@arbidocs/client 0.4.127 → 0.4.129

package/dist/index.cjs

@@ -100,11 +100,17 @@ async function initSodium() {
 function base64ToBytes(base64String) {
   return sodium__default.default.from_base64(base64String, sodium__default.default.base64_variants.ORIGINAL);
 }
-function bytesToBase64(bytes) {
-  return sodium__default.default.to_base64(bytes, sodium__default.default.base64_variants.ORIGINAL);
+function bytesToBase64(bytes2) {
+  return sodium__default.default.to_base64(bytes2, sodium__default.default.base64_variants.ORIGINAL);
 }
-function base64Encode(bytes) {
-  const binString = Array.from(bytes, (byte) => String.fromCodePoint(byte)).join("");
+function bytesToBase64Url(bytes2) {
+  return sodium__default.default.to_base64(bytes2, sodium__default.default.base64_variants.URLSAFE_NO_PADDING);
+}
+function base64UrlToBytes(encoded) {
+  return sodium__default.default.from_base64(encoded, sodium__default.default.base64_variants.URLSAFE_NO_PADDING);
+}
+function base64Encode(bytes2) {
+  const binString = Array.from(bytes2, (byte) => String.fromCodePoint(byte)).join("");
   return btoa(binString);
 }
 function base64Decode(base64) {
@@ -214,6 +220,20 @@ function deriveEncryptionKeypairFromSigning(signingKeyPair) {
     secretKey: encryptionPrivateKey
   };
 }
+function encryptionKeypairFromSigningKey(signingPrivateKey) {
+  return deriveEncryptionKeypairFromSigning({
+    publicKey: signingPrivateKey.slice(32, 64),
+    secretKey: signingPrivateKey
+  });
+}
+function unwrapWorkspaceKey(wrappedKey, signingPrivateKey) {
+  const { secretKey } = encryptionKeypairFromSigningKey(signingPrivateKey);
+  try {
+    return sealedBoxDecrypt(wrappedKey, secretKey);
+  } finally {
+    secretKey.fill(0);
+  }
+}
 function generateRandomSigningKeypair() {
   const kp = sodium__default.default.crypto_sign_keypair();
   return { publicKey: kp.publicKey, secretKey: kp.privateKey };
@@ -309,32 +329,23 @@ async function openSealedCallKey(sealedBase64, encryptionSecretKey) {
 }
 async function encryptCallTitle(title, key) {
   await initSodium();
-  const nonce = sodium__default.default.randombytes_buf(sodium__default.default.crypto_secretbox_NONCEBYTES);
-  const box = sodium__default.default.crypto_secretbox_easy(sodium__default.default.from_string(title), nonce, key);
-  const out = new Uint8Array(nonce.length + box.length);
-  out.set(nonce, 0);
-  out.set(box, nonce.length);
-  return bytesToBase64(out);
+  return bytesToBase64(encryptFile(sodium__default.default.from_string(title), key));
 }
 async function decryptCallTitle(ciphertext, key) {
   await initSodium();
   try {
-    const raw = base64ToBytes(ciphertext);
-    const nonce = raw.slice(0, sodium__default.default.crypto_secretbox_NONCEBYTES);
-    const box = raw.slice(sodium__default.default.crypto_secretbox_NONCEBYTES);
-    return sodium__default.default.to_string(sodium__default.default.crypto_secretbox_open_easy(box, nonce, key));
+    return sodium__default.default.to_string(decryptFile(base64ToBytes(ciphertext), key));
   } catch {
     return null;
   }
 }
 function encodeCallKey(key) {
-  return bytesToBase64(key).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  return bytesToBase64Url(key);
 }
 function decodeCallKey(encoded) {
   if (!/^[A-Za-z0-9_-]+$/.test(encoded)) return null;
-  const b64 = encoded.replace(/-/g, "+").replace(/_/g, "/");
   try {
-    const key = base64ToBytes(b64 + "=".repeat((4 - b64.length % 4) % 4));
+    const key = base64UrlToBytes(encoded);
     return key.length === CALL_KEY_BYTES ? key : null;
   } catch {
     return null;
@@ -373,19 +384,11 @@ async function openSealedChatKey(sealedBase64, mySecretKey) {
 }
 async function encryptWithChatKey(plaintext, key) {
   await initSodium();
-  const nonce = sodium__default.default.randombytes_buf(sodium__default.default.crypto_secretbox_NONCEBYTES);
-  const box = sodium__default.default.crypto_secretbox_easy(sodium__default.default.from_string(plaintext), nonce, key);
-  const out = new Uint8Array(nonce.length + box.length);
-  out.set(nonce, 0);
-  out.set(box, nonce.length);
-  return bytesToBase64(out);
+  return bytesToBase64(encryptFile(sodium__default.default.from_string(plaintext), key));
 }
 async function decryptWithChatKey(ciphertext, key) {
   await initSodium();
-  const raw = base64ToBytes(ciphertext);
-  const nonce = raw.slice(0, sodium__default.default.crypto_secretbox_NONCEBYTES);
-  const box = raw.slice(sodium__default.default.crypto_secretbox_NONCEBYTES);
-  return sodium__default.default.to_string(sodium__default.default.crypto_secretbox_open_easy(box, nonce, key));
+  return sodium__default.default.to_string(decryptFile(base64ToBytes(ciphertext), key));
 }
 
 // src/crypto/keypairs.ts
@@ -433,12 +436,12 @@ function wrapIdentityKey(identitySecretKey, passwordSecretKey) {
 }
 function unwrapIdentityKey(wrapped, passwordSecretKey) {
   if (!wrapped) return passwordSecretKey;
-  const bytes = base64Decode(wrapped);
-  const nonce = bytes.slice(0, sodium__default.default.crypto_secretbox_NONCEBYTES);
+  const bytes2 = base64Decode(wrapped);
+  const nonce = bytes2.slice(0, sodium__default.default.crypto_secretbox_NONCEBYTES);
   const key = identityWrappingKey(passwordSecretKey);
   try {
     return sodium__default.default.crypto_secretbox_open_easy(
-      bytes.slice(sodium__default.default.crypto_secretbox_NONCEBYTES),
+      bytes2.slice(sodium__default.default.crypto_secretbox_NONCEBYTES),
       nonce,
       key
     );
@@ -500,379 +503,303 @@ async function generatePasswordChangeCredentials(params, deploymentDomain) {
     }
   };
 }
-
-// src/middleware/bearer-auth.ts
-function createBearerAuthMiddleware(config) {
+var UNENCRYPTED_RECOVERY_KEY_SIZE = 64;
+var ENCRYPTED_RECOVERY_KEY_SIZE = 104;
+var RECOVERY_KEY_ERRORS = {
+  INVALID_SIZE: `Invalid recovery key: file must be ${UNENCRYPTED_RECOVERY_KEY_SIZE} or ${ENCRYPTED_RECOVERY_KEY_SIZE} bytes`,
+  INVALID_FORMAT: "Invalid recovery key format",
+  READ_ERROR: "Failed to read recovery key file",
+  AUTH_FAILED: "Recovery key does not match this account",
+  ENCRYPTED_KEY_REQUIRES_SSO: 'This recovery key is encrypted with your SSO identity. Please use SSO login and then click "Forgot Password" to use this key.',
+  DECRYPTION_FAILED: "Failed to decrypt recovery key. This key may belong to a different SSO account."
