@fuzdev/fuz_app 0.147.0 → 0.148.0

package/dist/testing/cross_backend/create_cross_backend_global_setup.js

@@ -1,5 +1,6 @@
 import '../assert_dev_env.js';
 import { bootstrap_backend } from './bootstrap_backend.js';
+import { ensure_database_for_url } from './postgres_database.js';
 import { serialize_bootstrapped_handle } from './setup.js';
 /**
  * Default project-name → backend-name reduction: strips the
@@ -8,19 +9,39 @@ import { serialize_bootstrapped_handle } from './setup.js';
  * `cross_backend_ts_deno` → `deno` and `cross_backend_rust` → `rust`.
  */
 const DEFAULT_PROJECT_NAME_PREFIX = /^cross_backend_(?:ts_)?/;
+const default_cross_backend_global_setup_deps = {
+    ensure_database_for_url,
+    bootstrap_backend
+};
 /**
  * Build a vitest `globalSetup` default export. Returns the
  * `(project) => teardown` function vitest 4 expects.
+ *
+ * @param options - the configs, and what runs before the spawn
+ * @param deps - the database creator and the spawn, the shipped ones by default
+ * @throws Error when a `before_spawn` key names no config
  */
-export const create_cross_backend_global_setup = ({ configs, derive_name = (project_name) => project_name.replace(DEFAULT_PROJECT_NAME_PREFIX, ''), provide_key = 'backend_handle' }) => {
+export const create_cross_backend_global_setup = ({ configs, derive_name = (project_name) => project_name.replace(DEFAULT_PROJECT_NAME_PREFIX, ''), provide_key = 'backend_handle', ensure_databases = false, before_spawn = {} }, deps = default_cross_backend_global_setup_deps) => {
+    for (const name of Object.keys(before_spawn)) {
+        if (!Object.hasOwn(configs, name)) {
+            throw new Error(`create_cross_backend_global_setup: before_spawn names '${name}', which has no config — ` +
+                `expected one of: ${Object.keys(configs).join(', ')}`);
+        }
+    }
     return async (project) => {
         const name = derive_name(project.name);
-        const factory = configs[name];
+        const factory = Object.hasOwn(configs, name) ? configs[name] : undefined;
         if (!factory) {
             throw new Error(`Could not derive backend config from vitest project '${project.name}' ` +
                 `(derived name '${name}') — expected one of: ${Object.keys(configs).join(', ')}`);
         }
-        const bootstrapped = await bootstrap_backend(factory());
+        if (Object.hasOwn(before_spawn, name))
+            await before_spawn[name]();
+        const config = factory();
+        const database_url = config.env.DATABASE_URL;
+        if (ensure_databases && database_url !== undefined)
+            deps.ensure_database_for_url(database_url);
+        const bootstrapped = await deps.bootstrap_backend(config);
         // vitest's `provide` is keyed on the consumer-augmented `ProvidedContext`;
         // the generic key is a plain string, so cast past the keyof constraint.
         project.provide(provide_key, serialize_bootstrapped_handle(bootstrapped));

package/dist/testing/cross_backend/create_dual_spawn_global_setup.d.ts

@@ -19,15 +19,14 @@ import '../assert_dev_env.js';
  * import {create_dual_spawn_global_setup} from
  *   '@fuzdev/fuz_app/testing/cross_backend/create_dual_spawn_global_setup.ts';
  * import {deno_backend_config, rust_backend_config} from './my_backend_config.js';
- * import './cross_test_types.js'; // augments the two provide keys
  *
  * export default create_dual_spawn_global_setup({
  *   configs: {a: deno_backend_config, b: rust_backend_config},
  * });
  * ```
  *
- * The `.cross.test.ts` `inject`s both keys, rebuilds each with
- * `reconstruct_bootstrapped_handle`, and asserts. Run this project in a
+ * The `.cross.test.ts` reads both with `inject_parity_handles`
+ * (`provided_context.ts`, which declares the default keys) and asserts. Run this project in a
  * later `groupOrder` than the single-backend projects (or with distinct
  * ports) — it reuses both configs' ports, so it must not run concurrently
  * with the per-backend projects.
