@fuzdev/fuz_app 0.118.0 → 0.119.0

package/dist/realtime/subscriber_registry.js

@@ -17,6 +17,9 @@
  * carries a broader identity for coarse close — the broader identity
  * doesn't cap across sessions.
  *
+ * Registration can run in two phases (`subscribe_pending` then `admit`) so a
+ * revocation reaches a stream that is still opening — see the class doc.
+ *
  * @module
  */
 /**
@@ -27,6 +30,28 @@
  * matching subscribers. `close_by_identity` force-closes all subscribers
  * whose `scope` or `groups` contain the given key — use for auth revocation.
  *
+ * ## Two-phase registration
+ *
+ * A stream is authorized once, at open, so a revocation has to be able to
+ * reach it from the moment its credential is read. A route's gates run before
+ * the stream exists, and each revocation closes only the streams *registered*
+ * under what it revoked — registering after the gates leaves a window in which
+ * a revocation closes nothing and the stream then opens on a dead session, or
+ * under a role its actor no longer holds.
+ *
+ * So a route that authenticated a revocable credential registers in two
+ * phases: `subscribe_pending` registers the subscription **un-admitted** —
+ * closeable by every `close_by_identity`, and otherwise inert: it has no
+ * stream, so no broadcast reaches it, the cap neither counts nor evicts for
+ * it, and `count` does not see it (`pending_count` does). The route then
+ * re-reads the credential and the role, and `admit` attaches the stream and
+ * opens the feed — or refuses when a revocation closed the registration in
+ * between, evicting nothing. The cap's eviction happens at admission.
+ *
+ * `subscribe` stays as the one-step form for a stream with nothing to revoke
+ * behind it. The twin of the Rust `fuz_realtime` `SseRegistry`
+ * (`subscribe_pending` / `admit` / `subscribe`).
+ *
  * @example
  * ```ts
  * const registry = new SubscriberRegistry<SseNotification>();
@@ -56,19 +81,63 @@
  * // fine — close just the stream(s) tied to a specific session
  * registry.close_by_identity(session_hash);
  * ```
+ *
+ * @example
+ * ```ts
+ * // two-phase, for a route behind a revocable credential
+ * const pending = registry.subscribe_pending({scope: session_hash, groups: [account_id]});
+ * if (!(await credential_is_still_live())) {
+ *   pending.unsubscribe();
+ *   return unauthorized();
+ * }
+ * const {response, stream} = create_sse_response(c, log);
+ * if (registry.admit(pending, stream)) stream.on_close(pending.unsubscribe);
+ * else stream.close(); // closed while pending — the body is the connect comment alone
+ * return response;
+ * ```
  */
 export class SubscriberRegistry {
+    // insertion order is registration order — the cap's "oldest"
     #subscribers = new Set();
+    // each pending handle's entry; keyed per registry, so a handle from
+    // another registry names nothing here
+    #pending = new WeakMap();
     #max_per_scope;
     constructor(options) {
         this.#max_per_scope = options?.max_per_scope ?? null;
     }
-    /** Number of active subscribers. */
+    /**
+     * Number of open — **admitted** — subscribers. A registration still pending
+     * admission is counted by `pending_count` instead.
+     */
     get count() {
-        return this.#subscribers.size;
+        let count = 0;
+        for (const subscriber of this.#subscribers) {
+            if (subscriber.stream !== null)
+                count++;
+        }
+        return count;
     }
     /**
-     * Add a subscriber.
+     * Number of registrations awaiting admission — between `subscribe_pending`
+     * and `admit` (or their refusal). For telemetry and tests.
+     */
+    get pending_count() {
+        let count = 0;
+        for (const subscriber of this.#subscribers) {
+            if (subscriber.stream === null)
+                count++;
+        }
+        return count;
+    }
+    /**
+     * Add a subscriber, admitted at once — the one-step form of
+     * `subscribe_pending` + `admit`.
+     *
+     * **Not for a route that authenticated a revocable credential**: a
+     * revocation landing between that route's gates and this call closes
+     * nothing, and the stream would open on a dead credential (class doc,
+     * "Two-phase registration").
      *
      * @param stream - SSE stream to send data to
      * @param options - channel filter and identity slots (`scope` + `groups`)
@@ -76,28 +145,72 @@ export class SubscriberRegistry {
      * @mutates registry - adds the new subscriber; closes oldest matching subscribers when `max_per_scope` is exceeded
      */
     subscribe(stream, options) {
-        const channels = options?.channels && options.channels.length > 0 ? new Set(options.channels) : null;
-        const scope = options?.scope ?? null;
-        const groups = options?.groups && options.groups.length > 0 ? new Set(options.groups) : null;
-        // Per-scope cap — only `scope` is capped, `groups` are never capped.
-        // Insertion order of the backing Set preserves FIFO eviction semantics.
