@arbidocs/client 0.5.57 → 0.5.59

package/dist/index.d.cts

@@ -1,5 +1,36 @@
 import createFetchClient, { Middleware } from 'openapi-fetch';
 
+/** HTTP plumbing only: no token, workspace selection, response-body parsing or retries. */
+interface HttpRequestInfo {
+    readonly method: string;
+    /** URL without credentials, query or fragment; hooks never receive bodies or headers. */
+    readonly url: string;
+}
+interface HttpResponseInfo extends HttpRequestInfo {
+    readonly status: number;
+    readonly durationMs: number;
+}
+interface HttpErrorInfo extends HttpRequestInfo {
+    readonly error: unknown;
+    readonly durationMs: number;
+}
+interface HttpTransportOptions {
+    /** Fetch-compatible implementation; defaults to globalThis.fetch at request time. */
+    fetch?: typeof globalThis.fetch;
+    /** Time until the adapter returns a Response (native fetch: headers). Disabled by default. */
+    timeoutMs?: number;
+    onRequest?: (request: HttpRequestInfo) => void;
+    onResponse?: (response: HttpResponseInfo) => void;
+    onError?: (failure: HttpErrorInfo) => void;
+}
+interface HttpTransport {
+    readonly fetch: typeof globalThis.fetch;
+    readonly customFetch: boolean;
+    /** Use the same timeout/hooks with a specialized adapter, such as upload-progress XHR. */
+    withFetch(adapter: typeof globalThis.fetch): typeof globalThis.fetch;
+}
+declare function createHttpTransport(options?: HttpTransportOptions): HttpTransport;
+
 /**
  * This file was auto-generated by openapi-typescript.
  * Do not make direct changes to the file.
@@ -39279,6 +39310,8 @@ interface BearerAuthMiddlewareConfig {
 /** The new access token, or `null`. Ending a session the server refused is the handler's job. */
 type ReloginHandler = () => Promise<string | null>;
 interface AutoReloginMiddlewareConfig {
+    /** Send recovered requests through the same configured/session-gated transport. */
+    fetch?: typeof globalThis.fetch;
     reloginHandler: ReloginHandler;
     /** URL substrings that should never trigger re-login (e.g. the login endpoint itself) */
     reloginExcludePatterns?: string[];
@@ -39324,12 +39357,14 @@ interface SessionKeys {
 }
 /**
  * Where the signed-in identity is kept between page loads (the signing key and the server session
- * key). Browsers default to the bundled encrypted IndexedDB store; Node hosts pass a file-backed
- * one. A silent re-login reads the key from here and saves the new server session key back.
+ * key). Browsers default to the bundled encrypted IndexedDB store; without IndexedDB the default
+ * is per-client memory. Hosts may supply their own persistence. A silent re-login reads the key from here and saves the new server session key back.
  */
 interface SessionPersistence {
     getSession(): Promise<SessionKeys | null>;
     saveSession(data: SessionKeys): Promise<void>;
+    /** Clear local key material when signing out everywhere. Optional for existing adapters. */
+    clearSession?(): Promise<void>;
 }
 interface AuthStateProvider {
     getUserEmail(): string | null;
@@ -40426,6 +40461,8 @@ declare function disconnectSso(params: DisconnectSsoParams, deps: DisconnectSsoD
 
 declare const API_PREFIX: "/v1";
 interface ArbiClientOptions {
+    /** Shared HTTP adapter, header timeout and metadata hooks; no workspace or retry policy. */
+    transport?: HttpTransportOptions;
     /**
      * Base URL for the ARBI API (e.g. "https://api.mydeployment.com"; `''` for the page's own
      * origin). A function is read on every request: a host whose configuration arrives after the
@@ -40446,8 +40483,8 @@ interface ArbiClientOptions {
     session?: SessionManager;
     /**
      * Where the signing key and server session key are kept between page loads. Browsers default to
-     * the bundled encrypted IndexedDB store; Node consumers (CLI, integration tests) pass a
-     * file-backed one, or a 401 has no key to re-login with.
+     * the bundled encrypted IndexedDB store; without IndexedDB the default is per-client memory.
+     * Supply an adapter explicitly to persist Node sessions beyond this instance.
      */
     persistence?: SessionPersistence;
     /**
@@ -40476,6 +40513,8 @@ interface ArbiClientOptions {
     userEmail?: string;
 }
 interface ArbiClient {
+    /** Session-gated HTTP for raw streaming/multipart adapters. Optional for existing host adapters. */
+    http?: HttpTransport;
     /** Type-safe openapi-fetch client with middleware */
     fetch: ReturnType<typeof createFetchClient<paths>>;
     /** In-memory session state */
@@ -40572,7 +40611,7 @@ interface ArbiClient {
         encryptMessageWithSharedSecret: typeof encryptMessageWithSharedSecret;
         decryptMessageWithSharedSecret: typeof decryptMessageWithSharedSecret;
     };
-    /** IndexedDB storage operations */
+    /** The same session-key persistence used by login and session recovery. */
     storage: {
         getSession: typeof getSession;
         saveSession: typeof saveSession;
@@ -40746,4 +40785,7 @@ interface OpenAllDeps {
  */
 declare function createAllWorkspacesOpener(deps: OpenAllDeps): () => Promise<void>;
 
