@arbidocs/client 0.3.25 → 0.3.26

package/dist/index.d.cts

@@ -200,7 +200,7 @@ interface paths {
         patch?: never;
         trace?: never;
     };
-    '/v1/user/authorize': {
+    '/v1/user/agent': {
         parameters: {
             query?: never;
             header?: never;
@@ -210,44 +210,17 @@ interface paths {
         get?: never;
         put?: never;
         /**
-         * Authorize Session Endpoint
-         * @description Create a delegated session with pre-populated workspace keys.
+         * Create Agent
+         * @description Create a persistent agent owned by the current user.
          *
-         *     Frontend sends workspace keys SealedBox-encrypted with the user's session public key.
-         *     Server decrypts them, re-encrypts with a new session keypair, and creates a pending
-         *     session keyed by a 3-word claim code. The recipient redeems the code via POST /user/token.
+         *     The frontend generates an Ed25519 keypair from a random seed (the agent's password).
+         *     Only the public key is sent here.  The agent logs in via POST /user/login using its
+         *     synthetic email (``agentname.usr-XXXXXXXX@deploymentdomain``) and a signature derived
+         *     from the seed.
          *
-         *     If persist_identity is True, the claim also creates a persistent Agent identity
-         *     with WorkspaceUsers rows so the agent can re-login later.
+         *     Workspace access is granted separately via POST /workspace/{id}/users.
          */
-        post: operations['authorize_session'];
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    '/v1/user/token': {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        /**
-         * Claim Agent Session Endpoint
-         * @description Claim an agent session using a 3-word code.
-         *
-         *     Returns LoginResponse so the frontend can use the same auth code path as login.
-         *     Workspaces are filtered to only those included in the delegation.
-         *
-         *     If persist_identity was set on delegation:
-         *     - signing_key is required in the request
-         *     - Creates an Agent row and WorkspaceUsers rows (role=guest)
-         */
-        post: operations['claim_agent_session'];
+        post: operations['create_agent'];
         delete?: never;
         options?: never;
         head?: never;
@@ -283,7 +256,7 @@ interface paths {
         };
         /**
          * List User Sessions
-         * @description List active sessions. Agents/delegated see only their own session; users see all.
+         * @description List active sessions. Agents see only their own session; users see all.
          */
         get: operations['list_sessions'];
         put?: never;
@@ -307,18 +280,15 @@ interface paths {
          * Change Password
          * @description Change user's master password by re-keying all workspace keys.
          *
-         *     Client must:
+         *     Self re-key (agent_ext_id omitted):
          *     1. Sign "email|timestamp" with current Ed25519 key (proves current password)
          *     2. Provide new Ed25519 signing key (derived from new password)
          *     3. Re-wrap all workspace keys with new X25519 public key
          *
-         *     Server will:
-         *     1. Verify signature with stored signing_key_pub
-         *     2. Derive new X25519 encryption key from new Ed25519 signing key
-         *     3. Update both keys and all workspace wrapped keys
-         *
-         *     Note: This changes the master password (encryption password), not authentication password.
-         *     Both local and SSO users can change their master password.
+         *     Agent re-key (agent_ext_id provided):
+         *     1. Parent signs "agent_ext_id|timestamp" with their own Ed25519 key (proves authority)
+         *     2. Provide new Ed25519 signing key for the agent
+         *     3. Re-wrap the agent's workspace keys with the agent's new X25519 public key
          */
         post: operations['change_password'];
         delete?: never;
@@ -380,7 +350,7 @@ interface paths {
          * Get User Settings
          * @description Get current user's settings.
          *
-         *     Updates local subscription status (entitlements) to ensure fresh status before returning.
+         *     Updates local subscription status (subscription tier) to ensure fresh status before returning.
          */
         get: operations['get_user_settings'];
         put?: never;
@@ -428,7 +398,7 @@ interface paths {
          * Get Stripe Subscription
          * @description Get detailed Stripe subscription information including portal URL for management.
          *
-         *     First updates local subscription status based on Stripe entitlements (to refresh after purchase),
+         *     First updates local subscription status based on Stripe subscription tier (to refresh after purchase),
          *     then fetches detailed subscription information from Stripe Subscriptions API.
          */
         get: operations['get_subscription'];
@@ -491,7 +461,7 @@ interface paths {
          * @description Open a workspace: store encrypted workspace key in session, set active, return workspace data.
          *
          *     Users provide ``workspace_key`` (SealedBox-encrypted with session public key).
-         *     Agents omit it — their keys are pre-populated via ``/agent-session``.
+         *     Agents omit it — their workspace keys are pre-populated at login from their WorkspaceUsers rows.