+};
+function assertSigningKey(signingPrivateKey) {
+  if (signingPrivateKey.length !== UNENCRYPTED_RECOVERY_KEY_SIZE) {
+    throw new Error("Invalid signing key: must be exactly 64 bytes");
+  }
+}
+function ssoWrappingKey(auth0Sub) {
+  return sodium__default.default.crypto_hash_sha256(sodium__default.default.from_string(auth0Sub));
+}
+async function encryptRecoveryKey(signingPrivateKey, auth0Sub) {
+  await initSodium();
+  assertSigningKey(signingPrivateKey);
+  return encryptFile(signingPrivateKey, ssoWrappingKey(auth0Sub));
+}
+async function decryptRecoveryKey(encryptedKey, auth0Sub) {
+  await initSodium();
+  if (encryptedKey.length !== ENCRYPTED_RECOVERY_KEY_SIZE) {
+    throw new Error(`Invalid encrypted key: expected ${ENCRYPTED_RECOVERY_KEY_SIZE} bytes`);
+  }
+  try {
+    return decryptFile(encryptedKey, ssoWrappingKey(auth0Sub));
+  } catch {
+    throw new Error(RECOVERY_KEY_ERRORS.DECRYPTION_FAILED);
+  }
+}
+function isEncryptedRecoveryKey(byteLength) {
+  return byteLength === ENCRYPTED_RECOVERY_KEY_SIZE;
+}
+function getRecoveryKeyFilename() {
+  const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19);
+  return `arbi-recovery-${timestamp}.html`;
+}
+function buildRecoveryUrl(args) {
+  const params = new URLSearchParams({ email: args.email });
+  if (args.sso) params.set("sso", "1");
+  return `${args.origin}/recover?${params.toString()}#KEY=${bytesToBase64Url(args.keyBytes)}`;
+}
+function parseRecoveryUrl(search, hash) {
+  const params = new URLSearchParams(search);
+  const email = params.get("email");
+  const keyMatch = /(?:^#|[&#])KEY=([A-Za-z0-9_-]+)/.exec(hash);
+  if (!email || !keyMatch) return null;
+  try {
+    return {
+      email,
+      recoveryKey: base64UrlToBytes(keyMatch[1]),
+      isEncrypted: params.get("sso") === "1"
+    };
+  } catch {
+    return null;
+  }
+}
+function escapeHtml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function buildRecoveryHtml(args) {
+  const email = escapeHtml(args.email);
+  const url = escapeHtml(args.url);
+  const ssoNote = args.ssoEncrypted ? '<p class="note">This recovery file is encrypted with your SSO identity \u2014 opening it on a different account will not work.</p>' : "";
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<title>ARBI Recovery</title>
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<style>
+  :root { color-scheme: light dark; }
+  body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+         max-width: 32rem; margin: 4rem auto; padding: 1.5rem; line-height: 1.5; }
+  h1 { font-size: 1.25rem; margin-bottom: 0.25rem; }
+  .email { font-weight: 600; }
+  .btn { display: inline-block; padding: 0.75rem 1.25rem; margin-top: 1.5rem;
+         background: #2563eb; color: #fff; text-decoration: none;
+         border-radius: 0.5rem; font-weight: 600; }
+  .btn:hover { background: #1d4ed8; }
+  .note { font-size: 0.85rem; color: #6b7280; margin-top: 1.5rem; }
+  details { margin-top: 1rem; font-size: 0.85rem; color: #6b7280; }
+  code { word-break: break-all; }
+</style>
+</head>
+<body>
+  <h1>ARBI account recovery</h1>
+  <p>Click below to set a new password for <span class="email">${email}</span>.</p>
+  <p><a class="btn" href="${url}">Recover account</a></p>
+  ${ssoNote}
+  <details>
+    <summary>If the button doesn&apos;t work, open this URL manually</summary>
+    <p><code>${url}</code></p>
+  </details>
+</body>
+</html>
+`;
+}
+async function createRecoveryUrl(params) {
+  assertSigningKey(params.signingPrivateKey);
+  const keyBytes = params.auth0Sub ? await encryptRecoveryKey(params.signingPrivateKey, params.auth0Sub) : params.signingPrivateKey;
+  return buildRecoveryUrl({
+    origin: params.origin,
+    email: params.email,
+    keyBytes,
+    sso: !!params.auth0Sub
+  });
+}
+async function createRecoveryFile(params) {
+  const url = await createRecoveryUrl(params);
   return {
-    async onRequest({ request }) {
-      const accessToken = config.tokenProvider.getAccessToken();
-      if (accessToken) {
-        request.headers.set("Authorization", `Bearer ${accessToken}`);
-      }
-      return request;
-    }
+    filename: getRecoveryKeyFilename(),
+    html: buildRecoveryHtml({ email: params.email, url, ssoEncrypted: !!params.auth0Sub }),
+    url
   };
 }
-
-// src/middleware/auto-relogin.ts
-var NO_ACTIVE_WORKSPACE = /no active workspace/i;
-async function isNoActiveWorkspace(response) {
+async function validateRecoveryKeyFile(file) {
+  if (file.size !== UNENCRYPTED_RECOVERY_KEY_SIZE && file.size !== ENCRYPTED_RECOVERY_KEY_SIZE) {
+    return {
+      valid: false,
+      isEncrypted: false,
+      data: null,
+      error: RECOVERY_KEY_ERRORS.INVALID_SIZE
+    };
+  }
   try {
-    return NO_ACTIVE_WORKSPACE.test(await response.clone().text());
+    const data = new Uint8Array(await file.arrayBuffer());
+    return { valid: true, isEncrypted: isEncryptedRecoveryKey(data.length), data };
   } catch {
-    return false;
+    return { valid: false, isEncrypted: false, data: null, error: RECOVERY_KEY_ERRORS.READ_ERROR };
   }
 }
-function safeClone(request) {
+var SECURE_MAIL_KEY_BYTES = 32;
+async function sealSecureMail(raw, metadata, senderPublicKey) {
+  await initSodium();
+  const key = sodium__default.default.randombytes_buf(SECURE_MAIL_KEY_BYTES);
   try {
-    return request.clone();
+    return {
+      ciphertext: bytesToBase64(encryptFile(raw, key)),
+      metadata_ciphertext: bytesToBase64(
+        encryptFile(sodium__default.default.from_string(JSON.stringify(metadata)), key)
+      ),
+      fragment_key: bytesToBase64(key),