-export { type $defs, ACCESS_TOKEN_STORAGE_KEY, API_PREFIX, type ArbiClient, type ArbiClientOptions, type AuthStateProvider, type AutoReloginMiddlewareConfig, type BearerAuthMiddlewareConfig, CALL_KEY_BYTES, CHAT_KEY_BYTES, type CallPeer, type ChangePasswordParams, type ChangePasswordRequest, type ChangePasswordResult, type CryptoProvider, type DisconnectSsoParams, ENCRYPTED_RECOVERY_KEY_SIZE, type KeyLoginCredentials, type KeyPair, type ListedWorkspaceKey, type LoginCredentials, type LoginParams, type LoginProfile, type LoginProvider, type LoginRequest, type LoginResponse, type LoginResult, type LoginWithKeyParams, type OfflineSealer, type OfflineSealerOptions, type OnReloginSuccess, type OpenAllDeps, type ParsedRecoveryUrl, type PasswordChangeCredentials, RECOVERY_KEY_ERRORS, type RecoveryKeyParams, type RecoveryKeyValidationResult, type RegisterParams, type RegisterRequest, type RegisterResult, type RegistrationCredentials, type ReloginDeps, type ReloginFailure, type ReloginHandler, type ReopenDeps, SECURE_MAIL_KEY_BYTES, type SealedSecureMail, type SecureMailCiphertexts, type SecureMailClaim, type SessionClaims, type SessionData, type SessionKeys, type SessionManager, type SessionManagerOptions, type SessionPersistence, type SessionSignIn, type SessionState, type SessionStateStorage, type SessionUser, type SignInHooks, type SsoTokenSource, type StoredSessionState, type TokenProvider, UNENCRYPTED_RECOVERY_KEY_SIZE, type UserKeypairs, type WebSocketClientMessage, type WebSocketServerMessage, type WorkspaceKeyRefreshProvider, type WorkspaceKeys, type WorkspaceOpenProvider, type WorkspaceOpens, type WsAgentDmStatusMessage, type WsAuthMessage, type WsAuthResultMessage, type WsBatchCompleteMessage, type WsChatMessageMessage, type WsChatReadMessage, type WsChatUpdatedMessage, type WsConnectionClosedMessage, type WsConversationMessagePostedMessage, type WsErrorMessage, type WsNotificationResponse, type WsPresenceUpdateMessage, type WsResponseCompleteMessage, type WsTaskUpdateMessage, authRequestError, base64Decode, base64Encode, base64ToBytes, base64UrlToBytes, browserSessionStateStorage, buildCallFragment, buildCallLink, buildWebSocketUrl, bytesToBase64, bytesToBase64Url, canPersistSession, changePassword, clearAllData, clearSession, type components, computeSharedSecret, createAllWorkspacesOpener, createArbiClient, createAuthMessage, createAutoReloginMiddleware, createBearerAuthMiddleware, createContentHash, createOfflineSealer, createRecoveryFile, createRecoveryUrl, createReloginHandler, createSessionManager, createWorkspaceKeys, createWorkspaceOpens, createWorkspaceReopener, decodeCallKey, decodeSecureMailKey, decryptCallTitle, decryptFile, decryptMessage, decryptMessageWithSharedSecret, decryptRecoveryKey, decryptWithChatKey, deriveDirectChatKey, deriveEncryptionKeypairFromSigning, derivePublicKey, disconnectSso, encodeCallKey, encryptCallTitle, encryptFile, encryptMessage, encryptMessageWithSharedSecret, encryptRecoveryKey, encryptWithChatKey, encryptionKeypairFromSigningKey, generateCallKey, generateChatKey, generateIdentityKeypair, generateKeyPairs, generateLoginCredentials, generateLoginCredentialsFromKey, generatePasswordChangeCredentials, generateRandomSigningKeypair, generateRegistrationCredentials, generateUserKeypairs, getRecoveryKeyFilename, getSession, getUserEncryptionKeypair, hasSession, identityFromLoginResponse, initSodium, initializeDatabase, isAbortError, isEncryptedRecoveryKey, isMessageType, openCallKeyOf, openSealedCallKey, openSealedChatKey, openSecureMail, type operations, parseCallFragment, parseRecoveryUrl, parseServerMessage, passwordChangeErrorMessage, type paths, prewarmKeyPairs, readSessionClaims, requestSsoDisconnectCode, saveSession, sealCallKey, sealCallKeyForPeers, sealChatKey, sealKeyForSession, sealSecureMail, sealedBoxDecrypt, sealedBoxEncrypt, secureMailClaim, signMessage, unlockIdentityWithPassword, unwrapIdentityKey, unwrapWorkspaceKey, updateWrappedIdentityKey, validateRecoveryKeyFile, type webhooks, workspaceKeyRequiredOf, wrapIdentityKey };
+/** Per-client memory only: no browser globals, files or process-wide shared identity. */
+declare function createMemorySessionPersistence(): SessionPersistence;
+
+export { type $defs, ACCESS_TOKEN_STORAGE_KEY, API_PREFIX, type ArbiClient, type ArbiClientOptions, type AuthStateProvider, type AutoReloginMiddlewareConfig, type BearerAuthMiddlewareConfig, CALL_KEY_BYTES, CHAT_KEY_BYTES, type CallPeer, type ChangePasswordParams, type ChangePasswordRequest, type ChangePasswordResult, type CryptoProvider, type DisconnectSsoParams, ENCRYPTED_RECOVERY_KEY_SIZE, type HttpErrorInfo, type HttpRequestInfo, type HttpResponseInfo, type HttpTransport, type HttpTransportOptions, type KeyLoginCredentials, type KeyPair, type ListedWorkspaceKey, type LoginCredentials, type LoginParams, type LoginProfile, type LoginProvider, type LoginRequest, type LoginResponse, type LoginResult, type LoginWithKeyParams, type OfflineSealer, type OfflineSealerOptions, type OnReloginSuccess, type OpenAllDeps, type ParsedRecoveryUrl, type PasswordChangeCredentials, RECOVERY_KEY_ERRORS, type RecoveryKeyParams, type RecoveryKeyValidationResult, type RegisterParams, type RegisterRequest, type RegisterResult, type RegistrationCredentials, type ReloginDeps, type ReloginFailure, type ReloginHandler, type ReopenDeps, SECURE_MAIL_KEY_BYTES, type SealedSecureMail, type SecureMailCiphertexts, type SecureMailClaim, type SessionClaims, type SessionData, type SessionKeys, type SessionManager, type SessionManagerOptions, type SessionPersistence, type SessionSignIn, type SessionState, type SessionStateStorage, type SessionUser, type SignInHooks, type SsoTokenSource, type StoredSessionState, type TokenProvider, UNENCRYPTED_RECOVERY_KEY_SIZE, type UserKeypairs, type WebSocketClientMessage, type WebSocketServerMessage, type WorkspaceKeyRefreshProvider, type WorkspaceKeys, type WorkspaceOpenProvider, type WorkspaceOpens, type WsAgentDmStatusMessage, type WsAuthMessage, type WsAuthResultMessage, type WsBatchCompleteMessage, type WsChatMessageMessage, type WsChatReadMessage, type WsChatUpdatedMessage, type WsConnectionClosedMessage, type WsConversationMessagePostedMessage, type WsErrorMessage, type WsNotificationResponse, type WsPresenceUpdateMessage, type WsResponseCompleteMessage, type WsTaskUpdateMessage, authRequestError, base64Decode, base64Encode, base64ToBytes, base64UrlToBytes, browserSessionStateStorage, buildCallFragment, buildCallLink, buildWebSocketUrl, bytesToBase64, bytesToBase64Url, canPersistSession, changePassword, clearAllData, clearSession, type components, computeSharedSecret, createAllWorkspacesOpener, createArbiClient, createAuthMessage, createAutoReloginMiddleware, createBearerAuthMiddleware, createContentHash, createHttpTransport, createMemorySessionPersistence, createOfflineSealer, createRecoveryFile, createRecoveryUrl, createReloginHandler, createSessionManager, createWorkspaceKeys, createWorkspaceOpens, createWorkspaceReopener, decodeCallKey, decodeSecureMailKey, decryptCallTitle, decryptFile, decryptMessage, decryptMessageWithSharedSecret, decryptRecoveryKey, decryptWithChatKey, deriveDirectChatKey, deriveEncryptionKeypairFromSigning, derivePublicKey, disconnectSso, encodeCallKey, encryptCallTitle, encryptFile, encryptMessage, encryptMessageWithSharedSecret, encryptRecoveryKey, encryptWithChatKey, encryptionKeypairFromSigningKey, generateCallKey, generateChatKey, generateIdentityKeypair, generateKeyPairs, generateLoginCredentials, generateLoginCredentialsFromKey, generatePasswordChangeCredentials, generateRandomSigningKeypair, generateRegistrationCredentials, generateUserKeypairs, getRecoveryKeyFilename, getSession, getUserEncryptionKeypair, hasSession, identityFromLoginResponse, initSodium, initializeDatabase, isAbortError, isEncryptedRecoveryKey, isMessageType, openCallKeyOf, openSealedCallKey, openSealedChatKey, openSecureMail, type operations, parseCallFragment, parseRecoveryUrl, parseServerMessage, passwordChangeErrorMessage, type paths, prewarmKeyPairs, readSessionClaims, requestSsoDisconnectCode, saveSession, sealCallKey, sealCallKeyForPeers, sealChatKey, sealKeyForSession, sealSecureMail, sealedBoxDecrypt, sealedBoxEncrypt, secureMailClaim, signMessage, unlockIdentityWithPassword, unwrapIdentityKey, unwrapWorkspaceKey, updateWrappedIdentityKey, validateRecoveryKeyFile, type webhooks, workspaceKeyRequiredOf, wrapIdentityKey };

