v0.59.0: SSE frames drop terminal package history (sseFrame projection) — ~597 KB → ~10 KB per frame (#133)

e2e/events.spec.ts

@@ -8,8 +8,13 @@ const baseUrl = process.env.E2E_BASE_URL ?? 'https://flight.dev.kkhost.pl';
 
 interface StateBody {
   simState: { clockMs: number };
+  packages?: Array<{ status: string }>;
 }
 
+// ISS-133 (v0.59.0): frames carry only the package statuses the client renders — terminal history
+// (delivered/abandoned/ignored) is unbounded in the DB and must never leak into a pushed frame.
+const ALLOWED_PACKAGE_STATUSES = new Set(['open', 'loaded', 'expired']);
+
 test('GET /api/events streams state snapshots over SSE', async () => {
   const res = await fetch(`${baseUrl}/api/events`, { headers: { Accept: 'text/event-stream' } });
   expect(res.status).toBe(200);
@@ -20,6 +25,8 @@ test('GET /api/events streams state snapshots over SSE', async () => {
   const decoder = new TextDecoder();
   let buffer = '';
   const clocks: number[] = []; // simState.clockMs of each parsed snapshot event
+  const statusesSeen = new Set<string>(); // package statuses observed in any frame (ISS-133)
+  let maxFrameBytes = 0;
 
   try {
     // Collect two snapshot events: the initial one, then at least one pushed by a background tick.
@@ -46,6 +53,8 @@ test('GET /api/events streams state snapshots over SSE', async () => {
           if (!line.startsWith('data: ')) continue; // heartbeats are comment lines (" : ping")
           const snap = JSON.parse(line.slice('data: '.length)) as StateBody;
           clocks.push(snap.simState.clockMs);
+          for (const p of snap.packages ?? []) statusesSeen.add(p.status);
+          maxFrameBytes = Math.max(maxFrameBytes, line.length);
         }
       }
     }
@@ -56,4 +65,11 @@ test('GET /api/events streams state snapshots over SSE', async () => {
   // The initial snapshot arrives on connect; the second comes from a background tick within ~1 s.
   expect(clocks.length).toBeGreaterThanOrEqual(2);
   expect(clocks[1]).toBeGreaterThan(clocks[0]); // clock advanced between pushes — real updates, not replays
+
+  // ISS-133: no terminal package history in any frame (the DB keeps it forever; frames must not),
+  // and a bounded frame size even on an instance with long-running history (~597 KB pre-v0.59.0).
+  for (const status of statusesSeen) {
+    expect(ALLOWED_PACKAGE_STATUSES.has(status)).toBe(true);
+  }
+  expect(maxFrameBytes).toBeLessThan(200_000);
 });