@arbidocs/sdk 0.4.2 → 0.4.4

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { p as ConfigStore, m as CliConfig, n as CliCredentials, C as ChatSession, ab as SkippedFile, ak as UploadResult, j as AuthHeaders, ag as UploadBatchResult, aj as UploadOptions, ah as UploadDirectOptions, ai as UploadDirectResult, a9 as SUPPORTED_EXTENSIONS, v as DmCryptoContext } from './browser-U90kdb7T.cjs';
-export { b as AgentStepEvent, c as Arbi, d as ArbiApiError, e as ArbiError, g as ArbiOptions, h as ArtifactEvent, i as AuthContext, k as AuthenticatedClient, l as CitationSummary, o as CommandDescriptor, q as ConnectOptions, D as DOC_TERMINAL_STATUSES, w as DocNameMap, x as DocumentListFields, y as DocumentListOrder, z as DocumentWaiter, B as DocumentWaiterOptions, H as FormattedWsMessage, L as ListAllOptions, J as ListPaginatedOptions, M as MessageLevel, K as MessageMetadataPayload, N as MessageQueuedEvent, O as OutputTokensDetails, P as ParsedSlashCommand, R as ProjectInvoicesResponse, S as ProjectUsageResponse, T as QueryOptions, U as ReconnectOptions, V as ReconnectableWsConnection, W as ResolvedCitation, X as ResolvedRecipient, Y as ResponseCompletedEvent, Z as ResponseContentPartAddedEvent, _ as ResponseCreatedEvent, $ as ResponseFailedEvent, a0 as ResponseOutputItemAddedEvent, a1 as ResponseOutputItemDoneEvent, a2 as ResponseOutputTextDeltaEvent, a3 as ResponseOutputTextDoneEvent, a4 as ResponseUsage, a5 as SSEEvent, a6 as SSEStreamCallbacks, a7 as SSEStreamResult, a8 as SSEStreamStartData, aa as SkillSummary, ad as TokenBudgetContext, al as UserDailyUsageResponse, am as UserInfo, an as UserInputRequestEvent, ao as UserMessageEvent, ap as WebSocketAuthError, aq as WorkspaceContext, ar as WsConnection, as as agentconfig, at as assistant, au as authenticatedFetch, av as buildDocNameMap, aw as buildRetrievalChunkTool, ax as buildRetrievalFullContextTool, ay as buildRetrievalTocTool, az as connectWebSocket, aA as connectWithReconnect, aB as consumeSSEStream, aC as contacts, aD as conversations, aE as countCitations, aF as createAuthenticatedClient, aG as createDocumentWaiter, aH as dm, aI as doctags, aJ as documents, aK as facts, aL as files, aM as filterSkills, aN as formatAgentStepLabel, aO as formatFileSize, aP as formatItemLabel, aQ as formatStreamSummary, aR as formatUserName, aS as formatWorkspaceChoices, aT as formatWsMessage, aU as generateEncryptedWorkspaceKey, aV as generateNewWorkspaceKey, aW as getErrorCode, aX as getErrorMessage, aY as getRawWorkspaceKey, aZ as health, a_ as parseSSEEvents, a$ as parseSlashCommand, b0 as parseSlashTokenInProgress, b1 as performPasswordLogin, b2 as performSigningKeyLogin, b3 as performSsoDeviceFlowLogin, b4 as projects, b5 as requireData, b6 as requireOk, b7 as resolveAuth, b8 as resolveCitations, b9 as resolveWorkspace, ba as responses, bb as selectWorkspace, bc as selectWorkspaceById, bd as settings, be as streamSSE, bf as stripCitationMarkdown, bg as summarizeCitations, bh as tags, bi as tasks, bj as workspaces } from './browser-U90kdb7T.cjs';
+import { q as ConfigStore, n as CliConfig, o as CliCredentials, C as ChatSession, ac as SkippedFile, al as UploadResult, k as AuthHeaders, ah as UploadBatchResult, ak as UploadOptions, ai as UploadDirectOptions, aj as UploadDirectResult, aa as SUPPORTED_EXTENSIONS, w as DmCryptoContext } from './browser-Bdzn5DIN.cjs';
+export { b as AgentStepEvent, c as Arbi, d as ArbiApiError, e as ArbiError, g as ArbiOptions, h as ArbiSessionExpiredError, i as ArtifactEvent, j as AuthContext, l as AuthenticatedClient, m as CitationSummary, p as CommandDescriptor, r as ConnectOptions, D as DOC_TERMINAL_STATUSES, x as DocNameMap, y as DocumentListFields, z as DocumentListOrder, B as DocumentWaiter, E as DocumentWaiterOptions, I as FormattedWsMessage, L as ListAllOptions, K as ListPaginatedOptions, M as MessageLevel, N as MessageMetadataPayload, O as MessageQueuedEvent, P as OutputTokensDetails, Q as ParsedSlashCommand, S as ProjectInvoicesResponse, T as ProjectUsageResponse, U as QueryOptions, V