docs: document POST /v1/tokens/path endpoint (#39)

Co-authored-by: Proactive Runtime Bot <agent@agent-relay.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

Author: 3 people

README.md

@@ -57,8 +57,10 @@ type PathTokenIssueRequest = {
 
 - `POST /v1/tokens/workspace` returns a long-lived `relay_ws_*` workspace token.
 - `POST /v1/tokens/agent` accepts that workspace token via `x-api-key` and returns a short-lived `relay_ag_*` token pair for one `agentId`.
+- `POST /v1/tokens/path` accepts that same workspace token via `x-api-key` and returns a short-lived `relay_pa_*` token pair whose `relayfile:fs:*` scopes are intersected with the requested `paths`.
 - `POST /v1/tokens/refresh` rotates the current pair and preserves the agent-token lineage. Revoking the parent workspace token invalidates all derived agent tokens.
-- `POST /v1/tokens/path` is reserved for M5 path-scoped tokens. In M1 it deliberately returns `501 { error: "path_scoped_tokens_not_implemented", code: "not_implemented" }`.
+
+`paths` uses the same filesystem constraint model as `relayfile:fs:*` scopes: exact paths or trailing-prefix globs such as `/linear/issues/*`. For compatibility, `/linear/issues/**` is normalized to `/linear/issues/*` during issuance.
 
 The TypeScript SDK includes an `AgentTokenSession` helper for transparent agent-token rotation: