@fuzdev/fuz_app 0.145.0 → 0.146.0

package/dist/server/x_accel.js

@@ -33,6 +33,10 @@
  * - carry, as top-level directives of its own body, an exact `internal;` and
  *   each `fact_security_header_directives` line (token-equal: whitespace and
  *   quoting are free, the words are not);
+ * - set those headers with no other `add_header` — one naming a
+ *   `FACT_SECURITY_HEADERS` header (ASCII case-insensitive) that is not
+ *   token-equal to its required line is refused, since nginx sends both values
+ *   and a client may read only the first (`sniff, nosniff`);
  * - hold only simple directives — any nested block (`location`, `if`,
  *   `limit_except`, …) is refused, and so is `include`, since included files
  *   are not followed.
@@ -53,13 +57,34 @@
  * own modifier and path words and the bodies of the locations serving the
  * prefix.
  *
+ * The prefix itself must be an absolute path ending in exactly one `/` — the
+ * server appends `<shard>/<rest>` straight onto it, so `/_facts` would redirect
+ * to `/_factsab/…`, outside the validated location. At least one location
+ * serving the prefix must sit exactly at it (`/_facts` or `/_facts/`): one only
+ * below it (`location ^~ /_facts/00/`) leaves every other redirect path to
+ * whatever location matches next, and nginx compares location paths
+ * byte-for-byte, so `/_facts//` sits below it too.
+ *
+ * Module directives that undo those guarantees are refused too:
+ *
+ * - `ssi` with any value but `off`, anywhere in the config. SSI `include
+ *   virtual` is a subrequest, which `internal;` admits, so an SSI-processed
+ *   response — a fact inheriting `ssi on` from `http` or `server`, or any page
+ *   carrying user content — could include another fact's bytes.
+ * - `more_set_headers` / `more_clear_headers` (headers-more) everywhere except
+ *   inside a `location` that doesn't serve the prefix (or a block within one):
+ *   they run after `add_header` and can strip the hardening headers, so they
+ *   are refused in the facts location and at every level above it, including
+ *   any block there (`if`, another `server`).
+ *
  * Also refused: an `=` location on the prefix or below it (it can't serve the
  * nested paths the redirect emits); a regex location (`~` / `~*`) whose pattern
  * spells out the prefix (after unescaping `\/`, ASCII case-folded for `~*`) —
- * dead under the rules above, refused for the clearer message; and a config
- * with no location serving the prefix. `include` at server level is allowed,
- * but its file is not read — keep facts-related locations out of included
- * files.
+ * dead under the rules above, refused for the clearer message; a config with no
+ * location at the prefix; and blocks nested more than 64 deep (a parse error, so
+ * the walks can't exhaust the stack). `include` at server level is allowed, but
+ * its file is not read — keep facts-related locations and the directives above
+ * out of included files.
  *
  * The threat model is operator mistakes, not an adversarial config author: the
  * prefix check is textual, so a value assembled from pieces (`/_fac$1`) evades
@@ -73,8 +98,10 @@
  *   the server is trusted to point into the prefix; an untrusted one needs
  *   `proxy_ignore_headers X-Accel-Redirect;` (or the `fastcgi_` / `uwsgi_` /
  *   `scgi_` equivalent).
- * - Module code can redirect internally too (ssi `include virtual`, njs
- *   `internalRedirect`, perl, echo), so run trusted modules and content only.
+ * - Other module code can redirect internally too (njs `internalRedirect`, perl,
+ *   echo), or strip the hardening headers as headers-more can (njs
+ *   `js_header_filter`, lua-nginx-module `header_filter_by_lua*`), and the
+ *   check sees none of it, so run trusted modules and content only.
  *
  * The Rust twin is `fuz_fact_serving`'s `nginx.rs`, held to the same rules and
  * the same fixture corpus.
@@ -129,6 +156,13 @@ const collect_errors = (config, facts_location) => {
                 `(e.g. \`/_facts/\`).`
         ];
     }
+    if (facts_location.length !== prefix.length + 1) {
+        return [
+            `X-Accel redirect prefix \`${facts_location}\` must end in exactly one \`/\` (e.g. ` +
+                `\`/_facts/\`) — the server appends \`<shard>/<rest>\` straight onto it, so any other ` +
+                `ending redirects outside the validated location.`
+        ];
+    }
     const directives = parse_directives(tokenize(config));
     const locations = [];
     collect_locations(directives, null, locations);
@@ -140,7 +174,7 @@ const collect_errors = (config, facts_location) => {
     ]);
     const rendered = fact_security_header_directives();
     const errors = [];
-    let matched = false;