package/dist/index.d.ts

@@ -1,5 +1,36 @@
 import createFetchClient, { Middleware } from 'openapi-fetch';
 
+/** HTTP plumbing only: no token, workspace selection, response-body parsing or retries. */
+interface HttpRequestInfo {
+    readonly method: string;
+    /** URL without credentials, query or fragment; hooks never receive bodies or headers. */
+    readonly url: string;
+}
+interface HttpResponseInfo extends HttpRequestInfo {
+    readonly status: number;
+    readonly durationMs: number;
+}
+interface HttpErrorInfo extends HttpRequestInfo {
+    readonly error: unknown;
+    readonly durationMs: number;
+}
+interface HttpTransportOptions {
+    /** Fetch-compatible implementation; defaults to globalThis.fetch at request time. */
+    fetch?: typeof globalThis.fetch;
+    /** Time until the adapter returns a Response (native fetch: headers). Disabled by default. */
+    timeoutMs?: number;
+    onRequest?: (request: HttpRequestInfo) => void;
+    onResponse?: (response: HttpResponseInfo) => void;
+    onError?: (failure: HttpErrorInfo) => void;
+}
+interface HttpTransport {
+    readonly fetch: typeof globalThis.fetch;
+    readonly customFetch: boolean;
+    /** Use the same timeout/hooks with a specialized adapter, such as upload-progress XHR. */
+    withFetch(adapter: typeof globalThis.fetch): typeof globalThis.fetch;
+}
+declare function createHttpTransport(options?: HttpTransportOptions): HttpTransport;
+
 /**
  * This file was auto-generated by openapi-typescript.
  * Do not make direct changes to the file.
@@ -39279,6 +39310,8 @@ interface BearerAuthMiddlewareConfig {
 /** The new access token, or `null`. Ending a session the server refused is the handler's job. */
 type ReloginHandler = () => Promise<string | null>;
 interface AutoReloginMiddlewareConfig {
+    /** Send recovered requests through the same configured/session-gated transport. */
+    fetch?: typeof globalThis.fetch;
     reloginHandler: ReloginHandler;
     /** URL substrings that should never trigger re-login (e.g. the login endpoint itself) */
     reloginExcludePatterns?: string[];
@@ -39324,12 +39357,14 @@ interface SessionKeys {
 }
 /**
  * Where the signed-in identity is kept between page loads (the signing key and the server session
- * key). Browsers default to the bundled encrypted IndexedDB store; Node hosts pass a file-backed
- * one. A silent re-login reads the key from here and saves the new server session key back.
+ * key). Browsers default to the bundled encrypted IndexedDB store; without IndexedDB the default
+ * is per-client memory. Hosts may supply their own persistence. A silent re-login reads the key from here and saves the new server session key back.
  */
 interface SessionPersistence {
     getSession(): Promise<SessionKeys | null>;
     saveSession(data: SessionKeys): Promise<void>;
+    /** Clear local key material when signing out everywhere. Optional for existing adapters. */
+    clearSession?(): Promise<void>;
 }
 interface AuthStateProvider {
     getUserEmail(): string | null;
@@ -40426,6 +40461,8 @@ declare function disconnectSso(params: DisconnectSsoParams, deps: DisconnectSsoD
 
