@fuzdev/fuz_app 0.117.1 → 0.119.0

package/dist/realtime/subscriber_registry.js

@@ -17,6 +17,9 @@
  * carries a broader identity for coarse close — the broader identity
  * doesn't cap across sessions.
  *
+ * Registration can run in two phases (`subscribe_pending` then `admit`) so a
+ * revocation reaches a stream that is still opening — see the class doc.
+ *
  * @module
  */
 /**
@@ -27,6 +30,28 @@
  * matching subscribers. `close_by_identity` force-closes all subscribers
  * whose `scope` or `groups` contain the given key — use for auth revocation.
  *
+ * ## Two-phase registration
+ *
+ * A stream is authorized once, at open, so a revocation has to be able to
+ * reach it from the moment its credential is read. A route's gates run before
+ * the stream exists, and each revocation closes only the streams *registered*
+ * under what it revoked — registering after the gates leaves a window in which
+ * a revocation closes nothing and the stream then opens on a dead session, or
+ * under a role its actor no longer holds.
+ *
+ * So a route that authenticated a revocable credential registers in two
+ * phases: `subscribe_pending` registers the subscription **un-admitted** —
+ * closeable by every `close_by_identity`, and otherwise inert: it has no
+ * stream, so no broadcast reaches it, the cap neither counts nor evicts for
+ * it, and `count` does not see it (`pending_count` does). The route then
+ * re-reads the credential and the role, and `admit` attaches the stream and
+ * opens the feed — or refuses when a revocation closed the registration in
+ * between, evicting nothing. The cap's eviction happens at admission.
+ *
+ * `subscribe` stays as the one-step form for a stream with nothing to revoke
+ * behind it. The twin of the Rust `fuz_realtime` `SseRegistry`
+ * (`subscribe_pending` / `admit` / `subscribe`).
+ *
  * @example
  * ```ts
  * const registry = new SubscriberRegistry<SseNotification>();
@@ -56,19 +81,63 @@
  * // fine — close just the stream(s) tied to a specific session
  * registry.close_by_identity(session_hash);
  * ```
+ *
+ * @example
+ * ```ts
+ * // two-phase, for a route behind a revocable credential
+ * const pending = registry.subscribe_pending({scope: session_hash, groups: [account_id]});
+ * if (!(await credential_is_still_live())) {
+ *   pending.unsubscribe();
+ *   return unauthorized();
+ * }
+ * const {response, stream} = create_sse_response(c, log);
+ * if (registry.admit(pending, stream)) stream.on_close(pending.unsubscribe);
+ * else stream.close(); // closed while pending — the body is the connect comment alone
+ * return response;
+ * ```
  */
 export class SubscriberRegistry {
+    // insertion order is registration order — the cap's "oldest"
     #subscribers = new Set();
+    // each pending handle's entry; keyed per registry, so a handle from
+    // another registry names nothing here
+    #pending = new WeakMap();
     #max_per_scope;
     constructor(options) {
         this.#max_per_scope = options?.max_per_scope ?? null;
     }
-    /** Number of active subscribers. */
+    /**
+     * Number of open — **admitted** — subscribers. A registration still pending
+     * admission is counted by `pending_count` instead.
+     */
     get count() {
-        return this.#subscribers.size;
+        let count = 0;
+        for (const subscriber of this.#subscribers) {
+            if (subscriber.stream !== null)
+                count++;
+        }
+        return count;
     }
     /**
-     * Add a subscriber.
+     * Number of registrations awaiting admission — between `subscribe_pending`
+     * and `admit` (or their refusal). For telemetry and tests.
+     */
+    get pending_count() {
+        let count = 0;
+        for (const subscriber of this.#subscribers) {
+            if (subscriber.stream === null)
+                count++;
+        }
+        return count;
+    }
+    /**
+     * Add a subscriber, admitted at once — the one-step form of
+     * `subscribe_pending` + `admit`.
+     *
+     * **Not for a route that authenticated a revocable credential**: a
+     * revocation landing between that route's gates and this call closes