+    let at_prefix = false;
     for (const location of locations) {
         const label = location_label(location);
         switch (location.modifier) {
@@ -150,7 +184,10 @@ const collect_errors = (config, facts_location) => {
             case 'prefix_no_regex': {
                 if (!path_is_under(location.path, prefix))
                     break;
-                matched = true;
+                // nginx compares location paths byte-for-byte, so `/_facts//` never matches
+                // `/_facts/ab/…` — only `/_facts` and `/_facts/` sit at the prefix
+                if (location.path === prefix || location.path === prefix + '/')
+                    at_prefix = true;
                 if (location.modifier !== 'prefix_no_regex') {
                     errors.push(`${label} must use \`^~\` (\`location ^~ ${location.path}\`) — on a plain prefix ` +
                         `location nginx goes on to check regex locations, any of which can serve fact ` +
@@ -174,6 +211,16 @@ const collect_errors = (config, facts_location) => {
                 }
                 for (const directive of location.body) {
                     const name = directive.args[0] ?? '';
+                    const header = directive.args[1];
+                    if (directive.block === null && name === 'add_header' && header !== undefined) {
+                        const index = required.findIndex((args) => to_ascii_lowercase(args[1]) === to_ascii_lowercase(header));
+                        if (index !== -1 && !args_equal(directive.args, required[index])) {
+                            errors.push(`${label} has another \`add_header ${header}\` (line ${directive.line}) — nginx ` +
+                                `sends every \`add_header\` for a header and a client may read only the ` +
+                                `first, so the facts location may set \`${required[index][1]}\` only with ` +
+                                `\`${rendered[index]}\`.`);
+                        }
+                    }
                     if (directive.block !== null) {
                         errors.push(`${label} contains a nested \`${name}\` block (line ${directive.line}) — the facts ` +
                             `location must hold only simple directives, since a nested block can ` +
@@ -209,11 +256,13 @@ const collect_errors = (config, facts_location) => {
         }
     }
     collect_prefix_mention_errors(directives, prefix, errors);
-    if (!matched) {
+    collect_module_errors(directives, prefix, true, errors);
+    if (!at_prefix) {
         errors.unshift(`No nginx \`location ^~ ${facts_location}\` block found — the X-Accel facts ` +
-            `location must exist and be marked \`internal;\` so only the authz'd handler's ` +
-            `redirect can reach it. A public facts location bypasses every cell-visibility ` +
-            `check.`);
+            `location must exist exactly at the prefix (one only below it leaves the other ` +
+            `redirect paths uncovered) and be marked \`internal;\` so only the authz'd ` +
+            `handler's redirect can reach it. A public facts location bypasses every ` +
+            `cell-visibility check.`);
     }
     return errors;
 };
@@ -255,12 +304,13 @@ export class XAccelConfigError extends Error {
  * The make-impossible-states gate: serving can only emit `X-Accel-Redirect`
  * into a location proven `internal;` and header-carrying at boot.
  *
- * @param redirect_prefix - the X-Accel redirect prefix (e.g. `/_facts/`)
+ * @param redirect_prefix - the X-Accel redirect prefix, ending in `/` (e.g. `/_facts/`)
  * @param nginx_config - the nginx config string to validate against
  * @returns the validated `XAccelConfig` carrying `redirect_prefix`
  * @throws `XAccelConfigError` carrying every violation
- *   `validate_facts_internal_location` finds — a missing, public, header-less,
- *   exact-match, or regex-shadowed facts location.
+ *   `validate_facts_internal_location` finds — a prefix not ending in `/`, a
+ *   missing, public, header-less, re-headered, exact-match, or regex-shadowed
+ *   facts location, or `ssi` / headers-more reaching it.
  */
 export const create_x_accel_config = (redirect_prefix, nginx_config) => {
     const validation = validate_facts_internal_location(nginx_config, redirect_prefix);
@@ -282,7 +332,9 @@ const path_is_under = (path, prefix) => {
  * `true` when `body` has a top-level simple directive whose words are exactly
  * `args` (a block directive with those words doesn't count).
  */
-const has_directive = (body, args) => body.some((d) => d.block === null && d.args.length === args.length && d.args.every((a, i) => a === args[i]));