-        if (this.#max_per_scope != null && scope !== null) {
-            this.#enforce_scope_limit(scope, this.#max_per_scope);
-        }
-        const subscriber = { stream, channels, scope, groups };
+        const subscriber = this.#create_entry(options);
+        this.#admit_entry(subscriber, stream);
         this.#subscribers.add(subscriber);
         return () => {
             this.#subscribers.delete(subscriber);
         };
     }
     /**
-     * Broadcast data to all subscribers on a channel.
+     * Register a subscription **un-admitted** — phase one of the two-phase
+     * registration (class doc).
+     *
+     * The registration is closeable at once by every `close_by_identity`
+     * matching its `scope` or `groups`, and until `admit` it receives no
+     * broadcast, is not counted, and evicts nothing. A caller that then refuses
+     * the request calls the returned handle's `unsubscribe`.
+     *
+     * @param options - channel filter and identity slots (`scope` + `groups`)
+     * @returns the pending handle `admit` takes
+     * @mutates registry - adds the un-admitted registration
+     */
+    subscribe_pending(options) {
+        const subscriber = this.#create_entry(options);
+        this.#subscribers.add(subscriber);
+        const pending = {
+            unsubscribe: () => {
+                this.#subscribers.delete(subscriber);
+            }
+        };
+        this.#pending.set(pending, subscriber);
+        return pending;
+    }
+    /**
+     * Admit a pending subscription, attaching the stream it delivers to — phase
+     * two (class doc).
+     *
+     * If the registration is gone — a revocation closed it while it was
+     * pending, or it was unsubscribed — nothing is evicted and the subscription
+     * is refused. Otherwise the per-scope cap is enforced as in `subscribe`,
+     * counting only admitted subscribers, and the stream starts receiving
+     * `broadcast` data. Admitting twice is refused the second time.
+     *
+     * @param pending - the handle `subscribe_pending` returned
+     * @param stream - SSE stream to send data to
+     * @returns `false` when the subscription was not admitted — the caller ends the stream
+     * @mutates registry - attaches `stream`; closes oldest matching subscribers when `max_per_scope` is exceeded
+     */
+    admit(pending, stream) {
+        const subscriber = this.#pending.get(pending);
+        if (!subscriber || subscriber.stream !== null || !this.#subscribers.has(subscriber)) {
+            return false;
+        }
+        this.#admit_entry(subscriber, stream);
+        return true;
+    }
+    /**
+     * Broadcast data to all admitted subscribers on a channel.
      *
      * Subscribers with no channel filter receive all broadcasts.
-     * Subscribers with a channel filter only receive matching broadcasts.
+     * Subscribers with a channel filter only receive matching broadcasts. A
+     * registration pending admission is not an open stream and is skipped —
+     * nothing is queued toward a subscriber not yet authorized.
      */
     broadcast(channel, data) {
         for (const subscriber of this.#subscribers) {
+            if (subscriber.stream === null)
+                continue;
             if (subscriber.channels === null || subscriber.channels.has(channel)) {
                 subscriber.stream.send(data);
             }
@@ -110,9 +223,17 @@ export class SubscriberRegistry {
      * Use for auth revocation — when a user's permissions change, close their
      * SSE connections so they must reconnect and re-authenticate.
      *
+     * Matches every registration, pending or admitted — never filter on
+     * admission here: reaching a registration in flight is the point of the
+     * pending phase, and `admit` then refuses it.
+     *
+     * A stream whose `close` throws does not stop the loop: every match is
+     * removed and closed, and the first error is thrown afterward.
+     *
      * @param identity - the identity key to match (checked against `scope` and `groups`)
      * @returns the number of subscribers closed
      * @mutates registry - removes matching subscribers and closes their streams
+     * @throws the first error a stream's `close` threw, after every match was attempted
      */
     close_by_identity(identity) {
         // collect first, then close — avoids mutating the Set during iteration
@@ -123,28 +244,66 @@ export class SubscriberRegistry {
                 to_close.push(subscriber);
             }
         }
+        let failed = false;
+        let first_error;
         for (const subscriber of to_close) {
-            subscriber.stream.close();
+            // removed first, so a stream whose close throws is unregistered too
             this.#subscribers.delete(subscriber);
+            try {
+                subscriber.stream?.close();
+            }
+            catch (error) {
+                if (!failed) {
+                    failed = true;
+                    first_error = error;
+                }
+            }
         }
+        if (failed)
+            throw first_error;
         return to_close.length;
     }
+    #create_entry(options) {
+        return {
+            stream: null,
+            channels: options?.channels && options.channels.length > 0 ? new Set(options.channels) : null,
+            scope: options?.scope ?? null,
+            groups: options?.groups && options.groups.length > 0 ? new Set(options.groups) : null
+        };
+    }
+    /**
+     * Enforce the per-scope cap for one more admitted subscriber on the entry's
+     * scope, then attach its stream.
