@evolu/nodejs 3.0.0-next.0 → 3.0.0-next.2

package/LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2023 Evolu
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/src/Crypto.d.ts

@@ -1,3 +1,4 @@
 import type { TimingSafeEqual } from "@evolu/common";
+/** Creates the Node.js implementation of {@link TimingSafeEqual}. */
 export declare const createTimingSafeEqual: () => TimingSafeEqual;
 //# sourceMappingURL=Crypto.d.ts.map

package/dist/src/Crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Crypto.d.ts","sourceRoot":"","sources":["../../src/Crypto.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGrD,eAAO,MAAM,qBAAqB,QAAO,eAAkC,CAAC"}
+{"version":3,"file":"Crypto.d.ts","sourceRoot":"","sources":["../../src/Crypto.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGrD,qEAAqE;AACrE,eAAO,MAAM,qBAAqB,QAAO,eAAkC,CAAC"}

package/dist/src/Crypto.js

@@ -1,2 +1,3 @@
 import { timingSafeEqual } from "node:crypto";
+/** Creates the Node.js implementation of {@link TimingSafeEqual}. */
 export const createTimingSafeEqual = () => timingSafeEqual;

package/dist/src/WebSocket.d.ts

@@ -0,0 +1,19 @@
+import { type ClientRequest, type IncomingMessage } from "http";
+/**
+ * A raw WebSocket upgrade request prepared for tests by
+ * {@link testSetupWebSocketUpgradeRequest}.
+ */
+export interface TestSetupWebSocketUpgradeRequest extends AsyncDisposable {
+    readonly req: ClientRequest;
+}
+/**
+ * Creates a raw WebSocket upgrade request test setup for tests that need manual
+ * request control.
+ */
+export declare const testSetupWebSocketUpgradeRequest: (port: number, path: string) => TestSetupWebSocketUpgradeRequest;
+/**
+ * Sends a raw WebSocket upgrade request and resolves with the rejection
+ * response.
+ */
+export declare const testSendWebSocketUpgradeRequest: (port: number, path: string) => Promise<IncomingMessage>;
+//# sourceMappingURL=WebSocket.d.ts.map

package/dist/src/WebSocket.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebSocket.d.ts","sourceRoot":"","sources":["../../src/WebSocket.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,KAAK,aAAa,EAAE,KAAK,eAAe,EAAE,MAAM,MAAM,CAAC;AAEzE;;;GAGG;AACH,MAAM,WAAW,gCAAiC,SAAQ,eAAe;IACvE,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;CAC7B;AAED;;;GAGG;AACH,eAAO,MAAM,gCAAgC,GAC3C,MAAM,MAAM,EACZ,MAAM,MAAM,KACX,gCAWF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,+BAA+B,GAC1C,MAAM,MAAM,EACZ,MAAM,MAAM,KACX,OAAO,CAAC,eAAe,CAezB,CAAC"}

package/dist/src/WebSocket.js

@@ -0,0 +1,46 @@
+import { request } from "http";
+/**
+ * Creates a raw WebSocket upgrade request test setup for tests that need manual
+ * request control.
+ */
+export const testSetupWebSocketUpgradeRequest = (port, path) => {
+    const req = createWebSocketUpgradeRequest(port, path);
+    req.on("error", () => undefined);
+    return {
+        req,
+        [Symbol.asyncDispose]: () => {
+            req.destroy();
+            return Promise.resolve();
+        },
+    };
+};
+/**
+ * Sends a raw WebSocket upgrade request and resolves with the rejection
+ * response.
+ */
+export const testSendWebSocketUpgradeRequest = async (port, path) => {
+    const req = createWebSocketUpgradeRequest(port, path);
+    return new Promise((resolve, reject) => {
+        req.once("response", (response) => {
+            response.resume();
+            resolve(response);
+        });
+        req.once("upgrade", (_response, socket) => {
+            socket.destroy();
+            reject(new Error("Expected HTTP upgrade rejection"));
+        });
+        req.once("error", reject);
+        req.end();
+    });
+};
+const createWebSocketUpgradeRequest = (port, path) => request({
+    host: "127.0.0.1",
+    port,
+    path,
+    headers: {
+        Connection: "Upgrade",
+        Upgrade: "websocket",
+        "Sec-WebSocket-Version": "13",
+        "Sec-WebSocket-Key": "dGhlIHNhbXBsZSBub25jZQ==",
+    },
+});

