@fuzdev/fuz_app 0.146.1 → 0.148.0

package/dist/testing/cross_backend/differential_normalize.d.ts

@@ -0,0 +1,150 @@
+import '../assert_dev_env.js';
+/**
+ * Response normalization for the cross-backend differential.
+ *
+ * The differential (`describe_differential_conformance_tests`) sends one
+ * conformance case to two backends, each over its own database with its own
+ * keeper, so every id, timestamp and token differs between the two answers
+ * even when the backends agree. `normalize_differential_response` maps a
+ * response onto a canonical `{status, body, header_names}` that keeps what a
+ * client can rely on and drops what is fresh per run:
+ *
+ * - **Positional placeholders.** Each volatile value is replaced by its kind
+ *   and the order it was first seen in that response: the first UUID becomes
+ *   `<uuid:1>`, the next distinct one `<uuid:2>`, and a repeat of the first is
+ *   `<uuid:1>` again. So identity relations within one response survive (the
+ *   `account_id` of a listed row equals the caller's), while the values
+ *   themselves may differ across backends. The kinds, each matched anywhere
+ *   inside a string, are `VOLATILE_VALUE_PATTERNS`: API tokens, API token
+ *   ids (`tok_…`), lowercase UUIDs, second-precision UTC timestamps
+ *   (`ISO8601_SECONDS`, the canonical wire shape) and bare 64-character
+ *   lowercase hex digests (random session ids). Only the canonical spelling
+ *   of each is placeholdered — an uppercase UUID or a millisecond timestamp
+ *   stays raw and shows up as a difference, since a format divergence is a
+ *   wire divergence.
+ * - **Content addresses are compared verbatim.** A `blake3:`-prefixed hash
+ *   names bytes, and equal bytes hash equal on both spines, so it is left as
+ *   is: a differing fact hash is a real divergence. A fact whose bytes embed a
+ *   volatile value differs by design, which is a ledger row's job.
+ * - **Object key order doesn't matter.** Keys are sorted, and the walk that
+ *   numbers placeholders visits them in that order, so two bodies whose keys
+ *   differ only in order normalize the same.
+ * - **Array order does.** Arrays keep their order — a list's order is part of
+ *   its contract.
+ * - **Header names, not values.** `header_names` is the sorted set of response
+ *   header names minus `VOLATILE_HEADER_NAMES`: framing and per-request
+ *   headers (`date`, `content-length`, `transfer-encoding`, `connection`,
+ *   `keep-alive`) that each HTTP server sets its own way. Values are not
+ *   compared at all — `set-cookie` carries a fresh credential on every login,
+ *   and the header values that are contracts are pinned per backend by the
+ *   conformance table's `expect.headers` and its no-fingerprint floor. A
+ *   header one backend sends and the other doesn't is still a difference.
+ *
+ * `diff_differential_responses` lists every place two normalized responses
+ * differ, one entry per leaf path, which is what a known-divergence ledger
+ * entry names.
+ *
+ * Placeholders are positional, not tied to fixture identity: they keep which
+ * values repeat within a response, not which fixture entity each one is, so
+ * two ids that appear once each and trade places normalize equal.
+ *
+ * Placeholder numbering is per response and per kind. Object keys are
+ * normalized too, but sorted by their raw text, so a record keyed by ids would
+ * order its entries by values that differ across backends — no conformance
+ * response is shaped that way today.
+ *
+ * @module
+ */
+/**
+ * The canonical form of one response: what the differential compares across
+ * backends.
+ */
+export interface DifferentialResponse {
+    /** HTTP status. */
+    readonly status: number;
+    /** The JSON body with volatile values placeholdered and keys sorted. */
