@arbidocs/client 0.5.24 → 0.5.26

package/dist/index.d.cts

@@ -40451,6 +40451,19 @@ interface ArbiClient {
         openAllWorkspaces(): Promise<void>;
         /** Subscribe to "the session could not be recovered" (see `relogin`). Returns an unsubscribe. */
         onSessionExpired(listener: () => void): () => void;
+        /**
+         * Subscribe to "the session is ending" (`logout`): called once nothing new can start on it and
+         * before what is in flight is aborted and the server revokes the token, so a host stops its
+         * own work on it (cancels its queries, closes its socket). Returns an unsubscribe.
+         */
+        onSigningOut(listener: () => void): () => void;
+        /** A `logout` is under way: no request starts and no re-login runs until it is done. */
+        isSigningOut(): boolean;
+        /**
+         * The current session's signal: aborted when a `logout` begins, before the server revokes the
+         * token. Hand it to work that must stop with the session (a socket, a stream).
+         */
+        sessionSignal(): AbortSignal;
     };
     /** Crypto utilities */
     crypto: {
@@ -40481,6 +40494,24 @@ interface ArbiClient {
 }
 declare function createArbiClient(options: ArbiClientOptions): ArbiClient;
 
+/**
+ * The session gate: every authenticated request of a client runs under it, so a sign-out can stop
+ * them all before the server revokes the token.
+ *
+ * A sign-out `close`s the gate: from then on no request starts (it fails at once with an
+ * `AbortError`, without reaching the network) and no re-login runs; then it `abort`s what is in
+ * flight. Only then does the server end the session, so nothing still running on the old token
+ * comes back 401, and nothing a 401 would set off (a re-login, a workspace re-open, a retry) starts
+ * a new server session behind the sign-out. Once the session is cleared the gate `reopen`s, for the
+ * next sign-in.
+ */
+
+/**
+ * Whether `error` is a request (or work) that was aborted rather than one that failed: callers
+ * treat it as nothing to report. Looks through `cause`, for an error wrapped by the SDK.
+ */
+declare function isAbortError(error: unknown): boolean;
+
 /**
  * Bearer Auth Middleware
  *
@@ -40629,4 +40660,4 @@ interface OpenAllDeps {
  */
 declare function createAllWorkspacesOpener(deps: OpenAllDeps): () => Promise<void>;
 
-export { type $defs, ACCESS_TOKEN_STORAGE_KEY, API_PREFIX, type ArbiClient, type ArbiClientOptions, type AuthStateProvider, type AutoReloginMiddlewareConfig, type BearerAuthMiddlewareConfig, CALL_KEY_BYTES, CHAT_KEY_BYTES, type CallPeer, type ChangePasswordParams, type ChangePasswordRequest, type ChangePasswordResult, type CryptoProvider, type DisconnectSsoParams, ENCRYPTED_RECOVERY_KEY_SIZE, type KeyLoginCredentials, type KeyPair, type ListedWorkspaceKey, type LoginCredentials, type LoginParams, type LoginProfile, type LoginProvider, type LoginRequest, type LoginResponse, type LoginResult, type LoginWithKeyParams, type OfflineSealer, type OfflineSealerOptions, type OnReloginSuccess, type OpenAllDeps, type ParsedRecoveryUrl, type PasswordChangeCredentials, RECOVERY_KEY_ERRORS, type RecoveryKeyParams, type RecoveryKeyValidationResult, type RegisterParams, type RegisterRequest, type RegisterResult, type RegistrationCredentials, type ReloginDeps, type ReloginFailure, type ReloginHandler, type ReopenDeps, SECURE_MAIL_KEY_BYTES, type SealedSecureMail, type SecureMailCiphertexts, type SecureMailClaim, type SessionClaims, type SessionData, type SessionKeys, type SessionManager, type SessionManagerOptions, type SessionPersistence, type SessionSignIn, type SessionState, type SessionStateStorage, type SessionUser, type SignInHooks, type SsoTokenSource, type StoredSessionState, type TokenProvider, UNENCRYPTED_RECOVERY_KEY_SIZE, type UserKeypairs, type WebSocketClientMessage, type WebSocketServerMessage, type WorkspaceKeyRefreshProvider, type WorkspaceKeys, type WorkspaceOpenProvider, type WorkspaceOpens, type WsAgentDmStatusMessage, type WsAuthMessage, type WsAuthResultMessage, type WsBatchCompleteMessage, type WsChatMessageMessage, type WsChatReadMessage, type WsChatUpdatedMessage, type