package/dist/src/index.d.ts

@@ -2,4 +2,5 @@ export * from "./Sqlite.js";
 export * from "./Crypto.js";
 export * from "./local-first/Relay.js";
 export * from "./Task.js";
+export * from "./WebSocket.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/src/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,wBAAwB,CAAC;AACvC,cAAc,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,wBAAwB,CAAC;AACvC,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC"}

package/dist/src/index.js

@@ -2,3 +2,4 @@ export * from "./Sqlite.js";
 export * from "./Crypto.js";
 export * from "./local-first/Relay.js";
 export * from "./Task.js";
+export * from "./WebSocket.js";

package/dist/src/local-first/Relay.d.ts

@@ -37,8 +37,8 @@ export declare const createRelayDeps: () => RelayDeps;
  *     startRelay({
  *       port: 4000,
  *
- *       // Note: Relay requires URL in format ws://host:port/<ownerId>
- *       // isOwnerAllowed: (_ownerId) => true,
+ *       // Note: Relay requires URL in format ws://host:port?ownerId=<ownerId>
+ *       // isOwnerAllowed: (_ownerId, { signal: _signal }) => true,
  *
  *       isOwnerWithinQuota: (_ownerId, requiredBytes) => {
  *         const maxBytes = 1024 * 1024; // 1MB

package/dist/src/local-first/Relay.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Relay.d.ts","sourceRoot":"","sources":["../../../src/local-first/Relay.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,qBAAqB,EAK1B,KAAK,SAAS,EACd,KAAK,IAAI,EACT,KAAK,kBAAkB,EAExB,MAAM,eAAe,CAAC;AACvB,OAAO,EAQL,KAAK,KAAK,EACV,KAAK,WAAW,EACjB,MAAM,2BAA2B,CAAC;AAOnC,MAAM,WAAW,iBAAkB,SAAQ,WAAW;IACpD,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,SAAS,GAAG,qBAAqB,GAAG,SAAS,GAAG,kBAAkB,CAAC;AAE/E,gEAAgE;AAChE,eAAO,MAAM,eAAe,QAAO,SAIjC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,eAAO,MAAM,UAAU,GACpB,qDAKE,iBAAiB,KAAG,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAoKlD,CAAC"}
+{"version":3,"file":"Relay.d.ts","sourceRoot":"","sources":["../../../src/local-first/Relay.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,KAAK,qBAAqB,EAI1B,KAAK,SAAS,EACd,KAAK,IAAI,EACT,KAAK,kBAAkB,EAExB,MAAM,eAAe,CAAC;AACvB,OAAO,EAQL,KAAK,KAAK,EACV,KAAK,WAAW,EACjB,MAAM,2BAA2B,CAAC;AAQnC,MAAM,WAAW,iBAAkB,SAAQ,WAAW;IACpD,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,SAAS,GAAG,qBAAqB,GAAG,SAAS,GAAG,kBAAkB,CAAC;AAE/E,gEAAgE;AAChE,eAAO,MAAM,eAAe,QAAO,SAIjC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,eAAO,MAAM,UAAU,GACpB,qDAKE,iBAAiB,KAAG,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CA6MlD,CAAC"}

