@fuzdev/fuz_app 0.134.0 → 0.136.0

package/dist/actions/CLAUDE.md

@@ -159,13 +159,13 @@ if a consumer genuinely owns protocol actions in their typed API.
 
 **Consumer tiers.** Single-source consumers (zzz) drop into the helpers
 and accept the default `* as specs` namespace import. Multi-source
-consumers (zap, visiones — stitching local specs with
+consumers (fuz_forge, visiones — stitching local specs with
 `all_admin_action_specs` / `all_role_grant_offer_action_specs` /
 `all_account_action_specs` / `all_self_service_role_action_specs` from
 fuz_app) call `create_namespace_qualifier` once, then pass the returned
 `qualify_spec` callback to multi-source helpers.
 
-**Tier 1** (HTTP-only, zap/visiones) emits a smaller surface — typically
+**Tier 1** (HTTP-only) emits a smaller surface — typically
 `ActionMethod` + `FrontendActionsApi` + `ActionInputs` / `ActionOutputs`.
 Never calls `generate_typed_action_event_alias` or
 `generate_frontend_action_handlers`. **Tier 2** (`TypedActionEvent`-aware,
@@ -362,6 +362,7 @@ and `allow_fallback: boolean` (default `true`). Explicit
 - `WS_CLOSE_CLIENT_HEARTBEAT_TIMEOUT = 4002` — client observed receive-silence past its receive timeout (`resolve_heartbeat_receive_timeout`).
 - `WS_CLOSE_SERVER_HEARTBEAT_TIMEOUT = 4003` — server observed receive-silence past `DEFAULT_SERVER_HEARTBEAT_TIMEOUT` (60s).
 - `WS_CLOSE_CONNECTION_LIMIT = 4004` — server closed this socket to admit a newer one on the same account, past the per-account connection cap (reason `connection limit`). Not a revocation: the client stays `closed` with `superseded` set and no reconnect, until `connect()` is called. Twin of the Rust spine's constant.
+- `WS_CLOSE_OUTBOUND_OVERFLOW = 4005` — the server had more waiting to be written to this socket than its outbound budget holds (reason `WS_CLOSE_OUTBOUND_OVERFLOW_REASON`, `outbound queue overflow`); what was waiting is dropped. Not a revocation, and nothing took the connection's place: the client reconnects under its ordinary backoff. Twin of the Rust spine's constant.
 - `WS_CLOSE_GOING_AWAY = 1001` — the server is shutting down (reason `WS_CLOSE_GOING_AWAY_REASON`, `Server shutting down`): `close_all_sockets`, which `AppServer.close` runs. Also the close for an upgrade the shutdown refuses — pending at the close-all, or born closed after it. Not a revocation: the client reconnects under its ordinary backoff.
 - `WS_CLOSE_MESSAGE_TOO_BIG = 1009` — server received a message over its `max_message_bytes` cap (RFC 6455 "Message Too Big").
 - `WS_CLOSE_POLICY_VIOLATION = 1008` — a socket sent too much while it was still opening (before admission and `on_socket_open` completed): past `MAX_PRE_ADMISSION_FRAMES` frames or the `PRE_ADMISSION_QUEUE_BYTES_FACTOR` byte budget.
@@ -371,7 +372,8 @@ and `allow_fallback: boolean` (default `true`). Explicit
 
 - `actions/transports_http.ts` — `frontend_http_rpc`; thin `fetch` adapter, POST default, GET on `has_side_effects(method) === false`.
 - `actions/transports_ws.ts` — `frontend_websocket_rpc`; thin adapter over `WebsocketRpcConnection` (default impl: `FrontendWebsocketClient`). Answers inbound server→client requests: a built-in `peer_ping_responder` for `peer/ping` (zero-wiring liveness), any other request routed through `peer.receive` with the response sent back over the socket (the frontend half of the ActionPeer receive loop).
-- `actions/transports_ws_backend.ts` — `backend_websocket_rpc`; server-side WS with session tracking, two-phase registration (`register_pending` / `admit`), and the per-account cap; satisfies `FilterableBroadcastTransport`. Server→client requests via `request_connection` (correlation registry in `actions/peer_request.ts`).
+- `actions/transports_ws_backend.ts` — `backend_websocket_rpc`; server-side WS with session tracking, two-phase registration (`register_pending` / `admit`), the per-account cap, and the per-connection outbound budget; satisfies `FilterableBroadcastTransport`. Server→client requests via `request_connection` (correlation registry in `actions/peer_request.ts`).
+- `actions/ws_outbound_writer.ts` — `WsOutboundWriter`, the outbound queue and write pump of one connection, which every frame the transport sends goes through; `realtime/outbound_budget.ts` is the accounting it shares with SSE.
 
 `FrontendHttpTransport` on non-OK HTTP returns the body as-is when it's a
 JSON-RPC error response for the request (same `id` compared as strings since GET sends it as a query param, or `null`) — the
@@ -406,7 +408,7 @@ client; `null` skips the client-side measurement.
 
 One map keyed by `connection_id` (branded `Uuid`), in registration order:
 `#connections: Map<Uuid, ConnectionEntry>`, each entry `{ws, identity,
-admitted, abort_controller}`. `identity` is the `ConnectionIdentity`
+admitted, abort_controller, writer}`. `identity` is the `ConnectionIdentity`
 `{token_hash, account_id, api_token_id}` (session sets `token_hash`, bearer
 sets `api_token_id`, daemon-token sets both null).
 
@@ -477,6 +479,74 @@ Rust `fuz_realtime` `ConnectionRegistry`'s cap — same default, same policy,
 same close code and reason — pinned on both by the
 `describe_ws_connection_cap_cross_tests` suite.
 