+    readonly body: unknown;
+    /** Sorted response header names, minus `VOLATILE_HEADER_NAMES`. */
+    readonly header_names: ReadonlyArray<string>;
+}
+/** The raw response `normalize_differential_response` takes. */
+export interface DifferentialRawResponse {
+    readonly status: number;
+    /** Header snapshot with lowercased names (`headers_to_record`'s shape). */
+    readonly headers: Readonly<Record<string, string>>;
+    readonly body: unknown;
+}
+/**
+ * Response headers left out of `header_names`: framing and per-request
+ * headers each HTTP server sets its own way, which say nothing about the
+ * application. Lowercased.
+ */
+export declare const VOLATILE_HEADER_NAMES: ReadonlyArray<string>;
+/** One kind of volatile value: its placeholder name and what matches it. */
+export interface VolatileValuePattern {
+    /** The placeholder's kind, as in `<uuid:1>`. */
+    readonly kind: string;
+    /** Matches every occurrence inside a string; must carry the `g` flag. */
+    readonly pattern: RegExp;
+}
+/**
+ * The volatile values `normalize_differential_response` placeholders, applied
+ * in order to every string (object keys included). Tokens come first, so the
+ * random tail of a token is never read as a hash. A `blake3:<64 hex>` content
+ * address matches none of them and is compared verbatim.
+ */
+export declare const VOLATILE_VALUE_PATTERNS: ReadonlyArray<VolatileValuePattern>;
+/**
+ * Normalize one response into its `DifferentialResponse`. Pure; numbering
+ * restarts for every call.
+ *
+ * @param response - the raw status, header snapshot and JSON body
+ * @returns the canonical form
+ */
+export declare const normalize_differential_response: (response: DifferentialRawResponse) => DifferentialResponse;
+/**
+ * One place two normalized responses differ. `path` is dotted from the
+ * response root (`status`, `headers.x-example`, `body.error.data.reason`,
+ * `body.result.accounts[0]`); `a` / `b` are the values on each side,
+ * `undefined` where a side has nothing there. A header one side sent and the
+ * other didn't is `headers.<name>`, with `true` on the side that sent it.
+ * An object one side lacks is compared key by key, so each of its keys is its
+ * own difference (`body.error.data.reason`, not the whole `body.error.data`);
+ * an empty object against a missing one is a difference at the object's path.
+ */
+export interface DifferentialDiff {
+    readonly path: string;
+    readonly a: unknown;
+    readonly b: unknown;
+}
+/**
+ * Every place two normalized responses differ, in a stable order: status,
+ * then header names, then the body depth-first with keys sorted. Empty when
+ * the responses are equal.
+ *
+ * @param a - one backend's normalized response
+ * @param b - the other's
+ * @returns the differences
+ */
+export declare const diff_differential_responses: (a: DifferentialResponse, b: DifferentialResponse) => Array<DifferentialDiff>;
+/**
+ * Whether `path` is `covered` or lies under it — `body.error.data` covers
+ * `body.error.data.reason` and `body.error.data[0]`, not `body.error.database`.
+ *
+ * @param covered - a declared path
+ * @param path - a `DifferentialDiff` path
+ * @returns `true` when `path` is `covered` or under it
+ */
+export declare const differential_path_covers: (covered: string, path: string) => boolean;
+/**
+ * Render diffs one per line for an assertion message.
+ *
+ * @param diffs - the differences
+ * @param labels - names for the two sides
+ * @returns one indented `path: a=… b=…` line per diff
+ */
+export declare const format_differential_diffs: (diffs: ReadonlyArray<DifferentialDiff>, labels: {
+    readonly a: string;
+    readonly b: string;
+}) => string;
+//# sourceMappingURL=differential_normalize.d.ts.map