package/dist/src/local-first/Relay.js

@@ -50,8 +50,9 @@ var __disposeResources = (this && this.__disposeResources) || (function (Suppres
     var e = new Error(message);
     return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
 });
-import { createRandom, createRelation, createSqlite, isPromiseLike, Name, ok, OwnerId, Uint8Array, } from "@evolu/common";
+import { AbortError, assert, callback, createRandom, createRelation, createSqlite, Name, ok, OwnerId, Uint8Array, } from "@evolu/common";
 import { applyProtocolMessageAsRelay, createBaseSqliteStorageTables, createRelaySqliteStorage, createRelayStorageTables, defaultProtocolMessageMaxSize, parseOwnerIdFromOwnerWebSocketTransportUrl, } from "@evolu/common/local-first";
+import { once } from "events";
 import { existsSync } from "fs";
 import { createServer } from "http";
 import { WebSocket, WebSocketServer } from "ws";
@@ -93,8 +94,8 @@ export const createRelayDeps = () => ({
  *     startRelay({
  *       port: 4000,
  *
- *       // Note: Relay requires URL in format ws://host:port/<ownerId>
- *       // isOwnerAllowed: (_ownerId) => true,
+ *       // Note: Relay requires URL in format ws://host:port?ownerId=<ownerId>
+ *       // isOwnerAllowed: (_ownerId, { signal: _signal }) => true,
  *
  *       isOwnerWithinQuota: (_ownerId, requiredBytes) => {
  *         const maxBytes = 1024 * 1024; // 1MB
@@ -112,27 +113,35 @@ export const startRelay = ({ port = 443, name = Name.orThrow("evolu-relay"), isO
     try {
         const stack = __addDisposableResource(env_1, new AsyncDisposableStack(), true);
         const console = run.deps.console.child("relay");
+        stack.defer(() => {
+            console.info("Shutdown complete");
+        });
         const dbFileExists = existsSync(`${name}.db`);
-        const sqliteResult = await run(createSqlite(name));
-        if (!sqliteResult.ok)
-            return sqliteResult;
-        const sqlite = stack.use(sqliteResult.value);
+        const sqlite = stack.use(await run.orThrow(createSqlite(name)));
         const deps = { ...run.deps, sqlite };
         if (!dbFileExists) {
             createBaseSqliteStorageTables(deps);
             createRelayStorageTables(deps);
         }
-        const relayRun = run.create().addDeps({
-            storage: createRelaySqliteStorage(deps)({
-                isOwnerWithinQuota,
-            }),
+        const server = stack.use(createServer());
+        server.once("close", () => {
+            console.info("HTTP server closed");
         });
-        const server = createServer();
-        const wss = new WebSocketServer({
+        const wss = stack.adopt(new WebSocketServer({
             maxPayload: defaultProtocolMessageMaxSize,
             noServer: true,
-        });
+        }), (wss) => new Promise((resolve) => {
+            wss.close(() => {
+                console.info("WebSocketServer closed");
+                resolve();
+            });
+        }));
         const ownerSocketRelation = createRelation();
+        const relayRun = stack.use(run.create().addDeps({
+            storage: createRelaySqliteStorage(deps)({
+                isOwnerWithinQuota,
+            }),
+        }));
         server.on("upgrade", (request, socket, head) => {
             socket.on("error", console.debug);
             const completeUpgrade = () => {
@@ -145,24 +154,48 @@ export const startRelay = ({ port = 443, name = Name.orThrow("evolu-relay"), isO
                 completeUpgrade();
                 return;
             }
-            const ownerId = parseOwnerIdFromOwnerWebSocketTransportUrl(request.url ?? "");
-            if (!ownerId) {
-                console.debug("invalid or missing ownerId in URL", request.url);
-                socket.write("HTTP/1.1 400 Bad Request\r\n\r\n");
+            const respondAndDestroy = (statusCode) => {
+                if (socket.destroyed)
+                    return;
+                socket.write(`HTTP/1.1 ${statusCode} ${HttpStatusTextByCode[statusCode]}\r\n\r\n`);
                 socket.destroy();
+            };
+            const requestUrl = request.url;
+            const ownerId = requestUrl
+                ? parseOwnerIdFromOwnerWebSocketTransportUrl(requestUrl)
+                : undefined;
+            if (!ownerId) {
+                console.debug("invalid or missing ownerId in URL", requestUrl);
+                respondAndDestroy(400);
                 return;
             }
-            void (async () => {
-                const result = isOwnerAllowed(ownerId);
-                const isAllowed = isPromiseLike(result) ? await result : result;
-                if (!isAllowed) {
-                    console.debug("unauthorized owner", ownerId);
-                    socket.write("HTTP/1.1 401 Unauthorized\r\n\r\n");
+            const authorizationFiber = relayRun(callback(({ ok, err, signal }) => {
+                void Promise.try(() => isOwnerAllowed(ownerId, { signal })).then(ok, err);
+            }));
+            const abortAuthorization = () => {
+                authorizationFiber.abort("WebSocket upgrade request socket closed");
+            };
+            socket.once("close", abortAuthorization);
+            socket.once("error", abortAuthorization);
+            void authorizationFiber.then((result) => {
+                socket.removeListener("close", abortAuthorization);
+                socket.removeListener("error", abortAuthorization);
+                if (!result.ok) {
+                    if (!AbortError.is(result.error)) {
+                        console.error("isOwnerAllowed failed", ownerId, result.error);
+                        respondAndDestroy(503);
+                        return;
+                    }
                     socket.destroy();
                     return;
                 }
+                if (!result.value) {
+                    console.debug("unauthorized owner", ownerId);
+                    respondAndDestroy(401);
+                    return;
+                }
                 completeUpgrade();
-            })();
+            });
         });
         wss.on("connection", (ws) => {
             console.debug("on connection", wss.clients.size);
@@ -201,23 +234,6 @@ export const startRelay = ({ port = 443, name = Name.orThrow("evolu-relay"), isO
                 console.debug("ws close", wss.clients.size);
             });
         });
-        // Cleanup runs in LIFO order: clients → WebSocketServer → HTTP server
-        stack.defer(() => {
-            console.info("Shutdown complete");
-        });
-        stack.defer(() => {
-            server.close(() => {
-                console.info("HTTP server closed");
-            });
-        });
-        stack.defer(() => {
-            // wss.close() emits 'close' when all clients have disconnected
-            // https://github.com/websockets/ws/blob/master/doc/ws.md#serverclosecallback
-            wss.close(() => {
-                console.info("WebSocketServer closed");
-                ok();
-            });
-        });
         stack.defer(() => {
             console.info("Shutting down...");
             for (const client of wss.clients) {
@@ -226,10 +242,16 @@ export const startRelay = ({ port = 443, name = Name.orThrow("evolu-relay"), isO
                 }
             }
         });
-        stack.use(relayRun);
         server.listen(port);
-        console.info(`Started on port ${port}`);
-        return ok(stack.move());
+        await once(server, "listening");
+        const address = server.address();
+        assert(address && typeof address !== "string", "Expected TCP address");
+        const moved = stack.move();
+        console.info(`Started on port ${address.port}`);
+        return ok({
+            port: address.port,
+            [Symbol.asyncDispose]: () => moved.disposeAsync(),
+        });
     }
     catch (e_1) {
         env_1.error = e_1;
@@ -241,3 +263,8 @@ export const startRelay = ({ port = 443, name = Name.orThrow("evolu-relay"), isO
             await result_1;
     }
 };
+const HttpStatusTextByCode = {
+    400: "Bad Request",
+    401: "Unauthorized",
+    503: "Service Unavailable",
+};

