@fuzdev/fuz_app 0.117.1 → 0.119.0

package/dist/testing/cross_backend/role_grant_offer_notification_ws.js

@@ -38,7 +38,7 @@ import '../assert_dev_env.js';
  * guard), and accept stays idempotent on the role_grant while still superseding
  * pending siblings. Gated on `capabilities.ws`.
  *
- * Cross-process only: `create_ws_transport` needs a real bound socket, so wire
+ * Cross-process only: `create_admitted_ws_transport` needs a real bound socket, so wire
  * it from a `*.cross.test.ts` file, never an in-process setup. Authed cookies
  * come from the per-account session minted by `fixture.create_account` /
  * `fixture.create_session_headers`.
@@ -47,7 +47,7 @@ import '../assert_dev_env.js';
  */
 import { assert, describe } from 'vitest';
 import { rpc_call } from '../rpc_helpers.js';
-import { create_ws_transport } from '../transports/ws_transport.js';
+import { create_admitted_ws_transport } from '../transports/ws_transport.js';
 import { is_notification_with } from '../transports/ws_client.js';
 import { ROLE_ADMIN } from '../../auth/role_schema.js';
 import { ROLE_GRANT_OFFER_RECEIVED_NOTIFICATION_METHOD, ROLE_GRANT_OFFER_ACCEPTED_NOTIFICATION_METHOD, ROLE_GRANT_OFFER_DECLINED_NOTIFICATION_METHOD, ROLE_GRANT_OFFER_RETRACTED_NOTIFICATION_METHOD, ROLE_GRANT_OFFER_SUPERSEDE_NOTIFICATION_METHOD, ROLE_GRANT_REVOKE_NOTIFICATION_METHOD, RoleGrantOfferReceivedParams, RoleGrantOfferAcceptedParams, RoleGrantOfferDeclinedParams, RoleGrantOfferRetractedParams, RoleGrantOfferSupersedeParams, RoleGrantRevokeParams } from '../../auth/role_grant_offer_notifications.js';
@@ -65,10 +65,19 @@ const RPC_PATH = '/api/rpc';
 export const describe_role_grant_offer_notification_ws_tests = (options) => {
     const { setup_test, capabilities, base_url, ws_path } = options;
     // -- shared helpers -------------------------------------------------------
-    /** Open a WS transport for a single session cookie (`<name>=<value>`). */
+    /**
+     * Open a WS transport for a single session cookie (`<name>=<value>`),
+     * admitted before it resolves: a targeted notification is delivered only to
+     * an admitted connection, and the handshake alone doesn't say it is one.
+     */
     const open_ws = (cookie) => {
         assert.ok(cookie, 'expected a session cookie for the WS upgrade');
-        return create_ws_transport({ base_url, ws_path, cookies: [cookie], origin: base_url });
+        return create_admitted_ws_transport({
+            base_url,
+            ws_path,
+            cookies: [cookie],
+            origin: base_url
+        });
     };
     /** Drive a JSON-RPC call over the fixture's HTTP transport. */
     const rpc = (fixture, method, params, headers) => rpc_call({ app: fixture.transport, path: RPC_PATH, method, params, headers });

package/dist/testing/cross_backend/rust_spine_stub_backend_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rust_spine_stub_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/rust_spine_stub_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA0C9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AASzD,uGAAuG;AACvG,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAEzE;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,6CAA6C,CAAC;AAE3F;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,6CAA6C,CAAC;AAkBnG,kGAAkG;AAClG,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,0FAA0F;AAC1F,eAAO,MAAM,oCAAoC,sDACG,CAAC;AAErD,MAAM,WAAW,6BAA6B;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,UAAS,6BAAkC,KACzC,aAkDF,CAAC"}
+{"version":3,"file":"rust_spine_stub_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/rust_spine_stub_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA0C9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AASzD,uGAAuG;AACvG,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAEzE;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,6CAA6C,CAAC;AAE3F;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,6CAA6C,CAAC;AAqBnG,kGAAkG;AAClG,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,0FAA0F;AAC1F,eAAO,MAAM,oCAAoC,sDACG,CAAC;AAErD,MAAM,WAAW,6BAA6B;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,UAAS,6BAAkC,KACzC,aAkDF,CAAC"}

