@sparkvault/sdk-mobile 6.0.2 → 7.0.1

package/src/http.ts

@@ -5,8 +5,11 @@ import {
   SparkVaultMobileError,
   SparkVaultNetworkError,
   SparkVaultTimeoutError,
+  vatRefusalReason,
 } from './errors.js';
+import { isTransientHttpStatus } from './app-sdk/transient.js';
 import { createDedupMutex } from './mutex.js';
+import { queryString, type ApiPath, type QueryParams } from './request-path.js';
 import type { ApiErrorBody, ApiMeta, ApiResponse, RateLimitInfo } from './types.js';
 
 export type HttpMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
@@ -14,6 +17,8 @@ export type HttpMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
 export interface RequestOptions {
   body?: unknown;
   headers?: Record<string, string>;
+  /** Query parameters appended to the path; empty values are left out. */
+  query?: QueryParams;
   skipAuth?: boolean;
   vat?: string;
   timeoutMs?: number;
@@ -22,6 +27,21 @@ export interface RequestOptions {
 export type AuthEvent = 'logout' | 'token_refreshed';
 export type AuthEventListener = (event: AuthEvent) => void;
 
+/**
+ * How a token refresh ended.
+ * - `refreshed`: a new access token is stored.
+ * - `rejected`: the session is over - no refresh token is stored, or the
+ *   server refused it (the stored pair is then cleared and 'logout' emitted).
+ * - `transient`: the refresh could not complete (connectivity, timeout, a
+ *   408/429/5xx answer, a token-store failure). The session stands, and
+ *   `error` is what the caller surfaces: it must never read as an
+ *   authentication failure, which callers treat as a rejected credential.
+ */
+export type RefreshOutcome =
+  | { status: 'refreshed' }
+  | { status: 'rejected' }
+  | { status: 'transient'; error: unknown };
+
 function parseRetryAfter(headers: Headers): number | null {
   const retryAfter = headers.get('Retry-After');
   if (!retryAfter) return null;
@@ -50,7 +70,7 @@ function isJsonBody(body: unknown): body is Record<string, unknown> | unknown[]
 export class MobileHttpClient {
   private readonly config: ResolvedMobileConfig;
   private readonly authListeners = new Set<AuthEventListener>();
-  private readonly refreshMutex = createDedupMutex<boolean>();
+  private readonly refreshMutex = createDedupMutex<RefreshOutcome>();
   private lastMeta: ApiMeta | null = null;
   private rateLimitInfo: RateLimitInfo | null = null;
 
@@ -139,17 +159,14 @@ export class MobileHttpClient {
     }
   }
 
-  private normalizeError(err: unknown, isUpload = false): never {
+  /** The SDK error for a request the fetch adapter rejected (no HTTP response). */
+  private transportError(err: unknown): SparkVaultMobileError {
     if (err instanceof SparkVaultMobileError) {
-      throw err;
+      return err;
     }
 
     if (err instanceof Error && (err.name === 'AbortError' || err.name === 'TimeoutError')) {
-      throw new SparkVaultTimeoutError(
-        isUpload
-          ? 'Upload timed out. Please check your connection and try again.'
-          : 'Request timed out. Please check your connection and try again.'
-      );
+      return new SparkVaultTimeoutError('Request timed out. Please check your connection and try again.');
     }
 
     // Connectivity failures arrive in two shapes depending on the injected
@@ -158,29 +175,46 @@ export class MobileHttpClient {
     // normalize to SparkVaultNetworkError or consumers misclassify an offline
     // failure as a generic (non-retryable) error.
     if (err instanceof TypeError || (err instanceof Error && err.name === 'NetworkError')) {
-      throw new SparkVaultNetworkError('Network request failed. Please check your connection.');
+      return new SparkVaultNetworkError('Network request failed. Please check your connection.');
     }
 
-    throw new SparkVaultMobileError(err instanceof Error ? err.message : 'Unknown request error');
+    return new SparkVaultMobileError(err instanceof Error ? err.message : 'Unknown request error');
   }
 
