@fuzdev/fuz_app 0.148.0 → 0.149.0

package/dist/testing/cross_backend/spine_surface_constants.js

@@ -13,6 +13,30 @@ export const TESTING_ACTION_AUTH = {
     actor: 'none',
     credential_types: ['daemon_token']
 };
+/**
+ * Every `_testing_*` backdoor the shipped cross suites know: the daemon-token
+ * actions a test binary may mount for the harness to drive. The one list a
+ * backend's `capabilities.testing_backdoors` declares from, the
+ * testing-backdoor suite probes, and `describe_spine_cross_suites` gates suites
+ * on. A consumer's own seams stay off it — the testing-backdoor suite takes
+ * those as `extra_methods`.
+ *
+ * `spine_surface_constants.testing_backdoors.test.ts` holds it to the `_testing_*` methods
+ * fuz_app's spine binary mounts, so an action added there fails until it is
+ * listed here.
+ */
+export const TESTING_BACKDOOR_METHODS = [
+    '_testing_reset',
+    '_testing_drain_effects',
+    '_testing_mint_session',
+    '_testing_put_fact',
+    '_testing_flood_notifications',
+    '_testing_schema_snapshot',
+    '_testing_migration_tracker',
+    '_testing_action_manifest',
+    '_testing_origin_check',
+    '_testing_shorten_credential_expiry'
+];
 /** RPC endpoint mount path — matches the binary's `/api/rpc`. */
 export const SPINE_RPC_PATH = '/api/rpc';
 /** Ungated WebSocket endpoint mount path — matches the binaries' `/api/ws`. */

package/dist/testing/cross_backend/testing_backdoor.d.ts

@@ -1,14 +1,37 @@
 import '../assert_dev_env.js';
-import type { RpcPathCrossSuiteOptions } from './setup.js';
+import type { RpcPathCapabilityGatedCrossSuiteOptions } from './setup.js';
 import { type WsEndpointTarget } from './ws_endpoint.js';
-/** Options for the testing-backdoor negative-credential suite. */
-export interface TestingBackdoorCrossTestOptions extends RpcPathCrossSuiteOptions {
+/**
+ * A backdoor the suite fires: its method and a params payload its input
+ * schema accepts, so a refusal lands on the credential gate, not on validation.
+ */
+export interface TestingBackdoorProbe {
+    readonly method: string;
+    readonly params?: unknown;
+}
+/** Options for the testing-backdoor suite. */
+export interface TestingBackdoorCrossTestOptions extends RpcPathCapabilityGatedCrossSuiteOptions {
     /**
      * Where the backend's WebSocket endpoint is, for the session-socket cases.
-     * Pass it when the backend serves the `_testing_*` actions on its WS
+     * Pass it when the backend serves its `_testing_*` actions on its WS
      * endpoint too; omitted, those cases are skipped.
      */
     readonly ws?: WsEndpointTarget;
+    /**
+     * The backend's own daemon-token seams beyond `TESTING_BACKDOOR_METHODS`,
+     * each with params its input accepts — fired with the same refused
+     * principals as the known backdoors. Each must start with `_testing_` and
+     * not be a known backdoor; the call throws otherwise.
+     */
+    readonly extra_methods?: ReadonlyArray<TestingBackdoorProbe>;
 }
+/**
+ * Register the backdoor suite: the declaration check over every known
+ * backdoor, then the refused-principal rows over the mounted ones.
+ *
+ * @param options - the fixture, the backend's capabilities, and the optional
+ *   WS target and extra seams
+ * @throws Error - on a declaration or extra method `resolve_backdoor_probes` refuses
+ */
 export declare const describe_testing_backdoor_cross_tests: (options: TestingBackdoorCrossTestOptions) => void;
 //# sourceMappingURL=testing_backdoor.d.ts.map

package/dist/testing/cross_backend/testing_backdoor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing_backdoor.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_backdoor.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA6E9B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AAExE,OAAO,EAAmB,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAwF1E,kEAAkE;AAClE,MAAM,WAAW,+BAAgC,SAAQ,wBAAwB;IAChF;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAED,eAAO,MAAM,qCAAqC,GACjD,SAAS,+BAA+B,KACtC,IAoEF,CAAC"}
+{"version":3,"file":"testing_backdoor.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_backdoor.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA2F9B,OAAO,KAAK,EAAE,uCAAuC,EAAe,MAAM,YAAY,CAAC;AAMvF,OAAO,EAAmB,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AA0C1E;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC1B;AAkDD,8CAA8C;AAC9C,MAAM,WAAW,+BAAgC,SAAQ,uCAAuC;IAC/F;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAC7D;AAqDD;;;;;;;GAOG;AACH,eAAO,MAAM,qCAAqC,GACjD,SAAS,+BAA+B,KACtC,IAgHF,CAAC"}

package/dist/testing/cross_backend/testing_backdoor.js

@@ -1,19 +1,20 @@
 import '../assert_dev_env.js';
 /**
- * Cross-backend negative-credential suite for the `_testing_*` backdoor
- * actions.
