@arbidocs/client 0.4.166 → 0.4.168

package/dist/index.js

@@ -4,55 +4,67 @@ import sodium from 'libsodium-wrappers-sumo';
 // src/client.ts
 
 // src/session.ts
-function createInitialState() {
+function createInitialState(isSsoMode = false) {
   return {
     accessToken: null,
     userEmail: null,
     userExtId: null,
     selectedWorkspaceId: null,
-    isSsoMode: false,
-    isAuth0Authenticated: false,
-    auth0AccessToken: null
+    isSsoMode,
+    user: null,
+    signedIn: false,
+    serverSessionKey: null
   };
 }
-function createSessionManager() {
-  let state = createInitialState();
+var stored = (s) => ({
+  accessToken: s.accessToken,
+  userEmail: s.userEmail,
+  userExtId: s.userExtId,
+  isSsoMode: s.isSsoMode,
+  user: s.user,
+  signedIn: s.signedIn
+});
+function createSessionManager(options = {}) {
+  const { storage } = options;
+  let state = { ...createInitialState(), ...storage?.load() ?? {} };
   const listeners = /* @__PURE__ */ new Set();
-  function notify() {
-    const snapshot = { ...state };
-    for (const listener of listeners) {
-      listener(snapshot);
-    }
+  function update(patch) {
+    state = { ...state, ...patch };
+    storage?.save(stored(state));
+    const snapshot = state;
+    for (const listener of [...listeners]) listener(snapshot);
   }
   return {
-    getState() {
-      return state;
-    },
-    setAccessToken(token) {
-      state = { ...state, accessToken: token };
-      notify();
-    },
+    getState: () => state,
+    setAccessToken: (accessToken) => update({ accessToken }),
     setUser(email, extId) {
-      state = { ...state, userEmail: email, userExtId: extId ?? state.userExtId };
-      notify();
-    },
-    setSelectedWorkspace(id) {
-      state = { ...state, selectedWorkspaceId: id };
-      notify();
+      update({
+        userEmail: email,
+        userExtId: extId ?? state.userExtId,
+        user: state.user ? { ...state.user, email } : null
+      });
     },
-    setSsoState(opts) {
-      state = {
-        ...state,
-        isSsoMode: opts.isSsoMode ?? state.isSsoMode,
-        isAuth0Authenticated: opts.isAuth0Authenticated ?? state.isAuth0Authenticated,
-        auth0AccessToken: opts.auth0AccessToken !== void 0 ? opts.auth0AccessToken : state.auth0AccessToken
-      };
-      notify();
+    updateUser(patch) {
+      if (!state.user) return;
+      const user = { ...state.user, ...patch };
+      update({ user, userEmail: user.email });
     },
-    clear() {
-      state = createInitialState();
-      notify();
+    setSelectedWorkspace: (selectedWorkspaceId) => update({ selectedWorkspaceId }),
+    setSsoMode: (isSsoMode) => update({ isSsoMode }),
+    setServerSessionKey: (serverSessionKey) => update({ serverSessionKey }),
+    signIn({ accessToken, user, isSsoMode, serverSessionKey }) {
+      update({
+        accessToken,
+        user,
+        userEmail: user.email,
+        userExtId: user.external_id,
+        isSsoMode,
+        serverSessionKey,
+        signedIn: true
+      });
     },
+    // The SSO mode outlives a sign-out: it says how this deployment (or this user) signs in.
+    clear: () => update(createInitialState(state.isSsoMode)),
     subscribe(listener) {
       listeners.add(listener);
       return () => {
@@ -61,23 +73,41 @@ function createSessionManager() {
     }
   };
 }
+var ACCESS_TOKEN_STORAGE_KEY = "arbi_access_token";
+var SESSION_STORAGE_KEY = "arbi_session";
+function browserSessionStateStorage() {
+  return {
+    load() {
+      try {
+        const rest = JSON.parse(window.localStorage.getItem(SESSION_STORAGE_KEY) ?? "null");
+        const accessToken = window.sessionStorage.getItem(ACCESS_TOKEN_STORAGE_KEY);
+        return { ...rest ?? {}, accessToken };
+      } catch {
+        return null;
+      }
+    },
+    save({ accessToken, ...rest }) {
+      try {
+        if (accessToken) window.sessionStorage.setItem(ACCESS_TOKEN_STORAGE_KEY, accessToken);
+        else window.sessionStorage.removeItem(ACCESS_TOKEN_STORAGE_KEY);
+        if (rest.signedIn || rest.isSsoMode)
+          window.localStorage.setItem(SESSION_STORAGE_KEY, JSON.stringify(rest));
+        else window.localStorage.removeItem(SESSION_STORAGE_KEY);
+      } catch {
+      }
+    }
+  };
+}
 function createTokenProvider(session) {
   return {
     getAccessToken: () => session.getState().accessToken
   };
 }
-function createAuthStateProvider(session) {
+function createAuthStateProvider(session, selectedWorkspace = () => session.getState().selectedWorkspaceId) {
   return {
     getUserEmail: () => session.getState().userEmail,
-    getSsoState: () => {
-      const s = session.getState();
-      return {
-        isSsoMode: s.isSsoMode,
-        isAuth0Authenticated: s.isAuth0Authenticated,
-        auth0AccessToken: s.auth0AccessToken
-      };
-    },
-    getSelectedWorkspaceId: () => session.getState().selectedWorkspaceId,
+    isSsoMode: () => session.getState().isSsoMode,
+    getSelectedWorkspaceId: selectedWorkspace,
     setAccessToken: (token) => session.setAccessToken(token)
   };
 }
@@ -356,6 +386,25 @@ function parseCallFragment(hash) {
   const v = Number(params.get("v"));
   return { key, linkVersion: Number.isInteger(v) && v > 0 ? v : null };
 }
+function buildCallLink(origin, callExtId, key, linkVersion) {
