@arbidocs/client 0.4.4 → 0.4.6

package/dist/index.d.cts

@@ -17762,11 +17762,23 @@ interface LoginWithKeyParams {
     signingPrivateKey: Uint8Array;
     ssoToken?: string;
 }
+/** The signed-in user's profile as the login response carries it. */
+interface LoginProfile {
+    givenName: string;
+    familyName: string | null;
+    /** Avatar image (data URL or URL), when set. */
+    picture: string | null;
+    email: string;
+    /** True when the account signs in through an SSO provider (the email is managed there). */
+    isSso: boolean;
+}
 interface LoginResult {
     accessToken: string;
     userExtId?: string;
     /** Owner's ext_id for agent accounts; null/undefined for human users */
     parentExtId?: string | null;
+    /** The profile from the login response, so hosts need no second request for the name. */
+    profile?: LoginProfile;
     signingPrivateKey: Uint8Array;
     serverSessionKey: Uint8Array;
 }
@@ -17786,6 +17798,34 @@ interface ChangePasswordParams {
 interface ChangePasswordResult {
     newSigningPrivateKey: Uint8Array;
 }
+interface RekeyedPasswordChangeParams {
+    email: string;
+    newPassword: string;
+    /** The current password. Omit in recovery mode: the session's own signing key proves identity. */
+    currentPassword?: string;
+    /** The caller's `usr-` id; needed to tell sent from received direct messages. */
+    userExtId?: string;
+}
+interface RekeyedPasswordChangeResult {
+    newSigningPrivateKey: Uint8Array;
+    /** Workspaces the server re-keyed. */
+    workspacesUpdated: number;
+    /** Direct messages re-encrypted for the new key. */
+    messagesReEncrypted: number;
+}
+type FetchClient = ReturnType<typeof createFetchClient<paths>>;
+/** Pull a readable message out of whatever shape a failed call carried (`{ detail }`, `Error`). */
+declare function passwordChangeErrorMessage(err: unknown): string;
+/**
+ * Change (or, in recovery mode, set) the master password: derive the new keys, re-wrap the key of
+ * every workspace the user is a member of for them, re-encrypt direct messages, post it all to
+ * `/v1/user/change_password`, then store the new signing key. The caller shows the recovery key
+ * for `newSigningPrivateKey` afterwards.
+ */
+declare function changePasswordWithRekey(params: RekeyedPasswordChangeParams, deps: {
+    fetchClient: FetchClient;
+    deploymentDomain: string;
+}): Promise<RekeyedPasswordChangeResult>;
 
 /**
  * createArbiClient() — SDK entry point
@@ -18008,4 +18048,4 @@ interface ReopenDeps {
  */
 declare function createWorkspaceReopener(deps: ReopenDeps): () => Promise<boolean>;
 