+**Outbound bound.** Every frame the server sends a connection goes through
+its `WsOutboundWriter` (`actions/ws_outbound_writer.ts`), reached by one path:
+`send_to(connection_id, frame)` — which `register_action_ws` uses for every
+response, error frame, and socket-scoped notification — and the fan-outs
+(`send`, `broadcast_filtered`, `send_to_account`, `request_connection`). The
+one way around it is a consumer sending on the raw `SocketOpenContext.ws`,
+which bypasses the budget. A send never waits and never throws.
+
+- **What waits.** A frame sent to an idle connection — nothing waiting,
+  nothing unwritten in the runtime's socket buffer, no other frame sent in the
+  same synchronous run — goes straight to the socket. Everything else waits in
+  the writer's queue: the rest of a burst sent in one synchronous run (a loop
+  with no `await` gives the pump no turn), and anything sent while the socket's
+  buffer is at or over `WS_WRITE_HIGH_WATER_BYTES`. The pump hands waiting
+  frames over in order, on the microtask after a send and as the buffer drains.
+  So a second send in one synchronous run reaches the socket a microtask later.
+- **The budget.** What waits is held to `outbound_queue_bytes`
+  (`new BackendWebsocketTransport({outbound_queue_bytes})`, default
+  `DEFAULT_WS_OUTBOUND_QUEUE_BYTES`, 4 MiB — its own constant, not derived from
+  `max_message_bytes`; anything but a positive integer throws): each waiting
+  frame is charged its UTF-8 length plus `OUTBOUND_FRAME_OVERHEAD_BYTES` (64),
+  and a frame is always accepted when nothing is waiting. Nothing counts
+  frames (`OutboundBudget`, `realtime/outbound_budget.ts`).
+- **Overflow.** A frame that does not fit closes the connection with
+  `WS_CLOSE_OUTBOUND_OVERFLOW`: the entry leaves the map in the same
+  synchronous step (the overflowing send returns `false` / is not counted,
+  later sends miss it, the count accessors and the cap stop seeing it), its
+  pending peer requests drain as `connection_gone`, its controller is aborted,
+  and what was waiting is discarded. Frames already handed to the socket may
+  still reach the client ahead of the close frame; nothing follows it.
+- **Deadlines.** Bytes a socket still holds `WS_WRITE_STALL_TIMEOUT` (10 s)
+  after they were handed to it drop the connection with no close frame
+  (`terminate()` on Node's `ws` and Bun; the client sees 1006), removing it and
+  aborting its controller the same way. A close frame gets
+  `WS_CLOSE_WRITE_TIMEOUT` (1 s), after which a socket still holding unwritten
+  bytes is cut. Deno's standard `WebSocket` cannot be cut, so there a stalled
+  connection is closed with `WS_CLOSE_OUTBOUND_OVERFLOW` instead, the close
+  deadline cuts nothing, and the runtime keeps the socket until it or the
+  client ends it. The timers are unref'd and cleared when the socket's close
+  arrives (`remove_connection`, which is for a socket that has closed).
+- **Other closes.** A revocation, a cap eviction, the shutdown, and
+  `close_connection` run the pump's rule once more: the frames still waiting
+  are handed to the socket ahead of the close frame while its buffer is below
+  `WS_WRITE_HIGH_WATER_BYTES` (64 KiB), and the rest are discarded. A reply
+  sent to an otherwise idle connection just before a self-revoking close still
+  arrives; one queued behind a backed-up socket does not.
+- **After a close.** A closed or dropped connection is out of the map, so the
+  per-account cap does not count it while its socket is still closing. Where
+  the runtime reports its buffer, what it holds for that socket is less than
+  the high-water mark plus one frame, and the close frame — for the close deadline on Node and Bun, and on
+  Deno until the runtime or the client ends the socket.
+- **Logging.** One `warn` per overflow (`ws: outbound queue overflow, closing
+  the connection`, the Rust spine's line) or stall (`ws: write stalled,
+  dropping the connection`), with `{connection_id, account_id, queued_bytes,
+  queued_frames, …}`. No audit row: a client can provoke either at will.
+
+The twin of the Rust `fuz_realtime` outbound queue — same budget, charge,
+rule, close code, reason, and deadlines, pinned on both by
+`describe_ws_outbound_overflow_cross_tests`. Where they differ (the Rust spine
+queues every frame and discards the whole backlog at every close) is listed in
+../../../docs/security.md §Outbound Bounds.
+
+`close_connection(connection_id, code, reason)` closes one connection, pending
+or admitted — removal, abort, then the close through the writer — and answers
+`false` for an id that names nothing. `register_action_ws` makes its own closes
+with it (heartbeat timeout, oversized message, failed `on_socket_open`, refused
+admission).
+
 Targeted closure (all return socket count closed, use
 `WS_CLOSE_SESSION_REVOKED`, match pending and admitted entries alike, and abort
 each closed connection's controller):
@@ -525,7 +595,7 @@ no pending entry (unsolicited / cross-connection / late) is dropped + audited vi
 Rust `audit_unmatched_response`).
 
 Return values are bookkeeping, not delivery receipts — `0` means no live
-sockets, non-zero means `ws.send` did not throw. Durable delivery requires
+sockets, non-zero means the connection's outbound queue accepted the frame. Durable delivery requires
 persistence + rehydration by the consumer.
 
 ## Connection closer (`actions/connection_closer.ts`)
@@ -678,7 +748,8 @@ parsed and every caller would be unauthenticated.
 
 `WsEndpointSpec` fields: `path`, `allowed_origins?` (default: the server's),
 `actions`,
-`required_roles?`, `transport?`, `max_connections_per_account?`, `heartbeat?`,
+`required_roles?`, `transport?`, `max_connections_per_account?`,
+`outbound_queue_bytes?`, `heartbeat?`,
 `artificial_delay?`, `max_message_bytes?`,
 `on_socket_open?`, `on_socket_close?`, `auth_guard?` (default `true`,
 deduped by reference identity via `WeakSet<BackendWebsocketTransport>`),
@@ -690,7 +761,10 @@ the audit listener, not of the handlers' closes.
 transport the mount creates (`RegisterActionWsOptions` carries the same field).
 It throws alongside `transport` — a supplied transport carries its own cap, set
 where it was constructed, and an option that silently did nothing would read as
-enforced.
+enforced. `outbound_queue_bytes` sets the per-connection outbound budget on that
+transport the same way (default `DEFAULT_WS_OUTBOUND_QUEUE_BYTES`; zero or a
+non-positive value throws at assembly, as does passing it alongside
+`transport`).
 
