@arbidocs/client 0.4.84 → 0.4.86

package/dist/index.d.cts

@@ -639,14 +639,13 @@ interface paths {
          * @description Login with Ed25519 signature verification (local or SSO).
          *
          *     Authentication flow:
-         *     1. Client derives Ed25519 keypair from password
-         *     2. Client signs "email|timestamp" with Ed25519 private key
-         *     3. Server verifies signature using stored Ed25519 public key
-         *     4. Server encrypts response with stored X25519 public key
+         *     1. Client derives the password key (Ed25519) from the password, or holds the identity key
+         *        (recovery key, session re-login)
+         *     2. Client signs "email|timestamp" with it
+         *     3. Server verifies the signature against the stored password key or identity key
+         *     4. The response carries ``wrapped_identity_key``, which only the password key opens
          *
          *     For SSO users: Also validates SSO token before proceeding.
-         *
-         *     Returns encrypted login response that only the correct password can decrypt.
          */
         post: operations['login_user'];
         delete?: never;
@@ -730,17 +729,13 @@ interface paths {
         put?: never;
         /**
          * Change Password
-         * @description Change user's master password by re-keying all workspace keys.
-         *
-         *     Self re-key (agent_ext_id omitted):
-         *     1. Sign "email|timestamp" with current Ed25519 key (proves current password)
-         *     2. Provide new Ed25519 signing key (derived from new password)
-         *     3. Re-wrap all workspace keys with new X25519 public key
+         * @description Change the master password (or set a new one after signing in with the recovery key).
          *
-         *     Agent re-key (agent_ext_id provided):
-         *     1. Parent signs "agent_ext_id|timestamp" with their own Ed25519 key (proves authority)
-         *     2. Provide new Ed25519 signing key for the agent
-         *     3. Re-wrap the agent's workspace keys with the agent's new X25519 public key
+         *     The password only protects the identity keypair; it never encrypts content. The client signs
+         *     "email|timestamp" with the current password key (or with the identity key, in recovery), derives the
+         *     new password key, and wraps the identity's secret key under it. The server swaps the two values: the
+         *     identity — and every workspace key, mailbox key, direct message and directory entry bound to it —
+         *     is untouched, so nothing is re-encrypted and nothing can be left behind.
          */
         post: operations['change_password'];
         delete?: never;
@@ -1558,6 +1553,30 @@ interface paths {
         patch?: never;
         trace?: never;
     };
+    '/v1/workspace/{workspace_ext_id}/activity': {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get Workspace Activity
+         * @description What happened in the workspace, newest first: thread history, people posting, documents uploaded, new
+         *     versions and signatures, and workflow runs.
+         *
+         *     Only what the caller can already see is listed: private threads (their events and messages), documents and
+         *     workflows of others are left out. Nothing here is pushed; notifications tell a person what needs them.
+         */
+        get: operations['get_workspace_activity'];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     '/v1/editor/{document_id}/mentions': {
         parameters: {
             query?: never;
@@ -3104,7 +3123,7 @@ interface paths {
         patch?: never;
         trace?: never;
     };
-    '/v1/tag/list': {
+    '/v1/tag/': {
         parameters: {
             query?: never;
             header?: never;
@@ -3113,18 +3132,32 @@ interface paths {
         };
         /**
          * List Tags
-         * @description List all tags in the current workspace.
+         * @description The workspace's tags, filtered: of a ``kind``, children of a ``parent``, or the ``ids`` given (filters
+         *     combine). Oldest first, or in the order of ``ids``.
+         *
+         *     A table of tags is this list: ``?kind=issue&include=links`` is every issue with its values (``field_values``,
+         *     for the columns ``GET /v1/tag/kinds/issue`` defines) and its evidence. With ``include=links`` each tag lists up
+         *     to ``links_limit`` documents (the doctag's note, how many passages it cites), facts and threads, newest first;
+         *     the counts are the totals, so a tag with none is a gap.
          */
         get: operations['list_tags'];
         put?: never;
-        post?: never;
+        /**
+         * Create Tag
+         * @description Create a new tag for a given workspace.
+         *
+         *     If 'shared' is provided, the tag will be set to shared or private accordingly.
+         *     If 'shared' is not provided, it defaults to True (shared). ``kind`` defaults from the format. Issues, people
+         *     and organisations are flat (no parent). ``field_values`` are for the kind's fields.
+         */
+        post: operations['create_tag'];
         delete?: never;
         options?: never;
         head?: never;
         patch?: never;
         trace?: never;
     };
-    '/v1/tag/matrix': {
+    '/v1/tag/kinds': {
         parameters: {
             query?: never;
             header?: never;
@@ -3132,15 +3165,10 @@ interface paths {
             cookie?: never;
         };
         /**
-         * Get Tag Matrix
-         * @description A set of tags with their fields and values, plus the documents and facts linked to each.
-         *
-         *     Select the rows with ``parent_ext_id`` (its children; the parent comes back too, its fields being the
-         *     shared columns), with ``kind`` (e.g. every person, or every issue) or with ``tag_ext_id``. Each row lists up
-         *     to ``links_limit`` documents (with the doctag's note and how many passages it cites) and facts, newest
-         *     first; ``doc_count``/``fact_count`` are the totals.
+         * List Tag Kinds
+         * @description Every tag kind's fields in this workspace (the built-in ones where the workspace has not set its own).
          */
-        get: operations['get_tag_matrix'];
+        get: operations['list_tag_kinds'];
         put?: never;
         post?: never;
         delete?: never;
@@ -3149,30 +3177,33 @@ interface paths {
         patch?: never;
         trace?: never;
     };
-    '/v1/tag/entities/extract': {
+    '/v1/tag/kinds/{kind}': {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
-        get?: never;
-        put?: never;
         /**
-         * Extract Entities
-         * @description Find the people and organisations these documents name, and link each to its entity tag (on demand).
-         *
-         *     Returns 202 at once; a ``batch_complete`` (``entity_extract``) WebSocket message follows when every document
-         *     is done. Reuses entities already in the workspace by name or "Also known as"; only ever adds links.
+         * Get Tag Kind
+         * @description A kind's fields in this workspace — the columns of a table of its tags (e.g. the workspace's issue fields).
+         *     Each tag of the kind holds its own values (``field_values``).
          */
-        post: operations['extract_entities'];
+        get: operations['get_tag_kind'];
+        /**
+         * Update Tag Kind
+         * @description Set a kind's fields in this workspace, in full and in order: a field given with its ``id`` is kept (its
+         *     type cannot change; its name and options can), one without is added, one left out is removed.
+         */
+        put: operations['update_tag_kind'];
+        post?: never;
         delete?: never;
         options?: never;
         head?: never;
         patch?: never;
         trace?: never;
     };
-    '/v1/tag/': {
+    '/v1/tag/entities/extract': {
         parameters: {
             query?: never;
             header?: never;
@@ -3182,14 +3213,13 @@ interface paths {
         get?: never;
         put?: never;
         /**
-         * Create Tag
-         * @description Create a new tag for a given workspace.
+         * Extract Entities
+         * @description Find the people and organisations these documents name, and link each to its entity tag (on demand).
          *
-         *     If 'shared' is provided, the tag will be set to shared or private accordingly.