WsConnectionClosedMessage, type WsConversationMessagePostedMessage, type WsErrorMessage, type WsNotificationResponse, type WsPresenceUpdateMessage, type WsResponseCompleteMessage, type WsTaskUpdateMessage, authRequestError, base64Decode, base64Encode, base64ToBytes, base64UrlToBytes, browserSessionStateStorage, buildCallFragment, buildCallLink, buildWebSocketUrl, bytesToBase64, bytesToBase64Url, canPersistSession, changePassword, clearAllData, clearSession, type components, computeSharedSecret, createAllWorkspacesOpener, createArbiClient, createAuthMessage, createAutoReloginMiddleware, createBearerAuthMiddleware, createContentHash, createOfflineSealer, createRecoveryFile, createRecoveryUrl, createReloginHandler, createSessionManager, createWorkspaceKeys, createWorkspaceOpens, createWorkspaceReopener, decodeCallKey, decodeSecureMailKey, decryptCallTitle, decryptFile, decryptMessage, decryptMessageWithSharedSecret, decryptRecoveryKey, decryptWithChatKey, deriveDirectChatKey, deriveEncryptionKeypairFromSigning, derivePublicKey, disconnectSso, encodeCallKey, encryptCallTitle, encryptFile, encryptMessage, encryptMessageWithSharedSecret, encryptRecoveryKey, encryptWithChatKey, encryptionKeypairFromSigningKey, generateCallKey, generateChatKey, generateIdentityKeypair, generateKeyPairs, generateLoginCredentials, generateLoginCredentialsFromKey, generatePasswordChangeCredentials, generateRandomSigningKeypair, generateRegistrationCredentials, generateUserKeypairs, getRecoveryKeyFilename, getSession, getUserEncryptionKeypair, hasSession, identityFromLoginResponse, initSodium, initializeDatabase, isEncryptedRecoveryKey, isMessageType, openCallKeyOf, openSealedCallKey, openSealedChatKey, openSecureMail, type operations, parseCallFragment, parseRecoveryUrl, parseServerMessage, passwordChangeErrorMessage, type paths, prewarmKeyPairs, readSessionClaims, requestSsoDisconnectCode, saveSession, sealCallKey, sealCallKeyForPeers, sealChatKey, sealKeyForSession, sealSecureMail, sealedBoxDecrypt, sealedBoxEncrypt, secureMailClaim, signMessage, unlockIdentityWithPassword, unwrapIdentityKey, unwrapWorkspaceKey, updateWrappedIdentityKey, validateRecoveryKeyFile, type webhooks, workspaceKeyRequiredOf, wrapIdentityKey };
+export { type $defs, ACCESS_TOKEN_STORAGE_KEY, API_PREFIX, type ArbiClient, type ArbiClientOptions, type AuthStateProvider, type AutoReloginMiddlewareConfig, type BearerAuthMiddlewareConfig, CALL_KEY_BYTES, CHAT_KEY_BYTES, type CallPeer, type ChangePasswordParams, type ChangePasswordRequest, type ChangePasswordResult, type CryptoProvider, type DisconnectSsoParams, ENCRYPTED_RECOVERY_KEY_SIZE, type KeyLoginCredentials, type KeyPair, type ListedWorkspaceKey, type LoginCredentials, type LoginParams, type LoginProfile, type LoginProvider, type LoginRequest, type LoginResponse, type LoginResult, type LoginWithKeyParams, type OfflineSealer, type OfflineSealerOptions, type OnReloginSuccess, type OpenAllDeps, type ParsedRecoveryUrl, type PasswordChangeCredentials, RECOVERY_KEY_ERRORS, type RecoveryKeyParams, type RecoveryKeyValidationResult, type RegisterParams, type RegisterRequest, type RegisterResult, type RegistrationCredentials, type ReloginDeps, type ReloginFailure, type ReloginHandler, type ReopenDeps, SECURE_MAIL_KEY_BYTES, type SealedSecureMail, type SecureMailCiphertexts, type SecureMailClaim, type SessionClaims, type SessionData, type SessionKeys, type SessionManager, type SessionManagerOptions, type SessionPersistence, type SessionSignIn, type SessionState, type SessionStateStorage, type SessionUser, type SignInHooks, type SsoTokenSource, type StoredSessionState, type TokenProvider, UNENCRYPTED_RECOVERY_KEY_SIZE, type UserKeypairs, type WebSocketClientMessage, type WebSocketServerMessage, type WorkspaceKeyRefreshProvider, type WorkspaceKeys, type WorkspaceOpenProvider, type WorkspaceOpens, type WsAgentDmStatusMessage, type WsAuthMessage, type WsAuthResultMessage, type WsBatchCompleteMessage, type WsChatMessageMessage, type WsChatReadMessage, type WsChatUpdatedMessage, type WsConnectionClosedMessage, type WsConversationMessagePostedMessage, type WsErrorMessage, type WsNotificationResponse, type WsPresenceUpdateMessage, type