package/dist/testing/cross_backend/differential_normalize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"differential_normalize.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/differential_normalize.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACpC,mBAAmB;IACnB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,mEAAmE;IACnE,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC7C;AAED,gEAAgE;AAChE,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACvB;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,aAAa,CAAC,MAAM,CAMvD,CAAC;AAEF,4EAA4E;AAC5E,MAAM,WAAW,oBAAoB;IACpC,gDAAgD;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAE,aAAa,CAAC,oBAAoB,CAUvE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,+BAA+B,GAC3C,UAAU,uBAAuB,KAC/B,oBA0CF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;CACpB;AA6BD;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,GACvC,GAAG,oBAAoB,EACvB,GAAG,oBAAoB,KACrB,KAAK,CAAC,gBAAgB,CAYxB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,GAAI,SAAS,MAAM,EAAE,MAAM,MAAM,KAAG,OAEoB,CAAC;AAE9F;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,GACrC,OAAO,aAAa,CAAC,gBAAgB,CAAC,EACtC,QAAQ;IAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAA;CAAE,KAChD,MAOU,CAAC"}

package/dist/testing/cross_backend/differential_normalize.js

@@ -0,0 +1,153 @@
+import '../assert_dev_env.js';
+/**
+ * Response headers left out of `header_names`: framing and per-request
+ * headers each HTTP server sets its own way, which say nothing about the
+ * application. Lowercased.
+ */
+export const VOLATILE_HEADER_NAMES = [
+    'connection',
+    'content-length',
+    'date',
+    'keep-alive',
+    'transfer-encoding'
+];
+/**
+ * The volatile values `normalize_differential_response` placeholders, applied
+ * in order to every string (object keys included). Tokens come first, so the
+ * random tail of a token is never read as a hash. A `blake3:<64 hex>` content
+ * address matches none of them and is compared verbatim.
+ */
+export const VOLATILE_VALUE_PATTERNS = [
+    // `API_TOKEN_PREFIX` + base64url
+    { kind: 'token', pattern: /secret_fuz_token_[A-Za-z0-9_-]+/g },
+    // `API_TOKEN_ID_REGEX`, unanchored — the public id of an API token
+    { kind: 'token_id', pattern: /(?<![\w-])tok_[\w-]{12}(?![\w-])/g },
+    { kind: 'uuid', pattern: /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/g },
+    // `ISO8601_SECONDS`, unanchored
+    { kind: 'timestamp', pattern: /\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z/g },
+    // bare digests only — a `blake3:` content address is compared verbatim
+    { kind: 'hash', pattern: /(?<!\w|blake3:)[0-9a-f]{64}(?!\w)/g }
+];
+/**
+ * Normalize one response into its `DifferentialResponse`. Pure; numbering
+ * restarts for every call.
+ *
+ * @param response - the raw status, header snapshot and JSON body
+ * @returns the canonical form
+ */
+export const normalize_differential_response = (response) => {
+    const seen = new Map();
+    const placeholder = (kind, value) => {
+        let values = seen.get(kind);
+        if (!values) {
+            values = new Map();
+            seen.set(kind, values);
+        }
+        let p = values.get(value);
+        if (p === undefined) {
+            p = `<${kind}:${values.size + 1}>`;
+            values.set(value, p);
+        }
+        return p;
+    };
+    const normalize_string = (value) => {
+        let out = value;
+        for (const { kind, pattern } of VOLATILE_VALUE_PATTERNS) {
+            out = out.replace(pattern, (match) => placeholder(kind, match));
+        }
+        return out;
+    };
+    const normalize_value = (value) => {
+        if (typeof value === 'string')
+            return normalize_string(value);
+        if (Array.isArray(value))
+            return value.map(normalize_value);
+        if (value !== null && typeof value === 'object') {
+            const out = {};
+            for (const key of Object.keys(value).sort()) {
+                out[normalize_string(key)] = normalize_value(value[key]);
+            }
+            return out;
+        }
+        return value;
+    };
+    return {
+        status: response.status,
+        body: normalize_value(response.body),
+        header_names: Object.keys(response.headers)
+            .map((name) => name.toLowerCase())
+            .filter((name) => !VOLATILE_HEADER_NAMES.includes(name))
+            .sort()
+    };
+};
+const is_record = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+const diff_values = (path, a, b, out) => {
+    if (Array.isArray(a) && Array.isArray(b)) {
+        const length = Math.max(a.length, b.length);
+        for (let i = 0; i < length; i++)
+            diff_values(`${path}[${i}]`, a[i], b[i], out);
+        return;
+    }
+    // an object one side lacks diffs key by key, so a ledger path can name one key
+    if ((is_record(a) && (is_record(b) || b === undefined)) || (a === undefined && is_record(b))) {
+        const ra = a ?? {};
+        const rb = b ?? {};
+        // `{}` against nothing has no key to diff, but is still a difference
+        if (a === undefined || b === undefined) {
+            if (Object.keys(ra).length === 0 && Object.keys(rb).length === 0) {
+                out.push({ path, a, b });
+                return;
+            }
+        }
+        const keys = [...new Set([...Object.keys(ra), ...Object.keys(rb)])].sort();
+        for (const key of keys)
+            diff_values(`${path}.${key}`, ra[key], rb[key], out);
+        return;
+    }
+    if (!Object.is(a, b))
+        out.push({ path, a, b });
+};
+/**
+ * Every place two normalized responses differ, in a stable order: status,
+ * then header names, then the body depth-first with keys sorted. Empty when
+ * the responses are equal.
+ *
+ * @param a - one backend's normalized response
+ * @param b - the other's
+ * @returns the differences
+ */
+export const diff_differential_responses = (a, b) => {
+    const out = [];
+    if (a.status !== b.status)
+        out.push({ path: 'status', a: a.status, b: b.status });
+    for (const name of [...new Set([...a.header_names, ...b.header_names])].sort()) {
+        const in_a = a.header_names.includes(name);
+        const in_b = b.header_names.includes(name);
+        if (in_a !== in_b) {
+            out.push({ path: `headers.${name}`, a: in_a || undefined, b: in_b || undefined });
+        }
+    }
+    diff_values('body', a.body, b.body, out);
+    return out;
+};
+/**
+ * Whether `path` is `covered` or lies under it — `body.error.data` covers
+ * `body.error.data.reason` and `body.error.data[0]`, not `body.error.database`.
+ *
+ * @param covered - a declared path
+ * @param path - a `DifferentialDiff` path
+ * @returns `true` when `path` is `covered` or under it
+ */
+export const differential_path_covers = (covered, path) => path === covered ||
+    (path.startsWith(covered) && (path[covered.length] === '.' || path[covered.length] === '['));
+/**
+ * Render diffs one per line for an assertion message.
+ *
+ * @param diffs - the differences
+ * @param labels - names for the two sides
+ * @returns one indented `path: a=… b=…` line per diff
+ */
+export const format_differential_diffs = (diffs, labels) => diffs
+    .map((d) => `  ${d.path}: ${labels.a}=${JSON.stringify(d.a) ?? 'undefined'} ` +
+    `${labels.b}=${JSON.stringify(d.b) ?? 'undefined'}`)
+    .join('\n');