+ * Cross-backend suite for the `_testing_*` backdoor actions: the backend's
+ * declaration of which it mounts, and the credential gate on each.
  *
- * `_testing_reset` / `_testing_mint_session` / `_testing_put_fact` /
- * `_testing_flood_notifications` / `_testing_schema_snapshot` /
- * `_testing_migration_tracker` / `_testing_action_manifest` /
- * `_testing_origin_check` / `_testing_shorten_credential_expiry` are
+ * `TESTING_BACKDOOR_METHODS` (`_testing_reset`, `_testing_drain_effects`,
+ * `_testing_mint_session`, `_testing_put_fact`,
+ * `_testing_flood_notifications`, `_testing_schema_snapshot`,
+ * `_testing_migration_tracker`, `_testing_action_manifest`,
+ * `_testing_origin_check`, `_testing_shorten_credential_expiry`) are
  * privileged test-binary actions the production
  * wire never exposes — direct DB writes (full auth wipe, forged session row,
- * raw fact insert), a flood of the caller's own connection, introspection
- * reads (the live schema, the `schema_version` migration tracker, and the live
- * RPC registry — the highest info-leak of the set were the gate to break), a
- * probe of the origin allowlist parser, and a rewrite of an account's
- * credential expiries. Their only structural fence
+ * raw fact insert), the audit barrier, a flood of the caller's own connection,
+ * introspection reads (the live schema, the `schema_version` migration
+ * tracker, and the live RPC registry — the highest info-leak of the set were
+ * the gate to break), a probe of the origin allowlist parser, and a rewrite of
+ * an account's credential expiries. Their only structural fence
  * is the **daemon-token** credential gate on
  * each spec's `auth` axis. A test binary live-mounts them on its RPC
  * endpoint (and, on fuz_app's spine binary and the Rust stub, its WS
@@ -24,7 +25,19 @@ import '../assert_dev_env.js';
  * (`live_rpc_endpoints`) fires the same refusals through the auth rows
  * `generate_rpc_auth_conformance_cases` generates for them.
  *
- * For every backdoor method, three principals:
+ * **The declaration.** A backend states which it mounts in
+ * `capabilities.testing_backdoors`, and the suite holds it to that: each known
+ * backdoor the declaration leaves out is sent anonymously and must answer
+ * `method_not_found` (404) — both spines look a method up before they
+ * authenticate the caller, so an unmounted method answers that whatever the
+ * credential — and each declared one runs the rows below, whose anonymous row
+ * (a 401, not `method_not_found`) proves it mounted. A wrong declaration fails
+ * either way, so the suites that skip on an undeclared backdoor
+ * (`describe_spine_cross_suites`) skip only what the backend truly lacks. The
+ * check runs on every backend, one mounting none of them included.
+ *
+ * For every declared backdoor, and each `extra_methods` seam (a consumer's own
+ * daemon-token action), three principals:
  *
  * - **anonymous** (no credential) → `401` (pre-authorization auth refuses an
  *   account-less caller before anything else).
@@ -55,13 +68,13 @@ import '../assert_dev_env.js';
  * on both impls. Cited property: `security.md` §Test Backdoor Actions
  * (daemon-token-gated, off-surface, DEV-excluded).
  *
- * Cross-process only — the `_testing_*` actions are mounted on the spawned
- * binary, not the in-process app — like the ws/sse suites. Wire from a
- * `*.cross.test.ts`. Requires the standard `_testing_*` actions mounted (the
- * same precondition `default_cross_process_setup` already imposes for its
- * per-test `_testing_reset`); the HTTP cases are ungated, since every cross
- * backend mounts them, and the WS cases run when `ws` is passed — for a
- * backend that also serves them on its WS endpoint.
+ * The credential rows run cross-process only — the `_testing_*` actions are
+ * mounted on the spawned binary, not the in-process app — like the ws/sse
+ * suites; there, wire from a `*.cross.test.ts`, whose setup fires
+ * `_testing_reset`, so the backend must mount that one. In-process, an app
+ * mounting none declares none, and the suite runs the declaration rows alone,
+ * one per known backdoor. The WS cases run when `ws` is passed — for a
+ * backend that also serves its backdoors on its WS endpoint.