 declare const API_PREFIX: "/v1";
 interface ArbiClientOptions {
+    /** Shared HTTP adapter, header timeout and metadata hooks; no workspace or retry policy. */
+    transport?: HttpTransportOptions;
     /**
      * Base URL for the ARBI API (e.g. "https://api.mydeployment.com"; `''` for the page's own
      * origin). A function is read on every request: a host whose configuration arrives after the
@@ -40446,8 +40483,8 @@ interface ArbiClientOptions {
     session?: SessionManager;
     /**
      * Where the signing key and server session key are kept between page loads. Browsers default to
-     * the bundled encrypted IndexedDB store; Node consumers (CLI, integration tests) pass a
-     * file-backed one, or a 401 has no key to re-login with.
+     * the bundled encrypted IndexedDB store; without IndexedDB the default is per-client memory.
+     * Supply an adapter explicitly to persist Node sessions beyond this instance.
      */
     persistence?: SessionPersistence;
     /**
@@ -40476,6 +40513,8 @@ interface ArbiClientOptions {
     userEmail?: string;
 }
 interface ArbiClient {
+    /** Session-gated HTTP for raw streaming/multipart adapters. Optional for existing host adapters. */
+    http?: HttpTransport;
     /** Type-safe openapi-fetch client with middleware */
     fetch: ReturnType<typeof createFetchClient<paths>>;
     /** In-memory session state */
@@ -40572,7 +40611,7 @@ interface ArbiClient {
         encryptMessageWithSharedSecret: typeof encryptMessageWithSharedSecret;
         decryptMessageWithSharedSecret: typeof decryptMessageWithSharedSecret;
     };
-    /** IndexedDB storage operations */
+    /** The same session-key persistence used by login and session recovery. */
     storage: {
         getSession: typeof getSession;
         saveSession: typeof saveSession;
@@ -40746,4 +40785,7 @@ interface OpenAllDeps {
  */
 declare function createAllWorkspacesOpener(deps: OpenAllDeps): () => Promise<void>;
 
