@glyphteck/veyl 0.66.2 → 0.67.0

package/dist/cli.js

@@ -7922,7 +7922,7 @@ function closeSessionResources({ wallet, chatPK, chatPrivateKey, chatSigningSecr
   close(vaultAccess);
   close(vaultSigner);
   close(localCache);
-  pending.push(lockWallet(wallet));
+  lockWallet(wallet);
   lockChat(chatPrivateKey, chatPK);
   cleanBytes(chatSigningSecret, notificationPrivateKey, notificationPublicKey);
   return Promise.allSettled(pending).then(() => {
@@ -8551,12 +8551,16 @@ function settingsState(settings = defaultSettings) {
     }
   };
 }
+function isAccountAuthenticationError(error) {
+  const code = typeof error?.code === "string" ? error.code.toLowerCase() : "";
+  return code === "permission-denied" || code.endsWith("/permission-denied") || code === "unauthenticated" || code.endsWith("/unauthenticated");
+}
 function createUser({ cloud, network, avatarCache = null, diag = null, onSessionRevoked = null }) {
   if (!cloud) {
     throw new Error("createUser requires { cloud }");
   }
-  if (avatarCache && [avatarCache.read, avatarCache.write, avatarCache.remove, avatarCache.removeAll].some((method) => typeof method !== "function")) {
-    throw new Error("avatarCache requires read, write, remove, and removeAll");
+  if (avatarCache && [avatarCache.read, avatarCache.write, avatarCache.remove].some((method) => typeof method !== "function")) {
+    throw new Error("avatarCache requires read, write, and remove");
   }
   let activeNetwork = network;
   let state = defaultUser;
@@ -8694,9 +8698,6 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
       return;
     runCacheTask("user.avatar.cache.remove", () => avatarCache.remove(uid));
   }
-  function clearCachedAvatars() {
-    runCacheTask("user.avatar.cache.clear", () => avatarCache.removeAll());
-  }
   async function fetchAvatar(uid, { version = null, force = false, clear = false, persist = true } = {}) {
     if (!uid)
       return;
@@ -8779,6 +8780,54 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
   function isCurrentUser(uid, session) {
     return started && authSession === session && userUid === uid;
   }
+  function revokeAuthentication(authUser, {
+    code = "",
+    local = false,
+    reason = "session-inactive"
+  } = {}) {
+    if (revokingSession)
+      return;
+    revokingSession = true;
+    let callback;
+    try {
+      callback = onSessionRevoked?.({
+        uid: authUser.uid,
+        code,
+        reason
+      });
+    } catch (error) {
+      callback = Promise.reject(error);
+    }
+    markDiag(diag, "user.auth.revoked", {
+      code,
+      local,
+      reason
+    });
+    setState((user) => ({
+      ...user,
+      authSessionReady: true,
+      authSessionActive: false,
+      authCredential: null
+    }));
+    let operation = Promise.resolve(callback).catch((error) => markError(diag, "user.session.revoke.local", Date.now(), error));
+    if (!local) {
+      operation = operation.then(() => cloud.auth.logout()).catch((error) => markError(diag, "user.session.revoke.auth", Date.now(), error));
+    }
+    operation.finally(() => {
+      if (userUid === authUser.uid) {
+        revokingSession = false;
+      }
+    });
+  }
+  function revokeAuthenticationError(authUser, error, reason) {
+    if (!isAccountAuthenticationError(error))
+      return false;
+    revokeAuthentication(authUser, {
+      code: error?.code || "",
+      reason
+    });
+    return true;
+  }
   function watchUser(authUser) {
     if (!started)
       return;
@@ -8788,7 +8837,6 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
     closeUserWatches();
     markDiag(diag, "user.auth.state", { signedIn: !!authUser });
     if (!authUser) {
-      const signedOutUid = userUid;
       revokingSession = false;
       userUid = null;
       clearSettingsKey(settingsKey);
@@ -8797,17 +8845,11 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
       agreementStored = null;
       agreementOverride = null;
       agreementAcceptance = null;
-      if (signedOutUid) {
-        clearCachedAvatars();
-      }
       avatarFetch = { uid: null, key: null, promise: null };