+     * nothing, and the stream would open on a dead credential (class doc,
+     * "Two-phase registration").
      *
      * @param stream - SSE stream to send data to
      * @param options - channel filter and identity slots (`scope` + `groups`)
@@ -76,28 +145,72 @@ export class SubscriberRegistry {
      * @mutates registry - adds the new subscriber; closes oldest matching subscribers when `max_per_scope` is exceeded
      */
     subscribe(stream, options) {
-        const channels = options?.channels && options.channels.length > 0 ? new Set(options.channels) : null;
-        const scope = options?.scope ?? null;
-        const groups = options?.groups && options.groups.length > 0 ? new Set(options.groups) : null;
-        // Per-scope cap — only `scope` is capped, `groups` are never capped.
-        // Insertion order of the backing Set preserves FIFO eviction semantics.
-        if (this.#max_per_scope != null && scope !== null) {
-            this.#enforce_scope_limit(scope, this.#max_per_scope);
-        }
-        const subscriber = { stream, channels, scope, groups };
+        const subscriber = this.#create_entry(options);
+        this.#admit_entry(subscriber, stream);
         this.#subscribers.add(subscriber);
         return () => {
             this.#subscribers.delete(subscriber);
         };
     }
     /**
-     * Broadcast data to all subscribers on a channel.
+     * Register a subscription **un-admitted** — phase one of the two-phase
+     * registration (class doc).
+     *
+     * The registration is closeable at once by every `close_by_identity`
+     * matching its `scope` or `groups`, and until `admit` it receives no
+     * broadcast, is not counted, and evicts nothing. A caller that then refuses
+     * the request calls the returned handle's `unsubscribe`.
+     *
+     * @param options - channel filter and identity slots (`scope` + `groups`)
+     * @returns the pending handle `admit` takes
+     * @mutates registry - adds the un-admitted registration
+     */
+    subscribe_pending(options) {
+        const subscriber = this.#create_entry(options);
+        this.#subscribers.add(subscriber);
+        const pending = {
+            unsubscribe: () => {
+                this.#subscribers.delete(subscriber);
+            }
+        };
+        this.#pending.set(pending, subscriber);
+        return pending;
+    }
+    /**
+     * Admit a pending subscription, attaching the stream it delivers to — phase
+     * two (class doc).
+     *
+     * If the registration is gone — a revocation closed it while it was
+     * pending, or it was unsubscribed — nothing is evicted and the subscription
+     * is refused. Otherwise the per-scope cap is enforced as in `subscribe`,
+     * counting only admitted subscribers, and the stream starts receiving
+     * `broadcast` data. Admitting twice is refused the second time.
+     *
+     * @param pending - the handle `subscribe_pending` returned
+     * @param stream - SSE stream to send data to
+     * @returns `false` when the subscription was not admitted — the caller ends the stream
+     * @mutates registry - attaches `stream`; closes oldest matching subscribers when `max_per_scope` is exceeded
+     */
+    admit(pending, stream) {
+        const subscriber = this.#pending.get(pending);
+        if (!subscriber || subscriber.stream !== null || !this.#subscribers.has(subscriber)) {
+            return false;
+        }
+        this.#admit_entry(subscriber, stream);
+        return true;
+    }
+    /**
+     * Broadcast data to all admitted subscribers on a channel.
      *
      * Subscribers with no channel filter receive all broadcasts.
-     * Subscribers with a channel filter only receive matching broadcasts.
+     * Subscribers with a channel filter only receive matching broadcasts. A
+     * registration pending admission is not an open stream and is skipped —
+     * nothing is queued toward a subscriber not yet authorized.
      */
     broadcast(channel, data) {
         for (const subscriber of this.#subscribers) {
+            if (subscriber.stream === null)
+                continue;
             if (subscriber.channels === null || subscriber.channels.has(channel)) {