          */
         post: operations['open_workspace'];
         delete?: never;
@@ -519,8 +489,15 @@ interface paths {
          * Add Workspace Users
          * @description Add users to a workspace (bulk operation). Only workspace owners can add users.
          *
-         *     Client provides workspace-scoped JWT. Server decrypts workspace key from JWT claims,
-         *     then wraps it with each recipient's public key.
+         *     Two modes:
+         *     1. Body supplies ``workspace_key`` + ``workspace_ext_id``: caller provides the
+         *        SealedBox-encrypted workspace key (encrypted with their session public key).
+         *        The workspace need not be open/active on the session. This allows sharing any
+         *        workspace for which the caller holds a key (e.g. from their login response).
+         *     2. No body key: server falls back to the session's current active workspace.
+         *
+         *     Wraps the workspace key with each recipient's X25519 public key (permanent grant)
+         *     or deposits it into their Redis session (temporary grant when session_pubkey_b64 is set).
          *     Returns the full WorkspaceUserResponse for each successfully added user.
          */
         post: operations['add_workspace_users'];
@@ -616,6 +593,37 @@ interface paths {
         patch?: never;
         trace?: never;
     };
+    '/v1/document/similar': {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get Similar Documents
+         * @description Return document similarity pairs from the doc_similarities table.
+         *
+         *     Pairs are stored at upload time for documents with similarity >= NEAR_DUPLICATE_STORE_THRESHOLD.
+         *     Use the threshold param to filter (e.g. 0.92 for near-duplicates, 0.75 for similar docs).
+         *     Use doc_ext_id to find all documents similar to a specific document.
+         *
+         *     Args:
+         *         threshold: Minimum cosine similarity score (0.0–1.0). Default 0.0 returns all stored pairs.
+         *         doc_ext_id: Optional document ID to filter pairs involving that specific document.
+         *
+         *     Returns:
+         *         List of document similarity pairs with scores.
+         */
+        get: operations['get_similar_documents'];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     '/v1/document/': {
         parameters: {
             query?: never;
@@ -1504,28 +1512,32 @@ interface components {
         };
         /**
          * AddWorkspaceUsersRequest
-         * @description Request to add users to a workspace (POST /workspace/{id}/users).
+         * @description Request to add users to a workspace (POST /workspace/users).
          *
          *     All invited users receive the same role.
+         *
+         *     workspace_key + workspace_ext_id (optional): If provided, the caller supplies the
+         *     SealedBox-encrypted workspace key directly (encrypted with their session public key)
+         *     and the target workspace external ID. This allows sharing any workspace the caller
+         *     holds a key for without needing to open/activate it first. If omitted, the server
+         *     falls back to the current session's active workspace.
+         *
+         *     session_pubkey_b64 (optional): If set, the grant is temporary and scoped to the
+         *     recipient's current session (identified by this X25519 public key). The workspace
+         *     key is stored in that session's Redis entry and the workspaceusers row expires when
+         *     the session expires. Omit for a permanent grant (default behaviour).
          */
         AddWorkspaceUsersRequest: {
             /** Emails */
             emails: string[];
             /** @default collaborator */
             role: components['schemas']['WorkspaceRole'];
-        };
-        /**
-         * AgentSessionClaimRequest
-         * @description Claim an agent session using a 3-word code.
-         *
-         *     If the pending session has persist_identity=True, signing_key is required
-         *     to create the Agent identity. Otherwise it is accepted but ignored.
-         */
-        AgentSessionClaimRequest: {
-            /** Claim Code */
-            claim_code: string;
-            /** Signing Key */
-            signing_key?: string | null;
+            /** Workspace Key */
+            workspace_key?: string | null;
+            /** Workspace Ext Id */
+            workspace_ext_id?: string | null;
+            /** Session Pubkey B64 */
+            session_pubkey_b64?: string | null;
         };
         /**
          * AgentStepEvent
@@ -2265,47 +2277,6 @@ interface components {
             /** Reason */
             reason?: string | null;
         };
-        /**
-         * AuthorizeRequest
-         * @description Authorize a delegated session with workspace keys.
-         *
-         *     Used by: POST /user/authorize (authenticated)
-         *
-         *     Frontend sends workspace keys SealedBox-encrypted with the user's session public key.
-         *     Server decrypts them, re-encrypts with a new session keypair, and creates a pending
-         *     session keyed by a 3-word claim code. The recipient redeems the code via POST /user/token.
-         *
-         *     If persist_identity is True, the claim creates a persistent Agent identity
-         *     with its own keypair and WorkspaceUsers rows. The agent can then re-login.