  *
  * @module
  */
@@ -69,46 +82,49 @@ import { describe, test, assert } from 'vitest';
 import { ERROR_CREDENTIAL_TYPE_REQUIRED } from '../../http/error_schemas.js';
 import { JSONRPC_ERROR_CODES } from '../../http/jsonrpc_errors.js';
 import { rpc_call } from '../rpc_helpers.js';
+import { TESTING_METHOD_PREFIX } from '../surface_invariants.js';
 import { is_response_for } from '../transports/ws_client.js';
 import { test_if } from './capabilities.js';
-import { SPINE_RPC_PATH } from './spine_surface_constants.js';
+import { SPINE_RPC_PATH, TESTING_BACKDOOR_METHODS } from './spine_surface_constants.js';
 import { open_session_ws } from './ws_endpoint.js';
 /** A well-formed UUID that never names a real row. */
 const NIL_UUID = '00000000-0000-0000-0000-000000000000';
 /**
- * The backdoor methods + a **valid** params payload each (so the
- * session/bearer cases reach the 403 credential gate rather than a 400 on
- * input validation). The handlers never run — the gate refuses first.
+ * A **valid** params payload for each known backdoor (so the session/bearer
+ * cases reach the 403 credential gate rather than a 400 on input validation).
+ * The handlers never run — the gate refuses first. Keyed by
+ * `TestingBackdoorMethod`, so a method added to `TESTING_BACKDOOR_METHODS`
+ * fails typecheck here until it has its params.
  */
-const backdoor_methods = [
-    { method: '_testing_reset', params: {} },
+const BACKDOOR_PARAMS = {
+    _testing_reset: {},
     // The audit barrier — its input is void, so the call carries no params.
-    { method: '_testing_drain_effects', params: undefined },
-    { method: '_testing_mint_session', params: { account_id: NIL_UUID, expires_in_seconds: -60 } },
-    { method: '_testing_put_fact', params: { content: 'backdoor-probe' } },
+    _testing_drain_effects: undefined,
+    _testing_mint_session: { account_id: NIL_UUID, expires_in_seconds: -60 },
+    _testing_put_fact: { content: 'backdoor-probe' },
     // An empty burst — valid input, so it clears the 400 phase; a refused
     // caller never reaches the handler that would queue it.
-    { method: '_testing_flood_notifications', params: { count: 0, size: 0 } },
+    _testing_flood_notifications: { count: 0, size: 0 },
     // The schema-dump read — `exclude_tables` is optional, so `{}` is valid
     // and clears the 400 phase like the writes above.
-    { method: '_testing_schema_snapshot', params: {} },
+    _testing_schema_snapshot: {},
     // The migration-tracker-dump read — input is an empty strict object, so `{}`
     // is valid and clears the 400 phase, reaching the credential gate like the rest.
-    { method: '_testing_migration_tracker', params: {} },
+    _testing_migration_tracker: {},
     // The RPC-registry-dump read — input is an empty strict object, so `{}` is
     // valid and clears the 400 phase, reaching the credential gate like the rest.
-    { method: '_testing_action_manifest', params: {} },
+    _testing_action_manifest: {},
     // The origin conformance probe — a valid `{patterns, origin}` pair, so it
     // clears the 400 phase like the rest.
-    { method: '_testing_origin_check', params: { patterns: 'http://localhost:*', origin: null } },
+    _testing_origin_check: { patterns: 'http://localhost:*', origin: null },
     // The credential-expiry rewrite — a valid `{account_id, seconds}` pair (a
     // syntactically valid UUID; no row needs to match), so it clears the 400
     // phase like the rest.
-    {
-        method: '_testing_shorten_credential_expiry',
-        params: { account_id: '00000000-0000-4000-8000-000000000000', seconds: 30 }
+    _testing_shorten_credential_expiry: {
+        account_id: '00000000-0000-4000-8000-000000000000',
+        seconds: 30
     }
-];
+};
 const principals = [
     {
         name: 'anonymous',
@@ -139,11 +155,89 @@ const principals = [
         })
     }
 ];
+/**
+ * The known backdoors a backend declares, checked against the known list,
+ * and its extra seams, checked against the `_testing_` prefix and the list.