-export { type $defs, API_PREFIX, type ArbiClient, type ArbiClientOptions, type AuthStateProvider, type AutoReloginMiddlewareConfig, type BearerAuthMiddlewareConfig, type ChangePasswordParams, type ChangePasswordRequest, type ChangePasswordResult, type CryptoProvider, type KeyPair, type LoginCredentials, type LoginParams, type LoginProvider, type LoginRequest, type LoginResult, type LoginWithKeyParams, type OnReloginSuccess, type PasswordChangeCredentials, type RegisterParams, type RegisterRequest, type RegisterResult, type RegistrationCredentials, type ReloginDeps, type ReloginHandler, type ReopenDeps, type SessionData, type SessionKeys, type SessionManager, type SessionState, type SessionStorageProvider, type SsoTokenProvider, type TokenProvider, type UserKeypairs, type WebSocketClientMessage, type WebSocketServerMessage, type WorkspaceKeyRefreshProvider, type WorkspaceOpenProvider, type WsAuthMessage, type WsAuthResultMessage, type WsBatchCompleteMessage, type WsConnectionClosedMessage, type WsErrorMessage, type WsNotificationResponse, type WsPresenceUpdateMessage, type WsResponseCompleteMessage, type WsTaskUpdateMessage, base64Decode, base64Encode, base64ToBytes, buildWebSocketUrl, bytesToBase64, clearAllData, clearSession, type components, computeSharedSecret, createArbiClient, createAuthMessage, createAutoReloginMiddleware, createBearerAuthMiddleware, createContentHash, createReloginHandler, createSessionManager, createWorkspaceReopener, decryptFile, decryptMessage, decryptMessageWithSharedSecret, deriveEncryptionKeypairFromSigning, derivePublicKey, encryptFile, encryptMessage, encryptMessageWithSharedSecret, generateKeyPairs, generateLoginCredentials, generateLoginCredentialsFromKey, generatePasswordChangeCredentials, generateRandomSigningKeypair, generateRecoveryPasswordChangeCredentials, generateRegistrationCredentials, generateUserKeypairs, getSession, getUserEncryptionKeypair, hasSession, initSodium, initializeDatabase, isMessageType, type operations, parseServerMessage, type paths, prewarmKeyPairs, saveSession, sealKeyForSession, sealedBoxDecrypt, sealedBoxEncrypt, signMessage, updateSigningPrivateKey, type webhooks };
+export { type $defs, API_PREFIX, type ArbiClient, type ArbiClientOptions, type AuthStateProvider, type AutoReloginMiddlewareConfig, type BearerAuthMiddlewareConfig, type ChangePasswordParams, type ChangePasswordRequest, type ChangePasswordResult, type CryptoProvider, type KeyPair, type LoginCredentials, type LoginParams, type LoginProfile, type LoginProvider, type LoginRequest, type LoginResult, type LoginWithKeyParams, type OnReloginSuccess, type PasswordChangeCredentials, type RegisterParams, type RegisterRequest, type RegisterResult, type RegistrationCredentials, type RekeyedPasswordChangeParams, type RekeyedPasswordChangeResult, type ReloginDeps, type ReloginHandler, type ReopenDeps, type SessionData, type SessionKeys, type SessionManager, type SessionState, type SessionStorageProvider, type SsoTokenProvider, type TokenProvider, type UserKeypairs, type WebSocketClientMessage, type WebSocketServerMessage, type WorkspaceKeyRefreshProvider, type WorkspaceOpenProvider, type WsAuthMessage, type WsAuthResultMessage, type WsBatchCompleteMessage, type WsConnectionClosedMessage, type WsErrorMessage, type WsNotificationResponse, type WsPresenceUpdateMessage, type WsResponseCompleteMessage, type WsTaskUpdateMessage, base64Decode, base64Encode, base64ToBytes, buildWebSocketUrl, bytesToBase64, changePasswordWithRekey, clearAllData, clearSession, type components, computeSharedSecret, createArbiClient, createAuthMessage, createAutoReloginMiddleware, createBearerAuthMiddleware, createContentHash, createReloginHandler, createSessionManager, createWorkspaceReopener, decryptFile, decryptMessage, decryptMessageWithSharedSecret, deriveEncryptionKeypairFromSigning, derivePublicKey, encryptFile, encryptMessage, encryptMessageWithSharedSecret, generateKeyPairs, generateLoginCredentials, generateLoginCredentialsFromKey, generatePasswordChangeCredentials, generateRandomSigningKeypair, generateRecoveryPasswordChangeCredentials, generateRegistrationCredentials, generateUserKeypairs, getSession, getUserEncryptionKeypair, hasSession, initSodium, initializeDatabase, isMessageType, type operations, parseServerMessage, passwordChangeErrorMessage, type paths, prewarmKeyPairs, saveSession, sealKeyForSession, sealedBoxDecrypt, sealedBoxEncrypt, signMessage, updateSigningPrivateKey, type webhooks };

package/dist/index.d.ts

@@ -17762,11 +17762,23 @@ interface LoginWithKeyParams {
     signingPrivateKey: Uint8Array;
     ssoToken?: string;
 }
+/** The signed-in user's profile as the login response carries it. */
+interface LoginProfile {
+    givenName: string;
+    familyName: string | null;
+    /** Avatar image (data URL or URL), when set. */
+    picture: string | null;
+    email: string;
+    /** True when the account signs in through an SSO provider (the email is managed there). */
+    isSso: boolean;
+}
 interface LoginResult {
     accessToken: string;
     userExtId?: string;
     /** Owner's ext_id for agent accounts; null/undefined for human users */
     parentExtId?: string | null;
+    /** The profile from the login response, so hosts need no second request for the name. */
+    profile?: LoginProfile;
     signingPrivateKey: Uint8Array;
     serverSessionKey: Uint8Array;
 }
@@ -17786,6 +17798,34 @@ interface ChangePasswordParams {
 interface ChangePasswordResult {
     newSigningPrivateKey: Uint8Array;
 }
+interface RekeyedPasswordChangeParams {
+    email: string;
+    newPassword: string;
+    /** The current password. Omit in recovery mode: the session's own signing key proves identity. */
+    currentPassword?: string;
+    /** The caller's `usr-` id; needed to tell sent from received direct messages. */
+    userExtId?: string;
+}
+interface RekeyedPasswordChangeResult {
+    newSigningPrivateKey: Uint8Array;
+    /** Workspaces the server re-keyed. */
+    workspacesUpdated: number;
+    /** Direct messages re-encrypted for the new key. */
+    messagesReEncrypted: number;
+}
+type FetchClient = ReturnType<typeof createFetchClient<paths>>;
+/** Pull a readable message out of whatever shape a failed call carried (`{ detail }`, `Error`). */
+declare function passwordChangeErrorMessage(err: unknown): string;
+/**
+ * Change (or, in recovery mode, set) the master password: derive the new keys, re-wrap the key of
+ * every workspace the user is a member of for them, re-encrypt direct messages, post it all to
+ * `/v1/user/change_password`, then store the new signing key. The caller shows the recovery key
+ * for `newSigningPrivateKey` afterwards.
+ */
+declare function changePasswordWithRekey(params: RekeyedPasswordChangeParams, deps: {
+    fetchClient: FetchClient;
+    deploymentDomain: string;
+}): Promise<RekeyedPasswordChangeResult>;
 