-         *     If 'shared' is not provided, it defaults to True (shared). ``kind`` defaults from the format; a person or
-         *     organisation gets that kind's default fields unless ``fields`` are given.
+         *     Returns 202 at once; a ``batch_complete`` (``entity_extract``) WebSocket message follows when every document
+         *     is done. Reuses entities already in the workspace by name (a person also by title and surname); only ever adds.
          */
-        post: operations['create_tag'];
+        post: operations['extract_entities'];
         delete?: never;
         options?: never;
         head?: never;
@@ -6156,23 +6186,6 @@ interface paths {
         patch?: never;
         trace?: never;
     };
-    '/v1/mail/native/rotation-credentials': {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /** Rotation Credentials */
-        get: operations['rotation_credentials_v1_mail_native_rotation_credentials_get'];
-        put?: never;
-        post?: never;
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
     '/v1/mail/accounts/{account_id}/drafts': {
         parameters: {
             query?: never;
@@ -6967,7 +6980,7 @@ interface components {
             WORKSPACE_SETUP: boolean;
             /**
              * Workspace Tools Enabled
-             * @description Enable native user-action tools so the agent can act as an ARBI user within its active workspace: list_workspaces, upload_document, list_tags, create_tag and tag_documents. In-process and RLS-native — bounded by the agent's workspace memberships. Off by default.
+             * @description Enable native user-action tools so the agent can act as an ARBI user within its active workspace: list_workspaces, upload_document, list_tags, create_tag, set_tag_fields and tag_documents. In-process and RLS-native — bounded by the agent's workspace memberships. Off by default.
              * @default false
              */
             WORKSPACE_TOOLS_ENABLED: boolean;
@@ -7234,7 +7247,7 @@ interface components {
             SKILLS_ENABLED: boolean;
             /**
              * Workspace Tools Enabled
-             * @description Enable native user-action tools so the agent can act as an ARBI user within its active workspace: list_workspaces, upload_document, list_tags, create_tag and tag_documents. In-process and RLS-native — bounded by the agent's workspace memberships. Off by default.
+             * @description Enable native user-action tools so the agent can act as an ARBI user within its active workspace: list_workspaces, upload_document, list_tags, create_tag, set_tag_fields and tag_documents. In-process and RLS-native — bounded by the agent's workspace memberships. Off by default.
              * @default false
              */
             WORKSPACE_TOOLS_ENABLED: boolean;
@@ -7932,19 +7945,19 @@ interface components {
             title: string;
             /**
              * Mode
-             * @description Rendering mode: markdown (default, supports redlines), html (single-file page, rendered in a sandboxed preview), react (single-file JSX component, rendered in a sandboxed preview), plain text, or image (a generated image artifact — render the doc via the image viewer)
+             * @description What the model wrote: markdown (default) or plain text — a document draft, stored as a Word document (DOCX) and opened in the Word editor; html (single-file page, rendered in a sandboxed preview); react (single-file JSX component, rendered in a sandboxed preview); or image (a generated image artifact — render the doc via the image viewer)
              * @default markdown
              * @enum {string}
              */
             mode: 'markdown' | 'html' | 'text' | 'react' | 'image';
             /**
              * Content
-             * @description The artifact content (markdown/html/text; empty for image mode)
+             * @description What the model wrote: the Markdown/text of a document draft (a preview: the document is the stored DOCX), or the html/jsx source; empty for image mode
              */
             content: string;
             /**
              * File Type
-             * @description Bare file extension for image-mode artifacts (e.g. 'png'); empty for text modes
+             * @description Bare extension of the stored file: 'docx' for a document draft (markdown/text), 'html' or 'jsx' for a UI artifact, the image's (e.g. 'png') for image mode
              * @default
              */
             file_type: string;
@@ -9103,50 +9116,25 @@ interface components {
         };
         /**
          * ChangePasswordRequest
-         * @description Password change request with signature-based auth.
+         * @description Change the master password: replace the password key and the wrapped identity key, nothing else.
          *
-         *     Self re-key (agent_ext_id omitted):
-         *       Client proves knowledge of current password by signing "email|timestamp"
-         *       with their own Ed25519 key.
-         *
-         *     Agent re-key (agent_ext_id provided):
-         *       Parent re-keys an agent's signing/encryption keys.  Parent proves authority
-         *       by signing "agent_ext_id|timestamp" with their own Ed25519 key.
-         *       rewrapped_workspace_keys must contain entries for the agent's workspaces,
-         *       each wrapped with the agent's new X25519 public key.
+         *     Everything the user can read (workspace keys, mailbox keys, direct messages, call keys) is encrypted
+         *     to the identity keypair, which a password change keeps, so the change is O(1) and re-encrypts nothing.
          */
         ChangePasswordRequest: {
             /** Signature */
             signature: string;
             /** Timestamp */
             timestamp: number;
-            /** New Signing Key */
-            new_signing_key: string;
-            /** Rewrapped Workspace Keys */
-            rewrapped_workspace_keys: {
-                [key: string]: string;
-            };
-            /** Agent Ext Id */
-            agent_ext_id?: string | null;
-            /** Rewrapped Agent Recovery Keys */
-            rewrapped_agent_recovery_keys?: {
-                [key: string]: string;
-            } | null;
-            /** Rewrapped Mail Keys */
-            rewrapped_mail_keys?: {
-                [key: string]: string;
-            } | null;
-            /** Rewrapped Mail Credentials */
-            rewrapped_mail_credentials?: {
-                [key: string]: string;
-            } | null;
+            /** New Login Key */
+            new_login_key: string;
+            /** Wrapped Identity Key */
+            wrapped_identity_key: string;
         };
         /** ChangePasswordResponse */
         ChangePasswordResponse: {
             /** Detail */
             detail: string;
-            /** Workspaces Updated */
-            workspaces_updated: number;
         };
         /**
          * ChatCompletionRequest
@@ -10514,9 +10502,9 @@ interface components {
          * CreateTagRequest
          * @description Request to create a new tag in a workspace.
          *
-         *     ``kind`` defaults to the parent's when the parent is an issue, person or organisation (so a matrix's new row
-         *     is one too), else from the format (checkbox → label, search → search, any other → annotation). A person or
-         *     organisation is created with that kind's default fields unless ``fields`` are given.
+         *     ``kind`` defaults from the format (checkbox → label, search → search, any other → annotation), never from the
+         *     parent. Issues, people and organisations are flat: they take no parent. ``field_values`` are for the kind's
+         *     fields (``GET /v1/tag/kinds/{kind}``).
          */
         CreateTagRequest: {
             /** Name */
@@ -10530,8 +10518,6 @@ interface components {
             shared?: boolean | null;
             /** Parent Ext Id */
             parent_ext_id?: string | null;
-            /** Fields */
-            fields?: components['schemas']['FieldDefinitionWrite'][] | null;
             /** Field Values */
             field_values?: {
                 [key: string]: unknown;
@@ -12111,9 +12097,11 @@ interface components {
          * ExtractEntitiesRequest
          * @description Find the people and organisations these documents name and link each to its entity tag.