+  return `${origin}/call/${callExtId}#${buildCallFragment(key, linkVersion)}`;
+}
+async function sealCallKeyForPeers(key, peers, exclude) {
+  const out = {};
+  for (const peer of peers) {
+    if (!peer.encryption_public_key || peer.external_id === exclude) continue;
+    out[peer.external_id] = await sealCallKey(key, peer.encryption_public_key);
+  }
+  return out;
+}
+async function openCallKeyOf(call, encryptionSecretKey) {
+  if (!call.my_sealed_key) return null;
+  try {
+    return await openSealedCallKey(call.my_sealed_key, encryptionSecretKey);
+  } catch {
+    return null;
+  }
+}
 var CHAT_KEY_BYTES = 32;
 async function deriveDirectChatKey(peerPublicKeyBase64, mySecretKey) {
   await initSodium();
@@ -1060,8 +1109,126 @@ function createBearerAuthMiddleware(config) {
   };
 }
 
+// src/workspace-keys.ts
+function createWorkspaceKeys(deps) {
+  const wrapped = /* @__PURE__ */ new Map();
+  const keyless = /* @__PURE__ */ new Set();
+  let listing = null;
+  const primed = /* @__PURE__ */ new Map();
+  let primedFor = null;
+  function remember(workspaces) {
+    for (const ws of workspaces) {
+      if (ws.wrapped_key) {
+        wrapped.set(ws.external_id, ws.wrapped_key);
+        keyless.delete(ws.external_id);
+      } else if (ws.is_public || ws.is_member) keyless.add(ws.external_id);
+    }
+    return workspaces;
+  }
+  function readList() {
+    listing ??= (async () => {
+      try {
+        const token = deps.getAccessToken();
+        if (!token) throw new Error("Not signed in");
+        const list = await deps.listWorkspaces(token);
+        if (!list) throw new Error("Failed to fetch workspaces");
+        remember(list);
+      } finally {
+        listing = null;
+      }
+    })();
+    return listing;
+  }
+  async function wrappedKey(workspaceId, { refresh = false } = {}) {
+    if (!refresh) {
+      const cached = wrapped.get(workspaceId);
+      if (cached) return { wrappedKey: cached, fromCache: true };
+      if (keyless.has(workspaceId)) return { wrappedKey: null, fromCache: true };
+    }
+    wrapped.delete(workspaceId);
+    keyless.delete(workspaceId);
+    await readList();
+    const fresh = wrapped.get(workspaceId);
+    if (fresh) return { wrappedKey: fresh, fromCache: false };
+    if (keyless.has(workspaceId)) return { wrappedKey: null, fromCache: false };
+    throw new Error(`Workspace ${workspaceId} not found or has no encryption key`);
+  }
+  async function sealedFor(workspaceId, serverSessionKey2, refresh) {
+    const stored2 = await deps.persistence.getSession();
+    if (!stored2?.signingPrivateKey) throw new Error("No stored identity to unlock the workspace");
+    const { wrappedKey: key, fromCache } = await wrappedKey(workspaceId, { refresh });
+    if (!key) throw new Error(`Workspace ${workspaceId} is public: it has no key to deposit`);
+    try {
+      await deps.crypto.ensureReady();
+      return await deps.crypto.sealKeyForSession(
+        deps.unwrapWorkspaceKey(key, stored2.signingPrivateKey),
+        serverSessionKey2
+      );
+    } catch (error) {
+      if (!fromCache) throw error;
+      return sealedFor(workspaceId, serverSessionKey2, true);
+    }
+  }
+  async function serverSessionKey() {
+    const key = deps.getServerSessionKey() ?? (await deps.persistence.getSession())?.serverSessionKey;
+    if (!key) throw new Error("No server session to unlock the workspace for");
+    return key;
+  }
+  function prime(workspaceId, { force = false } = {}) {
+    const sessionKey = deps.getServerSessionKey();
+    if (sessionKey !== primedFor) {
+      primed.clear();
+      primedFor = sessionKey;
+    }
+    const pending = primed.get(workspaceId);
+    if (pending && !force) return pending;
+    const run = (async () => {
+      const token = deps.getAccessToken();
+      if (!token) throw new Error("Not signed in");
+      const sealed = await sealedFor(workspaceId, await serverSessionKey(), false);
+      await deps.primeKey(token, workspaceId, sealed);
+    })();
+    primed.set(workspaceId, run);
+    run.catch(() => {
+      if (primed.get(workspaceId) === run) primed.delete(workspaceId);
+    });
+    return run;
+  }
+  return {
+    remember,
+    wrappedKey,
+    prime,
+    forget(workspaceIds) {
+      for (const id of workspaceIds) {
+        wrapped.delete(id);
+        keyless.delete(id);
+        primed.delete(id);
+      }
+    },
+    clear() {
+      wrapped.clear();
+      keyless.clear();
+      primed.clear();
+      primedFor = null;
+    }
+  };
+}
+function workspaceKeyRequiredOf(body) {
+  const detail = body?.detail;
+  if (!detail || typeof detail !== "object") return null;
+  const d = detail;
+  return d.code === "workspace_key_required" && typeof d.workspace_ext_id === "string" ? d.workspace_ext_id : null;
+}
+
 // src/middleware/auto-relogin.ts
 var NO_ACTIVE_WORKSPACE = /no active workspace/i;
+async function keyRequiredWorkspace(response) {
+  try {
+    return workspaceKeyRequiredOf(await response.clone().json());
+  } catch {
+    return null;
+  }
+}
 async function isNoActiveWorkspace(response) {
   try {
     return NO_ACTIVE_WORKSPACE.test(await response.clone().text());
@@ -1086,6 +1253,16 @@ function createAutoReloginMiddleware(config) {
       }
     },