package/dist/testing/cross_backend/fact_serving.d.ts

@@ -15,6 +15,11 @@ export interface CrossPutFactInput {
     readonly content_type?: string;
     /** The actor the put is on behalf of — recorded as a holder. Omit for a system put. */
     readonly holder?: string;
+    /**
+     * Store an external row naming this URL, verbatim and with no bytes, instead
+     * of an embedded one.
+     */
+    readonly external_url?: string;
 }
 /**
  * Seed an embedded fact over the daemon channel via `_testing_put_fact`;

package/dist/testing/cross_backend/fact_serving.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fact_serving.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/fact_serving.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA8D9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAElG;;;;;GAKG;AACH,MAAM,WAAW,2BAA4B,SAAQ,uCAAuC;IAC3F,QAAQ,CAAC,sBAAsB,CAAC,EAAE,SAAS,CAAC;CAC5C;AAgBD,iEAAiE;AACjE,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,uFAAuF;IACvF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,GAC1B,SAAS,IAAI,CAAC,WAAW,EAAE,iBAAiB,GAAG,6BAA6B,CAAC,EAC7E,UAAU,MAAM,EAChB,OAAO,iBAAiB,KACtB,OAAO,CAAC,MAAM,CAaV,CAAC;AAgDR,eAAO,MAAM,iCAAiC,GAAI,SAAS,2BAA2B,KAAG,IAkRxF,CAAC"}
+{"version":3,"file":"fact_serving.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/fact_serving.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAqE9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAElG;;;;;GAKG;AACH,MAAM,WAAW,2BAA4B,SAAQ,uCAAuC;IAC3F,QAAQ,CAAC,sBAAsB,CAAC,EAAE,SAAS,CAAC;CAC5C;AAgBD,iEAAiE;AACjE,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,uFAAuF;IACvF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,GAC1B,SAAS,IAAI,CAAC,WAAW,EAAE,iBAAiB,GAAG,6BAA6B,CAAC,EAC7E,UAAU,MAAM,EAChB,OAAO,iBAAiB,KACtB,OAAO,CAAC,MAAM,CAaV,CAAC;AAgDR,eAAO,MAAM,iCAAiC,GAAI,SAAS,2BAA2B,KAAG,IA4UxF,CAAC"}