+const has_directive = (body, args) => body.some((d) => d.block === null && args_equal(d.args, args));
+/** `true` when `a` and `b` hold the same words in the same order. */
+const args_equal = (a, b) => a.length === b.length && a.every((word, i) => word === b[i]);
 const MODIFIER_TEXT = {
     prefix: '',
     named: '',
@@ -361,6 +413,59 @@ const collect_prefix_mention_errors = (directives, prefix, errors) => {
             collect_prefix_mention_errors(directive.block, prefix, errors);
     }
 };
+/**
+ * The headers-more module's response-header directives, which run after
+ * `add_header` and so can strip or rewrite the fact hardening headers.
+ */
+const HEADERS_MORE_DIRECTIVES = new Set([
+    'more_set_headers',
+    'more_clear_headers'
+]);
+/**
+ * Refuse the module directives that undo the facts location's guarantees:
+ *
+ * - `ssi` with any value but `off`, in any block at any depth. SSI `include
+ *   virtual` is a subrequest, which `internal;` admits, so an SSI-processed
+ *   response — a fact served from the facts location (inheriting `ssi on` from
+ *   `http` or `server`), or any page carrying user content — could include
+ *   another fact's bytes by its path. A sibling location's `ssi on` is as
+ *   dangerous as an inherited one, so the rule is config-wide.
+ * - a headers-more directive anywhere except inside a `location` that doesn't
+ *   serve the prefix (or a block within one): in the facts location's body, or
+ *   at any level above it (`http`, `server`, top level, and any block there such
+ *   as `if` or another `server`).
+ *
+ * `reaches_facts` is `true` while the walk is in a scope the facts location
+ * inherits from or is.
+ */
+const collect_module_errors = (directives, prefix, reaches_facts, errors) => {
+    for (const directive of directives) {
+        const name = directive.args[0] ?? '';
+        if (directive.block === null) {
+            if (name === 'ssi' &&
+                !(directive.args.length === 2 && to_ascii_lowercase(directive.args[1]) === 'off')) {
+                errors.push(`\`ssi\` (line ${directive.line}) is not \`off\` — SSI \`include virtual\` subrequests ` +
+                    `reach the \`internal;\` facts location, so an SSI-processed response could ` +
+                    `include any fact's bytes by its path. Remove it or set \`ssi off;\`.`);
+            }
+            else if (reaches_facts && HEADERS_MORE_DIRECTIVES.has(name)) {
+                errors.push(`\`${name}\` (line ${directive.line}) applies to the facts location — a ` +
+                    `headers-more directive in or above it can strip or rewrite the fact hardening ` +
+                    `headers after \`add_header\` sets them. Move it into the locations that need it.`);
+            }
+            continue;
+        }
+        let reaches = reaches_facts;
+        if (name === 'location') {
+            const parsed = parse_location_args(directive.args.slice(1));
+            reaches =
+                parsed !== null &&
+                    (parsed.modifier === 'prefix' || parsed.modifier === 'prefix_no_regex') &&
+                    path_is_under(parsed.path, prefix);
+        }
+        collect_module_errors(directive.block, prefix, reaches, errors);
+    }
+};
 /**
  * Gather every `location` block at any depth, in document order, each with the
  * name of the block directly enclosing it.
@@ -543,11 +648,20 @@ const tokenize = (config) => {
     }
     return tokens;
 };
+/**
+ * The deepest block nesting the parser accepts — far beyond any real config, and
+ * low enough that the recursive walks can't exhaust the stack.
+ */
+const MAX_NESTING_DEPTH = 64;
 const parse_directives = (tokens) => {
     const cursor = { pos: 0 };
-    return parse_block(tokens, cursor, null);
+    return parse_block(tokens, cursor, null, 0);
 };
-const parse_block = (tokens, cursor, open_line) => {
+/**
+ * Parse one block's directives; `depth` is the number of blocks enclosing them
+ * (`0` at the top level).
+ */
+const parse_block = (tokens, cursor, open_line, depth) => {
     const out = [];
     for (;;) {
         const token = tokens[cursor.pos];
@@ -580,8 +694,11 @@ const parse_block = (tokens, cursor, open_line) => {
                 break;
             }
             else if (next?.kind === '{') {
+                if (depth >= MAX_NESTING_DEPTH) {
+                    throw new NginxParseError(`blocks nested deeper than ${MAX_NESTING_DEPTH} levels (line ${next.line})`);
+                }
                 cursor.pos++;
-                const block = parse_block(tokens, cursor, next.line);
+                const block = parse_block(tokens, cursor, next.line, depth + 1);
                 out.push({ args, line, block });
                 break;
             }

