@arbidocs/sdk 0.3.116 → 0.3.117

package/dist/index.cjs

@@ -5629,9 +5629,53 @@ __export(dm_exports, {
   listDecryptedDMs: () => listDecryptedDMs,
   markRead: () => markRead,
   requestWorkspaceAccess: () => requestWorkspaceAccess,
+  resolveRecipient: () => resolveRecipient,
   sendDM: () => sendDM,
   sendEncryptedDM: () => sendEncryptedDM
 });
+
+// src/operations/agents.ts
+var agents_exports = {};
+__export(agents_exports, {
+  createAgent: () => createAgent,
+  deleteAgents: () => deleteAgents,
+  getAgentConfig: () => getAgentConfig,
+  listAgentWorkspaces: () => listAgentWorkspaces,
+  listAgents: () => listAgents
+});
+async function listAgents(arbi) {
+  return requireData(await arbi.fetch.GET("/v1/agents"), "Failed to fetch agents");
+}
+async function createAgent(arbi, name) {
+  const body = { name };
+  return requireData(await arbi.fetch.POST("/v1/agents", { body }), "Failed to create agent");
+}
+async function getAgentConfig(arbi, agentExtId) {
+  return requireData(
+    await arbi.fetch.GET("/v1/agents/{agent_ext_id}/config", {
+      params: { path: { agent_ext_id: agentExtId } }
+    }),
+    "Failed to fetch agent config"
+  );
+}
+async function listAgentWorkspaces(arbi, agentExtId) {
+  return requireData(
+    await arbi.fetch.GET("/v1/agents/{agent_ext_id}/workspaces", {
+      params: { path: { agent_ext_id: agentExtId } }
+    }),
+    "Failed to fetch agent workspaces"
+  );
+}
+async function deleteAgents(arbi, agentExtIds) {
+  return requireData(
+    await arbi.fetch.DELETE("/v1/agents", {
+      body: { agent_ext_ids: agentExtIds }
+    }),
+    "Failed to delete agents"
+  );
+}
+
+// src/operations/dm.ts
 function createDmCryptoContext(arbi, signingPrivateKeyBytes, userExtId) {
   const ed25519PublicKey = signingPrivateKeyBytes.slice(32, 64);
   const encryptionKeypair = arbi.crypto.deriveEncryptionKeypairFromSigning({
@@ -5694,6 +5738,37 @@ async function listActivity(arbi, options) {
     "Failed to fetch activity"
   );
 }
+async function resolveRecipient(arbi, ref) {
+  const isEmail = ref.includes("@");
+  const matchKey = isEmail ? "email" : "external_id";
+  const contacts = await listContacts(arbi);
+  const contactMatch = contacts.find(
+    (c2) => isEmail ? c2.email === ref : c2.user?.external_id === ref || c2.external_id === ref
+  );
+  if (contactMatch?.user?.encryption_public_key) {
+    return {
+      extId: contactMatch.user.external_id,
+      pubKey: contactMatch.user.encryption_public_key
+    };
+  }
+  try {
+    const agents = await listAgents(arbi);
+    const agentMatch = agents.find((a2) => a2[matchKey] === ref);
+    if (agentMatch?.encryption_public_key) {
+      return { extId: agentMatch.external_id, pubKey: agentMatch.encryption_public_key };
+    }
+  } catch {
+  }
+  try {
+    const wsUsers = await listWorkspaceUsers(arbi);
+    const wsMatch = wsUsers.find((wu) => wu.user[matchKey] === ref);
+    if (wsMatch?.user.encryption_public_key) {
+      return { extId: wsMatch.user.external_id, pubKey: wsMatch.user.encryption_public_key };
+    }
+  } catch {
+  }
+  return null;
+}
 async function sendEncryptedDM(arbi, messages, crypto) {
   const encrypted = await Promise.all(
     messages.map(async (msg) => ({
@@ -5890,47 +5965,6 @@ async function getFileContent(auth, fileId) {
   });
 }
 
