@memberjunction/server 6.2.0-edge.4 → 6.2.0-edge.6

package/src/__tests__/scalabilityDatabaseIntegration.test.ts

@@ -0,0 +1,207 @@
+import 'reflect-metadata';
+import { describe, it, expect, beforeAll, afterAll, vi } from 'vitest';
+import sql from 'mssql';
+import { RunViewParams, RunViewResult, SetProvider, UserInfo } from '@memberjunction/core';
+import { GenericDatabaseProvider, UserCache } from '@memberjunction/generic-database-provider';
+import { SQLServerDataProvider, SQLServerProviderConfigData } from '@memberjunction/sqlserver-dataprovider';
+import {
+    CacheInvalidationBroadcastManager,
+    SequencedRoleBucketBroadcastProvider,
+} from '../broadcast/index.js';
+
+const IT_DB_NAME = process.env.MJ_IT_DB;
+
+describe.skipIf(!IT_DB_NAME)('MJServer Scalability Architecture — Live SQL Server Integration', () => {
+    let pool: sql.ConnectionPool;
+    let sharedProvider: SQLServerDataProvider;
+    let sysUser: UserInfo;
+
+    beforeAll(async () => {
+        pool = new sql.ConnectionPool({
+            server: process.env.MJ_IT_HOST || 'localhost',
+            port: parseInt(process.env.MJ_IT_PORT || '1433', 10),
+            database: IT_DB_NAME,
+            user: process.env.MJ_IT_USER || 'sa',
+            password: process.env.MJ_IT_PASSWORD || 'GHWUc7QKZNT8GQiqnJHdEPonPcukY2WA',
+            options: {
+                encrypt: false,
+                trustServerCertificate: true,
+            },
+        });
+        await pool.connect();
+
+        sharedProvider = new SQLServerDataProvider();
+        const config = new SQLServerProviderConfigData(pool, '__mj', 0);
+        await sharedProvider.Config(config);
+        SetProvider(sharedProvider);
+        await UserCache.Instance.Refresh(sharedProvider, 0);
+
+        const foundUser =
+            UserCache.Instance.GetSystemUser() ||
+            UserCache.Instance.Users.find((u) => u.IsActive && u.Type === 'Owner') ||
+            UserCache.Instance.Users[0];
+        if (!foundUser) {
+            throw new Error(`No user found in ${IT_DB_NAME}`);
+        }
+        sysUser = foundUser;
+    }, 60_000);
+
+    afterAll(async () => {
+        if (pool?.connected) {
+            await pool.close();
+        }
+    });
+
+    it('creates per-request SQLServerDataProvider with zero-copy prototype-delegated metadata shell and lazy transaction queues', async () => {
+        const reqProvider = new SQLServerDataProvider();
+        const reqConfig = new SQLServerProviderConfigData(
+            pool,
+            '__mj',
+            0,
+            undefined,
+            undefined,
+            false // ignoreExistingMetadata = false -> reuses shared metadata shell
+        );
+        await reqProvider.Config(reqConfig);
+
+        // Verify lazy RxJS Subjects are NOT allocated on a read-only request provider
+        const internal = reqProvider as unknown as {
+            _sqlQueue$: unknown;
+            _transactionState$: unknown;
+        };
+
+        expect(internal._sqlQueue$).toBeNull();
+        expect(internal._transactionState$).toBeNull();
+
+        // Verify zero-copy prototype delegation to shared metadata
+        expect(Object.getPrototypeOf(reqProvider.AllMetadata)).toBe(sharedProvider.AllMetadata);
+        expect(reqProvider.Entities.length).toBeGreaterThan(50);
+        expect(reqProvider.Entities).toBe(sharedProvider.Entities);
+    });
+
+    it('coalesces 10 concurrent identical InternalRunView calls against SQL Server into a single SQL execution and isolates result mutations', async () => {
+        // Warm up the view column order cache for vwEntities (must return >=1 row so sortViewRowKeys caches sys.columns)
+        await sharedProvider.RunView(
+            {
+                EntityName: 'MJ: Entities',
+                ExtraFilter: "Name = 'MJ: Entities'",
+                ResultType: 'simple',
+                IgnoreMaxRows: true,
+            },
+            sysUser
+        );
+
+        const executeSpy = vi.spyOn(sharedProvider, 'ExecuteSQL');
+        const internalRunner = sharedProvider as unknown as {
+            InternalRunView<T>(params: RunViewParams, contextUser?: UserInfo): Promise<RunViewResult<T>>;
+        };
+
+        try {
+            const concurrentCount = 10;
+            const promises = Array.from({ length: concurrentCount }, () =>
+                internalRunner.InternalRunView<Record<string, unknown>>(
+                    {
+                        EntityName: 'MJ: Entities',
+                        ExtraFilter: "SchemaName = '__mj' AND Name LIKE 'MJ: %'",