package/dist/testing/CLAUDE.md

@@ -932,10 +932,10 @@ source of truth for wire-shape conformance.
   (the **gating** flags `ws` / `sse` / `cell_crud` / `cell_relations` /
   `cell_gated_create` / `account_lifecycle` / `fact_serving` / `ready` /
   `account_status` / `peer_request` /
-  `ws_handshake_pipelining` / `ws_account_actions` / `ws_self_revocation_reply` /
+  `ws_handshake_pipelining` / `ws_account_actions` /
   `ws_role_gated` / `ws_refusal_body` — each has a `test_if`
-  reader (`ws_self_revocation_reply` forks one case's assertion instead, and
-  `ws_refusal_body` how the front-door table reads a WS refusal); `peer_request` (server-initiated requests — the ActionPeer
+  reader (`ws_refusal_body` picks how the front-door table reads a WS
+  refusal instead); `peer_request` (server-initiated requests — the ActionPeer
   `peer/ping` round-trip) is `true` for both the Rust spine and the TS spine
   (`BackendWebsocketTransport.request_connection`); `ts_default_capabilities`
   keeps it `false` like sse/ready until a backend wires the `peer/ping` HTTP +
@@ -966,7 +966,8 @@ source of truth for wire-shape conformance.
   generic round-trip can't drive (it can't delete the subject). `true` on every
   spine. `fact_serving`
   gates `describe_fact_serving_cross_tests` (the cell-scoped per-reference +
-  admin-only bare-hash fact-serving parity suite); like cells it stays off the
+  admin-only bare-hash fact-serving parity suite, incl. the served fact's
+  hardening headers and bodyless masked 404s); like cells it stays off the
   declared surface and is `true` on every spine that mounts the serve routes +
   the `_testing_put_fact` seeder (whose optional `holder` records a
   `fact_holder` row, so a non-admin can reference what it seeds) — it also
@@ -991,11 +992,9 @@ source of truth for wire-shape conformance.
   write raw bytes to).
   `ws_account_actions` (the WS endpoint mounts the account actions — `true` on
   fuz_app's own spine presets, `false` in the family defaults) gates the WS
-  round-trip suite's self-revocation case and, with `rpc_path`, its
-  WS-mutation audit case (which calls `_testing_drain_effects`);
-  `ws_self_revocation_reply` says what the self-revocation case requires: the reply ahead of the close (`true`, the TS
-  family) or the close alone (`false`, the Rust family, whose socket loop
-  drops the response once the connection is closed — a recorded divergence).
+  round-trip suite's self-revocation case (which requires the reply ahead of
+  the close on every backend) and, with `rpc_path`, its WS-mutation audit case
+  (which calls `_testing_drain_effects`).
 