WsResponseCompleteMessage, type WsTaskUpdateMessage, authRequestError, base64Decode, base64Encode, base64ToBytes, base64UrlToBytes, browserSessionStateStorage, buildCallFragment, buildCallLink, buildWebSocketUrl, bytesToBase64, bytesToBase64Url, canPersistSession, changePassword, clearAllData, clearSession, type components, computeSharedSecret, createAllWorkspacesOpener, createArbiClient, createAuthMessage, createAutoReloginMiddleware, createBearerAuthMiddleware, createContentHash, createOfflineSealer, createRecoveryFile, createRecoveryUrl, createReloginHandler, createSessionManager, createWorkspaceKeys, createWorkspaceOpens, createWorkspaceReopener, decodeCallKey, decodeSecureMailKey, decryptCallTitle, decryptFile, decryptMessage, decryptMessageWithSharedSecret, decryptRecoveryKey, decryptWithChatKey, deriveDirectChatKey, deriveEncryptionKeypairFromSigning, derivePublicKey, disconnectSso, encodeCallKey, encryptCallTitle, encryptFile, encryptMessage, encryptMessageWithSharedSecret, encryptRecoveryKey, encryptWithChatKey, encryptionKeypairFromSigningKey, generateCallKey, generateChatKey, generateIdentityKeypair, generateKeyPairs, generateLoginCredentials, generateLoginCredentialsFromKey, generatePasswordChangeCredentials, generateRandomSigningKeypair, generateRegistrationCredentials, generateUserKeypairs, getRecoveryKeyFilename, getSession, getUserEncryptionKeypair, hasSession, identityFromLoginResponse, initSodium, initializeDatabase, isAbortError, isEncryptedRecoveryKey, isMessageType, openCallKeyOf, openSealedCallKey, openSealedChatKey, openSecureMail, type operations, parseCallFragment, parseRecoveryUrl, parseServerMessage, passwordChangeErrorMessage, type paths, prewarmKeyPairs, readSessionClaims, requestSsoDisconnectCode, saveSession, sealCallKey, sealCallKeyForPeers, sealChatKey, sealKeyForSession, sealSecureMail, sealedBoxDecrypt, sealedBoxEncrypt, secureMailClaim, signMessage, unlockIdentityWithPassword, unwrapIdentityKey, unwrapWorkspaceKey, updateWrappedIdentityKey, validateRecoveryKeyFile, type webhooks, workspaceKeyRequiredOf, wrapIdentityKey };

package/dist/index.d.ts

@@ -40451,6 +40451,19 @@ interface ArbiClient {
         openAllWorkspaces(): Promise<void>;
         /** Subscribe to "the session could not be recovered" (see `relogin`). Returns an unsubscribe. */
         onSessionExpired(listener: () => void): () => void;
+        /**
+         * Subscribe to "the session is ending" (`logout`): called once nothing new can start on it and
+         * before what is in flight is aborted and the server revokes the token, so a host stops its
+         * own work on it (cancels its queries, closes its socket). Returns an unsubscribe.
+         */
+        onSigningOut(listener: () => void): () => void;
+        /** A `logout` is under way: no request starts and no re-login runs until it is done. */
+        isSigningOut(): boolean;
+        /**
+         * The current session's signal: aborted when a `logout` begins, before the server revokes the
+         * token. Hand it to work that must stop with the session (a socket, a stream).
+         */
+        sessionSignal(): AbortSignal;
     };
     /** Crypto utilities */
     crypto: {
@@ -40481,6 +40494,24 @@ interface ArbiClient {
 }
 declare function createArbiClient(options: ArbiClientOptions): ArbiClient;
 
+/**
+ * The session gate: every authenticated request of a client runs under it, so a sign-out can stop
+ * them all before the server revokes the token.
+ *
+ * A sign-out `close`s the gate: from then on no request starts (it fails at once with an
+ * `AbortError`, without reaching the network) and no re-login runs; then it `abort`s what is in
+ * flight. Only then does the server end the session, so nothing still running on the old token
+ * comes back 401, and nothing a 401 would set off (a re-login, a workspace re-open, a retry) starts
+ * a new server session behind the sign-out. Once the session is cleared the gate `reopen`s, for the
+ * next sign-in.
+ */
+
+/**
+ * Whether `error` is a request (or work) that was aborted rather than one that failed: callers
+ * treat it as nothing to report. Looks through `cause`, for an error wrapped by the SDK.
