@arbidocs/client 0.4.1 → 0.4.3

package/dist/index.d.cts

@@ -11765,6 +11765,13 @@ interface components {
             email_notifications?: components['schemas']['EmailNotificationSettings'];
             /** Premium Model */
             premium_model?: string | null;
+            /**
+             * Retired Premium Model
+             * @description One-shot notice: set only on the response that cleared a stored premium_model which is no longer an available Premium model. Never persisted; the choice is already cleared.
+             */
+            retired_premium_model?: string | null;
+            /** Retired Premium Model Suggestion */
+            retired_premium_model_suggestion?: string | null;
             /** Picture */
             picture?: string | null;
             /** Extra Discount */
@@ -17192,6 +17199,13 @@ interface AutoReloginMiddlewareConfig {
     reloginHandler: ReloginHandler;
     /** URL substrings that should never trigger re-login (e.g. the login endpoint itself) */
     reloginExcludePatterns?: string[];
+    /**
+     * Re-open the selected workspace on the server session without a new login. Resolves true when
+     * done. Used on 400 "No active workspace" (the server lost the open-workspace state while the
+     * token is still valid); when it is absent or returns false, a full re-login (which also
+     * re-opens the workspace) is tried instead.
+     */
+    reopenWorkspaceHandler?: () => Promise<boolean>;
     onRetryCloneFailed?: () => void;
     /** Called when re-login was attempted but failed (returned null). Use to clear stale auth state. */
     onReloginFailed?: () => void;
@@ -17808,6 +17822,13 @@ interface ArbiClientOptions {
         userExtId?: string;
         serverSessionKey: Uint8Array;
     }) => void;
+    /**
+     * Called when the session cannot be recovered: a request failed with 401 (or 400 "No active
+     * workspace") and neither a workspace re-open nor a silent re-login worked because the server
+     * REFUSED it (not a network failure, which leaves the session alone). The host shows "your
+     * session expired, sign in again". Not called before anyone has logged in.
+     */
+    onSessionExpired?: () => void;
     /**
      * Optional session storage provider for the relogin handler.
      *
@@ -17837,8 +17858,10 @@ interface ArbiClient {
         loginWithKey(params: LoginWithKeyParams): Promise<LoginResult>;
         logout(): Promise<void>;
         changePassword(params: ChangePasswordParams): Promise<ChangePasswordResult>;
-        /** Instant re-login using stored private key */
+        /** Instant re-login using stored private key (re-opens the selected workspace too) */
         relogin(): Promise<string | null>;
+        /** Re-open the selected workspace on the server session, without a new login */
+        reopenWorkspace(): Promise<boolean>;
     };
     /** Crypto utilities */
     crypto: {
@@ -17960,4 +17983,29 @@ declare function isMessageType<T extends WebSocketServerMessage>(msg: WebSocketS
  */
 declare function createReloginHandler(deps: ReloginDeps): () => Promise<string | null>;
 