+                        OrderBy: 'Name ASC',
+                        IgnoreMaxRows: true,
+                        ResultType: 'simple',
+                    },
+                    sysUser
+                )
+            );
+
+            const results = await Promise.all(promises);
+
+            // Only 1 physical SQL execution should have been issued for the 10 identical concurrent views
+            expect(executeSpy).toHaveBeenCalledTimes(1);
+
+            for (const res of results) {
+                expect(res.Success).toBe(true);
+                expect(res.Results.length).toBeGreaterThan(0);
+            }
+
+            // Mutating caller 0's result array or row object must not affect caller 1's result
+            const originalName = results[1].Results[0].Name;
+            const originalLength = results[1].Results.length;
+            results[0].Results[0].Name = 'MUTATED_IN_CALLER_0';
+            results[0].Results.pop();
+
+            expect(results[1].Results[0].Name).toBe(originalName);
+            expect(results[0].Results.length).toBe(originalLength - 1);
+            expect(results[1].Results.length).toBe(originalLength);
+        } finally {
+            executeSpy.mockRestore();
+        }
+    });
+
+    it('bounds concurrent SQL executions in RunViews to MaxConcurrentViewsPerBatch', async () => {
+        let activeCount = 0;
+        let maxObservedConcurrency = 0;
+
+        const originalExecuteSQL = sharedProvider.ExecuteSQL.bind(sharedProvider);
+        const executeSpy = vi.spyOn(sharedProvider, 'ExecuteSQL').mockImplementation(async (query, params, options, contextUser) => {
+            activeCount++;
+            if (activeCount > maxObservedConcurrency) {
+                maxObservedConcurrency = activeCount;
+            }
+            try {
+                return await originalExecuteSQL(query, params, options, contextUser);
+            } finally {
+                activeCount--;
+            }
+        });
+
+        try {
+            const batchParams = Array.from({ length: 16 }, (_, idx) => ({
+                EntityName: 'MJ: Entities',
+                ExtraFilter: `SchemaName = '__mj' AND UserViewMaxRows IS NULL AND ${idx} = ${idx}`,
+                IgnoreMaxRows: true,
+                ResultType: 'simple' as const,
+            }));
+
+            const batchResults = await sharedProvider.RunViews(batchParams, sysUser);
+            expect(batchResults).toHaveLength(16);
+            for (const r of batchResults) {
+                expect(r.Success).toBe(true);
+            }
+            expect(maxObservedConcurrency).toBeLessThanOrEqual(GenericDatabaseProvider.MaxConcurrentViewsPerBatch);
+            expect(maxObservedConcurrency).toBeGreaterThan(1);
+        } finally {
+            executeSpy.mockRestore();
+        }
+    });
+
+    it('sequences and shapes cache invalidation broadcasts against live entity metadata and replays delta catch-up', async () => {
+        const provider = CacheInvalidationBroadcastManager.Instance.Configure({
+            provider: 'SequencedRoleBucket',
+            ringBufferSize: 500,
+        }) as SequencedRoleBucketBroadcastProvider;
+        expect(provider).toBeInstanceOf(SequencedRoleBucketBroadcastProvider);
+
+        const baseSeq = provider.CurrentSequence;
+        const entityInfo = sharedProvider.Entities.find((e) => e.Name === 'MJ: Entities');
+        expect(entityInfo).toBeDefined();
+
+        const published = provider.RecordInvalidation({
+            entityName: 'MJ: Entities',
+            primaryKeyValues: JSON.stringify([{ FieldName: 'ID', Value: entityInfo!.ID }]),
+            action: 'save',
+            sourceServerId: 'it-server-node-1',
+            timestamp: new Date(),
+            recordData: JSON.stringify({ ID: entityInfo!.ID, Name: entityInfo!.Name }),
+        });
+
+        expect(published.sequence).toBe(baseSeq + 1);
+        expect(provider.CurrentSequence).toBe(baseSeq + 1);
+
+        // Verify delta catch-up shapes payload for sysUser against real MJ: Entities metadata
+        const catchUp = provider.GetChangesSince(baseSeq, sysUser);
+        expect(catchUp.RequiresFullRefresh).toBe(false);
+        expect(catchUp.CurrentSequence).toBe(baseSeq + 1);
+        expect(catchUp.Events).toHaveLength(1);
+        expect(catchUp.Events[0].EntityName).toBe('MJ: Entities');
+        expect(catchUp.Events[0].Sequence).toBe(baseSeq + 1);
+        expect(catchUp.Events[0].RecordData).toContain(entityInfo!.Name);
+    });
+});

