@arbidocs/client 0.4.167 → 0.4.168

package/dist/index.d.ts

@@ -3563,6 +3563,12 @@ interface paths {
         /**
          * Cancel Response
          * @description Stop an owned response while preserving its agent login and sandbox.
+         *
+         *     The stop is the person's decision and is stored whatever state the run is in. The run is cancelled here when
+         *     it runs on this process, else through the ``cancel_response`` broadcast, and a stop marker lets its heartbeat
+         *     pick the stop up if the broadcast never reached it. When the run does not confirm within ``STOP_CONFIRM_S``
+         *     (its process is not servicing its event loop, or is gone) the endpoint stores the turn ``cancelled`` itself,
+         *     so a reload never shows the stopped turn generating again.
          */
         post: operations['cancel_response'];
         delete?: never;
@@ -4998,7 +5004,9 @@ interface paths {
          *       webinar, on stage (403 ``not_on_stage``).
          *     * ``composite``: the host's view, host only, ``audio_video`` recordings only (422 ``composite_needs_video``).
          *
-         *     409 ``recording_stopped`` once the recording has stopped.
+         *     A new track is taken while recording and for the stop's grace window (409 ``recording_stopped`` later), like the
+         *     parts: the in-flight tail of someone whose first part comes at the stop (a recording shorter than one part, or
+         *     a speaker who started in its last part) belongs to the recording.
          */
         post: operations['create_call_recording_track'];
         delete?: never;
@@ -5047,7 +5055,9 @@ interface paths {
          * @description Commit an uploaded part: the object must exist (409 ``part_not_uploaded``) and be no larger than declared
          *     plus a small tolerance (422 ``size_mismatch``: the object is deleted; presign and PUT again). The stored size is
          *     recorded and counts towards the project's storage from now on. Committing a committed part returns it. 404 for
-         *     an undeclared ``seq``; 409 ``recording_stopped`` after the stop's grace window.
+         *     an undeclared ``seq``; 409 ``recording_stopped`` after the stop's grace window. A part committed after the stop
+         *     (the tail) is announced to the room audience, WS ``call.recording_updated {call_ext_id, recording_ext_id}``, so
+         *     the Recording cards already shown re-read the recording.
          */
         post: operations['commit_call_recording_part'];
         delete?: never;
@@ -8090,7 +8100,8 @@ interface components {
          *     session_pubkey_b64 (optional): If set, the grant is temporary and scoped to the
          *     recipient's current session (identified by this X25519 public key). The workspace
          *     key is stored in that session's Redis entry and the workspaceusers row expires when
-         *     the session expires. Omit for a permanent grant (default behaviour).
+         *     the session expires. Omit for a permanent grant for paid recipients. External
+         *     recipients always receive a Redis-backed grant of at most 24 hours.
          *
          *     confirm_invite (default False): an email that isn't a registered user is never
          *     invited on a call with this unset — it's silently left out of the response (same
@@ -8125,8 +8136,12 @@ interface components {
             workspace_ext_id?: string | null;
             /** Session Pubkey B64 */
             session_pubkey_b64?: string | null;
-            /** External access duration in seconds, at most 24 hours. @default 86400 */
-            access_duration_seconds?: number;
+            /**
+             * Access Duration Seconds
+             * @description External recipients always receive an expiring grant, at most 24 hours, across login sessions.
+             * @default 86400
+             */
+            access_duration_seconds: number;
             /** Confirm Invite */
             confirm_invite?: boolean | null;
             /** Resource Type */
@@ -8605,8 +8620,8 @@ interface components {
             SUGGESTED_QUERIES: boolean;
             /**
              * Artifacts Enabled
-             * @description Enable the create_artifact tool for generating standalone documents (summaries, reports, drafts) displayed in a side panel.
-             * @default false
+             * @description Documents: enable the create_artifact tool, which drafts standalone documents (letters, reports, summaries) and saves them to the workspace as Word documents.
+             * @default true
              */
             ARTIFACTS_ENABLED: boolean;
             /**
@@ -8804,12 +8819,12 @@ interface components {
              *
              *     DOCUMENT STRATEGY, in order:
              *     1. Listing or cataloguing documents: use the document index already in your prompt — no tool calls needed.
-             *     2. Getting oriented in a document you have not read: call get_table_of_contents FIRST. It is cheap, returns the heading structure with page references, and tells you which pages actually matter. Do this before any read_document on a document longer than a few pages, rather than reading blind and then discovering the structure.
+             *     [[if get_table_of_contents, search_inside_documents, read_document: 2. Getting oriented in a document you have not read: call get_table_of_contents FIRST. It is cheap, returns the heading structure with page references, and tells you which pages actually matter. Do this before any read_document on a document longer than a few pages, rather than reading blind and then discovering the structure.
              *     3. Specific questions across several documents: search_inside_documents to locate the passages, then read_document on the pages it points to.
              *     4. Reading a document: read_document with page ranges for the sections you need, or with no ranges to load the complete text. A read with no ranges returns the WHOLE document — once you have it there is nothing further to retrieve from that document. Do not read it again, do not re-read ranges out of it, and do not ask for its outline afterwards.
              *     5. Prefer digest=true from the outset. It is the normal retrieval mode: findings with citations, compact context. Decide against it only when the task needs the exact words — translation, quotation, close reading of style or drafting. Choosing digest=false IS that decision, and it is final for that document: digest is a way of retrieving, not a way of processing text you already hold, so once you have loaded a document in full a digest of it is refused. Reason over the text you have.
              *     6. Open-ended investigative queries ("find interesting things", "what's notable", "what stands out", "explore X", "what should I know about", "any findings", "anything unusual", "key insights"): ALWAYS call search_inside_documents with multiple diverse queries covering different aspects of the documents before answering. The document index is never sufficient for investigative answers — you must retrieve actual content.
-             *     7. Never search for meta-queries like "summary", "overview", or "all documents" — search for the actual subject matter.
+             *     7. Never search for meta-queries like "summary", "overview", or "all documents" — search for the actual subject matter.]]
              *
              *     FORMATTING:
              *     - Start your answer directly with the content.
@@ -8890,8 +8905,8 @@ interface components {
             SUGGESTED_QUERIES: boolean;
             /**
              * Artifacts Enabled
-             * @description Enable the create_artifact tool for generating standalone documents (summaries, reports, drafts) displayed in a side panel.
-             * @default false
+             * @description Documents: enable the create_artifact tool, which drafts standalone documents (letters, reports, summaries) and saves them to the workspace as Word documents.