+     */
+    #admit_entry(subscriber, stream) {
+        // Per-scope cap — only `scope` is capped, `groups` are never capped. The
+        // entry itself has no stream yet, so the eviction neither counts nor
+        // removes it.
+        if (this.#max_per_scope != null && subscriber.scope !== null) {
+            this.#enforce_scope_limit(subscriber.scope, this.#max_per_scope);
+        }
+        subscriber.stream = stream;
+    }
+    /**
+     * Close `scope`'s oldest **admitted** subscribers until one more fits under
+     * `max`. Pending registrations are neither counted nor closed — a
+     * subscription that may yet be refused must not cost a live one its slot.
+     */
     #enforce_scope_limit(scope, max) {
-        // count existing subscribers with this scope (in insertion order)
+        // admitted subscribers with this scope, in registration order (the
+        // backing Set's insertion order), paired with their streams
         const matching = [];
         for (const subscriber of this.#subscribers) {
-            if (subscriber.scope === scope)
-                matching.push(subscriber);
+            if (subscriber.scope === scope && subscriber.stream !== null) {
+                matching.push([subscriber, subscriber.stream]);
+            }
         }
         // close oldest first, stopping once we've freed up room for one more
-        let overflow = matching.length - (max - 1);
-        let i = 0;
-        while (overflow > 0 && i < matching.length) {
-            const victim = matching[i];
-            victim.stream.close();
+        const overflow = matching.length - (max - 1);
+        for (let i = 0; i < overflow; i++) {
+            const [victim, stream] = matching[i];
+            stream.close();
             this.#subscribers.delete(victim);
-            overflow--;
-            i++;
         }
     }
 }

package/dist/server/app_backend.d.ts

@@ -13,6 +13,7 @@
 import { Logger } from '@fuzdev/fuz_util/log.ts';
 import type { AppDeps } from '../auth/deps.js';
 import { type AuditEmitter } from '../auth/audit_emitter.js';
+import { type RealtimeCloser } from '../actions/connection_closer.js';
 import type { DbType, Db } from '../db/db.js';
 import type { Keyring } from '../auth/keyring.js';
 import type { PasswordHashDeps } from '../auth/password.js';
@@ -118,6 +119,15 @@ export interface CreateAppBackendOptions {
      * `audit.add_listener(...)`.
      */
     audit_factory: AuditFactory;
+    /**
+     * The closer to put on `AppDeps.connection_closer`. Omit for a fresh one
+     * — the usual case, since `create_app_server` adds the transports it
+     * mounts. Pass one built up front (`create_realtime_closer()`) when a
+     * transport is constructed before the backend and has to be added to the
+     * same closer the handlers will hold — e.g. an audit stream from
+     * `create_audit_log_sse` whose listener `audit_factory` registers.
+     */
+    connection_closer?: RealtimeCloser;
     /**
      * Additional migration namespaces to run after the builtin auth namespace.
      * The shared `schema_version` table records one row per applied migration
@@ -136,7 +146,8 @@ export interface CreateAppBackendOptions {
  *
  * Calls `create_db` → `run_migrations` (auth namespace, then any
  * `migration_namespaces` from options in order) → `audit_factory({db, log})`
- * and bundles the result with the provided keyring and password deps.
+ * and bundles the result with the provided keyring and password deps and a
+ * `connection_closer` (empty until `create_app_server` adds its transports).
  *
  * @param options - keyring, password deps, `audit_factory`, optional database URL, and optional `migration_namespaces`
  * @returns app backend with deps, database metadata, and combined migration results

package/dist/server/app_backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app_backend.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/app_backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAwB,KAAK,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACnF,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAkB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAIjG;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,oIAAoI;IACpI,QAAQ,CAAC,iBAAiB,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC3D,iEAAiE;IACjE,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE;IAAE,EAAE,EAAE,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,KAAK,YAAY,CAAC;AAE7E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,EAAE,YACF,CAAC;AAEnC;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACvC;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACxD,qBAAqB;IACrB,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,0EAA0E;IAC1E,YAAY,EAAE,MAAM,CAAC;IACrB,wCAAwC;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,iFAAiF;IACjF,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;;;;;;;;OAkBG;IACH,aAAa,EAAE,YAAY,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,oBAAoB,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;CACzD;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,GAAU,SAAS,uBAAuB,KAAG,OAAO,CAAC,UAAU,CAiD7F,CAAC"}
+{"version":3,"file":"app_backend.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/app_backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAwB,KAAK,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACnF,OAAO,EAA0B,KAAK,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAC9F,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAkB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAIjG;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,oIAAoI;IACpI,QAAQ,CAAC,iBAAiB,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC3D,iEAAiE;IACjE,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE;IAAE,EAAE,EAAE,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,KAAK,YAAY,CAAC;AAE7E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,EAAE,YACF,CAAC;AAEnC;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACvC;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACxD,qBAAqB;IACrB,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,0EAA0E;IAC1E,YAAY,EAAE,MAAM,CAAC;IACrB,wCAAwC;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,iFAAiF;IACjF,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;;;;;;;;OAkBG;IACH,aAAa,EAAE,YAAY,CAAC;IAC5B;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,cAAc,CAAC;IACnC;;;;;;;;;;OAUG;IACH,oBAAoB,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;CACzD;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,GAAU,SAAS,uBAAuB,KAAG,OAAO,CAAC,UAAU,CAkD7F,CAAC"}

package/dist/server/app_backend.js

@@ -12,6 +12,7 @@
  */
 import { Logger } from '@fuzdev/fuz_util/log.ts';
 import { create_audit_emitter } from '../auth/audit_emitter.js';
+import { create_realtime_closer } from '../actions/connection_closer.js';
 import { run_migrations } from '../db/migrate.js';
 import { auth_migration_ns, reserved_migration_namespaces } from '../auth/migrations.js';
 import { create_db } from '../db/create_db.js';
@@ -32,7 +33,8 @@ export const default_audit_factory = ({ db, log }) => create_audit_emitter({ db,
  *
  * Calls `create_db` → `run_migrations` (auth namespace, then any
  * `migration_namespaces` from options in order) → `audit_factory({db, log})`
- * and bundles the result with the provided keyring and password deps.