package/package.json

@@ -1,10 +1,13 @@
 {
   "name": "@evolu/nodejs",
-  "version": "3.0.0-next.0",
+  "version": "3.0.0-next.2",
   "description": "Evolu for Node.js",
   "author": "Daniel Steigerwald <daniel@steigerwald.cz>",
   "license": "MIT",
-  "repository": "evoluhq/evolu",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/evoluhq/evolu.git"
+  },
   "bugs": {
     "url": "https://github.com/evoluhq/evolu/issues"
   },
@@ -23,22 +26,17 @@
     "src/**",
     "README.md"
   ],
-  "scripts": {
-    "build": "tsc --build tsconfig.build.json",
-    "prepack": "npm run build",
-    "format": "prettier --write \"src/*.{ts,tsx,md}\""
-  },
   "dependencies": {
     "better-sqlite3": "^12.6.2",
     "ws": "^8.19.0"
   },
   "devDependencies": {
-    "@evolu/common": "8.0.0-next.0",
-    "@evolu/typescript-config": "*",
     "@types/better-sqlite3": "^7.6.13",
     "@types/node": "^24.10.9",
     "@types/ws": "^8.18.1",
-    "typescript": "^5.9.3"
+    "typescript": "^6",
+    "@evolu/common": "8.0.0-next.2",
+    "@evolu/typescript-config": "0.0.2"
   },
   "peerDependencies": {
     "@evolu/common": "^8.0.0-next.0"
@@ -48,5 +46,9 @@
   },
   "publishConfig": {
     "access": "public"
+  },
+  "scripts": {
+    "build": "tsc --build tsconfig.build.json",
+    "format": "prettier --write \"src/*.{ts,tsx,md}\""
   }
-}
+}

package/src/Crypto.ts

@@ -1,4 +1,5 @@
 import type { TimingSafeEqual } from "@evolu/common";
 import { timingSafeEqual } from "node:crypto";
 
+/** Creates the Node.js implementation of {@link TimingSafeEqual}. */
 export const createTimingSafeEqual = (): TimingSafeEqual => timingSafeEqual;