+      sender_wrapped_key: sealedBoxEncrypt(key, senderPublicKey)
+    };
+  } finally {
+    key.fill(0);
+  }
+}
+function decodeSecureMailKey(fragmentKey) {
+  let key;
+  try {
+    key = base64ToBytes(fragmentKey);
   } catch {
-    return null;
+    throw new Error("Invalid secure message link");
+  }
+  if (key.length !== SECURE_MAIL_KEY_BYTES) {
+    key.fill(0);
+    throw new Error("Invalid secure message link");
   }
+  return key;
 }
-function createAutoReloginMiddleware(config) {
-  const cloneCache = /* @__PURE__ */ new WeakMap();
+async function openSecureMail(payload, key) {
+  await initSodium();
+  const raw = decryptFile(base64ToBytes(payload.ciphertext), key);
+  const meta = decryptFile(base64ToBytes(payload.metadata_ciphertext), key);
+  try {
+    return { raw, metadata: JSON.parse(sodium__default.default.to_string(meta)) };
+  } finally {
+    meta.fill(0);
+  }
+}
+async function secureMailClaim(key, recipientPublicKey) {
+  await initSodium();
   return {
-    async onRequest({ request }) {
-      try {
-        cloneCache.set(request, request.clone());
-      } catch {
+    claim_hash: sodium__default.default.to_hex(sodium__default.default.crypto_hash_sha256(key)),
+    wrapped_key: sealedBoxEncrypt(key, recipientPublicKey),
+    recipient_public_key: bytesToBase64(recipientPublicKey)
+  };
+}
+
+// src/storage/indexed-db.ts
+var DB_NAME = "arbi-crypto";
+var DB_VERSION = 2;
+var db = null;
+var memorySession = null;
+function canPersistSession() {
+  return !!crypto?.subtle;
+}
+async function initializeDatabase() {
+  return new Promise((resolve, reject) => {
+    const request = indexedDB.open(DB_NAME, DB_VERSION);
+    request.onerror = () => {
+      console.error("[STORAGE] Failed to open IndexedDB:", request.error);
+      reject(request.error);
+    };
+    request.onsuccess = () => {
+      db = request.result;
+      resolve(db);
+    };
+    request.onupgradeneeded = (event) => {
+      const database = event.target.result;
+      if (!database.objectStoreNames.contains("session")) {
+        database.createObjectStore("session", { keyPath: "id" });
       }
-    },
-    async onResponse({ response, request }) {
-      if (response.status === 400 && await isNoActiveWorkspace(response)) {
-        let token = null;
-        let recovered = await config.reopenWorkspaceHandler?.() ?? false;
-        if (!recovered) {
-          token = await config.reloginHandler();
-          recovered = token !== null;
-        }
-        if (!recovered) {
-          config.onReloginFailed?.();
-          return response;
-        }
-        const retry = cloneCache.get(request) ?? safeClone(request);
-        if (retry) {
-          if (token) retry.headers.set("Authorization", `Bearer ${token}`);
-          return fetch(retry);
-        }
-        config.onRetryCloneFailed?.();
-        return response;
+      if (!database.objectStoreNames.contains("wrapping-key")) {
+        database.createObjectStore("wrapping-key", { keyPath: "id" });
       }
-      if (response.status === 400) {
-        const isSafeMethod = ["GET", "HEAD", "DELETE"].includes(request.method);
-        if (isSafeMethod) {
-          const newToken = await config.reloginHandler();
-          if (newToken) {
-            const retryRequest = cloneCache.get(request) ?? request.clone();
-            retryRequest.headers.set("Authorization", `Bearer ${newToken}`);
-            return fetch(retryRequest);
-          }
+    };
+  });
+}
+async function ensureDatabase() {
+  if (!db) {
+    await initializeDatabase();
+  }
+}
+async function getOrCreateWrappingKey() {
+  await ensureDatabase();
+  if (!db) {
+    throw new Error("Database not initialized");
+  }
+  return new Promise((resolve, reject) => {
+    if (!db) {
+      reject(new Error("Database not initialized"));
+      return;
+    }
+    const transaction = db.transaction(["wrapping-key"], "readwrite");
+    const store = transaction.objectStore("wrapping-key");
+    const request = store.get("master");
+    request.onsuccess = () => {
+      const result = request.result;
+      if (result?.key) {
+        resolve(result.key);
+      } else {
+        if (!crypto?.subtle) {
+          reject(
+            new Error(
+              "Web Crypto API not available. Ensure the page is served over HTTPS or localhost."
+            )
+          );
+          return;
         }
-      }
-      if (response.status === 401) {
-        const excludePatterns = config.reloginExcludePatterns ?? [];
-        const isExcluded = excludePatterns.some((pattern) => request.url.includes(pattern));
-        if (!isExcluded) {
-          const newToken = await config.reloginHandler();
-          if (newToken) {
-            const cached = cloneCache.get(request);
-            if (cached) {
-              cached.headers.set("Authorization", `Bearer ${newToken}`);
-              return fetch(cached);
-            }
-            try {
-              const retryRequest = request.clone();
-              retryRequest.headers.set("Authorization", `Bearer ${newToken}`);
-              return fetch(retryRequest);
-            } catch {
-              console.warn("[API] Could not retry request after re-login (body already consumed)");
-              config.onRetryCloneFailed?.();
-            }
-          } else {
-            config.onReloginFailed?.();
+        crypto.subtle.generateKey(
+          {
+            name: "AES-GCM",
+            length: 256
+          },
+          false,
+          // ❌ NON-EXTRACTABLE - Can't be exported!