+ */
+declare function isAbortError(error: unknown): boolean;
+
 /**
  * Bearer Auth Middleware
  *
@@ -40629,4 +40660,4 @@ interface OpenAllDeps {
  */
 declare function createAllWorkspacesOpener(deps: OpenAllDeps): () => Promise<void>;
 
-export { type $defs, ACCESS_TOKEN_STORAGE_KEY, API_PREFIX, type ArbiClient, type ArbiClientOptions, type AuthStateProvider, type AutoReloginMiddlewareConfig, type BearerAuthMiddlewareConfig, CALL_KEY_BYTES, CHAT_KEY_BYTES, type CallPeer, type ChangePasswordParams, type ChangePasswordRequest, type ChangePasswordResult, type CryptoProvider, type DisconnectSsoParams, ENCRYPTED_RECOVERY_KEY_SIZE, type KeyLoginCredentials, type KeyPair, type ListedWorkspaceKey, type LoginCredentials, type LoginParams, type LoginProfile, type LoginProvider, type LoginRequest, type LoginResponse, type LoginResult, type LoginWithKeyParams, type OfflineSealer, type OfflineSealerOptions, type OnReloginSuccess, type OpenAllDeps, type ParsedRecoveryUrl, type PasswordChangeCredentials, RECOVERY_KEY_ERRORS, type RecoveryKeyParams, type RecoveryKeyValidationResult, type RegisterParams, type RegisterRequest, type RegisterResult, type RegistrationCredentials, type ReloginDeps, type ReloginFailure, type ReloginHandler, type ReopenDeps, SECURE_MAIL_KEY_BYTES, type SealedSecureMail, type SecureMailCiphertexts, type SecureMailClaim, type SessionClaims, type SessionData, type SessionKeys, type SessionManager, type SessionManagerOptions, type SessionPersistence, type SessionSignIn, type SessionState, type SessionStateStorage, type SessionUser, type SignInHooks, type SsoTokenSource, type StoredSessionState, type TokenProvider, UNENCRYPTED_RECOVERY_KEY_SIZE, type UserKeypairs, type WebSocketClientMessage, type WebSocketServerMessage, type WorkspaceKeyRefreshProvider, type WorkspaceKeys, type WorkspaceOpenProvider, type WorkspaceOpens, type WsAgentDmStatusMessage, type WsAuthMessage, type WsAuthResultMessage, type WsBatchCompleteMessage, type WsChatMessageMessage, type WsChatReadMessage, type WsChatUpdatedMessage, type WsConnectionClosedMessage, type WsConversationMessagePostedMessage, type WsErrorMessage, type WsNotificationResponse, type WsPresenceUpdateMessage, type WsResponseCompleteMessage, type WsTaskUpdateMessage, authRequestError, base64Decode, base64Encode, base64ToBytes, base64UrlToBytes, browserSessionStateStorage, buildCallFragment, buildCallLink, buildWebSocketUrl, bytesToBase64, bytesToBase64Url, canPersistSession, changePassword, clearAllData, clearSession, type components, computeSharedSecret, createAllWorkspacesOpener, createArbiClient, createAuthMessage, createAutoReloginMiddleware, createBearerAuthMiddleware, createContentHash, createOfflineSealer, createRecoveryFile, createRecoveryUrl, createReloginHandler, createSessionManager, createWorkspaceKeys, createWorkspaceOpens, createWorkspaceReopener, decodeCallKey, decodeSecureMailKey, decryptCallTitle, decryptFile, decryptMessage, decryptMessageWithSharedSecret, decryptRecoveryKey, decryptWithChatKey, deriveDirectChatKey, deriveEncryptionKeypairFromSigning, derivePublicKey, disconnectSso, encodeCallKey, encryptCallTitle, encryptFile, encryptMessage, encryptMessageWithSharedSecret, encryptRecoveryKey, encryptWithChatKey, encryptionKeypairFromSigningKey, generateCallKey, generateChatKey, generateIdentityKeypair, generateKeyPairs, generateLoginCredentials, generateLoginCredentialsFromKey, generatePasswordChangeCredentials, generateRandomSigningKeypair, generateRegistrationCredentials, generateUserKeypairs, getRecoveryKeyFilename, getSession, getUserEncryptionKeypair, hasSession, identityFromLoginResponse, initSodium, initializeDatabase, isEncryptedRecoveryKey, isMessageType, openCallKeyOf, openSealedCallKey, openSealedChatKey, openSecureMail, type operations, parseCallFragment, parseRecoveryUrl, parseServerMessage, passwordChangeErrorMessage, type paths, prewarmKeyPairs, readSessionClaims, requestSsoDisconnectCode, saveSession, sealCallKey, sealCallKeyForPeers, sealChatKey, sealKeyForSession, sealSecureMail, sealedBoxDecrypt, sealedBoxEncrypt, secureMailClaim, signMessage, unlockIdentityWithPassword, unwrapIdentityKey, unwrapWorkspaceKey, updateWrappedIdentityKey, validateRecoveryKeyFile, type webhooks, workspaceKeyRequiredOf, wrapIdentityKey };