+ * and bundles the result with the provided keyring and password deps and a
+ * `connection_closer` (empty until `create_app_server` adds its transports).
  *
  * @param options - keyring, password deps, `audit_factory`, optional database URL, and optional `migration_namespaces`
  * @returns app backend with deps, database metadata, and combined migration results
@@ -72,7 +74,8 @@ export const create_app_backend = async (options) => {
                 read_secure_file,
                 delete_file,
                 log,
-                audit
+                audit,
+                connection_closer: options.connection_closer ?? create_realtime_closer()
             }
         };
     }

package/dist/server/app_server.d.ts

@@ -26,7 +26,8 @@ import { type RouteSpec } from '../http/route_spec.js';
 import type { MiddlewareSpec } from '../http/middleware_spec.js';
 import { type BootstrapStatus } from '../auth/bootstrap_routes.js';
 import type { WsEndpointSpec } from '../actions/ws_endpoint_spec.js';
-import { BackendWebsocketTransport } from '../actions/transports_ws_backend.js';
+import type { BackendWebsocketTransport } from '../actions/transports_ws_backend.js';
+import { type AuthCleanupScheduleOptions } from '../auth/cleanup.js';
 /**
  * Context passed to `on_effect_error` when a pending effect rejects.
  */
@@ -185,12 +186,13 @@ export interface AppServerOptions {
      *
      * When truthy, creates an `AuditLogSse` instance internally, registers the SSE
      * listener via `backend.deps.audit.add_listener` (composing with the
-     * consumer's `on_audit_event` callback rather than rebuilding `AppDeps`), and
-     * auto-includes `audit_log_event_specs` in the surface. The result is exposed
-     * on `AppServerContext` (for route factories) and `AppServer` (for the caller),
-     * always typed as `AuditLogSse | null` — when this option is set, the field
-     * is non-null. Use `require_audit_sse(ctx)` to assert the invariant in
-     * route factories that depend on it.
+     * consumer's `on_audit_event` callback rather than rebuilding `AppDeps`),
+     * adds its registry to `backend.deps.connection_closer` so revocations close
+     * its streams, and auto-includes `audit_log_event_specs` in the surface. The
+     * result is exposed on `AppServerContext` (for route factories) and
+     * `AppServer` (for the caller), always typed as `AuditLogSse | null` — when
+     * this option is set, the field is non-null. Use `require_audit_sse(ctx)` to
+     * assert the invariant in route factories that depend on it.
      *
      * Pass `true` for defaults (admin role), or `{role: 'custom'}` for a custom role.
      * Omit to wire audit SSE manually.
@@ -198,6 +200,28 @@ export interface AppServerOptions {
     audit_log_sse?: true | {
         role?: string;
     };
+    /**
+     * Schedule the auth cleanup beside the server: `start_auth_cleanup` over
+     * `backend.deps` — a pass as assembly finishes, then one per interval —
+     * stopped by `AppServer.close`. Each pass deletes expired sessions and
+     * closes the connections they opened through `deps.connection_closer`
+     * (every WebSocket transport and audit stream this server mounts), and
+     * audits each newly expired role_grant offer once.
+     *
+     * **Off by default; a production server should turn it on.** Without it
+     * nothing sweeps: expired session rows accumulate, a WebSocket or audit
+     * stream outlives the expiry of the session it opened on until it
+     * disconnects, and an offer's expiry is never audited. With it, a
+     * connection outlives its session's expiry by at most one interval. The
+     * Rust spine's servers all schedule the twin (`spawn_auth_cleanup`).