+             * @default true
              */
             ARTIFACTS_ENABLED: boolean;
             /**
@@ -9003,7 +9018,7 @@ interface components {
              *       "DEEP_RESEARCH_ENABLED": true,
              *       "SUBAGENTS_ENABLED": true,
              *       "SUGGESTED_QUERIES": true,
-             *       "ARTIFACTS_ENABLED": false,
+             *       "ARTIFACTS_ENABLED": true,
              *       "IMAGE_ENABLED": true,
              *       "VISION_ENABLED": false,
              *       "CONVERSATION_SEARCH_ENABLED": true,
@@ -9033,7 +9048,7 @@ interface components {
              *       "AGENT_MAX_RUN_TOKENS": 1500000,
              *       "AGENT_MAX_SUBAGENT_SPAWNS": 4,
              *       "AGENT_HISTORY_TOKEN_BUDGET": 48000,
-             *       "AGENT_SYSTEM_PROMPT": "Answer any question the user asks. You have access to workspace documents — use them when relevant. When no documents are relevant, answer from your own knowledge. Always provide a helpful answer.\n\nWhen using documents, retrieve actual document content — do not rely on metadata or headings alone. Cross-check information across sources. Not all assertions in sources are factual — some are arguments by a party. Attribute claims to their source where parties disagree.\n\nDOCUMENT INDEX:\nThe \"Workspace Documents\" table in your system prompt lists every document with its Id, Title, Date, and Pages. The Subject field is a brief navigation label only — it does not contain enough information to answer questions about a document's content. Use this table directly when the user asks to list, catalogue, or tabulate documents — do NOT call any tools for that. Only use tools when you need to read or search document content.\n\nREADING TOOL RESULTS:\nEvery retrieval result opens with a CAPTION line naming the call that produced it, what it contains, and what it does not (for example \"FULL CONTENT … complete verbatim text, all 10 pages\" or \"DIGEST … verbatim page text is NOT part of this result\"). The caption also tells you when you already retrieved that material earlier in this turn. Read it before choosing your next call — it is the record of what you already hold.\n\nDOCUMENT STRATEGY, in order:\n1. Listing or cataloguing documents: use the document index already in your prompt — no tool calls needed.\n2. Getting oriented in a document you have not read: call get_table_of_contents FIRST. It is cheap, returns the heading structure with page references, and tells you which pages actually matter. Do this before any read_document on a document longer than a few pages, rather than reading blind and then discovering the structure.\n3. Specific questions across several documents: search_inside_documents to locate the passages, then read_document on the pages it points to.\n4. Reading a document: read_document with page ranges for the sections you need, or with no ranges to load the complete text. A read with no ranges returns the WHOLE document — once you have it there is nothing further to retrieve from that document. Do not read it again, do not re-read ranges out of it, and do not ask for its outline afterwards.\n5. Prefer digest=true from the outset. It is the normal retrieval mode: findings with citations, compact context. Decide against it only when the task needs the exact words — translation, quotation, close reading of style or drafting. Choosing digest=false IS that decision, and it is final for that document: digest is a way of retrieving, not a way of processing text you already hold, so once you have loaded a document in full a digest of it is refused. Reason over the text you have.\n6. Open-ended investigative queries (\"find interesting things\", \"what's notable\", \"what stands out\", \"explore X\", \"what should I know about\", \"any findings\", \"anything unusual\", \"key insights\"): ALWAYS call search_inside_documents with multiple diverse queries covering different aspects of the documents before answering. The document index is never sufficient for investigative answers — you must retrieve actual content.\n7. Never search for meta-queries like \"summary\", \"overview\", or \"all documents\" — search for the actual subject matter.\n\nFORMATTING:\n- Start your answer directly with the content.\n- Use markdown: headings, bold, bullet points, numbered lists\n- Main conclusion first, followed by supporting points\n- Bullet points for lists of discrete items\n- Numbering for sequential steps or prioritized items\n- Bold text for critical conclusions or decision points\n\nTOOL CALLING:\n- Your job is to gather the context the question needs, then answer. Do not give a final answer while there is relevant context you have not yet retrieved — but material already in your context counts as retrieved, and fetching it a second time is not progress. If the question touches a workspace document, always check the source — never answer from a past turn's reply alone.\n- Always invoke tools using the tool-calling mechanism. Say what a call is doing in its `focus` argument.\n\nEFFICIENCY:\n1. Before each step, review the results of prior steps. Adapt your approach based on what you learned — if a call was rejected or returned poor results, adjust your strategy.\n2. Call multiple tools in parallel when a query has several aspects.\n3. NEVER repeat a tool call with the same arguments, and never re-retrieve material you already hold — the caption on each result tells you what that is.\n4. Use targeted queries and narrow page ranges per retrieval call.\n5. Stop when you have sufficient evidence — do not over-research."
+             *       "AGENT_SYSTEM_PROMPT": "Answer any question the user asks. You have access to workspace documents — use them when relevant. When no documents are relevant, answer from your own knowledge. Always provide a helpful answer.\n\nWhen using documents, retrieve actual document content — do not rely on metadata or headings alone. Cross-check information across sources. Not all assertions in sources are factual — some are arguments by a party. Attribute claims to their source where parties disagree.\n\nDOCUMENT INDEX:\nThe \"Workspace Documents\" table in your system prompt lists every document with its Id, Title, Date, and Pages. The Subject field is a brief navigation label only — it does not contain enough information to answer questions about a document's content. Use this table directly when the user asks to list, catalogue, or tabulate documents — do NOT call any tools for that. Only use tools when you need to read or search document content.\n\nREADING TOOL RESULTS:\nEvery retrieval result opens with a CAPTION line naming the call that produced it, what it contains, and what it does not (for example \"FULL CONTENT … complete verbatim text, all 10 pages\" or \"DIGEST … verbatim page text is NOT part of this result\"). The caption also tells you when you already retrieved that material earlier in this turn. Read it before choosing your next call — it is the record of what you already hold.\n\nDOCUMENT STRATEGY, in order:\n1. Listing or cataloguing documents: use the document index already in your prompt — no tool calls needed.\n[[if get_table_of_contents, search_inside_documents, read_document: 2. Getting oriented in a document you have not read: call get_table_of_contents FIRST. It is cheap, returns the heading structure with page references, and tells you which pages actually matter. Do this before any read_document on a document longer than a few pages, rather than reading blind and then discovering the structure.\n3. Specific questions across several documents: search_inside_documents to locate the passages, then read_document on the pages it points to.\n4. Reading a document: read_document with page ranges for the sections you need, or with no ranges to load the complete text. A read with no ranges returns the WHOLE document — once you have it there is nothing further to retrieve from that document. Do not read it again, do not re-read ranges out of it, and do not ask for its outline afterwards.\n5. Prefer digest=true from the outset. It is the normal retrieval mode: findings with citations, compact context. Decide against it only when the task needs the exact words — translation, quotation, close reading of style or drafting. Choosing digest=false IS that decision, and it is final for that document: digest is a way of retrieving, not a way of processing text you already hold, so once you have loaded a document in full a digest of it is refused. Reason over the text you have.\n6. Open-ended investigative queries (\"find interesting things\", \"what's notable\", \"what stands out\", \"explore X\", \"what should I know about\", \"any findings\", \"anything unusual\", \"key insights\"): ALWAYS call search_inside_documents with multiple diverse queries covering different aspects of the documents before answering. The document index is never sufficient for investigative answers — you must retrieve actual content.\n7. Never search for meta-queries like \"summary\", \"overview\", or \"all documents\" — search for the actual subject matter.]]\n\nFORMATTING:\n- Start your answer directly with the content.\n- Use markdown: headings, bold, bullet points, numbered lists\n- Main conclusion first, followed by supporting points\n- Bullet points for lists of discrete items\n- Numbering for sequential steps or prioritized items\n- Bold text for critical conclusions or decision points\n\nTOOL CALLING:\n- Your job is to gather the context the question needs, then answer. Do not give a final answer while there is relevant context you have not yet retrieved — but material already in your context counts as retrieved, and fetching it a second time is not progress. If the question touches a workspace document, always check the source — never answer from a past turn's reply alone.\n- Always invoke tools using the tool-calling mechanism. Say what a call is doing in its `focus` argument.\n\nEFFICIENCY:\n1. Before each step, review the results of prior steps. Adapt your approach based on what you learned — if a call was rejected or returned poor results, adjust your strategy.\n2. Call multiple tools in parallel when a query has several aspects.\n3. NEVER repeat a tool call with the same arguments, and never re-retrieve material you already hold — the caption on each result tells you what that is.\n4. Use targeted queries and narrow page ranges per retrieval call.\n5. Stop when you have sufficient evidence — do not over-research."