+export { type $defs, ACCESS_TOKEN_STORAGE_KEY, API_PREFIX, type ArbiClient, type ArbiClientOptions, type AuthStateProvider, type AutoReloginMiddlewareConfig, type BearerAuthMiddlewareConfig, CALL_KEY_BYTES, CHAT_KEY_BYTES, type CallPeer, type ChangePasswordParams, type ChangePasswordRequest, type ChangePasswordResult, type CryptoProvider, type DisconnectSsoParams, ENCRYPTED_RECOVERY_KEY_SIZE, type KeyLoginCredentials, type KeyPair, type ListedWorkspaceKey, type LoginCredentials, type LoginParams, type LoginProfile, type LoginProvider, type LoginRequest, type LoginResponse, type LoginResult, type LoginWithKeyParams, type OfflineSealer, type OfflineSealerOptions, type OnReloginSuccess, type OpenAllDeps, type ParsedRecoveryUrl, type PasswordChangeCredentials, RECOVERY_KEY_ERRORS, type RecoveryKeyParams, type RecoveryKeyValidationResult, type RegisterParams, type RegisterRequest, type RegisterResult, type RegistrationCredentials, type ReloginDeps, type ReloginFailure, type ReloginHandler, type ReopenDeps, SECURE_MAIL_KEY_BYTES, type SealedSecureMail, type SecureMailCiphertexts, type SecureMailClaim, type SessionClaims, type SessionData, type SessionKeys, type SessionManager, type SessionManagerOptions, type SessionPersistence, type SessionSignIn, type SessionState, type SessionStateStorage, type SessionUser, type SignInHooks, type SsoTokenSource, type StoredSessionState, type TokenProvider, UNENCRYPTED_RECOVERY_KEY_SIZE, type UserKeypairs, type WebSocketClientMessage, type WebSocketServerMessage, type WorkspaceKeyRefreshProvider, type WorkspaceKeys, type WorkspaceOpenProvider, type WorkspaceOpens, type WsAgentDmStatusMessage, type WsAuthMessage, type WsAuthResultMessage, type WsBatchCompleteMessage, type WsChatMessageMessage, type WsChatReadMessage, type WsChatUpdatedMessage, type WsConnectionClosedMessage, type WsConversationMessagePostedMessage, type WsErrorMessage, type WsNotificationResponse, type WsPresenceUpdateMessage, type WsResponseCompleteMessage, type WsTaskUpdateMessage, authRequestError, base64Decode, base64Encode, base64ToBytes, base64UrlToBytes, browserSessionStateStorage, buildCallFragment, buildCallLink, buildWebSocketUrl, bytesToBase64, bytesToBase64Url, canPersistSession, changePassword, clearAllData, clearSession, type components, computeSharedSecret, createAllWorkspacesOpener, createArbiClient, createAuthMessage, createAutoReloginMiddleware, createBearerAuthMiddleware, createContentHash, createOfflineSealer, createRecoveryFile, createRecoveryUrl, createReloginHandler, createSessionManager, createWorkspaceKeys, createWorkspaceOpens, createWorkspaceReopener, decodeCallKey, decodeSecureMailKey, decryptCallTitle, decryptFile, decryptMessage, decryptMessageWithSharedSecret, decryptRecoveryKey, decryptWithChatKey, deriveDirectChatKey, deriveEncryptionKeypairFromSigning, derivePublicKey, disconnectSso, encodeCallKey, encryptCallTitle, encryptFile, encryptMessage, encryptMessageWithSharedSecret, encryptRecoveryKey, encryptWithChatKey, encryptionKeypairFromSigningKey, generateCallKey, generateChatKey, generateIdentityKeypair, generateKeyPairs, generateLoginCredentials, generateLoginCredentialsFromKey, generatePasswordChangeCredentials, generateRandomSigningKeypair, generateRegistrationCredentials, generateUserKeypairs, getRecoveryKeyFilename, getSession, getUserEncryptionKeypair, hasSession, identityFromLoginResponse, initSodium, initializeDatabase, isAbortError, isEncryptedRecoveryKey, isMessageType, openCallKeyOf, openSealedCallKey, openSealedChatKey, openSecureMail, type operations, parseCallFragment, parseRecoveryUrl, parseServerMessage, passwordChangeErrorMessage, type paths, prewarmKeyPairs, readSessionClaims, requestSsoDisconnectCode, saveSession, sealCallKey, sealCallKeyForPeers, sealChatKey, sealKeyForSession, sealSecureMail, sealedBoxDecrypt, sealedBoxEncrypt, secureMailClaim, signMessage, unlockIdentityWithPassword, unwrapIdentityKey, unwrapWorkspaceKey, updateWrappedIdentityKey, validateRecoveryKeyFile, type webhooks, workspaceKeyRequiredOf, wrapIdentityKey };

