session_pubkey_b64`` branch) —
+         *     mirroring the task flow's second step exactly. The session's remaining
+         *     time can be checked or ended early afterward via the generic session
+         *     endpoints, not extended (see the module docstring above).
+         */
+        post: operations['authorize_agent'];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     '/v1/agents/{agent_ext_id}': {
         parameters: {
             query?: never;
@@ -4666,6 +4714,46 @@ interface components {
             /** Reason */
             reason?: string | null;
         };
+        /**
+         * AuthorizeAgentRequest
+         * @description Body for POST /agents/{agent_ext_id}/authorize.
+         */
+        AuthorizeAgentRequest: {
+            /** Workspace Ext Id */
+            workspace_ext_id: string;
+            /**
+             * Ttl Seconds
+             * @description Omit for the deployment default (see GET /agents/authorize-limits).
+             */
+            ttl_seconds?: number | null;
+        };
+        /**
+         * AuthorizeAgentResponse
+         * @description What the caller's client needs to deposit a temporary workspace key onto
+         *     the freshly-minted session — the same shape a task run's
+         *     ``pending_auth_session_pubkey`` / ``pending_auth_agent_email`` fields carry.
+         */
+        AuthorizeAgentResponse: {
+            /** Session Pubkey B64 */
+            session_pubkey_b64: string;
+            /** Agent Email */
+            agent_email: string;
+            /** Ttl */
+            ttl: number;
+        };
+        /**
+         * AuthorizeLimitsResponse
+         * @description Bounds for ``authorize``'s ``ttl_seconds`` — lets a client show/enforce
+         *     the real default and max instead of guessing or discovering them via a 422.
+         *     Deployment-tunable (``AGENT_AUTHORIZE_DEFAULT_TTL_SECONDS`` /
+         *     ``AGENT_AUTHORIZE_MAX_TTL_SECONDS`` env vars), not hardcoded to 4h.
+         */
+        AuthorizeLimitsResponse: {
+            /** Default Ttl Seconds */
+            default_ttl_seconds: number;
+            /** Max Ttl Seconds */
+            max_ttl_seconds: number;
+        };
         /**
          * BatchCompleteMessage
          * @description Notification that a batch operation (upload or doctag generation) completed.
@@ -10081,7 +10169,7 @@ interface components {
         SessionTTLPatchRequest: {
             /**
              * Ttl
-             * @description New remaining TTL in seconds. 0 expires the session immediately; any other value resets its remaining time (capped at the server's max session TTL).
+             * @description New remaining TTL in seconds. 0 expires the session immediately; any other value must be LESS than the session's current remaining TTL — sessions can be ended early or shortened, never extended.
              */
             ttl: number;
         };
@@ -15334,6 +15422,62 @@ interface operations {
             };
         };
     };
+    get_authorize_limits: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Successful Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    'application/json': components['schemas']['AuthorizeLimitsResponse'];
+                };
+            };
+        };
+    };
+    authorize_agent: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Agent external id (agt-XXXXXXXX) */
+                agent_ext_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                'application/json': components['schemas']['AuthorizeAgentRequest'];
+            };
+        };
+        responses: {
+            /** @description Successful Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    'application/json': components['schemas']['AuthorizeAgentResponse'];
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    'application/json': components['schemas']['HTTPValidationError'];
+                };
+            };
+        };
+    };
     update_agent: {
         parameters: {
             query?: never;

package/dist/index.d.ts

@@ -427,10 +427,11 @@ interface paths {
         head?: never;
         /**
          * Patch Session
-         * @description Expire (ttl=0) or reset the remaining TTL of one of the caller's own sessions.
+         * @description Expire (ttl=0) or shorten the remaining TTL of one of the caller's own sessions.
          *
          *     Agents (as with /logout) may only touch their own session; principals may target
          *     any session in their session set, including ones other than the one they're on.
+         *     Cannot increase a session's TTL — see patch_session_ttl's docstring for why.
          */
         patch: operations['patch_session'];
         trace?: never;
@@ -2345,6 +2346,53 @@ interface paths {
         patch?: never;
         trace?: never;
     };
+    '/v1/agents/authorize-limits': {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Get Authorize Limits */
+        get: operations['get_authorize_limits'];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    '/v1/agents/{agent_ext_id}/authorize': {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Authorize Agent
+         * @description Mint a fresh, TTL'd session for the caller's own agent.
