@arbidocs/sdk 0.4.3 → 0.4.4

package/dist/index.cjs

@@ -5225,6 +5225,7 @@ __export(workspaces_exports, {
   copyDocuments: () => copyDocuments,
   createWorkspace: () => createWorkspace,
   deleteWorkspaces: () => deleteWorkspaces,
+  grantTemporaryWorkspaceAccess: () => grantTemporaryWorkspaceAccess,
   listWorkspaceUsers: () => listWorkspaceUsers,
   listWorkspaces: () => listWorkspaces,
   removeWorkspaceUsers: () => removeWorkspaceUsers,
@@ -5265,14 +5266,33 @@ async function updateWorkspace(arbi, body) {
 async function listWorkspaceUsers(arbi) {
   return requireData(await arbi.fetch.GET("/v1/workspace/users"), "Failed to fetch workspace users");
 }
-async function addWorkspaceUsers(arbi, emails, role = "collaborator") {
+async function addWorkspaceUsers(arbi, emails, role = "collaborator", target) {
   return requireData(
     await arbi.fetch.POST("/v1/workspace/users", {
-      body: { emails, role }
+      body: target ? {
+        emails,
+        role,
+        workspace_ext_id: target.workspaceExtId,
+        workspace_key: target.workspaceKey
+      } : { emails, role }
     }),
     "Failed to add users"
   );
 }
+async function grantTemporaryWorkspaceAccess(arbi, params) {
+  return requireData(
+    await arbi.fetch.POST("/v1/workspace/users", {
+      body: {
+        emails: params.emails,
+        role: params.role ?? "collaborator",
+        workspace_ext_id: params.workspaceExtId,
+        workspace_key: params.workspaceKey,
+        session_pubkey_b64: params.sessionPubkeyB64
+      }
+    }),
+    "Failed to grant temporary access"
+  );
+}
 async function removeWorkspaceUsers(arbi, userIds) {
   requireOk(
     await arbi.fetch.DELETE("/v1/workspace/users", {
@@ -5668,9 +5688,11 @@ __export(dm_exports, {
 // src/operations/agents.ts
 var agents_exports = {};
 __export(agents_exports, {
+  authorizeAgent: () => authorizeAgent,
   createAgent: () => createAgent,
   deleteAgents: () => deleteAgents,
   getAgentConfig: () => getAgentConfig,
+  getAuthorizeLimits: () => getAuthorizeLimits,
   listAgentWorkspaces: () => listAgentWorkspaces,
   listAgents: () => listAgents
 });
@@ -5705,6 +5727,21 @@ async function deleteAgents(arbi, agentExtIds) {
     "Failed to delete agents"
   );
 }
+async function authorizeAgent(arbi, agentExtId, workspaceExtId, ttlSeconds) {
+  return requireData(
+    await arbi.fetch.POST("/v1/agents/{agent_ext_id}/authorize", {
+      params: { path: { agent_ext_id: agentExtId } },
+      body: { workspace_ext_id: workspaceExtId, ttl_seconds: ttlSeconds ?? null }
+    }),
+    "Failed to authorize agent"
+  );
+}
+async function getAuthorizeLimits(arbi) {
+  return requireData(
+    await arbi.fetch.GET("/v1/agents/authorize-limits"),
+    "Failed to fetch authorize limits"
+  );
+}
 
 // src/operations/dm.ts
 function createDmCryptoContext(arbi, signingPrivateKeyBytes, userExtId) {
@@ -6091,6 +6128,7 @@ __export(tasks_exports, {
   createTask: () => createTask,
   deleteTask: () => deleteTask,
   getTask: () => getTask,
+  listTaskRuns: () => listTaskRuns,
   listTasks: () => listTasks,
   runTask: () => runTask,
   updateTask: () => updateTask
@@ -6128,6 +6166,12 @@ async function runTask(arbi, taskId) {
     "Failed to run task"
   );
 }
+async function listTaskRuns(arbi, taskId) {
+  return requireData(
+    await arbi.fetch.GET("/v1/tasks/{task_id}/runs", { params: { path: { task_id: taskId } } }),
+    "Failed to list task runs"
+  );
+}
 