package/dist/index.js

@@ -1109,6 +1109,67 @@ function createBearerAuthMiddleware(config) {
   };
 }
 
+// src/session-gate.ts
+function abortError() {
+  return new DOMException("The session ended.", "AbortError");
+}
+function isAbortError(error) {
+  for (let e = error, depth = 0; e && typeof e === "object" && depth < 5; depth++) {
+    if (e.name === "AbortError") return true;
+    e = e.cause;
+  }
+  return false;
+}
+function eitherSignal(a, b) {
+  if (!b) return a;
+  if (typeof AbortSignal.any === "function") return AbortSignal.any([a, b]);
+  const controller = new AbortController();
+  const abort = (signal) => () => controller.abort(signal.reason);
+  if (a.aborted || b.aborted) controller.abort((a.aborted ? a : b).reason);
+  else {
+    a.addEventListener("abort", abort(a), { once: true });
+    b.addEventListener("abort", abort(b), { once: true });
+  }
+  return controller.signal;
+}
+function createSessionGate() {
+  let controller = new AbortController();
+  let closed = false;
+  return {
+    get signal() {
+      return controller.signal;
+    },
+    get closed() {
+      return closed;
+    },
+    close() {
+      closed = true;
+    },
+    abort() {
+      controller.abort(abortError());
+    },
+    reopen() {
+      if (controller.signal.aborted) controller = new AbortController();
+      closed = false;
+    }
+  };
+}
+function gatedFetch(gate, fetch2) {
+  return (input, init) => {
+    if (gate.closed) return Promise.reject(abortError());
+    const own = init?.signal ?? (input instanceof Request ? input.signal : void 0);
+    return fetch2(input, { ...init, signal: eitherSignal(gate.signal, own) });
+  };
+}
+function createSessionGateMiddleware(gate) {
+  return {
+    onRequest({ request }) {
+      const signal = gate.closed ? AbortSignal.abort(abortError()) : gate.signal;
+      return new Request(request, { signal: eitherSignal(signal, request.signal) });
+    }
+  };
+}
+
 // src/workspace-keys.ts
 function createWorkspaceKeys(deps) {
   const wrapped = /* @__PURE__ */ new Map();
@@ -1905,6 +1966,8 @@ function createTransport(options) {
   const baseUrlOption = options.baseUrl;
   const base = typeof baseUrlOption === "function" ? baseUrlOption : () => baseUrlOption;
   const retryFetch = createRetryFetch();
+  const gate = createSessionGate();
+  const sessionFetch = gatedFetch(gate, retryFetch);
   const session = options.session ?? createSessionManager();
   if (userEmail) session.setUser(userEmail);
   const tokenProvider = createTokenProvider(session);
@@ -1922,7 +1985,7 @@ function createTransport(options) {
       const rawFetch = createFetchClient({
         baseUrl: base(),
         credentials,
-        fetch: retryFetch
+        fetch: sessionFetch
       });
       let response;
       try {
@@ -1935,7 +1998,7 @@ function createTransport(options) {
           }
         });
       } catch (error) {
-        console.warn("[API] Login call unreachable:", error);
+        if (!isAbortError(error)) console.warn("[API] Login call unreachable:", error);
         return "unreachable";
       }
       if (response.error || !response.data) {
@@ -1952,7 +2015,7 @@ function createTransport(options) {
     }
   };
   async function listWorkspaces(accessToken) {
-    const response = await retryFetch(`${base()}${API_PREFIX}/user/workspaces`, {
+    const response = await sessionFetch(`${base()}${API_PREFIX}/user/workspaces`, {
       method: "GET",
       headers: {
         Authorization: `Bearer ${accessToken}`,
@@ -1970,7 +2033,7 @@ function createTransport(options) {
     getServerSessionKey: () => session.getState().serverSessionKey,
     listWorkspaces,
     async primeKey(accessToken, workspaceId, sealedKey) {
-      const response = await retryFetch(
+      const response = await sessionFetch(
         `${base()}${API_PREFIX}/workspace/${workspaceId}/prime-key`,
         {