-export { type $defs, API_PREFIX, type ArbiClient, type ArbiClientOptions, type AuthStateProvider, type AutoReloginMiddlewareConfig, type BearerAuthMiddlewareConfig, type ChangePasswordParams, type ChangePasswordRequest, type ChangePasswordResult, type CryptoProvider, type KeyPair, type LoginCredentials, type LoginParams, type LoginProvider, type LoginRequest, type LoginResult, type LoginWithKeyParams, type OnReloginSuccess, type PasswordChangeCredentials, type RegisterParams, type RegisterRequest, type RegisterResult, type RegistrationCredentials, type ReloginDeps, type ReloginHandler, type SessionData, type SessionKeys, type SessionManager, type SessionState, type SessionStorageProvider, type SsoTokenProvider, type TokenProvider, type UserKeypairs, type WebSocketClientMessage, type WebSocketServerMessage, type WorkspaceKeyRefreshProvider, type WorkspaceOpenProvider, type WsAuthMessage, type WsAuthResultMessage, type WsBatchCompleteMessage, type WsConnectionClosedMessage, type WsErrorMessage, type WsNotificationResponse, type WsPresenceUpdateMessage, type WsResponseCompleteMessage, type WsTaskUpdateMessage, base64Decode, base64Encode, base64ToBytes, buildWebSocketUrl, bytesToBase64, clearAllData, clearSession, type components, computeSharedSecret, createArbiClient, createAuthMessage, createAutoReloginMiddleware, createBearerAuthMiddleware, createContentHash, createReloginHandler, createSessionManager, decryptFile, decryptMessage, decryptMessageWithSharedSecret, deriveEncryptionKeypairFromSigning, derivePublicKey, encryptFile, encryptMessage, encryptMessageWithSharedSecret, generateKeyPairs, generateLoginCredentials, generateLoginCredentialsFromKey, generatePasswordChangeCredentials, generateRandomSigningKeypair, generateRecoveryPasswordChangeCredentials, generateRegistrationCredentials, generateUserKeypairs, getSession, getUserEncryptionKeypair, hasSession, initSodium, initializeDatabase, isMessageType, type operations, parseServerMessage, type paths, prewarmKeyPairs, saveSession, sealKeyForSession, sealedBoxDecrypt, sealedBoxEncrypt, signMessage, updateSigningPrivateKey, type webhooks };
+/**
+ * Workspace re-open (no re-login)
+ *
+ * The server keeps "which workspace is open, and its key sealed for this session" on the session.
+ * When that state is gone while the access token is still valid (a server restart, a rotated
+ * session, an expired workspace session), requests fail with 400 "No active workspace - call
+ * /open first". Re-opening needs no new login: unwrap the workspace key with the stored signing
+ * key, seal it for the stored server session key, POST /open.
+ */
+
+interface ReopenDeps {
+    crypto: Pick<CryptoProvider, 'ensureReady' | 'deriveEncryptionKeypair' | 'sealedBoxDecrypt' | 'sealKeyForSession'>;
+    sessionStorage: SessionStorageProvider;
+    authState: Pick<AuthStateProvider, 'getSelectedWorkspaceId'>;
+    getAccessToken(): string | null;
+    workspaceKeyRefreshProvider: WorkspaceKeyRefreshProvider;
+    workspaceOpenProvider: WorkspaceOpenProvider;
+}
+/**
+ * Returns `reopenWorkspace()`: resolves true when the selected workspace is open again on the
+ * server session, false when it cannot be (nothing selected, no stored keys, server refused).
+ * Concurrent calls share one in-flight attempt.
+ */
+declare function createWorkspaceReopener(deps: ReopenDeps): () => Promise<boolean>;
+
+export { type $defs, API_PREFIX, type ArbiClient, type ArbiClientOptions, type AuthStateProvider, type AutoReloginMiddlewareConfig, type BearerAuthMiddlewareConfig, type ChangePasswordParams, type ChangePasswordRequest, type ChangePasswordResult, type CryptoProvider, type KeyPair, type LoginCredentials, type LoginParams, type LoginProvider, type LoginRequest, type LoginResult, type LoginWithKeyParams, type OnReloginSuccess, type PasswordChangeCredentials, type RegisterParams, type RegisterRequest, type RegisterResult, type RegistrationCredentials, type ReloginDeps, type ReloginHandler, type ReopenDeps, type SessionData, type SessionKeys, type SessionManager, type SessionState, type SessionStorageProvider, type SsoTokenProvider, type TokenProvider, type UserKeypairs, type