-         */
-        AuthorizeRequest: {
-            /** Workspaces */
-            workspaces: {
-                [key: string]: string;
-            };
-            /** Active Workspace */
-            active_workspace?: string | null;
-            /**
-             * Ttl
-             * @default 3600
-             */
-            ttl: number;
-            /**
-             * Persist Identity
-             * @default false
-             */
-            persist_identity: boolean;
-            /** Name */
-            name: string;
-        };
-        /**
-         * AuthorizeResponse
-         * @description Response containing a 3-word claim code for the recipient to retrieve a JWT.
-         */
-        AuthorizeResponse: {
-            /** Claim Code */
-            claim_code: string;
-        };
         /**
          * BatchCompleteMessage
          * @description Notification that a batch operation (upload or doctag generation) completed.
@@ -2331,8 +2302,15 @@ interface components {
          * ChangePasswordRequest
          * @description Password change request with signature-based auth.
          *
-         *     Client proves knowledge of current password by signing with Ed25519 key.
-         *     Server derives new X25519 encryption key from new Ed25519 signing key.
+         *     Self re-key (agent_ext_id omitted):
+         *       Client proves knowledge of current password by signing "email|timestamp"
+         *       with their own Ed25519 key.
+         *
+         *     Agent re-key (agent_ext_id provided):
+         *       Parent re-keys an agent's signing/encryption keys.  Parent proves authority
+         *       by signing "agent_ext_id|timestamp" with their own Ed25519 key.
+         *       rewrapped_workspace_keys must contain entries for the agent's workspaces,
+         *       each wrapped with the agent's new X25519 public key.
          */
         ChangePasswordRequest: {
             /** Signature */
@@ -2345,6 +2323,12 @@ interface components {
             rewrapped_workspace_keys: {
                 [key: string]: string;
             };
+            /** Agent Ext Id */
+            agent_ext_id?: string | null;
+            /** Rewrapped Agent Recovery Keys */
+            rewrapped_agent_recovery_keys?: {
+                [key: string]: string;
+            } | null;
         };
         /** ChangePasswordResponse */
         ChangePasswordResponse: {
@@ -2833,6 +2817,28 @@ interface components {
              */
             results: components['schemas']['CopyDocumentResult'][];
         };
+        /**
+         * CreateAgentRequest
+         * @description Create a persistent agent owned by the current user.
+         *
+         *     Used by: POST /user/agent (authenticated, non-agent)
+         *
+         *     Frontend generates an Ed25519 keypair from a random seed (the agent's "password").
+         *     Only the public key is sent here; the seed is given to the agent CLI.
+         *     The agent's synthetic email is ``agentname.usr-XXXXXXXX@deploymentdomain``.
+         *     The agent logs in via POST /user/login using this email + Ed25519 signature.
+         *
+         *     Agent name must be composed of letters, digits, hyphens, and underscores only
+         *     (must start with a letter or digit) so it is valid as an email local-part.
+         */
+        CreateAgentRequest: {
+            /** Name */
+            name: string;
+            /** Signing Key */
+            signing_key: string;
+            /** Recovery Key */
+            recovery_key?: string | null;
+        };
         /**
          * CreateArtifactDetail
          * @description Detail for a create_artifact tool call.
@@ -3050,6 +3056,26 @@ interface components {
             doctags: components['schemas']['DocTagResponse'][];
             doc_metadata?: components['schemas']['DocMetadata'] | null;
         };
+        /**
+         * DocSimPair
+         * @description A pair of documents identified as near-duplicates by centroid similarity.
+         */
+        DocSimPair: {
+            doc_a: components['schemas']['DocResponse'];
+            doc_b: components['schemas']['DocResponse'];
+            /** Similarity */
+            similarity: number;
+        };
+        /**
+         * DocSimResponse
+         * @description Response for the near-duplicates endpoint.
+         */
+        DocSimResponse: {
+            /** Workspace Ext Id */
+            workspace_ext_id: string;
+            /** Pairs */
+            pairs: components['schemas']['DocSimPair'][];
+        };
         /**
          * DocTagResponse
          * @description Response for doctag operations - the link between a document and a tag.
@@ -3587,22 +3613,24 @@ interface components {
          * LoginRequest
          * @description Unified login request for users and agents.
          *
+         *     Both human users and persistent agents authenticate via email + Ed25519 signature.
+         *     Agents have a synthetic email (``parent+agentname@domain``).
+         *
          *     For local users: email + signature + timestamp
          *     For SSO users: email + signature + timestamp + sso_token
-         *     For agents: agent_ext_id + signature + timestamp
-         *
-         *     Exactly one of ``email`` or ``agent_ext_id`` must be provided.