+ *
+ * @throws Error - on a declared method that isn't a known backdoor, an extra
+ *   method outside the `_testing_` namespace or naming a known backdoor, or a
+ *   duplicate
+ */
+const resolve_backdoor_probes = (declared, extra_methods) => {
+    const known = new Set(TESTING_BACKDOOR_METHODS);
+    const seen = new Set();
+    for (const method of declared) {
+        if (!known.has(method)) {
+            throw new Error(`describe_testing_backdoor_cross_tests: capabilities.testing_backdoors declares ` +
+                `'${method}', which is not in TESTING_BACKDOOR_METHODS — pass a consumer seam as extra_methods`);
+        }
+        if (seen.has(method)) {
+            throw new Error(`describe_testing_backdoor_cross_tests: capabilities.testing_backdoors declares '${method}' twice`);
+        }
+        seen.add(method);
+    }
+    for (const { method } of extra_methods) {
+        if (!method.startsWith(TESTING_METHOD_PREFIX) || known.has(method)) {
+            throw new Error(`describe_testing_backdoor_cross_tests: extra method '${method}' must start with ` +
+                `'${TESTING_METHOD_PREFIX}' and not be a known backdoor (declare those in capabilities.testing_backdoors)`);
+        }
+        if (seen.has(method)) {
+            throw new Error(`describe_testing_backdoor_cross_tests: extra method '${method}' is listed twice`);
+        }
+        seen.add(method);
+    }
+    return [
+        ...TESTING_BACKDOOR_METHODS.filter((method) => declared.includes(method)).map((method) => ({
+            method,
+            params: BACKDOOR_PARAMS[method]
+        })),
+        ...extra_methods
+    ];
+};
+/**
+ * Register the backdoor suite: the declaration check over every known
+ * backdoor, then the refused-principal rows over the mounted ones.
+ *
+ * @param options - the fixture, the backend's capabilities, and the optional
+ *   WS target and extra seams
+ * @throws Error - on a declaration or extra method `resolve_backdoor_probes` refuses
+ */
 export const describe_testing_backdoor_cross_tests = (options) => {
-    const { setup_test, ws } = options;
+    const { setup_test, capabilities, ws, extra_methods = [] } = options;
     const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
+    const declared = capabilities.testing_backdoors;
+    const probes = resolve_backdoor_probes(declared, extra_methods);
+    // a declared backdoor's mount is pinned by its anonymous row below (a 401,
+    // not `method_not_found`); an undeclared one must not be mounted, so a
+    // backend can't mount one its declaration leaves out
+    const undeclared = TESTING_BACKDOOR_METHODS.filter((method) => !declared.includes(method));
+    // vitest fails a describe holding no test, so a full declaration registers none
+    if (undeclared.length > 0) {
+        describe('testing backdoor declaration', () => {
+            for (const method of undeclared) {
+                test(`${method} is undeclared → method_not_found`, async () => {
+                    const fixture = await setup_test();
+                    const res = await rpc_call({
+                        app: fixture.fresh_transport(),
+                        path: rpc_path,
+                        method,
+                        params: BACKDOOR_PARAMS[method]
+                    });
+                    assert.ok(!res.ok, `${method}: undeclared in capabilities.testing_backdoors, but the call succeeded`);
+                    if (!res.ok) {
+                        assert.strictEqual(res.error.code, JSONRPC_ERROR_CODES.method_not_found, `${method}: undeclared in capabilities.testing_backdoors, but it answers ` +
+                            `${res.status} (${res.error.code}) — the backend mounts it, so declare it`);
+                    }
+                    assert.strictEqual(res.status, 404, `${method}: status`);
+                });
+            }
+        });
+    }
+    // none declared and no extra seam: no rows, and vitest fails an empty describe
+    if (probes.length === 0)
+        return;
     describe('testing backdoor credential gate parity', () => {
-        for (const { method, params } of backdoor_methods) {
+        for (const { method, params } of probes) {
             for (const principal of principals) {
                 test(`${method} rejects ${principal.name} → ${principal.status}`, async () => {
                     const fixture = await setup_test();
@@ -158,9 +252,10 @@ export const describe_testing_backdoor_cross_tests = (options) => {
                     });
                     const label = `${method} ${principal.name}`;
                     assert.ok(!res.ok, `${label}: expected denial (${principal.status}) but the call succeeded`);
-                    assert.strictEqual(res.status, principal.status, `${label}: status`);
                     // `!res.ok` narrows `res` to the error variant for `res.error`.