 ### `cross_backend/standard.ts` — `describe_standard_cross_process_tests`
 
@@ -1117,7 +1116,8 @@ call (not folded into `describe_standard_cross_process_tests`) because it
 needs raw `base_url` / `ws_path` the standard bundle doesn't carry, mirroring
 how `describe_ws_round_trip_tests` sits beside `describe_standard_tests`
 in-process. `describe_cross_process_ws_tests({setup_test, capabilities,
-base_url, ws_path, origin?, rpc_path?, max_message_bytes?})` opens a live
+base_url, ws_path, origin?, rpc_path?, max_message_bytes?, logout_path?,
+password_path?, max_tokens?})` opens a live
 `WebSocket` via `create_ws_transport` (the `ws` npm package) and asserts
 cases against the upgrade stack `register_ws_endpoint` wires (origin →
 `require_auth` → dispatch): authed upgrade round-trips `heartbeat`,
@@ -1135,8 +1135,19 @@ anonymous upgrade refused, disallowed-origin upgrade refused, and — gated on
 mid-connection (`account_session_revoke_all` over the keeper session channel;
 asserted via `WsClient.wait_for_close`) and when its account is deleted
 (`account_delete` by the keeper, also gated on
-`capabilities.account_lifecycle`; the close code is
-`WS_CLOSE_SESSION_REVOKED`). Per-connection auth is enforced **at upgrade
+`capabilities.account_lifecycle`), each with `WS_CLOSE_SESSION_REVOKED` and
+`WS_CLOSE_SESSION_REVOKED_REASON`. The rest of the revocation table closes a second
+account's socket with `WS_CLOSE_SESSION_REVOKED` and
+`WS_CLOSE_SESSION_REVOKED_REASON`: `account_token_revoke` its revoked token's
+bearer socket (a socket on its other token stays open);
+`admin_token_revoke_all`, `POST /logout` (`logout_path`), `POST /password`
+(`password_path`) and `account_purge` (also gated on
+`capabilities.account_lifecycle`) its bearer and session sockets; and
+`max_tokens` further mints (default `DEFAULT_MAX_TOKENS`; `null` skips) the
+bearer socket of the token the cap evicts. The account-wide rows come from
+`cross_backend/revocation_drivers.ts` (`create_account_revocations`, shared
+with the SSE suite), and a case that opens several sockets closes whichever
+opened when a later open fails. Per-connection auth is enforced **at upgrade
 time**, so the negative upgrade cases assert the upgrade itself rejects, not
 a per-message error; the close cases prove a revocation closes an
 already-open socket, since per-message dispatch never re-checks credential
@@ -1144,8 +1155,7 @@ validity. Omit `rpc_path` to skip the close cases (consumers without the
 standard account and admin actions on their RPC endpoint). Two cases are gated
 on `capabilities.ws_account_actions` (the WS endpoint mounts the account
 actions): a socket that revokes its own sessions over that socket is closed
-with `WS_CLOSE_SESSION_REVOKED`, and — where the backend declares
-`capabilities.ws_self_revocation_reply` — reads the reply first; and (with
+with `WS_CLOSE_SESSION_REVOKED` and its reason after reading the reply to its request; and (with
 `rpc_path`) a socket mints an API token over WS, and its `token_create` audit
 row is read back after `_testing_drain_effects` — a WS reply can precede its
 audit write, so the drain is the barrier (the binary mounts it via
@@ -1349,7 +1359,11 @@ account-wide close) and then just the one (`account_session_revoke`, the
 session-scoped close), each dropping the live stream (asserted via
 `SseTransport.wait_for_close`); the keeper soft-deletes a second admin whose
 stream is open (`account_delete`, also gated on
-`capabilities.account_lifecycle`), dropping it; and one stream past the per-session cap
+`capabilities.account_lifecycle`), dropping it; `admin_token_revoke_all`,
+`POST /logout` (`logout_path`), `POST /password` (`password_path`) and
+`account_purge` (also gated on `capabilities.account_lifecycle`) of a second
+admin each drop its stream — the rows `create_account_revocations`
+(`cross_backend/revocation_drivers.ts`) shares with the WS suite; and one stream past the per-session cap
 (`max_per_scope`, default `AUDIT_LOG_SSE_MAX_PER_SCOPE`; `null` skips) on one
 session closes the oldest and leaves the rest open. The data-frame + close
 cases gate on `rpc_path` (they drive the standard account/admin actions); all
@@ -1359,6 +1373,20 @@ cases gate on `capabilities.sse`. Cross-process only — wire from a
 TS spines wire `audit_log_sse` and the Rust `spine_stub` serves the same
 stream.
 
+### `cross_backend/revocation_drivers.ts` — shared revocation drivers
+
+The account-wide revocations both transport suites close a live connection on,
+as one table: `create_account_revocations({capabilities, rpc_path,
+logout_path, password_path})` → `AccountRevocation` rows (`{label, slug,
+gate, revoke(fixture, target)}`) for `admin_token_revoke_all`, `POST /logout`,
+`POST /password`, and `account_purge` (`gate` reads
+`capabilities.account_lifecycle`). `revoke` asserts the revocation succeeded;
+the target must hold `DEFAULT_TEST_PASSWORD`. A revocation added here is
+covered on WS and SSE at once. The drivers stand alone too: `cross_post_as`
+(a JSON `POST` on an account's session, asserting 200),
+`cross_admin_token_revoke_all`, and `cross_account_purge` (over the daemon
+token, no `Origin`).
+
 ### `cross_backend/cell_crud.ts` + `cell_relations.ts` + `cell_gated_create.ts` — cell parity suites
 