@@ -49,8 +48,9 @@ export interface DualSpawnGlobalSetupOptions {
     /**
      * `project.provide` keys for the two serialized handles (read by
      * `inject` in the test). Default `parity_handle_a` / `parity_handle_b`
-     * (the primary parity use); override for other dual-spawn gates. Augment
-     * vitest's `ProvidedContext` for whichever keys you use.
+     * (the primary parity use, declared on vitest's `ProvidedContext` by
+     * `provided_context.ts`); override for other dual-spawn gates, augmenting
+     * `ProvidedContext` for those keys yourself.
      */
     readonly provide_keys?: {
         readonly a: string;

package/dist/testing/cross_backend/create_dual_spawn_global_setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create_dual_spawn_global_setup.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/create_dual_spawn_global_setup.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAIzD,MAAM,WAAW,2BAA2B;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,aAAa,CAAC;QAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,aAAa,CAAA;KAAE,CAAC;IACvF;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE;QAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACnE;AAED;;GAEG;AACH,eAAO,MAAM,8BAA8B,GAAI,2BAG5C,2BAA2B,KAAG,CAAC,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAmBvF,CAAC"}
+{"version":3,"file":"create_dual_spawn_global_setup.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/create_dual_spawn_global_setup.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAIzD,MAAM,WAAW,2BAA2B;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,aAAa,CAAC;QAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,aAAa,CAAA;KAAE,CAAC;IACvF;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE;QAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACnE;AAED;;GAEG;AACH,eAAO,MAAM,8BAA8B,GAAI,2BAG5C,2BAA2B,KAAG,CAAC,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAmBvF,CAAC"}

package/dist/testing/cross_backend/credential_deadline.d.ts

@@ -1,20 +1,24 @@
 import '../assert_dev_env.js';
 import { type BackendCapabilities } from './capabilities.js';
 import type { SetupTest } from './setup.js';
+import { type WsEndpointTarget } from './ws_endpoint.js';
 /** Configuration for `describe_credential_deadline_cross_tests`. */
-export interface CredentialDeadlineCrossTestOptions {
-    /** Per-test fixture producer (`default_cross_process_setup(handle)`). */
+export interface CredentialDeadlineCrossTestOptions extends WsEndpointTarget {
+    /** Fixture producer (`default_cross_process_setup(handle)`), called once for the suite. */
     readonly setup_test: SetupTest;
     /** Backend capability flags — the WebSocket cases gate on `ws`, the stream case on `sse`. */
     readonly capabilities: BackendCapabilities;
-    /** Base URL the backend is reachable at. */
-    readonly base_url: string;
-    /** The WebSocket endpoint path (e.g. `/api/ws`). */
-    readonly ws_path: string;
     /** The audit-log stream path. Default `/api/admin/audit/stream`. */
     readonly sse_path?: string;
     /** JSON-RPC endpoint path. Default `SPINE_RPC_PATH`. */
     readonly rpc_path?: string;
+    /**
+     * Roles each account this suite opens a socket for is created with, for a
+     * backend whose WS upgrade requires a role (an admin-gated `/api/ws`
+     * refuses a roleless account's upgrade). Each must be admin-grantable — the
+     * fixture offers it. Default none.
+     */
+    readonly ws_account_roles?: ReadonlyArray<string>;
 }
 /**
  * Register the credential-deadline suite: a WebSocket on a session or an API

package/dist/testing/cross_backend/credential_deadline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential_deadline.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/credential_deadline.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAmD9B,OAAO,EAAE,KAAK,mBAAmB,EAAW,MAAM,mBAAmB,CAAC;AACtE,OAAO,KAAK,EAAE,SAAS,EAAmC,MAAM,YAAY,CAAC;AAsB7E,oEAAoE;AACpE,MAAM,WAAW,kCAAkC;IAClD,yEAAyE;IACzE,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,6FAA6F;IAC7F,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,4CAA4C;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oDAAoD;IACpD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;GAIG;AACH,eAAO,MAAM,wCAAwC,GACpD,SAAS,kCAAkC,KACzC,IAoKF,CAAC"}
+{"version":3,"file":"credential_deadline.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/credential_deadline.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAwD9B,OAAO,EAAE,KAAK,mBAAmB,EAAW,MAAM,mBAAmB,CAAC;AAEtE,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,YAAY,CAAC;AAEzD,OAAO,EAAsC,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAkB7F,oEAAoE;AACpE,MAAM,WAAW,kCAAmC,SAAQ,gBAAgB;IAC3E,2FAA2F;IAC3F,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,6FAA6F;IAC7F,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAClD;AAED;;;;GAIG;AACH,eAAO,MAAM,wCAAwC,GACpD,SAAS,kCAAkC,KACzC,IAiKF,CAAC"}

package/dist/testing/cross_backend/credential_deadline.js

@@ -29,12 +29,17 @@ import '../assert_dev_env.js';
  * covers it below the wire — the Rust stream route on a widened credential
  * gate, the TS deadline wait shared by both transports.