+          ["encrypt", "decrypt"]
+        ).then((key) => {
+          if (!db) {
+            reject(new Error("Database not initialized"));
+            return;
           }
-        }
+          const putTransaction = db.transaction(["wrapping-key"], "readwrite");
+          const putStore = putTransaction.objectStore("wrapping-key");
+          const putRequest = putStore.put({
+            id: "master",
+            key,
+            created: Date.now()
+          });
+          putRequest.onsuccess = () => {
+            resolve(key);
+          };
+          putRequest.onerror = () => {
+            reject(new Error("Failed to store wrapping key"));
+          };
+        }).catch((error) => {
+          const errorMsg = error instanceof Error ? error.message : String(error);
+          reject(new Error(`Failed to generate wrapping key: ${errorMsg}`));
+        });
       }
-      return response;
-    }
-  };
-}
-
-// src/relogin/handler.ts
-var RELOGIN_COOLDOWN_MS = 5e3;
-function createReloginHandler(deps) {
-  let reloginPromise = null;
-  let lastSuccessToken = null;
-  let lastSuccessTime = 0;
-  return function instantReLogin() {
-    if (reloginPromise) {
-      return reloginPromise;
-    }
-    const elapsed = Date.now() - lastSuccessTime;
-    if (lastSuccessToken && elapsed < RELOGIN_COOLDOWN_MS) {
-      return Promise.resolve(lastSuccessToken);
-    }
-    const userEmail = deps.authState.getUserEmail();
-    if (!userEmail) {
-      console.warn("[API] Re-login aborted: no user email");
-      return Promise.resolve(null);
-    }
-    reloginPromise = (async () => {
-      try {
-        await deps.crypto.ensureReady();
-        const session = await deps.sessionStorage.getSession();
-        if (!session) {
-          console.warn("[API] Re-login aborted: no session");
-          return null;
-        }
-        const ed25519PublicKey = session.signingPrivateKey.slice(32, 64);
-        const encryptionKeyPair = deps.crypto.deriveEncryptionKeypair({
-          publicKey: ed25519PublicKey,
-          secretKey: session.signingPrivateKey
-        });
-        const timestamp = Math.floor(Date.now() / 1e3);
-        const message = `${userEmail}|${timestamp}`;
-        const signature = deps.crypto.signMessage(message, session.signingPrivateKey);
-        const ssoState = deps.authState.getSsoState();
-        const isSsoAccount = ssoState.isSsoMode || ssoState.isAuth0Authenticated || !!ssoState.auth0AccessToken;
-        let ssoToken = null;
-        if (deps.ssoTokenProvider) {
-          try {
-            ssoToken = await deps.ssoTokenProvider.getToken();
-          } catch (error) {
-            console.error("[API] Failed to get SSO token from provider:", error);
-          }
-        }
-        if (!ssoToken && ssoState.auth0AccessToken) {
-          ssoToken = ssoState.auth0AccessToken;
-        }
-        if (!ssoToken && isSsoAccount) {
-          console.warn("[API] Re-login aborted: SSO account but no token available");
-          return null;
-        }
-        const loginResult = await deps.loginProvider.login({
-          email: userEmail,
-          signature,
-          timestamp,
-          ssoToken: ssoToken ?? void 0
-        });
-        if (!loginResult) {
-          console.warn("[API] Re-login failed");
-          return null;
-        }
-        await deps.sessionStorage.saveSession({
-          signingPrivateKey: session.signingPrivateKey,
-          serverSessionKey: loginResult.sessionKey,
-          userExtId: loginResult.userExtId,
-          wrappedIdentityKey: loginResult.wrappedIdentityKey ?? null
-        });
-        await deps.onReloginSuccess?.({
-          email: userEmail,
-          accessToken: loginResult.accessToken,
-          userExtId: loginResult.userExtId,
-          serverSessionKey: loginResult.sessionKey
-        });
-        const activeToken = loginResult.accessToken;
-        deps.authState.setAccessToken(activeToken);
-        const selectedWorkspaceId = deps.authState.getSelectedWorkspaceId();
-        if (selectedWorkspaceId) {
-          try {
-            const wrappedKey = await deps.workspaceKeyRefreshProvider.getWrappedKey(
-              loginResult.accessToken,
-              selectedWorkspaceId
-            );
-            if (wrappedKey) {
-              const workspaceKey = deps.crypto.sealedBoxDecrypt(
-                wrappedKey,
-                encryptionKeyPair.secretKey
-              );
-              const encryptedWorkspaceKey = await deps.crypto.sealKeyForSession(
-                workspaceKey,
-                loginResult.sessionKey
-              );
-              if (deps.workspaceOpenProvider) {
-                await deps.workspaceOpenProvider.openWorkspace(
-                  loginResult.accessToken,
-                  selectedWorkspaceId,
-                  encryptedWorkspaceKey
-                );
-              }
-            }
-          } catch (error) {
-            console.error("[API] Failed to re-open workspace after re-login:", error);
-          }
-        }
-        console.info("[API] Re-login successful");
-        lastSuccessToken = activeToken;
-        lastSuccessTime = Date.now();
-        return activeToken;
-      } catch (error) {
-        console.error("[API] Re-login error:", error);
-        lastSuccessToken = null;
-        lastSuccessTime = 0;
-        return null;
-      } finally {
-        reloginPromise = null;
-      }
-    })();
-    return reloginPromise;
-  };
-}
-
-// src/relogin/reopen.ts
-function createWorkspaceReopener(deps) {
-  let inFlight = null;
-  return function reopenWorkspace() {
-    if (inFlight) return inFlight;
-    inFlight = (async () => {
-      try {
-        const workspaceId = deps.authState.getSelectedWorkspaceId();
-        const accessToken = deps.getAccessToken();
-        if (!workspaceId || !accessToken) return false;
-        const session = await deps.sessionStorage.getSession();
-        if (!session?.signingPrivateKey || !session.serverSessionKey) return false;
-        await deps.crypto.ensureReady();
-        const wrappedKey = await deps.workspaceKeyRefreshProvider.getWrappedKey(
-          accessToken,
-          workspaceId
-        );
-        if (!wrappedKey) return false;
-        const encryptionKeyPair = deps.crypto.deriveEncryptionKeypair({
-          publicKey: session.signingPrivateKey.slice(32, 64),
-          secretKey: session.signingPrivateKey
-        });
-        const workspaceKey = deps.crypto.sealedBoxDecrypt(wrappedKey, encryptionKeyPair.secretKey);
-        const sealed = await deps.crypto.sealKeyForSession(workspaceKey, session.serverSessionKey);
-        const opened = await deps.workspaceOpenProvider.openWorkspace(
-          accessToken,
-          workspaceId,
-          sealed
-        );
-        return opened === true;
-      } catch (error) {
-        console.error("[API] Failed to re-open workspace:", error);
-        return false;
-      } finally {
-        inFlight = null;
-      }
-    })();
-    return inFlight;
-  };
-}
-
-// src/storage/indexed-db.ts
-var DB_NAME = "arbi-crypto";
-var DB_VERSION = 2;
-var db = null;
-var memorySession = null;
-function canPersistSession() {
-  return !!crypto?.subtle;
-}
-async function initializeDatabase() {
-  return new Promise((resolve, reject) => {
-    const request = indexedDB.open(DB_NAME, DB_VERSION);
-    request.onerror = () => {
-      console.error("[STORAGE] Failed to open IndexedDB:", request.error);
-      reject(request.error);
-    };
-    request.onsuccess = () => {
-      db = request.result;
-      resolve(db);
-    };
-    request.onupgradeneeded = (event) => {
-      const database = event.target.result;
-      if (!database.objectStoreNames.contains("session")) {
-        database.createObjectStore("session", { keyPath: "id" });
-      }
-      if (!database.objectStoreNames.contains("wrapping-key")) {
-        database.createObjectStore("wrapping-key", { keyPath: "id" });
-      }
-    };
-  });
-}
-async function ensureDatabase() {
-  if (!db) {
-    await initializeDatabase();
-  }
-}
-async function getOrCreateWrappingKey() {
-  await ensureDatabase();
-  if (!db) {
-    throw new Error("Database not initialized");
-  }
-  return new Promise((resolve, reject) => {
-    if (!db) {
-      reject(new Error("Database not initialized"));
-      return;
-    }
-    const transaction = db.transaction(["wrapping-key"], "readwrite");
-    const store = transaction.objectStore("wrapping-key");
-    const request = store.get("master");
-    request.onsuccess = () => {
-      const result = request.result;
-      if (result?.key) {
-        resolve(result.key);
-      } else {
-        if (!crypto?.subtle) {
-          reject(
-            new Error(
-              "Web Crypto API not available. Ensure the page is served over HTTPS or localhost."