package/dist/testing/cross_backend/rust_spine_stub_backend_config.js

@@ -61,7 +61,9 @@ export const RUST_SPINE_STUB_EXPECTED_SCHEMA_PATH_ENV = 'FUZ_RUST_SPINE_STUB_EXP
  * Capabilities for the Rust `testing_spine_stub` — `rust_default_capabilities`
  * plus `sse` (the stub serves `GET /api/admin/audit/stream` over the spine
  * `fuz_realtime::SseRegistry` + audit listener), `ready` (it live-mounts
- * `/ready` over the env-supplied fixture path), and `cell_gated_create` (it
+ * `/ready` over the env-supplied fixture path), `ws_account_actions` (it
+ * serves one action registry on `/api/rpc` and `/api/ws`), and
+ * `cell_gated_create` (it
  * mounts the `TestCellGatedCreateAuthorize` policy on its cell layer). Named
  * (not inline) so every spine preset is greppable, mirroring
  * `ts_spine_capabilities`.
@@ -70,6 +72,7 @@ const rust_spine_stub_capabilities = Object.freeze({
     ...rust_default_capabilities,
     sse: true,
     ready: true,
+    ws_account_actions: true,
     cell_gated_create: true
 });
 /** Default listening port — slots beside zzz's 1175/1176; matches the binary's `DEFAULT_PORT`. */

package/dist/testing/cross_backend/session_cap.d.ts

@@ -14,6 +14,19 @@ export interface SessionCapCrossTestOptions {
     readonly login_path?: string;
     /** REST account-status route path. Default `/api/account/status`. */
     readonly status_path?: string;
+    /**
+     * Where the backend's WebSocket endpoint is, for the case that an evicted
+     * session's socket is closed. Pass it when the backend has a WS transport
+     * (`capabilities.ws`); omitted, that case is skipped.
+     */
+    readonly ws?: {
+        /** Base URL the backend is reachable at (e.g. `http://localhost:1178`). */
+        readonly base_url: string;
+        /** WebSocket endpoint path on the backend (e.g. `/api/ws`). */
+        readonly ws_path: string;
+        /** Origin for the upgrade. Defaults to `base_url`. */
+        readonly origin?: string;
+    };
 }
 export declare const describe_session_cap_cross_tests: (options: SessionCapCrossTestOptions) => void;
 //# sourceMappingURL=session_cap.d.ts.map

package/dist/testing/cross_backend/session_cap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session_cap.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/session_cap.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAwD9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,gDAAgD;AAChD,MAAM,WAAW,0BAA0B;IAC1C,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,eAAO,MAAM,gCAAgC,GAAI,SAAS,0BAA0B,KAAG,IA6DtF,CAAC"}
+{"version":3,"file":"session_cap.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/session_cap.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA6D9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,gDAAgD;AAChD,MAAM,WAAW,0BAA0B;IAC1C,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE;QACb,2EAA2E;QAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,+DAA+D;QAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,sDAAsD;QACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACF;AAED,eAAO,MAAM,gCAAgC,GAAI,SAAS,0BAA0B,KAAG,IA4FtF,CAAC"}