+         *     For agents: email (agent's synthetic address) + signature + timestamp
          *
          *     Authentication flow:
          *     1. Client derives Ed25519 keypair from password (users) or has stored key (agents)
-         *     2. Client signs "identity|timestamp" with Ed25519 private key
+         *     2. Client signs "email|timestamp" with Ed25519 private key
          *     3. Server verifies signature using stored Ed25519 public key
          */
         LoginRequest: {
-            /** Email */
-            email?: string | null;
-            /** Agent Ext Id */
-            agent_ext_id?: string | null;
+            /**
+             * Email
+             * Format: email
+             */
+            email: string;
             /** Signature */
             signature: string;
             /** Timestamp */
@@ -4076,7 +4104,7 @@ interface components {
          *     Type is self-descriptive, no need to parse content field.
          * @enum {string}
          */
-        NotificationType: 'user_message' | 'workspaceuser_added_owner' | 'workspaceuser_added_collaborator' | 'workspaceuser_added_guest' | 'workspaceuser_removed' | 'workspaceuser_updated_owner' | 'workspaceuser_updated_collaborator' | 'workspaceuser_updated_guest' | 'contact_accepted' | 'access_request' | 'access_code' | 'email_reply';
+        NotificationType: 'user_message' | 'workspaceuser_added_owner' | 'workspaceuser_added_collaborator' | 'workspaceuser_added_guest' | 'workspaceuser_removed' | 'workspaceuser_updated_owner' | 'workspaceuser_updated_collaborator' | 'workspaceuser_updated_guest' | 'contact_accepted' | 'email_reply';
         /**
          * NotificationUpdate
          * @description Single notification update for bulk PATCH.
@@ -5666,11 +5694,12 @@ interface components {
          * SubscriptionStatusResponse
          * @description Subscription status response - unified model for all subscription states.
          *
-         *     Status can be:
-         *     - "trialing": User is on trial (has trial_expires, days_remaining)
-         *     - "active": Active Stripe subscription (has plan, amount, currency, etc.)
-         *     - "canceled": Had subscription but canceled (has portal_url)
-         *     - "none": No subscription or trial
+         *     Status is one of the tier names configured in STRIPE_TIERS, plus system tiers:
+         *     - Paid tiers (e.g., "pro", "pro_plus"): Active Stripe subscription
+         *     - "trial": User is on trial (has trial_expires, days_remaining)
+         *     - "dev": Developer access
+         *     - "restricted": No access (trial expired or no subscription)
+         *     - "inactive": Expired/canceled/unpaid Stripe subscription
          */
         SubscriptionStatusResponse: {
             /** Status */
@@ -6711,6 +6740,7 @@ interface components {
          * @description User (or agent) with their role in a workspace.
          *
          *     For agents: agent_ext_id is set (agt-XXXXXXXX), name is user.given_name.
+         *     is_temporary: True when the grant is session-scoped (expires_at is set in DB).
          */
         WorkspaceUserResponse: {
             user: components['schemas']['UserResponse'];
@@ -6732,6 +6762,11 @@ interface components {
             document_count: number;
             /** Agent Ext Id */
             agent_ext_id?: string | null;
+            /**
+             * Is Temporary
+             * @default false
+             */
+            is_temporary: boolean;
         };
     };
     responses: never;
@@ -7033,7 +7068,7 @@ interface operations {
             };
         };
     };
-    authorize_session: {
+    create_agent: {
         parameters: {
             query?: never;
             header?: never;
@@ -7042,50 +7077,17 @@ interface operations {
         };
         requestBody: {
             content: {
-                'application/json': components['schemas']['AuthorizeRequest'];
+                'application/json': components['schemas']['CreateAgentRequest'];
             };
         };
         responses: {
             /** @description Successful Response */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    'application/json': components['schemas']['AuthorizeResponse'];
-                };
-            };
-            /** @description Validation Error */
-            422: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    'application/json': components['schemas']['HTTPValidationError'];
-                };
-            };
-        };
-    };
-    claim_agent_session: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        requestBody: {
-            content: {
-                'application/json': components['schemas']['AgentSessionClaimRequest'];
-            };
-        };
-        responses: {
-            /** @description Successful Response */
-            200: {
+            201: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['LoginResponse'];
+                    'application/json': components['schemas']['UserResponse'];
                 };
             };
             /** @description Validation Error */
@@ -7665,6 +7667,40 @@ interface operations {
             };
         };
     };
+    get_similar_documents: {
+        parameters: {
+            query?: {
+                /** @description Minimum similarity score (0.0 = all stored pairs) */
+                threshold?: number;
+                /** @description Filter pairs involving a specific document */
+                doc_ext_id?: string | null;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Successful Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    'application/json': components['schemas']['DocSimResponse'];
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    'application/json': components['schemas']['HTTPValidationError'];
+                };
+            };
+        };
+    };
     get_documents: {
         parameters: {
             query: {

package/dist/index.d.ts

@@ -200,7 +200,7 @@ interface paths {
         patch?: never;
         trace?: never;
     };
-    '/v1/user/authorize': {
+    '/v1/user/agent': {
         parameters: {
             query?: never;
             header?: never;
@@ -210,44 +210,17 @@ interface paths {
         get?: never;
         put?: never;
         /**
-         * Authorize Session Endpoint
-         * @description Create a delegated session with pre-populated workspace keys.
