Current behavior

Encrypter.getInternalClient copies listeners onto the internal key-vault client, then listens for newListener and forwards every later subscription. There is no removeListener forwarder, and close() does not remove the newListener hook. After the application client removes a commandStarted listener, the same function still runs for key-vault commands and remains reachable from the internal client. The forwarder itself stays on the application client after Encrypter.close().

Expected behavior

Removing a listener from the application client removes that function from the internal client. After encrypter.close(), new subscriptions on the application client are not copied, and the internal client no longer holds the forwarding function.

Scope

src/encrypter.ts. Present on main for a client that creates the internal key-vault client (auto-encryption without an explicit keyVaultClient, and with maxPoolSize not 0). No specific server version.

Pull request

PR 5104