   /**
-   * Single exit for non-OK responses: 402s become typed gate errors
+   * Single mapping for non-OK responses: 402s become typed gate errors
    * (PlanRequiredError / QuotaExceededError) so the subscribe / add-on UX keys
    * off one set of types; everything else becomes a SparkVaultMobileError
    * carrying the server code, status, details, and meta.
    */
-  private throwHttpError(status: number, errorBody: ApiErrorBody): never {
-    if (errorBody.meta) {
-      this.lastMeta = errorBody.meta;
+  /** An error response's JSON body, or an empty one when it has none. */
+  private async readErrorBody(response: Response): Promise<ApiErrorBody> {
+    try {
+      return await response.json();
+    } catch {
+      this.config.logger.debug('Failed to parse error response body', { status: response.status });
+      return {};
+    }
+  }
+
+  /**
+   * A 401 that names a refused vault access token is not a dead login: no
+   * refresh revives a VAT, so it is thrown as it is instead of spending the
+   * one-time refresh token.
+   */
+  private async throwIfVatRefused(response: Response): Promise<void> {
+    const error = this.httpError(response.status, await this.readErrorBody(response));
+    if (vatRefusalReason(error) !== null) {
+      throw error;
     }
+  }
 
-    const gateError = gateErrorFromBody(status, errorBody);
-    if (gateError) {
-      throw gateError;
+  private httpError(status: number, errorBody: ApiErrorBody): SparkVaultMobileError {
+    if (errorBody.meta) {
+      this.lastMeta = errorBody.meta;
     }
 
-    throw new SparkVaultMobileError(
+    return gateErrorFromBody(status, errorBody) ?? new SparkVaultMobileError(
       errorBody.error?.message ?? errorBody.message ?? this.defaultErrorMessage(status),
       {
         code: errorBody.error?.code ?? status,
@@ -191,11 +225,8 @@ export class MobileHttpClient {
     );
   }
 
-  private makeUrl(endpoint: string): string {
-    if (/^https?:\/\//i.test(endpoint)) {
-      return endpoint;
-    }
-    return `${this.config.apiBaseUrl}${endpoint}`;
+  private makeUrl(path: ApiPath, query: QueryParams | undefined): string {
+    return `${this.config.apiBaseUrl}${path}${queryString(query)}`;
   }
 
   private serializeBody(body: unknown): BodyInit | undefined {
@@ -203,58 +234,61 @@ export class MobileHttpClient {
     return isJsonBody(body) ? JSON.stringify(body) : body as BodyInit;
   }
 
-  async refreshAccessToken(): Promise<boolean> {
-    try {
-      return await this.refreshMutex.dedupe(() => this.doRefreshOnce());
-    } catch {
-      this.refreshMutex.reset();
-      return false;
-    }
+  /**
+   * Refresh the access token once; concurrent callers share the one attempt
+   * (refresh tokens rotate and are one-time-use). Never throws: every failure
+   * is an outcome.
+   */
+  refreshAccessToken(): Promise<RefreshOutcome> {
+    return this.refreshMutex.dedupe(() => this.doRefreshOnce());
   }
 
-  private async doRefreshOnce(): Promise<boolean> {
-    const refreshToken = await this.config.tokenStorage.getRefreshToken();
-    if (!refreshToken) return false;
-
+  private async doRefreshOnce(): Promise<RefreshOutcome> {
     try {
+      const refreshToken = await this.config.tokenStorage.getRefreshToken();
+      if (!refreshToken) return { status: 'rejected' };
       return await this.doRefresh(refreshToken);
     } catch (err) {
-      const error = err instanceof Error ? err : new Error(String(err));
-      this.config.logger.warn('Token refresh failed without retry', { error: error.message });
-      return false;
+      // A token store that could not be read or written: the session was not
+      // refused, so it stands, and the store's own error is what the caller
+      // sees (as it is when the store fails before any request).
+      this.config.logger.warn('Token refresh could not use the token store', {
+        error: err instanceof Error ? err.message : String(err),
+      });
+      return { status: 'transient', error: err };
     }
   }
 
-  private async doRefresh(refreshToken: string): Promise<boolean> {
-    const response = await this.config.fetch(`${this.config.apiBaseUrl}/auth/refresh`, {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        Accept: 'application/json',
-        'User-Agent': this.config.userAgent,
-      },
-      body: JSON.stringify({ refresh_token: refreshToken }),
-      timeoutMs: this.config.timeoutMs,
-    });
+  private async doRefresh(refreshToken: string): Promise<RefreshOutcome> {
+    let response: Response;
+    try {
+      response = await this.config.fetch(`${this.config.apiBaseUrl}/auth/refresh`, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          Accept: 'application/json',
+          'User-Agent': this.config.userAgent,
+        },
+        body: JSON.stringify({ refresh_token: refreshToken }),
+        timeoutMs: this.config.timeoutMs,
+      });
+    } catch (err) {
+      const error = this.transportError(err);
+      this.config.logger.warn('Token refresh did not reach the API', { error: error.message });
+      return { status: 'transient', error };
+    }
 