 Mounted transport reachable at `app_server.ws_endpoints[path]`
 (`Readonly<Record<string, BackendWebsocketTransport>>`). Duplicate paths
@@ -740,7 +814,8 @@ HTTP RPC also calls. `register_action_ws` owns only WS-specific concerns:
 - **Cancel-notification interception** — `{request_id → AbortController}` map; aborts the matching pending controller before the cancel bubbles past the dispatcher
 - **Duplicate live ids refused** — a request whose id names a request still running on the socket is answered `invalid_request` with `data.reason` `ERROR_DUPLICATE_REQUEST_ID` and not dispatched; the running request keeps its controller, its cancel entry, and its reply id. An id is free again once its request is answered. Same refusal on the Rust spine
 - **In-flight ceiling** — at most `MAX_INBOUND_DISPATCHES_PER_CONNECTION` (128) requests run at once per socket (`@hono/node-ws` does not await `onMessage`, so nothing else bounds them); one more is answered `queue_overflow` (`WS_INBOUND_DISPATCH_OVERFLOW_MESSAGE`) and not dispatched, and the socket stays open and keeps reading — a reply to a server-initiated request still gets through. The duplicate check runs first; neither refusal reaches `perform_action`, so neither charges the action rate limiters. Same cap, message, and order as the Rust spine's `MAX_INBOUND_DISPATCHES_PER_CONN`
-- **Socket-scoped notify** — `(method, params) => ws.send(notification)`, threaded into `perform_action` as `notify`
+- **Socket-scoped notify** — `(method, params) => transport.send_to(connection_id, notification)`, threaded into `perform_action` as `notify`
+- **Every send through the transport** — responses, error frames, and notifications all go through `transport.send_to`, so they are held to the connection's outbound budget; a handler that sends past it closes its own socket with `WS_CLOSE_OUTBOUND_OVERFLOW` and gets no response written
 - **Composed abort signal** — `AbortSignal.any([socket_close, per_request_cancel])`, threaded as `signal`
 - **Connection lifecycle** — admission (`transport.register_pending` → credential re-read → `transport.admit`, which enforces the per-account connection cap) / `remove_connection`, `on_socket_open` / `_close` hooks, server heartbeat
 - **The inbound gate** — frames queue until the socket is admitted and `on_socket_open` has completed; frames on a socket the server closed are dropped
@@ -805,7 +880,8 @@ completes — `@hono/node-ws` does, for up to the `ws` close timeout when the
 client withholds its close frame. So every server-side close removes the
 connection from the transport and aborts the socket's controller **at close
 time**: the transport does both for a revocation or a cap eviction, and
-`register_action_ws`'s `end_socket` does both for a heartbeat timeout, an
+`register_action_ws`'s `end_socket` does both — through
+`transport.close_connection` — for a heartbeat timeout, an
 oversized message, a failed `on_socket_open`, and a refused admission.
 `onMessage` then drops any frame whose socket has ended — no dispatch, no
 error reply. A connection the transport no longer holds though nothing closed
@@ -848,7 +924,11 @@ rolled-back message fires no post-commit effect). See `http/CLAUDE.md`
 handler that revokes the credential its own socket runs on queues a close of
 that socket on `post_commit_effects`, so the caller reads its reply and then the
 `WS_CLOSE_SESSION_REVOKED` close — flushing first would strand it without an
-answer. (The Rust spine does flush first, and drops the response: a divergence
+answer. The close hands the frames still waiting in the connection's outbound
+queue to the socket ahead of the close frame while the socket's buffer is below
+`WS_WRITE_HIGH_WATER_BYTES`, so the reply arrives when it was queued behind
+another frame of the same run on a socket that is keeping up, and is discarded
+when the socket is backed up past that mark. (The Rust spine does flush first, and drops the response: a divergence
 the cross-backend WS suite records as `capabilities.ws_self_revocation_reply`.)
 
 **Lifecycle hooks.** `on_socket_open({ws, connection_id, identity, notify, signal})`
@@ -967,7 +1047,9 @@ recent frame each way — every frame, including heartbeats and the responses
 `request` consumes — for diagnostics UI.
 
 Reconnect policy (exponential backoff): `delay = DEFAULT_RECONNECT_DELAY * DEFAULT_BACKOFF_FACTOR ** (attempts-1)`,
-capped at `DEFAULT_RECONNECT_DELAY_MAX`. Two close codes never reconnect:
+capped at `DEFAULT_RECONNECT_DELAY_MAX`. Every other close reconnects —
+`WS_CLOSE_OUTBOUND_OVERFLOW` included, the server's notice that this client
+fell behind and missed messages. Two close codes never reconnect:
 
 - `WS_CLOSE_SESSION_REVOKED` is **terminal** — sets `revoked`, no reconnect
   loop on 401, and `connect()` becomes a no-op. Pending and queued requests