              *     }
              */
             Agents: components['schemas']['AgentsConfig'];
@@ -9195,7 +9210,7 @@ interface components {
              *       "API_TYPE": "remote",
              *       "ENABLE_THINKING": true,
              *       "MODEL_NAME": "Wise",
-             *       "SYSTEM_INSTRUCTION": "You are a research planning assistant. Your job is to analyze a user query and produce a concise, numbered research plan.\n\nYou have access to a workspace of documents. The available tools for executing the plan are:\n- search_inside_documents: Search workspace documents for relevant passages (semantic, keyword, or hybrid). Use digest=true to extract learnings.\n- read_document: Read page ranges or entire documents. Use digest=true to extract learnings with citations.\n- get_table_of_contents: Get document headings with page references\n\nConsider:\n- What information is needed to answer the query\n- Which documents are likely relevant based on the document index\n- What search queries and document passages to examine\n- What order of operations will be most efficient\n- Whether parallel searches can be used for different aspects\n\nRespond with ONLY the plan (numbered steps). Do not execute any steps.",
+             *       "SYSTEM_INSTRUCTION": "You are a research planning assistant. Your job is to analyze a user query and produce a concise, numbered research plan.\n\nYou have access to a workspace of documents.[[if search_inside_documents, read_document, get_table_of_contents:  The available tools for executing the plan are:\n- search_inside_documents: Search workspace documents for relevant passages (semantic, keyword, or hybrid). Use digest=true to extract learnings.\n- read_document: Read page ranges or entire documents. Use digest=true to extract learnings with citations.\n- get_table_of_contents: Get document headings with page references]]\n\nConsider:\n- What information is needed to answer the query\n- Which documents are likely relevant based on the document index\n- What search queries and document passages to examine\n- What order of operations will be most efficient\n- Whether parallel searches can be used for different aspects\n\nRespond with ONLY the plan (numbered steps). Do not execute any steps.",
              *       "TEMPERATURE": 0.3,
              *       "MAX_TOKENS": 0,
              *       "MAX_TOKEN_SIZE_TO_ANSWER": 200000,
@@ -12853,6 +12868,11 @@ interface components {
              * @default false
              */
             is_identity_verified: boolean;
+            /**
+             * Temporary Access Only
+             * @default false
+             */
+            temporary_access_only: boolean;
             /** Signing Private Key */
             signing_private_key: string;
         };
@@ -13169,6 +13189,11 @@ interface components {
              * @default false
              */
             is_identity_verified: boolean;
+            /**
+             * Temporary Access Only
+             * @default false
+             */
+            temporary_access_only: boolean;
             /** Can Create Projects */
             can_create_projects: boolean;
             /**
@@ -13861,6 +13886,11 @@ interface components {
             error_message?: string | null;
             /** Failed Stage */
             failed_stage?: string | null;
+            /**
+             * Status Seq
+             * @default 0
+             */
+            status_seq: number;
             /** N Pages */
             n_pages?: number | null;
             /** N Chunks */
@@ -17279,6 +17309,13 @@ interface components {
             /** Premium Default */
             premium_default?: string | null;
         };
+        /** NamedSigner */
+        NamedSigner: {
+            /** Email */
+            email: string;
+            /** Name */
+            name: string;
+        };
         /** NativeAliasRead */
         NativeAliasRead: {
             /** Email */
@@ -17874,10 +17911,10 @@ interface components {
              * @description System instruction for the planning LLM.
              * @default You are a research planning assistant. Your job is to analyze a user query and produce a concise, numbered research plan.
              *
-             *     You have access to a workspace of documents. The available tools for executing the plan are:
+             *     You have access to a workspace of documents.[[if search_inside_documents, read_document, get_table_of_contents:  The available tools for executing the plan are:
              *     - search_inside_documents: Search workspace documents for relevant passages (semantic, keyword, or hybrid). Use digest=true to extract learnings.
              *     - read_document: Read page ranges or entire documents. Use digest=true to extract learnings with citations.
-             *     - get_table_of_contents: Get document headings with page references
+             *     - get_table_of_contents: Get document headings with page references]]
              *
              *     Consider:
              *     - What information is needed to answer the query
@@ -21645,6 +21682,11 @@ interface components {
         SuggestSignatureFieldsResponse: {
             /** Fields */
             fields: components['schemas']['SuggestedSignatureField'][];
+            /**
+             * Signers
+             * @description The signers the Word document's placed fields name, with the name each gives, in document order: known even when the PDF shows none of the fields' anchors (fields then placed by hand)
+             */
+            signers?: components['schemas']['NamedSigner'][];
         };
         /** SuggestedSignatureField */
         SuggestedSignatureField: {
@@ -22231,6 +22273,10 @@ interface components {
             failed_stage?: string | null;
             /** Folder */
             folder?: string | null;
+            /** Seq */
+            seq?: number | null;
+            /** Updated At */
+            updated_at?: string | null;
         };
         /** TaxQuoteLine */
         TaxQuoteLine: {
@@ -23363,8 +23409,11 @@ interface components {
              * @default false
              */
             is_identity_verified: boolean;
-            /** Read-only: external recipients may only receive temporary workspace access. */
-            temporary_access_only?: boolean;
+            /**
+             * Temporary Access Only
+             * @default false
+             */
+            temporary_access_only: boolean;
         };
         /**
          * UserRole
@@ -24447,7 +24496,7 @@ interface components {
          * @description User (or agent) with their role in a workspace.
          *
          *     For agents: agent_ext_id is set (agt-XXXXXXXX), name is user.given_name.
