@arbidocs/client 0.4.167 → 0.4.168

package/README.md

@@ -190,11 +190,21 @@ interface ArbiClientOptions {
   baseUrl: string              // ARBI API URL (e.g. "https://www.arbidocs.com")
   deploymentDomain: string     // Used for deterministic key derivation
   credentials?: RequestCredentials  // Default: 'include'. Use 'omit' for Node.js
-  ssoTokenProvider?: { getToken(): Promise<string | null> } | null
+  session?: SessionManager           // The host's session state; default: in-memory
+  persistence?: SessionPersistence   // Keys between page loads; default: encrypted IndexedDB
+  sso?: SsoTokenSource | null        // The SSO provider's token, asked only in SSO mode
+  middleware?: Middleware[]          // Host middleware, run before the re-login middleware
+  reloginExcludePatterns?: string[]  // Paths whose 401 never re-logs in
   onReloginSuccess?: (data) => void
+  onRetryCloneFailed?: () => void
 }
 ```
 
+The client owns the session recovery: a 401 re-logs in once for every request that failed
+(single-flight, a 5s cooldown), a 400 "No active workspace" re-opens the workspace, and a re-login
+the server refused ends the session (`session.clear()`, then `auth.onSessionExpired` listeners). A
+login still finishing or an unreachable server leaves the session alone.
+
 Returns an `ArbiClient` with these namespaces:
 
 | Namespace | Description |
@@ -225,6 +235,12 @@ await arbi.auth.logout()
 
 // Re-login using stored private key (auto-called by middleware on 401)
 await arbi.auth.relogin()
+
+// "The session could not be recovered": show the sign-in screen
+const off = arbi.auth.onSessionExpired(() => showSignIn())
+
+// Seal every workspace key to this server session (before deriving an MCP session from it)
+await arbi.auth.openAllWorkspaces()
 ```
 
 ### Middleware (Auto-Applied)