package/dist/testing/cross_backend/session_cap.js

@@ -3,15 +3,11 @@ import '../assert_dev_env.js';
  * Cross-backend parity suite for the **per-account concurrent-session cap**
  * over real HTTP.
  *
- * The cap is a shipped control on the TS spine (`query_session_enforce_limit`,
- * `DEFAULT_MAX_SESSIONS`) that the Rust spine went without — its session INSERT
- * carried no eviction, so every Rust-backed deployment served unlimited
- * concurrent sessions per account. That divergence survived because nothing crossed the
- * wire on it — the TS half is pinned by in-process tests
- * (`session_middleware.lifecycle.db.test.ts`, `session_token_limits.integration.db.test.ts`)
- * whose Rust counterparts simply didn't exist to fail. This suite is the pin
- * that runs on *both*, so the next spine to lose the cap fails here rather than
- * in production. Two properties:
+ * Both spines cap concurrent sessions per account (the TS
+ * `query_session_enforce_limit` / `DEFAULT_MAX_SESSIONS`, the Rust
+ * `create_capped_session`). Each spine's own tests pin its half in-process;
+ * nothing in them crosses the wire, so a spine that lost the cap would fail
+ * no shared test. This suite is the pin that runs on *both*. It pins:
  *
  * - **the cap bounds concurrent sessions, by eviction not refusal** — logging in
  *   `max_sessions + 1` times succeeds every time (a login is never denied for
@@ -19,6 +15,11 @@ import '../assert_dev_env.js';
  * - **the evicted session is the oldest** — the first login's cookie no longer
  *   authenticates once the cap is exceeded. A spine with no cap authenticates it
  *   fine, which is exactly the defect this catches.
+ * - **an evicted session's socket is closed** (when `ws` is supplied) — the cap
+ *   deletes the session row, and a WebSocket never re-reads its session, so
+ *   the login that evicts it must close the socket it opened
+ *   (`WS_CLOSE_SESSION_REVOKED`), once the eviction has committed. A spine
+ *   that only deletes the row leaves the socket running on a dead session.
  *
  * **Why `max_sessions + 1` logins and not `max_sessions`.** The starting session
  * count isn't zero and isn't guaranteed equal across impls — `create_account`
@@ -48,16 +49,32 @@ import '../assert_dev_env.js';
  * @module
  */
 import { describe, test, assert } from 'vitest';
+import { heartbeat_action_spec } from '../../actions/heartbeat.js';
+import { WS_CLOSE_SESSION_REVOKED } from '../../actions/transports.js';
 import { DEFAULT_MAX_SESSIONS } from '../../auth/account_route_schema.js';
 import { DEFAULT_TEST_PASSWORD } from '../test_credentials.js';
+import { create_ws_transport } from '../transports/ws_transport.js';
+import { test_if } from './capabilities.js';
 export const describe_session_cap_cross_tests = (options) => {
-    const { setup_test } = options;
+    const { setup_test, ws } = options;
     const max_sessions = options.max_sessions ?? DEFAULT_MAX_SESSIONS;
     const login_path = options.login_path ?? '/api/account/login';
     const status_path = options.status_path ?? '/api/account/status';
     // Fresh-keeper-per-test wipes the DB between tests, so a literal username
     // never collides (see `setup.ts`).
     const username = 'session_cap_user';
+    /** Log `username` in on a fresh transport — one login, one session, one jar. */
+    const login = async (fixture, label) => {
+        const transport = fixture.fresh_transport();
+        const res = await transport(login_path, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ username, password: DEFAULT_TEST_PASSWORD })
+        });
+        assert.strictEqual(res.status, 200, `${label} must succeed — the cap evicts, it never refuses`);
+        assert.ok(transport.cookies().length > 0, `${label} must set a session cookie on its jar`);
+        return transport;
+    };
     describe('per-account session cap parity', () => {
         test(`logging in ${max_sessions + 1} times evicts the oldest session (newest cookie resolves, first does not)`, async () => {
             const fixture = await setup_test();
@@ -69,15 +86,7 @@ export const describe_session_cap_cross_tests = (options) => {
             // look alike. Held oldest-first.
             const sessions = [];
             for (let i = 0; i < max_sessions + 1; i++) {
-                const transport = fixture.fresh_transport();
-                const res = await transport(login_path, {
-                    method: 'POST',
-                    headers: { 'content-type': 'application/json' },
-                    body: JSON.stringify({ username, password: DEFAULT_TEST_PASSWORD })
-                });
-                assert.strictEqual(res.status, 200, `login ${i + 1}/${max_sessions + 1} must succeed — the cap evicts, it never refuses`);
-                assert.ok(transport.cookies().length > 0, `login ${i + 1} must set a session cookie on its jar`);
-                sessions.push(transport);
+                sessions.push(await login(fixture, `login ${i + 1}/${max_sessions + 1}`));
             }
             /** `GET /status` on one login's transport: 200 authenticated, 401 not. */
             const status_on = async (transport) => {
@@ -89,5 +98,32 @@ export const describe_session_cap_cross_tests = (options) => {
             assert.strictEqual(await status_on(sessions[0]), 401, `the oldest session must be evicted once the account exceeds ${max_sessions} sessions ` +
                 '(a spine with no cap authenticates this cookie)');
         });
+        // `max_sessions` further logins leave the watched session outside the
+        // newest `max_sessions`, so it is evicted whatever sessions the account
+        // held before it (`create_account` seeds one on some cradles).
+        test_if(ws !== undefined, 'a session the cap evicts has its open socket closed', async () => {
+            const fixture = await setup_test();
+            await fixture.create_account({ username, password_value: DEFAULT_TEST_PASSWORD });
+            const victim = await login(fixture, 'the login whose socket is watched');
+            const client = await create_ws_transport({
+                base_url: ws.base_url,
+                ws_path: ws.ws_path,
+                cookies: victim.cookies(),
+                origin: ws.origin
+            });
+            try {
+                // admitted and dispatching before the evicting logins
+                await client.request(1, heartbeat_action_spec.method, {});
+                for (let i = 0; i < max_sessions; i++) {
+                    await login(fixture, `evicting login ${i + 1}/${max_sessions}`);
+                }
+                const closed = await client.wait_for_close(2000);
+                assert.ok(closed, `the socket of a session evicted past ${max_sessions} sessions did not close within 2s`);
+                assert.strictEqual(client.close_code, WS_CLOSE_SESSION_REVOKED);
+            }
+            finally {
+                await client.close();
+            }
+        });
     });
 };