-         *     is_temporary: True when the grant is session-scoped (expires_at is set in DB).
+         *     is_temporary: True when the grant expires (expires_at is set in DB).
          */
         WorkspaceUserResponse: {
             user: components['schemas']['UserResponse'];
@@ -24479,7 +24528,7 @@ interface components {
              * @default false
              */
             is_temporary: boolean;
-            /** Fixed UTC expiry of temporary access. */
+            /** Access Expires At */
             access_expires_at?: string | null;
         };
         /**
@@ -37894,6 +37943,7 @@ interface TokenProvider {
 interface BearerAuthMiddlewareConfig {
     tokenProvider: TokenProvider;
 }
+/** The new access token, or `null`. Ending a session the server refused is the handler's job. */
 type ReloginHandler = () => Promise<string | null>;
 interface AutoReloginMiddlewareConfig {
     reloginHandler: ReloginHandler;
@@ -37906,9 +37956,12 @@ interface AutoReloginMiddlewareConfig {
      * re-opens the workspace) is tried instead.
      */
     reopenWorkspaceHandler?: () => Promise<boolean>;
+    /**
+     * Deposit a workspace's key on the session (it named a workspace whose key the session lacks:
+     * 409 `workspace_key_required`). Resolves true when done; the request is then sent again, once.
+     */
+    primeWorkspaceHandler?: (workspaceId: string) => Promise<boolean>;
     onRetryCloneFailed?: () => void;
-    /** Called when re-login was attempted but failed (returned null). Use to clear stale auth state. */
-    onReloginFailed?: () => void;
 }
 
 /**
@@ -37931,26 +37984,33 @@ interface CryptoProvider {
 interface SessionKeys {
     signingPrivateKey: Uint8Array;
     serverSessionKey?: Uint8Array;
+    /** The account these keys belong to. */
+    userExtId?: string;
     /** The identity wrapped under the password key (see SessionData.wrappedIdentityKey). */
     wrappedIdentityKey?: string | null;
 }
-interface SessionStorageProvider {
+/**
+ * Where the signed-in identity is kept between page loads (the signing key and the server session
+ * key). Browsers default to the bundled encrypted IndexedDB store; Node hosts pass a file-backed
+ * one. A silent re-login reads the key from here and saves the new server session key back.
+ */
+interface SessionPersistence {
     getSession(): Promise<SessionKeys | null>;
-    saveSession(data: SessionKeys & {
-        userExtId?: string;
-    }): Promise<void>;
+    saveSession(data: SessionKeys): Promise<void>;
 }
 interface AuthStateProvider {
     getUserEmail(): string | null;
-    getSsoState(): {
-        isSsoMode: boolean;
-        isAuth0Authenticated: boolean;
-        auth0AccessToken: string | null;
-    };
+    /** True when this deployment signs in through SSO: a re-login then needs an SSO token. */
+    isSsoMode(): boolean;
     getSelectedWorkspaceId(): string | null;
     setAccessToken(token: string): void;
 }
-interface SsoTokenProvider {
+/**
+ * The SSO provider's access token for a re-login, or `null` when there is none. The SDK knows no
+ * SSO vendor: the host (or a blocks adapter, e.g. Auth0) supplies this. It is only asked when the
+ * session is in SSO mode.
+ */
+interface SsoTokenSource {
     getToken(): Promise<string | null>;
 }
 /** Result of a successful login API call */
@@ -37961,14 +38021,17 @@ interface LoginResult$1 {
     /** The login response's `wrapped_identity_key`, saved with the session. */
     wrappedIdentityKey?: string | null;
 }
-/** Performs the login API call. Transport details are the consumer's concern. */
+/**
+ * Performs the login API call: the result, `null` when the server refused it, `'unreachable'` when
+ * the server could not be reached.
+ */
 interface LoginProvider {
     login(payload: {
         email: string;
         signature: string;
         timestamp: number;
         ssoToken?: string;
-    }): Promise<LoginResult$1 | null>;
+    }): Promise<LoginResult$1 | 'unreachable' | null>;
 }
 /**
  * Fetches the wrapped workspace key for a given workspace after re-login.
@@ -37990,48 +38053,98 @@ type OnReloginSuccess = (data: {
     userExtId?: string;
     serverSessionKey: Uint8Array;
 }) => void | Promise<void>;
+/**
+ * Why a re-login returned no token:
+ * - `not-ready`: nothing to re-login with yet (no user, no stored key): a login is still finishing;
+ * - `unreachable`: the server could not be reached: an outage, not an expired session;
+ * - `refused`: the attempt failed (the server refused it, no SSO token, a crypto error): the
+ *   session is over.
+ */
+type ReloginFailure = 'not-ready' | 'unreachable' | 'refused';
 interface ReloginDeps {
     crypto: CryptoProvider;
-    sessionStorage: SessionStorageProvider;
+    persistence: SessionPersistence;
     authState: AuthStateProvider;
-    ssoTokenProvider: SsoTokenProvider | null;
+    sso: SsoTokenSource | null;
     loginProvider: LoginProvider;
     workspaceKeyRefreshProvider: WorkspaceKeyRefreshProvider;
     workspaceOpenProvider?: WorkspaceOpenProvider;
     onReloginSuccess?: OnReloginSuccess;
+    /** Called once per failed attempt (concurrent callers share it), with the reason. */
+    onReloginFailed?: (reason: ReloginFailure) => void;
 }
 
 /**
- * SessionManager - In-memory session state for SDK consumers
+ * SessionManager: the signed-in session's state, the one source the transport, the SDK and a host's
+ * UI read: the token, the user, SSO mode, the server session key and whether a login finished.
  *
- * Replaces Zustand for SDK consumers. Simple in-memory store with subscribe pattern.
- * Implements TokenProvider and AuthStateProvider —
- * plugs directly into middleware and relogin handler without any framework.
+ * In memory by default. A browser host passes `storage` (`browserSessionStateStorage()`) so the
+ * session survives a reload. Implements TokenProvider and AuthStateProvider for the middleware and the
+ * re-login, without any framework.
  */
 
+/** The signed-in user as the login returned it (and as profile edits keep it). */
+type SessionUser = components['schemas']['UserResponse'];
 interface SessionState {
     accessToken: string | null;
     userEmail: string | null;
     userExtId: string | null;
     selectedWorkspaceId: string | null;
+    /** The account signs in through SSO: a re-login needs the SSO provider's token. */
     isSsoMode: boolean;
-    isAuth0Authenticated: boolean;
-    auth0AccessToken: string | null;
+    /** The signed-in user; `null` signed out (and for a session seeded with an email only). */
+    user: SessionUser | null;
+    /**
+     * A login finished on this device and was not signed out. A new tab (or an offline unlock) is
+     * signed in with no token yet: the next request re-logs in.