package/src/WebSocket.ts

@@ -0,0 +1,69 @@
+import { request, type ClientRequest, type IncomingMessage } from "http";
+
+/**
+ * A raw WebSocket upgrade request prepared for tests by
+ * {@link testSetupWebSocketUpgradeRequest}.
+ */
+export interface TestSetupWebSocketUpgradeRequest extends AsyncDisposable {
+  readonly req: ClientRequest;
+}
+
+/**
+ * Creates a raw WebSocket upgrade request test setup for tests that need manual
+ * request control.
+ */
+export const testSetupWebSocketUpgradeRequest = (
+  port: number,
+  path: string,
+): TestSetupWebSocketUpgradeRequest => {
+  const req = createWebSocketUpgradeRequest(port, path);
+  req.on("error", () => undefined);
+
+  return {
+    req,
+    [Symbol.asyncDispose]: () => {
+      req.destroy();
+      return Promise.resolve();
+    },
+  };
+};
+
+/**
+ * Sends a raw WebSocket upgrade request and resolves with the rejection
+ * response.
+ */
+export const testSendWebSocketUpgradeRequest = async (
+  port: number,
+  path: string,
+): Promise<IncomingMessage> => {
+  const req = createWebSocketUpgradeRequest(port, path);
+
+  return new Promise((resolve, reject) => {
+    req.once("response", (response) => {
+      response.resume();
+      resolve(response);
+    });
+    req.once("upgrade", (_response, socket) => {
+      socket.destroy();
+      reject(new Error("Expected HTTP upgrade rejection"));
+    });
+    req.once("error", reject);
+    req.end();
+  });
+};
+
+const createWebSocketUpgradeRequest = (
+  port: number,
+  path: string,
+): ClientRequest =>
+  request({
+    host: "127.0.0.1",
+    port,
+    path,
+    headers: {
+      Connection: "Upgrade",
+      Upgrade: "websocket",
+      "Sec-WebSocket-Version": "13",
+      "Sec-WebSocket-Key": "dGhlIHNhbXBsZSBub25jZQ==",
+    },
+  });

package/src/index.ts

@@ -2,3 +2,4 @@ export * from "./Sqlite.js";
 export * from "./Crypto.js";
 export * from "./local-first/Relay.js";
 export * from "./Task.js";
+export * from "./WebSocket.js";

package/src/local-first/Relay.ts

@@ -1,9 +1,11 @@
 import {
+  AbortError,
+  assert,
+  callback,
   createRandom,
   createRelation,
   createSqlite,
   type CreateSqliteDriverDep,
-  isPromiseLike,
   Name,
   ok,
   OwnerId,
@@ -23,6 +25,7 @@ import {
   type Relay,
   type RelayConfig,
 } from "@evolu/common/local-first";
+import { once } from "events";
 import { existsSync } from "fs";
 import { createServer } from "http";
 import { WebSocket, WebSocketServer } from "ws";
@@ -73,8 +76,8 @@ export const createRelayDeps = (): RelayDeps => ({
  *     startRelay({
  *       port: 4000,
  *
- *       // Note: Relay requires URL in format ws://host:port/<ownerId>
- *       // isOwnerAllowed: (_ownerId) => true,
+ *       // Note: Relay requires URL in format ws://host:port?ownerId=<ownerId>
+ *       // isOwnerAllowed: (_ownerId, { signal: _signal }) => true,
  *
  *       isOwnerWithinQuota: (_ownerId, requiredBytes) => {
  *         const maxBytes = 1024 * 1024; // 1MB
@@ -98,12 +101,12 @@ export const startRelay =
     await using stack = new AsyncDisposableStack();
     const console = run.deps.console.child("relay");
 
-    const dbFileExists = existsSync(`${name}.db`);
-
-    const sqliteResult = await run(createSqlite(name));
-    if (!sqliteResult.ok) return sqliteResult;
-    const sqlite = stack.use(sqliteResult.value);
+    stack.defer(() => {
+      console.info("Shutdown complete");
+    });
 
+    const dbFileExists = existsSync(`${name}.db`);
+    const sqlite = stack.use(await run.orThrow(createSqlite(name)));
     const deps = { ...run.deps, sqlite };
 
     if (!dbFileExists) {
@@ -111,19 +114,35 @@ export const startRelay =
       createRelayStorageTables(deps);
     }
 
-    const relayRun = run.create().addDeps({
-      storage: createRelaySqliteStorage(deps)({
-        isOwnerWithinQuota,
-      }),
+    const server = stack.use(createServer());
+    server.once("close", () => {
+      console.info("HTTP server closed");
     });
 
-    const server = createServer();
-    const wss = new WebSocketServer({
-      maxPayload: defaultProtocolMessageMaxSize,
-      noServer: true,
-    });
+    const wss = stack.adopt(
+      new WebSocketServer({
+        maxPayload: defaultProtocolMessageMaxSize,
+        noServer: true,
+      }),
+      (wss) =>
+        new Promise<void>((resolve) => {
+          wss.close(() => {
+            console.info("WebSocketServer closed");
+            resolve();
+          });
+        }),
+    );
+
     const ownerSocketRelation = createRelation<OwnerId, WebSocket>();
 