     if (!response.ok) {
-      if (response.status === 429) {
-        this.config.logger.warn('Token refresh rate limited', {
-          retryAfterMs: parseRetryAfter(response.headers),
-        });
-        return false;
-      }
-
-      if (response.status >= 500 || response.status === 408) {
+      if (isTransientHttpStatus(response.status)) {
         this.config.logger.warn('Token refresh failed with transient HTTP status', {
           status: response.status,
+          retryAfterMs: parseRetryAfter(response.headers),
         });
-        return false;
+        const errorBody: ApiErrorBody = await response.json().catch(() => ({}));
+        return { status: 'transient', error: this.httpError(response.status, errorBody) };
       }
 
-      await this.config.tokenStorage.clearTokens();
-      this.emitAuthEvent('logout');
-      return false;
+      return this.endRefusedSession();
     }
 
     const body = await response.json().catch(() => ({} as ApiResponse<{
@@ -268,9 +302,7 @@ export class MobileHttpClient {
         hasData: Boolean(data),
         accessTokenType: typeof data?.access_token,
       });
-      await this.config.tokenStorage.clearTokens();
-      this.emitAuthEvent('logout');
-      return false;
+      return this.endRefusedSession();
     }
 
     // Refresh tokens rotate and are one-time-use: persist the pair through a
@@ -289,11 +321,43 @@ export class MobileHttpClient {
       await this.config.tokenStorage.setAccessToken(data.access_token);
     }
     this.emitAuthEvent('token_refreshed');
-    return true;
+    return { status: 'refreshed' };
+  }
+
+  /**
+   * The server refused the session: drop the stored pair and end it. The
+   * session is over whether or not the local clear lands, so 'logout' always
+   * fires and the app's teardown runs.
+   */
+  private async endRefusedSession(): Promise<RefreshOutcome> {
+    try {
+      await this.config.tokenStorage.clearTokens();
+    } catch (err) {
+      this.config.logger.warn('Could not clear the refused session tokens', {
+        error: err instanceof Error ? err.message : String(err),
+      });
+    }
+    this.emitAuthEvent('logout');
+    return { status: 'rejected' };
+  }
+
+  /**
+   * Renew the session after a 401, or throw what the caller should see:
+   * SparkVaultAuthenticationError only when the session is over, otherwise
+   * the transient failure that kept the refresh from completing.
+   */
+  private async renewSession(): Promise<void> {
+    const outcome = await this.refreshAccessToken();
+    if (outcome.status === 'rejected') {
+      throw new SparkVaultAuthenticationError('Session expired. Please log in again.');
+    }
+    if (outcome.status === 'transient') {
+      throw outcome.error;
+    }
   }
 
-  async request<T>(method: HttpMethod, endpoint: string, options: RequestOptions = {}): Promise<ApiResponse<T>> {
-    const url = this.makeUrl(endpoint);
+  async request<T>(method: HttpMethod, path: ApiPath, options: RequestOptions = {}): Promise<ApiResponse<T>> {
+    const url = this.makeUrl(path, options.query);
     const timeoutMs = options.timeoutMs ?? this.config.timeoutMs;
     const body = method === 'GET' ? undefined : this.serializeBody(options.body);
     let headers = await this.getHeaders({ ...options, body: options.body });
@@ -302,20 +366,18 @@ export class MobileHttpClient {
     try {
       response = await this.config.fetch(url, { method, headers, body, timeoutMs });
     } catch (err) {
-      this.normalizeError(err);
+      throw this.transportError(err);
     }
     this.parseRateLimitHeaders(response.headers);
 
     if (response.status === 401 && !options.skipAuth) {
-      const refreshed = await this.refreshAccessToken();
-      if (!refreshed) {
-        throw new SparkVaultAuthenticationError('Session expired. Please log in again.');
-      }
+      await this.throwIfVatRefused(response);
+      await this.renewSession();
       headers = await this.getHeaders({ ...options, body: options.body });
       try {
         response = await this.config.fetch(url, { method, headers, body, timeoutMs });
       } catch (err) {
-        this.normalizeError(err);
+        throw this.transportError(err);
       }
       this.parseRateLimitHeaders(response.headers);
     }
@@ -331,14 +393,7 @@ export class MobileHttpClient {
     }
 
     if (!response.ok) {
-      let errorBody: ApiErrorBody = {};
-      try {
-        errorBody = await response.json();
-      } catch {
-        this.config.logger.debug('Failed to parse error response body', { status: response.status });
-      }
-
-      this.throwHttpError(response.status, errorBody);
+      throw this.httpError(response.status, await this.readErrorBody(response));
     }
 
     const result = await response.json();
@@ -349,84 +404,24 @@ export class MobileHttpClient {
     return result as ApiResponse<T>;
   }
 