+     */
+    signedIn: boolean;
+    /** This server session's key, which workspace keys are sealed to. In memory only. */
+    serverSessionKey: Uint8Array | null;
+}
+/** What a finished login puts in the session, all at once. */
+interface SessionSignIn {
+    /** `null` for an offline unlock: no server session yet. */
+    accessToken: string | null;
+    user: SessionUser;
+    isSsoMode: boolean;
+    serverSessionKey: Uint8Array | null;
+}
+/** The part of the session kept across reloads (never the server session key). */
+type StoredSessionState = Pick<SessionState, 'accessToken' | 'userEmail' | 'userExtId' | 'isSsoMode' | 'user' | 'signedIn'>;
+/** Where a browser keeps the session across reloads. */
+interface SessionStateStorage {
+    load(): Partial<StoredSessionState> | null;
+    save(state: StoredSessionState): void;
+}
+interface SessionManagerOptions {
+    storage?: SessionStateStorage;
 }
 interface SessionManager {
+    /** The current state: the same object until something in it changes. */
     getState(): Readonly<SessionState>;
     setAccessToken(token: string | null): void;
     setUser(email: string, extId?: string): void;
+    /** Change the signed-in user's fields (a profile edit, a verified tick). */
+    updateUser(patch: Partial<SessionUser>): void;
     setSelectedWorkspace(id: string | null): void;
-    setSsoState(opts: Partial<{
-        isSsoMode: boolean;
-        isAuth0Authenticated: boolean;
-        auth0AccessToken: string | null;
-    }>): void;
+    setSsoMode(isSsoMode: boolean): void;
+    setServerSessionKey(key: Uint8Array | null): void;
+    /** A login finished: token, user, SSO mode and server session key in one change. */
+    signIn(session: SessionSignIn): void;
+    /** The session is over (logout, or it could not be recovered): drop the token and the user. */
     clear(): void;
     subscribe(listener: (state: SessionState) => void): () => void;
 }
-declare function createSessionManager(): SessionManager;
+declare function createSessionManager(options?: SessionManagerOptions): SessionManager;
+/** sessionStorage key of the access token: per tab, so each tab has its own server session. */
+declare const ACCESS_TOKEN_STORAGE_KEY = "arbi_access_token";
+/**
+ * The browser's session storage: the access token per tab (sessionStorage), the user and the
+ * signed-in flag per browser (localStorage), so a new tab is signed in and re-logs in for a token
+ * of its own. The keys themselves stay in the encrypted IndexedDB store (`SessionPersistence`).
+ */
+declare function browserSessionStateStorage(): SessionStateStorage;
 
 /**
  * Layer 1: Pure libsodium wrappers
@@ -38260,6 +38373,25 @@ declare function parseCallFragment(hash: string): {
     key: Uint8Array;
     linkVersion: number | null;
 } | null;
+/** `<origin>/call/<id>#k=…&v=…` — the shareable call link (the key travels in the fragment only). */
+declare function buildCallLink(origin: string, callExtId: string, key: Uint8Array, linkVersion: number): string;
+/** Someone a call key can be sealed to: their user id and X25519 public key (base64). */
+interface CallPeer {
+    external_id: string;
+    encryption_public_key?: string | null;
+}
+/**
+ * K sealed to each peer that has an encryption key, by user id. Agents and keyless users are
+ * skipped, and so is `exclude` (the caller, who holds K already).
+ */
+declare function sealCallKeyForPeers(key: Uint8Array, peers: readonly CallPeer[], exclude?: string | null): Promise<Record<string, string>>;
+/**
+ * My copy of a call's K from the call row (`my_sealed_key`, sealed to me as its creator or an
+ * invitee); null when I have none or it does not open.
+ */
+declare function openCallKeyOf(call: {
+    my_sealed_key?: string | null;
+}, encryptionSecretKey: Uint8Array): Promise<Uint8Array | null>;
 
 /**
  * Chat keys (`/v1/chats`). Every chat message, title and attachment manifest is
@@ -38568,6 +38700,69 @@ interface OfflineSealerOptions {
 /** A sealer for one offline store, namespaced so stores can't read each other's records. */
 declare function createOfflineSealer(namespace: string, { locked, keypair: getKeypair }: OfflineSealerOptions): OfflineSealer;
 
+/**
+ * The user's workspace keys on this client: what the workspace lists said (each workspace's key,
+ * wrapped to the user, and which are public, with none), and depositing a workspace's key on the
+ * server session without opening it (`/prime-key`).
+ *
+ * One per client, so every `Arbi` on the client (a host recreates its `Arbi` per session and per
+ * opened workspace) and the client's own recovery share it: a list read once, by whoever read it,
+ * serves every later open. A request refused with 409 `workspace_key_required` primes the
+ * workspace it names and is sent again (see the auto re-login middleware).
+ */
+
+/** A workspace as a workspace list has it (only what the keys need). */
+interface ListedWorkspaceKey {
+    external_id: string;
+    wrapped_key?: string | null;
+    is_public?: boolean | null;
+    /** A member without an account key: a temporary grant whose key lives in the server session. */
+    is_member?: boolean | null;
+}
+interface WorkspaceKeys {
+    /** Remember what a workspace list said. Returns the list. */
+    remember<T extends ListedWorkspaceKey>(workspaces: T[]): T[];
+    /**
+     * The workspace's key, wrapped to the user: from what was remembered, else from a fresh list
+     * (a workspace created or shared since), or a fresh list with `refresh` (a key that no longer
+     * opens: access re-granted with a new key). `null` for a public workspace the user holds no key
+     * for, or one they hold a temporary (session-scoped or fixed-expiry) grant to. Throws when the user cannot see the workspace.
+     */
+    wrappedKey(workspaceId: string, options?: {
+        refresh?: boolean;
+    }): Promise<{
+        wrappedKey: string | null;
+        fromCache: boolean;
+    }>;
+    /**
+     * Make a workspace usable for requests that name it, without opening it: its key, sealed to this
+     * server session, is deposited with `/prime-key`. Once per server session (a re-login rotates
+     * it); concurrent calls share one request; `force` deposits again (the server lost it).