-export { type $defs, ACCESS_TOKEN_STORAGE_KEY, API_PREFIX, type ArbiClient, type ArbiClientOptions, type AuthStateProvider, type AutoReloginMiddlewareConfig, type BearerAuthMiddlewareConfig, CALL_KEY_BYTES, CHAT_KEY_BYTES, type CallPeer, type ChangePasswordParams, type ChangePasswordRequest, type ChangePasswordResult, type CryptoProvider, type DisconnectSsoParams, ENCRYPTED_RECOVERY_KEY_SIZE, type KeyLoginCredentials, type KeyPair, type ListedWorkspaceKey, type LoginCredentials, type LoginParams, type LoginProfile, type LoginProvider, type LoginRequest, type LoginResponse, type LoginResult, type LoginWithKeyParams, type OfflineSealer, type OfflineSealerOptions, type OnReloginSuccess, type OpenAllDeps, type ParsedRecoveryUrl, type PasswordChangeCredentials, RECOVERY_KEY_ERRORS, type RecoveryKeyParams, type RecoveryKeyValidationResult, type RegisterParams, type RegisterRequest, type RegisterResult, type RegistrationCredentials, type ReloginDeps, type ReloginFailure, type ReloginHandler, type ReopenDeps, SECURE_MAIL_KEY_BYTES, type SealedSecureMail, type SecureMailCiphertexts, type SecureMailClaim, type SessionClaims, type SessionData, type SessionKeys, type SessionManager, type SessionManagerOptions, type SessionPersistence, type SessionSignIn, type SessionState, type SessionStateStorage, type SessionUser, type SignInHooks, type SsoTokenSource, type StoredSessionState, type TokenProvider, UNENCRYPTED_RECOVERY_KEY_SIZE, type UserKeypairs, type WebSocketClientMessage, type WebSocketServerMessage, type WorkspaceKeyRefreshProvider, type WorkspaceKeys, type WorkspaceOpenProvider, type WorkspaceOpens, type WsAgentDmStatusMessage, type WsAuthMessage, type WsAuthResultMessage, type WsBatchCompleteMessage, type WsChatMessageMessage, type WsChatReadMessage, type WsChatUpdatedMessage, type WsConnectionClosedMessage, type WsConversationMessagePostedMessage, type WsErrorMessage, type WsNotificationResponse, type WsPresenceUpdateMessage, type WsResponseCompleteMessage, type WsTaskUpdateMessage, authRequestError, base64Decode, base64Encode, base64ToBytes, base64UrlToBytes, browserSessionStateStorage, buildCallFragment, buildCallLink, buildWebSocketUrl, bytesToBase64, bytesToBase64Url, canPersistSession, changePassword, clearAllData, clearSession, type components, computeSharedSecret, createAllWorkspacesOpener, createArbiClient, createAuthMessage, createAutoReloginMiddleware, createBearerAuthMiddleware, createContentHash, createOfflineSealer, createRecoveryFile, createRecoveryUrl, createReloginHandler, createSessionManager, createWorkspaceKeys, createWorkspaceOpens, createWorkspaceReopener, decodeCallKey, decodeSecureMailKey, decryptCallTitle, decryptFile, decryptMessage, decryptMessageWithSharedSecret, decryptRecoveryKey, decryptWithChatKey, deriveDirectChatKey, deriveEncryptionKeypairFromSigning, derivePublicKey, disconnectSso, encodeCallKey, encryptCallTitle, encryptFile, encryptMessage, encryptMessageWithSharedSecret, encryptRecoveryKey, encryptWithChatKey, encryptionKeypairFromSigningKey, generateCallKey, generateChatKey, generateIdentityKeypair, generateKeyPairs, generateLoginCredentials, generateLoginCredentialsFromKey, generatePasswordChangeCredentials, generateRandomSigningKeypair, generateRegistrationCredentials, generateUserKeypairs, getRecoveryKeyFilename, getSession, getUserEncryptionKeypair, hasSession, identityFromLoginResponse, initSodium, initializeDatabase, isAbortError, isEncryptedRecoveryKey, isMessageType, openCallKeyOf, openSealedCallKey, openSealedChatKey, openSecureMail, type operations, parseCallFragment, parseRecoveryUrl, parseServerMessage, passwordChangeErrorMessage, type paths, prewarmKeyPairs, readSessionClaims, requestSsoDisconnectCode, saveSession, sealCallKey, sealCallKeyForPeers, sealChatKey, sealKeyForSession, sealSecureMail, sealedBoxDecrypt, sealedBoxEncrypt, secureMailClaim, signMessage, unlockIdentityWithPassword, unwrapIdentityKey, unwrapWorkspaceKey, updateWrappedIdentityKey, validateRecoveryKeyFile, type webhooks, workspaceKeyRequiredOf, wrapIdentityKey };
+/** Per-client memory only: no browser globals, files or process-wide shared identity. */
+declare function createMemorySessionPersistence(): SessionPersistence;
+
+export { type $defs, ACCESS_TOKEN_STORAGE_KEY, API_PREFIX, type ArbiClient, type ArbiClientOptions, type AuthStateProvider, type AutoReloginMiddlewareConfig, type BearerAuthMiddlewareConfig, CALL_KEY_BYTES, CHAT_KEY_BYTES, type CallPeer, type ChangePasswordParams, type ChangePasswordRequest, type ChangePasswordResult, type CryptoProvider, type DisconnectSsoParams, ENCRYPTED_RECOVERY_KEY_SIZE, type HttpErrorInfo, type HttpRequestInfo, type HttpResponseInfo, type HttpTransport, type HttpTransportOptions, type KeyLoginCredentials, type KeyPair, type ListedWorkspaceKey, type LoginCredentials, type LoginParams, type LoginProfile, type LoginProvider, type LoginRequest, type LoginResponse, type LoginResult, type LoginWithKeyParams, type OfflineSealer, type OfflineSealerOptions, type OnReloginSuccess, type OpenAllDeps, type ParsedRecoveryUrl, type PasswordChangeCredentials, RECOVERY_KEY_ERRORS, type RecoveryKeyParams, type RecoveryKeyValidationResult, type RegisterParams, type RegisterRequest, type RegisterResult, type RegistrationCredentials, type ReloginDeps, type ReloginFailure, type ReloginHandler, type ReopenDeps, SECURE_MAIL_KEY_BYTES, type SealedSecureMail, type SecureMailCiphertexts, type SecureMailClaim, type SessionClaims, type SessionData, type SessionKeys, type SessionManager, type SessionManagerOptions, type SessionPersistence, type SessionSignIn, type SessionState, type SessionStateStorage, type SessionUser, type SignInHooks, type SsoTokenSource, type StoredSessionState, type TokenProvider, UNENCRYPTED_RECOVERY_KEY_SIZE, type UserKeypairs, type WebSocketClientMessage, type WebSocketServerMessage, type WorkspaceKeyRefreshProvider, type WorkspaceKeys, type WorkspaceOpenProvider, type WorkspaceOpens, type WsAgentDmStatusMessage, type WsAuthMessage, type WsAuthResultMessage, type WsBatchCompleteMessage, type WsChatMessageMessage, type WsChatReadMessage, type WsChatUpdatedMessage, type WsConnectionClosedMessage, type WsConversationMessagePostedMessage, type WsErrorMessage, type WsNotificationResponse, type WsPresenceUpdateMessage, type WsResponseCompleteMessage, type WsTaskUpdateMessage, authRequestError, base64Decode, base64Encode, base64ToBytes, base64UrlToBytes, browserSessionStateStorage, buildCallFragment, buildCallLink, buildWebSocketUrl, bytesToBase64, bytesToBase64Url, canPersistSession, changePassword, clearAllData, clearSession, type components, computeSharedSecret, createAllWorkspacesOpener, createArbiClient, createAuthMessage, createAutoReloginMiddleware, createBearerAuthMiddleware, createContentHash, createHttpTransport, createMemorySessionPersistence, createOfflineSealer, createRecoveryFile, createRecoveryUrl, createReloginHandler, createSessionManager, createWorkspaceKeys, createWorkspaceOpens, createWorkspaceReopener, decodeCallKey, decodeSecureMailKey, decryptCallTitle, decryptFile, decryptMessage, decryptMessageWithSharedSecret, decryptRecoveryKey, decryptWithChatKey, deriveDirectChatKey, deriveEncryptionKeypairFromSigning, derivePublicKey, disconnectSso, encodeCallKey, encryptCallTitle, encryptFile, encryptMessage, encryptMessageWithSharedSecret, encryptRecoveryKey, encryptWithChatKey, encryptionKeypairFromSigningKey, generateCallKey, generateChatKey, generateIdentityKeypair, generateKeyPairs, generateLoginCredentials, generateLoginCredentialsFromKey, generatePasswordChangeCredentials, generateRandomSigningKeypair, generateRegistrationCredentials, generateUserKeypairs, getRecoveryKeyFilename, getSession, getUserEncryptionKeypair, hasSession, identityFromLoginResponse, initSodium, initializeDatabase, isAbortError, isEncryptedRecoveryKey, isMessageType, openCallKeyOf, openSealedCallKey, openSealedChatKey, openSecureMail, type operations, parseCallFragment, parseRecoveryUrl, parseServerMessage, passwordChangeErrorMessage, type paths, prewarmKeyPairs, readSessionClaims, requestSsoDisconnectCode, saveSession, sealCallKey, sealCallKeyForPeers, sealChatKey, sealKeyForSession, sealSecureMail, sealedBoxDecrypt, sealedBoxEncrypt, secureMailClaim, signMessage, unlockIdentityWithPassword, unwrapIdentityKey, unwrapWorkspaceKey, updateWrappedIdentityKey, validateRecoveryKeyFile, type webhooks, workspaceKeyRequiredOf, wrapIdentityKey };