package/dist/actions/register_action_ws.d.ts

@@ -188,7 +188,11 @@ export declare const ERROR_DUPLICATE_REQUEST_ID = "duplicate_request_id";
  * snapshot.
  */
 export interface SocketOpenContext {
-    /** The raw WebSocket context — exposed for edge cases; prefer `notify` for sends. */
+    /**
+     * The raw WebSocket context — exposed for edge cases; prefer `notify` for
+     * sends. A frame sent on it directly bypasses the connection's outbound
+     * budget and its ordering with queued frames.
+     */
     ws: WSContext;
     /** Connection id assigned by `BackendWebsocketTransport.register_pending`. */
     connection_id: Uuid;
@@ -301,6 +305,17 @@ export interface RegisterActionWsOptions {
      * @default DEFAULT_MAX_CONNECTIONS_PER_ACCOUNT
      */
     max_connections_per_account?: number | null;
+    /**
+     * Byte budget of the frames waiting to be written to one connection, for
+     * the transport this call creates — see
+     * `BackendWebsocketTransportOptions.outbound_queue_bytes` (a frame that does
+     * not fit closes the socket with `WS_CLOSE_OUTBOUND_OVERFLOW`). Not derived
+     * from `max_message_bytes`. Rejected alongside `transport`: a supplied
+     * transport carries its own budget, set where it was constructed.
+     *
+     * @default DEFAULT_WS_OUTBOUND_QUEUE_BYTES
+     */
+    outbound_queue_bytes?: number;
     /**
      * Server-side heartbeat policy. Default-on (receive-silence detection,
      * 60s timeout). `false` disables the timer entirely — only do this if
@@ -400,6 +415,10 @@ export interface RegisterActionWsResult {
  *   `WS_CLOSE_INTERNAL_ERROR`. Frames sent before admission wait for it.
  * - A socket the server has closed dispatches nothing more, whether or not
  *   its client answers the close.
+ * - Every frame sent — responses, error frames, notifications — goes through
+ *   the transport's outbound queue. A connection with more waiting than its
+ *   `outbound_queue_bytes` budget closes with `WS_CLOSE_OUTBOUND_OVERFLOW`, and
+ *   the response of the request whose handler overflowed it is not sent.
  *
  * @returns the transport (supplied or freshly created) — retain it to wire
  *   `create_ws_auth_guard` or broadcast on audit events.
@@ -408,8 +427,9 @@ export interface RegisterActionWsResult {
  *   connection via `register_pending` / `admit` / `remove_connection`
  * @mutates options.connection_closer - adds the endpoint's transport, once the
  *   mount has succeeded
- * @throws Error when `max_connections_per_account` is passed alongside
- *   `transport`, or is neither `null` nor a positive integer, or when
+ * @throws Error when `max_connections_per_account` or `outbound_queue_bytes`
+ *   is passed alongside `transport`, when the cap is neither `null` nor a
+ *   positive integer, when the budget is not a positive integer, or when
  *   `actions` fails to compile (`compile_action_registry`)
  */
 export declare const register_action_ws: (options: RegisterActionWsOptions) => RegisterActionWsResult;

package/dist/actions/register_action_ws.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register_action_ws.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/register_action_ws.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+FG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAE3D,OAAO,EAAU,KAAK,MAAM,IAAI,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAWnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAmBtD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAa7D,OAAO,EAAE,yBAAyB,EAAE,KAAK,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAIhG,0EAA0E;AAC1E,eAAO,MAAM,gCAAgC,QAAS,CAAC;AAEvD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAE5C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,gCAAgC,IAAI,CAAC;AAElD;;;GAGG;AACH,eAAO,MAAM,sCAAsC,2CAA2C,CAAC;AAE/F;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,qCAAqC,MAAM,CAAC;AAEzD;;;GAGG;AACH,eAAO,MAAM,oCAAoC,oDACC,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,yBAAyB,CAAC;AAsCjE;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IACjC,qFAAqF;IACrF,EAAE,EAAE,SAAS,CAAC;IACd,8EAA8E;IAC9E,aAAa,EAAE,IAAI,CAAC;IACpB,oDAAoD;IACpD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B;;;OAGG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IAClD;;;;;OAKG;IACH,MAAM,EAAE,WAAW,CAAC;CACpB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,kBAAkB;IAClC;;;;OAIG;IACH,EAAE,EAAE,SAAS,CAAC;IACd,2CAA2C;IAC3C,aAAa,EAAE,IAAI,CAAC;IACpB,8EAA8E;IAC9E,QAAQ,EAAE,kBAAkB,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAsB;IACtC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wCAAwC;AACxC,MAAM,WAAW,uBAAuB;IACvC,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,gCAAgC;IAChC,GAAG,EAAE,IAAI,CAAC;IACV,iEAAiE;IACjE,gBAAgB,EAAE,gBAAgB,CAAC;IACnC;;;;;;;OAOG;IACH,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B;;;;;;;;;OASG;IACH,EAAE,EAAE,EAAE,CAAC;IACP;;;;OAIG;IACH,SAAS,CAAC,EAAE,yBAAyB,CAAC;IACtC;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,EAAE,cAAc,GAAG,IAAI,CAAC;IACzC;;;;;;;;OAQG;IACH,2BAA2B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,sBAAsB,CAAC;IAC7C,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,kBAAkB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE;;;;;;;;OAQG;IACH,sBAAsB,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3C;;;;;;OAMG;IACH,2BAA2B,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD;AAED,sCAAsC;AACtC,MAAM,WAAW,sBAAsB;IACtC,yEAAyE;IACzE,SAAS,EAAE,yBAAyB,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,eAAO,MAAM,kBAAkB,GAAI,SAAS,uBAAuB,KAAG,sBA+vBrE,CAAC"}
+{"version":3,"file":"register_action_ws.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/register_action_ws.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+FG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAE3D,OAAO,EAAU,KAAK,MAAM,IAAI,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAWnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAmBtD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAa7D,OAAO,EAAE,yBAAyB,EAAE,KAAK,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAIhG,0EAA0E;AAC1E,eAAO,MAAM,gCAAgC,QAAS,CAAC;AAEvD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAE5C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,gCAAgC,IAAI,CAAC;AAElD;;;GAGG;AACH,eAAO,MAAM,sCAAsC,2CAA2C,CAAC;AAE/F;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,qCAAqC,MAAM,CAAC;AAEzD;;;GAGG;AACH,eAAO,MAAM,oCAAoC,oDACC,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,yBAAyB,CAAC;AA0CjE;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;OAIG;IACH,EAAE,EAAE,SAAS,CAAC;IACd,8EAA8E;IAC9E,aAAa,EAAE,IAAI,CAAC;IACpB,oDAAoD;IACpD,QAAQ,EAAE,kBAAkB,CAAC;IAC7B;;;OAGG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IAClD;;;;;OAKG;IACH,MAAM,EAAE,WAAW,CAAC;CACpB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,kBAAkB;IAClC;;;;OAIG;IACH,EAAE,EAAE,SAAS,CAAC;IACd,2CAA2C;IAC3C,aAAa,EAAE,IAAI,CAAC;IACpB,8EAA8E;IAC9E,QAAQ,EAAE,kBAAkB,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAsB;IACtC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wCAAwC;AACxC,MAAM,WAAW,uBAAuB;IACvC,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,gCAAgC;IAChC,GAAG,EAAE,IAAI,CAAC;IACV,iEAAiE;IACjE,gBAAgB,EAAE,gBAAgB,CAAC;IACnC;;;;;;;OAOG;IACH,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B;;;;;;;;;OASG;IACH,EAAE,EAAE,EAAE,CAAC;IACP;;;;OAIG;IACH,SAAS,CAAC,EAAE,yBAAyB,CAAC;IACtC;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,EAAE,cAAc,GAAG,IAAI,CAAC;IACzC;;;;;;;;OAQG;IACH,2BAA2B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C;;;;;;;;;OASG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,sBAAsB,CAAC;IAC7C,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,kBAAkB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE;;;;;;;;OAQG;IACH,sBAAsB,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3C;;;;;;OAMG;IACH,2BAA2B,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD;AAED,sCAAsC;AACtC,MAAM,WAAW,sBAAsB;IACtC,yEAAyE;IACzE,SAAS,EAAE,yBAAyB,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,eAAO,MAAM,kBAAkB,GAAI,SAAS,uBAAuB,KAAG,sBAqwBrE,CAAC"}