       setState({ ...defaultUser, authReady: true });
       return;
     }
     const authUidChanged = userUid !== authUser.uid;
-    if (userUid && authUidChanged) {
-      clearCachedAvatars();
-    }
     userUid = authUser.uid;
     if (authUidChanged) {
       clearSettingsKey(settingsKey);
@@ -8837,32 +8879,28 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
     userWatches.push(cloud.auth.session.watch(authUser.uid, current((authSessionState) => {
       if (authSessionState?.active) {
         const authCredential = authSessionState.authCredential;
-        setState((user) => user.authCredential?.kind === authCredential?.kind && user.authCredential?.id === authCredential?.id ? user : { ...user, authCredential });
-        return;
-      }
-      if (revokingSession)
-        return;
-      revokingSession = true;
-      if (cloud.auth.session.isLocalTermination?.(authUser.uid, authSessionState?.generation)) {
-        Promise.resolve(onSessionRevoked?.({ uid: authUser.uid })).catch((error) => markError(diag, "user.session.revoke.local", Date.now(), error)).finally(() => {
-          if (userUid === authUser.uid) {
-            revokingSession = false;
-          }
+        setState((user) => user.authSessionReady && user.authSessionActive && user.authCredential?.kind === authCredential?.kind && user.authCredential?.id === authCredential?.id ? user : {
+          ...user,
+          authSessionReady: true,
+          authSessionActive: true,
+          authCredential
         });
         return;
       }
-      Promise.resolve(onSessionRevoked?.({ uid: authUser.uid })).catch((error) => markError(diag, "user.session.revoke.local", Date.now(), error)).then(() => cloud.auth.logout()).catch((error) => markError(diag, "user.session.revoke.auth", Date.now(), error)).finally(() => {
-        if (userUid === authUser.uid) {
-          revokingSession = false;
-        }
+      revokeAuthentication(authUser, {
+        local: cloud.auth.session.isLocalTermination?.(authUser.uid, authSessionState?.generation) === true,
+        reason: "session-inactive"
       });
     }), current((error) => {
       markError(diag, "user.session.listen", authStartedAt, error);
+      revokeAuthenticationError(authUser, error, "session-listener");
     })));
     userWatches.push(cloud.user.admin.watch(authUser.uid, current((allowed) => {
       setState((user) => ({ ...user, isAdmin: allowed, adminReady: true }));
     }), current((error) => {
       markError(diag, "user.admin.listen", authStartedAt, error);
+      if (revokeAuthenticationError(authUser, error, "admin-listener"))
+        return;
       setState((user) => ({ ...user, isAdmin: false, adminReady: true }));
     })));
     userWatches.push(cloud.user.private.watch(authUser.uid, current((privateData, info = {}) => {
@@ -8886,6 +8924,8 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
       }));
     }), current((error) => {
       markError(diag, "user.settings.snapshot", authStartedAt, error);
+      if (revokeAuthenticationError(authUser, error, "settings-listener"))
+        return;
       settingsStored = null;
       agreementStored = null;
       setState((user) => ({
@@ -8898,6 +8938,8 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
       setState((user) => ({ ...user, banned: banned ?? null }));
     }), current((error) => {
       markError(diag, "user.moderation.listen", authStartedAt, error);
+      if (revokeAuthenticationError(authUser, error, "moderation-listener"))
+        return;
       setState((user) => ({ ...user, banned: null }));
     })));
     userWatches.push(cloud.user.blocked.watch(authUser.uid, current((blocked, info = {}) => {
@@ -8910,6 +8952,8 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
       });
     }), current((error) => {
       markError(diag, "user.blocked.listen", authStartedAt, error);
+      if (revokeAuthenticationError(authUser, error, "blocked-listener"))
+        return;
       setState((user) => ({ ...user, blockedReady: false }));
     })));
     userWatches.push(cloud.user.profile.watch(authUser.uid, current((profileData, info = {}) => {
@@ -8956,6 +9000,8 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