  *
+ * The cases run concurrently, each on its own account under one reset for the
+ * suite: the seam shortens only the account it names, so each case waits out
+ * its own deadline and the suite takes about one. Every case keeps the full
+ * `expiry_seconds` margin — the "open short of the deadline" check needs it.
+ *
  * Gated on `capabilities.ws` (cases 1, 2, 4) and `capabilities.sse` (case 3);
  * cross-process only — the seam is mounted on the spine test binaries.
  *
  * @module
  */
-import { assert, describe } from 'vitest';
+import { assert, beforeAll, describe } from 'vitest';
 import { heartbeat_action_spec } from '../../actions/heartbeat.js';
 import { WS_CLOSE_CREDENTIAL_EXPIRED_REASON, WS_CLOSE_SESSION_REVOKED } from '../../actions/transports.js';
 import { ROLE_ADMIN } from '../../auth/role_schema.js';
@@ -43,9 +48,8 @@ import { rpc_call_non_browser } from '../rpc_helpers.js';
 import { create_sse_transport } from '../transports/sse_transport.js';
 import { create_admitted_ws_transport } from '../transports/ws_transport.js';
 import { test_if } from './capabilities.js';
-import { SPINE_RPC_PATH } from './spine_surface_constants.js';
-/** Default audit-log stream path. */
-const DEFAULT_SSE_PATH = '/api/admin/audit/stream';
+import { SPINE_RPC_PATH, SPINE_SSE_PATH } from './spine_surface_constants.js';
+import { open_session_ws, to_session_cookie } from './ws_endpoint.js';
 /** The shortened lifetime each case gives its credentials, in seconds. */
 const EXPIRY_SECONDS = 2;
 /**
@@ -65,7 +69,8 @@ const EARLIEST_CLOSE_MS = EXPIRY_SECONDS * 1000 - 300;
  * audit stream on a session ends there, and the expiry seam never extends.
  */
 export const describe_credential_deadline_cross_tests = (options) => {
-    const { setup_test, capabilities, base_url, ws_path, sse_path = DEFAULT_SSE_PATH, rpc_path = SPINE_RPC_PATH } = options;
+    const { setup_test, capabilities, base_url, ws_path, sse_path = SPINE_SSE_PATH, rpc_path = SPINE_RPC_PATH, ws_account_roles = [] } = options;
+    const ws_account = { roles: [...ws_account_roles] };
     /**
      * Pull `account`'s credential expiries in to `seconds` from now through the
      * daemon-token seam, returning when it was called.
@@ -85,11 +90,6 @@ export const describe_credential_deadline_cross_tests = (options) => {
         const counts = result.result;
         return { called_at, ...counts };
     };
-    const cookie_of = (account) => {
-        const { cookie } = account.create_session_headers();
-        assert.ok(cookie, 'expected a session cookie');
-        return cookie;
-    };
     /**
      * Assert `client` is open short of the deadline, then closes with 4001
      * "Credential expired" at it.
@@ -103,18 +103,24 @@ export const describe_credential_deadline_cross_tests = (options) => {
         assert.strictEqual(client.close_code, WS_CLOSE_SESSION_REVOKED);
         assert.strictEqual(client.close_reason, WS_CLOSE_CREDENTIAL_EXPIRED_REASON);
     };
-    describe('credential deadline (cross-process)', () => {
+    describe.concurrent('credential deadline (cross-process)', () => {
+        // One reset for the suite: the cases share no state past it, since each
+        // mints its own account and the seam touches only that account.