     async onResponse({ response, request }) {
+      if (response.status === 409 && config.primeWorkspaceHandler) {
+        const workspaceId = await keyRequiredWorkspace(response);
+        if (workspaceId) {
+          if (!await config.primeWorkspaceHandler(workspaceId)) return response;
+          const retry = cloneCache.get(request) ?? safeClone(request);
+          if (retry) return fetch(retry);
+          config.onRetryCloneFailed?.();
+          return response;
+        }
+      }
       if (response.status === 400 && await isNoActiveWorkspace(response)) {
         let token = null;
         let recovered = await config.reopenWorkspaceHandler?.() ?? false;
@@ -1093,10 +1270,7 @@ function createAutoReloginMiddleware(config) {
           token = await config.reloginHandler();
           recovered = token !== null;
         }
-        if (!recovered) {
-          config.onReloginFailed?.();
-          return response;
-        }
+        if (!recovered) return response;
         const retry = cloneCache.get(request) ?? safeClone(request);
         if (retry) {
           if (token) retry.headers.set("Authorization", `Bearer ${token}`);
@@ -1135,8 +1309,6 @@ function createAutoReloginMiddleware(config) {
               console.warn("[API] Could not retry request after re-login (body already consumed)");
               config.onRetryCloneFailed?.();
             }
-          } else {
-            config.onReloginFailed?.();
           }
         }
       }
@@ -1162,15 +1334,20 @@ function createReloginHandler(deps) {
     const userEmail = deps.authState.getUserEmail();
     if (!userEmail) {
       console.warn("[API] Re-login aborted: no user email");
+      deps.onReloginFailed?.("not-ready");
       return Promise.resolve(null);
     }
+    const fail = (reason) => {
+      deps.onReloginFailed?.(reason);
+      return null;
+    };
     reloginPromise = (async () => {
       try {
         await deps.crypto.ensureReady();
-        const session = await deps.sessionStorage.getSession();
+        const session = await deps.persistence.getSession();
         if (!session) {
           console.warn("[API] Re-login aborted: no session");
-          return null;
+          return fail("not-ready");
         }
         const ed25519PublicKey = session.signingPrivateKey.slice(32, 64);
         const encryptionKeyPair = deps.crypto.deriveEncryptionKeypair({
@@ -1180,22 +1357,17 @@ function createReloginHandler(deps) {
         const timestamp = Math.floor(Date.now() / 1e3);
         const message = `${userEmail}|${timestamp}`;
         const signature = deps.crypto.signMessage(message, session.signingPrivateKey);
-        const ssoState = deps.authState.getSsoState();
-        const isSsoAccount = ssoState.isSsoMode || ssoState.isAuth0Authenticated || !!ssoState.auth0AccessToken;
         let ssoToken = null;
-        if (deps.ssoTokenProvider) {
+        if (deps.authState.isSsoMode()) {
           try {
-            ssoToken = await deps.ssoTokenProvider.getToken();
+            ssoToken = await deps.sso?.getToken() ?? null;
           } catch (error) {
-            console.error("[API] Failed to get SSO token from provider:", error);
+            console.error("[API] Failed to get SSO token:", error);
+          }
+          if (!ssoToken) {
+            console.warn("[API] Re-login aborted: SSO account but no token available");
+            return fail("refused");
           }
-        }
-        if (!ssoToken && ssoState.auth0AccessToken) {
-          ssoToken = ssoState.auth0AccessToken;
-        }
-        if (!ssoToken && isSsoAccount) {
-          console.warn("[API] Re-login aborted: SSO account but no token available");
-          return null;
         }
         const loginResult = await deps.loginProvider.login({
           email: userEmail,
@@ -1203,11 +1375,15 @@ function createReloginHandler(deps) {
           timestamp,
           ssoToken: ssoToken ?? void 0
         });
+        if (loginResult === "unreachable") {
+          console.warn("[API] Re-login failed: server unreachable");
+          return fail("unreachable");
+        }
         if (!loginResult) {
           console.warn("[API] Re-login failed");
-          return null;
+          return fail("refused");
         }
-        await deps.sessionStorage.saveSession({
+        await deps.persistence.saveSession({
           signingPrivateKey: session.signingPrivateKey,
           serverSessionKey: loginResult.sessionKey,
           userExtId: loginResult.userExtId,
@@ -1257,7 +1433,7 @@ function createReloginHandler(deps) {
         console.error("[API] Re-login error:", error);
         lastSuccessToken = null;
         lastSuccessTime = 0;
-        return null;
+        return fail("refused");
       } finally {
         reloginPromise = null;
       }
@@ -1276,7 +1452,7 @@ function createWorkspaceReopener(deps) {
         const workspaceId = deps.authState.getSelectedWorkspaceId();
         const accessToken = deps.getAccessToken();
         if (!workspaceId || !accessToken) return false;
-        const session = await deps.sessionStorage.getSession();
+        const session = await deps.persistence.getSession();
         if (!session?.signingPrivateKey || !session.serverSessionKey) return false;