 // src/operations/facts.ts
 var facts_exports = {};
@@ -6269,6 +6313,22 @@ var Arbi = class {
     const signingPrivateKey = client.crypto.base64ToBytes(signingPrivateKeyBase64);
     this.loginResult = await client.auth.loginWithKey({ email, signingPrivateKey });
   }
+  /** A workspace's key, sealed to the caller's own session (what `/open` and `POST /workspace/users` take). */
+  async sealWorkspaceKey(workspaceId) {
+    const client = this.requireClient();
+    const lr2 = this.requireLogin();
+    const all = await listWorkspaces(client);
+    const ws = all.find((w2) => w2.external_id === workspaceId);
+    if (!ws || !ws.wrapped_key) {
+      throw new ArbiError(`Workspace ${workspaceId} not found or has no encryption key`);
+    }
+    return generateEncryptedWorkspaceKey(
+      client,
+      ws.wrapped_key,
+      lr2.serverSessionKey,
+      client.crypto.bytesToBase64(lr2.signingPrivateKey)
+    );
+  }
   /**
    * Select a workspace by ID. Fetches the workspace list, finds the matching
    * workspace, decrypts the wrapped key, and sets up auth headers.
@@ -6451,6 +6511,30 @@ var Arbi = class {
     update: (body) => updateWorkspace(this.requireClient(), body),
     listUsers: () => listWorkspaceUsers(this.requireClient()),
     addUsers: (emails, role) => addWorkspaceUsers(this.requireClient(), emails, role),
+    /**
+     * Grant users a temporary key scoped to ONE session (identified by its public key), for
+     * example an agent's run session minted by `agents.authorize()`. Nothing standing is created:
+     * the grant expires with that session. Works for any workspace the caller holds a key for;
+     * it does not need to be the open one.
+     */
+    grantTemporaryAccess: async (params) => {
+      const client = this.requireClient();
+      return grantTemporaryWorkspaceAccess(client, {
+        emails: params.emails,
+        workspaceExtId: params.workspaceId,
+        workspaceKey: await this.sealWorkspaceKey(params.workspaceId),
+        sessionPubkeyB64: params.sessionPubkeyB64,
+        role: params.role
+      });
+    },
+    /**
+     * Add users (standing, permanent membership) to ANY workspace the caller holds a key for,
+     * without opening it. `addUsers` does the same for the currently open workspace.
+     */
+    grantAccess: async (params) => addWorkspaceUsers(this.requireClient(), params.emails, params.role, {
+      workspaceExtId: params.workspaceId,
+      workspaceKey: await this.sealWorkspaceKey(params.workspaceId)
+    }),
     removeUsers: (userIds) => removeWorkspaceUsers(this.requireClient(), userIds),
     setUserRole: (userIds, role) => setUserRole(this.requireClient(), userIds, role),
     /**
@@ -6566,6 +6650,8 @@ var Arbi = class {
      * Respond to an agent's question during a human-in-the-loop workflow.
      */
     respond: (assistantMessageExtId, answer) => respondToAgent(this.requireClient(), assistantMessageExtId, answer),
+    /** The skills the caller can run (own + shared marketplace), metadata only. */
+    listSkills: (options) => listSkills(this.requireClient(), options),
     /**
      * Search documents without LLM generation (retrieval only).
      */
@@ -6722,7 +6808,28 @@ var Arbi = class {
     create: (name) => createAgent(this.requireClient(), name),
     getConfig: (agentExtId) => getAgentConfig(this.requireClient(), agentExtId),
     listWorkspaces: (agentExtId) => listAgentWorkspaces(this.requireClient(), agentExtId),
-    delete: (agentExtIds) => deleteAgents(this.requireClient(), agentExtIds)
+    delete: (agentExtIds) => deleteAgents(this.requireClient(), agentExtIds),
+    /** Mint a TTL'd run session for an agent; see `grantTemporaryAccess` to also deposit a key. */
+    authorize: (agentExtId, workspaceId, ttlSeconds) => authorizeAgent(this.requireClient(), agentExtId, workspaceId, ttlSeconds),
+    authorizeLimits: () => getAuthorizeLimits(this.requireClient()),
+    /**
+     * Give an agent temporary, session-scoped access to a workspace: mint its run session, then
+     * deposit the workspace key on it. Returns the session details (`ttl` in seconds).
+     */
+    grantTemporaryAccess: async (agentExtId, workspaceId, ttlSeconds) => {
+      const session = await authorizeAgent(
+        this.requireClient(),
+        agentExtId,
+        workspaceId,
+        ttlSeconds
+      );
+      await this.workspaces.grantTemporaryAccess({
+        workspaceId,
+        emails: [session.agent_email],
+        sessionPubkeyB64: session.session_pubkey_b64
+      });
+      return session;
+    }
   };
   // ── Scheduled tasks ───────────────────────────────────────────────────
   tasks = {
@@ -6731,7 +6838,26 @@ var Arbi = class {
     get: (taskId) => getTask(this.requireClient(), taskId),
     update: (taskId, body) => updateTask(this.requireClient(), taskId, body),
     delete: (taskId) => deleteTask(this.requireClient(), taskId),
-    run: (taskId) => runTask(this.requireClient(), taskId)
+    run: (taskId) => runTask(this.requireClient(), taskId),
+    listRuns: (taskId) => listTaskRuns(this.requireClient(), taskId),
+    /**
+     * Run a task and, when the run is parked waiting for workspace access (a temporary
+     * authorization tier), grant the agent's run session a temporary key and run it again.
+     * A task that needs no approval returns from the first call already running.
+     */
+    runWithAuth: async (taskId) => {
+      const client = this.requireClient();
+      const first = await runTask(client, taskId);
+      if (!first.pending_auth_request_id || !first.pending_auth_session_pubkey || !first.pending_auth_agent_email || !first.workspace_ext_id) {
+        return first;
+      }
+      await this.workspaces.grantTemporaryAccess({
+        workspaceId: first.workspace_ext_id,
+        emails: [first.pending_auth_agent_email],
+        sessionPubkeyB64: first.pending_auth_session_pubkey
+      });
+      return runTask(client, taskId);
+    }
   };
   // ── Workspace facts ─────────────────────────────────────────────────
   facts = {