package/dist/actions/register_action_ws.js

@@ -185,9 +185,12 @@ export const WS_INBOUND_DISPATCH_OVERFLOW_MESSAGE = 'too many concurrent request
  * answered.
  */
 export const ERROR_DUPLICATE_REQUEST_ID = 'duplicate_request_id';
-/** Send one JSON-RPC error response frame on `ws`. */
-const send_error_response = (ws, id, error) => {
-    ws.send(JSON.stringify(create_jsonrpc_error_response(id, error)));
+/**
+ * Send one JSON-RPC error response frame to `connection_id` through the
+ * transport's outbound queue.
+ */
+const send_error_response = (transport, connection_id, id, error) => {
+    transport.send_to(connection_id, JSON.stringify(create_jsonrpc_error_response(id, error)));
 };
 /**
  * Whether a frame is a reply to a server-initiated request, in the shape the
@@ -248,6 +251,10 @@ const is_peer_response = (json) => {
  *   `WS_CLOSE_INTERNAL_ERROR`. Frames sent before admission wait for it.
  * - A socket the server has closed dispatches nothing more, whether or not
  *   its client answers the close.
+ * - Every frame sent — responses, error frames, notifications — goes through
+ *   the transport's outbound queue. A connection with more waiting than its
+ *   `outbound_queue_bytes` budget closes with `WS_CLOSE_OUTBOUND_OVERFLOW`, and
+ *   the response of the request whose handler overflowed it is not sent.
  *
  * @returns the transport (supplied or freshly created) — retain it to wire
  *   `create_ws_auth_guard` or broadcast on audit events.
@@ -256,8 +263,9 @@ const is_peer_response = (json) => {
  *   connection via `register_pending` / `admit` / `remove_connection`
  * @mutates options.connection_closer - adds the endpoint's transport, once the
  *   mount has succeeded
- * @throws Error when `max_connections_per_account` is passed alongside
- *   `transport`, or is neither `null` nor a positive integer, or when
+ * @throws Error when `max_connections_per_account` or `outbound_queue_bytes`
+ *   is passed alongside `transport`, when the cap is neither `null` nor a
+ *   positive integer, when the budget is not a positive integer, or when
  *   `actions` fails to compile (`compile_action_registry`)
  */
 export const register_action_ws = (options) => {
@@ -266,10 +274,16 @@ export const register_action_ws = (options) => {
         throw new Error(`register_action_ws: max_connections_per_account configures the transport created for ${options.path}, ` +
             'but a transport was supplied — set the cap on that BackendWebsocketTransport instead');
     }
+    if (options.transport && options.outbound_queue_bytes !== undefined) {
+        // a budget that silently did nothing would read as enforced
+        throw new Error(`register_action_ws: outbound_queue_bytes configures the transport created for ${options.path}, ` +
+            'but a transport was supplied — set the budget on that BackendWebsocketTransport instead');
+    }
     const { path, app, upgradeWebSocket, actions, db, heartbeat = true, artificial_delay = 0, max_message_bytes = DEFAULT_WS_MAX_MESSAGE_BYTES, log = new Logger('[ws]'), on_socket_open, on_socket_close, action_ip_rate_limiter, action_account_rate_limiter } = options;
     const transport = options.transport ??
         new BackendWebsocketTransport({
             max_connections_per_account: options.max_connections_per_account,
+            outbound_queue_bytes: options.outbound_queue_bytes,
             log
         });
     // Build the dispatcher's per-method lookup. Only request_response
@@ -442,12 +456,17 @@ export const register_action_ws = (options) => {
         // End the socket from the server side: unregister it and abort its
         // signal *now* — so nothing more dispatches and in-flight handlers
         // see `signal.aborted` while the close handshake is still in flight —
-        // then send the close frame.
+        // then send the close frame. The transport does all three for a
+        // connection it still holds, sending the close behind the waiting
+        // frames the socket has room for and under the close deadline; a socket
+        // whose connection is already gone has nothing waiting and is closed
+        // directly.
         const end_socket = (ws, code, reason) => {
-            if (captured_connection_id !== undefined) {
-                transport.remove_connection(captured_connection_id);
-            }
+            const closed = captured_connection_id !== undefined &&
+                transport.close_connection(captured_connection_id, code, reason);
             socket_abort_controller.abort();
+            if (closed)
+                return;
             try {
                 ws.close(code, reason);
             }
@@ -459,20 +478,22 @@ export const register_action_ws = (options) => {
         // close frame: a revocation closed its pending registration (the
         // transport sent the 4001), the shutdown did (the 1001 — so a refusal
         // during shutdown never sends a revocation's or a failure's code), or
-        // the client went away.
+        // the client went away. Its registration is gone too — the transport
+        // removed it with its close, `onClose` with the client's — and it is
+        // not removed again here: `remove_connection` is for a socket that has
+        // closed, and would drop the close deadline of one that has not.
         const refuse_upgrade = (ws, code, reason) => {
-            if (captured_connection_id !== undefined) {
-                transport.remove_connection(captured_connection_id);
-            }
             if (!socket_abort_controller.signal.aborted)
                 end_socket(ws, code, reason);
         };
         // Socket-scoped notification helper — routes to this socket only,
         // matches the `ctx.notify` semantics exposed to per-message handlers.
-        const notify_socket = (ws) => (notify_method, notify_params) => {
+        // Through the transport's outbound queue, like every other frame: a
+        // handler that notifies past the connection's budget closes it.
+        const notify_socket = (connection_id) => (notify_method, notify_params) => {
             try {
                 const notification = create_jsonrpc_notification(notify_method, to_jsonrpc_params(notify_params));
-                ws.send(JSON.stringify(notification));
+                transport.send_to(connection_id, JSON.stringify(notification));
             }
             catch (error) {
                 log.error('notify send failed:', notify_method, error);
@@ -564,7 +585,7 @@ export const register_action_ws = (options) => {
                         ws,
                         connection_id,
                         identity,
-                        notify: notify_socket(ws),
+                        notify: notify_socket(connection_id),
                         signal: socket_abort_controller.signal
                     });
                 }
@@ -573,12 +594,7 @@ export const register_action_ws = (options) => {
                     // an ended socket has no one to tell
                     if (phase_is('ended'))
                         return;
-                    try {
-                        send_error_response(ws, null, jsonrpc_error_messages.internal_error());
-                    }
-                    catch {
-                        // ignore — socket may already be dead
-                    }
+                    send_error_response(transport, connection_id, null, jsonrpc_error_messages.internal_error());
                     end_socket(ws, WS_CLOSE_INTERNAL_ERROR, 'socket bootstrap failed');
                     return;
                 }
@@ -592,7 +608,7 @@ export const register_action_ws = (options) => {
             phase = 'open';