-            )
-          );
-          return;
-        }
-        crypto.subtle.generateKey(
-          {
-            name: "AES-GCM",
-            length: 256
-          },
-          false,
-          // ❌ NON-EXTRACTABLE - Can't be exported!
-          ["encrypt", "decrypt"]
-        ).then((key) => {
-          if (!db) {
-            reject(new Error("Database not initialized"));
-            return;
-          }
-          const putTransaction = db.transaction(["wrapping-key"], "readwrite");
-          const putStore = putTransaction.objectStore("wrapping-key");
-          const putRequest = putStore.put({
-            id: "master",
-            key,
-            created: Date.now()
-          });
-          putRequest.onsuccess = () => {
-            resolve(key);
-          };
-          putRequest.onerror = () => {
-            reject(new Error("Failed to store wrapping key"));
-          };
-        }).catch((error) => {
-          const errorMsg = error instanceof Error ? error.message : String(error);
-          reject(new Error(`Failed to generate wrapping key: ${errorMsg}`));
-        });
-      }
-    };
-    request.onerror = () => {
-      reject(new Error("Failed to retrieve wrapping key from IndexedDB"));
-    };
-  });
-}
-async function encryptWithWrappingKey(data) {
-  const wrappingKey = await getOrCreateWrappingKey();
-  const iv = crypto.getRandomValues(new Uint8Array(12));
-  const ciphertext = await crypto.subtle.encrypt(
-    {
-      name: "AES-GCM",
-      iv
-    },
-    wrappingKey,
-    data
-  );
-  return {
-    ciphertext: new Uint8Array(ciphertext),
-    iv
+    };
+    request.onerror = () => {
+      reject(new Error("Failed to retrieve wrapping key from IndexedDB"));
+    };
+  });
+}
+async function encryptWithWrappingKey(data) {
+  const wrappingKey = await getOrCreateWrappingKey();
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const ciphertext = await crypto.subtle.encrypt(
+    {
+      name: "AES-GCM",
+      iv
+    },
+    wrappingKey,
+    data
+  );
+  return {
+    ciphertext: new Uint8Array(ciphertext),
+    iv
   };
 }
 async function decryptWithWrappingKey(ciphertext, iv) {
@@ -964,104 +891,427 @@ async function getSession() {
               result.serverSessionKeyIV
             );
           }
-          resolve({
-            signingPrivateKey,
-            serverSessionKey,
-            userExtId: result.userExtId,
-            wrappedIdentityKey: result.wrappedIdentityKey ?? null
-          });
-        } catch (error) {
-          console.error("[STORAGE] Failed to decrypt session data:", error);
-          reject(error);
+          resolve({
+            signingPrivateKey,
+            serverSessionKey,
+            userExtId: result.userExtId,
+            wrappedIdentityKey: result.wrappedIdentityKey ?? null
+          });
+        } catch (error) {
+          console.error("[STORAGE] Failed to decrypt session data:", error);
+          reject(error);
+        }
+      } else {
+        resolve(null);
+      }
+    };
+    request.onerror = () => {
+      console.error("[STORAGE] Failed to get session:", request.error);
+      reject(request.error);
+    };
+  });
+}
+async function updateWrappedIdentityKey(wrappedIdentityKey) {
+  const existingSession = await getSession();
+  if (!existingSession) {
+    throw new Error("No existing session to update");
+  }
+  await saveSession({ ...existingSession, wrappedIdentityKey });
+}
+async function clearSession() {
+  memorySession = null;
+  if (!canPersistSession()) {
+    return;
+  }
+  await ensureDatabase();
+  if (!db) {
+    throw new Error("Database not initialized");
+  }
+  return new Promise((resolve, reject) => {
+    if (!db) {
+      reject(new Error("Database not initialized"));
+      return;
+    }
+    const transaction = db.transaction(["session"], "readwrite");
+    const store = transaction.objectStore("session");
+    const request = store.delete("current");
+    request.onsuccess = () => {
+      resolve();
+    };
+    request.onerror = () => {
+      console.error("[STORAGE] Failed to clear session:", request.error);
+      reject(request.error);
+    };
+  });
+}
+async function clearWrappingKey() {
+  await ensureDatabase();
+  if (!db) {
+    throw new Error("Database not initialized");
+  }
+  return new Promise((resolve, reject) => {
+    if (!db) {
+      reject(new Error("Database not initialized"));
+      return;
+    }
+    const transaction = db.transaction(["wrapping-key"], "readwrite");
+    const store = transaction.objectStore("wrapping-key");
+    const request = store.delete("master");
+    request.onsuccess = () => {
+      resolve();
+    };
+    request.onerror = () => {
+      console.error("[STORAGE] Failed to clear wrapping key:", request.error);
+      reject(request.error);
+    };
+  });
+}
+async function clearAllData() {
+  memorySession = null;
+  if (!canPersistSession()) {
+    return;
+  }
+  await clearSession();
+  await clearWrappingKey();
+}
+async function hasSession() {
+  const session = await getSession();
+  return session !== null;
+}
+async function getUserEncryptionKeypair() {
+  await initSodium();
+  const session = await getSession();
+  if (!session?.signingPrivateKey) {
+    return null;
+  }
+  return encryptionKeypairFromSigningKey(session.signingPrivateKey);
+}
+
+// src/crypto/offline-sealer.ts
+function bytes(value) {
+  return value instanceof Uint8Array ? value : Uint8Array.from(value);
+}
+function createOfflineSealer(namespace, { locked, keypair: getKeypair = getUserEncryptionKeypair }) {
+  const ENC_LABEL = `${namespace}:enc`;
+  const INDEX_LABEL = `${namespace}:index`;
+  let cached = null;
+  async function keys() {
+    await sodium__default.default.ready;
+    const keypair = await getKeypair();
+    if (!keypair) throw locked();
+    const publicKey = sodium__default.default.to_hex(keypair.publicKey);
+    if (cached?.publicKey === publicKey) {
+      keypair.secretKey.fill(0);
+      return cached.keys;
+    }
+    const derived = {
+      enc: sodium__default.default.crypto_generichash(32, ENC_LABEL, bytes(keypair.secretKey)),