           method: "POST",
@@ -2001,7 +2064,7 @@ function createTransport(options) {
     async openWorkspace(accessToken, workspaceId, encryptedWorkspaceKey) {
       const query = "?include_documents=false&include_conversations=false&include_tags=false";
       try {
-        const response = await retryFetch(
+        const response = await sessionFetch(
           `${base()}${API_PREFIX}/workspace/${workspaceId}/open${query}`,
           {
             method: "POST",
@@ -2031,6 +2094,7 @@ function createTransport(options) {
   };
   let lastFailure = null;
   const expiredListeners = /* @__PURE__ */ new Set();
+  const signingOutListeners = /* @__PURE__ */ new Set();
   const rawRelogin = createReloginHandler({
     crypto: cryptoProvider,
     persistence,
@@ -2050,6 +2114,7 @@ function createTransport(options) {
     }
   });
   async function relogin() {
+    if (gate.closed) return null;
     const tokenBefore = session.getState().accessToken;
     const token = await rawRelogin();
     if (token) return token;
@@ -2071,7 +2136,7 @@ function createTransport(options) {
     workspaceOpenProvider: rawWorkspaceOpenProvider
   });
   let reopening = null;
-  const reopenWorkspace = () => reopening ??= workspaceOpens.run(() => authState.getSelectedWorkspaceId(), reopenSelected).finally(() => {
+  const reopenWorkspace = () => gate.closed ? Promise.resolve(false) : reopening ??= workspaceOpens.run(() => authState.getSelectedWorkspaceId(), reopenSelected).finally(() => {
     reopening = null;
   });
   const openEveryWorkspace = createAllWorkspacesOpener({
@@ -2094,6 +2159,7 @@ function createTransport(options) {
     fetch: retryFetch
   });
   if (typeof baseUrlOption === "function") readBaseUrlPerRequest(fetchClient, base);
+  fetchClient.use(createSessionGateMiddleware(gate));
   fetchClient.use(createBearerAuthMiddleware({ tokenProvider }));
   for (const m of middleware) fetchClient.use(m);
   fetchClient.use(
@@ -2121,18 +2187,39 @@ function createTransport(options) {
       relogin,
       reopenWorkspace,
       openAllWorkspaces,
+      onSigningOut(listener) {
+        signingOutListeners.add(listener);
+        return () => {
+          signingOutListeners.delete(listener);
+        };
+      },
+      isSigningOut: () => gate.closed,
+      sessionSignal: () => gate.signal,
       async logout({ everywhere = false } = {}) {
-        if (session.getState().accessToken) {
+        gate.close();
+        for (const listener of [...signingOutListeners]) {
           try {
-            await fetchClient.POST("/v1/user/logout", {
-              params: { query: { all_sessions: everywhere } }
-            });
+            listener();
           } catch (error) {
-            console.warn("[API] Server logout failed:", error);
+            console.warn("[API] A sign-out listener failed:", error);
           }
         }
-        session.clear();
-        if (everywhere) await clearAllData();
+        gate.abort();
+        try {
+          const accessToken = session.getState().accessToken;
+          if (accessToken) {
+            const query = `?all_sessions=${everywhere}`;
+            await retryFetch(`${base()}${API_PREFIX}/user/logout${query}`, {
+              method: "POST",
+              headers: { Authorization: `Bearer ${accessToken}` },
+              credentials
+            }).catch((error) => console.warn("[API] Server logout failed:", error));
+          }
+          session.clear();
+          if (everywhere) await clearAllData();
+        } finally {
+          gate.reopen();
+        }
       },
       async unlock({ email, password }) {
         const saved = await persistence.getSession();
@@ -2212,6 +2299,6 @@ function isMessageType(msg, type) {
   return msg.type === type;
 }
 