             for (const frame of queued_frames.splice(0)) {
                 if (transport.is_registered(connection_id)) {
-                    handle_frame(frame.data, frame.ws, connection_id).then(frame.resolve, frame.reject);
+                    handle_frame(frame.data, connection_id).then(frame.resolve, frame.reject);
                 }
                 else {
                     frame.resolve();
@@ -601,19 +617,20 @@ export const register_action_ws = (options) => {
         };
         // Dispatch one inbound frame on an admitted, still-registered
         // connection.
-        const handle_frame = async (data, ws, connection_id) => {
+        const handle_frame = async (data, connection_id) => {
+            const send_error = (id, error) => send_error_response(transport, connection_id, id, error);
             let json;
             try {
                 json = JSON.parse(String(data));
             }
             catch (error) {
                 log.error('JSON parse error:', error);
-                send_error_response(ws, null, jsonrpc_error_messages.parse_error());
+                send_error(null, jsonrpc_error_messages.parse_error());
                 return;
             }
             // Batch JSON-RPC is not supported on the WebSocket path.
             if (Array.isArray(json)) {
-                send_error_response(ws, null, jsonrpc_error_messages.invalid_request('batch JSON-RPC requests are not supported on WebSocket'));
+                send_error(null, jsonrpc_error_messages.invalid_request('batch JSON-RPC requests are not supported on WebSocket'));
                 return;
             }
             // Inbound responses to server-initiated requests (`peer/ping`,
@@ -642,7 +659,7 @@ export const register_action_ws = (options) => {
             // falls through here on purpose, so it is answered rather
             // than swallowed.
             if (!is_jsonrpc_object(json)) {
-                send_error_response(ws, to_jsonrpc_envelope_id(json), jsonrpc_error_messages.invalid_request());
+                send_error(to_jsonrpc_envelope_id(json), jsonrpc_error_messages.invalid_request());
                 return;
             }
             // Notifications (string method + no id) — `cancel` is
@@ -671,7 +688,7 @@ export const register_action_ws = (options) => {
                     }
                     return;
                 }
-                send_error_response(ws, to_jsonrpc_message_id(json), jsonrpc_error_messages.invalid_request());
+                send_error(to_jsonrpc_message_id(json), jsonrpc_error_messages.invalid_request());
                 return;
             }
             // Envelope validation — the same `JsonrpcRequest.safeParse` the
@@ -684,7 +701,7 @@ export const register_action_ws = (options) => {
             // precedes it.
             const envelope = JsonrpcRequest.safeParse(json);
             if (!envelope.success) {
-                send_error_response(ws, to_jsonrpc_message_id(json), jsonrpc_error_messages.invalid_request(dev_only({ issues: envelope.error.issues })));
+                send_error(to_jsonrpc_message_id(json), jsonrpc_error_messages.invalid_request(dev_only({ issues: envelope.error.issues })));
                 return;
             }
             const { method, id, params } = envelope.data;
@@ -697,13 +714,13 @@ export const register_action_ws = (options) => {
             // `perform_action`, so neither charges the action rate limiters —
             // the same on the Rust spine.
             if (pending_controllers.has(id)) {
-                send_error_response(ws, id, jsonrpc_error_messages.invalid_request({ reason: ERROR_DUPLICATE_REQUEST_ID }));
+                send_error(id, jsonrpc_error_messages.invalid_request({ reason: ERROR_DUPLICATE_REQUEST_ID }));
                 return;
             }
             // The in-flight ceiling: shed, don't queue — see
             // `MAX_INBOUND_DISPATCHES_PER_CONNECTION`.
             if (pending_controllers.size >= MAX_INBOUND_DISPATCHES_PER_CONNECTION) {
-                send_error_response(ws, id, jsonrpc_error_messages.queue_overflow(WS_INBOUND_DISPATCH_OVERFLOW_MESSAGE));
+                send_error(id, jsonrpc_error_messages.queue_overflow(WS_INBOUND_DISPATCH_OVERFLOW_MESSAGE));
                 return;
             }
             // Per-action method lookup — return method_not_found before
@@ -712,7 +729,7 @@ export const register_action_ws = (options) => {
             // surface as method_not_found just like unknown methods.
             const action = action_map.get(method);
             if (!action) {
-                send_error_response(ws, id, jsonrpc_error_messages.method_not_found(method));
+                send_error(id, jsonrpc_error_messages.method_not_found(method));
                 return;
             }
             // Per-request controller — fires on explicit `cancel` or when the
@@ -745,14 +762,14 @@ export const register_action_ws = (options) => {
             // bearer) queues a close of this very socket on
             // `post_commit_effects` (`queue_connection_close`), and
             // the audit listeners repeat it from the same queue. The
-            // `ws.send` on the success path runs before the `finally`
+            // send on the success path runs before the `finally`
             // flushes that queue, so the caller reads its reply and
             // then the 4001 close. Inverting the order — flushing the
             // queues before the send — would strand the caller without
             // a reply.
             const pending_effects = [];
             const post_commit_effects = [];
-            const notify = notify_socket(ws);
+            const notify = notify_socket(connection_id);
             // Server→client request seam (ActionPeer) — closes over this
             // socket's connection_id so a handler can initiate a request to
             // the originating client and await the reply.
@@ -796,7 +813,10 @@ export const register_action_ws = (options) => {
                     log.error(`action result is not serializable: ${method}`, error);
                     frame = JSON.stringify(create_jsonrpc_error_response(id, jsonrpc_error_messages.internal_error(dev_only(error instanceof Error ? error.message : undefined))));
                 }
-                ws.send(frame);
+                // Refused when the connection is gone — closed while the handler
+                // ran, or closed by the handler's own notifications overflowing
+                // its outbound budget — so nothing follows a close frame.
+                transport.send_to(connection_id, frame);
             }
             finally {
                 pending_controllers.delete(id);
@@ -843,7 +863,7 @@ export const register_action_ws = (options) => {
                     queued_bytes += bytes;
                     last_receive_time = Date.now();
                     return new Promise((resolve, reject) => {
-                        queued_frames.push({ data: event.data, ws, resolve, reject });
+                        queued_frames.push({ data: event.data, resolve, reject });
                     });
                 }
                 // The transport is the authority on whether the connection is
@@ -860,7 +880,7 @@ export const register_action_ws = (options) => {
                 }
                 // only a frame that is accepted counts as activity
                 last_receive_time = Date.now();
-                return handle_frame(event.data, ws, connection_id);
+                return handle_frame(event.data, connection_id);
             },
             onClose: async (event, ws) => {
                 // belt and braces: the abort listener stops the timer and the