 /**
  * createArbiClient() — SDK entry point
@@ -18008,4 +18048,4 @@ interface ReopenDeps {
  */
 declare function createWorkspaceReopener(deps: ReopenDeps): () => Promise<boolean>;
 
-export { type $defs, API_PREFIX, type ArbiClient, type ArbiClientOptions, type AuthStateProvider, type AutoReloginMiddlewareConfig, type BearerAuthMiddlewareConfig, type ChangePasswordParams, type ChangePasswordRequest, type ChangePasswordResult, type CryptoProvider, type KeyPair, type LoginCredentials, type LoginParams, type LoginProvider, type LoginRequest, type LoginResult, type LoginWithKeyParams, type OnReloginSuccess, type PasswordChangeCredentials, type RegisterParams, type RegisterRequest, type RegisterResult, type RegistrationCredentials, type ReloginDeps, type ReloginHandler, type ReopenDeps, type SessionData, type SessionKeys, type SessionManager, type SessionState, type SessionStorageProvider, type SsoTokenProvider, type TokenProvider, type UserKeypairs, type WebSocketClientMessage, type WebSocketServerMessage, type WorkspaceKeyRefreshProvider, type WorkspaceOpenProvider, type WsAuthMessage, type WsAuthResultMessage, type WsBatchCompleteMessage, type WsConnectionClosedMessage, type WsErrorMessage, type WsNotificationResponse, type WsPresenceUpdateMessage, type WsResponseCompleteMessage, type WsTaskUpdateMessage, base64Decode, base64Encode, base64ToBytes, buildWebSocketUrl, bytesToBase64, clearAllData, clearSession, type components, computeSharedSecret, createArbiClient, createAuthMessage, createAutoReloginMiddleware, createBearerAuthMiddleware, createContentHash, createReloginHandler, createSessionManager, createWorkspaceReopener, decryptFile, decryptMessage, decryptMessageWithSharedSecret, deriveEncryptionKeypairFromSigning, derivePublicKey, encryptFile, encryptMessage, encryptMessageWithSharedSecret, generateKeyPairs, generateLoginCredentials, generateLoginCredentialsFromKey, generatePasswordChangeCredentials, generateRandomSigningKeypair, generateRecoveryPasswordChangeCredentials, generateRegistrationCredentials, generateUserKeypairs, getSession, getUserEncryptionKeypair, hasSession, initSodium, initializeDatabase, isMessageType, type operations, parseServerMessage, type paths, prewarmKeyPairs, saveSession, sealKeyForSession, sealedBoxDecrypt, sealedBoxEncrypt, signMessage, updateSigningPrivateKey, type webhooks };
+export { type $defs, API_PREFIX, type ArbiClient, type ArbiClientOptions, type AuthStateProvider, type AutoReloginMiddlewareConfig, type BearerAuthMiddlewareConfig, type ChangePasswordParams, type ChangePasswordRequest, type ChangePasswordResult, type CryptoProvider, type KeyPair, type LoginCredentials, type LoginParams, type LoginProfile, type LoginProvider, type LoginRequest, type LoginResult, type LoginWithKeyParams, type OnReloginSuccess, type PasswordChangeCredentials, type RegisterParams, type RegisterRequest, type RegisterResult, type RegistrationCredentials, type RekeyedPasswordChangeParams, type RekeyedPasswordChangeResult, type ReloginDeps, type ReloginHandler, type ReopenDeps, type SessionData, type SessionKeys, type SessionManager, type SessionState, type SessionStorageProvider, type SsoTokenProvider, type TokenProvider, type UserKeypairs, type WebSocketClientMessage, type WebSocketServerMessage, type WorkspaceKeyRefreshProvider, type WorkspaceOpenProvider, type WsAuthMessage, type WsAuthResultMessage, type WsBatchCompleteMessage, type WsConnectionClosedMessage, type WsErrorMessage, type WsNotificationResponse, type WsPresenceUpdateMessage, type WsResponseCompleteMessage, type WsTaskUpdateMessage, base64Decode, base64Encode, base64ToBytes, buildWebSocketUrl, bytesToBase64, changePasswordWithRekey, clearAllData, clearSession, type components, computeSharedSecret, createArbiClient, createAuthMessage, createAutoReloginMiddleware, createBearerAuthMiddleware, createContentHash, createReloginHandler, createSessionManager, createWorkspaceReopener, decryptFile, decryptMessage, decryptMessageWithSharedSecret, deriveEncryptionKeypairFromSigning, derivePublicKey, encryptFile, encryptMessage, encryptMessageWithSharedSecret, generateKeyPairs, generateLoginCredentials, generateLoginCredentialsFromKey, generatePasswordChangeCredentials, generateRandomSigningKeypair, generateRecoveryPasswordChangeCredentials, generateRegistrationCredentials, generateUserKeypairs, getSession, getUserEncryptionKeypair, hasSession, initSodium, initializeDatabase, isMessageType, type operations, parseServerMessage, passwordChangeErrorMessage, type paths, prewarmKeyPairs, saveSession, sealKeyForSession, sealedBoxDecrypt, sealedBoxEncrypt, signMessage, updateSigningPrivateKey, type webhooks };