-export { ACCESS_TOKEN_STORAGE_KEY, API_PREFIX, CALL_KEY_BYTES, CHAT_KEY_BYTES, ENCRYPTED_RECOVERY_KEY_SIZE, RECOVERY_KEY_ERRORS, SECURE_MAIL_KEY_BYTES, UNENCRYPTED_RECOVERY_KEY_SIZE, authRequestError, base64Decode, base64Encode, base64ToBytes, base64UrlToBytes, browserSessionStateStorage, buildCallFragment, buildCallLink, buildWebSocketUrl, bytesToBase64, bytesToBase64Url, canPersistSession, changePassword, clearAllData, clearSession, computeSharedSecret, createAllWorkspacesOpener, createArbiClient, createAuthMessage, createAutoReloginMiddleware, createBearerAuthMiddleware, createContentHash, createOfflineSealer, createRecoveryFile, createRecoveryUrl, createReloginHandler, createSessionManager, createWorkspaceKeys, createWorkspaceOpens, createWorkspaceReopener, decodeCallKey, decodeSecureMailKey, decryptCallTitle, decryptFile, decryptMessage, decryptMessageWithSharedSecret, decryptRecoveryKey, decryptWithChatKey, deriveDirectChatKey, deriveEncryptionKeypairFromSigning, derivePublicKey, disconnectSso, encodeCallKey, encryptCallTitle, encryptFile, encryptMessage, encryptMessageWithSharedSecret, encryptRecoveryKey, encryptWithChatKey, encryptionKeypairFromSigningKey, generateCallKey, generateChatKey, generateIdentityKeypair, generateKeyPairs, generateLoginCredentials, generateLoginCredentialsFromKey, generatePasswordChangeCredentials, generateRandomSigningKeypair, generateRegistrationCredentials, generateUserKeypairs, getRecoveryKeyFilename, getSession, getUserEncryptionKeypair, hasSession, identityFromLoginResponse, initSodium, initializeDatabase, isEncryptedRecoveryKey, isMessageType, openCallKeyOf, openSealedCallKey, openSealedChatKey, openSecureMail, parseCallFragment, parseRecoveryUrl, parseServerMessage, passwordChangeErrorMessage, prewarmKeyPairs, readSessionClaims, requestSsoDisconnectCode, saveSession, sealCallKey, sealCallKeyForPeers, sealChatKey, sealKeyForSession, sealSecureMail, sealedBoxDecrypt, sealedBoxEncrypt, secureMailClaim, signMessage, unlockIdentityWithPassword, unwrapIdentityKey, unwrapWorkspaceKey, updateWrappedIdentityKey, validateRecoveryKeyFile, workspaceKeyRequiredOf, wrapIdentityKey };
+export { ACCESS_TOKEN_STORAGE_KEY, API_PREFIX, CALL_KEY_BYTES, CHAT_KEY_BYTES, ENCRYPTED_RECOVERY_KEY_SIZE, RECOVERY_KEY_ERRORS, SECURE_MAIL_KEY_BYTES, UNENCRYPTED_RECOVERY_KEY_SIZE, authRequestError, base64Decode, base64Encode, base64ToBytes, base64UrlToBytes, browserSessionStateStorage, buildCallFragment, buildCallLink, buildWebSocketUrl, bytesToBase64, bytesToBase64Url, canPersistSession, changePassword, clearAllData, clearSession, computeSharedSecret, createAllWorkspacesOpener, createArbiClient, createAuthMessage, createAutoReloginMiddleware, createBearerAuthMiddleware, createContentHash, createOfflineSealer, createRecoveryFile, createRecoveryUrl, createReloginHandler, createSessionManager, createWorkspaceKeys, createWorkspaceOpens, createWorkspaceReopener, decodeCallKey, decodeSecureMailKey, decryptCallTitle, decryptFile, decryptMessage, decryptMessageWithSharedSecret, decryptRecoveryKey, decryptWithChatKey, deriveDirectChatKey, deriveEncryptionKeypairFromSigning, derivePublicKey, disconnectSso, encodeCallKey, encryptCallTitle, encryptFile, encryptMessage, encryptMessageWithSharedSecret, encryptRecoveryKey, encryptWithChatKey, encryptionKeypairFromSigningKey, generateCallKey, generateChatKey, generateIdentityKeypair, generateKeyPairs, generateLoginCredentials, generateLoginCredentialsFromKey, generatePasswordChangeCredentials, generateRandomSigningKeypair, generateRegistrationCredentials, generateUserKeypairs, getRecoveryKeyFilename, getSession, getUserEncryptionKeypair, hasSession, identityFromLoginResponse, initSodium, initializeDatabase, isAbortError, isEncryptedRecoveryKey, isMessageType, openCallKeyOf, openSealedCallKey, openSealedChatKey, openSecureMail, parseCallFragment, parseRecoveryUrl, parseServerMessage, passwordChangeErrorMessage, prewarmKeyPairs, readSessionClaims, requestSsoDisconnectCode, saveSession, sealCallKey, sealCallKeyForPeers, sealChatKey, sealKeyForSession, sealSecureMail, sealedBoxDecrypt, sealedBoxEncrypt, secureMailClaim, signMessage, unlockIdentityWithPassword, unwrapIdentityKey, unwrapWorkspaceKey, updateWrappedIdentityKey, validateRecoveryKeyFile, workspaceKeyRequiredOf, wrapIdentityKey };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map