          *
-         *     An entity already in the workspace (same kind, same name or one of its "Also known as" names) is reused;
-         *     a new one is created with that kind's default fields. Each document gets a link (a doctag citing the
-         *     passages that name the entity), and facts drawn from the document that mention the entity get it too.
+         *     An entity already in the workspace (same kind and name — for a person also "Mr Grant" for an only Grant)
+         *     is reused, its empty fields filled; a new one is created. Values go into the fields of that name the
+         *     workspace's person / organisation fields have. Each document
+         *     gets a link (a doctag citing the passages that name the entity), and facts drawn from the document that
+         *     mention the entity get it too.
          *     Existing links are kept; ``overwrite`` refreshes their citations (e.g. after a new version).
          */
         ExtractEntitiesRequest: {
@@ -12299,6 +12287,23 @@ interface components {
              */
             label: string;
         };
+        /**
+         * FieldDefinition
+         * @description A field as the API returns it — decrypted.
+         */
+        FieldDefinition: {
+            /** Id */
+            id: string;
+            /** Name */
+            name: string;
+            /**
+             * Type
+             * @enum {string}
+             */
+            type: 'text' | 'number' | 'date' | 'checkbox' | 'select' | 'person' | 'document' | 'relation' | 'lookup' | 'rollup';
+            /** Options */
+            options?: string[] | null;
+        };
         /**
          * FieldDefinitionWrite
          * @description A field in a write. Give ``id`` to keep an existing field (its type cannot change); omit it to add one.
@@ -13169,6 +13174,8 @@ interface components {
             /** Session Key */
             session_key: string;
             user: components['schemas']['UserResponse'];
+            /** Wrapped Identity Key */
+            wrapped_identity_key?: string | null;
             /**
              * Workspaces
              * @default []
@@ -14217,7 +14224,7 @@ interface components {
          *     Type is self-descriptive, no need to parse content field.
          * @enum {string}
          */
-        NotificationType: 'user_message' | 'workspaceuser_added_owner' | 'workspaceuser_added_collaborator' | 'workspaceuser_added_guest' | 'workspaceuser_removed' | 'workspaceuser_updated_owner' | 'workspaceuser_updated_collaborator' | 'workspaceuser_updated_guest' | 'contact_accepted' | 'signup_reward' | 'referral_reward' | 'native_mail_received' | 'mail_draft_ready' | 'email_reply' | 'quota_threshold_50' | 'quota_threshold_90' | 'quota_threshold_100' | 'doc_shared' | 'docx_mention' | 'workspace_access_request' | 'conversation_ready' | 'conversation_done' | 'conversation_notified' | 'workflow_failed' | 'agent_input_requested' | 'workflow_completed' | 'workflow_signal' | 'step_ready' | 'task_started' | 'task_completed' | 'mailbox_sync_complete' | 'drive_sync_complete' | 'activity' | 'mention' | 'call_missed' | 'calendar_invite' | 'calendar_update' | 'calendar_cancel' | 'calendar_reply' | 'calendar_counter' | 'calendar_reminder' | 'calendar_share';
+        NotificationType: 'user_message' | 'workspaceuser_added_owner' | 'workspaceuser_added_collaborator' | 'workspaceuser_added_guest' | 'workspaceuser_removed' | 'workspaceuser_updated_owner' | 'workspaceuser_updated_collaborator' | 'workspaceuser_updated_guest' | 'contact_accepted' | 'signup_reward' | 'referral_reward' | 'native_mail_received' | 'mail_draft_ready' | 'email_reply' | 'quota_threshold_50' | 'quota_threshold_90' | 'quota_threshold_100' | 'doc_shared' | 'docx_mention' | 'workspace_access_request' | 'conversation_ready' | 'conversation_done' | 'conversation_notified' | 'workflow_failed' | 'agent_input_requested' | 'workflow_completed' | 'workflow_signal' | 'step_ready' | 'task_started' | 'task_completed' | 'mailbox_sync_complete' | 'drive_sync_complete' | 'activity' | 'mention' | 'thread_reply' | 'document_activity' | 'call_missed' | 'calendar_invite' | 'calendar_update' | 'calendar_cancel' | 'calendar_reply' | 'calendar_counter' | 'calendar_reminder' | 'calendar_share';
         /**
          * NotificationUpdate
          * @description Single notification update for bulk PATCH.
@@ -15763,10 +15770,15 @@ interface components {
          *     For local users: given_name and family_name are required
          *     For SSO users: given_name and family_name are optional (extracted from JWT if not provided)
          *
-         *     Key derivation:
-         *     1. Client derives Ed25519 keypair from password using Argon2id
-         *     2. Client sends Ed25519 public key (signing_key)
-         *     3. Backend derives X25519 encryption key from Ed25519 signing key
+         *     Keys:
+         *     1. Client generates a random Ed25519 identity keypair and sends its public key (signing_key);
+         *        the backend derives the X25519 encryption key from it
+         *     2. Client derives the password key from the password (Argon2id) and sends its public key (login_key)
+         *        with the identity's secret key wrapped under it (wrapped_identity_key)
+         *
+         *     Omitting both login_key and wrapped_identity_key makes the password-derived key the identity itself
+         *     (``signing_key`` is then the password key). Scripts and service accounts use this; a password change
+         *     later keeps that identity, so its original password keeps opening it.
          */
         RegisterRequest: {
             /**
@@ -15776,6 +15788,10 @@ interface components {
             email: string;
             /** Signing Key */
             signing_key: string;
+            /** Login Key */
+            login_key?: string | null;
+            /** Wrapped Identity Key */
+            wrapped_identity_key?: string | null;
             /** Verification Credential */
             verification_credential: string;
             /** Given Name */
@@ -18112,51 +18128,10 @@ interface components {
             requests: number;
         };
         /**
-         * TagField
-         * @description A field a tag has — its own, or inherited from an ancestor (``tag_ext_id`` says which tag defines it).
-         */
-        TagField: {
-            /** Id */
-            id: string;
-            /** Name */
-            name: string;
-            /**
-             * Type
-             * @enum {string}
-             */
-            type: 'text' | 'number' | 'date' | 'checkbox' | 'select' | 'person' | 'document' | 'relation' | 'lookup' | 'rollup';
-            /** Options */
-            options?: string[] | null;
-            /** Tag Ext Id */
-            tag_ext_id: string;
-        };
-        /**
-         * TagFormat
-         * @description Tag format configuration stored as JSONB.
-         *
-         *     Type-specific fields:
-         *     - select: options (list of choices, can be single or multi-select)
-         *     - search: tag name is the query, chunks include relevance scores
-         *     - checkbox, text, number: type only
-         */
-        TagFormat: {
-            /**
-             * Type
-             * @default checkbox
-             * @enum {string}
-             */
-            type: 'checkbox' | 'text' | 'number' | 'select' | 'search' | 'date';
-            /**
-             * Options
-             * @default []
-             */
-            options: string[];
-        };
-        /**
-         * TagMatrixDocLink
-         * @description A document a matrix tag is applied to: the doctag's note is the link's value.
+         * TagDocLink
+         * @description A document the tag is applied to: the doctag's note is the link's value.