+        let suite_fixture = null;
+        beforeAll(async () => {
+            if (capabilities.ws || capabilities.sse)
+                suite_fixture = await setup_test();
+        });
+        const get_fixture = () => {
+            assert.ok(suite_fixture, 'the suite fixture was not set up');
+            return suite_fixture;
+        };
         test_if(capabilities.ws, 'a session socket closes with 4001 "Credential expired" at the deadline', async () => {
-            const fixture = await setup_test();
-            const account = await fixture.create_account();
+            const fixture = get_fixture();
+            const account = await fixture.create_account(ws_account);
             const { called_at, sessions } = await shorten(fixture, account, EXPIRY_SECONDS);
             assert.ok(sessions >= 1, 'the seam shortened the account session');
-            const client = await create_admitted_ws_transport({
-                base_url,
-                ws_path,
-                cookies: [cookie_of(account)],
-                origin: base_url
-            });
+            const client = await open_session_ws(options, account, { admitted: true });
             try {
                 await assert_closes_at_deadline(client, called_at);
             }
@@ -123,8 +129,8 @@ export const describe_credential_deadline_cross_tests = (options) => {
             }
         });
         test_if(capabilities.ws, 'an API token socket closes with 4001 "Credential expired" at the deadline', async () => {
-            const fixture = await setup_test();
-            const account = await fixture.create_account();
+            const fixture = get_fixture();
+            const account = await fixture.create_account(ws_account);
             const { called_at, api_tokens } = await shorten(fixture, account, EXPIRY_SECONDS);
             assert.ok(api_tokens >= 1, 'the seam shortened the account API token');
             // a bearer outside a browser context: no Origin, no cookie
@@ -143,13 +149,13 @@ export const describe_credential_deadline_cross_tests = (options) => {
             }
         });
         test_if(capabilities.sse, 'a session audit stream ends at the deadline', async () => {
-            const fixture = await setup_test();
+            const fixture = get_fixture();
             const account = await fixture.create_account({ roles: [ROLE_ADMIN] });
             const { called_at } = await shorten(fixture, account, EXPIRY_SECONDS);
             const sse = await create_sse_transport({
                 base_url,
                 sse_path,
-                cookies: [cookie_of(account)],
+                cookies: [to_session_cookie(account)],
                 origin: base_url
             });
             try {
@@ -163,17 +169,12 @@ export const describe_credential_deadline_cross_tests = (options) => {
             }
         });
         test_if(capabilities.ws, 'the expiry seam only shortens: a later expiry moves nothing', async () => {
-            const fixture = await setup_test();
-            const account = await fixture.create_account();
+            const fixture = get_fixture();
+            const account = await fixture.create_account(ws_account);
             const { called_at } = await shorten(fixture, account, EXPIRY_SECONDS);
             // asks for a minute; the credentials stay due at the first deadline
             await shorten(fixture, account, 60);
-            const client = await create_admitted_ws_transport({
-                base_url,
-                ws_path,
-                cookies: [cookie_of(account)],
-                origin: base_url
-            });
+            const client = await open_session_ws(options, account, { admitted: true });
             try {
                 await assert_closes_at_deadline(client, called_at);
             }

package/dist/testing/cross_backend/credential_header_robustness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential_header_robustness.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/credential_header_robustness.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA4D9B,qGAAqG;AACrG,MAAM,WAAW,0CAA0C;IAC1D,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC9B;AAgDD,eAAO,MAAM,iDAAiD,GAC7D,SAAS,0CAA0C,KACjD,IAkHF,CAAC"}
+{"version":3,"file":"credential_header_robustness.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/credential_header_robustness.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA6D9B,qGAAqG;AACrG,MAAM,WAAW,0CAA0C;IAC1D,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC9B;AA6CD,eAAO,MAAM,iDAAiD,GAC7D,SAAS,0CAA0C,KACjD,IAkHF,CAAC"}

package/dist/testing/cross_backend/credential_header_robustness.js

@@ -39,8 +39,8 @@ import '../assert_dev_env.js';
  * Raw-socket by necessity (`fetch` can't emit duplicate or malformed headers),
  * so — like `body_size_smuggling.ts` — this is **cross-process only** and
  * fixture-free: it needs only the base URL, the RPC path, and a valid daemon
- * token (`handle.daemon_token`, kept current for the run by the same rotation
- * the `_testing_reset` channel relies on). Cited property: `docs/security.md`
+ * token (`handle.daemon_token`, read once at spawn and static for the run, the
+ * same credential the `_testing_reset` channel uses). Cited property: `docs/security.md`
  * §"Credential Type Hierarchy" (a leaked / conflicting credential header can't
  * escalate the credential ceiling) + §"API Token Security" (bearer handling).