       }
     }), current((error) => {
       markError(diag, "user.profile.snapshot", authStartedAt, error);
+      if (revokeAuthenticationError(authUser, error, "profile-listener"))
+        return;
       avatarFetch = { uid: null, key: null, promise: null };
       setState((user) => ({
         ...user,
@@ -9186,6 +9232,8 @@ var init_user = __esm(() => {
   defaultUser = {
     uid: null,
     authReady: false,
+    authSessionReady: false,
+    authSessionActive: false,
     authCredential: null,
     profileReady: false,
     username: null,
@@ -45674,20 +45722,36 @@ function openAccount(options = {}) {
   let closePromise = null;
   let state;
   let chatSession = null;
+  let revokedUid = null;
+  let revocationPromise = null;
   let nextAgreement = agreementContract(options.agreement || CURRENT_AGREEMENT);
   const listeners = new Set;
   let activeWriteTail = Promise.resolve();
   const sessionCloseWork = new Set;
   const operationBarrier = createAccountOperationCloseBarrier();
+  function revokeSession(details = {}) {
+    const { uid = null } = details;
+    const accountUid = uid || state?.uid || null;
+    if (accountUid && revokedUid === accountUid) {
+      return revocationPromise || Promise.resolve();
+    }
+    revokedUid = accountUid;
+    let callback;
+    try {
+      callback = options.onSessionRevoked?.({ ...details, uid: accountUid });
+    } catch (error) {
+      callback = Promise.reject(error);
+    }
+    lock();
+    revocationPromise = Promise.resolve(callback);
+    return revocationPromise;
+  }
   const user = options.user || createUser({
     cloud,
     network: options.network || defaultNetwork,
     avatarCache,
     diag,
-    onSessionRevoked: ({ uid } = {}) => {
-      lock();
-      options.onSessionRevoked?.({ uid: uid || state?.uid || null });
-    }
+    onSessionRevoked: revokeSession
   });
   state = emptyState(user.getSnapshot(), options.network || defaultNetwork);
   const chat = createChatSession({
@@ -45936,6 +46000,24 @@ function openAccount(options = {}) {
         code: error?.code || "",
         message: error?.message || String(error)
       });
+      if (isAccountAuthenticationError(error)) {
+        revokeSession({
+          uid,
+          code: error?.code || "",
+          reason: "vault-listener"
+        }).catch((revocationError) => {
+          diag?.("account.session.revoke.error", {
+            code: revocationError?.code || "",
+            message: revocationError?.message || String(revocationError)
+          });
+        }).then(() => cloud.auth.logout()).catch((logoutError) => {
+          diag?.("account.session.revoke.auth.error", {
+            code: logoutError?.code || "",
+            message: logoutError?.message || String(logoutError)
+          });
+        });
+        return;
+      }
       lock();
       emit2({ vault: null, vaultReady: true, vaultError: error });
     });
@@ -46400,8 +46482,8 @@ function normalizePasskeyLoginError(error, options = {}) {
   return error;
 }
 function normalizePasskeyRegisterError(error, options = {}) {
-  if (error?.name === "InvalidStateError" || error?.code === "functions/already-exists") {
-    return passkeyError(PASSKEY_PROVIDER_ALREADY_LINKED, "this provider already has a passkey for this account. choose another provider, device, or security key", error);
+  if (error?.name === "CredentialAlreadyExistsException" || error?.name === "InvalidStateError" || error?.code === "functions/already-exists") {
+    return passkeyError(PASSKEY_PROVIDER_ALREADY_LINKED, "you already have a passkey for this account", error);
   }
   if (error?.code === "functions/failed-precondition") {
     return passkeyError(PASSKEY_RP_MISMATCH, "This passkey belongs to a different Glyphteck passkey setup.", error);
@@ -56424,7 +56506,7 @@ var package_default;
 var init_package2 = __esm(() => {
   package_default = {
     name: "veyl",
-    version: "0.66.2",
+    version: "0.67.0",
     packageManager: "bun@1.4.0",
     private: true,
     license: "UNLICENSED",
@@ -57536,7 +57618,7 @@ var init_client = __esm(() => {
   ]);
 });
 