                 subscriber.stream.send(data);
             }
@@ -110,9 +223,17 @@ export class SubscriberRegistry {
      * Use for auth revocation — when a user's permissions change, close their
      * SSE connections so they must reconnect and re-authenticate.
      *
+     * Matches every registration, pending or admitted — never filter on
+     * admission here: reaching a registration in flight is the point of the
+     * pending phase, and `admit` then refuses it.
+     *
+     * A stream whose `close` throws does not stop the loop: every match is
+     * removed and closed, and the first error is thrown afterward.
+     *
      * @param identity - the identity key to match (checked against `scope` and `groups`)
      * @returns the number of subscribers closed
      * @mutates registry - removes matching subscribers and closes their streams
+     * @throws the first error a stream's `close` threw, after every match was attempted
      */
     close_by_identity(identity) {
         // collect first, then close — avoids mutating the Set during iteration
@@ -123,28 +244,66 @@ export class SubscriberRegistry {
                 to_close.push(subscriber);
             }
         }
+        let failed = false;
+        let first_error;
         for (const subscriber of to_close) {
-            subscriber.stream.close();
+            // removed first, so a stream whose close throws is unregistered too
             this.#subscribers.delete(subscriber);
+            try {
+                subscriber.stream?.close();
+            }
+            catch (error) {
+                if (!failed) {
+                    failed = true;
+                    first_error = error;
+                }
+            }
         }
+        if (failed)
+            throw first_error;
         return to_close.length;
     }
+    #create_entry(options) {
+        return {
+            stream: null,
+            channels: options?.channels && options.channels.length > 0 ? new Set(options.channels) : null,
+            scope: options?.scope ?? null,
+            groups: options?.groups && options.groups.length > 0 ? new Set(options.groups) : null
+        };
+    }
+    /**
+     * Enforce the per-scope cap for one more admitted subscriber on the entry's
+     * scope, then attach its stream.
+     */
+    #admit_entry(subscriber, stream) {
+        // Per-scope cap — only `scope` is capped, `groups` are never capped. The
+        // entry itself has no stream yet, so the eviction neither counts nor
+        // removes it.
+        if (this.#max_per_scope != null && subscriber.scope !== null) {
+            this.#enforce_scope_limit(subscriber.scope, this.#max_per_scope);
+        }
+        subscriber.stream = stream;
+    }
+    /**
+     * Close `scope`'s oldest **admitted** subscribers until one more fits under
+     * `max`. Pending registrations are neither counted nor closed — a
+     * subscription that may yet be refused must not cost a live one its slot.
+     */
     #enforce_scope_limit(scope, max) {
-        // count existing subscribers with this scope (in insertion order)
+        // admitted subscribers with this scope, in registration order (the
+        // backing Set's insertion order), paired with their streams
         const matching = [];
         for (const subscriber of this.#subscribers) {
-            if (subscriber.scope === scope)
-                matching.push(subscriber);
+            if (subscriber.scope === scope && subscriber.stream !== null) {
+                matching.push([subscriber, subscriber.stream]);
+            }
         }
         // close oldest first, stopping once we've freed up room for one more
-        let overflow = matching.length - (max - 1);
-        let i = 0;
-        while (overflow > 0 && i < matching.length) {
-            const victim = matching[i];
-            victim.stream.close();
+        const overflow = matching.length - (max - 1);
+        for (let i = 0; i < overflow; i++) {
+            const [victim, stream] = matching[i];
+            stream.close();
             this.#subscribers.delete(victim);
-            overflow--;
-            i++;
         }
     }
 }