+         *
+         *     Standalone version of the session-mint step ``useRunTaskWithAuth`` performs
+         *     inline for a task run (``POST /v1/tasks/{id}/run``) — same primitive
+         *     (:func:`mint_agent_session`), just triggerable on its own instead of bundled
+         *     into running something. Returns the session's public key so the caller's
+         *     client can immediately deposit a temporary workspace key onto it via the
+         *     ordinary ``POST /v1/workspace/users`` (``session_pubkey_b64`` branch) —
+         *     mirroring the task flow's second step exactly. The session's remaining
+         *     time can be checked or ended early afterward via the generic session
+         *     endpoints, not extended (see the module docstring above).
+         */
+        post: operations['authorize_agent'];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     '/v1/agents/{agent_ext_id}': {
         parameters: {
             query?: never;
@@ -4666,6 +4714,46 @@ interface components {
             /** Reason */
             reason?: string | null;
         };
+        /**
+         * AuthorizeAgentRequest
+         * @description Body for POST /agents/{agent_ext_id}/authorize.
+         */
+        AuthorizeAgentRequest: {
+            /** Workspace Ext Id */
+            workspace_ext_id: string;
+            /**
+             * Ttl Seconds
+             * @description Omit for the deployment default (see GET /agents/authorize-limits).
+             */
+            ttl_seconds?: number | null;
+        };
+        /**
+         * AuthorizeAgentResponse
+         * @description What the caller's client needs to deposit a temporary workspace key onto
+         *     the freshly-minted session — the same shape a task run's
+         *     ``pending_auth_session_pubkey`` / ``pending_auth_agent_email`` fields carry.
+         */
+        AuthorizeAgentResponse: {
+            /** Session Pubkey B64 */
+            session_pubkey_b64: string;
+            /** Agent Email */
+            agent_email: string;
+            /** Ttl */
+            ttl: number;
+        };
+        /**
+         * AuthorizeLimitsResponse
+         * @description Bounds for ``authorize``'s ``ttl_seconds`` — lets a client show/enforce
+         *     the real default and max instead of guessing or discovering them via a 422.
+         *     Deployment-tunable (``AGENT_AUTHORIZE_DEFAULT_TTL_SECONDS`` /
+         *     ``AGENT_AUTHORIZE_MAX_TTL_SECONDS`` env vars), not hardcoded to 4h.
+         */
+        AuthorizeLimitsResponse: {
+            /** Default Ttl Seconds */
+            default_ttl_seconds: number;
+            /** Max Ttl Seconds */
+            max_ttl_seconds: number;
+        };
         /**
          * BatchCompleteMessage
          * @description Notification that a batch operation (upload or doctag generation) completed.
@@ -10081,7 +10169,7 @@ interface components {
         SessionTTLPatchRequest: {
             /**
              * Ttl
-             * @description New remaining TTL in seconds. 0 expires the session immediately; any other value resets its remaining time (capped at the server's max session TTL).
+             * @description New remaining TTL in seconds. 0 expires the session immediately; any other value must be LESS than the session's current remaining TTL — sessions can be ended early or shortened, never extended.
              */
             ttl: number;
         };
@@ -15334,6 +15422,62 @@ interface operations {
             };
         };
     };
+    get_authorize_limits: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Successful Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    'application/json': components['schemas']['AuthorizeLimitsResponse'];
+                };
+            };
+        };
+    };
+    authorize_agent: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Agent external id (agt-XXXXXXXX) */
+                agent_ext_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                'application/json': components['schemas']['AuthorizeAgentRequest'];
+            };
+        };
+        responses: {
+            /** @description Successful Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    'application/json': components['schemas']['AuthorizeAgentResponse'];
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    'application/json': components['schemas']['HTTPValidationError'];
+                };
+            };
+        };
+    };
     update_agent: {
         parameters: {
             query?: never;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbidocs/client",
-  "version": "0.3.168",
+  "version": "0.3.170",
   "description": "TypeScript SDK for the ARBI API — zero-knowledge auth, E2E encryption, and type-safe REST client",
   "type": "module",
   "main": "dist/index.cjs",