  *
@@ -48,16 +48,14 @@ import '../assert_dev_env.js';
  */
 import { describe, test, assert } from 'vitest';
 import { DAEMON_TOKEN_HEADER } from '../../auth/daemon_token.js';
-import { raw_http_count_responses, raw_http_exchange, raw_http_first_status } from '../transports/raw_http.js';
+import { raw_http_count_responses, raw_http_exchange, raw_http_first_status, RAW_HTTP_READ_TIMEOUT_MS } from '../transports/raw_http.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 /** A well-formed UUID that never names a real row. */
 const NIL_UUID = '00000000-0000-0000-0000-000000000000';
 /** A value that is never a real credential — used for the conflicting / garbage copies. */
 const GARBAGE_TOKEN = 'not-a-real-credential-value';
-/** How long each raw exchange waits for the server to finish answering. */
-const RAW_READ_TIMEOUT_MS = 2000;
 /** Write `request_bytes` to a fresh raw socket and read until the server closes. */
-const send_raw = async (base_url, request_bytes) => (await raw_http_exchange(base_url, request_bytes, { read_timeout_ms: RAW_READ_TIMEOUT_MS }))
+const send_raw = async (base_url, request_bytes) => (await raw_http_exchange(base_url, request_bytes, { read_timeout_ms: RAW_HTTP_READ_TIMEOUT_MS }))
     .received;
 const is_success_status = (status) => status >= 200 && status < 300;
 /**

package/dist/testing/cross_backend/{cell_cross_helpers.d.ts → cross_rpc.d.ts}

@@ -15,7 +15,17 @@ export interface RpcResult {
  * POST a JSON-RPC call over a cross-process `FetchTransport` with the given
  * auth headers. Distinct from `testing/rpc_helpers.ts`'s `app`-based `rpc_call`: this
  * variant drives the cookie-jar `FetchTransport` the cross-backend harness
- * spawns against, and returns the slim `RpcResult` the cell suites read.
+ * spawns against, and returns the slim `RpcResult` the suites read.
+ *
+ * @param transport - the transport to send on
+ * @param path - the RPC endpoint path
+ * @param method - the JSON-RPC method
+ * @param params - the request params
+ * @param headers - auth and other headers, merged over the JSON defaults
+ * @returns the response's `ok`, `result` and `error`
+ * @throws Error when the reply is not a JSON object — naming the method, the
+ *   HTTP status and the head of the body, so a proxy page or a crash reads
+ *   as what it is
  */
 export declare const cross_rpc_call: (transport: FetchTransport, path: string, method: string, params: unknown, headers: Record<string, string>) => Promise<RpcResult>;
 /** Pull `error.data.reason` off an RPC error envelope (undefined if absent). */
@@ -25,4 +35,4 @@ export declare const error_reason: (r: RpcResult) => unknown;
  * output schema — the wire-shape parity gate. Returns the parsed output.
  */
 export declare const expect_output: <T>(r: RpcResult, schema: z.ZodType<T>) => T;
-//# sourceMappingURL=cell_cross_helpers.d.ts.map
+//# sourceMappingURL=cross_rpc.d.ts.map

package/dist/testing/cross_backend/cross_rpc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cross_rpc.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cross_rpc.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAgB9B,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAG7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAEvE,qEAAqE;AACrE,MAAM,WAAW,SAAS;IACzB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC9F;AAKD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,cAAc,GAC1B,WAAW,cAAc,EACzB,MAAM,MAAM,EACZ,QAAQ,MAAM,EACd,QAAQ,OAAO,EACf,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC7B,OAAO,CAAC,SAAS,CAmBnB,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,YAAY,GAAI,GAAG,SAAS,KAAG,OAG/B,CAAC;AAEd;;;GAGG;AACH,eAAO,MAAM,aAAa,GAAI,CAAC,EAAE,GAAG,SAAS,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAG,CAUrE,CAAC"}

package/dist/testing/cross_backend/{cell_cross_helpers.js → cross_rpc.js}

@@ -1,10 +1,10 @@
 import '../assert_dev_env.js';
 /**
- * Shared call-site primitives for the cell cross-backend parity suites
- * (`testing/cross_backend/cell_crud.ts` + `testing/cross_backend/cell_relations.ts`).