+         * Create Agent
+         * @description Create a persistent agent owned by the current user.
          *
-         *     Frontend sends workspace keys SealedBox-encrypted with the user's session public key.
-         *     Server decrypts them, re-encrypts with a new session keypair, and creates a pending
-         *     session keyed by a 3-word claim code. The recipient redeems the code via POST /user/token.
+         *     The frontend generates an Ed25519 keypair from a random seed (the agent's password).
+         *     Only the public key is sent here.  The agent logs in via POST /user/login using its
+         *     synthetic email (``agentname.usr-XXXXXXXX@deploymentdomain``) and a signature derived
+         *     from the seed.
          *
-         *     If persist_identity is True, the claim also creates a persistent Agent identity
-         *     with WorkspaceUsers rows so the agent can re-login later.
+         *     Workspace access is granted separately via POST /workspace/{id}/users.
          */
-        post: operations['authorize_session'];
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    '/v1/user/token': {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        /**
-         * Claim Agent Session Endpoint
-         * @description Claim an agent session using a 3-word code.
-         *
-         *     Returns LoginResponse so the frontend can use the same auth code path as login.
-         *     Workspaces are filtered to only those included in the delegation.
-         *
-         *     If persist_identity was set on delegation:
-         *     - signing_key is required in the request
-         *     - Creates an Agent row and WorkspaceUsers rows (role=guest)
-         */
-        post: operations['claim_agent_session'];
+        post: operations['create_agent'];
         delete?: never;
         options?: never;
         head?: never;
@@ -283,7 +256,7 @@ interface paths {
         };
         /**
          * List User Sessions
-         * @description List active sessions. Agents/delegated see only their own session; users see all.
+         * @description List active sessions. Agents see only their own session; users see all.
          */
         get: operations['list_sessions'];
         put?: never;
@@ -307,18 +280,15 @@ interface paths {
          * Change Password
          * @description Change user's master password by re-keying all workspace keys.
          *
-         *     Client must:
+         *     Self re-key (agent_ext_id omitted):
          *     1. Sign "email|timestamp" with current Ed25519 key (proves current password)
          *     2. Provide new Ed25519 signing key (derived from new password)
          *     3. Re-wrap all workspace keys with new X25519 public key
          *
-         *     Server will:
-         *     1. Verify signature with stored signing_key_pub
-         *     2. Derive new X25519 encryption key from new Ed25519 signing key
-         *     3. Update both keys and all workspace wrapped keys
-         *
-         *     Note: This changes the master password (encryption password), not authentication password.
-         *     Both local and SSO users can change their master password.
+         *     Agent re-key (agent_ext_id provided):
+         *     1. Parent signs "agent_ext_id|timestamp" with their own Ed25519 key (proves authority)
+         *     2. Provide new Ed25519 signing key for the agent
+         *     3. Re-wrap the agent's workspace keys with the agent's new X25519 public key
          */
         post: operations['change_password'];
         delete?: never;
@@ -380,7 +350,7 @@ interface paths {
          * Get User Settings
          * @description Get current user's settings.
          *
-         *     Updates local subscription status (entitlements) to ensure fresh status before returning.
+         *     Updates local subscription status (subscription tier) to ensure fresh status before returning.
          */
         get: operations['get_user_settings'];
         put?: never;
@@ -428,7 +398,7 @@ interface paths {
          * Get Stripe Subscription
          * @description Get detailed Stripe subscription information including portal URL for management.
          *
-         *     First updates local subscription status based on Stripe entitlements (to refresh after purchase),
+         *     First updates local subscription status based on Stripe subscription tier (to refresh after purchase),
          *     then fetches detailed subscription information from Stripe Subscriptions API.
          */
         get: operations['get_subscription'];
@@ -491,7 +461,7 @@ interface paths {
          * @description Open a workspace: store encrypted workspace key in session, set active, return workspace data.
          *
          *     Users provide ``workspace_key`` (SealedBox-encrypted with session public key).
-         *     Agents omit it — their keys are pre-populated via ``/agent-session``.
+         *     Agents omit it — their workspace keys are pre-populated at login from their WorkspaceUsers rows.
          */
         post: operations['open_workspace'];
         delete?: never;
@@ -519,8 +489,15 @@ interface paths {
          * Add Workspace Users
          * @description Add users to a workspace (bulk operation). Only workspace owners can add users.