as ReconnectOptions, W as ReconnectableWsConnection, X as ResolvedCitation, Y as ResolvedRecipient, Z as ResponseCompletedEvent, _ as ResponseContentPartAddedEvent, $ as ResponseCreatedEvent, a0 as ResponseFailedEvent, a1 as ResponseOutputItemAddedEvent, a2 as ResponseOutputItemDoneEvent, a3 as ResponseOutputTextDeltaEvent, a4 as ResponseOutputTextDoneEvent, a5 as ResponseUsage, a6 as SSEEvent, a7 as SSEStreamCallbacks, a8 as SSEStreamResult, a9 as SSEStreamStartData, ab as SkillSummary, ae as TokenBudgetContext, am as UserDailyUsageResponse, an as UserInfo, ao as UserInputRequestEvent, ap as UserMessageEvent, aq as WebSocketAuthError, ar as WorkspaceContext, as as WsConnection, at as agentconfig, au as assistant, av as authenticatedFetch, aw as buildDocNameMap, ax as buildRetrievalChunkTool, ay as buildRetrievalFullContextTool, az as buildRetrievalTocTool, aA as connectWebSocket, aB as connectWithReconnect, aC as consumeSSEStream, aD as contacts, aE as conversations, aF as countCitations, aG as createAuthenticatedClient, aH as createDocumentWaiter, aI as dm, aJ as doctags, aK as documents, aL as facts, aM as files, aN as filterSkills, aO as formatAgentStepLabel, aP as formatFileSize, aQ as formatItemLabel, aR as formatStreamSummary, aS as formatUserName, aT as formatWorkspaceChoices, aU as formatWsMessage, aV as generateEncryptedWorkspaceKey, aW as generateNewWorkspaceKey, aX as getErrorCode, aY as getErrorMessage, aZ as getRawWorkspaceKey, a_ as health, a$ as parseSSEEvents, b0 as parseSlashCommand, b1 as parseSlashTokenInProgress, b2 as performPasswordLogin, b3 as performSigningKeyLogin, b4 as performSsoDeviceFlowLogin, b5 as projects, b6 as requireData, b7 as requireOk, b8 as resolveAuth, b9 as resolveCitations, ba as resolveWorkspace, bb as responses, bc as selectWorkspace, bd as selectWorkspaceById, be as settings, bf as streamSSE, bg as stripCitationMarkdown, bh as summarizeCitations, bi as tags, bj as tasks, bk as workspaces } from './browser-Bdzn5DIN.cjs';
 import { SessionStorageProvider, ArbiClient, components } from '@arbidocs/client';
 
 /**
@@ -380,6 +380,8 @@ declare namespace documentsNode {
 type UserResponse = components['schemas']['UserResponse'];
 type CreateAgentResponse = components['schemas']['CreateAgentResponse'];
 type AgentWorkspaceResponse = components['schemas']['AgentWorkspaceResponse'];
+type AuthorizeAgentResponse = components['schemas']['AuthorizeAgentResponse'];
+type AuthorizeLimitsResponse = components['schemas']['AuthorizeLimitsResponse'];
 declare function listAgents(arbi: ArbiClient): Promise<UserResponse[]>;
 /**
  * Create a persistent agent. Only `name` is accepted (alphanumeric, `_`/`-`).
@@ -677,14 +679,27 @@ declare function listAgentWorkspaces(arbi: ArbiClient, agentExtId: string): Prom
 declare function deleteAgents(arbi: ArbiClient, agentExtIds: string[]): Promise<{
     [x: string]: unknown;
 }>;
+/**
+ * Mint a fresh, TTL'd run session for the caller's own agent
+ * (`POST /v1/agents/{id}/authorize`). The response carries the session's public key; deposit a
+ * temporary workspace key on it with `Arbi.workspaces.grantTemporaryAccess()` (or do both in one
+ * call with `Arbi.agents.grantTemporaryAccess()`). `ttlSeconds` omitted = the deployment default.
+ */
+declare function authorizeAgent(arbi: ArbiClient, agentExtId: string, workspaceExtId: string, ttlSeconds?: number): Promise<AuthorizeAgentResponse>;
+/** The default and maximum lifetime of a temporary agent authorization. */
+declare function getAuthorizeLimits(arbi: ArbiClient): Promise<AuthorizeLimitsResponse>;
 
+type agents_AuthorizeAgentResponse = AuthorizeAgentResponse;
+type agents_AuthorizeLimitsResponse = AuthorizeLimitsResponse;
+declare const agents_authorizeAgent: typeof authorizeAgent;
 declare const agents_createAgent: typeof createAgent;
 declare const agents_deleteAgents: typeof deleteAgents;
 declare const agents_getAgentConfig: typeof getAgentConfig;
+declare const agents_getAuthorizeLimits: typeof getAuthorizeLimits;