WebSocketClientMessage, type WebSocketServerMessage, type WorkspaceKeyRefreshProvider, type WorkspaceOpenProvider, type WsAuthMessage, type WsAuthResultMessage, type WsBatchCompleteMessage, type WsConnectionClosedMessage, type WsErrorMessage, type WsNotificationResponse, type WsPresenceUpdateMessage, type WsResponseCompleteMessage, type WsTaskUpdateMessage, base64Decode, base64Encode, base64ToBytes, buildWebSocketUrl, bytesToBase64, clearAllData, clearSession, type components, computeSharedSecret, createArbiClient, createAuthMessage, createAutoReloginMiddleware, createBearerAuthMiddleware, createContentHash, createReloginHandler, createSessionManager, createWorkspaceReopener, decryptFile, decryptMessage, decryptMessageWithSharedSecret, deriveEncryptionKeypairFromSigning, derivePublicKey, encryptFile, encryptMessage, encryptMessageWithSharedSecret, generateKeyPairs, generateLoginCredentials, generateLoginCredentialsFromKey, generatePasswordChangeCredentials, generateRandomSigningKeypair, generateRecoveryPasswordChangeCredentials, generateRegistrationCredentials, generateUserKeypairs, getSession, getUserEncryptionKeypair, hasSession, initSodium, initializeDatabase, isMessageType, type operations, parseServerMessage, type paths, prewarmKeyPairs, saveSession, sealKeyForSession, sealedBoxDecrypt, sealedBoxEncrypt, signMessage, updateSigningPrivateKey, type webhooks };

package/dist/index.d.ts

@@ -11765,6 +11765,13 @@ interface components {
             email_notifications?: components['schemas']['EmailNotificationSettings'];
             /** Premium Model */
             premium_model?: string | null;
+            /**
+             * Retired Premium Model
+             * @description One-shot notice: set only on the response that cleared a stored premium_model which is no longer an available Premium model. Never persisted; the choice is already cleared.
+             */
+            retired_premium_model?: string | null;
+            /** Retired Premium Model Suggestion */
+            retired_premium_model_suggestion?: string | null;
             /** Picture */
             picture?: string | null;
             /** Extra Discount */
@@ -17192,6 +17199,13 @@ interface AutoReloginMiddlewareConfig {
     reloginHandler: ReloginHandler;
     /** URL substrings that should never trigger re-login (e.g. the login endpoint itself) */
     reloginExcludePatterns?: string[];
+    /**
+     * Re-open the selected workspace on the server session without a new login. Resolves true when
+     * done. Used on 400 "No active workspace" (the server lost the open-workspace state while the
+     * token is still valid); when it is absent or returns false, a full re-login (which also
+     * re-opens the workspace) is tried instead.
+     */
+    reopenWorkspaceHandler?: () => Promise<boolean>;
     onRetryCloneFailed?: () => void;
     /** Called when re-login was attempted but failed (returned null). Use to clear stale auth state. */
     onReloginFailed?: () => void;
@@ -17808,6 +17822,13 @@ interface ArbiClientOptions {
         userExtId?: string;
         serverSessionKey: Uint8Array;
     }) => void;
+    /**
+     * Called when the session cannot be recovered: a request failed with 401 (or 400 "No active
+     * workspace") and neither a workspace re-open nor a silent re-login worked because the server
+     * REFUSED it (not a network failure, which leaves the session alone). The host shows "your
+     * session expired, sign in again". Not called before anyone has logged in.
+     */
+    onSessionExpired?: () => void;
     /**
      * Optional session storage provider for the relogin handler.