+     */
+    prime(workspaceId: string, options?: {
+        force?: boolean;
+    }): Promise<void>;
+    /** Forget these workspaces (deleted). */
+    forget(workspaceIds: string[]): void;
+    /** Forget everything (another user, signed out). */
+    clear(): void;
+}
+interface WorkspaceKeysDeps {
+    crypto: Pick<CryptoProvider, 'ensureReady' | 'sealKeyForSession'>;
+    /** The workspace key, unwrapped with the signing key. */
+    unwrapWorkspaceKey(wrappedKey: string, signingPrivateKey: Uint8Array): Uint8Array;
+    persistence: SessionPersistence;
+    getAccessToken(): string | null;
+    /** The server session key in use (the session's), else the stored one is read. */
+    getServerSessionKey(): Uint8Array | null;
+    listWorkspaces(accessToken: string): Promise<ListedWorkspaceKey[] | null>;
+    /** POST `/v1/workspace/{id}/prime-key`; throws when refused. */
+    primeKey(accessToken: string, workspaceId: string, sealedKey: string): Promise<void>;
+}
+declare function createWorkspaceKeys(deps: WorkspaceKeysDeps): WorkspaceKeys;
+/** The workspace a 409 `{detail: {code: "workspace_key_required", workspace_ext_id}}` names. */
+declare function workspaceKeyRequiredOf(body: unknown): string | null;
+
 /**
  * storage.ts - IndexedDB Storage Module
  *
@@ -38696,16 +38891,39 @@ interface RegisterResult {
  * identity → saves session
  */
 
+type LoginResponse = components['schemas']['LoginResponse'];
 interface LoginParams {
     email: string;
     password: string;
+    /** An SSO account signs in with its provider's token too (the session is then in SSO mode). */
     ssoToken?: string;
+    /** Profile fields to use instead of the login response's (a new SSO account's provider name). */
+    profile?: Partial<Pick<SessionUser, 'given_name' | 'family_name' | 'picture'>>;
 }
 interface LoginWithKeyParams {
     email: string;
     signingPrivateKey: Uint8Array;
     ssoToken?: string;
 }
+/**
+ * The host's part of every sign-in (password, key, SSO), around the client's own: `before` runs once
+ * the server accepted the login and the identity opened, before anything is stored, so the host can
+ * clear the previous user's state; `after` runs once the session is signed in.
+ */
+interface SignInHooks {
+    before?(next: {
+        user: LoginResponse['user'];
+    }): Promise<void> | void;
+    after?(signedIn: {
+        response: LoginResponse;
+        serverSessionKey: Uint8Array;
+    }): void;
+}
+/** A refused auth request: its message, and the server's `detail` and status for the caller. */
+declare function authRequestError(what: string, error: unknown, status: number | undefined): Error & {
+    detail?: unknown;
+    status?: number;
+};
 /** The signed-in user's profile as the login response carries it. */
 interface LoginProfile {
     givenName: string;
@@ -38719,6 +38937,8 @@ interface LoginProfile {
     isIdentityVerified?: boolean;
 }
 interface LoginResult {
+    /** The login response itself (workspaces, a pending share, the user). */
+    response?: LoginResponse;
     accessToken: string;
     userExtId?: string;
     /** Owner's ext_id for agent accounts; null/undefined for human users */
@@ -38818,83 +39038,111 @@ declare function readSessionClaims(token: string | null | undefined): SessionCla
 
 declare const API_PREFIX: "/v1";
 interface ArbiClientOptions {
-    /** Base URL for the ARBI API (e.g. "https://api.mydeployment.com") */
-    baseUrl: string;
+    /**
+     * Base URL for the ARBI API (e.g. "https://api.mydeployment.com"; `''` for the page's own
+     * origin). A function is read on every request: a host whose configuration arrives after the
+     * client is made (a runtime config file) passes a getter.
+     */
+    baseUrl: string | (() => string);
     /** Deployment domain used for deterministic key derivation (e.g. "mydeployment.com") */
-    deploymentDomain: string;
+    deploymentDomain: string | (() => string);
     /** URL patterns that should never trigger re-login */
     reloginExcludePatterns?: string[];
     /** Include credentials (cookies) in requests. Default: true */
     credentials?: RequestCredentials;
-    /** Optional SSO token provider */
-    ssoTokenProvider?: {
-        getToken(): Promise<string | null>;
-    } | null;
-    /** Optional callback when re-login succeeds */
-    onReloginSuccess?: (data: {
-        email: string;
-        accessToken: string;
-        userExtId?: string;
-        serverSessionKey: Uint8Array;
-    }) => void;
     /**
-     * Called when the session cannot be recovered: a request failed with 401 (or 400 "No active
-     * workspace") and neither a workspace re-open nor a silent re-login worked because the server
-     * REFUSED it (not a network failure, which leaves the session alone). The host shows "your
-     * session expired, sign in again". Not called before anyone has logged in.
+     * The session state (token, user, selected workspace, SSO mode), read on every request. Default:
+     * an in-memory one. A host app that keeps the session in its own store passes an adapter over it;
+     * its `clear()` is called when the session ends (logout, or a re-login the server refused).
      */
-    onSessionExpired?: () => void;
+    session?: SessionManager;
     /**
-     * Optional session storage provider for the relogin handler.
-     *
-     * Browsers get the bundled IndexedDB implementation by default. Node
-     * consumers (CLI, SDK integration tests) should pass a file-backed
-     * adapter — without one, the auto-relogin middleware has nowhere to
-     * read the signing key from on a 401 and falls back to surfacing the
-     * error as-is.
+     * Where the signing key and server session key are kept between page loads. Browsers default to
+     * the bundled encrypted IndexedDB store; Node consumers (CLI, integration tests) pass a
+     * file-backed one, or a 401 has no key to re-login with.
      */
-    sessionStorage?: SessionStorageProvider;
+    persistence?: SessionPersistence;
+    /**
+     * The workspace a re-login re-opens, when the host's navigation keeps it rather than the session
+     * (`session.selectedWorkspaceId`).
+     */
+    selectedWorkspace?: () => string | null;
+    /** The SSO provider's token for re-logins of SSO accounts (see `SsoTokenSource`). */
+    sso?: SsoTokenSource | null;
+    /**
+     * Extra openapi-fetch middleware, run after the bearer token is added and before the re-login
+     * middleware sees the response (e.g. a host's handling of 402 Payment Required).
+     */
+    middleware?: Middleware[];
+    /** The host's part of every sign-in (`SignInHooks`): clear the previous user, then follow up. */
+    signIn?: SignInHooks;
+    /** Optional callback when re-login succeeds */
+    onReloginSuccess?: OnReloginSuccess;
+    /** A request re-logged in but could not be re-sent (its body was already consumed). */
+    onRetryCloneFailed?: () => void;
     /**
      * Optional user email to seed the in-memory session at creation time.
      * Ensures the auto-relogin middleware can re-authenticate even when
      * the client is constructed from cached credentials (no login call).
      */
     userEmail?: string;
-    /**
-     * Run on a transport the host app already has instead of building one: its authenticated fetch
-     * client, its session state and its re-login. One session, one re-login loop; `baseUrl`,
-     * `credentials`, `ssoTokenProvider`, `sessionStorage`, `userEmail` and the re-login callbacks
-     * are the host's business then and are not used.