          *
-         *     Client provides workspace-scoped JWT. Server decrypts workspace key from JWT claims,
-         *     then wraps it with each recipient's public key.
+         *     Two modes:
+         *     1. Body supplies ``workspace_key`` + ``workspace_ext_id``: caller provides the
+         *        SealedBox-encrypted workspace key (encrypted with their session public key).
+         *        The workspace need not be open/active on the session. This allows sharing any
+         *        workspace for which the caller holds a key (e.g. from their login response).
+         *     2. No body key: server falls back to the session's current active workspace.
+         *
+         *     Wraps the workspace key with each recipient's X25519 public key (permanent grant)
+         *     or deposits it into their Redis session (temporary grant when session_pubkey_b64 is set).
          *     Returns the full WorkspaceUserResponse for each successfully added user.
          */
         post: operations['add_workspace_users'];
@@ -616,6 +593,37 @@ interface paths {
         patch?: never;
         trace?: never;
     };
+    '/v1/document/similar': {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get Similar Documents
+         * @description Return document similarity pairs from the doc_similarities table.
+         *
+         *     Pairs are stored at upload time for documents with similarity >= NEAR_DUPLICATE_STORE_THRESHOLD.
+         *     Use the threshold param to filter (e.g. 0.92 for near-duplicates, 0.75 for similar docs).
+         *     Use doc_ext_id to find all documents similar to a specific document.
+         *
+         *     Args:
+         *         threshold: Minimum cosine similarity score (0.0–1.0). Default 0.0 returns all stored pairs.
+         *         doc_ext_id: Optional document ID to filter pairs involving that specific document.
+         *
+         *     Returns:
+         *         List of document similarity pairs with scores.
+         */
+        get: operations['get_similar_documents'];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     '/v1/document/': {
         parameters: {
             query?: never;
@@ -1504,28 +1512,32 @@ interface components {
         };
         /**
          * AddWorkspaceUsersRequest
-         * @description Request to add users to a workspace (POST /workspace/{id}/users).
+         * @description Request to add users to a workspace (POST /workspace/users).
          *
          *     All invited users receive the same role.
+         *
+         *     workspace_key + workspace_ext_id (optional): If provided, the caller supplies the
+         *     SealedBox-encrypted workspace key directly (encrypted with their session public key)
+         *     and the target workspace external ID. This allows sharing any workspace the caller
+         *     holds a key for without needing to open/activate it first. If omitted, the server
+         *     falls back to the current session's active workspace.
+         *
+         *     session_pubkey_b64 (optional): If set, the grant is temporary and scoped to the
+         *     recipient's current session (identified by this X25519 public key). The workspace
+         *     key is stored in that session's Redis entry and the workspaceusers row expires when
+         *     the session expires. Omit for a permanent grant (default behaviour).
          */
         AddWorkspaceUsersRequest: {
             /** Emails */
             emails: string[];
             /** @default collaborator */
             role: components['schemas']['WorkspaceRole'];
-        };
-        /**
-         * AgentSessionClaimRequest
-         * @description Claim an agent session using a 3-word code.
-         *
-         *     If the pending session has persist_identity=True, signing_key is required
-         *     to create the Agent identity. Otherwise it is accepted but ignored.
-         */
-        AgentSessionClaimRequest: {
-            /** Claim Code */
-            claim_code: string;
-            /** Signing Key */
-            signing_key?: string | null;
+            /** Workspace Key */
+            workspace_key?: string | null;
+            /** Workspace Ext Id */
+            workspace_ext_id?: string | null;
+            /** Session Pubkey B64 */
+            session_pubkey_b64?: string | null;
         };
         /**
          * AgentStepEvent
@@ -2265,47 +2277,6 @@ interface components {
             /** Reason */
             reason?: string | null;
         };
-        /**
-         * AuthorizeRequest
-         * @description Authorize a delegated session with workspace keys.
-         *
-         *     Used by: POST /user/authorize (authenticated)
-         *
-         *     Frontend sends workspace keys SealedBox-encrypted with the user's session public key.
-         *     Server decrypts them, re-encrypts with a new session keypair, and creates a pending
-         *     session keyed by a 3-word claim code. The recipient redeems the code via POST /user/token.
-         *
-         *     If persist_identity is True, the claim creates a persistent Agent identity
-         *     with its own keypair and WorkspaceUsers rows. The agent can then re-login.
-         */
-        AuthorizeRequest: {
-            /** Workspaces */
-            workspaces: {
-                [key: string]: string;
-            };
-            /** Active Workspace */
-            active_workspace?: string | null;
-            /**
-             * Ttl
-             * @default 3600
-             */
-            ttl: number;
-            /**
-             * Persist Identity
-             * @default false
-             */
-            persist_identity: boolean;
-            /** Name */
-            name: string;
-        };
-        /**
-         * AuthorizeResponse
-         * @description Response containing a 3-word claim code for the recipient to retrieve a JWT.