-  async requestRaw(endpoint: string, options: RequestOptions & { method?: HttpMethod; responseType?: XMLHttpRequestResponseType } = {}): Promise<Response> {
-    const method = options.method ?? 'GET';
-    const url = this.makeUrl(endpoint);
-    const timeoutMs = options.timeoutMs ?? this.config.fileTransferTimeoutMs;
-    const body = method === 'GET' ? undefined : this.serializeBody(options.body);
-    let headers = await this.getHeaders({ ...options, body: options.body });
-
-    let response: Response;
-    try {
-      response = await this.config.fetch(url, {
-        method,
-        headers,
-        body,
-        timeoutMs,
-        responseType: options.responseType,
-      });
-    } catch (err) {
-      this.normalizeError(err, true);
-    }
-
-    if (response.status === 401 && !options.skipAuth) {
-      const refreshed = await this.refreshAccessToken();
-      if (!refreshed) {
-        throw new SparkVaultAuthenticationError('Session expired. Please log in again.');
-      }
-      headers = await this.getHeaders({ ...options, body: options.body });
-      try {
-        response = await this.config.fetch(url, {
-          method,
-          headers,
-          body,
-          timeoutMs,
-          responseType: options.responseType,
-        });
-      } catch (err) {
-        this.normalizeError(err, true);
-      }
-    }
-
-    if (!response.ok) {
-      let errorBody: ApiErrorBody = {};
-      try {
-        errorBody = await response.json();
-      } catch {
-        this.config.logger.debug('Failed to parse raw error response body', { status: response.status });
-      }
-      this.throwHttpError(response.status, errorBody);
-    }
-
-    return response;
-  }
-
-  get<T>(endpoint: string, options?: RequestOptions): Promise<ApiResponse<T>> {
-    return this.request<T>('GET', endpoint, options);
-  }
-
-  post<T>(endpoint: string, body?: unknown, options?: RequestOptions): Promise<ApiResponse<T>> {
-    return this.request<T>('POST', endpoint, { ...options, body });
+  get<T>(path: ApiPath, options?: RequestOptions): Promise<ApiResponse<T>> {
+    return this.request<T>('GET', path, options);
   }
 
-  put<T>(endpoint: string, body?: unknown, options?: RequestOptions): Promise<ApiResponse<T>> {
-    return this.request<T>('PUT', endpoint, { ...options, body });
+  post<T>(path: ApiPath, body?: unknown, options?: RequestOptions): Promise<ApiResponse<T>> {
+    return this.request<T>('POST', path, { ...options, body });
   }
 
-  patch<T>(endpoint: string, body?: unknown, options?: RequestOptions): Promise<ApiResponse<T>> {
-    return this.request<T>('PATCH', endpoint, { ...options, body });
+  put<T>(path: ApiPath, body?: unknown, options?: RequestOptions): Promise<ApiResponse<T>> {
+    return this.request<T>('PUT', path, { ...options, body });
   }
 
-  delete<T>(endpoint: string, options?: RequestOptions): Promise<ApiResponse<T>> {
-    return this.request<T>('DELETE', endpoint, options);
+  patch<T>(path: ApiPath, body?: unknown, options?: RequestOptions): Promise<ApiResponse<T>> {
+    return this.request<T>('PATCH', path, { ...options, body });
   }
 