-     */
-    transport?: ArbiClientTransport;
-}
-/** What an `ArbiClient` sends requests over: built by `createArbiClient`, or the host's own. */
-interface ArbiClientTransport {
-    /** Type-safe openapi-fetch client whose middleware adds the token and re-logs in on a 401. */
-    fetch: ReturnType<typeof createFetchClient<paths>>;
-    /** Session state (token, user, selected workspace), read on every call. */
-    session: SessionManager;
-    /** Silent re-login: the new access token, or `null` when the session cannot be recovered. */
-    relogin(): Promise<string | null>;
-    /** Re-open the selected workspace without a new login; `false` when it could not. */
-    reopenWorkspace(): Promise<boolean>;
 }
 interface ArbiClient {
     /** Type-safe openapi-fetch client with middleware */
     fetch: ReturnType<typeof createFetchClient<paths>>;
     /** In-memory session state */
     session: SessionManager;
+    /**
+     * The user's workspace keys: the wrapped keys the workspace lists returned (shared by everything
+     * on this client), and depositing a workspace's key on the session without opening it. A request
+     * refused with 409 `workspace_key_required` primes the workspace it names and is sent again.
+     */
+    workspaceKeys: WorkspaceKeys;
     /** High-level auth operations */
     auth: {
         register(params: RegisterParams): Promise<RegisterResult>;
         login(params: LoginParams): Promise<LoginResult>;
         loginWithKey(params: LoginWithKeyParams): Promise<LoginResult>;
-        logout(): Promise<void>;
+        /**
+         * Sign out: the server session ends (every session of the user with `everywhere`), the session
+         * state is cleared and, with `everywhere`, so are the keys kept on this device. A single sign-out
+         * keeps them, so the user can unlock offline. Best-effort on the server: offline still signs out.
+         */
+        logout(options?: {
+            everywhere?: boolean;
+        }): Promise<void>;
+        /**
+         * Sign in on this device with no server (offline): the password must open the identity saved
+         * at the last login here. Signed in without a token; the next request online re-logs in.
+         * Throws `'no-session'` (nothing saved here) or `'bad-password'`.
+         */
+        unlock(params: {
+            email: string;
+            password: string;
+        }): Promise<void>;
+        /**
+         * After a reload: put the stored server session key back in the session. `false` (and the
+         * session cleared) when the session says signed in but this device holds no keys.
+         */
+        restore(): Promise<boolean>;
         changePassword(params: ChangePasswordParams): Promise<ChangePasswordResult>;
-        /** Instant re-login using stored private key (re-opens the selected workspace too) */
+        /**
+         * Silent re-login with the stored key (and the SSO token for an SSO account); re-opens the
+         * selected workspace. Concurrent calls share one attempt and a success is reused for 5s. The
+         * new token, or `null`. When the server refused it the session is over: `session.clear()` runs
+         * and `onSessionExpired` listeners fire. A login still finishing or an unreachable server
+         * leaves the session alone.
+         */
         relogin(): Promise<string | null>;
         /** Re-open the selected workspace on the server session, without a new login */
         reopenWorkspace(): Promise<boolean>;
+        /**
+         * Seal every workspace key the user holds to this server session, so a session derived from it
+         * (an MCP session) reaches every workspace. Best-effort.
+         */
+        openAllWorkspaces(): Promise<void>;
+        /** Subscribe to "the session could not be recovered" (see `relogin`). Returns an unsubscribe. */
+        onSessionExpired(listener: () => void): () => void;
     };
     /** Crypto utilities */
     crypto: {
@@ -39033,7 +39281,7 @@ declare function createReloginHandler(deps: ReloginDeps): () => Promise<string |
 
 interface ReopenDeps {
     crypto: Pick<CryptoProvider, 'ensureReady' | 'deriveEncryptionKeypair' | 'sealedBoxDecrypt' | 'sealKeyForSession'>;
-    sessionStorage: SessionStorageProvider;
+    persistence: SessionPersistence;
     authState: Pick<AuthStateProvider, 'getSelectedWorkspaceId'>;
     getAccessToken(): string | null;
     workspaceKeyRefreshProvider: WorkspaceKeyRefreshProvider;
@@ -39045,5 +39293,27 @@ interface ReopenDeps {
  * Concurrent calls share one in-flight attempt.
  */
 declare function createWorkspaceReopener(deps: ReopenDeps): () => Promise<boolean>;
+interface OpenAllDeps {
+    crypto: Pick<CryptoProvider, 'ensureReady' | 'sealKeyForSession' | 'fromBase64'>;
+    persistence: SessionPersistence;
+    getAccessToken(): string | null;
+    /** The session's own X25519 key (the token's `sk` claim), which workspace keys are sealed to. */
+    getSessionKey(accessToken: string): string | null;
+    /** The workspace key, unwrapped with the signing key. */
+    unwrapWorkspaceKey(wrappedKey: string, signingPrivateKey: Uint8Array): Uint8Array;
+    listWorkspaces(accessToken: string): Promise<Array<{
+        external_id: string;
+        wrapped_key?: string | null;
+    }> | null>;
+    workspaceOpenProvider: WorkspaceOpenProvider;
+}
+/**
+ * Returns `openAllWorkspaces()`: seal every workspace key the user holds to this server session
+ * (`/open` each, sequentially), so a session derived from it (an MCP session copies the browser
+ * session's keys) can reach every workspace. Best-effort: a workspace that fails is logged and
+ * skipped. Sequential on purpose: the server's per-session key store is a read-modify-write, so
+ * parallel opens overwrite each other.