package/src/__tests__/serverExtensionHostOverlay.test.ts

@@ -0,0 +1,66 @@
+/**
+ * A host mj.config.cjs serverExtensions[] entry may be a partial OVERLAY of an extension an Open App
+ * package publishes: only DriverClass is required. The schema used to require RootPath and default
+ * Enabled to true, so `{ DriverClass, OwnsCORS: false }` failed config parsing at startup, and an
+ * overlay that omitted Enabled re-enabled an extension its package ships disabled. Completeness is
+ * checked after the merge instead.
+ */
+import { describe, it, expect, vi } from 'vitest';
+
+// config.ts evaluates `configInfo = LoadConfig()` at module load, and it rejects a configuration
+// carrying no database credentials. Stubbing only the cosmiconfig search lets the module import so the
+// REAL ServerExtensionSchema is under test (same pattern as newUserRolesDefault.test.ts).
+vi.mock('cosmiconfig', () => ({
+    cosmiconfigSync: () => ({
+        search: () => ({
+            filepath: '/test/mj.config.cjs',
+            isEmpty: false,
+            config: { dbUsername: 'test-user', dbPassword: 'test-password', dbDatabase: 'test-db' },
+        }),
+    }),
+}));
+
+import { MergeServerExtensionConfigs, PrepareServerExtensionConfigs } from '@memberjunction/server-extensions-core';
+import type { ServerExtensionConfig } from '@memberjunction/server-extensions-core';
+import { ServerExtensionSchema } from '../config.js';
+
+const published: ServerExtensionConfig = {
+    Enabled: true,
+    DriverClass: 'BallotEdge',
+    RootPath: '/vote',
+    OwnsCORS: true,
+    Settings: { RateLimitMax: 20 },
+};
+
+describe('host serverExtensions[] overlay schema', () => {
+    it('accepts an overlay that names only DriverClass and the fields it overrides', () => {
+        const parsed = ServerExtensionSchema.safeParse({ DriverClass: 'BallotEdge', OwnsCORS: false });
+        expect(parsed.success).toBe(true);
+        expect(parsed.success && parsed.data.RootPath).toBeUndefined();
+        expect(parsed.success && parsed.data.Enabled).toBeUndefined();
+    });
+
+    it('merges the overlay onto the published entry without losing RootPath or Enabled', () => {
+        const overlay = ServerExtensionSchema.parse({ DriverClass: 'BallotEdge', OwnsCORS: false, Settings: { RateLimitMax: 2000 } });
+        const [merged] = MergeServerExtensionConfigs([published], [overlay as ServerExtensionConfig]);
+        expect(merged).toMatchObject({ DriverClass: 'BallotEdge', RootPath: '/vote', Enabled: true, OwnsCORS: false });
+        expect(merged.Settings).toEqual({ RateLimitMax: 2000 });
+    });
+
+    it('does not re-enable an extension the package ships disabled', () => {
+        const overlay = ServerExtensionSchema.parse({ DriverClass: 'BallotEdge', Settings: { RateLimitMax: 5 } });
+        const [merged] = MergeServerExtensionConfigs([{ ...published, Enabled: false }], [overlay as ServerExtensionConfig]);
+        expect(merged.Enabled).toBe(false);
+    });
+
+    it('still rejects a host-only entry without a RootPath, after the merge', () => {
+        const overlay = ServerExtensionSchema.parse({ DriverClass: 'NotPublishedAnywhere' });
+        const problems: string[] = [];
+        const prepared = PrepareServerExtensionConfigs(
+            MergeServerExtensionConfigs([published], [overlay as ServerExtensionConfig]),
+            { onInvalid: (message: string) => problems.push(message) },
+        );
+        expect(prepared.map(c => c.DriverClass)).toEqual(['BallotEdge']);
+        expect(problems.some(p => p.includes('NotPublishedAnywhere') && p.includes('RootPath is empty'))).toBe(true);
+    });
+});