          */
-        TagMatrixDocLink: {
+        TagDocLink: {
             /** Doc Ext Id */
             doc_ext_id: string;
             /** File Name */
@@ -18175,10 +18150,10 @@ interface components {
             updated_at: string;
         };
         /**
-         * TagMatrixFactLink
-         * @description A fact carrying a matrix tag. A plain link: the fact is relevant to the tag's category.
+         * TagFactLink
+         * @description A fact carrying the tag. A plain link: the fact is relevant to the tag.
          */
-        TagMatrixFactLink: {
+        TagFactLink: {
             /** Fact Ext Id */
             fact_ext_id: string;
             /** Text */
@@ -18191,27 +18166,62 @@ interface components {
              */
             updated_at: string;
         };
-        /** TagMatrixResponse */
-        TagMatrixResponse: {
-            /** Rows */
-            rows?: components['schemas']['TagMatrixRow'][];
-            parent?: components['schemas']['TagResponse'] | null;
-            /** Links Limit */
-            links_limit: number;
+        /**
+         * TagFormat
+         * @description Tag format configuration stored as JSONB.
+         *
+         *     Type-specific fields:
+         *     - select: options (list of choices, can be single or multi-select)
+         *     - search: tag name is the query, chunks include relevance scores
+         *     - checkbox, text, number: type only
+         */
+        TagFormat: {
+            /**
+             * Type
+             * @default checkbox
+             * @enum {string}
+             */
+            type: 'checkbox' | 'text' | 'number' | 'select' | 'search' | 'date';
+            /**
+             * Options
+             * @default []
+             */
+            options: string[];
         };
         /**
-         * TagMatrixRow
-         * @description One tag of the matrix with its evidence. ``docs``/``facts``/``threads`` are capped; the counts are the
-         *     totals.
+         * TagKindSchema
+         * @description A kind's fields in a workspace: the columns of a table of that kind's tags. Each tag holds its own values.
+         *
+         *     ``is_default`` until the workspace sets its own (the kind's built-in fields, whose ids are stable).
          */
-        TagMatrixRow: {
-            tag: components['schemas']['TagResponse'];
+        TagKindSchema: {
+            /**
+             * Kind
+             * @enum {string}
+             */
+            kind: 'label' | 'annotation' | 'search' | 'issue' | 'person' | 'organisation';
+            /** Fields */
+            fields?: components['schemas']['FieldDefinition'][];
+            /**
+             * Is Default
+             * @default false
+             */
+            is_default: boolean;
+            /** Updated At */
+            updated_at?: string | null;
+        };
+        /**
+         * TagLinks
+         * @description A tag's evidence: ``docs``/``facts``/``threads`` newest first, at most the list's ``links_limit`` of each;
+         *     the counts are the totals (a tag with no documents and no facts is a gap).
+         */
+        TagLinks: {
             /** Docs */
-            docs?: components['schemas']['TagMatrixDocLink'][];
+            docs?: components['schemas']['TagDocLink'][];
             /** Facts */
-            facts?: components['schemas']['TagMatrixFactLink'][];
+            facts?: components['schemas']['TagFactLink'][];
             /** Threads */
-            threads?: components['schemas']['TagMatrixThreadLink'][];
+            threads?: components['schemas']['TagThreadLink'][];
             /**
              * Doc Count
              * @default 0
@@ -18228,21 +18238,6 @@ interface components {
              */
             thread_count: number;
         };
-        /**
-         * TagMatrixThreadLink
-         * @description A thread (conversation) carrying a matrix tag.
-         */
-        TagMatrixThreadLink: {
-            /** Conversation Ext Id */
-            conversation_ext_id: string;
-            /** Title */
-            title?: string | null;
-            /**
-             * Updated At
-             * Format: date-time
-             */
-            updated_at: string;
-        };
         /** TagResponse */
         TagResponse: {
             /** External Id */
@@ -18276,12 +18271,11 @@ interface components {
              * @default 0
              */
             convotag_count: number;
-            /** Fields */
-            fields?: components['schemas']['TagField'][];
             /** Field Values */
             field_values?: {
                 [key: string]: unknown;
             };
+            links?: components['schemas']['TagLinks'] | null;
             /** Created By Ext Id */
             created_by_ext_id: string;
             /** Updated By Ext Id */
@@ -18308,6 +18302,21 @@ interface components {
             instruction?: string | null;
             tag_type?: components['schemas']['TagFormat'];
         };
+        /**
+         * TagThreadLink
+         * @description A thread (conversation) carrying the tag.
+         */
+        TagThreadLink: {
+            /** Conversation Ext Id */
+            conversation_ext_id: string;
+            /** Title */
+            title?: string | null;
+            /**
+             * Updated At
+             * Format: date-time
+             */
+            updated_at: string;
+        };
         /**
          * TaskOptions
          * @description Make the conversation an assistant query starts a task: ``POST /v1/assistant/query`` with ``task`` set.
@@ -19062,6 +19071,16 @@ interface components {
              */
             is_identity_verified: boolean;
         };
+        /**
+         * UpdateTagKindRequest
+         * @description The kind's fields, in full and in order: give a field's id to keep it (its type cannot change; its name and
+         *     options can), omit the id to add one. A field left out is removed: the tags' values for it are hidden, and
+         *     come back only with that field (its id), never by adding another of the same name.
+         */
+        UpdateTagKindRequest: {
+            /** Fields */
+            fields: components['schemas']['FieldDefinitionWrite'][];
+        };
         /**
          * UpdateTagRequest
          * @description Partial update. Omitted fields are left unchanged.
@@ -19079,30 +19098,19 @@ interface components {
             tag_type?: components['schemas']['TagFormat'] | null;
             /**
              * Kind
-             * @description New kind. A label can become an issue, person or organisation and back (all presence tags); a format change alone re-derives label/annotation/search.
+             * @description New kind. A label can become an issue, person or organisation and back (all presence tags); a format change alone re-derives label/annotation/search. Issues, people and organisations are flat: a tag becoming one must have no parent and no children.
              */
             kind?: ('label' | 'annotation' | 'search' | 'issue' | 'person' | 'organisation') | null;
-            /**
-             * Kind To Children
-             * @description With kind: also give it to this tag's children whose format allows it (e.g. mark an existing issue list and its issues in one call).
-             * @default false
-             */
-            kind_to_children: boolean;
             /** Shared */
             shared?: boolean | null;
             /**
              * Parent Ext Id
-             * @description Parent tag external ID. Send null to un-nest the tag; omit to leave the parent unchanged.
+             * @description Parent tag external ID (not for issues, people or organisations, which are flat). Send null to un-nest the tag; omit to leave the parent unchanged.
              */
             parent_ext_id?: string | null;
-            /**
-             * Fields
-             * @description The tag's own fields, in full: give a field's id to keep it (its type cannot change), omit the id to add one; fields left out are dropped. Inherited fields are changed on the tag that defines them.
-             */
-            fields?: components['schemas']['FieldDefinitionWrite'][] | null;
             /**
              * Field Values
-             * @description Merged into the current values, keyed by field id or name; null clears a field.
+             * @description Merged into the current values of the kind's fields, keyed by field id or name; null clears one.