package/dist/actions/transports.d.ts

@@ -39,6 +39,29 @@ export declare const WS_CLOSE_SERVER_HEARTBEAT_TIMEOUT = 4003;
  * spine's `WS_CLOSE_CONNECTION_LIMIT`.
  */
 export declare const WS_CLOSE_CONNECTION_LIMIT = 4004;
+/**
+ * WebSocket close code — the server had more waiting to be written to this
+ * socket than the connection's outbound budget holds
+ * (`BackendWebsocketTransport`'s `outbound_queue_bytes`), because the client
+ * is reading slower than the server is sending to it, or not at all. The
+ * frame that did not fit and everything still waiting are dropped, so the
+ * close is the client's notice that it missed messages.
+ *
+ * Distinct from `WS_CLOSE_SESSION_REVOKED`: the credential is still good, so a
+ * client must not enter its `revoked` state. Unlike
+ * `WS_CLOSE_CONNECTION_LIMIT`, nothing took the connection's place:
+ * `FrontendWebsocketClient` reconnects under its ordinary backoff, and the
+ * consumer re-reads whatever state it tracks. A client that reads nothing at
+ * all may never see the frame — a socket whose write makes no progress is
+ * dropped without one, which a browser reports as 1006. The twin of the Rust
+ * spine's `WS_CLOSE_OUTBOUND_OVERFLOW`.
+ */
+export declare const WS_CLOSE_OUTBOUND_OVERFLOW = 4005;
+/**
+ * The close reason sent with `WS_CLOSE_OUTBOUND_OVERFLOW`. The Rust spine
+ * sends the same text.
+ */
+export declare const WS_CLOSE_OUTBOUND_OVERFLOW_REASON = "outbound queue overflow";
 /**
  * WebSocket close code — the server is shutting down (RFC 6455 §7.4.1 "Going
  * Away"). Sent to every live socket by `close_all_sockets`, which