package/dist/testing/cross_backend/sse_round_trip.d.ts

@@ -27,11 +27,19 @@ export interface CrossProcessSseTestOptions {
     readonly rpc_path?: string;
     /** Origin for the stream request. Defaults to `base_url`. */
     readonly origin?: string;
+    /**
+     * The backend's per-session audit-stream cap, which the cap case opens one
+     * stream past. Defaults to `AUDIT_LOG_SSE_MAX_PER_SCOPE`, the cap both
+     * spines apply unless overridden; `null` (a backend with the cap disabled)
+     * skips the case.
+     */
+    readonly max_per_scope?: number | null;
 }
 /**
- * Register the cross-process SSE round-trip suite. Up to four cases over a
+ * Register the cross-process SSE round-trip suite. Its cases run over a
  * real streaming `fetch`: connected-comment, audit data frame, account-wide
- * close-on-revoke, and session-scoped close-on-revoke.
+ * close-on-revoke, session-scoped close-on-revoke, close on account delete,
+ * and the per-session cap.
  */
 export declare const describe_cross_process_sse_tests: (options: CrossProcessSseTestOptions) => void;
 //# sourceMappingURL=sse_round_trip.d.ts.map

package/dist/testing/cross_backend/sse_round_trip.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sse_round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/sse_round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA+D9B,OAAO,EAAE,KAAK,mBAAmB,EAAW,MAAM,mBAAmB,CAAC;AACtE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAK5C,kEAAkE;AAClE,MAAM,WAAW,0BAA0B;IAC1C;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,wEAAwE;IACxE,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CACzB;AA0BD;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,GAAI,SAAS,0BAA0B,KAAG,IAwKtF,CAAC"}
+{"version":3,"file":"sse_round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/sse_round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA8E9B,OAAO,EAAE,KAAK,mBAAmB,EAAW,MAAM,mBAAmB,CAAC;AACtE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAK5C,kEAAkE;AAClE,MAAM,WAAW,0BAA0B;IAC1C;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,wEAAwE;IACxE,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;AA0BD;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAAI,SAAS,0BAA0B,KAAG,IA2PtF,CAAC"}