+     *
+     * Pass `true` for the default interval
+     * (`DEFAULT_AUTH_CLEANUP_INTERVAL_MS`), or `{interval_ms}` for another.
+     * Leave it off in an in-process test harness — a background pass deletes
+     * rows and writes audit rows mid-test — and in a process that runs
+     * `run_auth_cleanup` on a schedule of its own.
+     */
+    auth_cleanup?: boolean | AuthCleanupScheduleOptions;
     /** SSE event specs for surface generation. Defaults to `[]` (no SSE events). */
     event_specs?: Array<EventSpec>;
     /**
@@ -245,13 +269,17 @@ export interface AppServerOptions {
      * Duplicate `path` values across two `WsEndpointSpec`s throw at
      * mount time (Hono would silently shadow them otherwise).
      *
+     * Every mounted transport is added to `deps.connection_closer`, so
+     * the revocation handlers' post-commit closes reach its sockets —
+     * unconditionally, since those closes are what ends a revoked
+     * credential's connections.
+     *
      * Each spec's `auth_guard?` defaults to `true` — the factory
-     * composes `create_ws_auth_guard` + `create_ws_logout_closer`
-     * against the mounted transport and registers them via
-     * `deps.audit.add_listener`. Wiring is deduped by transport
-     * **reference identity** so two specs sharing one
-     * `BackendWebsocketTransport` instance get a single pair of
-     * listeners; wrapped / proxied transports dedupe as separate
+     * registers `create_ws_auth_guard` against the mounted transport via
+     * `deps.audit.add_listener`, repeating the close on the audit row.
+     * Wiring is deduped by transport **reference identity** so two specs
+     * sharing one `BackendWebsocketTransport` instance get a single
+     * listener; wrapped / proxied transports dedupe as separate
      * entries (set `auth_guard: false` on duplicates and compose
      * against the underlying transport once).
      */
@@ -320,7 +348,12 @@ export interface AppServer {
      * Empty when no `ws_endpoints` were mounted.
      */
     ws_endpoints: Readonly<Record<string, BackendWebsocketTransport>>;
-    /** Close the database connection. Propagated from `AppBackend`. */
+    /**
+     * Shut the server's resources down: stop the auth cleanup schedule when
+     * the `auth_cleanup` option started one — waiting for a pass in progress —
+     * then close the database connection (`AppBackend.close`). That wait has
+     * no bound of its own; a shutdown with a deadline races it.
+     */
     close: () => Promise<void>;
 }
 /**
@@ -354,12 +387,19 @@ export declare const DEFAULT_MAX_BODY_SIZE: number;
  * pass `migration_namespaces` to `create_app_backend`.
  *
  * When `audit_log_sse` is set, the SSE registry's listener is registered via
- * `backend.deps.audit.add_listener` — no shallow-copy of `AppDeps`. The
+ * `backend.deps.audit.add_listener` — no shallow-copy of `AppDeps`. That
+ * registry and every WebSocket transport mounted from `ws_endpoints` are added
+ * to `backend.deps.connection_closer`, so the revocation handlers built from
+ * `ctx.deps` close their connections with no further wiring. The
  * `audit_sse` field on the returned `AppServer` (and the
  * `AppServerContext` passed to `create_route_specs`) is non-null in that
  * case; consumers can call `require_audit_sse(ctx)` / `require_audit_sse(server)`
  * to assert the invariant.
  *
+ * When `auth_cleanup` is set, the auth cleanup schedule starts as the last
+ * step of assembly — so an assembly that throws leaves no schedule running —
+ * and the returned `close` stops it before closing the database.