                     if (!res.ok) {
+                        assert.notStrictEqual(res.error.code, JSONRPC_ERROR_CODES.method_not_found, `${label}: declared but not mounted — the backend answers method_not_found`);
+                        assert.strictEqual(res.status, principal.status, `${label}: status`);
                         assert.strictEqual(res.error.code, principal.code, `${label}: error.code`);
                         if (principal.reason !== undefined) {
                             const reason = res.error.data?.reason;
@@ -170,7 +265,7 @@ export const describe_testing_backdoor_cross_tests = (options) => {
                 });
             }
         }
-        for (const { method, params } of backdoor_methods) {
+        for (const { method, params } of probes) {
             test_if(ws !== undefined, `${method} over a session socket → forbidden ${ERROR_CREDENTIAL_TYPE_REQUIRED}`, async () => {
                 const fixture = await setup_test();
                 const client = await open_session_ws(ws, fixture, { admitted: true });

package/dist/testing/cross_backend/testing_reset_actions.d.ts

@@ -29,13 +29,16 @@ import '../assert_dev_env.js';
  *
  * `_testing_reset` — full DB wipe + keeper re-seed + optional
  * secondary-account seeding. The
- * handler wipes every auth-namespace row (no keeper-preserve filter),
+ * handler first fires the consumer-supplied domain-state callback (domain
+ * rows depend on auth rows, so a domain table with a restricting FK to
+ * `actor` empties before the rows it references go), then wipes every
+ * auth-namespace row (no keeper-preserve filter),
  * flips `bootstrap_lock` back to its post-bootstrap shape, seeds a
  * fresh keeper account inline (reusing `create_test_account_with_credentials`
- * so cross-process matches in-process write semantics), seeds any
- * caller-requested `extra_accounts` (also direct-inserted at this
- * setup step), refreshes the daemon-token cache to point at the new
- * keeper, and fires the consumer-supplied domain-state callback. The
+ * so cross-process matches in-process write semantics), queues the
+ * daemon-token cache refresh to point at the new keeper once the reset
+ * commits, and seeds any caller-requested `extra_accounts` (also
+ * direct-inserted at this setup step). The
  * new keeper + secondary credentials return as the action output so
  * the per-test fixture closes over them.
  *
@@ -177,6 +180,11 @@ export declare const testing_reset_action_spec: {
  * not — nor are eager writes outside `emit` (session touch, token usage),
  * which only the dispatching transport's own flush awaits.
  *
+ * The output's `tracked` is `AuditEmitter.is_tracking_inflight` — whether the
+ * drain could wait on anything. `cross_drain_effects` refuses `tracked: false`,
+ * so a binary whose emitter was built without tracking fails its first audit
+ * read instead of racing it. The Rust twin answers the same shape.
+ *
  * `auth` gates on the daemon-token credential, matching `_testing_reset`.
  */
 export declare const testing_drain_effects_action_spec: {
@@ -192,6 +200,7 @@ export declare const testing_drain_effects_action_spec: {
     readonly input: z.ZodVoid;
     readonly output: z.ZodObject<{
         ok: z.ZodBoolean;
+        tracked: z.ZodBoolean;
     }, z.core.$strict>;
     readonly async: true;
     readonly description: "Test-binary only — await in-flight fire-and-forget audit writes so a following audit_log_list read is authoritative.";
@@ -251,7 +260,8 @@ export declare const testing_mint_session_action_spec: {
  * emitter the backend's handlers emit through (`deps.audit`), built with
  * `track_inflight: true` (see the spec doc). Mount it on any test endpoint
  * whose suite asserts on audit rows (the spine binary bundles it via
- * `create_testing_actions`; in-process suites mount it directly).
+ * `create_testing_actions`; in-process suites mount it directly). Answers
+ * `{ok: true, tracked}`, `tracked` read from `audit.is_tracking_inflight()`.
  *
  * @param audit - the backend's emitter, whose in-flight writes the action awaits
  */
@@ -626,17 +636,22 @@ export interface CreateTestingActionsOptions {
      */
     readonly daemon_token_state: DaemonTokenState;
     /**
-     * Consumer-supplied callback invoked after the auth-table reset, passed
-     * the same transactional `Db` the auth wipes ran on. DB-domain consumers
+     * Consumer-supplied callback invoked first, before the auth-table wipe and
+     * keeper re-seed, passed the same transactional `Db` the auth wipes then
+     * run on. It runs while the previous test's accounts and actors still
+     * exist, so a domain table with a restricting FK to `actor` / `account`
+     * empties before the auth wipe deletes what it references; it must not
+     * depend on the fresh keeper, which doesn't exist yet. DB-domain consumers
      * (e.g. fuz_forge truncating its cell / fact / file tables) MUST use this
      * `db` rather than a separately-pooled connection — under the in-memory
-     * drivers' single connection (pglet, PGlite) a second connection deadlocks against this still-open
-     * transaction. `testing_zzz_server` clears in-memory workspace registry +
-     * terminals + scoped-FS scratch (ignores `db`); the spine binaries
-     * (`testing/cross_backend/full_spine_mount.ts` and the Rust `testing_spine_stub`) empty
-     * the cell and fact tables. Runs inside the same RPC dispatch
-     * as the auth-table writes, so a throw surfaces to the caller as a
-     * JSON-RPC error and the per-test fixture short-circuits.
+     * drivers' single connection (pglet, PGlite) a second connection deadlocks
+     * against this still-open transaction. `testing_zzz_server` clears
+     * in-memory workspace registry + terminals + scoped-FS scratch (ignores
+     * `db`); the spine binaries (`testing/cross_backend/full_spine_mount.ts` and
+     * the Rust `testing_spine_stub`) empty the cell and fact tables. Runs inside
+     * the same RPC dispatch as the auth-table writes, so a throw rolls the whole
+     * reset back and surfaces to the caller as a JSON-RPC error and the per-test
+     * fixture short-circuits.