package/dist/runtime/deno.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deno.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/runtime/deno.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,WAAW,EAA6B,MAAM,WAAW,CAAC;AAoExE;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAAI,MAAM,aAAa,CAAC,MAAM,CAAC,KAAG,WAuKhE,CAAC"}
+{"version":3,"file":"deno.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/runtime/deno.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,WAAW,EAA6B,MAAM,WAAW,CAAC;AAyExE;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAAI,MAAM,aAAa,CAAC,MAAM,CAAC,KAAG,WA0KhE,CAAC"}

package/dist/runtime/deno.js

@@ -8,7 +8,7 @@
  * @module
  */
 import { to_error_message } from '@fuzdev/fuz_util/error.ts';
-import { assert_secure_mode, assert_secure_size, read_secure_bounded } from './secure_file.js';
+import { assert_secure_mode, assert_secure_regular_file, assert_secure_size, read_secure_bounded } from './secure_file.js';
 /**
  * Create a runtime backed by Deno APIs.
  *
@@ -46,17 +46,20 @@ export const create_deno_runtime = (args) => ({
     read_text_file: (path) => Deno.readTextFile(path),
     read_file: (path) => Deno.readFile(path),
     read_secure_file: async (path) => {
-        // Deno exposes no O_NOFOLLOW, so the symlink check is a pre-open lstat
-        // (a TOCTOU window the Node impl doesn't have — the mode check below
-        // still runs on the open descriptor, so a post-open swap can't defeat
-        // it). The checks themselves are the shared `runtime/secure_file.ts`
-        // helpers, same as `load_secure_file_node`.
+        // Deno exposes no O_NOFOLLOW or O_NONBLOCK, so the symlink and
+        // regular-file checks are a pre-open lstat (a TOCTOU window the Node
+        // impl doesn't have — a FIFO swapped in after it would block the open;
+        // the checks below still run on the open descriptor, so a post-open swap
+        // can't defeat them). The checks themselves are the shared
+        // `runtime/secure_file.ts` helpers, same as `load_secure_file_node`.
         const l = await Deno.lstat(path);
         if (l.isSymlink)
             throw new Error(`secure file is a symlink: ${path}`);
+        assert_secure_regular_file(path, l.isFile);
         const file = await Deno.open(path, { read: true });
         try {
             const s = await file.stat();
+            assert_secure_regular_file(path, s.isFile);
             // `mode` is null where POSIX modes don't apply (Windows).
             if (s.mode !== null)
                 assert_secure_mode(path, s.mode);

package/dist/runtime/deps.d.ts

@@ -103,8 +103,9 @@ export interface WriteFileOptions {
  */
 export interface FsSecureReadDeps {
     /**
-     * Read a small secret file with fail-loud checks: rejects symlinks, any
-     * group/other-accessible mode (must be `0600`/`0400`; skipped where POSIX
+     * Read a small secret file with fail-loud checks: rejects symlinks,
+     * non-regular files (FIFO, device, directory — real runtimes only; the mock
+     * has no file types), any group/other-accessible mode (must be `0600`/`0400`; skipped where POSIX
      * modes don't apply), and files over a 4 KiB cap. Permission checks run on
      * the open descriptor where the platform allows, so the file can't be
      * swapped between check and read. Throws on any refusal — a refused secret