         await deps.crypto.ensureReady();
         const wrappedKey = await deps.workspaceKeyRefreshProvider.getWrappedKey(
@@ -1306,29 +1482,56 @@ function createWorkspaceReopener(deps) {
     return inFlight;
   };
 }
+function createAllWorkspacesOpener(deps) {
+  return async function openAllWorkspaces() {
+    const accessToken = deps.getAccessToken();
+    if (!accessToken) return;
+    await deps.crypto.ensureReady();
+    const session = await deps.persistence.getSession();
+    if (!session?.signingPrivateKey) return;
+    const sessionKey = deps.getSessionKey(accessToken);
+    if (!sessionKey) return;
+    const sessionKeyBytes = deps.crypto.fromBase64(sessionKey);
+    let workspaces;
+    try {
+      workspaces = await deps.listWorkspaces(accessToken);
+    } catch {
+      return;
+    }
+    for (const ws of workspaces ?? []) {
+      if (!ws.wrapped_key || !ws.external_id) continue;
+      try {
+        const workspaceKey = deps.unwrapWorkspaceKey(ws.wrapped_key, session.signingPrivateKey);
+        const sealed = await deps.crypto.sealKeyForSession(workspaceKey, sessionKeyBytes);
+        await deps.workspaceOpenProvider.openWorkspace(accessToken, ws.external_id, sealed);
+      } catch (error) {
+        console.warn(`[API] Failed to open workspace ${ws.external_id}:`, error);
+      }
+    }
+  };
+}
 
-// src/auth/register.ts
-async function register(params, deps) {
-  const credentials = await generateRegistrationCredentials(
-    {
-      email: params.email,
-      verification_credential: params.verificationCode,
-      given_name: params.firstName,
-      family_name: params.lastName,
-      picture: params.picture
-    },
-    params.password,
-    deps.deploymentDomain
-  );
-  const response = await deps.fetchClient.POST("/v1/user/register", {
-    body: credentials.request
-  });
-  if (response.error) {
-    throw new Error(
-      `Registration failed: ${typeof response.error === "object" && response.error !== null && "detail" in response.error ? response.error.detail : "Unknown error"}`
+// src/auth/session-claims.ts
+function readSessionClaims(token) {
+  const payload = token?.split(".")[1];
+  if (!payload) return null;
+  let claims;
+  try {
+    const binary = atob(payload.replace(/-/g, "+").replace(/_/g, "/"));
+    claims = JSON.parse(
+      new TextDecoder().decode(Uint8Array.from(binary, (c) => c.charCodeAt(0)))
     );
+  } catch {
+    return null;
   }
-  return { signingPrivateKey: credentials.signingPrivateKey };
+  if (typeof claims !== "object" || claims === null) return null;
+  const { sk, exp } = claims;
+  const sessionKey = typeof sk === "string" && sk ? sk : null;
+  return {
+    sessionKey,
+    sessionId: sessionKey ? sessionKey.slice(0, 12) : null,
+    expiresAt: typeof exp === "number" && Number.isFinite(exp) ? exp * 1e3 : null
+  };
 }
 
 // src/auth/identity.ts
@@ -1355,6 +1558,11 @@ async function unlockIdentityWithPassword(email, password, deploymentDomain) {
 }
 
 // src/auth/login.ts
+function authRequestError(what, error, status) {
+  const detail = typeof error === "object" && error !== null && "detail" in error ? error.detail : void 0;
+  const text = typeof detail === "string" ? detail : "Unknown error";
+  return Object.assign(new Error(`${what} failed: ${text}`), { detail, status });
+}
 async function login(params, deps) {
   const credentials = await generateLoginCredentials(
     {
@@ -1364,7 +1572,12 @@ async function login(params, deps) {
     params.password,
     deps.deploymentDomain
   );
-  return performLogin(credentials.request, { password: credentials.passwordPrivateKey }, deps);
+  return performLogin(
+    credentials.request,
+    { password: credentials.passwordPrivateKey },
+    deps,
+    params.profile
+  );
 }
 async function loginWithKey(params, deps) {
   const credentials = generateLoginCredentialsFromKey(
@@ -1376,27 +1589,42 @@ async function loginWithKey(params, deps) {
   );
   return performLogin(credentials.request, { identity: credentials.signingPrivateKey }, deps);
 }
-async function performLogin(request, signer, deps) {
+async function performLogin(request, signer, deps, profile) {
   const response = await deps.fetchClient.POST("/v1/user/login", {
     body: request
   });
   if (response.error || !response.data) {
-    throw new Error(
-      `Login failed: ${typeof response.error === "object" && response.error !== null && "detail" in response.error ? response.error.detail : "Unknown error"}`
-    );
+    throw authRequestError("Login", response.error, response.response?.status);
   }
   const data = response.data;
   const serverSessionKey = base64ToBytes(data.session_key);
   const signingPrivateKey = "password" in signer ? identityFromLoginResponse(signer.password, data) : signer.identity;
-  await saveSession({
+  await deps.signIn?.before?.({ user: data.user });
+  await (deps.persistence?.saveSession ?? saveSession)({
     signingPrivateKey,
     serverSessionKey,
     userExtId: data.user.external_id ?? void 0,
     wrappedIdentityKey: data.wrapped_identity_key ?? null
   });
-  deps.session.setAccessToken(data.access_token);
-  deps.session.setUser(request.email, data.user.external_id ?? void 0);
+  const email = request.email;
+  deps.session.signIn({
+    accessToken: data.access_token,