      *
@@ -17837,8 +17858,10 @@ interface ArbiClient {
         loginWithKey(params: LoginWithKeyParams): Promise<LoginResult>;
         logout(): Promise<void>;
         changePassword(params: ChangePasswordParams): Promise<ChangePasswordResult>;
-        /** Instant re-login using stored private key */
+        /** Instant re-login using stored private key (re-opens the selected workspace too) */
         relogin(): Promise<string | null>;
+        /** Re-open the selected workspace on the server session, without a new login */
+        reopenWorkspace(): Promise<boolean>;
     };
     /** Crypto utilities */
     crypto: {
@@ -17960,4 +17983,29 @@ declare function isMessageType<T extends WebSocketServerMessage>(msg: WebSocketS
  */
 declare function createReloginHandler(deps: ReloginDeps): () => Promise<string | null>;
 
-export { type $defs, API_PREFIX, type ArbiClient, type ArbiClientOptions, type AuthStateProvider, type AutoReloginMiddlewareConfig, type BearerAuthMiddlewareConfig, type ChangePasswordParams, type ChangePasswordRequest, type ChangePasswordResult, type CryptoProvider, type KeyPair, type LoginCredentials, type LoginParams, type LoginProvider, type LoginRequest, type LoginResult, type LoginWithKeyParams, type OnReloginSuccess, type PasswordChangeCredentials, type RegisterParams, type RegisterRequest, type RegisterResult, type RegistrationCredentials, type ReloginDeps, type ReloginHandler, type SessionData, type SessionKeys, type SessionManager, type SessionState, type SessionStorageProvider, type SsoTokenProvider, type TokenProvider, type UserKeypairs, type WebSocketClientMessage, type WebSocketServerMessage, type WorkspaceKeyRefreshProvider, type WorkspaceOpenProvider, type WsAuthMessage, type WsAuthResultMessage, type WsBatchCompleteMessage, type WsConnectionClosedMessage, type WsErrorMessage, type WsNotificationResponse, type WsPresenceUpdateMessage, type WsResponseCompleteMessage, type WsTaskUpdateMessage, base64Decode, base64Encode, base64ToBytes, buildWebSocketUrl, bytesToBase64, clearAllData, clearSession, type components, computeSharedSecret, createArbiClient, createAuthMessage, createAutoReloginMiddleware, createBearerAuthMiddleware, createContentHash, createReloginHandler, createSessionManager, decryptFile, decryptMessage, decryptMessageWithSharedSecret, deriveEncryptionKeypairFromSigning, derivePublicKey, encryptFile, encryptMessage, encryptMessageWithSharedSecret, generateKeyPairs, generateLoginCredentials, generateLoginCredentialsFromKey, generatePasswordChangeCredentials, generateRandomSigningKeypair, generateRecoveryPasswordChangeCredentials, generateRegistrationCredentials, generateUserKeypairs, getSession, getUserEncryptionKeypair, hasSession, initSodium, initializeDatabase, isMessageType, type operations, parseServerMessage, type paths, prewarmKeyPairs, saveSession, sealKeyForSession, sealedBoxDecrypt, sealedBoxEncrypt, signMessage, updateSigningPrivateKey, type webhooks };
+/**
+ * Workspace re-open (no re-login)
+ *
+ * The server keeps "which workspace is open, and its key sealed for this session" on the session.
+ * When that state is gone while the access token is still valid (a server restart, a rotated
+ * session, an expired workspace session), requests fail with 400 "No active workspace - call
+ * /open first". Re-opening needs no new login: unwrap the workspace key with the stored signing
+ * key, seal it for the stored server session key, POST /open.
+ */
+
+interface ReopenDeps {
+    crypto: Pick<CryptoProvider, 'ensureReady' | 'deriveEncryptionKeypair' | 'sealedBoxDecrypt' | 'sealKeyForSession'>;
+    sessionStorage: SessionStorageProvider;
+    authState: Pick<AuthStateProvider, 'getSelectedWorkspaceId'>;
+    getAccessToken(): string | null;
+    workspaceKeyRefreshProvider: WorkspaceKeyRefreshProvider;
+    workspaceOpenProvider: WorkspaceOpenProvider;
+}
+/**
+ * Returns `reopenWorkspace()`: resolves true when the selected workspace is open again on the
+ * server session, false when it cannot be (nothing selected, no stored keys, server refused).
+ * Concurrent calls share one in-flight attempt.