-// ../../node_modules/.bun/@buildonspark+spark-sdk@0.9.0+4b9ddefa68fc59f4/node_modules/@buildonspark/spark-sdk/dist/chunk-BCcL9Bmk.js
+// ../../node_modules/.bun/@buildonspark+spark-sdk@0.9.0+8e98cae01074b602/node_modules/@buildonspark/spark-sdk/dist/chunk-BCcL9Bmk.js
 var init_chunk_BCcL9Bmk = () => {};
 
 // ../../node_modules/.bun/@bufbuild+protobuf@2.14.0/node_modules/@bufbuild/protobuf/dist/esm/wire/varint.js
@@ -58308,7 +58390,7 @@ var init_wire2 = __esm(() => {
   init_size_delimited();
 });
 
-// ../../node_modules/.bun/@buildonspark+spark-sdk@0.9.0+4b9ddefa68fc59f4/node_modules/@buildonspark/spark-sdk/dist/empty-mxtQJySK.js
+// ../../node_modules/.bun/@buildonspark+spark-sdk@0.9.0+8e98cae01074b602/node_modules/@buildonspark/spark-sdk/dist/empty-mxtQJySK.js
 function createBaseTimestamp() {
   return {
     seconds: 0,
@@ -58653,7 +58735,7 @@ var init_empty_mxtQJySK = __esm(() => {
   };
 });
 
-// ../../node_modules/.bun/@buildonspark+spark-sdk@0.9.0+4b9ddefa68fc59f4/node_modules/@buildonspark/spark-sdk/dist/proto/spark.js
+// ../../node_modules/.bun/@buildonspark+spark-sdk@0.9.0+8e98cae01074b602/node_modules/@buildonspark/spark-sdk/dist/proto/spark.js
 function networkFromJSON(object) {
   switch (object) {
     case 0:
@@ -95034,7 +95116,7 @@ var init_dist3 = __esm(() => {
   };
 });
 
-// ../../node_modules/.bun/@buildonspark+spark-sdk@0.9.0+4b9ddefa68fc59f4/node_modules/@buildonspark/spark-sdk/dist/sdk-types-CKSuGSGE.js
+// ../../node_modules/.bun/@buildonspark+spark-sdk@0.9.0+8e98cae01074b602/node_modules/@buildonspark/spark-sdk/dist/sdk-types-CKSuGSGE.js
 function getAllProperties2(object) {
   const properties = /* @__PURE__ */ new Set;
   let current = object;
@@ -95878,7 +95960,7 @@ var init_sdk_types_CKSuGSGE = __esm(() => {
   }({});
 });
 
-// ../../node_modules/.bun/@buildonspark+spark-sdk@0.9.0+4b9ddefa68fc59f4/node_modules/@buildonspark/spark-sdk/dist/multisig-BPUmc7A3.js
+// ../../node_modules/.bun/@buildonspark+spark-sdk@0.9.0+8e98cae01074b602/node_modules/@buildonspark/spark-sdk/dist/multisig-BPUmc7A3.js
 function createBaseMultisigConfig() {
   return {
     version: 0,
@@ -96107,7 +96189,7 @@ var init_multisig_BPUmc7A3 = __esm(() => {
   };
 });
 