+ *
  * @returns assembled Hono app, backend, surface build, and bootstrap status
  */
 export declare const create_app_server: (options: AppServerOptions) => Promise<AppServer>;

package/dist/server/app_server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app_server.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/app_server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,IAAI,EAAE,KAAK,OAAO,EAAE,MAAM,MAAM,CAAC;AAG1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAEN,KAAK,cAAc,EAEnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAGN,KAAK,WAAW,EAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAKN,KAAK,WAAW,EAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAGhE,OAAO,oBAAoB,CAAC;AAE5B,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEhF,OAAO,EAEN,KAAK,cAAc,EAEnB,KAAK,eAAe,EACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAIN,KAAK,SAAS,EACd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAGN,KAAK,eAAe,EACpB,MAAM,6BAA6B,CAAC;AASrC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAKrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAClC,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,sBAAsB,GACjC,wBAAwB,GAAG,2BAA2B,GAAG,oBAAoB,CAAC;AAE/E,MAAM,WAAW,wBAAwB;IACxC,IAAI,EAAE,UAAU,CAAC;CACjB;AAED,MAAM,WAAW,2BAA2B;IAC3C,IAAI,EAAE,cAAc,CAAC;IACrB,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,uBAAuB,EAAE,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9E;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAChC,2DAA2D;IAC3D,OAAO,EAAE,UAAU,CAAC;IACpB,6CAA6C;IAC7C,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,sCAAsC;IACtC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAE/B,6BAA6B;IAC7B,KAAK,EAAE;QACN,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,iBAAiB,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,CAAC;KACtD,CAAC;IAEF;;;;;;;;;;;;OAYG;IACH,qBAAqB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3C;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5C;;;;;;OAMG;IACH,yBAAyB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C;;;;;OAKG;IACH,0BAA0B,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAChD;;;;;OAKG;IACH,2BAA2B,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjD;;;;;;;;OAQG;IACH,sBAAsB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5C;;;;;;;;OAQG;IACH,2BAA2B,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjD;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,2DAA2D;IAC3D,kBAAkB,CAAC,EAAE,gBAAgB,CAAC;IAEtC,yEAAyE;IACzE,SAAS,CAAC,EAAE,sBAAsB,CAAC;IAEnC;;;OAGG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC;IAEtB;;;OAGG;IACH,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAEpE,4DAA4D;IAC5D,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK,KAAK,CAAC,cAAc,CAAC,CAAC;IAE/E;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,EAAE,IAAI,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAEzC,gFAAgF;IAChF,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAE/B;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IAEjG;;;;;;;;;;;OAWG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAEpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,YAAY,CAAC,EACZ,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,gBAAgB,KAAK,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC;IAEhG;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IAEzB,mFAAmF;IACnF,qBAAqB,CAAC,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IAE9C,6DAA6D;IAC7D,cAAc,CAAC,EAAE;QAChB,YAAY,EAAE,kBAAkB,CAAC;QACjC,4DAA4D;QAC5D,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,gEAAgE;QAChE,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB;;;;WAIG;QACH,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;KACzC,CAAC;IAEF;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAEhC;;;;OAIG;IACH,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,kBAAkB,KAAK,IAAI,CAAC;IAExE,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,uCAAuC;AACvC,MAAM,WAAW,SAAS;IACzB,GAAG,EAAE,IAAI,CAAC;IACV,wEAAwE;IACxE,YAAY,EAAE,cAAc,CAAC;IAC7B,gBAAgB,EAAE,eAAe,CAAC;IAClC,oGAAoG;IACpG,iBAAiB,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAClD;;;;OAIG;IACH,SAAS,EAAE,WAAW,GAAG,IAAI,CAAC;IAC9B;;;;;;;;;;;OAWG;IACH,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAClE,mEAAmE;IACnE,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,iBAAiB,GAAI,QAAQ;IAAE,SAAS,EAAE,WAAW,GAAG,IAAI,CAAA;CAAE,KAAG,WAO7E,CAAC;AAEF,gDAAgD;AAChD,eAAO,MAAM,qBAAqB,QAAc,CAAC;AAEjD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,iBAAiB,GAAU,SAAS,gBAAgB,KAAG,OAAO,CAAC,SAAS,CAqYpF,CAAC"}
+{"version":3,"file":"app_server.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/app_server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,IAAI,EAAE,KAAK,OAAO,EAAE,MAAM,MAAM,CAAC;AAG1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAEN,KAAK,cAAc,EAEnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAGN,KAAK,WAAW,EAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAKN,KAAK,WAAW,EAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAGhE,OAAO,oBAAoB,CAAC;AAE5B,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEhF,OAAO,EAEN,KAAK,cAAc,EAEnB,KAAK,eAAe,EACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAIN,KAAK,SAAS,EACd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAGN,KAAK,eAAe,EACpB,MAAM,6BAA6B,CAAC;AASrC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EAAsB,KAAK,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAEzF;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAClC,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,sBAAsB,GACjC,wBAAwB,GAAG,2BAA2B,GAAG,oBAAoB,CAAC;AAE/E,MAAM,WAAW,wBAAwB;IACxC,IAAI,EAAE,UAAU,CAAC;CACjB;AAED,MAAM,WAAW,2BAA2B;IAC3C,IAAI,EAAE,cAAc,CAAC;IACrB,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,uBAAuB,EAAE,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9E;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAChC,2DAA2D;IAC3D,OAAO,EAAE,UAAU,CAAC;IACpB,6CAA6C;IAC7C,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,sCAAsC;IACtC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAE/B,6BAA6B;IAC7B,KAAK,EAAE;QACN,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,iBAAiB,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,CAAC;KACtD,CAAC;IAEF;;;;;;;;;;;;OAYG;IACH,qBAAqB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3C;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5C;;;;;;OAMG;IACH,yBAAyB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C;;;;;OAKG;IACH,0BAA0B,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAChD;;;;;OAKG;IACH,2BAA2B,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjD;;;;;;;;OAQG;IACH,sBAAsB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5C;;;;;;;;OAQG;IACH,2BAA2B,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjD;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,2DAA2D;IAC3D,kBAAkB,CAAC,EAAE,gBAAgB,CAAC;IAEtC,yEAAyE;IACzE,SAAS,CAAC,EAAE,sBAAsB,CAAC;IAEnC;;;OAGG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC;IAEtB;;;OAGG;IACH,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAEpE,4DAA4D;IAC5D,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK,KAAK,CAAC,cAAc,CAAC,CAAC;IAE/E;;;;;;;;;;;;;;;OAeG;IACH,aAAa,CAAC,EAAE,IAAI,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAEzC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,YAAY,CAAC,EAAE,OAAO,GAAG,0BAA0B,CAAC;IAEpD,gFAAgF;IAChF,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAE/B;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IAEjG;;;;;;;;;;;OAWG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAEpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,YAAY,CAAC,EACZ,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,gBAAgB,KAAK,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC;IAEhG;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IAEzB,mFAAmF;IACnF,qBAAqB,CAAC,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IAE9C,6DAA6D;IAC7D,cAAc,CAAC,EAAE;QAChB,YAAY,EAAE,kBAAkB,CAAC;QACjC,4DAA4D;QAC5D,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,gEAAgE;QAChE,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB;;;;WAIG;QACH,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;KACzC,CAAC;IAEF;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAEhC;;;;OAIG;IACH,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,kBAAkB,KAAK,IAAI,CAAC;IAExE,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,uCAAuC;AACvC,MAAM,WAAW,SAAS;IACzB,GAAG,EAAE,IAAI,CAAC;IACV,wEAAwE;IACxE,YAAY,EAAE,cAAc,CAAC;IAC7B,gBAAgB,EAAE,eAAe,CAAC;IAClC,oGAAoG;IACpG,iBAAiB,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAClD;;;;OAIG;IACH,SAAS,EAAE,WAAW,GAAG,IAAI,CAAC;IAC9B;;;;;;;;;;;OAWG;IACH,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAClE;;;;;OAKG;IACH,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,iBAAiB,GAAI,QAAQ;IAAE,SAAS,EAAE,WAAW,GAAG,IAAI,CAAA;CAAE,KAAG,WAO7E,CAAC;AAEF,gDAAgD;AAChD,eAAO,MAAM,qBAAqB,QAAc,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,iBAAiB,GAAU,SAAS,gBAAgB,KAAG,OAAO,CAAC,SAAS,CA2ZpF,CAAC"}

package/dist/server/app_server.js

@@ -32,8 +32,8 @@ import { create_fuz_authorization_handler } from '../auth/request_context.js';
 import { ERROR_PAYLOAD_TOO_LARGE } from '../http/error_schemas.js';
 import { create_rpc_endpoint } from '../actions/action_rpc.js';
 import { register_ws_endpoint } from '../actions/register_ws_endpoint.js';
-import { create_ws_auth_guard, create_ws_logout_closer } from '../actions/transports_ws_auth_guard.js';
-import { BackendWebsocketTransport } from '../actions/transports_ws_backend.js';
+import { create_ws_auth_guard } from '../actions/transports_ws_auth_guard.js';
+import { start_auth_cleanup } from '../auth/cleanup.js';
 /**
  * Assert that `audit_sse` was wired by `create_app_server` and return it
  * as a non-null `AuditLogSse`. Throws a labelled error when the
@@ -68,12 +68,19 @@ export const DEFAULT_MAX_BODY_SIZE = 1024 * 1024;
  * pass `migration_namespaces` to `create_app_backend`.
  *
  * When `audit_log_sse` is set, the SSE registry's listener is registered via
- * `backend.deps.audit.add_listener` — no shallow-copy of `AppDeps`. The
+ * `backend.deps.audit.add_listener` — no shallow-copy of `AppDeps`. That
+ * registry and every WebSocket transport mounted from `ws_endpoints` are added
+ * to `backend.deps.connection_closer`, so the revocation handlers built from
+ * `ctx.deps` close their connections with no further wiring. The
  * `audit_sse` field on the returned `AppServer` (and the
  * `AppServerContext` passed to `create_route_specs`) is non-null in that
  * case; consumers can call `require_audit_sse(ctx)` / `require_audit_sse(server)`
  * to assert the invariant.
  *
+ * When `auth_cleanup` is set, the auth cleanup schedule starts as the last
+ * step of assembly — so an assembly that throws leaves no schedule running —
+ * and the returned `close` stops it before closing the database.
+ *
  * @returns assembled Hono app, backend, surface build, and bootstrap status
  */
 export const create_app_server = async (options) => {
@@ -106,11 +113,13 @@ export const create_app_server = async (options) => {
         : options.action_account_rate_limiter;
     // Factory-managed audit SSE — registers a listener on the bound emitter
     // so SSE fan-out runs alongside the consumer's `on_audit_event`
-    // without rebuilding `AppDeps`.