package/src/__tests__/serverExtensionReservedRoots.test.ts

@@ -1,8 +1,8 @@
 /**
  * Pins the reserved-root set passed into prepareServerExtensionConfigs.
- * A new public mount in index.ts / a drifted `*_MOUNT_PATH` constant is a
- * contract failure — this file reads those sources as text so it never loads
- * `config.ts`.
+ * A drifted `*_MOUNT_PATH` constant is a contract failure — this file reads those
+ * sources as text so it never loads `config.ts`. That every core mount is reserved
+ * is checked against the real mounts in apiRootBoot.test.ts.
  */
 import { describe, it, expect } from 'vitest';
 import { readFileSync } from 'node:fs';
@@ -26,11 +26,6 @@ function exportedStringConst(relativeFile: string, name: string): string {
     return match[1];
 }
 
-function indexContainsLiteralPath(path: string): boolean {
-    const src = readFileSync(join(SRC, 'index.ts'), 'utf8');
-    return src.includes(`'${path}'`) || src.includes(`\`${path}\``) || src.includes(path.replace(/^\//, ''));
-}
-
 describe('coreReservedServerExtensionRoots', () => {
     it('stays in lockstep with exported *_MOUNT_PATH constants', () => {
         expect(CORE_CONSTANT_RESERVED_SERVER_EXTENSION_ROOTS).toEqual([
@@ -40,92 +35,11 @@ describe('coreReservedServerExtensionRoots', () => {
         ]);
     });
 
-    it('includes the literal pre-auth paths serve() registers without a constant', () => {
-        const indexSrc = readFileSync(join(SRC, 'index.ts'), 'utf8');
-        for (const path of CORE_STATIC_RESERVED_SERVER_EXTENSION_ROOTS) {
-            if (path === '/health') {
-                expect(indexSrc, `${path} missing from serve()`).toContain("'/health/extensions'");
-            } else if (path === '/realtime') {
-                expect(indexSrc, `${path} missing from serve()`).toMatch(/REALTIME_SDP_EXCHANGE_PATH|'\/realtime'/);
-            } else if (path === '/realtime-proxy') {
-                expect(indexSrc, `${path} missing from serve()`).toContain('/realtime-proxy');
-            } else {
-                expect(indexSrc, `${path} missing from serve()`).toContain(`'${path}'`);
-            }
-        }
-        expect(indexContainsLiteralPath('/healthcheck')).toBe(true);
-    });
-
-    it('structurally guarantees every pre-auth app.use / app.get / app.post mount in index.ts is reserved', () => {
-        const indexSrc = readFileSync(join(SRC, 'index.ts'), 'utf8');
-        const authMiddlewareIndex = indexSrc.indexOf('app.use(CreateUnifiedAuthMiddleware');
-        expect(authMiddlewareIndex).toBeGreaterThan(0);
-        const preAuthSrc = indexSrc.substring(0, authMiddlewareIndex);
-
-        const mountRegex = /app\.(?:use|get|post)\s*\(\s*([^,\s)]+)/g;
-        const reservedRoots = CoreReservedServerExtensionRoots('/');
-
-        // Explicit allowlist of known non-path middleware mounts (e.g. app.use(mw), app.use(cors()), app.use(compression(...)))
-        const knownNonPathTokens = [
-            'cors',
-            'express.',
-            'compression',
-            'cookieParser',
-            'CreateUnifiedAuthMiddleware',
-            'mw',
-        ];
-        const isKnownNonPath = (t: string): boolean =>
-            knownNonPathTokens.some(k => t === k || t.startsWith(k));
-
-        // Strip single-line and multi-line comments so comments like `app.use(...)` are not treated as code
-        const cleanPreAuthSrc = preAuthSrc.replace(/\/\*[\s\S]*?\*\/|\/\/.*/g, '');
-
-        let match: RegExpExecArray | null;
-        const mountedTokens: string[] = [];
-        while ((match = mountRegex.exec(cleanPreAuthSrc)) !== null) {
-            mountedTokens.push(match[1].trim());
-        }
-
-        expect(mountedTokens.length).toBeGreaterThan(0);
-
-        const knownConstants: Record<string, string> = {
-            REALTIME_SDP_EXCHANGE_PATH: '/realtime',
-            // Public verify-link routes for realtime identity verification; under the reserved '/realtime' root.
-            REALTIME_VERIFY_MOUNT_PATH: '/realtime/verify',
-            MAGIC_LINK_MOUNT_PATH: '/magic-link',
-            WIDGET_MOUNT_PATH: '/widget',
-            AUTH_CATALOG_MOUNT_PATH: '/auth',
-        };
-
-        for (const token of mountedTokens) {
-            const isLiteralPath = token.startsWith("'") || token.startsWith('"') || token.startsWith('`');
-            const isPathConstant = /^[A-Z0-9_]+_PATH$/.test(token) || token in knownConstants;
-            if (!isLiteralPath && !isPathConstant) {
-                if (isKnownNonPath(token)) {
-                    continue;
-                }
-                throw new Error(`Unrecognized pre-auth mount argument '${token}' in index.ts. If this is a non-path middleware, add it to knownNonPathTokens; if it is a route, reserve its prefix or map its constant.`);
-            }
-
-            let pathPrefix: string;
-            if (isLiteralPath) {
-                pathPrefix = token.slice(1, -1);
-            } else if (token in knownConstants) {
-                pathPrefix = knownConstants[token];
-            } else {
-                throw new Error(`Unrecognized pre-auth mount constant '${token}' in index.ts. If this is a new pre-auth route, map its constant or reserve its prefix.`);
-            }
-
-            const isCovered = reservedRoots.some(root => pathPrefix === root || pathPrefix.startsWith(`${root}/`));
-            expect(isCovered, `Pre-auth mount '${pathPrefix}' (from token '${token}') must be covered by reserved roots`).toBe(true);
-        }
-    });
-
-    it('includes graphqlRootPath and every core mount', () => {
-        const roots = CoreReservedServerExtensionRoots('/api');
+    it('includes every core mount, and no longer graphqlRootPath', () => {
+        const roots = CoreReservedServerExtensionRoots();
+        expect(roots).not.toContain('/api');
         expect(roots).toEqual(
             expect.arrayContaining([
-                '/api',
                 '/auth',
                 '/magic-link',
                 '/widget',
@@ -141,7 +55,7 @@ describe('coreReservedServerExtensionRoots', () => {
     });
 