package/dist/runtime/deps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deps.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/runtime/deps.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;GAEG;AACH,MAAM,WAAW,UAAU;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB;;;;;;;;;OASG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IACjC,+CAA+C;IAC/C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB,yCAAyC;IACzC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IAC9C,mCAAmC;IACnC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/C;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACxC,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAChC;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAChC;;;;;;;OAOG;IACH,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;CACxD;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IAC1B,+DAA+D;IAC/D,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACnD,8DAA8D;IAC9D,cAAc,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,+DAA+D;IAC/D,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,qBAAqB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC3F,8FAA8F;IAC9F,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;CAClD;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,sFAAsF;IACtF,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzF,6EAA6E;IAC7E,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9F,6BAA6B;IAC7B,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,4BAA4B;IAC5B,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D;;;;;;;;;;OAUG;IACH,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC5B;;;;;OAKG;IACH,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;IACxE;;;;;OAKG;IACH,iBAAiB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACrF;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC5B,kCAAkC;IAClC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3E;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B;;;;;;;OAOG;IACH,WAAW,EAAE,CACZ,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EACnB,OAAO,CAAC,EAAE,iBAAiB,KACvB,OAAO,CAAC,aAAa,CAAC,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACzB,yDAAyD;IACzD,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB,6BAA6B;IAC7B,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC5B,6BAA6B;IAC7B,YAAY,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,6CAA6C;IAC7C,UAAU,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC3D;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,oCAAoC;IACpC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,KAAK,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAChB,SACC,OAAO,EACP,UAAU,EACV,gBAAgB,EAChB,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,SAAS,EACT,YAAY,EACZ,WAAW,EACX,OAAO;IACR,qCAAqC;IACrC,OAAO,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACrC,qCAAqC;IACrC,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,qFAAqF;IACrF,mBAAmB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3E"}
+{"version":3,"file":"deps.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/runtime/deps.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;GAEG;AACH,MAAM,WAAW,UAAU;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB;;;;;;;;;OASG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IACjC,+CAA+C;IAC/C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB,yCAAyC;IACzC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IAC9C,mCAAmC;IACnC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/C;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACxC,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAChC;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAChC;;;;;;;;OAQG;IACH,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;CACxD;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IAC1B,+DAA+D;IAC/D,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACnD,8DAA8D;IAC9D,cAAc,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,+DAA+D;IAC/D,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,qBAAqB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC3F,8FAA8F;IAC9F,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;CAClD;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,sFAAsF;IACtF,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzF,6EAA6E;IAC7E,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9F,6BAA6B;IAC7B,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,4BAA4B;IAC5B,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D;;;;;;;;;;OAUG;IACH,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC5B;;;;;OAKG;IACH,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;IACxE;;;;;OAKG;IACH,iBAAiB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACrF;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC5B,kCAAkC;IAClC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3E;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B;;;;;;;OAOG;IACH,WAAW,EAAE,CACZ,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EACnB,OAAO,CAAC,EAAE,iBAAiB,KACvB,OAAO,CAAC,aAAa,CAAC,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACzB,yDAAyD;IACzD,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB,6BAA6B;IAC7B,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC5B,6BAA6B;IAC7B,YAAY,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,6CAA6C;IAC7C,UAAU,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC3D;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,oCAAoC;IACpC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,KAAK,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAChB,SACC,OAAO,EACP,UAAU,EACV,gBAAgB,EAChB,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,SAAS,EACT,YAAY,EACZ,WAAW,EACX,OAAO;IACR,qCAAqC;IACrC,OAAO,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACrC,qCAAqC;IACrC,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,qFAAqF;IACrF,mBAAmB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3E"}

package/dist/runtime/secure_file.d.ts

@@ -4,18 +4,20 @@
  *
  * The file this guards is typically the highest-value credential on the host
  * (the bootstrap token mints the keeper account), so the read fails loud
- * rather than degrading: a symlink, a group/other-accessible mode, or an
- * oversized file is refused, never returned. The deploy recipe places the
- * token at `0600`, so the check ratifies the shape zap produces; a
- * hand-placed `0644` file fails at boot instead of being read.
+ * rather than degrading: a symlink, a non-regular file (FIFO, device node,
+ * directory), a group/other-accessible mode, or an oversized file is refused,
+ * never returned. The deploy recipe places the token at `0600`, so the check
+ * ratifies the shape zap produces; a hand-placed `0644` file fails at boot
+ * instead of being read.
  *
  * The Node implementation lives here (`load_secure_file_node`, wired as
  * `create_node_runtime().read_secure_file`); the Deno runtime implements the
  * same contract over `Deno.open` in `runtime/deno.ts`, and the mock honors
- * the mode/size checks over its in-memory map. All three refuse through the
- * shared `assert_secure_mode` / `assert_secure_size` / `read_secure_bounded`
- * helpers so the checks — and their operator-facing messages — can't drift
- * between runtimes.
+ * the mode/size checks over its in-memory map (it has no file types). The real
+ * runtimes refuse through the shared `assert_secure_regular_file` /
+ * `assert_secure_mode` / `assert_secure_size` / `read_secure_bounded` helpers,
+ * and the mock through the mode and size ones, so the checks — and their
+ * operator-facing messages — can't drift between runtimes.
  *
  * @module
  */
@@ -25,6 +27,13 @@
  * `MAX_SECURE_FILE_SIZE`.
  */
 export declare const MAX_SECURE_FILE_SIZE = 4096;
+/**
+ * Refuse anything but a regular file — a FIFO, device node, socket, or
+ * directory at the secret's path.
+ *
+ * @throws Error naming the path
+ */
+export declare const assert_secure_regular_file: (path: string, is_file: boolean) => void;
 /**
  * Refuse any group/other-accessible mode (only `0600`/`0400` pass).
  *
@@ -57,6 +66,11 @@ export declare const read_secure_bounded: (path: string, read_chunk: (target: Ui
  * Read a secret file with fail-loud checks (Node implementation).
  *
  * - `O_NOFOLLOW` atomically rejects symlinks during open (no TOCTOU window)
+ * - `O_NONBLOCK` keeps the open from waiting on a FIFO that has no writer (it
+ *   has no effect on a regular file); the regular-file check on the open
+ *   descriptor then refuses it, a device node, or a directory
+ * - `O_NOCTTY` keeps a terminal device at the path from becoming the process's
+ *   controlling terminal in the moment before that check refuses it
  * - the permission check runs on the open descriptor, not the path, so the
  *   file can't be swapped between check and read — any group/other access
  *   (not `0600`/`0400`) is refused
@@ -65,7 +79,7 @@ export declare const read_secure_bounded: (path: string, read_chunk: (target: Ui
  *
  * @param path - path to the secret file
  * @returns the file's bytes
- * @throws Error on a missing file, symlink, permissive mode, oversized file, or I/O failure
+ * @throws Error on a missing file, symlink, non-regular file, permissive mode, oversized file, or I/O failure
  */
 export declare const load_secure_file_node: (path: string) => Promise<Uint8Array>;
 //# sourceMappingURL=secure_file.d.ts.map