              */
             field_values?: {
                 [key: string]: unknown;
@@ -19609,6 +19617,21 @@ interface components {
              * @default []
              */
             muted_users: string[];
+            /**
+             * Muted Workspaces
+             * @default []
+             */
+            muted_workspaces: string[];
+            /**
+             * Followed Workspaces
+             * @default []
+             */
+            followed_workspaces: string[];
+            /**
+             * Followed Threads
+             * @default []
+             */
+            followed_threads: string[];
             email_notifications?: components['schemas']['EmailNotificationSettings'];
             /** Premium Model */
             premium_model?: string | null;
@@ -19688,6 +19711,12 @@ interface components {
             hide_online_status?: boolean | null;
             /** Muted Users */
             muted_users?: string[] | null;
+            /** Muted Workspaces */
+            muted_workspaces?: string[] | null;
+            /** Followed Workspaces */
+            followed_workspaces?: string[] | null;
+            /** Followed Threads */
+            followed_threads?: string[] | null;
             email_notifications?: components['schemas']['EmailNotificationSettingsUpdate'] | null;
             /** Premium Model */
             premium_model?: string | null;
@@ -20094,6 +20123,64 @@ interface components {
             /** Location */
             location?: ('office' | 'home' | 'other') | null;
         };
+        /**
+         * WorkspaceActivityEntry
+         * @description One thing that happened in a workspace that the reader can see.
+         *
+         *     Titles and names are decrypted when the caller's session has the workspace open, and ``None`` otherwise.
+         */
+        WorkspaceActivityEntry: {
+            /** External Id */
+            external_id: string;
+            source: components['schemas']['WorkspaceActivitySource'];
+            /** Kind */
+            kind: string;
+            /** Actor Ext Id */
+            actor_ext_id?: string | null;
+            /** Conversation Ext Id */
+            conversation_ext_id?: string | null;
+            /** Conversation Title */
+            conversation_title?: string | null;
+            /** Message Ext Id */
+            message_ext_id?: string | null;
+            /** Document Ext Id */
+            document_ext_id?: string | null;
+            /** Document Name */
+            document_name?: string | null;
+            /** Version */
+            version?: number | null;
+            /** Workflow Ext Id */
+            workflow_ext_id?: string | null;
+            /** Workflow Name */
+            workflow_name?: string | null;
+            /** Status */
+            status?: string | null;
+            /** Detail */
+            detail?: {
+                [key: string]: unknown;
+            } | null;
+            /**
+             * Created At
+             * Format: date-time
+             */
+            created_at: string;
+        };
+        /**
+         * WorkspaceActivityPage
+         * @description A page of the feed, newest first. Pass ``next_cursor`` back as ``cursor`` for the next one (None: the end).
+         */
+        WorkspaceActivityPage: {
+            /** Items */
+            items: components['schemas']['WorkspaceActivityEntry'][];
+            /** Next Cursor */
+            next_cursor?: string | null;
+        };
+        /**
+         * WorkspaceActivitySource
+         * @description Where a feed entry comes from.
+         * @enum {string}
+         */
+        WorkspaceActivitySource: 'thread' | 'message' | 'document' | 'workflow';
         /** WorkspaceCreateRequest */
         WorkspaceCreateRequest: {
             /** Name */
@@ -22627,6 +22714,41 @@ interface operations {
             };
         };
     };
+    get_workspace_activity: {
+        parameters: {
+            query?: {
+                /** @description ``next_cursor`` of the previous page */
+                cursor?: string | null;
+                limit?: number;
+            };
+            header?: never;
+            path: {
+                workspace_ext_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Successful Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    'application/json': components['schemas']['WorkspaceActivityPage'];
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    'application/json': components['schemas']['HTTPValidationError'];
+                };
+            };
+        };
+    };
     request_docx_agent_v1_editor__document_id__mentions_post: {
         parameters: {
             query?: never;
@@ -24867,7 +24989,18 @@ interface operations {
     };
     list_tags: {
         parameters: {
-            query?: never;
+            query?: {
+                /** @description Only tags of this kind (e.g. every issue) */
+                kind?: ('label' | 'annotation' | 'search' | 'issue' | 'person' | 'organisation') | null;
+                /** @description Only this tag's children (a label hierarchy) */
+                parent?: string | null;
+                /** @description Only these tags, in this order (repeat the parameter) */
+                ids?: string[] | null;
+                /** @description links: each tag's documents (with the doctag's note), facts and threads, and their counts */
+                include?: 'links'[] | null;
+                /** @description With include=links: most documents, facts and threads per tag (newest first) */
+                links_limit?: number;
+            };
             header?: never;
             path?: never;
             cookie?: never;
@@ -24883,20 +25016,53 @@ interface operations {
                     'application/json': components['schemas']['TagResponse'][];
                 };
             };
+            /** @description Validation Error */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    'application/json': components['schemas']['HTTPValidationError'];
+                };
+            };
         };
     };
-    get_tag_matrix: {
+    create_tag: {
         parameters: {
-            query?: {
-                /** @description Rows are this tag's children, oldest first */
-                parent_ext_id?: string | null;
-                /** @description Rows are these tags, in this order (repeatable) */
-                tag_ext_id?: string[] | null;
-                /** @description Rows are every tag of this kind, oldest first */
-                kind?: ('label' | 'annotation' | 'search' | 'issue' | 'person' | 'organisation') | null;
-                /** @description Most documents and facts per row */
-                links_limit?: number;
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                'application/json': components['schemas']['CreateTagRequest'];
             };
+        };
+        responses: {
+            /** @description Successful Response */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    'application/json': components['schemas']['TagResponse'];
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    'application/json': components['schemas']['HTTPValidationError'];
+                };
+            };
+        };
+    };
+    list_tag_kinds: {
+        parameters: {
+            query?: never;
             header?: never;
             path?: never;
             cookie?: never;
@@ -24909,7 +25075,29 @@ interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['TagMatrixResponse'];
+                    'application/json': components['schemas']['TagKindSchema'][];
+                };
+            };
+        };
+    };
+    get_tag_kind: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                kind: 'label' | 'annotation' | 'search' | 'issue' | 'person' | 'organisation';
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Successful Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    'application/json': components['schemas']['TagKindSchema'];
                 };
             };
             /** @description Validation Error */
@@ -24923,29 +25111,28 @@ interface operations {
             };
         };
     };
-    extract_entities: {
+    update_tag_kind: {
         parameters: {
-            query?: {
-                /** @description Configuration to use for the LLM */
-                config_ext_id?: string | null;
-            };
+            query?: never;
             header?: never;
-            path?: never;
+            path: {
+                kind: 'label' | 'annotation' | 'search' | 'issue' | 'person' | 'organisation';
+            };
             cookie?: never;
         };
         requestBody: {
             content: {
-                'application/json': components['schemas']['ExtractEntitiesRequest'];
+                'application/json': components['schemas']['UpdateTagKindRequest'];
             };
         };
         responses: {
             /** @description Successful Response */
-            202: {
+            200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['ExtractEntitiesResponse'];
+                    'application/json': components['schemas']['TagKindSchema'];
                 };
             };
             /** @description Validation Error */
@@ -24959,26 +25146,29 @@ interface operations {
             };
         };
     };
-    create_tag: {
+    extract_entities: {
         parameters: {
-            query?: never;
+            query?: {
+                /** @description Configuration to use for the LLM */
+                config_ext_id?: string | null;
+            };
             header?: never;
             path?: never;
             cookie?: never;
         };
         requestBody: {
             content: {
-                'application/json': components['schemas']['CreateTagRequest'];
+                'application/json': components['schemas']['ExtractEntitiesRequest'];
             };
         };
         responses: {
             /** @description Successful Response */
-            201: {
+            202: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    'application/json': components['schemas']['TagResponse'];
+                    'application/json': components['schemas']['ExtractEntitiesResponse'];
                 };
             };
             /** @description Validation Error */
@@ -30541,28 +30731,6 @@ interface operations {
             };
         };
     };
-    rotation_credentials_v1_mail_native_rotation_credentials_get: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description Successful Response */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    'application/json': {
-                        [key: string]: string;
-                    };
-                };
-            };
-        };
-    };
     save_draft_v1_mail_accounts__account_id__drafts_post: {
         parameters: {
             query?: never;
@@ -30946,6 +31114,8 @@ interface CryptoProvider {
 interface SessionKeys {
     signingPrivateKey: Uint8Array;
     serverSessionKey?: Uint8Array;
+    /** The identity wrapped under the password key (see SessionData.wrappedIdentityKey). */
+    wrappedIdentityKey?: string | null;
 }
 interface SessionStorageProvider {
     getSession(): Promise<SessionKeys | null>;
@@ -30971,6 +31141,8 @@ interface LoginResult$1 {
     accessToken: string;
     sessionKey: Uint8Array;
     userExtId?: string;
+    /** The login response's `wrapped_identity_key`, saved with the session. */
+    wrappedIdentityKey?: string | null;
 }
 /** Performs the login API call. Transport details are the consumer's concern. */
 interface LoginProvider {
@@ -31283,10 +31455,15 @@ declare function generateUserKeypairs(username: string, password: string, deploy
  * Generates registration, login, and password-change credentials.