     it('closes the F-M2 bypasses: cased /auth and sibling /healthcheck', () => {
-        const extra = CoreReservedServerExtensionRoots('/');
+        const extra = CoreReservedServerExtensionRoots();
         expect(validateServerExtensionRootPath('/Auth', extra)).toMatch(/reserved prefix/);
         expect(validateServerExtensionRootPath('/healthcheck', extra)).toMatch(/reserved prefix/);
         expect(validateServerExtensionRootPath('/Healthcheck', extra)).toMatch(/reserved prefix/);
@@ -157,10 +71,9 @@ describe('coreReservedServerExtensionRoots', () => {
         expect(validateServerExtensionRootPath('/meetings/teams', extra)).toBeNull();
     });
 
-    it('reserves a non-default graphqlRootPath and its nested paths', () => {
-        const extra = CoreReservedServerExtensionRoots('/api');
-        expect(validateServerExtensionRootPath('/api', extra)).toMatch(/reserved prefix/);
-        expect(validateServerExtensionRootPath('/api/graphql', extra)).toMatch(/reserved prefix/);
-        expect(validateServerExtensionRootPath('/apiv2', extra)).toBeNull();
+    it('lets extensions sit under the GraphQL path (#5674): RootPaths are relative to MJAPI_BASE_PATH', () => {
+        const extra = CoreReservedServerExtensionRoots();
+        expect(validateServerExtensionRootPath('/api', extra)).toBeNull();
+        expect(validateServerExtensionRootPath('/forms', extra)).toBeNull();
     });
 });

package/src/__tests__/sessionUserClone.test.ts

@@ -43,6 +43,7 @@ function buildSourceUser(): UserInfo {
   user.ReturningVisitorContext = { VisitorKey: 'vk-1' };
   user.WidgetGuestContext = { WidgetID: 'W0000000-0000-0000-0000-000000000001' };
   user.IsMagicLinkAnonymous = true;
+  user.AnonymousVisitorID = 'visitor-sid-1';
   return user;
 }
 