-         */
-        AuthorizeResponse: {
-            /** Claim Code */
-            claim_code: string;
-        };
         /**
          * BatchCompleteMessage
          * @description Notification that a batch operation (upload or doctag generation) completed.
@@ -2331,8 +2302,15 @@ interface components {
          * ChangePasswordRequest
          * @description Password change request with signature-based auth.
          *
-         *     Client proves knowledge of current password by signing with Ed25519 key.
-         *     Server derives new X25519 encryption key from new Ed25519 signing key.
+         *     Self re-key (agent_ext_id omitted):
+         *       Client proves knowledge of current password by signing "email|timestamp"
+         *       with their own Ed25519 key.
+         *
+         *     Agent re-key (agent_ext_id provided):
+         *       Parent re-keys an agent's signing/encryption keys.  Parent proves authority
+         *       by signing "agent_ext_id|timestamp" with their own Ed25519 key.
+         *       rewrapped_workspace_keys must contain entries for the agent's workspaces,
+         *       each wrapped with the agent's new X25519 public key.
          */
         ChangePasswordRequest: {
             /** Signature */
@@ -2345,6 +2323,12 @@ interface components {
             rewrapped_workspace_keys: {
                 [key: string]: string;
             };
+            /** Agent Ext Id */
+            agent_ext_id?: string | null;
+            /** Rewrapped Agent Recovery Keys */
+            rewrapped_agent_recovery_keys?: {
+                [key: string]: string;
+            } | null;
         };
         /** ChangePasswordResponse */
         ChangePasswordResponse: {
@@ -2833,6 +2817,28 @@ interface components {
              */
             results: components['schemas']['CopyDocumentResult'][];
         };
+        /**
+         * CreateAgentRequest
+         * @description Create a persistent agent owned by the current user.
+         *
+         *     Used by: POST /user/agent (authenticated, non-agent)
+         *
+         *     Frontend generates an Ed25519 keypair from a random seed (the agent's "password").
+         *     Only the public key is sent here; the seed is given to the agent CLI.
+         *     The agent's synthetic email is ``agentname.usr-XXXXXXXX@deploymentdomain``.
+         *     The agent logs in via POST /user/login using this email + Ed25519 signature.
+         *
+         *     Agent name must be composed of letters, digits, hyphens, and underscores only
+         *     (must start with a letter or digit) so it is valid as an email local-part.
+         */
+        CreateAgentRequest: {
+            /** Name */
+            name: string;
+            /** Signing Key */
+            signing_key: string;
+            /** Recovery Key */
+            recovery_key?: string | null;
+        };
         /**
          * CreateArtifactDetail
          * @description Detail for a create_artifact tool call.
@@ -3050,6 +3056,26 @@ interface components {
             doctags: components['schemas']['DocTagResponse'][];
             doc_metadata?: components['schemas']['DocMetadata'] | null;
         };
+        /**
+         * DocSimPair
+         * @description A pair of documents identified as near-duplicates by centroid similarity.
+         */
+        DocSimPair: {
+            doc_a: components['schemas']['DocResponse'];
+            doc_b: components['schemas']['DocResponse'];
+            /** Similarity */
+            similarity: number;
+        };
+        /**
+         * DocSimResponse
+         * @description Response for the near-duplicates endpoint.
+         */
+        DocSimResponse: {
+            /** Workspace Ext Id */
+            workspace_ext_id: string;
+            /** Pairs */
+            pairs: components['schemas']['DocSimPair'][];
+        };
         /**
          * DocTagResponse
          * @description Response for doctag operations - the link between a document and a tag.
@@ -3587,22 +3613,24 @@ interface components {
          * LoginRequest
          * @description Unified login request for users and agents.
          *
+         *     Both human users and persistent agents authenticate via email + Ed25519 signature.
+         *     Agents have a synthetic email (``parent+agentname@domain``).
+         *
          *     For local users: email + signature + timestamp
          *     For SSO users: email + signature + timestamp + sso_token
-         *     For agents: agent_ext_id + signature + timestamp
-         *
-         *     Exactly one of ``email`` or ``agent_ext_id`` must be provided.
+         *     For agents: email (agent's synthetic address) + signature + timestamp
          *
          *     Authentication flow:
          *     1. Client derives Ed25519 keypair from password (users) or has stored key (agents)
-         *     2. Client signs "identity|timestamp" with Ed25519 private key
+         *     2. Client signs "email|timestamp" with Ed25519 private key
          *     3. Server verifies signature using stored Ed25519 public key
          */
         LoginRequest: {
-            /** Email */
-            email?: string | null;
-            /** Agent Ext Id */
-            agent_ext_id?: string | null;
+            /**
+             * Email
+             * Format: email
+             */
+            email: string;
             /** Signature */
             signature: string;
             /** Timestamp */
@@ -4076,7 +4104,7 @@ interface components {
          *     Type is self-descriptive, no need to parse content field.