+ */
+declare function createWorkspaceReopener(deps: ReopenDeps): () => Promise<boolean>;
+
+export { type $defs, API_PREFIX, type ArbiClient, type ArbiClientOptions, type AuthStateProvider, type AutoReloginMiddlewareConfig, type BearerAuthMiddlewareConfig, type ChangePasswordParams, type ChangePasswordRequest, type ChangePasswordResult, type CryptoProvider, type KeyPair, type LoginCredentials, type LoginParams, type LoginProvider, type LoginRequest, type LoginResult, type LoginWithKeyParams, type OnReloginSuccess, type PasswordChangeCredentials, type RegisterParams, type RegisterRequest, type RegisterResult, type RegistrationCredentials, type ReloginDeps, type ReloginHandler, type ReopenDeps, type SessionData, type SessionKeys, type SessionManager, type SessionState, type SessionStorageProvider, type SsoTokenProvider, type TokenProvider, type UserKeypairs, type WebSocketClientMessage, type WebSocketServerMessage, type WorkspaceKeyRefreshProvider, type WorkspaceOpenProvider, type WsAuthMessage, type WsAuthResultMessage, type WsBatchCompleteMessage, type WsConnectionClosedMessage, type WsErrorMessage, type WsNotificationResponse, type WsPresenceUpdateMessage, type WsResponseCompleteMessage, type WsTaskUpdateMessage, base64Decode, base64Encode, base64ToBytes, buildWebSocketUrl, bytesToBase64, clearAllData, clearSession, type components, computeSharedSecret, createArbiClient, createAuthMessage, createAutoReloginMiddleware, createBearerAuthMiddleware, createContentHash, createReloginHandler, createSessionManager, createWorkspaceReopener, decryptFile, decryptMessage, decryptMessageWithSharedSecret, deriveEncryptionKeypairFromSigning, derivePublicKey, encryptFile, encryptMessage, encryptMessageWithSharedSecret, generateKeyPairs, generateLoginCredentials, generateLoginCredentialsFromKey, generatePasswordChangeCredentials, generateRandomSigningKeypair, generateRecoveryPasswordChangeCredentials, generateRegistrationCredentials, generateUserKeypairs, getSession, getUserEncryptionKeypair, hasSession, initSodium, initializeDatabase, isMessageType, type operations, parseServerMessage, type paths, prewarmKeyPairs, saveSession, sealKeyForSession, sealedBoxDecrypt, sealedBoxEncrypt, signMessage, updateSigningPrivateKey, type webhooks };

package/dist/index.js

@@ -385,6 +385,21 @@ function createBearerAuthMiddleware(config) {
 }
 
 // src/middleware/auto-relogin.ts
+var NO_ACTIVE_WORKSPACE = /no active workspace/i;
+async function isNoActiveWorkspace(response) {
+  try {
+    return NO_ACTIVE_WORKSPACE.test(await response.clone().text());
+  } catch {
+    return false;
+  }
+}
+function safeClone(request) {
+  try {
+    return request.clone();
+  } catch {
+    return null;
+  }
+}
 function createAutoReloginMiddleware(config) {
   const cloneCache = /* @__PURE__ */ new WeakMap();
   return {
@@ -395,6 +410,25 @@ function createAutoReloginMiddleware(config) {
       }
     },
     async onResponse({ response, request }) {
+      if (response.status === 400 && await isNoActiveWorkspace(response)) {
+        let token = null;
+        let recovered = await config.reopenWorkspaceHandler?.() ?? false;
+        if (!recovered) {
+          token = await config.reloginHandler();
+          recovered = token !== null;
+        }
+        if (!recovered) {
+          config.onReloginFailed?.();
+          return response;
+        }
+        const retry = cloneCache.get(request) ?? safeClone(request);
+        if (retry) {
+          if (token) retry.headers.set("Authorization", `Bearer ${token}`);
+          return fetch(retry);
+        }
+        config.onRetryCloneFailed?.();
+        return response;
+      }
       if (response.status === 400) {
         const isSafeMethod = ["GET", "HEAD", "DELETE"].includes(request.method);