@@ -99,13 +100,14 @@ describe('CloneUserForSessionContext', () => {
     expect(clone.APIKeyRowFilters).toHaveLength(1);
   });
 
-  it('preserves ReturningVisitorContext, WidgetGuestContext, and IsMagicLinkAnonymous', () => {
+  it('preserves ReturningVisitorContext, WidgetGuestContext, IsMagicLinkAnonymous, and AnonymousVisitorID', () => {
     const source = buildSourceUser();
     const clone = CloneUserForSessionContext(source);
 
     expect(clone.ReturningVisitorContext).toEqual({ VisitorKey: 'vk-1' });
     expect(clone.WidgetGuestContext).toEqual({ WidgetID: 'W0000000-0000-0000-0000-000000000001' });
     expect(clone.IsMagicLinkAnonymous).toBe(true);
+    expect(clone.AnonymousVisitorID).toBe('visitor-sid-1');
   });
 
   it('stamping new contexts on the clone does NOT write through to the source', () => {
@@ -120,6 +122,7 @@ describe('CloneUserForSessionContext', () => {
     clone.APIKeyActingContext = { ActingOrganizationID: 'ORG-OTHER' };
     clone.APIKeyRowFilters = newBindings;
     clone.IsMagicLinkAnonymous = false;
+    clone.AnonymousVisitorID = 'visitor-sid-OTHER';
 
     // The source (potentially the shared UserCache instance) must be untouched
     expect(source.TenantContext).toEqual({ TenantID: 'tenant-1', Source: 'header' });
@@ -128,6 +131,7 @@ describe('CloneUserForSessionContext', () => {
     expect(source.APIKeyRowFilters).toHaveLength(1);
     expect(source.APIKeyRowFilters?.[0].FilterID).toBe('F0000000-0000-0000-0000-000000000001');
     expect(source.IsMagicLinkAnonymous).toBe(true);
+    expect(source.AnonymousVisitorID).toBe('visitor-sid-1');
   });
 
   it('clearing contexts on the clone does NOT clear them on the source', () => {

package/src/__tests__/sharedCache.test.ts

@@ -45,7 +45,7 @@ import { RedisLocalStorageProvider } from '@memberjunction/redis-provider';
 import type { CacheSettingsConfig } from '../config.js';
 
 function settings(overrides: Partial<CacheSettingsConfig>): CacheSettingsConfig {
-    return { maxMemoryMB: 150, maxPercentOfCachePerEntity: 50, defaultTTLSeconds: 0, evictionSweepIntervalSeconds: 300, verboseLogging: false, engineSweepIntervalSeconds: 300, ...overrides };
+    return { maxMemoryMB: 150, maxPercentOfCachePerEntity: 50, maxEntryPercentOfCache: 'auto', defaultTTLSeconds: 0, evictionSweepIntervalSeconds: 300, verboseLogging: false, engineSweepIntervalSeconds: 300, ...overrides };
 }
 
 function event(overrides: Partial<CacheChangedEvent>): CacheChangedEvent {
@@ -117,9 +117,11 @@ describe('shared cache configuration', () => {
     });
 
     it('maps cacheSettings onto LocalCacheManager settings', () => {
-        expect(CacheManagerConfigFromSettings(settings({ maxMemoryMB: 10, maxPercentOfCachePerEntity: 20, defaultTTLSeconds: 5, evictionSweepIntervalSeconds: 7, verboseLogging: true })))
-            .toEqual({ maxSizeBytes: 10 * 1024 * 1024, maxPercentOfCachePerEntity: 20, defaultTTLMs: 5000, evictionSweepIntervalMs: 7000, verboseLogging: true });
+        expect(CacheManagerConfigFromSettings(settings({ maxMemoryMB: 10, maxPercentOfCachePerEntity: 20, maxEntryPercentOfCache: 40, defaultTTLSeconds: 5, evictionSweepIntervalSeconds: 7, verboseLogging: true })))
+            .toEqual({ maxSizeBytes: 10 * 1024 * 1024, maxPercentOfCachePerEntity: 20, maxEntryPercentOfCache: 40, defaultTTLMs: 5000, evictionSweepIntervalMs: 7000, verboseLogging: true });
         expect(CacheManagerConfigFromSettings(undefined).maxSizeBytes).toBe(150 * 1024 * 1024);
+        // The per-entry ceiling reaches the cache, and an unset one is derived rather than a fixed fraction.
+        expect(CacheManagerConfigFromSettings(undefined).maxEntryPercentOfCache).toBe('auto');
     });
 