package/dist/testing/cross_backend/fact_serving.js

@@ -20,7 +20,11 @@ import '../assert_dev_env.js';
  *   nosniff`, the `default-src 'none'; sandbox` CSP, and `Cache-Control:
  *   private, max-age=300`, whatever its content type;
  * - **bare-hash admin-only** — `GET /api/facts/:hash` is admin (keeper) only:
- *   non-admin → 403, anonymous → 401;
+ *   non-admin → 403, anonymous → 401 (gated on `fact_serving_admin_hash` too);
+ * - **URL bound to hash** — a row whose `external_url` is a well-formed
+ *   `file:` URL naming another hash's file is a masked 404 on both routes,
+ *   refused before any disk read (each spine's unit suite proves the bytes
+ *   behind such a URL never serve);
  * - **multi-actor fallthrough** — a multi-actor caller resolves to a null
  *   (anonymous) context on the (`acting`-less) cell-scoped route, so it can't
  *   read its own *private* fact there (admitted only by public cells). Opt-in
@@ -32,14 +36,17 @@ import '../assert_dev_env.js';
  *   exactly as for an anonymous caller, while a public cell still serves.
  *
  * Facts are seeded **embedded** via `_testing_put_fact` (the cross-process
- * driver has no DB handle); the referencing cell via the `cell_create` RPC
+ * driver has no DB handle), or as a bare external row through its
+ * `external_url`; the referencing cell via the `cell_create` RPC
  * (the hash, a whole string value in `data`, is derived into `cell.refs`). A
  * non-admin owner's cell may reference only a fact it holds, so a fact a
  * non-admin references is put with that owner as its `holder` (the keeper is
  * a global admin, whom ref admission doesn't gate). Gated
- * on `capabilities.fact_serving`; runs under every `cross_backend_*` project —
- * the TS spine binary and the Rust `testing_spine_stub` both mount the serve
- * routes + the seeder.
+ * on `capabilities.fact_serving` (the cell-gated route + the seeder), the
+ * bare-hash cases on `capabilities.fact_serving_admin_hash` as well, so a
+ * backend serving only the cell-gated route runs the rest; runs under every
+ * `cross_backend_*` project — the TS spine binary and the Rust
+ * `testing_spine_stub` both mount both routes + the seeder.
  *
  * @module
  */
@@ -49,7 +56,7 @@ import { FactHashSchema } from '../../primitive_schemas.js';
 import { CellCreateOutput } from '../../auth/cell_action_specs.js';
 import { FACT_CACHE_CONTROL, FACT_CONTENT_SECURITY_POLICY, FACT_X_CONTENT_TYPE_OPTIONS } from '../../server/fact_security_headers.js';
 import { test_if } from './capabilities.js';
-import { cross_rpc_call, expect_output } from './cell_cross_helpers.js';
+import { cross_rpc_call, expect_output } from './cross_rpc.js';
 import { mint_narrowed_api_token } from './narrowed_api_token.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /** A blake3 hash that is a valid form but references no seeded fact. */
@@ -193,7 +200,34 @@ export const describe_fact_serving_cross_tests = (options) => {
             const edge_no_bytes = await fact_get(t, cell_fact_path(unrelated_cell, UNRELATED_HASH), admin_headers);
             assert_masked_404(edge_no_bytes, 'edge to an absent fact');
         });
-        test_if(capabilities.fact_serving, 'bare-hash route is admin-only', async () => {
+        /**
+         * Seed a row written past the store: a well-formed `file:` URL, but the
+         * address of another hash, so serving it would hand out that fact's bytes
+         * under this one's name.
+         */
+        const put_foreign_url_fact = (fixture, holder) => {
+            const other = 'ab' + 'cd'.repeat(31);
+            return cross_put_fact(fixture, rpc_path, {
+                content: 'row-with-a-foreign-url',
+                content_type: 'text/plain',
+                ...(holder === undefined ? {} : { holder }),
+                external_url: `file:${other.slice(0, 2)}/${other.slice(2)}`
+            });
+        };
+        test_if(capabilities.fact_serving, "an external_url naming another fact's file is a masked 404 on the cell route", async () => {
+            const fixture = await setup_test();
+            const owner = await fixture.create_account({ username: 'fact_url_owner' });
+            const hash = await put_foreign_url_fact(fixture, owner.actor.id);
+            const cell_id = await create_cell_with_ref(fixture.fresh_transport(), owner.create_session_headers(), hash, 'public');
+            const anon = fixture.fresh_transport({ origin: null });
+            assert_masked_404(await fact_get(anon, cell_fact_path(cell_id, hash), {}), 'foreign-url fact via a public cell');
+        });
+        test_if(capabilities.fact_serving && capabilities.fact_serving_admin_hash, "an external_url naming another fact's file is a masked 404 on the bare-hash route", async () => {
+            const fixture = await setup_test();
+            const hash = await put_foreign_url_fact(fixture);
+            assert_masked_404(await fact_get(fixture.fresh_transport(), `/api/facts/${hash}`, fixture.create_session_headers()), 'foreign-url fact by bare hash, as admin');
+        });
+        test_if(capabilities.fact_serving && capabilities.fact_serving_admin_hash, 'bare-hash route is admin-only', async () => {
             const fixture = await setup_test();
             const non_admin = await fixture.create_account({ username: 'fact_non_admin' });
             // stored as `text/html` — the type a dropped hardening header would let

package/dist/testing/cross_backend/full_spine_mount.d.ts

@@ -40,6 +40,7 @@ import type { Action } from '../../actions/action_types.js';
 import type { AppDeps } from '../../auth/deps.js';
 import type { DaemonTokenState } from '../../auth/daemon_token.js';
 import type { NotificationSender } from '../../auth/role_grant_offer_notifications.js';
+import type { RpcEndpointSpec } from '../../http/surface.js';
 /** Options for `build_full_spine_rpc_actions` / `build_full_spine_mount`. */
 export interface FullSpineMountOptions {
     /**
@@ -100,4 +101,18 @@ export interface FullSpineMount {
  * @returns the RPC and WS action lists, built once and sharing handler instances
  */
 export declare const build_full_spine_mount: (deps: AppDeps, options: FullSpineMountOptions) => FullSpineMount;
+/**
+ * The spine binary's whole live RPC mount as an endpoint list, built on stub
+ * deps for method resolution only — no handler built here ever runs.
+ *
+ * What a suite resolving off-surface methods takes as its `live_rpc_endpoints`
+ * (the conformance table, the differential, and the auth-row generator), so
+ * rows can name the cell verbs, the actor resolvers and the `_testing_*`
+ * backdoors the spines mount beside the declared surface. The requests go to
+ * the spawned backend, which runs its own handlers. Both spines mount this
+ * method set (the action-manifest parity gate holds them to it).
+ *
+ * @returns one endpoint at `SPINE_RPC_PATH` carrying `build_full_spine_rpc_actions`'s list
+ */
+export declare const create_spine_live_rpc_endpoints: () => Array<RpcEndpointSpec>;
 //# sourceMappingURL=full_spine_mount.d.ts.map