package/dist/index.js

@@ -999,6 +999,13 @@ async function performLogin(request, signingPrivateKey, deps) {
     accessToken: data.access_token,
     userExtId: data.user.external_id ?? void 0,
     parentExtId: data.user.parent_ext_id ?? null,
+    profile: {
+      givenName: data.user.given_name,
+      familyName: data.user.family_name ?? null,
+      picture: data.user.picture ?? null,
+      email: data.user.email ?? request.email,
+      isSso: data.user.is_sso === true
+    },
     signingPrivateKey,
     serverSessionKey
   };
@@ -1032,6 +1039,106 @@ async function changePassword(params, deps) {
   await updateSigningPrivateKey(credentials.newSigningPrivateKey);
   return { newSigningPrivateKey: credentials.newSigningPrivateKey };
 }
+function passwordChangeErrorMessage(err) {
+  if (err instanceof Error) return err.message;
+  if (err && typeof err === "object") {
+    const obj = err;
+    if (typeof obj.detail === "string") return obj.detail;
+    if (typeof obj.message === "string") return obj.message;
+    if (Array.isArray(obj.detail)) {
+      const msgs = obj.detail.map(
+        (d) => d && typeof d.msg === "string" ? d.msg : null
+      ).filter((m) => m !== null);
+      if (msgs.length) return msgs.join("; ");
+    }
+  }
+  return "Failed to change password";
+}
+async function reEncryptDirectMessages(fetchClient, userExtId, oldSecretKey, newSecretKey) {
+  const { data } = await fetchClient.GET("/v1/notifications/");
+  const messages = (data ?? []).filter((n) => n.type === "user_message" && n.content);
+  const oldSecrets = {};
+  const newSecrets = {};
+  const updates = [];
+  for (const n of messages) {
+    try {
+      const other = n.sender.external_id === userExtId ? n.recipient : n.sender;
+      const id = other.external_id;
+      oldSecrets[id] ??= await computeSharedSecret(other.encryption_public_key, oldSecretKey);
+      newSecrets[id] ??= await computeSharedSecret(other.encryption_public_key, newSecretKey);
+      const plain = await decryptMessageWithSharedSecret(n.content, oldSecrets[id]);
+      updates.push({
+        external_id: n.external_id,
+        content: await encryptMessageWithSharedSecret(plain, newSecrets[id])
+      });
+    } catch {
+    }
+  }
+  if (updates.length === 0) return 0;
+  const patched = await fetchClient.PATCH("/v1/notifications/", { body: { updates } });
+  if (!patched.data) throw new Error("Failed to save re-encrypted messages");
+  return updates.length;
+}
+async function changePasswordWithRekey(params, deps) {
+  const session = await getSession();
+  if (!session) throw new Error("No active session found");
+  const { request, newSigningPrivateKey } = params.currentPassword ? await generatePasswordChangeCredentials(
+    params.email,
+    params.currentPassword,
+    params.newPassword,
+    deps.deploymentDomain
+  ) : await generateRecoveryPasswordChangeCredentials(
+    params.email,
+    session.signingPrivateKey,
+    params.newPassword,
+    deps.deploymentDomain
+  );
+  const current = deriveEncryptionKeypairFromSigning({
+    publicKey: session.signingPrivateKey.slice(32, 64),
+    secretKey: session.signingPrivateKey
+  });
+  const next = deriveEncryptionKeypairFromSigning({
+    publicKey: newSigningPrivateKey.slice(32, 64),
+    secretKey: newSigningPrivateKey
+  });
+  const listed = await deps.fetchClient.GET("/v1/user/workspaces");
+  if (!listed.data) throw new Error("Could not list your workspaces");
+  const rewrapped = {};
+  for (const ws of listed.data.filter((w) => w.is_member)) {
+    if (!ws.wrapped_key) continue;
+    try {
+      rewrapped[ws.external_id] = sealedBoxEncrypt(
+        sealedBoxDecrypt(ws.wrapped_key, current.secretKey),
+        next.publicKey
+      );
+    } catch {
+      throw new Error(`Failed to re-wrap workspace key for ${ws.name || ws.external_id}`);
+    }
+  }
+  let messagesReEncrypted = 0;
+  if (params.userExtId) {
+    try {
+      messagesReEncrypted = await reEncryptDirectMessages(
+        deps.fetchClient,
+        params.userExtId,
+        current.secretKey,
+        next.secretKey
+      );
+    } catch {
+    }
+  }
+  const response = await deps.fetchClient.POST("/v1/user/change_password", {
+    body: { ...request, rewrapped_workspace_keys: rewrapped }
+  });
+  if (response.error || !response.data)
+    throw response.error ?? new Error("Failed to change password");
+  await updateSigningPrivateKey(newSigningPrivateKey);
+  return {
+    newSigningPrivateKey,
+    workspacesUpdated: response.data.workspaces_updated ?? 0,
+    messagesReEncrypted
+  };
+}
 