     it('starts the engine sweep at the configured interval, off when 0', () => {

package/src/__tests__/startupSweepOrder.test.ts

@@ -0,0 +1,40 @@
+/**
+ * `SweepInterruptedRuns` closes out run artifacts a dead process left open. It is only sound
+ * BEFORE anything in this process can start a run: a run started first is still in flight when
+ * the sweep looks, so the sweep marks a live run "killed" and the wizard and active-operations
+ * panel report a failure for work that is still going.
+ *
+ * Booting the server is far too heavy for a unit test, so this pins the order in the source:
+ * the sweep is awaited before the scheduler, the integration sync worker (whose Start() polls
+ * immediately), the HTTP listener, and pending RSU work.
+ */
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { describe, expect, it } from 'vitest';
+
+const source = readFileSync(join(__dirname, '..', 'index.ts'), 'utf8')
+    .replace(/\/\*[\s\S]*?\*\//g, '')
+    .replace(/^\s*\/\/.*$/gm, '');
+
+function at(needle: string): number {
+    const i = source.indexOf(needle);
+    expect(i, `not found in index.ts: ${needle}`).toBeGreaterThan(-1);
+    return i;
+}
+
+describe('startup: the interrupted-run sweep runs before anything can start a run', () => {
+    const sweep = () => at('await SweepInterruptedRuns(');
+
+    it.each([
+        ['the scheduled jobs service', 'scheduledJobsService.Start()'],
+        ['the integration sync worker', 'integrationSyncWorker.Start()'],
+        ['the HTTP listener', 'httpServer.listen('],
+        ['pending RSU work', 'processRSUPendingWork().catch('],
+    ])('precedes %s', (_label, needle) => {
+        expect(sweep()).toBeLessThan(at(needle));
+    });
+
+    it('is called exactly once', () => {
+        expect(source.split('await SweepInterruptedRuns(').length - 1).toBe(1);
+    });
+});

package/src/__tests__/unifiedAuth.test.ts

@@ -263,6 +263,34 @@ describe('createUnifiedAuthMiddleware', () => {
     });
   });
 
+  describe('x-mj-timezone header', () => {
+    beforeEach(() => {
+      setupSuccessfulAuth();
+    });
+
+    async function payloadFor(headers: Record<string, string>) {
+      const req = makeMockReq({ headers: { authorization: 'Bearer valid-token', ...headers } });
+      await middleware(req, makeMockRes(), vi.fn());
+      return req.userPayload!;
+    }
+
+    it('carries a valid IANA zone on the user payload', async () => {
+      expect((await payloadFor({ 'x-mj-timezone': 'Pacific/Auckland' })).TimeZone).toBe('Pacific/Auckland');
+    });
+
+    it('drops an invalid zone, so callers fall back to UTC', async () => {
+      expect((await payloadFor({ 'x-mj-timezone': 'Mars/Olympus_Mons' })).TimeZone).toBeUndefined();
+      expect((await payloadFor({ 'x-mj-timezone': "UTC'; DROP TABLE x;--" })).TimeZone).toBeUndefined();
+      expect((await payloadFor({ 'x-mj-timezone': '' })).TimeZone).toBeUndefined();
+    });
+
+    it('leaves the payload exactly as before when the header is absent', async () => {
+      const payload = await payloadFor({});
+      expect(payload.TimeZone).toBeUndefined();
+      expect(Object.keys(payload)).not.toContain('TimeZone');
+    });
+  });
+
   describe('Authentication failures', () => {
     it('should return 401 when no authorization header is provided, quietly (no stack-trace log)', async () => {
       mockGetReadOnlyDS.mockReturnValue(MOCK_POOL);

package/src/__tests__/widgetGuestElevation.test.ts

@@ -155,6 +155,8 @@ describe('widgetGuestElevation — elevateUserPayload', () => {
     expect(elevated.isSystemUser).toBe(true);
     // The session id MUST be preserved so progress/streaming still routes to the guest's websocket.
     expect(elevated.sessionId).toBe('sess-123');
+    // The guest it stands in for, so conversation writes can stay the guest's (MJ#4791).
+    expect(elevated.ElevatedFrom).toBe(guestPayload.userRecord);
   });
 
   it('does not mutate the original guest payload', () => {