+    // without rebuilding `AppDeps`, and adds the registry to the backend's
+    // closer so revocations close its streams.
     const audit_sse = options.audit_log_sse
         ? create_audit_log_sse({
             log,
-            role: typeof options.audit_log_sse === 'object' ? options.audit_log_sse.role : undefined
+            role: typeof options.audit_log_sse === 'object' ? options.audit_log_sse.role : undefined,
+            connection_closer: deps.connection_closer
         })
         : null;
     if (audit_sse) {
@@ -281,7 +290,10 @@ export const create_app_server = async (options) => {
     // committed transaction). Both queues drain here, after the handler
     // (and any wrapping `db.transaction`) returns. In test mode both are
     // awaited before the response returns; in production, eager-queue
-    // rejections are reported via `on_effect_error`.
+    // rejections are reported via `on_effect_error`. Either way the
+    // deferred thunks are invoked without waiting for the eager writes to
+    // settle — a revocation's connection close must not sit behind a slow
+    // audit INSERT.
     app.use('*', async (c, next) => {
         c.set('pending_effects', []);
         c.set('post_commit_effects', []);
@@ -293,8 +305,11 @@ export const create_app_server = async (options) => {
             const deferred = c.var.post_commit_effects;
             if (eager.length || deferred.length) {
                 if (options.await_pending_effects) {
+                    // run the deferred thunks before awaiting the eager writes,
+                    // so neither mode holds them behind a write
+                    const deferred_flush = flush_post_commit_effects(deferred, log);
                     await flush_pending_effects(eager, log);
-                    await flush_post_commit_effects(deferred, log);
+                    await deferred_flush;
                 }
                 else {
                     const error_ctx = { method: c.req.method, path: c.req.path };
@@ -348,7 +363,7 @@ export const create_app_server = async (options) => {
         }
         const seen_paths = new Set();
         // Dedupe `auth_guard` wiring by transport reference — two specs
-        // sharing one transport instance get a single pair of listeners,
+        // sharing one transport instance get a single listener,
         // otherwise revocation events would fire `close_sockets_for_*`
         // twice per event (idempotent on the transport but log-spammy).
         // Cross-spec OR-semantics: any spec with `auth_guard !== false`
@@ -364,15 +379,17 @@ export const create_app_server = async (options) => {
                 throw new Error(`create_app_server: ws_endpoints path collides with a GET RouteSpec: ${endpoint.path}`);
             }
             seen_paths.add(endpoint.path);
-            const endpoint_transport = endpoint.transport ?? new BackendWebsocketTransport();
-            register_ws_endpoint({
+            const { transport: endpoint_transport } = register_ws_endpoint({
                 app,
                 path: endpoint.path,
                 upgradeWebSocket: options.upgradeWebSocket,
                 allowed_origins: endpoint.allowed_origins,
                 db: deps.db,
                 actions: endpoint.actions,
-                transport: endpoint_transport,
+                transport: endpoint.transport,
+                // every revocation handler's close reaches this transport
+                connection_closer: deps.connection_closer,
+                max_connections_per_account: endpoint.max_connections_per_account,
                 heartbeat: endpoint.heartbeat,
                 artificial_delay: endpoint.artificial_delay,
                 max_message_bytes: endpoint.max_message_bytes,
@@ -387,7 +404,6 @@ export const create_app_server = async (options) => {
             if (endpoint.auth_guard !== false && !guarded_transports.has(endpoint_transport)) {
                 guarded_transports.add(endpoint_transport);
                 deps.audit.add_listener(create_ws_auth_guard(endpoint_transport, log));
-                deps.audit.add_listener(create_ws_logout_closer(endpoint_transport, log));
             }
             if (endpoint.extra_audit_handlers?.length) {
                 for (const handler of endpoint.extra_audit_handlers) {
@@ -407,6 +423,12 @@ export const create_app_server = async (options) => {
             app.use('/*', mw);
         }
     }
+    // Auth cleanup — opt-in, and last: nothing after it can throw, so a failed
+    // assembly never leaves a schedule running. Its closes go through
+    // `deps.connection_closer`, which the mounts above have filled.
+    const auth_cleanup = options.auth_cleanup
+        ? start_auth_cleanup(deps, options.auth_cleanup === true ? undefined : options.auth_cleanup)
+        : null;
     return {
         app,
         surface_spec,
@@ -414,6 +436,12 @@ export const create_app_server = async (options) => {
         migration_results: backend.migration_results,
         audit_sse,
         ws_endpoints: mounted_ws_endpoints,
-        close: backend.close
+        close: auth_cleanup
+            ? async () => {
+                // the schedule first, so a pass in progress finishes on a live pool
+                await auth_cleanup.stop();
+                await backend.close();
+            }
+            : backend.close
     };
 };