      */
     readonly reset_state?: (db: Db) => Promise<void> | void;
 }

package/dist/testing/cross_backend/testing_reset_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing_reset_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_reset_actions.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2EG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAOzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAsBzC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoCQ,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;CAWA,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;CAwBC,CAAC;AAE/C;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC,GAAI,OAAO,YAAY,KAAG,SAIvE,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;CAkBK,CAAC;AAE/C,kFAAkF;AAClF,eAAO,MAAM,iCAAiC,mBAAmB,CAAC;AAElE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,sFAAsF;AACtF,eAAO,MAAM,sBAAsB,QAAmB,CAAC;AAEvD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAAmB,CAAC;AAE9D,8FAA8F;AAC9F,eAAO,MAAM,iCAAiC,kBAAkB,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;CAwBN,CAAC;AAE/C;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC,QAAO,SAmB1D,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWF,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,QAAO,SAGvD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;CAYJ,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,QAAO,SAGzD,CAAC;AAEH,0FAA0F;AAC1F,eAAO,MAAM,6CAA6C,IAAI,CAAC;AAE/D;;;;GAIG;AACH,eAAO,MAAM,6CAA6C,KAAK,CAAC;AAShE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,6CAA6C;;;;;;;;;;;;;;;;;;;;CA2BZ,CAAC;AAE/C,2FAA2F;AAC3F,eAAO,MAAM,+CAA+C,QAAO,SAYhE,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAaF,CAAC;AAkB/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,GACjD,SAAS,aAAa,CAAC,SAAS,CAAC,KAC/B,SAMF,CAAC;AAEF,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,2BAA2B,KAClC,KAAK,CAAC,SAAS,CAsJjB,CAAC"}
+{"version":3,"file":"testing_reset_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_reset_actions.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8EG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAOzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAsBzC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoCQ,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;CAkBA,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;CAwBC,CAAC;AAE/C;;;;;;;;;GASG;AACH,eAAO,MAAM,mCAAmC,GAAI,OAAO,YAAY,KAAG,SAIvE,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;CAkBK,CAAC;AAE/C,kFAAkF;AAClF,eAAO,MAAM,iCAAiC,mBAAmB,CAAC;AAElE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,sFAAsF;AACtF,eAAO,MAAM,sBAAsB,QAAmB,CAAC;AAEvD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAAmB,CAAC;AAE9D,8FAA8F;AAC9F,eAAO,MAAM,iCAAiC,kBAAkB,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;CAwBN,CAAC;AAE/C;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC,QAAO,SAmB1D,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWF,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,QAAO,SAGvD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;CAYJ,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,QAAO,SAGzD,CAAC;AAEH,0FAA0F;AAC1F,eAAO,MAAM,6CAA6C,IAAI,CAAC;AAE/D;;;;GAIG;AACH,eAAO,MAAM,6CAA6C,KAAK,CAAC;AAShE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,6CAA6C;;;;;;;;;;;;;;;;;;;;CA2BZ,CAAC;AAE/C,2FAA2F;AAC3F,eAAO,MAAM,+CAA+C,QAAO,SAYhE,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAaF,CAAC;AAkB/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,GACjD,SAAS,aAAa,CAAC,SAAS,CAAC,KAC/B,SAMF,CAAC;AAEF,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,2BAA2B,KAClC,KAAK,CAAC,SAAS,CAwJjB,CAAC"}

package/dist/testing/cross_backend/testing_reset_actions.js

@@ -29,13 +29,16 @@ import '../assert_dev_env.js';
  *
  * `_testing_reset` — full DB wipe + keeper re-seed + optional
  * secondary-account seeding. The
- * handler wipes every auth-namespace row (no keeper-preserve filter),
+ * handler first fires the consumer-supplied domain-state callback (domain
+ * rows depend on auth rows, so a domain table with a restricting FK to
+ * `actor` empties before the rows it references go), then wipes every
+ * auth-namespace row (no keeper-preserve filter),
  * flips `bootstrap_lock` back to its post-bootstrap shape, seeds a
  * fresh keeper account inline (reusing `create_test_account_with_credentials`
- * so cross-process matches in-process write semantics), seeds any
- * caller-requested `extra_accounts` (also direct-inserted at this
- * setup step), refreshes the daemon-token cache to point at the new
- * keeper, and fires the consumer-supplied domain-state callback. The
+ * so cross-process matches in-process write semantics), queues the
+ * daemon-token cache refresh to point at the new keeper once the reset
+ * commits, and seeds any caller-requested `extra_accounts` (also
+ * direct-inserted at this setup step). The
  * new keeper + secondary credentials return as the action output so
  * the per-test fixture closes over them.