package/dist/index.js

@@ -3,6 +3,90 @@ import sodium from 'libsodium-wrappers-sumo';
 
 // src/client.ts
 
+// src/memory-persistence.ts
+function copy(keys) {
+  return {
+    ...keys,
+    signingPrivateKey: keys.signingPrivateKey.slice(),
+    ...keys.serverSessionKey ? { serverSessionKey: keys.serverSessionKey.slice() } : {}
+  };
+}
+function createMemorySessionPersistence() {
+  let saved = null;
+  const clear = () => {
+    saved?.signingPrivateKey.fill(0);
+    saved?.serverSessionKey?.fill(0);
+    saved = null;
+  };
+  return {
+    async getSession() {
+      return saved ? copy(saved) : null;
+    },
+    async saveSession(keys) {
+      const next = copy(keys);
+      clear();
+      saved = next;
+    },
+    async clearSession() {
+      clear();
+    }
+  };
+}
+
+// src/http-transport.ts
+function createHttpTransport(options = {}) {
+  const { timeoutMs } = options;
+  if (timeoutMs !== void 0 && (!Number.isFinite(timeoutMs) || timeoutMs <= 0)) {
+    throw new RangeError("transport.timeoutMs must be a positive finite number.");
+  }
+  const wrap = (adapter2) => async (input, init) => {
+    const url = new URL(input instanceof Request ? input.url : String(input), "http://localhost");
+    url.username = "";
+    url.password = "";
+    url.search = "";
+    url.hash = "";
+    const info = {
+      method: (init?.method ?? (input instanceof Request ? input.method : "GET")).toUpperCase(),
+      url: url.toString()
+    };
+    options.onRequest?.(info);
+    const started = performance.now();
+    let timer;
+    let requestInit = init;
+    if (timeoutMs !== void 0) {
+      const controller = new AbortController();
+      const own = init?.signal ?? (input instanceof Request ? input.signal : void 0);
+      timer = setTimeout(
+        () => controller.abort(
+          new DOMException("Waiting for HTTP response timed out.", "TimeoutError")
+        ),
+        timeoutMs
+      );
+      requestInit = {
+        ...init,
+        signal: own ? AbortSignal.any([own, controller.signal]) : controller.signal
+      };
+    }
+    let response;
+    try {
+      response = await adapter2(input, requestInit);
+    } catch (error) {
+      options.onError?.({ ...info, error, durationMs: performance.now() - started });
+      throw error;
+    } finally {
+      if (timer !== void 0) clearTimeout(timer);
+    }
+    options.onResponse?.({
+      ...info,
+      status: response.status,
+      durationMs: performance.now() - started
+    });
+    return response;
+  };
+  const adapter = options.fetch ?? ((input, init) => globalThis.fetch(input, init));
+  return { fetch: wrap(adapter), customFetch: options.fetch !== void 0, withFetch: wrap };
+}
+
 // src/session.ts
 function createInitialState(isSsoMode = false) {
   return {
@@ -1154,11 +1238,11 @@ function createSessionGate() {
     }
   };
 }
-function gatedFetch(gate, fetch2) {
+function gatedFetch(gate, fetch) {
   return (input, init) => {
     if (gate.closed) return Promise.reject(abortError());
     const own = init?.signal ?? (input instanceof Request ? input.signal : void 0);
-    return fetch2(input, { ...init, signal: eitherSignal(gate.signal, own) });
+    return fetch(input, { ...init, signal: eitherSignal(gate.signal, own) });
   };
 }
 function createSessionGateMiddleware(gate) {
@@ -1372,7 +1456,7 @@ function createAutoReloginMiddleware(config) {
         if (workspaceId) {
           if (!await config.primeWorkspaceHandler(workspaceId)) return response;
           const retry = cloneCache.get(request) ?? safeClone(request);
-          if (retry) return fetch(retry);
+          if (retry) return (config.fetch ?? globalThis.fetch)(retry);
           config.onRetryCloneFailed?.();
           return response;
         }
@@ -1388,7 +1472,7 @@ function createAutoReloginMiddleware(config) {
         const retry = cloneCache.get(request) ?? safeClone(request);
         if (retry) {
           if (token) retry.headers.set("Authorization", `Bearer ${token}`);
-          return fetch(retry);
+          return (config.fetch ?? globalThis.fetch)(retry);
         }
         config.onRetryCloneFailed?.();
         return response;
@@ -1400,7 +1484,7 @@ function createAutoReloginMiddleware(config) {
           if (newToken) {
             const retryRequest = cloneCache.get(request) ?? request.clone();
             retryRequest.headers.set("Authorization", `Bearer ${newToken}`);
-            return fetch(retryRequest);
+            return (config.fetch ?? globalThis.fetch)(retryRequest);
           }
         }
       }
@@ -1413,12 +1497,12 @@ function createAutoReloginMiddleware(config) {
             const cached = cloneCache.get(request);
             if (cached) {
               cached.headers.set("Authorization", `Bearer ${newToken}`);
-              return fetch(cached);
+              return (config.fetch ?? globalThis.fetch)(cached);
             }
             try {
               const retryRequest = request.clone();
               retryRequest.headers.set("Authorization", `Bearer ${newToken}`);
-              return fetch(retryRequest);