package/dist/testing/cross_backend/full_spine_mount.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"full_spine_mount.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/full_spine_mount.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAG5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8CAA8C,CAAC;AAcvF,6EAA6E;AAC7E,MAAM,WAAW,qBAAqB;IACrC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,KAAK,CAAC,SAAS,CA0CjB,CAAC;AAEF,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC9B,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACnC;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,cAUF,CAAC"}
+{"version":3,"file":"full_spine_mount.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/full_spine_mount.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAG5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8CAA8C,CAAC;AAMvF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAkC7D,6EAA6E;AAC7E,MAAM,WAAW,qBAAqB;IACrC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzD;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,KAAK,CAAC,SAAS,CA2CjB,CAAC;AAEF,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC9B,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACnC;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,cAUF,CAAC;AAaF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,+BAA+B,QAAO,KAAK,CAAC,eAAe,CAOvE,CAAC"}

package/dist/testing/cross_backend/full_spine_mount.js

@@ -5,10 +5,32 @@ import { create_standard_rpc_actions } from '../../auth/standard_rpc_actions.js'
 import { create_all_cell_actions } from '../../auth/all_cell_actions.js';
 import { create_actor_lookup_actions } from '../../auth/actor_lookup_actions.js';
 import { create_actor_search_actions } from '../../auth/actor_search_actions.js';
+import { create_stub_app_deps } from '../stubs.js';
+import { CELL_DROP_TABLES } from '../../db/cell_ddl.js';
+import { FACT_DROP_TABLES } from '../../db/fact_ddl.js';
 import { create_testing_action_manifest_action, create_testing_actions, create_testing_shorten_credential_expiry_action } from './testing_reset_actions.js';
 import { create_testing_origin_check_action } from './testing_origin_check.js';
 import { test_cell_gated_create_authorize } from './test_cell_gated_create_authorize.js';
 import { spine_roles, spine_session_options } from './default_spine_surface.js';
+import { SPINE_RPC_PATH } from './spine_surface_constants.js';
+/**
+ * The domain tables the spine binary's `_testing_reset` empties beside the
+ * auth ones: the `fuz_cell` and `fuz_facts` namespaces' drop lists
+ * (`CELL_DROP_TABLES`, `FACT_DROP_TABLES`), children first. Without it a test
+ * would see the cells and facts a previous test left. The Rust
+ * `testing_spine_stub` empties the same set, taken from its `fuz_cell` /
+ * `fuz_fact` column registries.
+ */
+const SPINE_DOMAIN_RESET_TABLES = [...CELL_DROP_TABLES, ...FACT_DROP_TABLES];
+/**
+ * `_testing_reset`'s `reset_state` for the full spine mount — empties
+ * `SPINE_DOMAIN_RESET_TABLES` on the reset's own transaction.
+ */
+const reset_spine_domain_state = async (db) => {
+    for (const table of SPINE_DOMAIN_RESET_TABLES) {
+        await db.query(`DELETE FROM ${table}`);
+    }
+};
 /**
  * Build the complete live RPC action list the spine test binary mounts on
  * its single endpoint: the declared `create_standard_rpc_actions` bundle plus
@@ -28,7 +50,8 @@ export const build_full_spine_rpc_actions = (deps, options) => {
         ...create_standard_rpc_actions({ ...deps, notification_sender: options.notification_sender ?? null }, { roles: spine_roles }),
         ...create_testing_actions(deps, {
             session_options: spine_session_options,
-            daemon_token_state: options.daemon_token_state
+            daemon_token_state: options.daemon_token_state,
+            reset_state: reset_spine_domain_state
         }),
         // Mount the directory-model `cell_gated_create` test policy (twin of the
         // Rust stub's `TestCellGatedCreateAuthorize`) so the cross-backend
@@ -87,3 +110,34 @@ export const build_full_spine_mount = (deps, options) => {
         ]
     };
 };
+/**
+ * Daemon-token state for building the mount only to read it — the
+ * `_testing_reset` handler that would write it never runs.
+ */
+const RESOLUTION_ONLY_DAEMON_TOKEN_STATE = {
+    current_token: 'resolution_only',
+    previous_token: null,
+    rotated_at: new Date(0),
+    keeper_account_id: null
+};
+/**
+ * The spine binary's whole live RPC mount as an endpoint list, built on stub
+ * deps for method resolution only — no handler built here ever runs.
+ *
+ * What a suite resolving off-surface methods takes as its `live_rpc_endpoints`
+ * (the conformance table, the differential, and the auth-row generator), so
+ * rows can name the cell verbs, the actor resolvers and the `_testing_*`
+ * backdoors the spines mount beside the declared surface. The requests go to
+ * the spawned backend, which runs its own handlers. Both spines mount this
+ * method set (the action-manifest parity gate holds them to it).
+ *
+ * @returns one endpoint at `SPINE_RPC_PATH` carrying `build_full_spine_rpc_actions`'s list
+ */
+export const create_spine_live_rpc_endpoints = () => [
+    {
+        path: SPINE_RPC_PATH,
+        actions: build_full_spine_rpc_actions(create_stub_app_deps(), {
+            daemon_token_state: RESOLUTION_ONLY_DAEMON_TOKEN_STATE
+        })
+    }
+];