 The cell-layer parity coverage is split across two sibling suites. Cells
@@ -1669,7 +1697,8 @@ cases are `src/test/auth/cell_ref_admission{,.fact_less}.db.test.ts`.
 `describe_token_scope_surface_cross_tests({setup_test, capabilities, rpc_path?,
 sse_path?})` — the `surface:<name>` twin of the conformance slate's
 `token_scope_cases`, which cover only the `rpc:<method>` arm. Token scoping's
-RPC-only rule (_a narrowed api token reaches no non-RPC surface_) is the
+RPC-only rule (_a narrowed api token reaches no non-RPC surface that reads
+account data or carries authority_) is the
 load-bearing half of the design and had **no** cross-impl gate: the schema gate
 can't see it (no column), the action-manifest gate can't see it (no method), and
 the spec-derived suites can't see it (REST routes, off the declared RPC surface).
@@ -1682,7 +1711,12 @@ fact read (`capabilities.fact_serving`) — asserting the exact flat
 contract on (`token_scope_denied_body` ↔
 `fuz_auth::token_scope_surface_denied_response`).
 
-The fifth case is the one with no prior pin anywhere: **scope outranks role**. A
+The account status read (`capabilities.account_status`) answers anonymous
+callers, so rule 3 there is the anonymous answer: a narrowed token on
+`GET /api/account/status` gets the anonymous `401`, status and body byte for
+byte, while the same account's full-scope bearer reads the account.
+
+One case has no prior pin anywhere: **scope outranks role**. A
 narrowed token on an account that _also_ lacks the gating role must hear
 `token_scope_required`, not `insufficient_permissions` — the observable the
 TS↔Rust ordering divergence produced before both spines converged on running the
@@ -1911,16 +1945,18 @@ asserting each spec declares `credential_types: ['daemon_token']`) + the
 
 ### Identity-primitive parity — `cross_backend/identity_parity.ts`
 
-`describe_identity_parity_cross_tests({setup_test, login_path?, signup_path?})` —
+`describe_identity_parity_cross_tests({setup_test, login_path?, signup_path?, bootstrap_path?, password_path?})` —
 the imperative suite pinning the `primitive_schemas` twins (`Username`,
 `UsernameProvided`, `Email`) + login/signup input handling end-to-end over real
 HTTP (flat REST `/login` + `/signup`, so imperative, not a `conformance_table`
-row). Six facets, each a TS↔Rust reimplementation pair that the spec-derived
+row). The facets, each a TS↔Rust reimplementation pair that the spec-derived
 round-trip / conformance suites never vary:
 
 - **Login canonicalization** — case-insensitive + whitespace-trim lookup
-  (`UsernameProvided` `.trim().toLowerCase()` + `LOWER(username)`), plus a
-  Turkish-`İ` homograph **no-Unicode-fold-collision** negative.
+  (`UsernameProvided` `.trim().toLowerCase()` + `LOWER(username)`), the trimmed
+  set being JS `String.prototype.trim`'s on every spine (U+FEFF padding trimmed,
+  U+0085 not), plus a Turkish-`İ` homograph **no-Unicode-fold-collision**
+  negative.
 - **Username-or-email login** — an account created with an email logs in via
   that email, case-insensitively both directions; username login still works;
   non-existent email → 401. This is the corner that surfaced and closed the Rust
@@ -1933,7 +1969,11 @@ round-trip / conformance suites never vary:
   `account_login` (closed a cluster where three of these fell through to a
   lookup-miss 401 on Rust and a whitespace-only identifier 401'd on TS). Asserted
   by error reason, not just status.
-- **ASCII-only creation invariant** — non-ASCII username → 400 at signup.
+- **ASCII-only creation invariant** — non-ASCII username → 400 at signup, and a
+  padded creation name (space, tab, U+0085) → 400, never trimmed into a legal
+  one — at signup, and at bootstrap (`bootstrap_path`, default
+  `/api/account/bootstrap`, `null` to skip), where the body is validated ahead
+  of the window check, so the 400 holds after bootstrap completed.
 - **Length + format regex parity** — both `[USERNAME_LENGTH_MIN,
 USERNAME_LENGTH_MAX]` = `[3, 39]` boundary edges (just-outside → 400,
   just-inside → 403 no-matching-invite) and the creation regex shape (leading
@@ -1948,6 +1988,13 @@ USERNAME_LENGTH_MAX]` = `[3, 39]` boundary edges (just-outside → 400,
   Zod's `z.email()` rejects — the deliberately-looser shared rule. **Closed a
   real divergence**: the Rust spine previously length-checked the email only,
   accepting any non-empty string TS rejected.
+- **Malformed JSON body** — an unparseable (`{`) or non-object (`[]`) body typed
+  `application/json` → 400 `{error: "invalid_json_body"}` and nothing else, on
+  login, signup, bootstrap (ahead of its window check), and the password change
+  (`password_path`, default `/api/account/password`, `null` skips; parsed after
+  its credential and session-only gates, so the case sends a session and an
+  anonymous one still answers 401). A Rust backend needs the spine's
+  `parse_json_body`.
 