-// ../../node_modules/.bun/@buildonspark+spark-sdk@0.9.0+4b9ddefa68fc59f4/node_modules/@buildonspark/spark-sdk/dist/proto/spark_token.js
+// ../../node_modules/.bun/@buildonspark+spark-sdk@0.9.0+8e98cae01074b602/node_modules/@buildonspark/spark-sdk/dist/proto/spark_token.js
 function tokenOutputStatusFromJSON(object) {
   switch (object) {
     case 0:
@@ -109410,7 +109492,7 @@ var require_bolt11 = __commonJS(function(exports, module) {
   };
 });
 
-// ../../node_modules/.bun/@buildonspark+spark-sdk@0.9.0+4b9ddefa68fc59f4/node_modules/@buildonspark/spark-sdk/dist/spark-wallet-CwB3Fuv1.js
+// ../../node_modules/.bun/@buildonspark+spark-sdk@0.9.0+8e98cae01074b602/node_modules/@buildonspark/spark-sdk/dist/spark-wallet-CwB3Fuv1.js
 function parseSignature(signature) {
   if (signature.length !== 64)
     throw new Error(`Invalid signature length: expected 64, got ${signature.length}`);
@@ -153313,7 +153395,7 @@ var require_lib5 = __commonJS(function(exports) {
   exports.retryMiddleware = retryMiddleware;
 });
 
-// ../../node_modules/.bun/@buildonspark+spark-sdk@0.9.0+4b9ddefa68fc59f4/node_modules/@buildonspark/spark-sdk/dist/spark-wallet.node-bD67u0Y4.js
+// ../../node_modules/.bun/@buildonspark+spark-sdk@0.9.0+8e98cae01074b602/node_modules/@buildonspark/spark-sdk/dist/spark-wallet.node-bD67u0Y4.js
 import { createHash } from "crypto";
 import { createWriteStream, mkdirSync } from "node:fs";
 import { dirname } from "node:path";
@@ -155912,7 +155994,7 @@ var init_spark_wallet_node_bD67u0Y4 = __esm(() => {
   };
 });
 
-// ../../node_modules/.bun/@buildonspark+spark-sdk@0.9.0+4b9ddefa68fc59f4/node_modules/@buildonspark/spark-sdk/dist/index.node.js
+// ../../node_modules/.bun/@buildonspark+spark-sdk@0.9.0+8e98cae01074b602/node_modules/@buildonspark/spark-sdk/dist/index.node.js
 import nodeCrypto from "crypto";
 var cryptoImpl2;
 var init_index_node = __esm(() => {
@@ -158469,7 +158551,7 @@ var init_index_esm3 = __esm(() => {
   registerCoreComponents("");
 });
 
-// ../../node_modules/.bun/firebase@12.18.0+d12ebd0fb199560c/node_modules/firebase/app/dist/index.mjs
+// ../../node_modules/.bun/firebase@12.18.0+40ac9e013e4b1dea/node_modules/firebase/app/dist/index.mjs
 var name3 = "firebase", version2 = "12.18.0";
 var init_dist4 = __esm(() => {
   init_index_esm3();
@@ -158477,7 +158559,7 @@ var init_dist4 = __esm(() => {
   registerVersion(name3, version2, "app");
 });
 
-// ../../node_modules/.bun/@firebase+auth@1.13.5+452031b0f0005c63/node_modules/@firebase/auth/dist/node-esm/totp-C24pd8aS.js
+// ../../node_modules/.bun/@firebase+auth@1.13.5+a89daa0b3e4af1f5/node_modules/@firebase/auth/dist/node-esm/totp-C24pd8aS.js
 function _debugErrorMap() {
   return {
     ["admin-restricted-operation"]: "This operation is restricted to administrators only.",
@@ -162451,7 +162533,7 @@ var init_totp_C24pd8aS = __esm(() => {
   };
 });
 