package/dist/testing/cross_backend/sse_round_trip.js

@@ -11,7 +11,7 @@ import '../assert_dev_env.js';
  * (`describe_standard_cross_process_tests`) omits SSE by design, so consumers
  * call this alongside it (paralleling `describe_cross_process_ws_tests`).
  *
- * Four cases, mirroring the in-process SSE self-test against fuz_app's
+ * Its cases follow the in-process SSE self-test against fuz_app's
  * standard audit-log stream:
  *
  * 1. **connects** — the stream opens and emits the `: connected` comment.
@@ -23,20 +23,28 @@ import '../assert_dev_env.js';
  *    stream opens so `create_account`'s own audit events (invite / signup /
  *    login / token) don't land on it.
  * 3. **close-on-revoke, account-wide** (gated on `rpc_path`) — the subscriber's
- *    *own* sessions are revoked (`account_session_revoke_all`), so the
- *    `session_revoke_all` event targets the keeper and the audit guard drops
- *    the live stream via the account-wide `close_for_account` path. Asserted
- *    via `SseTransport.wait_for_close`.
+ *    *own* sessions are revoked (`account_session_revoke_all`), which closes
+ *    every stream of the account once the revoke commits (the handler's
+ *    close, repeated by the audit guard on the `session_revoke_all` row).
+ *    Asserted via `SseTransport.wait_for_close`.
  * 4. **close-on-revoke, session-scoped** (gated on `rpc_path`) — the
  *    subscriber's *own* single session is revoked (`account_session_revoke`),
- *    so the `session_revoke` event drops the stream via the session-hash-scoped
- *    `close_for_session` path (the distinct primitive cases 2–3 don't reach).
+ *    which closes only the stream registered under that session's hash (the
+ *    distinct close cases 2–3 don't reach).
+ * 5. **close on account delete** (gated on `rpc_path` and
+ *    `capabilities.account_lifecycle`) — the keeper soft-deletes a second
+ *    admin whose stream is open; the delete revokes its credentials and
+ *    closes its stream.
+ * 6. **per-session cap** — one stream past `max_per_scope` on one session
+ *    closes the oldest (evict-oldest, no final frame) and leaves every other
+ *    stream open. Needs no RPC: the cap runs inside the subscribe itself.
  *
- * The close-on-revoke matrix is layered: cases 3–4 exercise the account-wide
- * and session-scoped paths cross-process; the remaining union events
- * (`token_revoke_all` / `logout` / `password_change`, all account-wide; and
- * `role_grant_revoke`, role-matched) are covered by the spine's `fuz_realtime`
- * SSE-registry unit tests and the in-process guard self-test, so a cross-process
+ * The close-on-revoke matrix is layered: cases 3–5 exercise the account-wide
+ * and session-scoped paths cross-process; the remaining revocation events
+ * (`token_revoke_all` / `logout` / `password_change` / `account_purge`, all
+ * account-wide; `token_revoke`, token-scoped; and `role_grant_revoke`,
+ * role-matched) are covered by the spine's `fuz_realtime` SSE-registry unit
+ * tests and the in-process guard self-test, so a cross-process
  * `token_revoke_all`-with-zero-tokens case (which may emit no audit row) stays
  * out to keep the spawned-backend suite non-flaky.
  *
@@ -49,8 +57,9 @@ import '../assert_dev_env.js';
  */
 import { assert, describe } from 'vitest';
 import { account_session_list_action_spec, account_session_revoke_action_spec, account_session_revoke_all_action_spec } from '../../auth/account_action_specs.js';
-import { admin_session_revoke_all_action_spec } from '../../auth/admin_action_specs.js';
-import { audit_log_event_specs } from '../../realtime/sse_auth_guard.js';
+import { account_delete_action_spec, admin_session_revoke_all_action_spec } from '../../auth/admin_action_specs.js';
+import { ROLE_ADMIN } from '../../auth/role_schema.js';
+import { AUDIT_LOG_SSE_MAX_PER_SCOPE, audit_log_event_specs } from '../../realtime/sse_auth_guard.js';
 import { SSE_CONNECTED_COMMENT } from '../../realtime/sse_constants.js';
 import { create_sse_transport } from '../transports/sse_transport.js';
 import { create_rpc_post_init } from '../rpc_helpers.js';
@@ -73,13 +82,15 @@ const assert_audit_data_frame = (frame) => {
     assert.ok(result.success, `audit data frame params mismatch for '${String(payload.method)}': ${result.success ? '' : JSON.stringify(result.error.issues)}`);
 };
 /**
- * Register the cross-process SSE round-trip suite. Up to four cases over a
+ * Register the cross-process SSE round-trip suite. Its cases run over a
  * real streaming `fetch`: connected-comment, audit data frame, account-wide
- * close-on-revoke, and session-scoped close-on-revoke.
+ * close-on-revoke, session-scoped close-on-revoke, close on account delete,
+ * and the per-session cap.
  */
 export const describe_cross_process_sse_tests = (options) => {
     const { setup_test, capabilities, base_url, rpc_path, origin } = options;
     const sse_path = options.sse_path ?? DEFAULT_SSE_PATH;
+    const max_per_scope = options.max_per_scope === undefined ? AUDIT_LOG_SSE_MAX_PER_SCOPE : options.max_per_scope;
     describe('cross-process sse', () => {
         test_if(capabilities.sse, 'connects and emits the connected comment', async () => {
             const fixture = await setup_test();
@@ -127,8 +138,9 @@ export const describe_cross_process_sse_tests = (options) => {
                 await sse.close();
             }
         });
-        // Revoke the subscriber's OWN sessions → `session_revoke_all` targets the
-        // keeper, so the audit guard closes the live stream.
+        // Revoke the subscriber's OWN sessions → the handler closes the keeper's
+        // streams once the revoke commits (the audit guard repeats the close on
+        // the `session_revoke_all` row).