 // src/client.ts
 var API_PREFIX = "/v1";
@@ -1276,6 +1383,6 @@ function isMessageType(msg, type) {
   return msg.type === type;
 }
 
-export { API_PREFIX, base64Decode, base64Encode, base64ToBytes, buildWebSocketUrl, bytesToBase64, clearAllData, clearSession, computeSharedSecret, createArbiClient, createAuthMessage, createAutoReloginMiddleware, createBearerAuthMiddleware, createContentHash, createReloginHandler, createSessionManager, createWorkspaceReopener, decryptFile, decryptMessage, decryptMessageWithSharedSecret, deriveEncryptionKeypairFromSigning, derivePublicKey, encryptFile, encryptMessage, encryptMessageWithSharedSecret, generateKeyPairs, generateLoginCredentials, generateLoginCredentialsFromKey, generatePasswordChangeCredentials, generateRandomSigningKeypair, generateRecoveryPasswordChangeCredentials, generateRegistrationCredentials, generateUserKeypairs, getSession, getUserEncryptionKeypair, hasSession, initSodium, initializeDatabase, isMessageType, parseServerMessage, prewarmKeyPairs, saveSession, sealKeyForSession, sealedBoxDecrypt, sealedBoxEncrypt, signMessage, updateSigningPrivateKey };
+export { API_PREFIX, base64Decode, base64Encode, base64ToBytes, buildWebSocketUrl, bytesToBase64, changePasswordWithRekey, clearAllData, clearSession, computeSharedSecret, createArbiClient, createAuthMessage, createAutoReloginMiddleware, createBearerAuthMiddleware, createContentHash, createReloginHandler, createSessionManager, createWorkspaceReopener, decryptFile, decryptMessage, decryptMessageWithSharedSecret, deriveEncryptionKeypairFromSigning, derivePublicKey, encryptFile, encryptMessage, encryptMessageWithSharedSecret, generateKeyPairs, generateLoginCredentials, generateLoginCredentialsFromKey, generatePasswordChangeCredentials, generateRandomSigningKeypair, generateRecoveryPasswordChangeCredentials, generateRegistrationCredentials, generateUserKeypairs, getSession, getUserEncryptionKeypair, hasSession, initSodium, initializeDatabase, isMessageType, parseServerMessage, passwordChangeErrorMessage, prewarmKeyPairs, saveSession, sealKeyForSession, sealedBoxDecrypt, sealedBoxEncrypt, signMessage, updateSigningPrivateKey };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map