-// ../../node_modules/.bun/@firebase+auth@1.13.5+452031b0f0005c63/node_modules/@firebase/auth/dist/node-esm/index.js
+// ../../node_modules/.bun/@firebase+auth@1.13.5+a89daa0b3e4af1f5/node_modules/@firebase/auth/dist/node-esm/index.js
 var init_node_esm = __esm(() => {
   init_totp_C24pd8aS();
   init_index_esm3();
@@ -162460,7 +162542,7 @@ var init_node_esm = __esm(() => {
   init_index_esm2();
 });
 
-// ../../node_modules/.bun/firebase@12.18.0+d12ebd0fb199560c/node_modules/firebase/auth/dist/index.mjs
+// ../../node_modules/.bun/firebase@12.18.0+40ac9e013e4b1dea/node_modules/firebase/auth/dist/index.mjs
 var exports_dist = {};
 __export(exports_dist, {
   ActionCodeOperation: () => ActionCodeOperation,
@@ -197105,7 +197187,7 @@ var init_index_node2 = __esm(() => {
   registerFirestore("node");
 });
 
-// ../../node_modules/.bun/firebase@12.18.0+d12ebd0fb199560c/node_modules/firebase/firestore/dist/index.mjs
+// ../../node_modules/.bun/firebase@12.18.0+40ac9e013e4b1dea/node_modules/firebase/firestore/dist/index.mjs
 var exports_dist2 = {};
 __export(exports_dist2, {
   AbstractUserDataWriter: () => AbstractUserDataWriter,
@@ -197808,7 +197890,7 @@ var init_index_esm4 = __esm(() => {
   registerFunctions();
 });
 