+      index: sodium__default.default.crypto_generichash(32, INDEX_LABEL, bytes(keypair.secretKey))
+    };
+    keypair.secretKey.fill(0);
+    cached = { publicKey, keys: derived };
+    return derived;
+  }
+  async function seal(plain) {
+    const { enc } = await keys();
+    const nonce = sodium__default.default.randombytes_buf(sodium__default.default.crypto_secretbox_NONCEBYTES);
+    const box = sodium__default.default.crypto_secretbox_easy(
+      typeof plain === "string" ? plain : bytes(plain),
+      nonce,
+      enc
+    );
+    const out = new Uint8Array(nonce.length + box.length);
+    out.set(nonce);
+    out.set(box, nonce.length);
+    return out;
+  }
+  async function openBytes(sealed) {
+    const { enc } = await keys();
+    const nonceBytes = sodium__default.default.crypto_secretbox_NONCEBYTES;
+    const data = bytes(sealed);
+    return sodium__default.default.crypto_secretbox_open_easy(
+      data.subarray(nonceBytes),
+      data.subarray(0, nonceBytes),
+      enc
+    );
+  }
+  return {
+    sealBytes: (plain) => seal(plain),
+    openBytes,
+    sealJson: (value) => seal(JSON.stringify(value)),
+    async openJson(sealed) {
+      return JSON.parse(sodium__default.default.to_string(await openBytes(sealed)));
+    },
+    async blind(...parts) {
+      const { index } = await keys();
+      return sodium__default.default.to_hex(sodium__default.default.crypto_generichash(16, parts.join("\0"), index));
+    },
+    forget() {
+      cached?.keys.enc.fill(0);
+      cached?.keys.index.fill(0);
+      cached = null;
+    }
+  };
+}
+
+// src/middleware/bearer-auth.ts
+function createBearerAuthMiddleware(config) {
+  return {
+    async onRequest({ request }) {
+      const accessToken = config.tokenProvider.getAccessToken();
+      if (accessToken) {
+        request.headers.set("Authorization", `Bearer ${accessToken}`);
+      }
+      return request;
+    }
+  };
+}
+
+// src/middleware/auto-relogin.ts
+var NO_ACTIVE_WORKSPACE = /no active workspace/i;
+async function isNoActiveWorkspace(response) {
+  try {
+    return NO_ACTIVE_WORKSPACE.test(await response.clone().text());
+  } catch {
+    return false;
+  }
+}
+function safeClone(request) {
+  try {
+    return request.clone();
+  } catch {
+    return null;
+  }
+}
+function createAutoReloginMiddleware(config) {
+  const cloneCache = /* @__PURE__ */ new WeakMap();
+  return {
+    async onRequest({ request }) {
+      try {
+        cloneCache.set(request, request.clone());
+      } catch {
+      }
+    },
+    async onResponse({ response, request }) {
+      if (response.status === 400 && await isNoActiveWorkspace(response)) {
+        let token = null;
+        let recovered = await config.reopenWorkspaceHandler?.() ?? false;
+        if (!recovered) {
+          token = await config.reloginHandler();
+          recovered = token !== null;
+        }
+        if (!recovered) {
+          config.onReloginFailed?.();
+          return response;
+        }
+        const retry = cloneCache.get(request) ?? safeClone(request);
+        if (retry) {
+          if (token) retry.headers.set("Authorization", `Bearer ${token}`);
+          return fetch(retry);
+        }
+        config.onRetryCloneFailed?.();
+        return response;
+      }
+      if (response.status === 400) {
+        const isSafeMethod = ["GET", "HEAD", "DELETE"].includes(request.method);
+        if (isSafeMethod) {
+          const newToken = await config.reloginHandler();
+          if (newToken) {
+            const retryRequest = cloneCache.get(request) ?? request.clone();
+            retryRequest.headers.set("Authorization", `Bearer ${newToken}`);
+            return fetch(retryRequest);
+          }
+        }
+      }
+      if (response.status === 401) {
+        const excludePatterns = config.reloginExcludePatterns ?? [];
+        const isExcluded = excludePatterns.some((pattern) => request.url.includes(pattern));
+        if (!isExcluded) {
+          const newToken = await config.reloginHandler();
+          if (newToken) {
+            const cached = cloneCache.get(request);
+            if (cached) {
+              cached.headers.set("Authorization", `Bearer ${newToken}`);
+              return fetch(cached);
+            }
+            try {
+              const retryRequest = request.clone();
+              retryRequest.headers.set("Authorization", `Bearer ${newToken}`);
+              return fetch(retryRequest);
+            } catch {
+              console.warn("[API] Could not retry request after re-login (body already consumed)");
+              config.onRetryCloneFailed?.();
+            }
+          } else {
+            config.onReloginFailed?.();
+          }
         }
-      } else {
-        resolve(null);
       }
-    };
-    request.onerror = () => {
-      console.error("[STORAGE] Failed to get session:", request.error);
-      reject(request.error);
-    };
-  });
-}
-async function updateWrappedIdentityKey(wrappedIdentityKey) {
-  const existingSession = await getSession();
-  if (!existingSession) {
-    throw new Error("No existing session to update");
-  }
-  await saveSession({ ...existingSession, wrappedIdentityKey });
-}
-async function clearSession() {
-  memorySession = null;
-  if (!canPersistSession()) {
-    return;
-  }
-  await ensureDatabase();
-  if (!db) {
-    throw new Error("Database not initialized");
-  }
-  return new Promise((resolve, reject) => {
-    if (!db) {
-      reject(new Error("Database not initialized"));
-      return;
+      return response;
     }
-    const transaction = db.transaction(["session"], "readwrite");
-    const store = transaction.objectStore("session");
-    const request = store.delete("current");
-    request.onsuccess = () => {
-      resolve();
-    };
-    request.onerror = () => {
-      console.error("[STORAGE] Failed to clear session:", request.error);
-      reject(request.error);
-    };
-  });
+  };
 }
-async function clearWrappingKey() {
-  await ensureDatabase();
-  if (!db) {
-    throw new Error("Database not initialized");
-  }
-  return new Promise((resolve, reject) => {