+    isSsoMode: !!request.sso_token,
+    serverSessionKey,
+    user: {
+      ...data.user,
+      email,
+      given_name: profile?.given_name ?? data.user.given_name ?? email.split("@")[0],
+      family_name: profile?.family_name ?? data.user.family_name,
+      picture: profile?.picture ?? data.user.picture ?? null,
+      parent_ext_id: data.user.parent_ext_id ?? null,
+      is_sso: data.user.is_sso ?? false,
+      is_identity_verified: data.user.is_identity_verified ?? false
+    }
+  });
+  deps.signIn?.after?.({ response: data, serverSessionKey });
   return {
+    response: data,
     accessToken: data.access_token,
     userExtId: data.user.external_id ?? void 0,
     parentExtId: data.user.parent_ext_id ?? null,
@@ -1413,10 +1641,26 @@ async function performLogin(request, signer, deps) {
   };
 }
 
-// src/auth/logout.ts
-async function logout(session) {
-  session.clear();
-  await clearAllData();
+// src/auth/register.ts
+async function register(params, deps) {
+  const credentials = await generateRegistrationCredentials(
+    {
+      email: params.email,
+      verification_credential: params.verificationCode,
+      given_name: params.firstName,
+      family_name: params.lastName,
+      picture: params.picture
+    },
+    params.password,
+    deps.deploymentDomain
+  );
+  const response = await deps.fetchClient.POST("/v1/user/register", {
+    body: credentials.request
+  });
+  if (response.error) {
+    throw authRequestError("Registration", response.error, response.response?.status);
+  }
+  return { signingPrivateKey: credentials.signingPrivateKey };
 }
 
 // src/auth/change-password.ts
@@ -1455,29 +1699,6 @@ async function changePassword(params, deps) {
   return { wrappedIdentityKey: request.wrapped_identity_key };
 }
 
-// src/auth/session-claims.ts
-function readSessionClaims(token) {
-  const payload = token?.split(".")[1];
-  if (!payload) return null;
-  let claims;
-  try {
-    const binary = atob(payload.replace(/-/g, "+").replace(/_/g, "/"));
-    claims = JSON.parse(
-      new TextDecoder().decode(Uint8Array.from(binary, (c) => c.charCodeAt(0)))
-    );
-  } catch {
-    return null;
-  }
-  if (typeof claims !== "object" || claims === null) return null;
-  const { sk, exp } = claims;
-  const sessionKey = typeof sk === "string" && sk ? sk : null;
-  return {
-    sessionKey,
-    sessionId: sessionKey ? sessionKey.slice(0, 12) : null,
-    expiresAt: typeof exp === "number" && Number.isFinite(exp) ? exp * 1e3 : null
-  };
-}
-
 // src/client.ts
 var API_PREFIX = "/v1";
 var RETRYABLE_CODES = /* @__PURE__ */ new Set([
@@ -1514,24 +1735,42 @@ function createRetryFetch() {
     throw lastError;
   };
 }
+var HTTP_METHODS = ["GET", "PUT", "POST", "DELETE", "OPTIONS", "HEAD", "PATCH", "TRACE"];
+function readBaseUrlPerRequest(fetchClient, base) {
+  const methods = fetchClient;
+  for (const method of HTTP_METHODS) {
+    const call = methods[method].bind(fetchClient);
+    methods[method] = (url, init) => call(url, { ...init, baseUrl: base() });
+  }
+  const request = methods.request.bind(fetchClient);
+  methods.request = (method, url, init) => request(method, url, { ...init, baseUrl: base() });
+}
+var deploymentDomainOf = ({ deploymentDomain }) => typeof deploymentDomain === "function" ? deploymentDomain() : deploymentDomain;
 function createArbiClient(options) {
-  const { fetch: fetch2, session, relogin, reopenWorkspace } = options.transport ?? createTransport(options);
-  const authDeps = { fetchClient: fetch2, session, deploymentDomain: options.deploymentDomain };
+  const { fetch: fetch2, session, persistence, workspaceKeys, auth } = createTransport(options);
+  const authDeps = {
+    fetchClient: fetch2,
+    session,
+    get deploymentDomain() {
+      return deploymentDomainOf(options);
+    },
+    persistence,
+    signIn: options.signIn
+  };
   return {
     fetch: fetch2,
+    workspaceKeys,
     session,
     auth: {
       register: (params) => register(params, authDeps),
       login: (params) => login(params, authDeps),
       loginWithKey: (params) => loginWithKey(params, authDeps),
-      logout: () => logout(session),
       changePassword: (params) => changePassword(params, authDeps),
-      relogin,
-      reopenWorkspace
+      ...auth
     },
     crypto: {
       initSodium,
-      generateUserKeypairs: (email, password) => generateUserKeypairs(email, password, options.deploymentDomain),
+      generateUserKeypairs: (email, password) => generateUserKeypairs(email, password, deploymentDomainOf(options)),
       signMessage,
       sealedBoxDecrypt,
       sealedBoxEncrypt,
@@ -1557,24 +1796,22 @@ function createArbiClient(options) {
 }
 function createTransport(options) {
   const {
-    baseUrl,
-    reloginExcludePatterns = [`${API_PREFIX}/user/login`],
+    reloginExcludePatterns = [`${API_PREFIX}/user/login`, `${API_PREFIX}/user/logout`],
     credentials = "include",
-    ssoTokenProvider = null,
+    sso = null,
+    middleware = [],
     onReloginSuccess,
-    onSessionExpired,
-    sessionStorage: sessionStorageOverride,
+    onRetryCloneFailed,
     userEmail
   } = options;
-  const sessionStorage = sessionStorageOverride ?? {
-    getSession,
-    saveSession
-  };
+  const persistence = options.persistence ?? { getSession, saveSession };