 Ungated (login + signup are on every spine). Runs both legs via the shared
 `{setup_test}` protocol: in-process (`identity_parity.db.test.ts`, plain
@@ -1970,6 +2017,10 @@ over real HTTP on both spines:
 - **XFF keying** — exhaust one forwarded IP to 429, then a _distinct_ forwarded IP
   → 401 (not 429), proving the limiter keys on the resolved `X-Forwarded-For` IP,
   not the loopback TCP peer (a backend ignoring XFF would 429 the fresh IP too).
+- **a malformed hop stops the walk** — after exhausting one forwarded IP, a
+  chain with that IP left of an `ip:port` entry → 401, not 429: the walk stops at
+  the malformed entry and keys on the connection IP (its audit row says so),
+  never on the client-written entry past it.
 - **a success does not refund the per-IP budget** — the distributed-spray
   backstop. Failed guesses against distinct usernames from one forwarded IP,
   interleaved with the attacker's own successful logins, must still 429 within a

package/dist/testing/cross_backend/capabilities.d.ts

@@ -176,24 +176,6 @@ export interface BackendCapabilities {
      * once the account actions are there.
      */
     readonly ws_account_actions: boolean;
-    /**
-     * A socket that revokes the credential it is running on reads the reply to
-     * that request **before** the revocation's close. Read by the
-     * self-revocation case in `describe_cross_process_ws_tests` (which
-     * `ws_account_actions` gates): with it `true` the case requires the reply
-     * frame ahead of the `WS_CLOSE_SESSION_REVOKED` close; with it `false` the
-     * case requires the close alone.
-     *
-     * `true` for the TS family — `register_action_ws` sends the response and
-     * only then flushes the request's post-commit queue, where the close is.
-     * `false` for the Rust family: its dispatch runs the post-commit queue
-     * before handing the response to the socket loop, and the loop, finding the
-     * connection already closed, writes the close frame and drops the response.
-     * The caller's revocation still took effect; it is not told so. The flag
-     * records that divergence so the suite stays green on both spines without
-     * hiding it — flip it once the Rust spine answers first.
-     */
-    readonly ws_self_revocation_reply: boolean;
     /**
      * A test `CellCreateAuthorize` policy is live-mounted on the backend's cell
      * layer — creating a `kind: 'gated'` cell requires the `participant` role

package/dist/testing/cross_backend/capabilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA2C9B;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAC;IAC3C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CAClC;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBA2BpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA2C9B;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CAClC;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAwBpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}

package/dist/testing/cross_backend/capabilities.js

@@ -28,7 +28,7 @@ import '../assert_dev_env.js';
  *
  * **Gating flags vs shape notes.** `BackendCapabilities` holds only flags a
  * suite actually gates on (each has a `test_if(capabilities.X, ...)` reader,
- * or — `ws_self_revocation_reply` — forks one case's assertion).
+ * or — `ws_refusal_body` — picks how a case reads a refusal).
  * Wiring facts that gate nothing — `bearer_auth` / `trusted_proxy` /
  * `login_rate_limit` — live in the parallel `BackendShapeNotes` record
  * (`in_process_shape_notes` here, `ts_default_shape_notes` /
@@ -66,9 +66,6 @@ export const in_process_capabilities = Object.freeze({
     ws_handshake_pipelining: false,
     // Cross-process-only: the case reads a real socket's frames in wire order.
     ws_account_actions: false,
-    // Read only by the case `ws_account_actions` gates; the in-process
-    // dispatcher does answer first.
-    ws_self_revocation_reply: true,
     // Cross-process-only: the test `CellCreateAuthorize` policy is mounted on the
     // spine binaries' full mount + the Rust stub, not the in-process default app.
     cell_gated_create: false,