  * Uses inline type definitions (structurally identical to OpenAPI schema types)
  * to avoid coupling the crypto module to the schema file.
+ *
+ * Two keys are in play (see ./identity.ts): the account identity, a fixed random Ed25519 keypair, and the
+ * password key, derived from email + password, which signs password logins and wraps the identity.
  */
 interface RegisterRequest {
     email: string;
     signing_key: string;
+    login_key?: string | null;
+    wrapped_identity_key?: string | null;
     verification_credential: string;
     given_name?: string | null;
     family_name?: string | null;
@@ -31301,8 +31478,8 @@ interface LoginRequest {
 interface ChangePasswordRequest {
     signature: string;
     timestamp: number;
-    new_signing_key: string;
-    rewrapped_workspace_keys: Record<string, string>;
+    new_login_key: string;
+    wrapped_identity_key: string;
 }
 /**
  * Credentials returned by generate functions.
@@ -31311,76 +31488,77 @@ interface ChangePasswordRequest {
  */
 interface RegistrationCredentials {
     request: RegisterRequest;
+    /** The new account's identity secret key (what the session keeps, and the recovery key). */
     signingPrivateKey: Uint8Array;
 }
 interface LoginCredentials {
     request: LoginRequest;
+    /**
+     * The password key that signed the request. Not the identity: open it from the response with
+     * `unwrapIdentityKey(response.wrapped_identity_key, passwordPrivateKey)`.
+     */
+    passwordPrivateKey: Uint8Array;
+}
+interface KeyLoginCredentials {
+    request: LoginRequest;
+    /** The identity secret key that signed the request (recovery key, session re-login). */
     signingPrivateKey: Uint8Array;
 }
 interface PasswordChangeCredentials {
-    request: Omit<ChangePasswordRequest, 'rewrapped_workspace_keys'>;
-    newSigningPrivateKey: Uint8Array;
+    request: ChangePasswordRequest;
 }
 /**
- * Generate registration credentials with Ed25519 signing key.
+ * Generate registration credentials: a random identity, wrapped under the password key.
  *
- * Creates Ed25519 keypair deterministically from email + password.
- * Server receives the Ed25519 public key (signing_key) and derives X25519 from it.
- *
- * @param registrationData - Registration fields (signing_key will be generated)
- * @param password - User's password (to generate keypair)
- * @param deploymentDomain - Deployment domain for salt derivation
- * @returns RegistrationCredentials with request body and private key (kept separate)
+ * The server stores the identity public key (signing_key, and the X25519 key it derives from it), the password
+ * key (login_key) and the wrapped identity.
  */
-declare function generateRegistrationCredentials(registrationData: Omit<RegisterRequest, 'signing_key'>, password: string, deploymentDomain: string): Promise<RegistrationCredentials>;
+declare function generateRegistrationCredentials(registrationData: Omit<RegisterRequest, 'signing_key' | 'login_key' | 'wrapped_identity_key'>, password: string, deploymentDomain: string): Promise<RegistrationCredentials>;
 /**
- * Generate login credentials with Ed25519 signature authentication.
- *
- * Derives Ed25519 keypair from email + password and signs "email|timestamp".
- * Server verifies signature using stored Ed25519 public key.
- *
- * @param loginData - Login fields (signature and timestamp will be generated)
- * @param password - User's password (to regenerate keypair)
- * @param deploymentDomain - Deployment domain for salt derivation
- * @returns LoginCredentials with request body and private key (kept separate)
+ * Generate password-login credentials: derive the password key and sign "email|timestamp" with it.
  */
 declare function generateLoginCredentials(loginData: Omit<LoginRequest, 'signature' | 'timestamp'>, password: string, deploymentDomain: string): Promise<LoginCredentials>;
 /**
- * Generate login credentials using an existing signing key (for password recovery).
- *
- * Bypasses password derivation and uses the provided key directly.
- *
- * @param loginData - Login fields (signature and timestamp will be generated)
- * @param signingPrivateKey - The Ed25519 signing private key (64 bytes)
- * @returns LoginCredentials with request body and private key
+ * Generate login credentials signed by the identity key itself (recovery key, session re-login).
  */
-declare function generateLoginCredentialsFromKey(loginData: Omit<LoginRequest, 'signature' | 'timestamp'>, signingPrivateKey: Uint8Array): LoginCredentials;
+declare function generateLoginCredentialsFromKey(loginData: Omit<LoginRequest, 'signature' | 'timestamp'>, signingPrivateKey: Uint8Array): KeyLoginCredentials;
 /**
- * Generate change password credentials with Ed25519 signature authentication.
+ * Generate a password change: the identity is kept, re-wrapped under the new password key.
  *
- * Signs "email|timestamp" with current Ed25519 key to prove knowledge of current password.
- * Provides new Ed25519 public key derived from new password.
- *
- * @param email - User's email address
- * @param currentPassword - Current password (to sign with current key)
- * @param newPassword - New password (to generate new key)
- * @param deploymentDomain - Deployment domain for salt derivation
- * @returns PasswordChangeCredentials with request body and new private key (kept separate)
+ * Signed with the current password key when `currentPassword` is given (proves it), else with the identity key
+ * (recovery: the user signed in with the recovery key and no longer knows the password).