+  const baseUrlOption = options.baseUrl;
+  const base = typeof baseUrlOption === "function" ? baseUrlOption : () => baseUrlOption;
   const retryFetch = createRetryFetch();
-  const session = createSessionManager();
+  const session = options.session ?? createSessionManager();
   if (userEmail) session.setUser(userEmail);
   const tokenProvider = createTokenProvider(session);
-  const authState = createAuthStateProvider(session);
+  const authState = createAuthStateProvider(session, options.selectedWorkspace);
   const cryptoProvider = {
     ensureReady: initSodium,
     signMessage,
@@ -1583,11 +1820,10 @@ function createTransport(options) {
     sealKeyForSession,
     fromBase64: base64ToBytes
   };
-  let reloginUnreachable = false;
   const loginProvider = {
     async login(payload) {
       const rawFetch = createFetchClient({
-        baseUrl,
+        baseUrl: base(),
         credentials,
         fetch: retryFetch
       });
@@ -1603,8 +1839,7 @@ function createTransport(options) {
         });
       } catch (error) {
         console.warn("[API] Login call unreachable:", error);
-        reloginUnreachable = true;
-        return null;
+        return "unreachable";
       }
       if (response.error || !response.data) {
         console.warn("[API] Login call failed:", response.error);
@@ -1619,81 +1854,219 @@ function createTransport(options) {
       };
     }
   };
-  const workspaceKeyRefreshProvider = {
-    async getWrappedKey(accessToken, workspaceId) {
-      const workspacesResponse = await retryFetch(`${baseUrl}${API_PREFIX}/user/workspaces`, {
-        method: "GET",
-        headers: {
-          Authorization: `Bearer ${accessToken}`,
-          "Content-Type": "application/json"
-        },
-        credentials
-      });
-      if (!workspacesResponse.ok) return null;
-      const workspacesData = await workspacesResponse.json();
-      const workspace = workspacesData.find(
-        (w) => w.external_id === workspaceId
+  async function listWorkspaces(accessToken) {
+    const response = await retryFetch(`${base()}${API_PREFIX}/user/workspaces`, {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        "Content-Type": "application/json"
+      },
+      credentials
+    });
+    return response.ok ? response.json() : null;
+  }
+  const workspaceKeys = createWorkspaceKeys({
+    crypto: cryptoProvider,
+    unwrapWorkspaceKey,
+    persistence,
+    getAccessToken: () => session.getState().accessToken,
+    getServerSessionKey: () => session.getState().serverSessionKey,
+    listWorkspaces,
+    async primeKey(accessToken, workspaceId, sealedKey) {
+      const response = await retryFetch(
+        `${base()}${API_PREFIX}/workspace/${workspaceId}/prime-key`,
+        {
+          method: "POST",
+          headers: { Authorization: `Bearer ${accessToken}`, "Content-Type": "application/json" },
+          body: JSON.stringify({ workspace_key: sealedKey }),
+          credentials
+        }
       );
-      return workspace?.wrapped_key ?? null;
+      if (!response.ok) throw new Error(`Could not unlock the workspace (${response.status})`);
+    }
+  });
+  let keysUser = session.getState().signedIn ? session.getState().userExtId : null;
+  session.subscribe((state) => {
+    const user = state.signedIn ? state.userExtId : null;
+    if (user !== keysUser) workspaceKeys.clear();
+    keysUser = user;
+  });
+  const workspaceKeyRefreshProvider = {
+    async getWrappedKey(_accessToken, workspaceId) {
+      return (await workspaceKeys.wrappedKey(workspaceId).catch(() => null))?.wrappedKey ?? null;
     }
   };
   const workspaceOpenProvider = {
     async openWorkspace(accessToken, workspaceId, encryptedWorkspaceKey) {
+      const query = "?include_documents=false&include_conversations=false&include_tags=false";
       try {
-        const response = await retryFetch(`${baseUrl}${API_PREFIX}/workspace/${workspaceId}/open`, {
-          method: "POST",
-          headers: {
-            Authorization: `Bearer ${accessToken}`,
-            "Content-Type": "application/json"
-          },
-          body: JSON.stringify({ workspace_key: encryptedWorkspaceKey }),
-          credentials
-        });
+        const response = await retryFetch(
+          `${base()}${API_PREFIX}/workspace/${workspaceId}/open${query}`,
+          {
+            method: "POST",
+            headers: {
+              Authorization: `Bearer ${accessToken}`,
+              "Content-Type": "application/json"
+            },
+            body: JSON.stringify({ workspace_key: encryptedWorkspaceKey }),
+            credentials
+          }
+        );
         return response.ok ? true : null;
       } catch {
         return null;
       }
     }
   };
-  const rawReloginHandler = createReloginHandler({
+  let lastFailure = null;
+  const expiredListeners = /* @__PURE__ */ new Set();
+  const rawRelogin = createReloginHandler({
     crypto: cryptoProvider,
-    sessionStorage,
+    persistence,
     authState,
-    ssoTokenProvider,
+    sso,
     loginProvider,
     workspaceKeyRefreshProvider,
     workspaceOpenProvider,
-    onReloginSuccess
+    // The new server session key goes into the session before the token: whatever re-renders on
+    // the token reads the key that goes with it.