 declare const agents_listAgentWorkspaces: typeof listAgentWorkspaces;
 declare const agents_listAgents: typeof listAgents;
 declare namespace agents {
-  export { agents_createAgent as createAgent, agents_deleteAgents as deleteAgents, agents_getAgentConfig as getAgentConfig, agents_listAgentWorkspaces as listAgentWorkspaces, agents_listAgents as listAgents };
+  export { type agents_AuthorizeAgentResponse as AuthorizeAgentResponse, type agents_AuthorizeLimitsResponse as AuthorizeLimitsResponse, agents_authorizeAgent as authorizeAgent, agents_createAgent as createAgent, agents_deleteAgents as deleteAgents, agents_getAgentConfig as getAgentConfig, agents_getAuthorizeLimits as getAuthorizeLimits, agents_listAgentWorkspaces as listAgentWorkspaces, agents_listAgents as listAgents };
 }
 
 /**

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { p as ConfigStore, m as CliConfig, n as CliCredentials, C as ChatSession, ab as SkippedFile, ak as UploadResult, j as AuthHeaders, ag as UploadBatchResult, aj as UploadOptions, ah as UploadDirectOptions, ai as UploadDirectResult, a9 as SUPPORTED_EXTENSIONS, v as DmCryptoContext } from './browser-U90kdb7T.js';
-export { b as AgentStepEvent, c as Arbi, d as ArbiApiError, e as ArbiError, g as ArbiOptions, h as ArtifactEvent, i as AuthContext, k as AuthenticatedClient, l as CitationSummary, o as CommandDescriptor, q as ConnectOptions, D as DOC_TERMINAL_STATUSES, w as DocNameMap, x as DocumentListFields, y as DocumentListOrder, z as DocumentWaiter, B as DocumentWaiterOptions, H as FormattedWsMessage, L as ListAllOptions, J as ListPaginatedOptions, M as MessageLevel, K as MessageMetadataPayload, N as MessageQueuedEvent, O as OutputTokensDetails, P as ParsedSlashCommand, R as ProjectInvoicesResponse, S as ProjectUsageResponse, T as QueryOptions, U as ReconnectOptions, V as ReconnectableWsConnection, W as ResolvedCitation, X as ResolvedRecipient, Y as ResponseCompletedEvent, Z as ResponseContentPartAddedEvent, _ as ResponseCreatedEvent, $ as ResponseFailedEvent, a0 as ResponseOutputItemAddedEvent, a1 as ResponseOutputItemDoneEvent, a2 as ResponseOutputTextDeltaEvent, a3 as ResponseOutputTextDoneEvent, a4 as ResponseUsage, a5 as SSEEvent, a6 as SSEStreamCallbacks, a7 as SSEStreamResult, a8 as SSEStreamStartData, aa as SkillSummary, ad as TokenBudgetContext, al as UserDailyUsageResponse, am as UserInfo, an as UserInputRequestEvent, ao as UserMessageEvent, ap as WebSocketAuthError, aq as WorkspaceContext, ar as WsConnection, as as agentconfig, at as assistant, au as authenticatedFetch, av as buildDocNameMap, aw as buildRetrievalChunkTool, ax as buildRetrievalFullContextTool, ay as buildRetrievalTocTool, az as connectWebSocket, aA as connectWithReconnect, aB as consumeSSEStream, aC as contacts, aD as conversations, aE as countCitations, aF as createAuthenticatedClient, aG as createDocumentWaiter, aH as dm, aI as doctags, aJ as documents, aK as facts, aL as files, aM as filterSkills, aN as formatAgentStepLabel, aO as formatFileSize, aP as formatItemLabel, aQ as formatStreamSummary, aR as formatUserName, aS as formatWorkspaceChoices, aT as formatWsMessage, aU as generateEncryptedWorkspaceKey, aV as generateNewWorkspaceKey, aW as getErrorCode, aX as getErrorMessage, aY as getRawWorkspaceKey, aZ as health, a_ as parseSSEEvents, a$ as parseSlashCommand, b0 as parseSlashTokenInProgress, b1 as performPasswordLogin, b2 as performSigningKeyLogin, b3 as performSsoDeviceFlowLogin, b4 as projects, b5 as requireData, b6 as requireOk, b7 as resolveAuth, b8 as resolveCitations, b9 as resolveWorkspace, ba as responses, bb as selectWorkspace, bc as selectWorkspaceById, bd as settings, be as streamSSE, bf as stripCitationMarkdown, bg as summarizeCitations, bh as tags, bi as tasks, bj as workspaces } from './browser-U90kdb7T.js';
+import { q as ConfigStore, n as CliConfig, o as CliCredentials, C as ChatSession, ac as SkippedFile, al as UploadResult, k as AuthHeaders, ah as UploadBatchResult, ak as UploadOptions, ai as UploadDirectOptions, aj as UploadDirectResult, aa as SUPPORTED_EXTENSIONS, w as DmCryptoContext } from './browser-Bdzn5DIN.js';