package/dist/testing/cross_backend/default_backend_configs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EAA4B,KAAK,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAYhG,2CAA2C;AAC3C,MAAM,WAAW,yBAAyB;IACzC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,yBAAyB,KAChC,MAAM,CAAC,MAAM,EAAE,MAAM,CAKtB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAyCpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBAkCtC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAIrC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,mDAAmD;IACnD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAoCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA4CF,CAAC"}
+{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EAA4B,KAAK,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAYhG,2CAA2C;AAC3C,MAAM,WAAW,yBAAyB;IACzC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,yBAAyB,KAChC,MAAM,CAAC,MAAM,EAAE,MAAM,CAKtB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAsCpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBA8BtC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAIrC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,mDAAmD;IACnD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAoCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA4CF,CAAC"}

package/dist/testing/cross_backend/default_backend_configs.js

@@ -47,9 +47,6 @@ export const ts_default_capabilities = Object.freeze({
     // fuz_app's spine configs opt in (the spine binary mounts the account
     // actions on `/api/ws`); a consumer does once its endpoint carries them.
     ws_account_actions: false,
-    // `register_action_ws` sends a request's response before it flushes the
-    // post-commit queue a self-revocation's close is on.
-    ws_self_revocation_reply: true,
     // Off by default — the `cell_gated_create` test policy is a fuz_app test
     // fixture, mounted only on the spine binaries (`ts_spine_*`), not generic
     // consumers.
@@ -88,10 +85,6 @@ export const rust_default_capabilities = Object.freeze({
     // Off by default, as on the TS family: a consumer opts in once its WS
     // endpoint mounts the account actions. The `testing_spine_stub` preset does.
     ws_account_actions: false,
-    // The Rust dispatch runs the post-commit queue — the self-revocation's
-    // close — before the socket loop writes the response, and the loop then
-    // drops it. A divergence from the TS spine; see the flag's doc.
-    ws_self_revocation_reply: false,
     // Off by default — the `testing_spine_stub` preset opts in (it mounts the
     // `TestCellGatedCreateAuthorize` policy); a generic Rust consumer doesn't.
     cell_gated_create: false,

package/dist/testing/cross_backend/fact_serving.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fact_serving.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/fact_serving.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAiD9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAElG;;;;;GAKG;AACH,MAAM,WAAW,2BAA4B,SAAQ,uCAAuC;IAC3F,QAAQ,CAAC,sBAAsB,CAAC,EAAE,SAAS,CAAC;CAC5C;AAgBD,iEAAiE;AACjE,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,uFAAuF;IACvF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,GAC1B,SAAS,IAAI,CAAC,WAAW,EAAE,iBAAiB,GAAG,6BAA6B,CAAC,EAC7E,UAAU,MAAM,EAChB,OAAO,iBAAiB,KACtB,OAAO,CAAC,MAAM,CAaV,CAAC;AAgBR,eAAO,MAAM,iCAAiC,GAAI,SAAS,2BAA2B,KAAG,IAgOxF,CAAC"}
+{"version":3,"file":"fact_serving.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/fact_serving.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA8D9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAElG;;;;;GAKG;AACH,MAAM,WAAW,2BAA4B,SAAQ,uCAAuC;IAC3F,QAAQ,CAAC,sBAAsB,CAAC,EAAE,SAAS,CAAC;CAC5C;AAgBD,iEAAiE;AACjE,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,uFAAuF;IACvF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,GAC1B,SAAS,IAAI,CAAC,WAAW,EAAE,iBAAiB,GAAG,6BAA6B,CAAC,EAC7E,UAAU,MAAM,EAChB,OAAO,iBAAiB,KACtB,OAAO,CAAC,MAAM,CAaV,CAAC;AAgDR,eAAO,MAAM,iCAAiC,GAAI,SAAS,2BAA2B,KAAG,IAkRxF,CAAC"}