-  async uploadFile<T>(
-    endpoint: string,
-    formData: FormData,
-    options: Omit<RequestOptions, 'body'> = {}
-  ): Promise<ApiResponse<T>> {
-    return this.request<T>('POST', endpoint, { ...options, body: formData, timeoutMs: options.timeoutMs ?? this.config.fileTransferTimeoutMs });
+  delete<T>(path: ApiPath, options?: RequestOptions): Promise<ApiResponse<T>> {
+    return this.request<T>('DELETE', path, options);
   }
 
   private defaultErrorMessage(status: number): string {

package/src/identity-dialog.tsx

@@ -13,6 +13,7 @@ import {
   View,
 } from 'react-native';
 import type { SparkVaultMobile } from './client.js';
+import { identityKeyboardType, inferIdentityType, parseIdentity } from './identity-input.js';
 import type {
   IdentityConfig,
   IdentityJwks,
@@ -43,8 +44,6 @@ export interface SparkVaultIdentityDialogProps {
  * for a host that drives the ceremony itself.
  */
 const SUPPORTED_METHODS = new Set<IdentityMethodId>(['otp_email', 'otp_sms', 'otp_voice']);
-const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-const E164_PHONE_REGEX = /^\+[1-9]\d{7,14}$/;
 
 export function SparkVaultIdentityDialog({
   client,
@@ -385,7 +384,7 @@ export function SparkVaultIdentityDialog({
                     setIdentity(value);
                     setError('');
                     if (allowedTypes.length > 1) {
-                      setIdentityType(value.trim().startsWith('+') || /^\d/.test(value.trim()) ? 'phone' : 'email');
+                      setIdentityType(inferIdentityType(value));
                     }
                   }}
                   placeholder={identityPlaceholder(allowedTypes)}
@@ -393,7 +392,7 @@ export function SparkVaultIdentityDialog({
                   autoCapitalize="none"
                   autoCorrect={false}
                   autoComplete={identityType === 'phone' ? 'tel' : 'email'}
-                  keyboardType={identityType === 'phone' ? 'phone-pad' : 'email-address'}
+                  keyboardType={identityKeyboardType(allowedTypes)}
                   editable={!isBusy}
                   style={[
                     styles.input,
@@ -587,7 +586,7 @@ function resolveInitialIdentityType(
   allowedTypes: IdentityType[]
 ): IdentityType {
   if (explicitType && allowedTypes.includes(explicitType)) return explicitType;
-  if (identity?.trim().startsWith('+') && allowedTypes.includes('phone')) return 'phone';
+  if (inferIdentityType(identity ?? '') === 'phone' && allowedTypes.includes('phone')) return 'phone';
   return allowedTypes.includes('email') ? 'email' : 'phone';
 }
 
@@ -603,38 +602,6 @@ function getMethodsForIdentity(
   });
 }
 
-function parseIdentity(
-  value: string,
-  allowedTypes: IdentityType[]
-): { ok: true; identity: string; identityType: IdentityType } | { ok: false; error: string } {
-  const trimmed = value.trim();
-  if (!trimmed) {
-    return { ok: false, error: 'Enter an identity to continue.' };
-  }
-
-  const inferredType: IdentityType = trimmed.startsWith('+') || /^\d/.test(trimmed) ? 'phone' : 'email';
-  if (!allowedTypes.includes(inferredType)) {
-    return {
-      ok: false,
-      error: inferredType === 'phone' ? 'Phone sign-in is not enabled for this app.' : 'Email sign-in is not enabled for this app.',
-    };
-  }
-
-  if (inferredType === 'email') {
-    const email = trimmed.toLowerCase();
-    if (!EMAIL_REGEX.test(email) || email.length > 254) {
-      return { ok: false, error: 'Enter a valid email address.' };
-    }
-    return { ok: true, identity: email, identityType: 'email' };
-  }
-
-  const phone = trimmed.startsWith('+') ? trimmed.replace(/[^\d+]/g, '') : `+${trimmed.replace(/\D/g, '')}`;
-  if (!E164_PHONE_REGEX.test(phone)) {
-    return { ok: false, error: 'Enter a valid phone number in international format.' };
-  }
-  return { ok: true, identity: phone, identityType: 'phone' };
-}
-
 function toOtpMethod(method: SupportedMethodId): OtpMethod {
   if (method === 'otp_sms') return 'sms';
   if (method === 'otp_voice') return 'voice';