          * @enum {string}
          */
-        NotificationType: 'user_message' | 'workspaceuser_added_owner' | 'workspaceuser_added_collaborator' | 'workspaceuser_added_guest' | 'workspaceuser_removed' | 'workspaceuser_updated_owner' | 'workspaceuser_updated_collaborator' | 'workspaceuser_updated_guest' | 'contact_accepted' | 'access_request' | 'access_code' | 'email_reply';
+        NotificationType: 'user_message' | 'workspaceuser_added_owner' | 'workspaceuser_added_collaborator' | 'workspaceuser_added_guest' | 'workspaceuser_removed' | 'workspaceuser_updated_owner' | 'workspaceuser_updated_collaborator' | 'workspaceuser_updated_guest' | 'contact_accepted' | 'email_reply';
         /**
          * NotificationUpdate
          * @description Single notification update for bulk PATCH.
@@ -5666,11 +5694,12 @@ interface components {
          * SubscriptionStatusResponse
          * @description Subscription status response - unified model for all subscription states.
          *
-         *     Status can be:
-         *     - "trialing": User is on trial (has trial_expires, days_remaining)
-         *     - "active": Active Stripe subscription (has plan, amount, currency, etc.)
-         *     - "canceled": Had subscription but canceled (has portal_url)
-         *     - "none": No subscription or trial
+         *     Status is one of the tier names configured in STRIPE_TIERS, plus system tiers:
+         *     - Paid tiers (e.g., "pro", "pro_plus"): Active Stripe subscription
+         *     - "trial": User is on trial (has trial_expires, days_remaining)
+         *     - "dev": Developer access
+         *     - "restricted": No access (trial expired or no subscription)
+         *     - "inactive": Expired/canceled/unpaid Stripe subscription
          */
         SubscriptionStatusResponse: {
             /** Status */
@@ -6711,6 +6740,7 @@ interface components {
          * @description User (or agent) with their role in a workspace.
          *
          *     For agents: agent_ext_id is set (agt-XXXXXXXX), name is user.given_name.
+         *     is_temporary: True when the grant is session-scoped (expires_at is set in DB).
          */
         WorkspaceUserResponse: {
             user: components['schemas']['UserResponse'];
@@ -6732,6 +6762,11 @@ interface components {
             document_count: number;
             /** Agent Ext Id */
             agent_ext_id?: string | null;
+            /**
+             * Is Temporary
+             * @default false
+             */
+            is_temporary: boolean;
         };
     };
     responses: never;
@@ -7033,7 +7068,7 @@ interface operations {
             };
         };
     };
-    authorize_session: {
+    create_agent: {
         parameters: {
             query?: never;
             header?: never;
@@ -7042,50 +7077,17 @@ interface operations {
         };
         requestBody: {
             content: {
-                'application/json': components['schemas']['AuthorizeRequest'];
+                'application/json': components['schemas']['CreateAgentRequest'];
             };
         };
         responses: {
             /** @description Successful Response */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    'application/json': components['schemas']['AuthorizeResponse'];
-                };
-            };
-            /** @description Validation Error */
-            422: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    'application/json': components['schemas']['HTTPValidationError'];
-                };
-            };
-        };
-    };
-    claim_agent_session: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        requestBody: {
-            content: {
-                'application/json': components['schemas']['AgentSessionClaimRequest'];
-            };
-        };
-        responses: {
-            /** @description Successful Response */
-            200: {
+            201: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['LoginResponse'];
+                    'application/json': components['schemas']['UserResponse'];
                 };
             };
             /** @description Validation Error */
@@ -7665,6 +7667,40 @@ interface operations {
             };
         };
     };
+    get_similar_documents: {
+        parameters: {
+            query?: {
+                /** @description Minimum similarity score (0.0 = all stored pairs) */
+                threshold?: number;
+                /** @description Filter pairs involving a specific document */
+                doc_ext_id?: string | null;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Successful Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    'application/json': components['schemas']['DocSimResponse'];
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    'application/json': components['schemas']['HTTPValidationError'];
+                };
+            };
+        };
+    };
     get_documents: {
         parameters: {
             query: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbidocs/client",
-  "version": "0.3.25",
+  "version": "0.3.26",
   "description": "TypeScript SDK for the ARBI API — zero-knowledge auth, E2E encryption, and type-safe REST client",
   "type": "module",
   "main": "dist/index.cjs",