+export { b as AgentStepEvent, c as Arbi, d as ArbiApiError, e as ArbiError, g as ArbiOptions, h as ArbiSessionExpiredError, i as ArtifactEvent, j as AuthContext, l as AuthenticatedClient, m as CitationSummary, p as CommandDescriptor, r as ConnectOptions, D as DOC_TERMINAL_STATUSES, x as DocNameMap, y as DocumentListFields, z as DocumentListOrder, B as DocumentWaiter, E as DocumentWaiterOptions, I as FormattedWsMessage, L as ListAllOptions, K as ListPaginatedOptions, M as MessageLevel, N as MessageMetadataPayload, O as MessageQueuedEvent, P as OutputTokensDetails, Q as ParsedSlashCommand, S as ProjectInvoicesResponse, T as ProjectUsageResponse, U as QueryOptions, V as ReconnectOptions, W as ReconnectableWsConnection, X as ResolvedCitation, Y as ResolvedRecipient, Z as ResponseCompletedEvent, _ as ResponseContentPartAddedEvent, $ as ResponseCreatedEvent, a0 as ResponseFailedEvent, a1 as ResponseOutputItemAddedEvent, a2 as ResponseOutputItemDoneEvent, a3 as ResponseOutputTextDeltaEvent, a4 as ResponseOutputTextDoneEvent, a5 as ResponseUsage, a6 as SSEEvent, a7 as SSEStreamCallbacks, a8 as SSEStreamResult, a9 as SSEStreamStartData, ab as SkillSummary, ae as TokenBudgetContext, am as UserDailyUsageResponse, an as UserInfo, ao as UserInputRequestEvent, ap as UserMessageEvent, aq as WebSocketAuthError, ar as WorkspaceContext, as as WsConnection, at as agentconfig, au as assistant, av as authenticatedFetch, aw as buildDocNameMap, ax as buildRetrievalChunkTool, ay as buildRetrievalFullContextTool, az as buildRetrievalTocTool, aA as connectWebSocket, aB as connectWithReconnect, aC as consumeSSEStream, aD as contacts, aE as conversations, aF as countCitations, aG as createAuthenticatedClient, aH as createDocumentWaiter, aI as dm, aJ as doctags, aK as documents, aL as facts, aM as files, aN as filterSkills, aO as formatAgentStepLabel, aP as formatFileSize, aQ as formatItemLabel, aR as formatStreamSummary, aS as formatUserName, aT as formatWorkspaceChoices, aU as formatWsMessage, aV as generateEncryptedWorkspaceKey, aW as generateNewWorkspaceKey, aX as getErrorCode, aY as getErrorMessage, aZ as getRawWorkspaceKey, a_ as health, a$ as parseSSEEvents, b0 as parseSlashCommand, b1 as parseSlashTokenInProgress, b2 as performPasswordLogin, b3 as performSigningKeyLogin, b4 as performSsoDeviceFlowLogin, b5 as projects, b6 as requireData, b7 as requireOk, b8 as resolveAuth, b9 as resolveCitations, ba as resolveWorkspace, bb as responses, bc as selectWorkspace, bd as selectWorkspaceById, be as settings, bf as streamSSE, bg as stripCitationMarkdown, bh as summarizeCitations, bi as tags, bj as tasks, bk as workspaces } from './browser-Bdzn5DIN.js';
 import { SessionStorageProvider, ArbiClient, components } from '@arbidocs/client';
 
 /**
@@ -380,6 +380,8 @@ declare namespace documentsNode {
 type UserResponse = components['schemas']['UserResponse'];
 type CreateAgentResponse = components['schemas']['CreateAgentResponse'];
 type AgentWorkspaceResponse = components['schemas']['AgentWorkspaceResponse'];
+type AuthorizeAgentResponse = components['schemas']['AuthorizeAgentResponse'];
+type AuthorizeLimitsResponse = components['schemas']['AuthorizeLimitsResponse'];
 declare function listAgents(arbi: ArbiClient): Promise<UserResponse[]>;
 /**
  * Create a persistent agent. Only `name` is accepted (alphanumeric, `_`/`-`).
@@ -677,14 +679,27 @@ declare function listAgentWorkspaces(arbi: ArbiClient, agentExtId: string): Prom
 declare function deleteAgents(arbi: ArbiClient, agentExtIds: string[]): Promise<{
     [x: string]: unknown;
 }>;
+/**
+ * Mint a fresh, TTL'd run session for the caller's own agent
+ * (`POST /v1/agents/{id}/authorize`). The response carries the session's public key; deposit a
+ * temporary workspace key on it with `Arbi.workspaces.grantTemporaryAccess()` (or do both in one
+ * call with `Arbi.agents.grantTemporaryAccess()`). `ttlSeconds` omitted = the deployment default.