+ * JSON-RPC call-site primitives for the cross-backend suites.
  *
- * The cell verbs are stateful and authz-shaped, so both suites POST raw
- * JSON-RPC envelopes (threading ids + auth headers across calls) and parse
+ * The stateful suites (the cell verbs, account lifecycle, role grants, tokens,
+ * facts, audit reads) POST raw JSON-RPC envelopes over a cross-process
+ * `FetchTransport`, threading ids and auth headers across calls, and parse
  * every success `result` against the verb's declared Zod **output** schema —
  * the wire-shape parity gate. A TS↔Rust envelope drift, not just a payload
  * field drift, fails the assertion.
@@ -13,18 +13,42 @@ import '../assert_dev_env.js';
  */
 import { assert } from 'vitest';
 import { create_rpc_post_init } from '../rpc_helpers.js';
+/** How much of a non-envelope reply body `cross_rpc_call`'s error quotes. */
+const BODY_HEAD_LENGTH = 200;
 /**
  * POST a JSON-RPC call over a cross-process `FetchTransport` with the given
  * auth headers. Distinct from `testing/rpc_helpers.ts`'s `app`-based `rpc_call`: this
  * variant drives the cookie-jar `FetchTransport` the cross-backend harness
- * spawns against, and returns the slim `RpcResult` the cell suites read.
+ * spawns against, and returns the slim `RpcResult` the suites read.
+ *
+ * @param transport - the transport to send on
+ * @param path - the RPC endpoint path
+ * @param method - the JSON-RPC method
+ * @param params - the request params
+ * @param headers - auth and other headers, merged over the JSON defaults
+ * @returns the response's `ok`, `result` and `error`
+ * @throws Error when the reply is not a JSON object — naming the method, the
+ *   HTTP status and the head of the body, so a proxy page or a crash reads
+ *   as what it is
  */
 export const cross_rpc_call = async (transport, path, method, params, headers) => {
     const init = create_rpc_post_init(method, params);
     Object.assign(init.headers, headers);
     const res = await transport(path, init);
-    const body = (await res.json());
-    return { ok: res.ok, result: body.result, error: body.error };
+    const text = await res.text();
+    let body;
+    try {
+        body = JSON.parse(text);
+    }
+    catch {
+        body = undefined;
+    }
+    if (body === null || typeof body !== 'object') {
+        throw new Error(`${method}: expected a JSON-RPC envelope, got status ${res.status} with body: ` +
+            JSON.stringify(text.slice(0, BODY_HEAD_LENGTH)));
+    }
+    const envelope = body;
+    return { ok: res.ok, result: envelope.result, error: envelope.error };
 };
 /** Pull `error.data.reason` off an RPC error envelope (undefined if absent). */
 export const error_reason = (r) => r.error && typeof r.error.data === 'object' && r.error.data !== null

package/dist/testing/cross_backend/default_backend_configs.d.ts

@@ -1,40 +1,24 @@
 import '../assert_dev_env.js';
+import type { BackendBootstrapConfig, BackendConfig } from './backend_config.js';
+import type { BackendCapabilities, FamilyDefaultCapabilities } from './capabilities.js';
+import { type TestBackendPaths } from './build_test_backend_paths.js';
 /**
- * Family-shared `BackendConfig` builders for cross-process test backends.
- *
- * Two consumer-facing factories — `make_default_ts_backend_config`
- * and `make_default_rust_backend_config` — own the common shape
- * for the JS-runtime (Deno/Node on V8) and Rust families respectively.
- * Per-backend factories in consumer projects compose a small
- * declaration against one of these and add consumer-specific env vars
- * via `extra_env`.
- *
- * Defaults baked in by family:
- *
- * - **TS** — `'memory://'` (in-memory pglet), 30s startup window. Its shape notes
- *   (`ts_default_shape_notes`) record `trusted_proxy: false` /
- *   `login_rate_limit: false` — the TS canonical path leaves those limiters
- *   null in test mode.
- * - **Rust** — caller-supplied real Postgres URL (an in-process WASM database isn't reachable
- *   from `tokio-postgres`), 120s startup window (cargo first-build cost), the
- *   `FUZ_TESTING_RESET_DB_ON_STARTUP=true` self-wipe gate, and shape notes
- *   (`rust_default_shape_notes`) recording `trusted_proxy: true` +
- *   `login_rate_limit: true`.