package/dist/actions/transports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transports.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/transports.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EACX,gCAAgC,EAChC,gCAAgC,EAChC,mBAAmB,EACnB,cAAc,EACd,sBAAsB,EACtB,oBAAoB,EACpB,MAAM,oBAAoB,CAAC;AAE5B;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAC7C;;;;GAIG;AACH,eAAO,MAAM,+BAA+B,oBAAoB,CAAC;AACjE,sEAAsE;AACtE,eAAO,MAAM,iCAAiC,OAAO,CAAC;AACtD,yEAAyE;AACzE,eAAO,MAAM,iCAAiC,OAAO,CAAC;AACtD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAC9C;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,OAAO,CAAC;AACxC,wDAAwD;AACxD,eAAO,MAAM,0BAA0B,yBAAyB,CAAC;AACjE;;;GAGG;AACH,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAC7C;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAC9C;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAE5C;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,QAAc,CAAC;AAIxD;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,GAAI,MAAM,MAAM,EAAE,WAAW,MAAM,KAAG,MAAM,GAAG,IAI3E,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,MAAM,MAAM,KAAG,MAA8C,CAAC;AAK1F,eAAO,MAAM,aAAa,aAAa,CAAC;AACxC,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACpC;;;;;OAKG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACzB,cAAc,EAAE,aAAa,CAAC;IAE9B,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/F,IAAI,CACH,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IACxC,IAAI,CACH,OAAO,EAAE,gCAAgC,EACzC,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,gCAAgC,GAAG,IAAI,CAAC,CAAC;IACpD,QAAQ,EAAE,MAAM,OAAO,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;CACrB;AAED,qBAAa,UAAU;;IAItB;;;OAGG;IACH,cAAc,EAAE,OAAO,CAAQ;IAE/B;;;;;OAKG;IACH,kBAAkB,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI;IAQ9C;;;;;OAKG;IACH,qBAAqB,CAAC,cAAc,EAAE,aAAa,GAAG,IAAI;IAM1D;;;;;;OAMG;IACH,aAAa,CAAC,cAAc,CAAC,EAAE,aAAa,GAAG,SAAS,GAAG,IAAI;IAO/D,QAAQ,IAAI,OAAO,GAAG,IAAI;IAM1B,qBAAqB,IAAI,SAAS,GAAG,IAAI;IAIzC,0BAA0B,IAAI,aAAa,GAAG,IAAI;IAIlD,qBAAqB,CAAC,cAAc,EAAE,aAAa,GAAG,SAAS,GAAG,IAAI;CAwCtE"}
+{"version":3,"file":"transports.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/transports.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EACX,gCAAgC,EAChC,gCAAgC,EAChC,mBAAmB,EACnB,cAAc,EACd,sBAAsB,EACtB,oBAAoB,EACpB,MAAM,oBAAoB,CAAC;AAE5B;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAC7C;;;;GAIG;AACH,eAAO,MAAM,+BAA+B,oBAAoB,CAAC;AACjE,sEAAsE;AACtE,eAAO,MAAM,iCAAiC,OAAO,CAAC;AACtD,yEAAyE;AACzE,eAAO,MAAM,iCAAiC,OAAO,CAAC;AACtD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAC9C;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAC/C;;;GAGG;AACH,eAAO,MAAM,iCAAiC,4BAA4B,CAAC;AAC3E;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,OAAO,CAAC;AACxC,wDAAwD;AACxD,eAAO,MAAM,0BAA0B,yBAAyB,CAAC;AACjE;;;GAGG;AACH,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAC7C;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAC9C;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAE5C;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,QAAc,CAAC;AAIxD;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,GAAI,MAAM,MAAM,EAAE,WAAW,MAAM,KAAG,MAAM,GAAG,IAI3E,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,MAAM,MAAM,KAAG,MAA8C,CAAC;AAK1F,eAAO,MAAM,aAAa,aAAa,CAAC;AACxC,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACpC;;;;;OAKG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACzB,cAAc,EAAE,aAAa,CAAC;IAE9B,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/F,IAAI,CACH,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IACxC,IAAI,CACH,OAAO,EAAE,gCAAgC,EACzC,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,gCAAgC,GAAG,IAAI,CAAC,CAAC;IACpD,QAAQ,EAAE,MAAM,OAAO,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;CACrB;AAED,qBAAa,UAAU;;IAItB;;;OAGG;IACH,cAAc,EAAE,OAAO,CAAQ;IAE/B;;;;;OAKG;IACH,kBAAkB,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI;IAQ9C;;;;;OAKG;IACH,qBAAqB,CAAC,cAAc,EAAE,aAAa,GAAG,IAAI;IAM1D;;;;;;OAMG;IACH,aAAa,CAAC,cAAc,CAAC,EAAE,aAAa,GAAG,SAAS,GAAG,IAAI;IAO/D,QAAQ,IAAI,OAAO,GAAG,IAAI;IAM1B,qBAAqB,IAAI,SAAS,GAAG,IAAI;IAIzC,0BAA0B,IAAI,aAAa,GAAG,IAAI;IAIlD,qBAAqB,CAAC,cAAc,EAAE,aAAa,GAAG,SAAS,GAAG,IAAI;CAwCtE"}

package/dist/actions/transports.js

@@ -38,6 +38,29 @@ export const WS_CLOSE_SERVER_HEARTBEAT_TIMEOUT = 4003;
  * spine's `WS_CLOSE_CONNECTION_LIMIT`.
  */
 export const WS_CLOSE_CONNECTION_LIMIT = 4004;
+/**
+ * WebSocket close code — the server had more waiting to be written to this
+ * socket than the connection's outbound budget holds
+ * (`BackendWebsocketTransport`'s `outbound_queue_bytes`), because the client
+ * is reading slower than the server is sending to it, or not at all. The
+ * frame that did not fit and everything still waiting are dropped, so the
+ * close is the client's notice that it missed messages.
+ *
+ * Distinct from `WS_CLOSE_SESSION_REVOKED`: the credential is still good, so a
+ * client must not enter its `revoked` state. Unlike
+ * `WS_CLOSE_CONNECTION_LIMIT`, nothing took the connection's place:
+ * `FrontendWebsocketClient` reconnects under its ordinary backoff, and the
+ * consumer re-reads whatever state it tracks. A client that reads nothing at
+ * all may never see the frame — a socket whose write makes no progress is
+ * dropped without one, which a browser reports as 1006. The twin of the Rust
+ * spine's `WS_CLOSE_OUTBOUND_OVERFLOW`.
+ */
+export const WS_CLOSE_OUTBOUND_OVERFLOW = 4005;
+/**
+ * The close reason sent with `WS_CLOSE_OUTBOUND_OVERFLOW`. The Rust spine
+ * sends the same text.
+ */
+export const WS_CLOSE_OUTBOUND_OVERFLOW_REASON = 'outbound queue overflow';
 /**
  * WebSocket close code — the server is shutting down (RFC 6455 §7.4.1 "Going
  * Away"). Sent to every live socket by `close_all_sockets`, which