         if (isSafeMethod) {
@@ -555,6 +589,47 @@ function createReloginHandler(deps) {
   };
 }
 
+// src/relogin/reopen.ts
+function createWorkspaceReopener(deps) {
+  let inFlight = null;
+  return function reopenWorkspace() {
+    if (inFlight) return inFlight;
+    inFlight = (async () => {
+      try {
+        const workspaceId = deps.authState.getSelectedWorkspaceId();
+        const accessToken = deps.getAccessToken();
+        if (!workspaceId || !accessToken) return false;
+        const session = await deps.sessionStorage.getSession();
+        if (!session?.signingPrivateKey || !session.serverSessionKey) return false;
+        await deps.crypto.ensureReady();
+        const wrappedKey = await deps.workspaceKeyRefreshProvider.getWrappedKey(
+          accessToken,
+          workspaceId
+        );
+        if (!wrappedKey) return false;
+        const encryptionKeyPair = deps.crypto.deriveEncryptionKeypair({
+          publicKey: session.signingPrivateKey.slice(32, 64),
+          secretKey: session.signingPrivateKey
+        });
+        const workspaceKey = deps.crypto.sealedBoxDecrypt(wrappedKey, encryptionKeyPair.secretKey);
+        const sealed = await deps.crypto.sealKeyForSession(workspaceKey, session.serverSessionKey);
+        const opened = await deps.workspaceOpenProvider.openWorkspace(
+          accessToken,
+          workspaceId,
+          sealed
+        );
+        return opened === true;
+      } catch (error) {
+        console.error("[API] Failed to re-open workspace:", error);
+        return false;
+      } finally {
+        inFlight = null;
+      }
+    })();
+    return inFlight;
+  };
+}
+
 // src/storage/indexed-db.ts
 var DB_NAME = "arbi-crypto";
 var DB_VERSION = 2;
@@ -1002,6 +1077,7 @@ function createArbiClient(options) {
     credentials = "include",
     ssoTokenProvider = null,
     onReloginSuccess,
+    onSessionExpired,
     sessionStorage: sessionStorageOverride,
     userEmail
   } = options;
@@ -1022,6 +1098,7 @@ function createArbiClient(options) {
     sealKeyForSession,
     fromBase64: base64ToBytes
   };
+  let reloginUnreachable = false;
   const loginProvider = {
     async login(payload) {
       const rawFetch = createFetchClient({
@@ -1029,14 +1106,21 @@ function createArbiClient(options) {
         credentials,
         fetch: retryFetch
       });
-      const response = await rawFetch.POST("/v1/user/login", {
-        body: {
-          email: payload.email,
-          signature: payload.signature,
-          timestamp: payload.timestamp,
-          sso_token: payload.ssoToken
-        }
-      });
+      let response;
+      try {
+        response = await rawFetch.POST("/v1/user/login", {
+          body: {
+            email: payload.email,
+            signature: payload.signature,
+            timestamp: payload.timestamp,
+            sso_token: payload.ssoToken
+          }
+        });
+      } catch (error) {
+        console.warn("[API] Login call unreachable:", error);
+        reloginUnreachable = true;
+        return null;
+      }
       if (response.error || !response.data) {
         console.warn("[API] Login call failed:", response.error);
         return null;
@@ -1067,15 +1151,46 @@ function createArbiClient(options) {
       return workspace?.wrapped_key ?? null;
     }
   };
-  const reloginHandler = createReloginHandler({
+  const workspaceOpenProvider = {
+    async openWorkspace(accessToken, workspaceId, encryptedWorkspaceKey) {
+      try {
+        const response = await retryFetch(`${baseUrl}${API_PREFIX}/workspace/${workspaceId}/open`, {
+          method: "POST",
+          headers: {
+            Authorization: `Bearer ${accessToken}`,