package/dist/testing/cross_backend/identity_parity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity_parity.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/identity_parity.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAoH9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAmB5C,uDAAuD;AACvD,MAAM,WAAW,8BAA8B;IAC9C,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,oFAAoF;IACpF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;AA8JD,eAAO,MAAM,oCAAoC,GAChD,SAAS,8BAA8B,KACrC,IAieF,CAAC"}
+{"version":3,"file":"identity_parity.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/identity_parity.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAoH9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAyB5C,uDAAuD;AACvD,MAAM,WAAW,8BAA8B;IAC9C,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,oFAAoF;IACpF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;AA8JD,eAAO,MAAM,oCAAoC,GAChD,SAAS,8BAA8B,KACrC,IAieF,CAAC"}

package/dist/testing/cross_backend/identity_parity.js

@@ -96,7 +96,7 @@ import '../assert_dev_env.js';
  * (not a `conformance_table` row) and ungated. Runs both legs via the shared
  * `{setup_test}` protocol: the in-process leg
  * (`cross_backend/identity_parity.db.test.ts`, plain `gro test`) and the
- * cross-process leg (`cross_backend/identity_parity.cross.test.ts`, the TS spine
+ * cross-process leg (`cross_backend/spine_suites.cross.test.ts`, the TS spine
  * binaries + Rust `testing_spine_stub` over real HTTP).
  *
  * @module
@@ -105,6 +105,7 @@ import { describe, test, assert } from 'vitest';
 import { ERROR_ALREADY_BOOTSTRAPPED, ERROR_AUTHENTICATION_REQUIRED, ERROR_INVALID_CREDENTIALS, ERROR_INVALID_JSON_BODY, ERROR_INVALID_REQUEST_BODY, ERROR_NO_MATCHING_INVITE } from '../../http/error_schemas.js';
 import { DEFAULT_TEST_PASSWORD } from '../test_credentials.js';
 import { test_if } from './capabilities.js';
+import { SPINE_ACCOUNT_BOOTSTRAP_PATH, SPINE_ACCOUNT_LOGIN_PATH, SPINE_ACCOUNT_PASSWORD_PATH, SPINE_ACCOUNT_SIGNUP_PATH } from './spine_surface_constants.js';
 /**
  * The flat-REST `{error}` reason each terminal login/signup status carries on
  * every spine — the assertion target that turns a status-only check into a
@@ -258,10 +259,10 @@ const SIGNUP_EMAIL_CASES = [
 ];
 export const describe_identity_parity_cross_tests = (options) => {
     const { setup_test } = options;
-    const login_path = options.login_path ?? '/api/account/login';
-    const signup_path = options.signup_path ?? '/api/account/signup';
-    const bootstrap_path = options.bootstrap_path === undefined ? '/api/account/bootstrap' : options.bootstrap_path;
-    const password_path = options.password_path === undefined ? '/api/account/password' : options.password_path;
+    const login_path = options.login_path ?? SPINE_ACCOUNT_LOGIN_PATH;
+    const signup_path = options.signup_path ?? SPINE_ACCOUNT_SIGNUP_PATH;
+    const bootstrap_path = options.bootstrap_path === undefined ? SPINE_ACCOUNT_BOOTSTRAP_PATH : options.bootstrap_path;
+    const password_path = options.password_path === undefined ? SPINE_ACCOUNT_PASSWORD_PATH : options.password_path;
     /**
      * POST a raw body typed `application/json` on a fresh (cookie-jar-free)
      * transport, with the transport's allowed `Origin`; return the status and