+    async onReloginSuccess(data) {
+      session.setServerSessionKey(data.serverSessionKey);
+      await onReloginSuccess?.(data);
+    },
+    onReloginFailed: (reason) => {
+      lastFailure = reason;
+    }
   });
-  const reloginHandler = () => {
-    reloginUnreachable = false;
-    return rawReloginHandler();
-  };
+  async function relogin() {
+    const tokenBefore = session.getState().accessToken;
+    const token = await rawRelogin();
+    if (token) return token;
+    const tokenNow = session.getState().accessToken;
+    if (tokenNow && tokenNow !== tokenBefore) return tokenNow;
+    if (lastFailure === "refused") {
+      lastFailure = null;
+      session.clear();
+      for (const listener of [...expiredListeners]) listener();
+    }
+    return null;
+  }
   const reopenWorkspace = createWorkspaceReopener({
     crypto: cryptoProvider,
-    sessionStorage,
+    persistence,
     authState,
     getAccessToken: () => session.getState().accessToken,
     workspaceKeyRefreshProvider,
     workspaceOpenProvider
   });
+  const openAllWorkspaces = createAllWorkspacesOpener({
+    crypto: cryptoProvider,
+    persistence,
+    getAccessToken: () => session.getState().accessToken,
+    getSessionKey: (accessToken) => readSessionClaims(accessToken)?.sessionKey ?? null,
+    unwrapWorkspaceKey,
+    listWorkspaces: async (accessToken) => {
+      const list = await listWorkspaces(accessToken);
+      return list && workspaceKeys.remember(list);
+    },
+    workspaceOpenProvider
+  });
   const fetchClient = createFetchClient({
-    baseUrl,
+    baseUrl: base(),
     credentials,
     fetch: retryFetch
   });
+  if (typeof baseUrlOption === "function") readBaseUrlPerRequest(fetchClient, base);
   fetchClient.use(createBearerAuthMiddleware({ tokenProvider }));
+  for (const m of middleware) fetchClient.use(m);
   fetchClient.use(
     createAutoReloginMiddleware({
-      reloginHandler,
+      reloginHandler: relogin,
       reloginExcludePatterns,
       reopenWorkspaceHandler: reopenWorkspace,
-      onReloginFailed: () => {
-        if (!reloginUnreachable && session.getState().userEmail) onSessionExpired?.();
-      }
+      primeWorkspaceHandler: (workspaceId) => workspaceKeys.prime(workspaceId, { force: true }).then(
+        () => true,
+        (error) => {
+          console.warn("[API] Could not unlock workspace", workspaceId, error);
+          return false;
+        }
+      ),
+      onRetryCloneFailed
     })
   );
-  return { fetch: fetchClient, session, relogin: reloginHandler, reopenWorkspace };
+  return {
+    fetch: fetchClient,
+    session,
+    persistence,
+    workspaceKeys,
+    auth: {
+      relogin,
+      reopenWorkspace,
+      openAllWorkspaces,
+      async logout({ everywhere = false } = {}) {
+        if (session.getState().accessToken) {
+          try {
+            await fetchClient.POST("/v1/user/logout", {
+              params: { query: { all_sessions: everywhere } }
+            });
+          } catch (error) {
+            console.warn("[API] Server logout failed:", error);
+          }
+        }
+        session.clear();
+        if (everywhere) await clearAllData();
+      },
+      async unlock({ email, password }) {
+        const saved = await persistence.getSession();
+        if (!saved?.signingPrivateKey) throw new Error("no-session");
+        let signingPrivateKey;
+        try {
+          signingPrivateKey = await unlockIdentityWithPassword(
+            email,
+            password,
+            deploymentDomainOf(options)
+          );
+        } catch {
+          throw new Error("bad-password");
+        }
+        const { publicKey } = encryptionKeypairFromSigningKey(signingPrivateKey);
+        session.signIn({
+          accessToken: null,
+          isSsoMode: false,
+          serverSessionKey: saved.serverSessionKey ?? null,
+          user: {
+            email,
+            given_name: email.split("@")[0],
+            family_name: null,
+            picture: null,
+            external_id: saved.userExtId ?? "",
+            parent_ext_id: null,
+            encryption_public_key: bytesToBase64(publicKey),
+            is_sso: false,
+            is_identity_verified: false,
+            temporary_access_only: false
+          }
+        });
+      },
+      async restore() {
+        if (!session.getState().signedIn) return false;
+        const keys = await persistence.getSession().catch(() => null);
+        if (session.getState().serverSessionKey) return true;