  *
@@ -179,6 +182,11 @@ export const testing_reset_action_spec = {
  * not — nor are eager writes outside `emit` (session touch, token usage),
  * which only the dispatching transport's own flush awaits.
  *
+ * The output's `tracked` is `AuditEmitter.is_tracking_inflight` — whether the
+ * drain could wait on anything. `cross_drain_effects` refuses `tracked: false`,
+ * so a binary whose emitter was built without tracking fails its first audit
+ * read instead of racing it. The Rust twin answers the same shape.
+ *
  * `auth` gates on the daemon-token credential, matching `_testing_reset`.
  */
 export const testing_drain_effects_action_spec = {
@@ -188,7 +196,13 @@ export const testing_drain_effects_action_spec = {
     auth: TESTING_ACTION_AUTH,
     side_effects: false,
     input: z.void(),
-    output: z.strictObject({ ok: z.boolean() }),
+    output: z.strictObject({
+        ok: z.boolean(),
+        tracked: z.boolean().meta({
+            description: "Whether the backend's audit emitter tracks in-flight writes — false means the drain " +
+                'waited on nothing and is no barrier.'
+        })
+    }),
     async: true,
     description: 'Test-binary only — await in-flight fire-and-forget audit writes so a following audit_log_list read is authoritative.'
 };
@@ -250,13 +264,14 @@ export const testing_mint_session_action_spec = {
  * emitter the backend's handlers emit through (`deps.audit`), built with
  * `track_inflight: true` (see the spec doc). Mount it on any test endpoint
  * whose suite asserts on audit rows (the spine binary bundles it via
- * `create_testing_actions`; in-process suites mount it directly).
+ * `create_testing_actions`; in-process suites mount it directly). Answers
+ * `{ok: true, tracked}`, `tracked` read from `audit.is_tracking_inflight()`.
  *
  * @param audit - the backend's emitter, whose in-flight writes the action awaits
  */
 export const create_testing_drain_effects_action = (audit) => rpc_action(testing_drain_effects_action_spec, async () => {
     await audit.drain_inflight();
-    return { ok: true };
+    return { ok: true, tracked: audit.is_tracking_inflight() };
 });
 /**
  * `_testing_put_fact` — seed an **embedded** fact (`fact.bytes`) for the
@@ -613,8 +628,18 @@ export const create_testing_actions = (deps, options) => {
     const log = deps.log;
     return [
         rpc_action(testing_reset_action_spec, async (input, ctx) => {
-            log.info('[_testing_reset] resetting auth state + re-seeding keeper');
-            // 1. Wipe every auth-namespace row. No keeper-preserve filter —
+            log.info('[_testing_reset] resetting domain + auth state + re-seeding keeper');
+            // 1. Fire domain-state reset (zzz workspaces/terminals/scratch,
+            //    fuz_forge cell/fact/file truncation, the spine binaries' cell +
+            //    fact wipe) first: domain rows depend on auth rows, so a domain
+            //    table with a restricting FK to `actor` would make the auth wipe
+            //    below fail once it holds a row.
+            //    Pass the transactional `ctx.db` so DB-domain truncation runs
+            //    on the same connection — a separate pool connection deadlocks
+            //    against this open transaction under the in-memory drivers.
+            if (reset_state)
+                await reset_state(ctx.db);
+            // 2. Wipe every auth-namespace row. No keeper-preserve filter —
             //    the fresh-keeper-per-test contract means mutation-cascade
             //    tests (password change, revoke-all) and hardcoded-username
             //    signup-uniqueness tests can't leak between cases.
@@ -631,13 +656,13 @@ export const create_testing_actions = (deps, options) => {
             await ctx.db.query('DELETE FROM role_grant');
             await ctx.db.query('DELETE FROM actor');
             await ctx.db.query('DELETE FROM account');
-            // 2. Reset singleton `app_settings` to production defaults
+            // 3. Reset singleton `app_settings` to production defaults
             //    (matches in-process `_build_test_backend` behavior in
             //    `app_server.ts`). Tests that flipped `open_signup` mid-run
             //    revert.
             await ctx.db.query('UPDATE app_settings SET open_signup = false, updated_at = NULL, updated_by = NULL ' +
                 'WHERE open_signup = true OR updated_at IS NOT NULL');
-            // 3. Flip `bootstrap_lock` to its post-bootstrap shape. Production
+            // 4. Flip `bootstrap_lock` to its post-bootstrap shape. Production
             //    `bootstrap_account` flips this to `true` on success; the
             //    in-process `bootstrap_test_keeper` mirrors the flip. We're
             //    about to seed the keeper here, so the final state needs to
@@ -645,7 +670,7 @@ export const create_testing_actions = (deps, options) => {
             //    to `false` — nothing reads it between our DELETEs and the
             //    UPDATE.