-    if (!db) {
-      reject(new Error("Database not initialized"));
-      return;
+
+// src/relogin/handler.ts
+var RELOGIN_COOLDOWN_MS = 5e3;
+function createReloginHandler(deps) {
+  let reloginPromise = null;
+  let lastSuccessToken = null;
+  let lastSuccessTime = 0;
+  return function instantReLogin() {
+    if (reloginPromise) {
+      return reloginPromise;
     }
-    const transaction = db.transaction(["wrapping-key"], "readwrite");
-    const store = transaction.objectStore("wrapping-key");
-    const request = store.delete("master");
-    request.onsuccess = () => {
-      resolve();
-    };
-    request.onerror = () => {
-      console.error("[STORAGE] Failed to clear wrapping key:", request.error);
-      reject(request.error);
-    };
-  });
-}
-async function clearAllData() {
-  memorySession = null;
-  if (!canPersistSession()) {
-    return;
-  }
-  await clearSession();
-  await clearWrappingKey();
-}
-async function hasSession() {
-  const session = await getSession();
-  return session !== null;
+    const elapsed = Date.now() - lastSuccessTime;
+    if (lastSuccessToken && elapsed < RELOGIN_COOLDOWN_MS) {
+      return Promise.resolve(lastSuccessToken);
+    }
+    const userEmail = deps.authState.getUserEmail();
+    if (!userEmail) {
+      console.warn("[API] Re-login aborted: no user email");
+      return Promise.resolve(null);
+    }
+    reloginPromise = (async () => {
+      try {
+        await deps.crypto.ensureReady();
+        const session = await deps.sessionStorage.getSession();
+        if (!session) {
+          console.warn("[API] Re-login aborted: no session");
+          return null;
+        }
+        const ed25519PublicKey = session.signingPrivateKey.slice(32, 64);
+        const encryptionKeyPair = deps.crypto.deriveEncryptionKeypair({
+          publicKey: ed25519PublicKey,
+          secretKey: session.signingPrivateKey
+        });
+        const timestamp = Math.floor(Date.now() / 1e3);
+        const message = `${userEmail}|${timestamp}`;
+        const signature = deps.crypto.signMessage(message, session.signingPrivateKey);
+        const ssoState = deps.authState.getSsoState();
+        const isSsoAccount = ssoState.isSsoMode || ssoState.isAuth0Authenticated || !!ssoState.auth0AccessToken;
+        let ssoToken = null;
+        if (deps.ssoTokenProvider) {
+          try {
+            ssoToken = await deps.ssoTokenProvider.getToken();
+          } catch (error) {
+            console.error("[API] Failed to get SSO token from provider:", error);
+          }
+        }
+        if (!ssoToken && ssoState.auth0AccessToken) {
+          ssoToken = ssoState.auth0AccessToken;
+        }
+        if (!ssoToken && isSsoAccount) {
+          console.warn("[API] Re-login aborted: SSO account but no token available");
+          return null;
+        }
+        const loginResult = await deps.loginProvider.login({
+          email: userEmail,
+          signature,
+          timestamp,
+          ssoToken: ssoToken ?? void 0
+        });
+        if (!loginResult) {
+          console.warn("[API] Re-login failed");
+          return null;
+        }
+        await deps.sessionStorage.saveSession({
+          signingPrivateKey: session.signingPrivateKey,
+          serverSessionKey: loginResult.sessionKey,
+          userExtId: loginResult.userExtId,
+          wrappedIdentityKey: loginResult.wrappedIdentityKey ?? null
+        });
+        await deps.onReloginSuccess?.({
+          email: userEmail,
+          accessToken: loginResult.accessToken,
+          userExtId: loginResult.userExtId,
+          serverSessionKey: loginResult.sessionKey
+        });
+        const activeToken = loginResult.accessToken;
+        deps.authState.setAccessToken(activeToken);
+        const selectedWorkspaceId = deps.authState.getSelectedWorkspaceId();
+        if (selectedWorkspaceId) {
+          try {
+            const wrappedKey = await deps.workspaceKeyRefreshProvider.getWrappedKey(
+              loginResult.accessToken,
+              selectedWorkspaceId
+            );
+            if (wrappedKey) {
+              const workspaceKey = deps.crypto.sealedBoxDecrypt(
+                wrappedKey,
+                encryptionKeyPair.secretKey
+              );
+              const encryptedWorkspaceKey = await deps.crypto.sealKeyForSession(
+                workspaceKey,
+                loginResult.sessionKey
+              );
+              if (deps.workspaceOpenProvider) {
+                await deps.workspaceOpenProvider.openWorkspace(
+                  loginResult.accessToken,
+                  selectedWorkspaceId,
+                  encryptedWorkspaceKey
+                );
+              }
+            }
+          } catch (error) {
+            console.error("[API] Failed to re-open workspace after re-login:", error);
+          }
+        }
+        console.info("[API] Re-login successful");
+        lastSuccessToken = activeToken;
+        lastSuccessTime = Date.now();
+        return activeToken;
+      } catch (error) {
+        console.error("[API] Re-login error:", error);
+        lastSuccessToken = null;
+        lastSuccessTime = 0;
+        return null;
+      } finally {
+        reloginPromise = null;
+      }
+    })();
+    return reloginPromise;
+  };
 }
-async function getUserEncryptionKeypair() {
-  await initSodium();
-  const session = await getSession();
-  if (!session?.signingPrivateKey) {
-    return null;
-  }
-  const publicKey = session.signingPrivateKey.slice(32, 64);
-  return deriveEncryptionKeypairFromSigning({
-    publicKey,
-    secretKey: session.signingPrivateKey
-  });
+
+// src/relogin/reopen.ts
+function createWorkspaceReopener(deps) {
+  let inFlight = null;
+  return function reopenWorkspace() {
+    if (inFlight) return inFlight;
+    inFlight = (async () => {
+      try {
+        const workspaceId = deps.authState.getSelectedWorkspaceId();
+        const accessToken = deps.getAccessToken();
+        if (!workspaceId || !accessToken) return false;
+        const session = await deps.sessionStorage.getSession();