- *
- * Both builders default `port_env_var` to `'PORT'`. Consumers whose
- * binary reads a different name (e.g. zzz's `ZZZ_PORT`) override.
- *
- * Common across both families: `/api/rpc`, `/api/ws`, `/health`,
- * `/api/account/bootstrap`, `cookie_name: 'fuz_session'`, the standard
- * bootstrap block keyed off `default_test_*` constants. Builders call
- * `build_test_backend_paths(name)` internally when the optional `paths`
- * is omitted.
+ * The `HOST` both builders bind a backend to — loopback IPv4, since
+ * `localhost` can resolve to `::1` and a backend bound there misses a client
+ * that connects to `127.0.0.1` (the raw-socket suites, a git hook calling
+ * back). `base_url` stays `http://localhost:<port>`, which reaches it.
+ */
+export declare const DEFAULT_TEST_BACKEND_HOST = "127.0.0.1";
+/**
+ * The directory a binary writing its daemon token to `{dir}/run/daemon_token`
+ * is given, so the token lands at `daemon_token_path`.
  *
- * @module
+ * @param daemon_token_path - where the harness reads the token
+ * @returns the `{dir}` of that layout
+ * @throws Error when the path is not `.../run/daemon_token`, which no such
+ *   directory can produce
  */
-import type { BackendBootstrapConfig, BackendConfig } from './backend_config.js';
-import type { BackendCapabilities, BackendShapeNotes } from './capabilities.js';
-import { type TestBackendPaths } from './build_test_backend_paths.js';
+export declare const to_daemon_token_dir: (daemon_token_path: string) => string;
 /** Options for `action_rate_limit_env`. */
 export interface ActionRateLimitEnvOptions {
     readonly enable_action_rate_limit?: boolean;
@@ -48,33 +32,18 @@ export interface ActionRateLimitEnvOptions {
  */
 export declare const action_rate_limit_env: (options: ActionRateLimitEnvOptions) => Record<string, string>;
 /**
- * Capabilities shared by TS-family backends — same canonical implementation,
- * same feature set. The non-gating wiring facts (`bearer_auth` /
- * `trusted_proxy` / `login_rate_limit`) live in `ts_default_shape_notes`.
+ * Capabilities shared by TS-family backends — only what the family
+ * guarantees: the declared spine surface's mounts and the behavior of its
+ * reference runtime, Node. Carries no `MountFlag`; each backend config states
+ * those itself (`FamilyDefaultCapabilities`).
  */
-export declare const ts_default_capabilities: BackendCapabilities;
+export declare const ts_default_capabilities: FamilyDefaultCapabilities;
 /**
- * Capabilities for the Rust family. The non-gating wiring facts live in
- * `rust_default_shape_notes` (which records the family's `trusted_proxy` +
- * `login_rate_limit` differences from the TS family).
+ * Capabilities for the Rust family — only what the family guarantees, as with
+ * `ts_default_capabilities`: the declared spine surface's mounts and the
+ * behavior of hyper. Carries no `MountFlag`.
  */
-export declare const rust_default_capabilities: BackendCapabilities;
-/**
- * Shape notes for TS-family backends — wiring facts, not gating flags.
- * `trusted_proxy: false` (the test binary doesn't enable proxy parsing) and
- * `login_rate_limit: false` (the TS canonical path leaves the limiter null in
- * test mode); bearer auth is always wired. Documentation only — see
- * `BackendShapeNotes`.
- */
-export declare const ts_default_shape_notes: BackendShapeNotes;
-/**
- * Shape notes for Rust-family backends — wiring facts, not gating flags. Adds
- * `trusted_proxy: true` (the Rust spine's client-IP middleware is always wired;
- * the env-gate only chooses XFF vs the TCP peer IP) and `login_rate_limit: true`
- * (env-gated bucket on `/login` + `/password`). Documentation only — see
- * `BackendShapeNotes`.