+    const relayRun = stack.use(
+      run.create().addDeps({
+        storage: createRelaySqliteStorage(deps)({
+          isOwnerWithinQuota,
+        }),
+      }),
+    );
+
     server.on("upgrade", (request, socket, head) => {
       socket.on("error", console.debug);
 
@@ -140,28 +159,65 @@ export const startRelay =
         return;
       }
 
-      const ownerId = parseOwnerIdFromOwnerWebSocketTransportUrl(
-        request.url ?? "",
-      );
+      const respondAndDestroy = (
+        statusCode: keyof typeof HttpStatusTextByCode,
+      ) => {
+        if (socket.destroyed) return;
+        socket.write(
+          `HTTP/1.1 ${statusCode} ${HttpStatusTextByCode[statusCode]}\r\n\r\n`,
+        );
+        socket.destroy();
+      };
+
+      const requestUrl = request.url;
+      const ownerId = requestUrl
+        ? parseOwnerIdFromOwnerWebSocketTransportUrl(requestUrl)
+        : undefined;
 
       if (!ownerId) {
-        console.debug("invalid or missing ownerId in URL", request.url);
-        socket.write("HTTP/1.1 400 Bad Request\r\n\r\n");
-        socket.destroy();
+        console.debug("invalid or missing ownerId in URL", requestUrl);
+        respondAndDestroy(400);
         return;
       }
 
-      void (async () => {
-        const result = isOwnerAllowed(ownerId);
-        const isAllowed = isPromiseLike(result) ? await result : result;
-        if (!isAllowed) {
-          console.debug("unauthorized owner", ownerId);
-          socket.write("HTTP/1.1 401 Unauthorized\r\n\r\n");
+      const authorizationFiber = relayRun(
+        callback<boolean, unknown>(({ ok, err, signal }) => {
+          void Promise.try(() => isOwnerAllowed(ownerId, { signal })).then(
+            ok,
+            err,
+          );
+        }),
+      );
+
+      const abortAuthorization = () => {
+        authorizationFiber.abort("WebSocket upgrade request socket closed");
+      };
+
+      socket.once("close", abortAuthorization);
+      socket.once("error", abortAuthorization);
+
+      void authorizationFiber.then((result) => {
+        socket.removeListener("close", abortAuthorization);
+        socket.removeListener("error", abortAuthorization);
+
+        if (!result.ok) {
+          if (!AbortError.is(result.error)) {
+            console.error("isOwnerAllowed failed", ownerId, result.error);
+            respondAndDestroy(503);
+            return;
+          }
           socket.destroy();
           return;
         }
+
+        if (!result.value) {
+          console.debug("unauthorized owner", ownerId);
+          respondAndDestroy(401);
+          return;
+        }
+
         completeUpgrade();
-      })();
+      });
     });
 
     wss.on("connection", (ws) => {
@@ -222,26 +278,6 @@ export const startRelay =
       });
     });
 
-    // Cleanup runs in LIFO order: clients → WebSocketServer → HTTP server
-    stack.defer(() => {
-      console.info("Shutdown complete");
-    });
-
-    stack.defer(() => {
-      server.close(() => {
-        console.info("HTTP server closed");
-      });
-    });
-
-    stack.defer(() => {
-      // wss.close() emits 'close' when all clients have disconnected
-      // https://github.com/websockets/ws/blob/master/doc/ws.md#serverclosecallback
-      wss.close(() => {
-        console.info("WebSocketServer closed");
-        ok();
-      });
-    });
-
     stack.defer(() => {
       console.info("Shutting down...");
       for (const client of wss.clients) {
@@ -251,10 +287,24 @@ export const startRelay =
       }
     });
 
-    stack.use(relayRun);
-
     server.listen(port);
-    console.info(`Started on port ${port}`);
+    await once(server, "listening");
+
+    const address = server.address();
+    assert(address && typeof address !== "string", "Expected TCP address");
+
+    const moved = stack.move();
 
-    return ok(stack.move());
+    console.info(`Started on port ${address.port}`);
+
+    return ok({
+      port: address.port,
+      [Symbol.asyncDispose]: () => moved.disposeAsync(),
+    });
   };
+
+const HttpStatusTextByCode = {
+  400: "Bad Request",
+  401: "Unauthorized",
+  503: "Service Unavailable",
+} as const;