package/dist/testing/cross_backend/in_process_setup.d.ts

@@ -25,10 +25,15 @@ export interface InProcessSetupOptions extends CreateTestAppOptions {
     /**
      * Additional actor names to seed on the bootstrapped keeper — exposed on
      * `fixture.extra_actors`. See `CrossProcessSetupOptions.extra_actors` /
-     * `TestFixtureBase.extra_actors`. Seeded directly against the live backend
+     * `TestFixture.extra_actors`. Seeded directly against the live backend
      * DB (in-process has no wire hop).
      */
     readonly extra_actors?: ReadonlyArray<string>;
+    /**
+     * Refuse undeclared audit metadata keys in the fixture's audit reads — see
+     * `CrossProcessSetupOptions.reject_unknown_audit_metadata_keys`.
+     */
+    readonly reject_unknown_audit_metadata_keys?: boolean;
 }
 /**
  * Build a `SetupTest` that creates a fresh `TestApp` per call via
@@ -90,9 +95,14 @@ export interface DefaultInProcessSuiteOptions {
     extra_accounts?: ReadonlyArray<ExtraAccountSpec>;
     /**
      * Additional actor names to seed on the bootstrapped keeper — exposed on
-     * `fixture.extra_actors`. See `TestFixtureBase.extra_actors`.
+     * `fixture.extra_actors`. See `TestFixture.extra_actors`.
      */
     extra_actors?: ReadonlyArray<string>;
+    /**
+     * Refuse undeclared audit metadata keys in the fixture's audit reads — see
+     * `CrossProcessSetupOptions.reject_unknown_audit_metadata_keys`.
+     */
+    reject_unknown_audit_metadata_keys?: boolean;
     /**
      * Pre-built `AppSurfaceSpec` — overrides the default which calls
      * `create_test_app_surface_spec` against the same factory inputs.

package/dist/testing/cross_backend/in_process_setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"in_process_setup.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/in_process_setup.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAqB9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAGnE,OAAO,EAIN,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAGN,KAAK,uBAAuB,EAC5B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAEtF,OAAO,EAGN,KAAK,SAAS,EAEd,KAAK,gBAAgB,EACrB,MAAM,YAAY,CAAC;AAepB;;;;;GAKG;AACH,MAAM,WAAW,qBAAsB,SAAQ,oBAAoB;IAClE;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAC1D;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC9C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,wBAAwB,GACnC,SAAS,qBAAqB,KAAG,SAqEjC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,WAAW,4BAA4B;IAC5C,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACnC;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IACjD;;;OAGG;IACH,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACrC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;CAChC;AAWD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,gCAAgC,GAAI,KAAK,CAAC,CAAC,SAAS,4BAA4B,EAC5F,SAAS,CAAC,KACR;IACF,UAAU,EAAE,SAAS,CAAC;IACtB,cAAc,EAAE,cAAc,CAAC;IAC/B,YAAY,EAAE,mBAAmB,CAAC;IAClC,eAAe,EAAE,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACtC,kBAAkB,EAAE,CAAC,CAAC,oBAAoB,CAAC,CAAC;IAC5C,aAAa,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC;CA8BjC,CAAC"}
+{"version":3,"file":"in_process_setup.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/in_process_setup.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAqB9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAGnE,OAAO,EAIN,KAAK,oBAAoB,EACzB,KAAK,eAAe,EAEpB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAGN,KAAK,uBAAuB,EAC5B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAEtF,OAAO,EAGN,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,MAAM,YAAY,CAAC;AAepB;;;;;GAKG;AACH,MAAM,WAAW,qBAAsB,SAAQ,oBAAoB;IAClE;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAC1D;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;OAGG;IACH,QAAQ,CAAC,kCAAkC,CAAC,EAAE,OAAO,CAAC;CACtD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,wBAAwB,GACnC,SAAS,qBAAqB,KAAG,SAuEjC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,WAAW,4BAA4B;IAC5C,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACnC;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IACjD;;;OAGG;IACH,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACrC;;;OAGG;IACH,kCAAkC,CAAC,EAAE,OAAO,CAAC;IAC7C;;;;;OAKG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;CAChC;AAWD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,gCAAgC,GAAI,KAAK,CAAC,CAAC,SAAS,4BAA4B,EAC5F,SAAS,CAAC,KACR;IACF,UAAU,EAAE,SAAS,CAAC;IACtB,cAAc,EAAE,cAAc,CAAC;IAC/B,YAAY,EAAE,mBAAmB,CAAC;IAClC,eAAe,EAAE,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACtC,kBAAkB,EAAE,CAAC,CAAC,oBAAoB,CAAC,CAAC;IAC5C,aAAa,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC;CA+BjC,CAAC"}