         test_if(capabilities.sse && rpc_path !== undefined, 'stream closes when the subscriber sessions are revoked', async () => {
             const fixture = await setup_test();
             const sse = await create_sse_transport({
@@ -150,14 +162,15 @@ export const describe_cross_process_sse_tests = (options) => {
             }
         });
         // Single `session_revoke` of the subscriber's OWN session → the
-        // session-hash-scoped close path (`close_for_session` / the TS guard's
-        // `close_by_identity(session_id)`). The keeper holds exactly one session,
-        // so revoking it by its blake3 hash drops the stream opened under it.
-        // This is the close-on-revoke path the account-wide cases above don't
-        // exercise; the remaining union events (`token_revoke_all` / `logout` /
-        // `password_change`) share the account-wide `close_for_account` path the
-        // `session_revoke_all` case already covers, and `role_grant_revoke`'s
-        // role-matched path is covered by `fuz_realtime`'s SSE registry unit tests.
+        // session-hash-scoped close (the Rust registry's `close_for_session`, the
+        // TS registry's `close_by_identity(session_hash)`). The keeper holds
+        // exactly one session, so revoking it by its blake3 hash drops the stream
+        // opened under it. This is the close-on-revoke path the account-wide case
+        // above doesn't exercise; the remaining account-wide events
+        // (`token_revoke_all` / `logout` / `password_change` / `account_purge`)
+        // share the close the `session_revoke_all` and account-delete cases cover,
+        // and `token_revoke`'s token-scoped and `role_grant_revoke`'s role-matched
+        // closes are covered by `fuz_realtime`'s SSE registry unit tests.
         test_if(capabilities.sse && rpc_path !== undefined, 'stream closes on a single session_revoke of the subscriber session', async () => {
             const fixture = await setup_test();
             const sse = await create_sse_transport({
@@ -183,5 +196,59 @@ export const describe_cross_process_sse_tests = (options) => {
                 await sse.close();
             }
         });
+        // A soft-deleted account's credentials stop authenticating, and a stream
+        // never rechecks its own — so the delete must close it. The keeper
+        // deletes a second admin whose stream is open; the keeper's own admin
+        // grant keeps the delete clear of the last-admin guard.
+        test_if(capabilities.sse && capabilities.account_lifecycle && rpc_path !== undefined, 'stream closes when the subscriber account is deleted', async () => {
+            const fixture = await setup_test();
+            const target = await fixture.create_account({
+                username: 'sse_delete_target',
+                roles: [ROLE_ADMIN]
+            });
+            const cookie = target.create_session_headers().cookie;
+            assert.ok(cookie, 'expected a session cookie for the target account');
+            const sse = await create_sse_transport({ base_url, sse_path, cookies: [cookie], origin });
+            try {
+                const first = await sse.read_frame();
+                assert.strictEqual(first + '\n\n', SSE_CONNECTED_COMMENT, 'first frame must be the connected comment');
+                const res = await fixture.transport(rpc_path, create_rpc_post_init(account_delete_action_spec.method, {
+                    account_id: target.account.id
+                }));
+                assert.strictEqual(res.status, 200, `account_delete RPC failed (status=${res.status})`);
+                const closed = await sse.wait_for_close(2000);
+                assert.ok(closed, 'stream did not close within 2s after account_delete');
+            }
+            finally {
+                await sse.close();
+            }
+        });
+        // One stream past the cap on one session → the oldest closes, the newest
+        // stays open. Opened in sequence, each awaited to its connect comment, so
+        // the server registered them in order and "oldest" is stream 0 on both
+        // spines. The evicted stream ends with no final frame, so a browser
+        // `EventSource` would reconnect — this asserts the server side only.
+        test_if(capabilities.sse && max_per_scope !== null, 'one stream past the per-session cap closes the oldest', async () => {
+            const fixture = await setup_test();
+            const cookies = fixture.transport.cookies();
+            const streams = [];
+            try {
+                for (let i = 0; i <= max_per_scope; i++) {
+                    const sse = await create_sse_transport({ base_url, sse_path, cookies, origin });
+                    streams.push(sse);
+                    const first = await sse.read_frame();
+                    assert.strictEqual(first + '\n\n', SSE_CONNECTED_COMMENT, `stream ${i}: first frame must be the connected comment`);
+                }
+                const [oldest, ...survivors] = streams;
+                const closed = await oldest.wait_for_close(2000);
+                assert.ok(closed, 'the oldest stream did not close within 2s of the cap overflow');
+                // only the oldest — every later stream on the session stays open
+                const survivors_closed = await Promise.all(survivors.map((sse) => sse.wait_for_close(200)));
+                assert.deepStrictEqual(survivors_closed, survivors.map(() => false), 'only the oldest stream may close; the rest of the session stays open');
+            }
+            finally {
+                await Promise.all(streams.map((sse) => sse.close()));
+            }
+        });
     });
 };