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify({ workspace_key: encryptedWorkspaceKey }),
+          credentials
+        });
+        return response.ok ? true : null;
+      } catch {
+        return null;
+      }
+    }
+  };
+  const rawReloginHandler = createReloginHandler({
     crypto: cryptoProvider,
     sessionStorage,
     authState,
     ssoTokenProvider,
     loginProvider,
     workspaceKeyRefreshProvider,
+    workspaceOpenProvider,
     onReloginSuccess
   });
+  const reloginHandler = () => {
+    reloginUnreachable = false;
+    return rawReloginHandler();
+  };
+  const reopenWorkspace = createWorkspaceReopener({
+    crypto: cryptoProvider,
+    sessionStorage,
+    authState,
+    getAccessToken: () => session.getState().accessToken,
+    workspaceKeyRefreshProvider,
+    workspaceOpenProvider
+  });
   const fetchClient = createFetchClient({
     baseUrl,
     credentials,
@@ -1085,7 +1200,11 @@ function createArbiClient(options) {
   fetchClient.use(
     createAutoReloginMiddleware({
       reloginHandler,
-      reloginExcludePatterns
+      reloginExcludePatterns,
+      reopenWorkspaceHandler: reopenWorkspace,
+      onReloginFailed: () => {
+        if (!reloginUnreachable && session.getState().userEmail) onSessionExpired?.();
+      }
     })
   );
   const authDeps = {
@@ -1102,7 +1221,8 @@ function createArbiClient(options) {
       loginWithKey: (params) => loginWithKey(params, authDeps),
       logout: () => logout(session),
       changePassword: (params) => changePassword(params, authDeps),
-      relogin: reloginHandler
+      relogin: reloginHandler,
+      reopenWorkspace
     },
     crypto: {
       initSodium,
@@ -1156,6 +1276,6 @@ function isMessageType(msg, type) {
   return msg.type === type;
 }
 
-export { API_PREFIX, base64Decode, base64Encode, base64ToBytes, buildWebSocketUrl, bytesToBase64, clearAllData, clearSession, computeSharedSecret, createArbiClient, createAuthMessage, createAutoReloginMiddleware, createBearerAuthMiddleware, createContentHash, createReloginHandler, createSessionManager, decryptFile, decryptMessage, decryptMessageWithSharedSecret, deriveEncryptionKeypairFromSigning, derivePublicKey, encryptFile, encryptMessage, encryptMessageWithSharedSecret, generateKeyPairs, generateLoginCredentials, generateLoginCredentialsFromKey, generatePasswordChangeCredentials, generateRandomSigningKeypair, generateRecoveryPasswordChangeCredentials, generateRegistrationCredentials, generateUserKeypairs, getSession, getUserEncryptionKeypair, hasSession, initSodium, initializeDatabase, isMessageType, parseServerMessage, prewarmKeyPairs, saveSession, sealKeyForSession, sealedBoxDecrypt, sealedBoxEncrypt, signMessage, updateSigningPrivateKey };
+export { API_PREFIX, base64Decode, base64Encode, base64ToBytes, buildWebSocketUrl, bytesToBase64, clearAllData, clearSession, computeSharedSecret, createArbiClient, createAuthMessage, createAutoReloginMiddleware, createBearerAuthMiddleware, createContentHash, createReloginHandler, createSessionManager, createWorkspaceReopener, decryptFile, decryptMessage, decryptMessageWithSharedSecret, deriveEncryptionKeypairFromSigning, derivePublicKey, encryptFile, encryptMessage, encryptMessageWithSharedSecret, generateKeyPairs, generateLoginCredentials, generateLoginCredentialsFromKey, generatePasswordChangeCredentials, generateRandomSigningKeypair, generateRecoveryPasswordChangeCredentials, generateRegistrationCredentials, generateUserKeypairs, getSession, getUserEncryptionKeypair, hasSession, initSodium, initializeDatabase, isMessageType, parseServerMessage, prewarmKeyPairs, saveSession, sealKeyForSession, sealedBoxDecrypt, sealedBoxEncrypt, signMessage, updateSigningPrivateKey };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map