+ */
+declare function authorizeAgent(arbi: ArbiClient, agentExtId: string, workspaceExtId: string, ttlSeconds?: number): Promise<AuthorizeAgentResponse>;
+/** The default and maximum lifetime of a temporary agent authorization. */
+declare function getAuthorizeLimits(arbi: ArbiClient): Promise<AuthorizeLimitsResponse>;
 
+type agents_AuthorizeAgentResponse = AuthorizeAgentResponse;
+type agents_AuthorizeLimitsResponse = AuthorizeLimitsResponse;
+declare const agents_authorizeAgent: typeof authorizeAgent;
 declare const agents_createAgent: typeof createAgent;
 declare const agents_deleteAgents: typeof deleteAgents;
 declare const agents_getAgentConfig: typeof getAgentConfig;
+declare const agents_getAuthorizeLimits: typeof getAuthorizeLimits;
 declare const agents_listAgentWorkspaces: typeof listAgentWorkspaces;
 declare const agents_listAgents: typeof listAgents;
 declare namespace agents {
-  export { agents_createAgent as createAgent, agents_deleteAgents as deleteAgents, agents_getAgentConfig as getAgentConfig, agents_listAgentWorkspaces as listAgentWorkspaces, agents_listAgents as listAgents };
+  export { type agents_AuthorizeAgentResponse as AuthorizeAgentResponse, type agents_AuthorizeLimitsResponse as AuthorizeLimitsResponse, agents_authorizeAgent as authorizeAgent, agents_createAgent as createAgent, agents_deleteAgents as deleteAgents, agents_getAgentConfig as getAgentConfig, agents_getAuthorizeLimits as getAuthorizeLimits, agents_listAgentWorkspaces as listAgentWorkspaces, agents_listAgents as listAgents };
 }
 
 /**

package/dist/index.js

@@ -3487,6 +3487,12 @@ var ArbiError = class extends Error {
     this.name = "ArbiError";
   }
 };
+var ArbiSessionExpiredError = class extends ArbiError {
+  constructor(message = "Your session expired. Sign in again.") {
+    super(message);
+    this.name = "ArbiSessionExpiredError";
+  }
+};
 var ArbiApiError = class extends ArbiError {
   apiError;
   constructor(message, apiError) {
@@ -5210,6 +5216,7 @@ __export(workspaces_exports, {
   copyDocuments: () => copyDocuments,
   createWorkspace: () => createWorkspace,
   deleteWorkspaces: () => deleteWorkspaces,
+  grantTemporaryWorkspaceAccess: () => grantTemporaryWorkspaceAccess,
   listWorkspaceUsers: () => listWorkspaceUsers,
   listWorkspaces: () => listWorkspaces,
   removeWorkspaceUsers: () => removeWorkspaceUsers,
@@ -5250,14 +5257,33 @@ async function updateWorkspace(arbi, body) {
 async function listWorkspaceUsers(arbi) {
   return requireData(await arbi.fetch.GET("/v1/workspace/users"), "Failed to fetch workspace users");
 }
-async function addWorkspaceUsers(arbi, emails, role = "collaborator") {
+async function addWorkspaceUsers(arbi, emails, role = "collaborator", target) {
   return requireData(
     await arbi.fetch.POST("/v1/workspace/users", {
-      body: { emails, role }
+      body: target ? {
+        emails,
+        role,
+        workspace_ext_id: target.workspaceExtId,
+        workspace_key: target.workspaceKey
+      } : { emails, role }
     }),
     "Failed to add users"
   );
 }
+async function grantTemporaryWorkspaceAccess(arbi, params) {
+  return requireData(
+    await arbi.fetch.POST("/v1/workspace/users", {
+      body: {
+        emails: params.emails,
+        role: params.role ?? "collaborator",
+        workspace_ext_id: params.workspaceExtId,
+        workspace_key: params.workspaceKey,
+        session_pubkey_b64: params.sessionPubkeyB64
+      }
+    }),
+    "Failed to grant temporary access"
+  );
+}
 async function removeWorkspaceUsers(arbi, userIds) {
   requireOk(
     await arbi.fetch.DELETE("/v1/workspace/users", {
@@ -5653,9 +5679,11 @@ __export(dm_exports, {
 // src/operations/agents.ts
 var agents_exports = {};
 __export(agents_exports, {
+  authorizeAgent: () => authorizeAgent,
   createAgent: () => createAgent,
   deleteAgents: () => deleteAgents,
   getAgentConfig: () => getAgentConfig,
+  getAuthorizeLimits: () => getAuthorizeLimits,
   listAgentWorkspaces: () => listAgentWorkspaces,
   listAgents: () => listAgents
 });
@@ -5690,6 +5718,21 @@ async function deleteAgents(arbi, agentExtIds) {
     "Failed to delete agents"
   );
 }
+async function authorizeAgent(arbi, agentExtId, workspaceExtId, ttlSeconds) {
+  return requireData(
+    await arbi.fetch.POST("/v1/agents/{agent_ext_id}/authorize", {
+      params: { path: { agent_ext_id: agentExtId } },
+      body: { workspace_ext_id: workspaceExtId, ttl_seconds: ttlSeconds ?? null }
+    }),
+    "Failed to authorize agent"
+  );
+}
+async function getAuthorizeLimits(arbi) {
+  return requireData(
+    await arbi.fetch.GET("/v1/agents/authorize-limits"),
+    "Failed to fetch authorize limits"
+  );
+}
 
 // src/operations/dm.ts
 function createDmCryptoContext(arbi, signingPrivateKeyBytes, userExtId) {
@@ -6076,6 +6119,7 @@ __export(tasks_exports, {
   createTask: () => createTask,
   deleteTask: () => deleteTask,
   getTask: () => getTask,
+  listTaskRuns: () => listTaskRuns,
   listTasks: () => listTasks,
   runTask: () => runTask,
   updateTask: () => updateTask
@@ -6113,6 +6157,12 @@ async function runTask(arbi, taskId) {
     "Failed to run task"
   );
 }
+async function listTaskRuns(arbi, taskId) {
+  return requireData(
+    await arbi.fetch.GET("/v1/tasks/{task_id}/runs", { params: { path: { task_id: taskId } } }),
+    "Failed to list task runs"
+  );
+}
 
 // src/operations/facts.ts
 var facts_exports = {};
@@ -6182,11 +6232,23 @@ async function remindFact(arbi, factId, options = {}) {
 }
 
 // src/arbi.ts
+function tokenExpiresWithin(token, seconds) {
+  const payload = token?.split(".")[1];
+  if (!payload) return false;
+  try {
+    const json = atob(payload.replace(/-/g, "+").replace(/_/g, "/"));
+    const { exp } = JSON.parse(json);
+    return typeof exp === "number" && exp * 1e3 - Date.now() < seconds * 1e3;
+  } catch {
+    return false;
+  }
+}
 var Arbi = class {
   client = null;
   loginResult = null;
   currentWorkspaceId = null;
   dmCryptoContext = null;
+  sessionExpiredListeners = /* @__PURE__ */ new Set();
   options;
   constructor(options) {
     this.options = options;
@@ -6199,7 +6261,13 @@ var Arbi = class {
     this.client = createArbiClient({
       baseUrl: this.options.url,
       deploymentDomain: domain,
-      credentials: this.options.credentials ?? "omit"
+      credentials: this.options.credentials ?? "omit",
+      // A silent re-login rotates the server session key: keep ours in step, or the next
+      // workspace open would seal the key for a session the server no longer has.