package/dist/testing/cross_backend/testing_server_bun.js

@@ -53,10 +53,10 @@ export const create_bun_testing_adapter = () => ({
             // hang), and the client runtime — a single server-closed WS is
             // necessary and sufficient. Client-initiated close or leaving the
             // socket open both stop cleanly in ~0ms. In this suite the trigger is
-            // `create_ws_auth_guard` closing the socket on `session_revoke_all`
-            // (the `ws.cross.test.ts` close-on-revoke case) — the only
-            // server-initiated WS close, which is why teardown hangs there and
-            // not under HTTP-only or client-closed WS traffic.
+            // any server-initiated WS close — a revocation's (the `ws.cross.test.ts`
+            // close-on-revoke cases), a cap eviction's, an oversized message's —
+            // which is why teardown hangs after those and not under HTTP-only or
+            // client-closed WS traffic.
             //
             // So initiate a force-close (`true` drops active connections, no
             // drain) but DON'T await it: awaiting hangs `start_testing_server`'s

package/dist/testing/cross_backend/ts_spine_backend_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ts_spine_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ts_spine_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AASzD,8GAA8G;AAC9G,eAAO,MAAM,gBAAgB,6BAA6B,CAAC;AAkC3D,6FAA6F;AAC7F,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,iDAAiD;AACjD,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,gDAAgD;AAChD,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,uDAAuD,CAAC;AAEvF,MAAM,WAAW,2BAA2B;IAC3C,mFAAmF;IACnF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;OASG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAC3C;AAWD;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAmBF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,GACvC,UAAS,2BAAgC,KACvC,aAmBF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAgCF,CAAC"}
+{"version":3,"file":"ts_spine_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ts_spine_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AASzD,8GAA8G;AAC9G,eAAO,MAAM,gBAAgB,6BAA6B,CAAC;AA0C3D,6FAA6F;AAC7F,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,iDAAiD;AACjD,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,gDAAgD;AAChD,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,uDAAuD,CAAC;AAEvF,MAAM,WAAW,2BAA2B;IAC3C,mFAAmF;IACnF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;OASG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAC3C;AAWD;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAmBF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,GACvC,UAAS,2BAAgC,KACvC,aAmBF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAgCF,CAAC"}