  */
-declare function generatePasswordChangeCredentials(email: string, currentPassword: string, newPassword: string, deploymentDomain: string): Promise<PasswordChangeCredentials>;
+declare function generatePasswordChangeCredentials(params: {
+    email: string;
+    identitySecretKey: Uint8Array;
+    newPassword: string;
+    currentPassword?: string;
+}, deploymentDomain: string): Promise<PasswordChangeCredentials>;
+
 /**
- * Generate password change credentials for recovery mode.
+ * The account identity and the password key that wraps it.
  *
- * Used when the user is recovering their account with a recovery key.
- * Signs with the existing signing key (from recovery) instead of deriving from password.
+ * The identity is a fixed Ed25519 keypair (its X25519 form is what workspace keys, mailbox keys and direct
+ * messages are encrypted to). The password derives a separate "password key" (Argon2id, `generateUserKeypairs`)
+ * that signs password logins and wraps the identity's secret key. Changing the password re-wraps the identity
+ * and re-encrypts nothing.
  *
- * @param email - User's email address
- * @param currentSigningKey - Current signing key (from recovery)
- * @param newPassword - New password (to generate new key)
- * @param deploymentDomain - Deployment domain for salt derivation
- * @returns PasswordChangeCredentials with request body and new private key
+ * Accounts registered before this existed have no wrap: their password key IS the identity
+ * (`wrapped_identity_key` is null in the login response).
+ *
+ * Same scheme as the Python SDK (`arbi_client.sdk.crypto`): BLAKE2b-256 keyed by the password key's seed over
+ * a fixed context gives a SecretBox key; the wrap is base64 of `nonce(24) ‖ secretbox(identity secret key)`.
+ */
+
+/** A fresh random identity (Ed25519; secretKey is the 64-byte form). */
+declare function generateIdentityKeypair(): KeyPair;
+/** Wrap the identity's 64-byte Ed25519 secret key under a password key. */
+declare function wrapIdentityKey(identitySecretKey: Uint8Array, passwordSecretKey: Uint8Array): string;
+/**
+ * The identity's 64-byte Ed25519 secret key a password key opens: unwrapped from `wrapped`, or the password key
+ * itself when nothing is wrapped. Throws when the password key does not open the wrap (a wrong password).
  */
-declare function generateRecoveryPasswordChangeCredentials(email: string, currentSigningKey: Uint8Array, newPassword: string, deploymentDomain: string): Promise<PasswordChangeCredentials>;
+declare function unwrapIdentityKey(wrapped: string | null | undefined, passwordSecretKey: Uint8Array): Uint8Array;
 
 /**
  * storage.ts - IndexedDB Storage Module
@@ -31417,9 +31595,16 @@ declare function canPersistSession(): boolean;
  * Note: accessToken is stored in Zustand (persisted separately), not here.
  */
 interface SessionData {
+    /** The account identity's Ed25519 secret key (64 bytes) - X25519 derived from this */
     signingPrivateKey: Uint8Array;
     serverSessionKey?: Uint8Array;
     userExtId?: string;
+    /**
+     * The identity wrapped under the password key, as the last login returned it (null: the password key is
+     * the identity). Lets a typed password be checked, and the identity opened, without the server (offline
+     * unlock, step-up confirmations). Ciphertext under the password key, so it is stored as is.
+     */
+    wrappedIdentityKey?: string | null;
 }
 /**
  * Initialize IndexedDB database.
@@ -31449,12 +31634,11 @@ declare function saveSession(sessionData: SessionData): Promise<void>;
  */
 declare function getSession(): Promise<SessionData | null>;
 /**
- * Update the signing private key in IndexedDB (used when changing password).
- * This re-encrypts the new key while preserving other session data.
+ * Replace the stored wrapped identity (after a password change), keeping the rest of the session.
  *
- * @param newSigningPrivateKey - New Ed25519 private key to store
+ * @param wrappedIdentityKey - The identity wrapped under the new password key
  */
-declare function updateSigningPrivateKey(newSigningPrivateKey: Uint8Array): Promise<void>;
+declare function updateWrappedIdentityKey(wrappedIdentityKey: string): Promise<void>;
 /**
  * Clear session data from IndexedDB.
  */
@@ -31500,7 +31684,8 @@ interface RegisterResult {
 /**
  * Login flow
  *
- * Generates Ed25519 signature → posts to /v1/user/login → saves session
+ * Signs "email|timestamp" (password key, or the identity key itself) → posts to /v1/user/login → opens the
+ * identity → saves session
  */
 
 interface LoginParams {
@@ -31532,6 +31717,7 @@ interface LoginResult {
     parentExtId?: string | null;
     /** The profile from the login response, so hosts need no second request for the name. */
     profile?: LoginProfile;
+    /** The account identity's secret key (the session key material, and the recovery key). */
     signingPrivateKey: Uint8Array;
     serverSessionKey: Uint8Array;
 }
@@ -31539,46 +31725,57 @@ interface LoginResult {
 /**
  * Change password flow
  *
- * Generates old + new credentials → posts to /v1/user/change_password → updates stored key
+ * The password only wraps the account identity (see ../crypto/identity.ts). Changing it derives the new password
+ * key, re-wraps the session's identity under it and posts both to /v1/user/change_password: one request, O(1).
+ * Workspace keys, mailbox keys and direct messages stay encrypted to the unchanged identity, so nothing is
+ * re-encrypted, nothing can be missed and the other party of a conversation is unaffected. The recovery key
+ * (the identity secret key) is unchanged too.
  */
 
 interface ChangePasswordParams {
     email: string;
-    currentPassword: string;
     newPassword: string;
-    rewrappedWorkspaceKeys?: Record<string, string>;
-}
-interface ChangePasswordResult {
-    newSigningPrivateKey: Uint8Array;
-}
-interface RekeyedPasswordChangeParams {
-    email: string;
-    newPassword: string;
-    /** The current password. Omit in recovery mode: the session's own signing key proves identity. */
+    /** The current password. Omit in recovery mode: the session's identity key signs instead. */
     currentPassword?: string;
-    /** The caller's `usr-` id; needed to tell sent from received direct messages. */
-    userExtId?: string;
+    /**
+     * The account identity's secret key. Omitted: read from the browser session store, which is then
+     * updated with the new wrap (hosts with their own key store pass it and keep `wrappedIdentityKey`).
+     */
+    identitySecretKey?: Uint8Array;
 }
-interface RekeyedPasswordChangeResult {
-    newSigningPrivateKey: Uint8Array;
-    /** Workspaces the server re-keyed. */
-    workspacesUpdated: number;
-    /** Direct messages re-encrypted for the new key. */
-    messagesReEncrypted: number;
+interface ChangePasswordResult {
+    /** The identity wrapped under the new password key (what a password login now returns). */
+    wrappedIdentityKey: string;
 }
-type FetchClient = ReturnType<typeof createFetchClient<paths>>;
 /** Pull a readable message out of whatever shape a failed call carried (`{ detail }`, `Error`). */
 declare function passwordChangeErrorMessage(err: unknown): string;
 /**
- * Change (or, in recovery mode, set) the master password: derive the new keys, re-wrap the key of
- * every workspace the user is a member of for them, re-encrypt direct messages, post it all to
- * `/v1/user/change_password`, then store the new signing key. The caller shows the recovery key
- * for `newSigningPrivateKey` afterwards.