+      onReloginSuccess: ({ serverSessionKey }) => {
+        if (this.loginResult) this.loginResult = { ...this.loginResult, serverSessionKey };
+      },
+      onSessionExpired: () => this.expireSession()
     });
     await this.client.crypto.initSodium();
     return this.client;
@@ -6236,6 +6304,22 @@ var Arbi = class {
     const signingPrivateKey = client.crypto.base64ToBytes(signingPrivateKeyBase64);
     this.loginResult = await client.auth.loginWithKey({ email, signingPrivateKey });
   }
+  /** A workspace's key, sealed to the caller's own session (what `/open` and `POST /workspace/users` take). */
+  async sealWorkspaceKey(workspaceId) {
+    const client = this.requireClient();
+    const lr2 = this.requireLogin();
+    const all = await listWorkspaces(client);
+    const ws = all.find((w2) => w2.external_id === workspaceId);
+    if (!ws || !ws.wrapped_key) {
+      throw new ArbiError(`Workspace ${workspaceId} not found or has no encryption key`);
+    }
+    return generateEncryptedWorkspaceKey(
+      client,
+      ws.wrapped_key,
+      lr2.serverSessionKey,
+      client.crypto.bytesToBase64(lr2.signingPrivateKey)
+    );
+  }
   /**
    * Select a workspace by ID. Fetches the workspace list, finds the matching
    * workspace, decrypts the wrapped key, and sets up auth headers.
@@ -6262,6 +6346,52 @@ var Arbi = class {
     });
     this.currentWorkspaceId = ws.external_id;
   }
+  /**
+   * Subscribe to "the session cannot be recovered". Fires when a request failed with 401 or
+   * "No active workspace" and neither a workspace re-open nor a silent re-login was possible
+   * (the server refused; an unreachable server does not fire). The local session is already
+   * cleared when it fires: show "Your session expired, sign in again". Returns an unsubscribe.
+   */
+  onSessionExpired(listener) {
+    this.sessionExpiredListeners.add(listener);
+    return () => this.sessionExpiredListeners.delete(listener);
+  }
+  expireSession() {
+    if (this.loginResult) {
+      this.loginResult.signingPrivateKey.fill(0);
+      this.loginResult.serverSessionKey.fill(0);
+    }
+    this.loginResult = null;
+    this.currentWorkspaceId = null;
+    this.dmCryptoContext = null;
+    this.client?.session.clear();
+    for (const listener of [...this.sessionExpiredListeners]) listener();
+  }
+  /**
+   * Run a raw-fetch operation (streaming, multipart: no middleware) and, when it fails because
+   * the token expired or the server lost the open workspace, recover once and run it again.
+   * `run` must read the auth headers itself so the retry carries the fresh token.
+   */
+  async recovering(run) {
+    if (this.client && tokenExpiresWithin(this.client.session.getState().accessToken, 30)) {
+      await this.client.auth.relogin();
+    }
+    try {
+      return await run();
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "";
+      const noWorkspace = /no active workspace/i.test(message);
+      const unauthorised = /\b401\b|token has expired/i.test(message);
+      if (!(error instanceof ArbiApiError) || !(noWorkspace || unauthorised)) throw error;
+      const client = this.requireClient();
+      const recovered = noWorkspace && await client.auth.reopenWorkspace() || await client.auth.relogin() !== null;
+      if (!recovered) {
+        this.expireSession();
+        throw new ArbiSessionExpiredError();
+      }
+      return run();
+    }
+  }
   /** Log out and clear internal state. */
   async logout() {
     if (this.client) {
@@ -6372,6 +6502,30 @@ var Arbi = class {
     update: (body) => updateWorkspace(this.requireClient(), body),
     listUsers: () => listWorkspaceUsers(this.requireClient()),
     addUsers: (emails, role) => addWorkspaceUsers(this.requireClient(), emails, role),
+    /**
+     * Grant users a temporary key scoped to ONE session (identified by its public key), for
+     * example an agent's run session minted by `agents.authorize()`. Nothing standing is created:
+     * the grant expires with that session. Works for any workspace the caller holds a key for;
+     * it does not need to be the open one.
+     */
+    grantTemporaryAccess: async (params) => {
+      const client = this.requireClient();
+      return grantTemporaryWorkspaceAccess(client, {
+        emails: params.emails,
+        workspaceExtId: params.workspaceId,
+        workspaceKey: await this.sealWorkspaceKey(params.workspaceId),
+        sessionPubkeyB64: params.sessionPubkeyB64,
+        role: params.role
+      });
+    },
+    /**
+     * Add users (standing, permanent membership) to ANY workspace the caller holds a key for,
+     * without opening it. `addUsers` does the same for the currently open workspace.