package/dist/runtime/secure_file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secure_file.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/runtime/secure_file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAMH;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,OAAO,CAAC;AAUzC;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,EAAE,MAAM,MAAM,KAAG,IAM/D,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,EAAE,MAAM,MAAM,KAAG,IAI/D,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,MAAM,EACZ,YAAY,CAAC,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,KACxD,OAAO,CAAC,UAAU,CAUpB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qBAAqB,GAAU,MAAM,MAAM,KAAG,OAAO,CAAC,UAAU,CAuB5E,CAAC"}
+{"version":3,"file":"secure_file.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/runtime/secure_file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAMH;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,OAAO,CAAC;AAUzC;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,GAAI,MAAM,MAAM,EAAE,SAAS,OAAO,KAAG,IAI3E,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,EAAE,MAAM,MAAM,KAAG,IAM/D,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,EAAE,MAAM,MAAM,KAAG,IAI/D,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,MAAM,EACZ,YAAY,CAAC,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,KACxD,OAAO,CAAC,UAAU,CAUpB,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qBAAqB,GAAU,MAAM,MAAM,KAAG,OAAO,CAAC,UAAU,CA2B5E,CAAC"}

package/dist/runtime/secure_file.js

@@ -4,18 +4,20 @@
  *
  * The file this guards is typically the highest-value credential on the host
  * (the bootstrap token mints the keeper account), so the read fails loud
- * rather than degrading: a symlink, a group/other-accessible mode, or an
- * oversized file is refused, never returned. The deploy recipe places the
- * token at `0600`, so the check ratifies the shape zap produces; a
- * hand-placed `0644` file fails at boot instead of being read.
+ * rather than degrading: a symlink, a non-regular file (FIFO, device node,
+ * directory), a group/other-accessible mode, or an oversized file is refused,
+ * never returned. The deploy recipe places the token at `0600`, so the check
+ * ratifies the shape zap produces; a hand-placed `0644` file fails at boot
+ * instead of being read.
  *
  * The Node implementation lives here (`load_secure_file_node`, wired as
  * `create_node_runtime().read_secure_file`); the Deno runtime implements the
  * same contract over `Deno.open` in `runtime/deno.ts`, and the mock honors
- * the mode/size checks over its in-memory map. All three refuse through the
- * shared `assert_secure_mode` / `assert_secure_size` / `read_secure_bounded`
- * helpers so the checks — and their operator-facing messages — can't drift
- * between runtimes.
+ * the mode/size checks over its in-memory map (it has no file types). The real
+ * runtimes refuse through the shared `assert_secure_regular_file` /
+ * `assert_secure_mode` / `assert_secure_size` / `read_secure_bounded` helpers,
+ * and the mock through the mode and size ones, so the checks — and their
+ * operator-facing messages — can't drift between runtimes.
  *
  * @module
  */
@@ -35,6 +37,17 @@ export const MAX_SECURE_FILE_SIZE = 4096;
  * The mock runtime checks unconditionally — its modes are simulated.
  */
 const modes_apply = process.platform !== 'win32';
+/**
+ * Refuse anything but a regular file — a FIFO, device node, socket, or
+ * directory at the secret's path.
+ *
+ * @throws Error naming the path
+ */
+export const assert_secure_regular_file = (path, is_file) => {
+    if (!is_file) {
+        throw new Error(`not a regular file: ${path}`);
+    }
+};
 /**
  * Refuse any group/other-accessible mode (only `0600`/`0400` pass).
  *
@@ -86,6 +99,11 @@ export const read_secure_bounded = async (path, read_chunk) => {
  * Read a secret file with fail-loud checks (Node implementation).
  *
  * - `O_NOFOLLOW` atomically rejects symlinks during open (no TOCTOU window)