+        if (!session?.signingPrivateKey || !session.serverSessionKey) return false;
+        await deps.crypto.ensureReady();
+        const wrappedKey = await deps.workspaceKeyRefreshProvider.getWrappedKey(
+          accessToken,
+          workspaceId
+        );
+        if (!wrappedKey) return false;
+        const encryptionKeyPair = deps.crypto.deriveEncryptionKeypair({
+          publicKey: session.signingPrivateKey.slice(32, 64),
+          secretKey: session.signingPrivateKey
+        });
+        const workspaceKey = deps.crypto.sealedBoxDecrypt(wrappedKey, encryptionKeyPair.secretKey);
+        const sealed = await deps.crypto.sealKeyForSession(workspaceKey, session.serverSessionKey);
+        const opened = await deps.workspaceOpenProvider.openWorkspace(
+          accessToken,
+          workspaceId,
+          sealed
+        );
+        return opened === true;
+      } catch (error) {
+        console.error("[API] Failed to re-open workspace:", error);
+        return false;
+      } finally {
+        inFlight = null;
+      }
+    })();
+    return inFlight;
+  };
 }
 
 // src/auth/register.ts
@@ -1093,12 +1343,7 @@ function bytesEqual(a, b) {
   return a.length === b.length && a.every((byte, i) => byte === b[i]);
 }
 function encryptionPublicKeyOf(identitySecretKey) {
-  return base64Encode(
-    deriveEncryptionKeypairFromSigning({
-      publicKey: identitySecretKey.slice(32, 64),
-      secretKey: identitySecretKey
-    }).publicKey
-  );
+  return base64Encode(encryptionKeypairFromSigningKey(identitySecretKey).publicKey);
 }
 function identityFromLoginResponse(passwordPrivateKey, response) {
   const identity = unwrapIdentityKey(response.wrapped_identity_key, passwordPrivateKey);
@@ -1464,12 +1709,18 @@ function isMessageType(msg, type) {
 exports.API_PREFIX = API_PREFIX;
 exports.CALL_KEY_BYTES = CALL_KEY_BYTES;
 exports.CHAT_KEY_BYTES = CHAT_KEY_BYTES;
+exports.ENCRYPTED_RECOVERY_KEY_SIZE = ENCRYPTED_RECOVERY_KEY_SIZE;
+exports.RECOVERY_KEY_ERRORS = RECOVERY_KEY_ERRORS;
+exports.SECURE_MAIL_KEY_BYTES = SECURE_MAIL_KEY_BYTES;
+exports.UNENCRYPTED_RECOVERY_KEY_SIZE = UNENCRYPTED_RECOVERY_KEY_SIZE;
 exports.base64Decode = base64Decode;
 exports.base64Encode = base64Encode;
 exports.base64ToBytes = base64ToBytes;
+exports.base64UrlToBytes = base64UrlToBytes;
 exports.buildCallFragment = buildCallFragment;
 exports.buildWebSocketUrl = buildWebSocketUrl;
 exports.bytesToBase64 = bytesToBase64;
+exports.bytesToBase64Url = bytesToBase64Url;
 exports.canPersistSession = canPersistSession;
 exports.changePassword = changePassword;
 exports.clearAllData = clearAllData;
@@ -1480,14 +1731,19 @@ exports.createAuthMessage = createAuthMessage;
 exports.createAutoReloginMiddleware = createAutoReloginMiddleware;
 exports.createBearerAuthMiddleware = createBearerAuthMiddleware;
 exports.createContentHash = createContentHash;
+exports.createOfflineSealer = createOfflineSealer;
+exports.createRecoveryFile = createRecoveryFile;
+exports.createRecoveryUrl = createRecoveryUrl;
 exports.createReloginHandler = createReloginHandler;
 exports.createSessionManager = createSessionManager;
 exports.createWorkspaceReopener = createWorkspaceReopener;
 exports.decodeCallKey = decodeCallKey;
+exports.decodeSecureMailKey = decodeSecureMailKey;
 exports.decryptCallTitle = decryptCallTitle;
 exports.decryptFile = decryptFile;
 exports.decryptMessage = decryptMessage;
 exports.decryptMessageWithSharedSecret = decryptMessageWithSharedSecret;
+exports.decryptRecoveryKey = decryptRecoveryKey;
 exports.decryptWithChatKey = decryptWithChatKey;
 exports.deriveDirectChatKey = deriveDirectChatKey;
 exports.deriveEncryptionKeypairFromSigning = deriveEncryptionKeypairFromSigning;
@@ -1497,7 +1753,9 @@ exports.encryptCallTitle = encryptCallTitle;
 exports.encryptFile = encryptFile;
 exports.encryptMessage = encryptMessage;
 exports.encryptMessageWithSharedSecret = encryptMessageWithSharedSecret;
+exports.encryptRecoveryKey = encryptRecoveryKey;
 exports.encryptWithChatKey = encryptWithChatKey;
+exports.encryptionKeypairFromSigningKey = encryptionKeypairFromSigningKey;
 exports.generateCallKey = generateCallKey;
 exports.generateChatKey = generateChatKey;
 exports.generateIdentityKeypair = generateIdentityKeypair;
@@ -1508,16 +1766,20 @@ exports.generatePasswordChangeCredentials = generatePasswordChangeCredentials;
 exports.generateRandomSigningKeypair = generateRandomSigningKeypair;
 exports.generateRegistrationCredentials = generateRegistrationCredentials;
 exports.generateUserKeypairs = generateUserKeypairs;
+exports.getRecoveryKeyFilename = getRecoveryKeyFilename;
 exports.getSession = getSession;
 exports.getUserEncryptionKeypair = getUserEncryptionKeypair;
 exports.hasSession = hasSession;
 exports.identityFromLoginResponse = identityFromLoginResponse;
 exports.initSodium = initSodium;
 exports.initializeDatabase = initializeDatabase;
+exports.isEncryptedRecoveryKey = isEncryptedRecoveryKey;
 exports.isMessageType = isMessageType;
 exports.openSealedCallKey = openSealedCallKey;
 exports.openSealedChatKey = openSealedChatKey;
+exports.openSecureMail = openSecureMail;
 exports.parseCallFragment = parseCallFragment;
+exports.parseRecoveryUrl = parseRecoveryUrl;
 exports.parseServerMessage = parseServerMessage;
 exports.passwordChangeErrorMessage = passwordChangeErrorMessage;
 exports.prewarmKeyPairs = prewarmKeyPairs;
@@ -1525,12 +1787,16 @@ exports.saveSession = saveSession;
 exports.sealCallKey = sealCallKey;
 exports.sealChatKey = sealChatKey;
 exports.sealKeyForSession = sealKeyForSession;
+exports.sealSecureMail = sealSecureMail;
 exports.sealedBoxDecrypt = sealedBoxDecrypt;
 exports.sealedBoxEncrypt = sealedBoxEncrypt;
+exports.secureMailClaim = secureMailClaim;
 exports.signMessage = signMessage;
 exports.unlockIdentityWithPassword = unlockIdentityWithPassword;
 exports.unwrapIdentityKey = unwrapIdentityKey;
+exports.unwrapWorkspaceKey = unwrapWorkspaceKey;
 exports.updateWrappedIdentityKey = updateWrappedIdentityKey;
+exports.validateRecoveryKeyFile = validateRecoveryKeyFile;
 exports.wrapIdentityKey = wrapIdentityKey;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map