-// ../../node_modules/.bun/firebase@12.18.0+d12ebd0fb199560c/node_modules/firebase/functions/dist/index.mjs
+// ../../node_modules/.bun/firebase@12.18.0+40ac9e013e4b1dea/node_modules/firebase/functions/dist/index.mjs
 var exports_dist3 = {};
 __export(exports_dist3, {
   FunctionsError: () => FunctionsError,
@@ -201665,18 +201747,25 @@ class Fleet {
     const client2 = this.client(profile);
     return operation(client2, publicAccount(record));
   }
+  failRecord(record, error) {
+    const message = error?.message || String(error);
+    record.error ||= message;
+    record.status = "error";
+    record.controller.abort(error);
+    if (record.failureEmitted)
+      return;
+    record.failureEmitted = true;
+    this.emit("account-error", {
+      account: publicAccount(record),
+      error: record.error
+    });
+  }
   queuePolicies(record, event2) {
     record.pendingEvents += 1;
     if (record.pendingEvents > this.maxPendingEvents) {
       record.pendingEvents -= 1;
       const error = new Error(`fleet event backlog exceeded for ${record.profile.profile}`);
-      record.error = error.message;
-      record.status = "error";
-      record.controller.abort(error);
-      this.emit("account-error", {
-        account: publicAccount(record),
-        error: error.message
-      });
+      this.failRecord(record, error);
       return;
     }
     if (this.policyReloading) {
@@ -201725,69 +201814,64 @@ class Fleet {
       unsubscribeRevoked: () => {},
       startedPolicies: [],
       reloadEvents: [],
-      closed: false
+      closed: false,
+      failureEmitted: false
     };
     this.records.set(profile.profile, record);
     this.emit("account-starting", { account: publicAccount(record) });
-    const baseOptions = typeof this.clientOptions === "function" ? await this.clientOptions(profile) : this.clientOptions;
-    record.client = await this.openClient({
-      ...baseOptions || {},
-      profile: profile.profile,
-      ...profile.network ? { network: profile.network } : {}
-    }, profile);
-    await record.client.ensureUnlocked();
-    for (const policy of this.policies) {
-      record.startedPolicies.push(policy);
-      await policy.start?.({
-        account: profile,
-        client: record.client,
-        fleet: this
-      });
-    }
-    let readyResolve;
-    let readyReject;
-    const ready2 = new Promise((resolve2, reject) => {
-      readyResolve = resolve2;
-      readyReject = reject;
-    });
-    record.unsubscribeRevoked = record.client.subscribeSessionRevoked?.(() => {
-      const error = new Error("account session revoked");
-      record.error = error.message;
-      record.status = "error";
-      controller.abort(error);
-      readyReject(error);
-      this.emit("account-error", {
-        account: publicAccount(record),
-        error: error.message
-      });
-    }) || (() => {});
-    const accountEventOptions = typeof this.eventOptions === "function" ? await this.eventOptions(profile) : this.eventOptions;
-    record.listenTask = record.client.listen({
-      ...accountEventOptions || {},
-      signal: controller.signal,
-      onEvent: (event2) => {
-        if (event2?.type === "ready")
-          readyResolve();
-        this.emit("account-event", {
-          account: publicAccount(record),
-          event: event2
+    try {
+      const baseOptions = typeof this.clientOptions === "function" ? await this.clientOptions(profile) : this.clientOptions;
+      record.client = await this.openClient({
+        ...baseOptions || {},
+        profile: profile.profile,
+        ...profile.network ? { network: profile.network } : {}
+      }, profile);
+      await record.client.ensureUnlocked();
+      for (const policy of this.policies) {
+        record.startedPolicies.push(policy);
+        await policy.start?.({
+          account: profile,
+          client: record.client,
+          fleet: this
         });
-        this.queuePolicies(record, event2);
       }
-    }).catch((error) => {
-      if (controller.signal.aborted)
-        return;
-      record.error = error?.message || String(error);
-      record.status = "error";
-      readyReject(error);
-      this.emit("account-error", {
-        account: publicAccount(record),
-        error: record.error
+      let readyResolve;
+      let readyReject;
+      const ready2 = new Promise((resolve2, reject) => {
+        readyResolve = resolve2;
+        readyReject = reject;
+      });
+      record.unsubscribeRevoked = record.client.subscribeSessionRevoked?.(() => {
+        const error = new Error("account session revoked");
+        this.failRecord(record, error);
+        readyReject(error);
+      }) || (() => {});
+      const accountEventOptions = typeof this.eventOptions === "function" ? await this.eventOptions(profile) : this.eventOptions;
+      record.listenTask = record.client.listen({
+        ...accountEventOptions || {},
+        signal: controller.signal,
+        onEvent: (event2) => {
+          if (event2?.type === "ready")
+            readyResolve();
+          this.emit("account-event", {
+            account: publicAccount(record),
+            event: event2
+          });
+          this.queuePolicies(record, event2);
+        }
+      }).catch((error) => {
+        if (controller.signal.aborted)
+          return;
+        this.failRecord(record, error);
+        readyReject(error);
       });
-    });
-    await waitFor3(ready2, this.startTimeoutMs, `fleet profile start timed out: ${profile.profile}`);
-    record.status = "ready";
-    this.emit("account-ready", { account: publicAccount(record) });
+      await waitFor3(ready2, this.startTimeoutMs, `fleet profile start timed out: ${profile.profile}`);
+      record.status = "ready";
+      this.emit("account-ready", { account: publicAccount(record) });
+    } catch (error) {
+      this.failRecord(record, error);
+      throw error;
+    }
   }
   async stopRecordPolicies(record) {
     const errors = [];
@@ -201999,10 +202083,13 @@ class Fleet {
       }
     };
     record.controller.abort();
-    await attempt(() => record.listenTask);
-    errors.push(...await this.stopRecordPolicies(record));
     await attempt(() => record.unsubscribeRevoked());
-    await attempt(() => record.client?.close());
+    errors.push(...await this.stopRecordPolicies(record));
+    const closeTask = Promise.resolve().then(() => record.client?.close());
+    await Promise.all([
+      attempt(() => record.listenTask),
+      attempt(() => closeTask)
+    ]);
     record.closed = true;
     record.status = errors.length || record.error ? "error" : "stopped";
     if (errors.length) {