+              return (config.fetch ?? globalThis.fetch)(retryRequest);
             } catch {
               console.warn("[API] Could not retry request after re-login (body already consumed)");
               config.onRetryCloneFailed?.();
@@ -1867,22 +1951,26 @@ var RETRYABLE_CODES = /* @__PURE__ */ new Set([
 var MAX_RETRIES = 3;
 var BASE_DELAY_MS = 200;
 function isRetryableError(err) {
-  if (!(err instanceof Error)) return false;
+  if (!(err instanceof Error) || isAbortError(err)) return false;
   const cause = err.cause;
   if (cause?.code && RETRYABLE_CODES.has(cause.code)) return true;
   const msg = err.message || "";
   return RETRYABLE_CODES.has(msg) || msg.includes("ECONNREFUSED") || msg.includes("ECONNRESET");
 }
-function createRetryFetch() {
+function createRetryFetch(fetch) {
   return async (input, init) => {
+    const method = (init?.method ?? (input instanceof Request ? input.method : "GET")).toUpperCase();
+    const maxRetries = method === "GET" || method === "HEAD" ? MAX_RETRIES : 0;
+    const signal = init?.signal ?? (input instanceof Request ? input.signal : void 0);
     let lastError;
-    for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
+    for (let attempt = 0; attempt <= maxRetries; attempt++) {
+      if (signal?.aborted) throw signal.reason ?? new DOMException("Request aborted.", "AbortError");
       try {
         const fetchInput = input instanceof Request ? input.clone() : input;
-        return await globalThis.fetch(fetchInput, init);
+        return await fetch(fetchInput, init);
       } catch (err) {
         lastError = err;
-        if (attempt < MAX_RETRIES && isRetryableError(err)) {
+        if (attempt < maxRetries && isRetryableError(err)) {
           await new Promise((r) => setTimeout(r, BASE_DELAY_MS * 2 ** attempt));
           continue;
         }
@@ -1904,9 +1992,9 @@ function readBaseUrlPerRequest(fetchClient, base) {
 }
 var deploymentDomainOf = ({ deploymentDomain }) => typeof deploymentDomain === "function" ? deploymentDomain() : deploymentDomain;
 function createArbiClient(options) {
-  const { fetch: fetch2, session, persistence, workspaceKeys, workspaceOpens, auth } = createTransport(options);
+  const { fetch, http, session, persistence, workspaceKeys, workspaceOpens, auth } = createTransport(options);
   const authDeps = {
-    fetchClient: fetch2,
+    fetchClient: fetch,
     session,
     get deploymentDomain() {
       return deploymentDomainOf(options);
@@ -1915,7 +2003,8 @@ function createArbiClient(options) {
     signIn: options.signIn
   };
   return {
-    fetch: fetch2,
+    fetch,
+    http,
     workspaceKeys,
     workspaceOpens,
     session,
@@ -1947,8 +2036,8 @@ function createArbiClient(options) {
       decryptMessageWithSharedSecret
     },
     storage: {
-      getSession,
-      saveSession
+      getSession: () => persistence.getSession(),
+      saveSession: (data) => persistence.saveSession(data)
     }
   };
 }
@@ -1962,12 +2051,18 @@ function createTransport(options) {
     onRetryCloneFailed,
     userEmail
   } = options;
-  const persistence = options.persistence ?? { getSession, saveSession };
+  const persistence = options.persistence ?? (typeof indexedDB === "undefined" ? createMemorySessionPersistence() : { getSession, saveSession, clearSession: clearAllData });
   const baseUrlOption = options.baseUrl;
   const base = typeof baseUrlOption === "function" ? baseUrlOption : () => baseUrlOption;
-  const retryFetch = createRetryFetch();
+  const transport = createHttpTransport(options.transport);
+  const retryFetch = createRetryFetch(transport.fetch);
   const gate = createSessionGate();
   const sessionFetch = gatedFetch(gate, retryFetch);
+  const http = {
+    fetch: gatedFetch(gate, transport.fetch),
+    customFetch: transport.customFetch,
+    withFetch: (adapter) => gatedFetch(gate, transport.withFetch(adapter))
+  };
   const session = options.session ?? createSessionManager();
   if (userEmail) session.setUser(userEmail);
   const tokenProvider = createTokenProvider(session);
@@ -2164,6 +2259,7 @@ function createTransport(options) {
   for (const m of middleware) fetchClient.use(m);
   fetchClient.use(
     createAutoReloginMiddleware({
+      fetch: sessionFetch,
       reloginHandler: relogin,
       reloginExcludePatterns,
       reopenWorkspaceHandler: reopenWorkspace,
@@ -2179,6 +2275,7 @@ function createTransport(options) {
   );
   return {
     fetch: fetchClient,
+    http,
     session,
     persistence,
     workspaceKeys,
@@ -2216,7 +2313,10 @@ function createTransport(options) {
             }).catch((error) => console.warn("[API] Server logout failed:", error));
           }
           session.clear();
-          if (everywhere) await clearAllData();
+          if (everywhere) {
+            if (persistence.clearSession) await persistence.clearSession();
+            else if (typeof indexedDB !== "undefined") await clearAllData();
+          }
         } finally {
           gate.reopen();
         }
@@ -2299,6 +2399,6 @@ function isMessageType(msg, type) {
   return msg.type === type;
 }
 