- */
-export declare const rust_default_shape_notes: BackendShapeNotes;
+export declare const rust_default_capabilities: FamilyDefaultCapabilities;
 export interface MakeDefaultTsBackendConfigOptions {
     /** Diagnostic label; also used as the tmpdir prefix when `paths` is omitted. */
     readonly name: string;
@@ -86,8 +55,12 @@ export interface MakeDefaultTsBackendConfigOptions {
     readonly database_url?: string;
     /** Merged on top of the generic env baseline; later keys win. */
     readonly extra_env?: Readonly<Record<string, string>>;
-    /** Defaults to `ts_default_capabilities`. */
-    readonly capabilities?: BackendCapabilities;
+    /**
+     * Every capability, stated: spread `ts_default_capabilities` and add each
+     * `MountFlag`. Required, so a mount flag left out is a type error rather
+     * than a suite that silently skips.
+     */
+    readonly capabilities: BackendCapabilities;
     /** Pre-computed paths; defaults to `build_test_backend_paths(name)`. */
     readonly paths?: TestBackendPaths;
     /** Override individual bootstrap fields (username/password/token). */
@@ -106,6 +79,15 @@ export interface MakeDefaultTsBackendConfigOptions {
      * `create_account` path (e.g. fuz_forge uses `'fuz_forge_session'`).
      */
     readonly cookie_name?: string;
+    /**
+     * Env var naming the directory the binary writes its daemon token under
+     * (`{dir}/run/daemon_token`), e.g. `'MY_APP_DAEMON_TOKEN_DIR'`. Given, it
+     * is set to the directory that layout puts the token at the bootstrap's
+     * `daemon_token_path` (`to_daemon_token_dir`) — the file `spawn_backend`
+     * reads — and a path in another layout throws. Omit it for a binary that
+     * derives the path otherwise.
+     */
+    readonly daemon_token_dir_env?: string;
 }
 /**
  * Shared builder for TS-family backends (Deno + Node). Owns the common
@@ -129,8 +111,12 @@ export interface MakeDefaultRustBackendConfigOptions {
     readonly database_url: string;
     /** Merged on top of the generic env baseline; later keys win. */
     readonly extra_env?: Readonly<Record<string, string>>;
-    /** Defaults to `rust_default_capabilities`. */
-    readonly capabilities?: BackendCapabilities;
+    /**
+     * Every capability, stated: spread `rust_default_capabilities` and add each
+     * `MountFlag`. Required, so a mount flag left out is a type error rather
+     * than a suite that silently skips.
+     */
+    readonly capabilities: BackendCapabilities;
     /** Pre-computed paths; defaults to `build_test_backend_paths(name)`. */
     readonly paths?: TestBackendPaths;
     /** Override individual bootstrap fields (username/password/token). */
@@ -152,6 +138,15 @@ export interface MakeDefaultRustBackendConfigOptions {
      * Must match the consumer's session config (see the TS builder's note).
      */
     readonly cookie_name?: string;
+    /**
+     * Env var naming the directory the binary writes its daemon token under
+     * (`{dir}/run/daemon_token`), e.g. `'MY_APP_DAEMON_TOKEN_DIR'`. Given, it
+     * is set to the directory that layout puts the token at the bootstrap's
+     * `daemon_token_path` (`to_daemon_token_dir`) — the file `spawn_backend`
+     * reads — and a path in another layout throws. Omit it for a binary that
+     * derives the path otherwise.
+     */
+    readonly daemon_token_dir_env?: string;
 }
 /**
  * Shared builder for Rust-family backends. Owns the common env baseline

package/dist/testing/cross_backend/default_backend_configs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EAA4B,KAAK,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAYhG,2CAA2C;AAC3C,MAAM,WAAW,yBAAyB;IACzC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,yBAAyB,KAChC,MAAM,CAAC,MAAM,EAAE,MAAM,CAKtB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAsCpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBA8BtC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAIrC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,mDAAmD;IACnD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAoCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA4CF,CAAC"}
+{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAqC9B,OAAO,KAAK,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AACxF,OAAO,EAA4B,KAAK,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAehG;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,cAAc,CAAC;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAAI,mBAAmB,MAAM,KAAG,MAS/D,CAAC;AAcF,2CAA2C;AAC3C,MAAM,WAAW,yBAAyB;IACzC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,yBAAyB,KAChC,MAAM,CAAC,MAAM,EAAE,MAAM,CAKtB,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAE,yBAgBpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,yBAatC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,mDAAmD;IACnD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACvC;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAuCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACvC;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA+CF,CAAC"}