+        if (keys?.signingPrivateKey && keys.serverSessionKey) {
+          session.setServerSessionKey(keys.serverSessionKey);
+          return true;
+        }
+        session.clear();
+        return false;
+      },
+      onSessionExpired(listener) {
+        expiredListeners.add(listener);
+        return () => {
+          expiredListeners.delete(listener);
+        };
+      }
+    }
+  };
 }
 
 // src/websocket.ts
@@ -1721,6 +2094,6 @@ function isMessageType(msg, type) {
   return msg.type === type;
 }
 
-export { API_PREFIX, CALL_KEY_BYTES, CHAT_KEY_BYTES, ENCRYPTED_RECOVERY_KEY_SIZE, RECOVERY_KEY_ERRORS, SECURE_MAIL_KEY_BYTES, UNENCRYPTED_RECOVERY_KEY_SIZE, base64Decode, base64Encode, base64ToBytes, base64UrlToBytes, buildCallFragment, buildWebSocketUrl, bytesToBase64, bytesToBase64Url, canPersistSession, changePassword, clearAllData, clearSession, computeSharedSecret, createArbiClient, createAuthMessage, createAutoReloginMiddleware, createBearerAuthMiddleware, createContentHash, createOfflineSealer, createRecoveryFile, createRecoveryUrl, createReloginHandler, createSessionManager, createWorkspaceReopener, decodeCallKey, decodeSecureMailKey, decryptCallTitle, decryptFile, decryptMessage, decryptMessageWithSharedSecret, decryptRecoveryKey, decryptWithChatKey, deriveDirectChatKey, deriveEncryptionKeypairFromSigning, derivePublicKey, encodeCallKey, encryptCallTitle, encryptFile, encryptMessage, encryptMessageWithSharedSecret, encryptRecoveryKey, encryptWithChatKey, encryptionKeypairFromSigningKey, generateCallKey, generateChatKey, generateIdentityKeypair, generateKeyPairs, generateLoginCredentials, generateLoginCredentialsFromKey, generatePasswordChangeCredentials, generateRandomSigningKeypair, generateRegistrationCredentials, generateUserKeypairs, getRecoveryKeyFilename, getSession, getUserEncryptionKeypair, hasSession, identityFromLoginResponse, initSodium, initializeDatabase, isEncryptedRecoveryKey, isMessageType, openSealedCallKey, openSealedChatKey, openSecureMail, parseCallFragment, parseRecoveryUrl, parseServerMessage, passwordChangeErrorMessage, prewarmKeyPairs, readSessionClaims, saveSession, sealCallKey, sealChatKey, sealKeyForSession, sealSecureMail, sealedBoxDecrypt, sealedBoxEncrypt, secureMailClaim, signMessage, unlockIdentityWithPassword, unwrapIdentityKey, unwrapWorkspaceKey, updateWrappedIdentityKey, validateRecoveryKeyFile, wrapIdentityKey };
+export { ACCESS_TOKEN_STORAGE_KEY, API_PREFIX, CALL_KEY_BYTES, CHAT_KEY_BYTES, ENCRYPTED_RECOVERY_KEY_SIZE, RECOVERY_KEY_ERRORS, SECURE_MAIL_KEY_BYTES, UNENCRYPTED_RECOVERY_KEY_SIZE, authRequestError, base64Decode, base64Encode, base64ToBytes, base64UrlToBytes, browserSessionStateStorage, buildCallFragment, buildCallLink, buildWebSocketUrl, bytesToBase64, bytesToBase64Url, canPersistSession, changePassword, clearAllData, clearSession, computeSharedSecret, createAllWorkspacesOpener, createArbiClient, createAuthMessage, createAutoReloginMiddleware, createBearerAuthMiddleware, createContentHash, createOfflineSealer, createRecoveryFile, createRecoveryUrl, createReloginHandler, createSessionManager, createWorkspaceKeys, createWorkspaceReopener, decodeCallKey, decodeSecureMailKey, decryptCallTitle, decryptFile, decryptMessage, decryptMessageWithSharedSecret, decryptRecoveryKey, decryptWithChatKey, deriveDirectChatKey, deriveEncryptionKeypairFromSigning, derivePublicKey, encodeCallKey, encryptCallTitle, encryptFile, encryptMessage, encryptMessageWithSharedSecret, encryptRecoveryKey, encryptWithChatKey, encryptionKeypairFromSigningKey, generateCallKey, generateChatKey, generateIdentityKeypair, generateKeyPairs, generateLoginCredentials, generateLoginCredentialsFromKey, generatePasswordChangeCredentials, generateRandomSigningKeypair, generateRegistrationCredentials, generateUserKeypairs, getRecoveryKeyFilename, getSession, getUserEncryptionKeypair, hasSession, identityFromLoginResponse, initSodium, initializeDatabase, isEncryptedRecoveryKey, isMessageType, openCallKeyOf, openSealedCallKey, openSealedChatKey, openSecureMail, parseCallFragment, parseRecoveryUrl, parseServerMessage, passwordChangeErrorMessage, prewarmKeyPairs, readSessionClaims, saveSession, sealCallKey, sealCallKeyForPeers, sealChatKey, sealKeyForSession, sealSecureMail, sealedBoxDecrypt, sealedBoxEncrypt, secureMailClaim, signMessage, unlockIdentityWithPassword, unwrapIdentityKey, unwrapWorkspaceKey, updateWrappedIdentityKey, validateRecoveryKeyFile, workspaceKeyRequiredOf, wrapIdentityKey };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map