+ */
+declare function createAllWorkspacesOpener(deps: OpenAllDeps): () => Promise<void>;
 
-export { type $defs, API_PREFIX, type ArbiClient, type ArbiClientOptions, type ArbiClientTransport, type AuthStateProvider, type AutoReloginMiddlewareConfig, type BearerAuthMiddlewareConfig, CALL_KEY_BYTES, CHAT_KEY_BYTES, type ChangePasswordParams, type ChangePasswordRequest, type ChangePasswordResult, type CryptoProvider, ENCRYPTED_RECOVERY_KEY_SIZE, type KeyLoginCredentials, type KeyPair, type LoginCredentials, type LoginParams, type LoginProfile, type LoginProvider, type LoginRequest, type LoginResult, type LoginWithKeyParams, type OfflineSealer, type OfflineSealerOptions, type OnReloginSuccess, type ParsedRecoveryUrl, type PasswordChangeCredentials, RECOVERY_KEY_ERRORS, type RecoveryKeyParams, type RecoveryKeyValidationResult, type RegisterParams, type RegisterRequest, type RegisterResult, type RegistrationCredentials, type ReloginDeps, type ReloginHandler, type ReopenDeps, SECURE_MAIL_KEY_BYTES, type SealedSecureMail, type SecureMailCiphertexts, type SecureMailClaim, type SessionClaims, type SessionData, type SessionKeys, type SessionManager, type SessionState, type SessionStorageProvider, type SsoTokenProvider, type TokenProvider, UNENCRYPTED_RECOVERY_KEY_SIZE, type UserKeypairs, type WebSocketClientMessage, type WebSocketServerMessage, type WorkspaceKeyRefreshProvider, type WorkspaceOpenProvider, type WsAgentDmStatusMessage, type WsAuthMessage, type WsAuthResultMessage, type WsBatchCompleteMessage, type WsChatMessageMessage, type WsChatReadMessage, type WsChatUpdatedMessage, type WsConnectionClosedMessage, type WsConversationMessagePostedMessage, type WsErrorMessage, type WsNotificationResponse, type WsPresenceUpdateMessage, type WsResponseCompleteMessage, type WsTaskUpdateMessage, base64Decode, base64Encode, base64ToBytes, base64UrlToBytes, buildCallFragment, buildWebSocketUrl, bytesToBase64, bytesToBase64Url, canPersistSession, changePassword, clearAllData, clearSession, type components, computeSharedSecret, createArbiClient, createAuthMessage, createAutoReloginMiddleware, createBearerAuthMiddleware, createContentHash, createOfflineSealer, createRecoveryFile, createRecoveryUrl, createReloginHandler, createSessionManager, createWorkspaceReopener, decodeCallKey, decodeSecureMailKey, decryptCallTitle, decryptFile, decryptMessage, decryptMessageWithSharedSecret, decryptRecoveryKey, decryptWithChatKey, deriveDirectChatKey, deriveEncryptionKeypairFromSigning, derivePublicKey, encodeCallKey, encryptCallTitle, encryptFile, encryptMessage, encryptMessageWithSharedSecret, encryptRecoveryKey, encryptWithChatKey, encryptionKeypairFromSigningKey, generateCallKey, generateChatKey, generateIdentityKeypair, generateKeyPairs, generateLoginCredentials, generateLoginCredentialsFromKey, generatePasswordChangeCredentials, generateRandomSigningKeypair, generateRegistrationCredentials, generateUserKeypairs, getRecoveryKeyFilename, getSession, getUserEncryptionKeypair, hasSession, identityFromLoginResponse, initSodium, initializeDatabase, isEncryptedRecoveryKey, isMessageType, openSealedCallKey, openSealedChatKey, openSecureMail, type operations, parseCallFragment, parseRecoveryUrl, parseServerMessage, passwordChangeErrorMessage, type paths, prewarmKeyPairs, readSessionClaims, saveSession, sealCallKey, sealChatKey, sealKeyForSession, sealSecureMail, sealedBoxDecrypt, sealedBoxEncrypt, secureMailClaim, signMessage, unlockIdentityWithPassword, unwrapIdentityKey, unwrapWorkspaceKey, updateWrappedIdentityKey, validateRecoveryKeyFile, type webhooks, wrapIdentityKey };
+export { type $defs, ACCESS_TOKEN_STORAGE_KEY, API_PREFIX, type ArbiClient, type ArbiClientOptions, type AuthStateProvider, type AutoReloginMiddlewareConfig, type BearerAuthMiddlewareConfig, CALL_KEY_BYTES, CHAT_KEY_BYTES, type CallPeer, type ChangePasswordParams, type ChangePasswordRequest, type ChangePasswordResult, type CryptoProvider, ENCRYPTED_RECOVERY_KEY_SIZE, type KeyLoginCredentials, type KeyPair, type ListedWorkspaceKey, type LoginCredentials, type LoginParams, type LoginProfile, type LoginProvider, type LoginRequest, type LoginResponse, type LoginResult, type LoginWithKeyParams, type OfflineSealer, type OfflineSealerOptions, type OnReloginSuccess, type OpenAllDeps, type ParsedRecoveryUrl, type PasswordChangeCredentials, RECOVERY_KEY_ERRORS, type RecoveryKeyParams, type RecoveryKeyValidationResult, type RegisterParams, type RegisterRequest, type RegisterResult, type RegistrationCredentials, type ReloginDeps, type ReloginFailure, type ReloginHandler, type ReopenDeps, SECURE_MAIL_KEY_BYTES, type SealedSecureMail, type SecureMailCiphertexts, type SecureMailClaim, type SessionClaims, type SessionData, type SessionKeys, type SessionManager, type SessionManagerOptions, type SessionPersistence, type SessionSignIn, type SessionState, type SessionStateStorage, type SessionUser, type SignInHooks, type SsoTokenSource, type StoredSessionState, type TokenProvider, UNENCRYPTED_RECOVERY_KEY_SIZE, type UserKeypairs, type WebSocketClientMessage, type WebSocketServerMessage, type WorkspaceKeyRefreshProvider, type WorkspaceKeys, type WorkspaceOpenProvider, type WsAgentDmStatusMessage, type WsAuthMessage, type WsAuthResultMessage, type WsBatchCompleteMessage, type WsChatMessageMessage, type WsChatReadMessage, type WsChatUpdatedMessage, type WsConnectionClosedMessage, type WsConversationMessagePostedMessage, type WsErrorMessage, type WsNotificationResponse, type WsPresenceUpdateMessage, type WsResponseCompleteMessage, type WsTaskUpdateMessage, authRequestError, base64Decode, base64Encode, base64ToBytes, base64UrlToBytes, browserSessionStateStorage, buildCallFragment, buildCallLink, buildWebSocketUrl, bytesToBase64, bytesToBase64Url, canPersistSession, changePassword, clearAllData, clearSession, type components, computeSharedSecret, createAllWorkspacesOpener, createArbiClient, createAuthMessage, createAutoReloginMiddleware, createBearerAuthMiddleware, createContentHash, createOfflineSealer, createRecoveryFile, createRecoveryUrl, createReloginHandler, createSessionManager, createWorkspaceKeys, createWorkspaceReopener, decodeCallKey, decodeSecureMailKey, decryptCallTitle, decryptFile, decryptMessage, decryptMessageWithSharedSecret, decryptRecoveryKey, decryptWithChatKey, deriveDirectChatKey, deriveEncryptionKeypairFromSigning, derivePublicKey, encodeCallKey, encryptCallTitle, encryptFile, encryptMessage, encryptMessageWithSharedSecret, encryptRecoveryKey, encryptWithChatKey, encryptionKeypairFromSigningKey, generateCallKey, generateChatKey, generateIdentityKeypair, generateKeyPairs, generateLoginCredentials, generateLoginCredentialsFromKey, generatePasswordChangeCredentials, generateRandomSigningKeypair, generateRegistrationCredentials, generateUserKeypairs, getRecoveryKeyFilename, getSession, getUserEncryptionKeypair, hasSession, identityFromLoginResponse, initSodium, initializeDatabase, isEncryptedRecoveryKey, isMessageType, openCallKeyOf, openSealedCallKey, openSealedChatKey, openSecureMail, type operations, parseCallFragment, parseRecoveryUrl, parseServerMessage, passwordChangeErrorMessage, type paths, prewarmKeyPairs, readSessionClaims, saveSession, sealCallKey, sealCallKeyForPeers, sealChatKey, sealKeyForSession, sealSecureMail, sealedBoxDecrypt, sealedBoxEncrypt, secureMailClaim, signMessage, unlockIdentityWithPassword, unwrapIdentityKey, unwrapWorkspaceKey, updateWrappedIdentityKey, validateRecoveryKeyFile, type webhooks, workspaceKeyRequiredOf, wrapIdentityKey };