             await ctx.db.query('UPDATE bootstrap_lock SET bootstrapped = true WHERE id = 1');
-            // 4. Seed the fresh keeper inline. Reuses the same primitive
+            // 5. Seed the fresh keeper inline. Reuses the same primitive
             //    in-process tests use (`create_test_account_with_credentials`)
             //    so cross-process and in-process write semantics stay in
             //    parity — same hash, same account+actor+role_grants+
@@ -662,7 +687,19 @@ export const create_testing_actions = (deps, options) => {
                 password_value: DEFAULT_TEST_PASSWORD,
                 roles: [ROLE_KEEPER, ROLE_ADMIN, ...(input.extra_keeper_roles ?? [])]
             });
-            // 5. Seed any caller-requested extras. These are bootstrap-time
+            // 6. Refresh the daemon-token cache so subsequent daemon-token
+            //    requests resolve to the freshly seeded keeper. The
+            //    middleware's lazy-refresh path only fires when the cached
+            //    id is null, so the reset sets it — after the commit, queued as
+            //    soon as the keeper exists, so a reset that rolls back after it
+            //    (a failing extra seed, a failed COMMIT) leaves the cache on the
+            //    keeper still in the database rather than one that never
+            //    landed, and the next reset can still authenticate.
+            const keeper_account_id = keeper.account.id;
+            emit_after_commit(ctx, () => {
+                daemon_token_state.keeper_account_id = keeper_account_id;
+            });
+            // 7. Seed any caller-requested extras. These are bootstrap-time
             //    secondaries — the bypass exists in the same cradle the
             //    keeper does, not as a free-form runtime action.
             const extras = [];
@@ -678,7 +715,7 @@ export const create_testing_actions = (deps, options) => {
                 });
                 extras.push(seeded);
             }
-            // 5b. Seed any additional keeper actors. Same bootstrap-cradle
+            // 8. Seed any additional keeper actors. Same bootstrap-cradle
             //    bypass as extra_accounts — no production wire path mints a
             //    second actor, so the multi-actor `acting` branches need this
             //    direct insert. Order-preserving so the fixture can address
@@ -691,26 +728,6 @@ export const create_testing_actions = (deps, options) => {
                 const seeded_actor = await create_test_extra_actor(ctx.db, keeper.account.id, name);
                 extra_actors.push({ id: seeded_actor.id, name: seeded_actor.name });
             }
-            // 6. Refresh the daemon-token cache so subsequent daemon-token
-            //    requests resolve to the freshly seeded keeper. The
-            //    middleware's lazy-refresh path only fires when the cached
-            //    id is null, so the reset sets it — after the commit, so a
-            //    reset that rolls back (a throwing `reset_state`, a failed
-            //    COMMIT) leaves the cache on the keeper still in the database
-            //    rather than one that never landed, and the next reset can
-            //    still authenticate.
-            const keeper_account_id = keeper.account.id;
-            emit_after_commit(ctx, () => {
-                daemon_token_state.keeper_account_id = keeper_account_id;
-            });
-            // 7. Fire domain-state reset (zzz workspaces/terminals/scratch,
-            //    fuz_forge cell/fact/file truncation, the spine binaries' cell +
-            //    fact wipe).
-            //    Pass the transactional `ctx.db` so DB-domain truncation runs
-            //    on the same connection — a separate pool connection deadlocks
-            //    against this open transaction under the in-memory drivers.
-            if (reset_state)
-                await reset_state(ctx.db);
             return { ...keeper, extra_accounts: extras, extra_actors };
         }),
         rpc_action(testing_mint_session_action_spec, async (input, ctx) => {

package/dist/testing/cross_backend/ts_spine_backend_config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ts_spine_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ts_spine_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AA4EzD,6FAA6F;AAC7F,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,iDAAiD;AACjD,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,gDAAgD;AAChD,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,uDAAuD,CAAC;AAEvF,MAAM,WAAW,2BAA2B;IAC3C,mFAAmF;IACnF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;OASG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAWD;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAwBF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,GACvC,UAAS,2BAAgC,KACvC,aAwBF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAqCF,CAAC"}
+{"version":3,"file":"ts_spine_backend_config.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ts_spine_backend_config.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAgFzD,6FAA6F;AAC7F,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,iDAAiD;AACjD,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,gDAAgD;AAChD,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,wDAAwD,CAAC;AAEzF,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,uDAAuD,CAAC;AAEvF,MAAM,WAAW,2BAA2B;IAC3C,mFAAmF;IACnF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,6DAA6D;IAC7D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;OASG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACjD;AAWD;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAwBF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,GACvC,UAAS,2BAAgC,KACvC,aAwBF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAS,2BAAgC,KACvC,aAqCF,CAAC"}