+     */
+    grantAccess: async (params) => addWorkspaceUsers(this.requireClient(), params.emails, params.role, {
+      workspaceExtId: params.workspaceId,
+      workspaceKey: await this.sealWorkspaceKey(params.workspaceId)
+    }),
     removeUsers: (userIds) => removeWorkspaceUsers(this.requireClient(), userIds),
     setUserRole: (userIds, role) => setUserRole(this.requireClient(), userIds, role),
     /**
@@ -6428,16 +6582,18 @@ var Arbi = class {
     },
     uploadFile: (fileData, fileName, options) => {
       this.requireWorkspace();
-      return uploadFile(
-        this.getAuthHeaders(),
-        fileData,
-        fileName,
-        options?.folder ? { folder: options.folder } : void 0
+      return this.recovering(
+        () => uploadFile(
+          this.getAuthHeaders(),
+          fileData,
+          fileName,
+          options?.folder ? { folder: options.folder } : void 0
+        )
       );
     },
-    download: (docId) => downloadDocument(this.getAuthHeaders(), docId),
-    getParsedContent: (docId, stage) => getParsedContent(this.getAuthHeaders(), docId, stage),
-    getThumbnails: (docIds) => getThumbnails(this.getAuthHeaders(), docIds)
+    download: (docId) => this.recovering(() => downloadDocument(this.getAuthHeaders(), docId)),
+    getParsedContent: (docId, stage) => this.recovering(() => getParsedContent(this.getAuthHeaders(), docId, stage)),
+    getThumbnails: (docIds) => this.recovering(() => getThumbnails(this.getAuthHeaders(), docIds))
   };
   // ── Conversations ─────────────────────────────────────────────────────
   conversations = {
@@ -6456,16 +6612,17 @@ var Arbi = class {
      * Returns the accumulated result after the stream completes.
      */
     query: async (question, options) => {
-      const auth = this.getAuthHeaders();
       const workspaceId = this.requireWorkspace();
-      const response = await queryAssistant({
-        ...auth,
-        workspaceId,
-        question,
-        docIds: options.docIds,
-        previousResponseId: options.previousResponseId,
-        model: options.model
-      });
+      const response = await this.recovering(
+        () => queryAssistant({
+          ...this.getAuthHeaders(),
+          workspaceId,
+          question,
+          docIds: options.docIds,
+          previousResponseId: options.previousResponseId,
+          model: options.model
+        })
+      );
       const callbacks = {
         onToken: options.onToken,
         onStreamStart: options.onStreamStart,
@@ -6484,6 +6641,8 @@ var Arbi = class {
      * Respond to an agent's question during a human-in-the-loop workflow.
      */
     respond: (assistantMessageExtId, answer) => respondToAgent(this.requireClient(), assistantMessageExtId, answer),
+    /** The skills the caller can run (own + shared marketplace), metadata only. */
+    listSkills: (options) => listSkills(this.requireClient(), options),
     /**
      * Search documents without LLM generation (retrieval only).
      */
@@ -6629,8 +6788,10 @@ var Arbi = class {
     list: (options) => listFiles(this.requireClient(), options),
     get: (fileId) => getFile(this.requireClient(), fileId),
     delete: (fileId) => deleteFile(this.requireClient(), fileId),
-    upload: (fileData, fileName, purpose) => uploadFile2(this.getAuthHeaders(), fileData, fileName, purpose),
-    getContent: (fileId) => getFileContent(this.getAuthHeaders(), fileId)
+    upload: (fileData, fileName, purpose) => this.recovering(
+      () => uploadFile2(this.getAuthHeaders(), fileData, fileName, purpose)
+    ),
+    getContent: (fileId) => this.recovering(() => getFileContent(this.getAuthHeaders(), fileId))
   };
   // ── Agents ──────────────────────────────────────────────────────────
   agents = {
@@ -6638,7 +6799,28 @@ var Arbi = class {
     create: (name) => createAgent(this.requireClient(), name),
     getConfig: (agentExtId) => getAgentConfig(this.requireClient(), agentExtId),
     listWorkspaces: (agentExtId) => listAgentWorkspaces(this.requireClient(), agentExtId),
-    delete: (agentExtIds) => deleteAgents(this.requireClient(), agentExtIds)
+    delete: (agentExtIds) => deleteAgents(this.requireClient(), agentExtIds),
+    /** Mint a TTL'd run session for an agent; see `grantTemporaryAccess` to also deposit a key. */
+    authorize: (agentExtId, workspaceId, ttlSeconds) => authorizeAgent(this.requireClient(), agentExtId, workspaceId, ttlSeconds),
+    authorizeLimits: () => getAuthorizeLimits(this.requireClient()),
+    /**
+     * Give an agent temporary, session-scoped access to a workspace: mint its run session, then
+     * deposit the workspace key on it. Returns the session details (`ttl` in seconds).