package/src/identity-input.ts

@@ -0,0 +1,70 @@
+/**
+ * Identity entry rules: what a typed identity is, its normalized form, and the
+ * keyboard its field needs. The sign-in dialog and every public identity method
+ * read identities through these rules, so a number or address resolves to the
+ * same identity whichever path it arrives by. A rule that misreads an identity
+ * locks that person out.
+ *
+ * What reads as a phone number and its E.164 form, and what is an email address
+ * and its canonical form, are the platform's one rules, mirrored from
+ * `@sparkvault/app-sdk/phone` and `@sparkvault/app-sdk/email-address` into
+ * `./app-sdk/`: the rules the Identity Product and the web SDK's identity field
+ * apply, so the dialog refuses exactly what the server would.
+ */
+
+import { canonicalEmailAddress, isValidEmailAddress } from './app-sdk/email-address.js';
+import { inferIdentityType, parsePhone } from './app-sdk/phone.js';
+import type { IdentityType } from './types.js';
+
+export { inferIdentityType };
+
+/**
+ * An identity in the form the Identity Product keys it by, read as the given
+ * type: the canonical email address (trimmed, lowercased), or a phone number in
+ * E.164. Null when the value is not a valid identity of that type.
+ */
+export function normalizeIdentifier(value: string, identityType: IdentityType): string | null {
+  if (identityType === 'phone') {
+    return parsePhone(value);
+  }
+  return isValidEmailAddress(value) ? canonicalEmailAddress(value) : null;
+}
+
+export type ParsedIdentity =
+  | { ok: true; identity: string; identityType: IdentityType }
+  | { ok: false; error: string };
+
+/** Classify and normalize a submitted identity (the canonical email address, or E.164 phone via `parsePhone`). */
+export function parseIdentity(value: string, allowedTypes: IdentityType[]): ParsedIdentity {
+  const trimmed = value.trim();
+  if (!trimmed) {
+    return { ok: false, error: 'Enter an identity to continue.' };
+  }
+
+  const inferredType = inferIdentityType(trimmed);
+  if (!allowedTypes.includes(inferredType)) {
+    return {
+      ok: false,
+      error: inferredType === 'phone' ? 'Phone sign-in is not enabled for this app.' : 'Email sign-in is not enabled for this app.',
+    };
+  }
+
+  const identity = normalizeIdentifier(trimmed, inferredType);
+  if (!identity) {
+    return {
+      ok: false,
+      error: inferredType === 'email' ? 'Enter a valid email address.' : 'Enter a valid phone number in international format.',
+    };
+  }
+  return { ok: true, identity, identityType: inferredType };
+}
+
+/**
+ * The identity field's keyboard. A field that takes an email keeps a keyboard
+ * that can type one even while the input still reads as a phone number: the
+ * first characters of "2024user@gmail.com" do, and the phone pad has no
+ * letters or '@' to finish it with.
+ */
+export function identityKeyboardType(allowedTypes: IdentityType[]): 'email-address' | 'phone-pad' {
+  return allowedTypes.includes('email') ? 'email-address' : 'phone-pad';
+}

package/src/index.ts

@@ -3,6 +3,7 @@ export {
   createSparkVaultMobileClient,
 } from './client.js';
 export type {
+  MobileConnectivity,
   SparkVaultMobileConfig,
   ResolvedMobileConfig,
 } from './config.js';
@@ -25,8 +26,10 @@ export {
 } from './folders.js';
 export {
   MobileIngotsClient,
+  NAME_CONFLICT_POLICIES,
 } from './ingots.js';
 export type {
+  NameConflictPolicy,
   DownloadToFileOptions,
   DownloadToFileResult,
   UploadOptions,
@@ -86,13 +89,11 @@ export type {
 export {
   MobileBillingClient,
 } from './billing.js';
-export type {
-  PortalSession,
-} from './billing.js';
 export {
   MobileUsersClient,
 } from './users.js';
 export {
+  isSessionExpired,
   isSessionGone,
   MobileTusUploader,
   parseForgeUrl,
@@ -110,20 +111,25 @@ export {
   bytesToUtf8,
   base64ToBytes,
   bytesToBase64,
+  bytesToBase64url,
   utf8ToBytes,
 } from './encoding.js';
 export {
   BackgroundTransferError,
   gateErrorFromBody,
+  IngotNameHeldError,
   IngotNotReadyError,
   isAuthError,
+  isIngotNameHeldError,
   isIngotNotReadyError,
   isNetworkError,
+  isNotFoundError,
   isRateLimitError,
   isReadOnlyVaultError,
   isRetryableDownloadError,
   isVatExpiredError,
   PlanRequiredError,
+  vatRefusalReason,
   QuotaExceededError,
   SparkVaultAuthenticationError,
   SparkVaultAuthorizationError,
@@ -133,6 +139,10 @@ export {
   SparkVaultValidationError,
   TusUploadError,
 } from './errors.js';
+export { VAT_REFUSAL_REASONS, endsVatSession } from './app-sdk/vat-refusal.js';
+export type {
+  IngotNameHolder,
+} from './errors.js';
 export {
   isSafeId,
   sanitizeFilename,