-export { ACCESS_TOKEN_STORAGE_KEY, API_PREFIX, CALL_KEY_BYTES, CHAT_KEY_BYTES, ENCRYPTED_RECOVERY_KEY_SIZE, RECOVERY_KEY_ERRORS, SECURE_MAIL_KEY_BYTES, UNENCRYPTED_RECOVERY_KEY_SIZE, authRequestError, base64Decode, base64Encode, base64ToBytes, base64UrlToBytes, browserSessionStateStorage, buildCallFragment, buildCallLink, buildWebSocketUrl, bytesToBase64, bytesToBase64Url, canPersistSession, changePassword, clearAllData, clearSession, computeSharedSecret, createAllWorkspacesOpener, createArbiClient, createAuthMessage, createAutoReloginMiddleware, createBearerAuthMiddleware, createContentHash, createOfflineSealer, createRecoveryFile, createRecoveryUrl, createReloginHandler, createSessionManager, createWorkspaceKeys, createWorkspaceOpens, createWorkspaceReopener, decodeCallKey, decodeSecureMailKey, decryptCallTitle, decryptFile, decryptMessage, decryptMessageWithSharedSecret, decryptRecoveryKey, decryptWithChatKey, deriveDirectChatKey, deriveEncryptionKeypairFromSigning, derivePublicKey, disconnectSso, encodeCallKey, encryptCallTitle, encryptFile, encryptMessage, encryptMessageWithSharedSecret, encryptRecoveryKey, encryptWithChatKey, encryptionKeypairFromSigningKey, generateCallKey, generateChatKey, generateIdentityKeypair, generateKeyPairs, generateLoginCredentials, generateLoginCredentialsFromKey, generatePasswordChangeCredentials, generateRandomSigningKeypair, generateRegistrationCredentials, generateUserKeypairs, getRecoveryKeyFilename, getSession, getUserEncryptionKeypair, hasSession, identityFromLoginResponse, initSodium, initializeDatabase, isAbortError, isEncryptedRecoveryKey, isMessageType, openCallKeyOf, openSealedCallKey, openSealedChatKey, openSecureMail, parseCallFragment, parseRecoveryUrl, parseServerMessage, passwordChangeErrorMessage, prewarmKeyPairs, readSessionClaims, requestSsoDisconnectCode, saveSession, sealCallKey, sealCallKeyForPeers, sealChatKey, sealKeyForSession, sealSecureMail, sealedBoxDecrypt, sealedBoxEncrypt, secureMailClaim, signMessage, unlockIdentityWithPassword, unwrapIdentityKey, unwrapWorkspaceKey, updateWrappedIdentityKey, validateRecoveryKeyFile, workspaceKeyRequiredOf, wrapIdentityKey };
+export { ACCESS_TOKEN_STORAGE_KEY, API_PREFIX, CALL_KEY_BYTES, CHAT_KEY_BYTES, ENCRYPTED_RECOVERY_KEY_SIZE, RECOVERY_KEY_ERRORS, SECURE_MAIL_KEY_BYTES, UNENCRYPTED_RECOVERY_KEY_SIZE, authRequestError, base64Decode, base64Encode, base64ToBytes, base64UrlToBytes, browserSessionStateStorage, buildCallFragment, buildCallLink, buildWebSocketUrl, bytesToBase64, bytesToBase64Url, canPersistSession, changePassword, clearAllData, clearSession, computeSharedSecret, createAllWorkspacesOpener, createArbiClient, createAuthMessage, createAutoReloginMiddleware, createBearerAuthMiddleware, createContentHash, createHttpTransport, createMemorySessionPersistence, createOfflineSealer, createRecoveryFile, createRecoveryUrl, createReloginHandler, createSessionManager, createWorkspaceKeys, createWorkspaceOpens, createWorkspaceReopener, decodeCallKey, decodeSecureMailKey, decryptCallTitle, decryptFile, decryptMessage, decryptMessageWithSharedSecret, decryptRecoveryKey, decryptWithChatKey, deriveDirectChatKey, deriveEncryptionKeypairFromSigning, derivePublicKey, disconnectSso, encodeCallKey, encryptCallTitle, encryptFile, encryptMessage, encryptMessageWithSharedSecret, encryptRecoveryKey, encryptWithChatKey, encryptionKeypairFromSigningKey, generateCallKey, generateChatKey, generateIdentityKeypair, generateKeyPairs, generateLoginCredentials, generateLoginCredentialsFromKey, generatePasswordChangeCredentials, generateRandomSigningKeypair, generateRegistrationCredentials, generateUserKeypairs, getRecoveryKeyFilename, getSession, getUserEncryptionKeypair, hasSession, identityFromLoginResponse, initSodium, initializeDatabase, isAbortError, isEncryptedRecoveryKey, isMessageType, openCallKeyOf, openSealedCallKey, openSealedChatKey, openSecureMail, parseCallFragment, parseRecoveryUrl, parseServerMessage, passwordChangeErrorMessage, prewarmKeyPairs, readSessionClaims, requestSsoDisconnectCode, saveSession, sealCallKey, sealCallKeyForPeers, sealChatKey, sealKeyForSession, sealSecureMail, sealedBoxDecrypt, sealedBoxEncrypt, secureMailClaim, signMessage, unlockIdentityWithPassword, unwrapIdentityKey, unwrapWorkspaceKey, updateWrappedIdentityKey, validateRecoveryKeyFile, workspaceKeyRequiredOf, wrapIdentityKey };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map