+ * - `O_NONBLOCK` keeps the open from waiting on a FIFO that has no writer (it
+ *   has no effect on a regular file); the regular-file check on the open
+ *   descriptor then refuses it, a device node, or a directory
+ * - `O_NOCTTY` keeps a terminal device at the path from becoming the process's
+ *   controlling terminal in the moment before that check refuses it
  * - the permission check runs on the open descriptor, not the path, so the
  *   file can't be swapped between check and read — any group/other access
  *   (not `0600`/`0400`) is refused
@@ -94,12 +112,12 @@ export const read_secure_bounded = async (path, read_chunk) => {
  *
  * @param path - path to the secret file
  * @returns the file's bytes
- * @throws Error on a missing file, symlink, permissive mode, oversized file, or I/O failure
+ * @throws Error on a missing file, symlink, non-regular file, permissive mode, oversized file, or I/O failure
  */
 export const load_secure_file_node = async (path) => {
     let handle;
     try {
-        handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+        handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK | constants.O_NOCTTY);
     }
     catch (err) {
         // ELOOP means the path was a symlink (O_NOFOLLOW refused it).
@@ -110,6 +128,7 @@ export const load_secure_file_node = async (path) => {
     }
     try {
         const s = await handle.stat();
+        assert_secure_regular_file(path, s.isFile());
         if (modes_apply)
             assert_secure_mode(path, s.mode);
         assert_secure_size(path, s.size);

package/dist/server/app_backend.d.ts

@@ -13,6 +13,7 @@
 import { Logger } from '@fuzdev/fuz_util/log.ts';
 import type { AppDeps } from '../auth/deps.js';
 import { type AuditEmitter } from '../auth/audit_emitter.js';
+import { type RealtimeCloser } from '../actions/connection_closer.js';
 import type { DbType, Db } from '../db/db.js';
 import type { Keyring } from '../auth/keyring.js';
 import type { PasswordHashDeps } from '../auth/password.js';
@@ -85,7 +86,7 @@ export interface CreateAppBackendOptions {
     /**
      * Hardened secret-file read for the bootstrap token — pass the runtime's
      * `read_secure_file` (see `FsSecureReadDeps`). Rejects symlinks,
-     * group/other-accessible modes, and oversized files.
+     * non-regular files, group/other-accessible modes, and oversized files.
      */
     read_secure_file: (path: string) => Promise<Uint8Array>;
     /** Delete a file. */
@@ -118,6 +119,15 @@ export interface CreateAppBackendOptions {
      * `audit.add_listener(...)`.
      */
     audit_factory: AuditFactory;
+    /**
+     * The closer to put on `AppDeps.connection_closer`. Omit for a fresh one
+     * — the usual case, since `create_app_server` adds the transports it
+     * mounts. Pass one built up front (`create_realtime_closer()`) when a
+     * transport is constructed before the backend and has to be added to the
+     * same closer the handlers will hold — e.g. an audit stream from
+     * `create_audit_log_sse` whose listener `audit_factory` registers.
+     */
+    connection_closer?: RealtimeCloser;
     /**
      * Additional migration namespaces to run after the builtin auth namespace.
      * The shared `schema_version` table records one row per applied migration
@@ -136,7 +146,8 @@ export interface CreateAppBackendOptions {
  *
  * Calls `create_db` → `run_migrations` (auth namespace, then any
  * `migration_namespaces` from options in order) → `audit_factory({db, log})`
- * and bundles the result with the provided keyring and password deps.
+ * and bundles the result with the provided keyring and password deps and a
+ * `connection_closer` (empty until `create_app_server` adds its transports).
  *
  * @param options - keyring, password deps, `audit_factory`, optional database URL, and optional `migration_namespaces`
  * @returns app backend with deps, database metadata, and combined migration results