+     */
+    grantTemporaryAccess: async (agentExtId, workspaceId, ttlSeconds) => {
+      const session = await authorizeAgent(
+        this.requireClient(),
+        agentExtId,
+        workspaceId,
+        ttlSeconds
+      );
+      await this.workspaces.grantTemporaryAccess({
+        workspaceId,
+        emails: [session.agent_email],
+        sessionPubkeyB64: session.session_pubkey_b64
+      });
+      return session;
+    }
   };
   // ── Scheduled tasks ───────────────────────────────────────────────────
   tasks = {
@@ -6647,7 +6829,26 @@ var Arbi = class {
     get: (taskId) => getTask(this.requireClient(), taskId),
     update: (taskId, body) => updateTask(this.requireClient(), taskId, body),
     delete: (taskId) => deleteTask(this.requireClient(), taskId),
-    run: (taskId) => runTask(this.requireClient(), taskId)
+    run: (taskId) => runTask(this.requireClient(), taskId),
+    listRuns: (taskId) => listTaskRuns(this.requireClient(), taskId),
+    /**
+     * Run a task and, when the run is parked waiting for workspace access (a temporary
+     * authorization tier), grant the agent's run session a temporary key and run it again.
+     * A task that needs no approval returns from the first call already running.
+     */
+    runWithAuth: async (taskId) => {
+      const client = this.requireClient();
+      const first = await runTask(client, taskId);
+      if (!first.pending_auth_request_id || !first.pending_auth_session_pubkey || !first.pending_auth_agent_email || !first.workspace_ext_id) {
+        return first;
+      }
+      await this.workspaces.grantTemporaryAccess({
+        workspaceId: first.workspace_ext_id,
+        emails: [first.pending_auth_agent_email],
+        sessionPubkeyB64: first.pending_auth_session_pubkey
+      });
+      return runTask(client, taskId);
+    }
   };
   // ── Workspace facts ─────────────────────────────────────────────────
   facts = {
@@ -7812,6 +8013,6 @@ async function startDmListener(options) {
   };
 }
 
-export { Arbi, ArbiApiError, ArbiError, ClaudeOrchestrator, DOC_TERMINAL_STATUSES, FileConfigStore, OpenClawOrchestrator, WebSocketAuthError, agentconfig_exports as agentconfig, agents_exports as agents, assistant_exports as assistant, authenticatedFetch, buildDocNameMap, buildRetrievalChunkTool, buildRetrievalFullContextTool, buildRetrievalTocTool, connectWebSocket, connectWithReconnect, consumeSSEStream, contacts_exports as contacts, conversations_exports as conversations, countCitations, createAuthenticatedClient, createDocumentWaiter, device_flow_exports as deviceFlow, dm_exports as dm, doctags_exports as doctags, documents_exports as documents, documents_node_exports as documentsNode, facts_exports as facts, files_exports as files, filterSkills, formatAgentStepLabel, formatFileSize, formatItemLabel, formatStreamSummary, formatUserName, formatWorkspaceChoices, formatWsMessage, generateEncryptedWorkspaceKey, generateNewWorkspaceKey, getErrorCode, getErrorMessage, getRawWorkspaceKey, health_exports as health, listen_exports as listen, parseSSEEvents, parseSlashCommand, parseSlashTokenInProgress, performPasswordLogin, performSigningKeyLogin, performSsoDeviceFlowLogin, profile_exports as profile, projects_exports as projects, requireData, requireOk, resolveAuth, resolveCitations, resolveWorkspace, responses_exports as responses, selectWorkspace, selectWorkspaceById, sessions_exports as sessions, settings_exports as settings, startDmListener, streamSSE, stripCitationMarkdown, summarizeCitations, tags_exports as tags, tasks_exports as tasks, workspaces_exports as workspaces };
+export { Arbi, ArbiApiError, ArbiError, ArbiSessionExpiredError, ClaudeOrchestrator, DOC_TERMINAL_STATUSES, FileConfigStore, OpenClawOrchestrator, WebSocketAuthError, agentconfig_exports as agentconfig, agents_exports as agents, assistant_exports as assistant, authenticatedFetch, buildDocNameMap, buildRetrievalChunkTool, buildRetrievalFullContextTool, buildRetrievalTocTool, connectWebSocket, connectWithReconnect, consumeSSEStream, contacts_exports as contacts, conversations_exports as conversations, countCitations, createAuthenticatedClient, createDocumentWaiter, device_flow_exports as deviceFlow, dm_exports as dm, doctags_exports as doctags, documents_exports as documents, documents_node_exports as documentsNode, facts_exports as facts, files_exports as files, filterSkills, formatAgentStepLabel, formatFileSize, formatItemLabel, formatStreamSummary, formatUserName, formatWorkspaceChoices, formatWsMessage, generateEncryptedWorkspaceKey, generateNewWorkspaceKey, getErrorCode, getErrorMessage, getRawWorkspaceKey, health_exports as health, listen_exports as listen, parseSSEEvents, parseSlashCommand, parseSlashTokenInProgress, performPasswordLogin, performSigningKeyLogin, performSsoDeviceFlowLogin, profile_exports as profile, projects_exports as projects, requireData, requireOk, resolveAuth, resolveCitations, resolveWorkspace, responses_exports as responses, selectWorkspace, selectWorkspaceById, sessions_exports as sessions, settings_exports as settings, startDmListener, streamSSE, stripCitationMarkdown, summarizeCitations, tags_exports as tags, tasks_exports as tasks, workspaces_exports as workspaces };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map