-// src/operations/agents.ts
-var agents_exports = {};
-__export(agents_exports, {
-  createAgent: () => createAgent,
-  deleteAgents: () => deleteAgents,
-  getAgentConfig: () => getAgentConfig,
-  listAgentWorkspaces: () => listAgentWorkspaces,
-  listAgents: () => listAgents
-});
-async function listAgents(arbi) {
-  return requireData(await arbi.fetch.GET("/v1/agents"), "Failed to fetch agents");
-}
-async function createAgent(arbi, name) {
-  const body = { name };
-  return requireData(await arbi.fetch.POST("/v1/agents", { body }), "Failed to create agent");
-}
-async function getAgentConfig(arbi, agentExtId) {
-  return requireData(
-    await arbi.fetch.GET("/v1/agents/{agent_ext_id}/config", {
-      params: { path: { agent_ext_id: agentExtId } }
-    }),
-    "Failed to fetch agent config"
-  );
-}
-async function listAgentWorkspaces(arbi, agentExtId) {
-  return requireData(
-    await arbi.fetch.GET("/v1/agents/{agent_ext_id}/workspaces", {
-      params: { path: { agent_ext_id: agentExtId } }
-    }),
-    "Failed to fetch agent workspaces"
-  );
-}
-async function deleteAgents(arbi, agentExtIds) {
-  return requireData(
-    await arbi.fetch.DELETE("/v1/agents", {
-      body: { agent_ext_ids: agentExtIds }
-    }),
-    "Failed to delete agents"
-  );
-}
-
 // src/operations/sessions.ts
 var sessions_exports = {};
 __export(sessions_exports, {
@@ -6066,6 +6100,7 @@ var Arbi = class {
   client = null;
   loginResult = null;
   currentWorkspaceId = null;
+  dmCryptoContext = null;
   options;
   constructor(options) {
     this.options = options;
@@ -6152,6 +6187,7 @@ var Arbi = class {
     }
     this.loginResult = null;
     this.currentWorkspaceId = null;
+    this.dmCryptoContext = null;
   }
   // ── Accessors ─────────────────────────────────────────────────────────
   /** Get the underlying ArbiClient (throws if not initialized). */
@@ -6207,6 +6243,16 @@ var Arbi = class {
   };
   // ── User (account-scoped usage) ───────────────────────────────────────
   user = {
+    /**
+     * The authenticated user's identity from the current session
+     * (`external_id` + `email`), established at login. Returns `null` when not
+     * logged in. This is the canonical "who am I" accessor — DM direction and
+     * ownership checks read it instead of re-deriving identity per call.
+     */
+    identity: () => {
+      const state = this.requireClient().session.getState();
+      return state.userExtId && state.userEmail ? { externalId: state.userExtId, email: state.userEmail } : null;
+    },
     /** Today's deployment-wide credit spend for the current user. */
     usageToday: () => getUserUsageToday(this.requireClient())
   };
@@ -6390,9 +6436,76 @@ var Arbi = class {
     groupByStatus: groupContactsByStatus
   };
   // ── Direct Messages ───────────────────────────────────────────────────
+  /**
+   * Build (and cache) the DM crypto context for the current session.
+   *
+   * Derives the user's curve25519 keypair from the stored signing key and pairs
+   * it with their external_id — everything `list()`/`send()` need to encrypt and
+   * decrypt. Cached for the session and cleared on logout. Consumers never touch
+   * this: it's an internal of the `dm` surface.
+   */
+  async requireDmCrypto() {
+    if (this.dmCryptoContext) return this.dmCryptoContext;
+    const client = this.requireClient();
+    const session = await client.storage.getSession();
+    if (!session) {
+      throw new ArbiError("Not authenticated \u2014 no session available for DM encryption");
+    }
+    const userExtId = client.session.getState().userExtId;
+    if (!userExtId) {
+      throw new ArbiError("No user identity in session \u2014 cannot set up DM encryption");
+    }
+    this.dmCryptoContext = createDmCryptoContext(client, session.signingPrivateKey, userExtId);
+    return this.dmCryptoContext;
+  }
   dm = {
-    list: () => listDMs(this.requireClient()),
-    send: (messages) => sendDM(this.requireClient(), messages),
+    /**
+     * List direct messages, newest first, with content already **decrypted**.
+     * (A message that can't be decrypted comes back as `[Decryption failed]`.)
+     */
+    list: async () => listDecryptedDMs(this.requireClient(), await this.requireDmCrypto()),
+    /**
+     * Send an E2E-encrypted DM to a recipient (email or `usr-`/`agt-` id).
+     * Resolves the recipient's public key and encrypts internally — the caller
+     * passes plaintext and never handles keys or ciphertext.
+     */
+    send: async (recipient, text) => {
+      const client = this.requireClient();
+      const resolved = await resolveRecipient(client, recipient);
+      if (!resolved) {
+        throw new ArbiError(
+          `Could not resolve DM recipient "${recipient}" (not a known contact, agent, or workspace member)`
+        );
+      }
+      return sendEncryptedDM(
+        client,
+        [
+          {
+            recipient_ext_id: resolved.extId,
+            content: text,
+            recipient_encryption_public_key: resolved.pubKey
+          }
+        ],
+        await this.requireDmCrypto()
+      );
+    },
+    /**
+     * Send to a recipient whose external_id + public key are already known
+     * (e.g. from a message's `sender`), skipping directory resolution.
+     */
+    sendTo: async (recipientExtId, recipientPublicKey, text) => sendEncryptedDM(
+      this.requireClient(),
+      [
+        {
+          recipient_ext_id: recipientExtId,
+          content: text,
+          recipient_encryption_public_key: recipientPublicKey
+        }
+      ],
+      await this.requireDmCrypto()
+    ),
+    /** Resolve a recipient reference to `{ extId, pubKey }` (contacts → agents → workspace). */
+    resolveRecipient: (recipient) => resolveRecipient(this.requireClient(), recipient),
     markRead: (messageIds) => markRead(this.requireClient(), messageIds),
     delete: (messageIds) => deleteDMs(this.requireClient(), messageIds),
     /** List the current user's durable activity feed (never unread; excluded from DMs). */