package/dist/testing/cross_backend/ts_spine_backend_config.js

@@ -9,6 +9,7 @@ export const TS_SPINE_DIR_ENV = 'FUZ_TESTING_TS_SPINE_DIR';
  * (the binary wires `audit_log_sse`), `ready` (the binary live-mounts the
  * `/ready` deploy gate in `build_spine_app`), `peer_request` (the backend
  * WS transport's `request_connection` path drives server→client `peer/ping`),
+ * `ws_account_actions` (the binary mounts the account actions on `/api/ws`),
  * and `cell_gated_create` (the binary's `full_spine_mount` mounts the
  * `test_cell_gated_create_authorize` policy).
  */
@@ -17,11 +18,13 @@ const ts_spine_capabilities = Object.freeze({
     sse: true,
     ready: true,
     peer_request: true,
+    ws_account_actions: true,
     cell_gated_create: true
 });
 /**
  * Capabilities for the **Bun** spine binary — `ts_spine_capabilities` with
- * `oversized_reject_closes_connection: false`. `Bun.serve` drains the declared
+ * `oversized_reject_closes_connection: false` and
+ * `ws_handshake_pipelining: false`. `Bun.serve` drains the declared
  * `Content-Length` of an oversized-body `413` reject and keeps the socket
  * alive (processing the correctly-framed pipelined request) even when the
  * response carries `Connection: close`, unlike `@hono/node-server` / Deno /
@@ -29,10 +32,15 @@ const ts_spine_capabilities = Object.freeze({
  * there is no desync — but the smuggling suite's strong "connection closes"
  * assertion doesn't hold; this flag routes Bun onto the suite's no-desync arm.
  * See `docs/security.md` §"Body Size Limiting".
+ *
+ * `Bun.serve` also answers `400` to an upgrade request that carries WebSocket
+ * frames in the same TCP write, before any handler runs, so the WS suite's
+ * frames-with-the-handshake case has nothing to drive there.
  */
 const ts_spine_bun_capabilities = Object.freeze({
     ...ts_spine_capabilities,
-    oversized_reject_closes_connection: false
+    oversized_reject_closes_connection: false,
+    ws_handshake_pipelining: false
 });
 /** Default port for the Node TS spine binary — slots beside the Rust `spine_stub` (1177). */
 export const TS_SPINE_NODE_DEFAULT_PORT = 1178;

package/dist/testing/cross_backend/ws_connection_cap.d.ts

@@ -0,0 +1,35 @@
+import '../assert_dev_env.js';
+import { type BackendCapabilities } from './capabilities.js';
+import type { SetupTest } from './setup.js';
+/** Options for the WebSocket connection-cap parity suite. */
+export interface WsConnectionCapCrossTestOptions {
+    /**
+     * Per-test fixture producer (`default_cross_process_setup(handle)`). Every
+     * socket in a case upgrades with the fresh-per-test keeper's session
+     * cookies, so they all land on one account.
+     */
+    readonly setup_test: SetupTest;
+    /** Backend capability flags; every case gates on `capabilities.ws`. */
+    readonly capabilities: BackendCapabilities;
+    /** Base URL the backend is reachable at (e.g. `http://localhost:1178`). */
+    readonly base_url: string;
+    /** WebSocket endpoint path on the backend (e.g. `/api/ws`). */
+    readonly ws_path: string;
+    /** Origin for the upgrades. Defaults to `base_url`. */
+    readonly origin?: string;
+    /**
+     * The backend's per-account connection cap, which each case opens past.
+     * Defaults to `DEFAULT_MAX_CONNECTIONS_PER_ACCOUNT`, the cap both spines
+     * apply unless overridden; pass the consumer's value when it sets one, or
+     * `null` (a backend with the cap disabled) to skip the cases.
+     */
+    readonly max_connections_per_account?: number | null;
+}
+/**
+ * Register the WebSocket connection-cap parity suite over a real upgrade:
+ * one connection past the cap closes the account's oldest with
+ * `WS_CLOSE_CONNECTION_LIMIT` and nothing else, and a closed connection
+ * frees its slot.
+ */
+export declare const describe_ws_connection_cap_cross_tests: (options: WsConnectionCapCrossTestOptions) => void;
+//# sourceMappingURL=ws_connection_cap.d.ts.map

package/dist/testing/cross_backend/ws_connection_cap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ws_connection_cap.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ws_connection_cap.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAsD9B,OAAO,EAAE,KAAK,mBAAmB,EAAW,MAAM,mBAAmB,CAAC;AACtE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAK5C,6DAA6D;AAC7D,MAAM,WAAW,+BAA+B;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,uEAAuE;IACvE,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,2BAA2B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrD;AAED;;;;;GAKG;AACH,eAAO,MAAM,sCAAsC,GAClD,SAAS,+BAA+B,KACtC,IA4GF,CAAC"}