+ * Change (or, in recovery mode, set) the master password of the signed-in account.
  */
-declare function changePasswordWithRekey(params: RekeyedPasswordChangeParams, deps: {
-    fetchClient: FetchClient;
+declare function changePassword(params: ChangePasswordParams, deps: {
+    fetchClient: ReturnType<typeof createFetchClient<paths>>;
     deploymentDomain: string;
-}): Promise<RekeyedPasswordChangeResult>;
+}): Promise<ChangePasswordResult>;
+
+/**
+ * Opening the account identity with a password (see ../crypto/identity.ts).
+ */
+/**
+ * The identity a password login opened: unwrapped from the response with the password key that signed it (or
+ * the password key itself for an account whose password key is its identity). Refuses an identity that is not
+ * the account's, so a wrong wrap cannot become the session's key.
+ */
+declare function identityFromLoginResponse(passwordPrivateKey: Uint8Array, response: {
+    wrapped_identity_key?: string | null;
+    user: {
+        encryption_public_key: string;
+    };
+}): Uint8Array;
+/**
+ * Check a typed password against the signed-in session and return the identity it opens (step-up
+ * confirmations, offline unlock). Uses the wrap saved at the last login; throws "Incorrect password".
+ */
+declare function unlockIdentityWithPassword(email: string, password: string, deploymentDomain: string): Promise<Uint8Array>;
 
 /**
  * createArbiClient() — SDK entry point
@@ -31802,4 +31999,4 @@ interface ReopenDeps {
  */
 declare function createWorkspaceReopener(deps: ReopenDeps): () => Promise<boolean>;
 
-export { type $defs, API_PREFIX, type ArbiClient, type ArbiClientOptions, type AuthStateProvider, type AutoReloginMiddlewareConfig, type BearerAuthMiddlewareConfig, CALL_KEY_BYTES, type ChangePasswordParams, type ChangePasswordRequest, type ChangePasswordResult, type CryptoProvider, type KeyPair, type LoginCredentials, type LoginParams, type LoginProfile, type LoginProvider, type LoginRequest, type LoginResult, type LoginWithKeyParams, type OnReloginSuccess, type PasswordChangeCredentials, type RegisterParams, type RegisterRequest, type RegisterResult, type RegistrationCredentials, type RekeyedPasswordChangeParams, type RekeyedPasswordChangeResult, type ReloginDeps, type ReloginHandler, type ReopenDeps, type SessionData, type SessionKeys, type SessionManager, type SessionState, type SessionStorageProvider, type SsoTokenProvider, type TokenProvider, type UserKeypairs, type WebSocketClientMessage, type WebSocketServerMessage, type WorkspaceKeyRefreshProvider, type WorkspaceOpenProvider, type WsAuthMessage, type WsAuthResultMessage, type WsBatchCompleteMessage, type WsConnectionClosedMessage, type WsConversationMessagePostedMessage, type WsErrorMessage, type WsNotificationResponse, type WsPresenceUpdateMessage, type WsResponseCompleteMessage, type WsTaskUpdateMessage, base64Decode, base64Encode, base64ToBytes, buildCallFragment, buildWebSocketUrl, bytesToBase64, canPersistSession, changePasswordWithRekey, clearAllData, clearSession, type components, computeSharedSecret, createArbiClient, createAuthMessage, createAutoReloginMiddleware, createBearerAuthMiddleware, createContentHash, createReloginHandler, createSessionManager, createWorkspaceReopener, decodeCallKey, decryptCallTitle, decryptFile, decryptMessage, decryptMessageWithSharedSecret, deriveEncryptionKeypairFromSigning, derivePublicKey, encodeCallKey, encryptCallTitle, encryptFile, encryptMessage, encryptMessageWithSharedSecret, generateCallKey, generateKeyPairs, generateLoginCredentials, generateLoginCredentialsFromKey, generatePasswordChangeCredentials, generateRandomSigningKeypair, generateRecoveryPasswordChangeCredentials, generateRegistrationCredentials, generateUserKeypairs, getSession, getUserEncryptionKeypair, hasSession, initSodium, initializeDatabase, isMessageType, openSealedCallKey, type operations, parseCallFragment, parseServerMessage, passwordChangeErrorMessage, type paths, prewarmKeyPairs, saveSession, sealCallKey, sealKeyForSession, sealedBoxDecrypt, sealedBoxEncrypt, signMessage, updateSigningPrivateKey, type webhooks };
+export { type $defs, API_PREFIX, type ArbiClient, type ArbiClientOptions, type AuthStateProvider, type AutoReloginMiddlewareConfig, type BearerAuthMiddlewareConfig, CALL_KEY_BYTES, type ChangePasswordParams, type ChangePasswordRequest, type ChangePasswordResult, type CryptoProvider, type KeyLoginCredentials, type KeyPair, type LoginCredentials, type LoginParams, type LoginProfile, type LoginProvider, type LoginRequest, type LoginResult, type LoginWithKeyParams, type OnReloginSuccess, type PasswordChangeCredentials, type RegisterParams, type RegisterRequest, type RegisterResult, type RegistrationCredentials, type ReloginDeps, type ReloginHandler, type ReopenDeps, type SessionData, type SessionKeys, type SessionManager, type SessionState, type SessionStorageProvider, type SsoTokenProvider, type TokenProvider, type UserKeypairs, type WebSocketClientMessage, type WebSocketServerMessage, type WorkspaceKeyRefreshProvider, type WorkspaceOpenProvider, type WsAuthMessage, type WsAuthResultMessage, type WsBatchCompleteMessage, type WsConnectionClosedMessage, type WsConversationMessagePostedMessage, type WsErrorMessage, type WsNotificationResponse, type WsPresenceUpdateMessage, type WsResponseCompleteMessage, type WsTaskUpdateMessage, base64Decode, base64Encode, base64ToBytes, buildCallFragment, buildWebSocketUrl, bytesToBase64, canPersistSession, changePassword, clearAllData, clearSession, type components, computeSharedSecret, createArbiClient, createAuthMessage, createAutoReloginMiddleware, createBearerAuthMiddleware, createContentHash, createReloginHandler, createSessionManager, createWorkspaceReopener, decodeCallKey, decryptCallTitle, decryptFile, decryptMessage, decryptMessageWithSharedSecret, deriveEncryptionKeypairFromSigning, derivePublicKey, encodeCallKey, encryptCallTitle, encryptFile, encryptMessage, encryptMessageWithSharedSecret, generateCallKey, generateIdentityKeypair, generateKeyPairs, generateLoginCredentials, generateLoginCredentialsFromKey, generatePasswordChangeCredentials, generateRandomSigningKeypair, generateRegistrationCredentials, generateUserKeypairs, getSession, getUserEncryptionKeypair, hasSession, identityFromLoginResponse, initSodium, initializeDatabase, isMessageType, openSealedCallKey, type operations, parseCallFragment, parseServerMessage, passwordChangeErrorMessage, type paths, prewarmKeyPairs, saveSession, sealCallKey, sealKeyForSession, sealedBoxDecrypt, sealedBoxEncrypt, signMessage, unlockIdentityWithPassword, unwrapIdentityKey, updateWrappedIdentityKey, type webhooks, wrapIdentityKey };