package/dist/server/app_backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app_backend.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/app_backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAwB,KAAK,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACnF,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAkB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAIjG;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,oIAAoI;IACpI,QAAQ,CAAC,iBAAiB,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC3D,iEAAiE;IACjE,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE;IAAE,EAAE,EAAE,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,KAAK,YAAY,CAAC;AAE7E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,EAAE,YACF,CAAC;AAEnC;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACvC;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACxD,qBAAqB;IACrB,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,0EAA0E;IAC1E,YAAY,EAAE,MAAM,CAAC;IACrB,wCAAwC;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,iFAAiF;IACjF,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;;;;;;;;OAkBG;IACH,aAAa,EAAE,YAAY,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,oBAAoB,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;CACzD;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,GAAU,SAAS,uBAAuB,KAAG,OAAO,CAAC,UAAU,CAiD7F,CAAC"}
+{"version":3,"file":"app_backend.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/app_backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAwB,KAAK,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACnF,OAAO,EAA0B,KAAK,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAC9F,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAkB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAIjG;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,oIAAoI;IACpI,QAAQ,CAAC,iBAAiB,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC3D,iEAAiE;IACjE,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE;IAAE,EAAE,EAAE,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,KAAK,YAAY,CAAC;AAE7E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,EAAE,YACF,CAAC;AAEnC;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACvC;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACxD,qBAAqB;IACrB,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,0EAA0E;IAC1E,YAAY,EAAE,MAAM,CAAC;IACrB,wCAAwC;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,iFAAiF;IACjF,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;;;;;;;;OAkBG;IACH,aAAa,EAAE,YAAY,CAAC;IAC5B;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,cAAc,CAAC;IACnC;;;;;;;;;;OAUG;IACH,oBAAoB,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;CACzD;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,GAAU,SAAS,uBAAuB,KAAG,OAAO,CAAC,UAAU,CAkD7F,CAAC"}

package/dist/server/app_backend.js

@@ -12,6 +12,7 @@
  */
 import { Logger } from '@fuzdev/fuz_util/log.ts';
 import { create_audit_emitter } from '../auth/audit_emitter.js';
+import { create_realtime_closer } from '../actions/connection_closer.js';
 import { run_migrations } from '../db/migrate.js';
 import { auth_migration_ns, reserved_migration_namespaces } from '../auth/migrations.js';
 import { create_db } from '../db/create_db.js';
@@ -32,7 +33,8 @@ export const default_audit_factory = ({ db, log }) => create_audit_emitter({ db,
  *
  * Calls `create_db` → `run_migrations` (auth namespace, then any
  * `migration_namespaces` from options in order) → `audit_factory({db, log})`
- * and bundles the result with the provided keyring and password deps.
+ * and bundles the result with the provided keyring and password deps and a
+ * `connection_closer` (empty until `create_app_server` adds its transports).
  *
  * @param options - keyring, password deps, `audit_factory`, optional database URL, and optional `migration_namespaces`
  * @returns app backend with deps, database metadata, and combined migration results
@@ -72,7 +74,8 @@ export const create_app_backend = async (options) => {
                 read_secure_file,
                 delete_file,
                 log,
-                audit
+                audit,
+                connection_closer: options.connection_closer ?? create_realtime_closer()
             }
         };
     }