@fuzdev/fuz_app 0.95.0 → 0.97.0

package/dist/http/error_schemas.js

@@ -46,8 +46,6 @@ export const ERROR_PAYLOAD_TOO_LARGE = 'payload_too_large';
 // --- Origin & bearer token verification ---
 /** Request origin not in allowlist. */
 export const ERROR_FORBIDDEN_ORIGIN = 'forbidden_origin';
-/** Bearer token sent with Origin/Referer header (browser context). */
-export const ERROR_BEARER_REJECTED_BROWSER = 'bearer_token_rejected_in_browser_context';
 /** Bearer token failed validation (missing, malformed, or revoked). */
 export const ERROR_INVALID_TOKEN = 'invalid_token';
 /** Token references a deleted account. */
@@ -86,10 +84,6 @@ export const ERROR_NO_ACTORS_ON_ACCOUNT = 'no_actors_on_account';
  */
 export const ERROR_ACCOUNT_VANISHED = 'account_vanished';
 // --- Keeper / daemon token ---
-/** Daemon token header present but malformed or not matching current/previous token. */
-export const ERROR_INVALID_DAEMON_TOKEN = 'invalid_daemon_token';
-/** Daemon token valid but keeper account not yet resolved (pre-bootstrap). */
-export const ERROR_KEEPER_ACCOUNT_NOT_CONFIGURED = 'keeper_account_not_configured';
 /** Keeper account ID set but account row not found. */
 export const ERROR_KEEPER_ACCOUNT_NOT_FOUND = 'keeper_account_not_found';
 // --- Bootstrap ---

package/dist/http/origin.d.ts

@@ -9,7 +9,24 @@
  *
  * @module
  */
-import type { Handler } from 'hono';
+import type { Context, Handler } from 'hono';
+/**
+ * True when the request looks like it originated from a browser context — it
+ * carries an `Origin` or `Referer` header. Browsers attach these
+ * automatically on the state-changing surface; loopback / CLI clients don't.
+ * Uses `!== undefined` so an empty-string header still counts as browser
+ * context. Checks `Referer` too (not just `Origin`) because some browser
+ * requests send only `Referer`. Twin of the Rust spine's
+ * `bearer_auth::is_browser_context`.
+ *
+ * The bearer (`auth/bearer_auth.ts`) and daemon-token
+ * (`auth/daemon_token_middleware.ts`) middleware both silently discard their
+ * credential when this is true: a stolen bearer token can't be replayed from a
+ * browser, and the loopback daemon token never legitimately carries an
+ * `Origin`. Distinct from `verify_request_source` — that gates browser
+ * requests against an allowlist; this only detects browser context.
+ */
+export declare const is_browser_context: (c: Context) => boolean;
 /**
  * Parses FUZ_ALLOWED_ORIGINS env var into regex matchers for request source verification.
  * Origin allowlisting for locally-running services — not the CSRF layer

package/dist/http/origin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"origin.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/origin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,MAAM,CAAC;AAIlC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,qBAAqB,GAAI,WAAW,MAAM,GAAG,SAAS,KAAG,KAAK,CAAC,MAAM,CAO5E,CAAC;AAEP;;;GAGG;AACH,eAAO,MAAM,mBAAmB,GAC/B,QAAQ,MAAM,EACd,kBAAkB,aAAa,CAAC,MAAM,CAAC,KACrC,OAAuD,CAAC;AAE3D;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,qBAAqB,GAChC,kBAAkB,aAAa,CAAC,MAAM,CAAC,KAAG,OAgB1C,CAAC"}
+{"version":3,"file":"origin.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/origin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAC,OAAO,EAAE,OAAO,EAAC,MAAM,MAAM,CAAC;AAI3C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,kBAAkB,GAAI,GAAG,OAAO,KAAG,OAC8B,CAAC;AAE/E;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,qBAAqB,GAAI,WAAW,MAAM,GAAG,SAAS,KAAG,KAAK,CAAC,MAAM,CAO5E,CAAC;AAEP;;;GAGG;AACH,eAAO,MAAM,mBAAmB,GAC/B,QAAQ,MAAM,EACd,kBAAkB,aAAa,CAAC,MAAM,CAAC,KACrC,OAAuD,CAAC;AAE3D;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,qBAAqB,GAChC,kBAAkB,aAAa,CAAC,MAAM,CAAC,KAAG,OAgB1C,CAAC"}

package/dist/http/origin.js

@@ -11,6 +11,23 @@
  */
 import { escape_regexp } from '@fuzdev/fuz_util/regexp.ts';
 import { ERROR_FORBIDDEN_ORIGIN } from './error_schemas.js';
+/**
+ * True when the request looks like it originated from a browser context — it
+ * carries an `Origin` or `Referer` header. Browsers attach these
+ * automatically on the state-changing surface; loopback / CLI clients don't.
+ * Uses `!== undefined` so an empty-string header still counts as browser
+ * context. Checks `Referer` too (not just `Origin`) because some browser
+ * requests send only `Referer`. Twin of the Rust spine's
+ * `bearer_auth::is_browser_context`.
+ *
+ * The bearer (`auth/bearer_auth.ts`) and daemon-token
+ * (`auth/daemon_token_middleware.ts`) middleware both silently discard their
+ * credential when this is true: a stolen bearer token can't be replayed from a
+ * browser, and the loopback daemon token never legitimately carries an
+ * `Origin`. Distinct from `verify_request_source` — that gates browser
+ * requests against an allowlist; this only detects browser context.
+ */
+export const is_browser_context = (c) => c.req.header('Origin') !== undefined || c.req.header('Referer') !== undefined;
 /**
  * Parses FUZ_ALLOWED_ORIGINS env var into regex matchers for request source verification.
  * Origin allowlisting for locally-running services — not the CSRF layer

package/dist/server/serve_fact_route.d.ts

@@ -63,6 +63,18 @@
  * is the doc cell, so serving goes view-doc-cell → doc-cell-refs-include-hash
  * → serve.
  *
+ * ## Untrusted-content hardening
+ *
+ * Fact bytes are served with a producer-supplied `content_type` emitted
+ * verbatim, inline. To stop a fact stored as (or sniffable to) `text/html`
+ * from executing as stored XSS for any reader of a referencing cell, **every**
+ * served-fact response carries `X-Content-Type-Options: nosniff` +
+ * `Content-Security-Policy: default-src 'none'; sandbox` (the
+ * `FACT_SECURITY_HEADERS` set, applied in all three serve branches). The same
+ * pair, byte-identical, is set by the Rust twin (`fuz_fact_serving::serve`).
+ * `Content-Disposition: attachment` is deliberately **not** added — it would
+ * force-download and break legitimate inline image rendering.
+ *
  * ## Defense-in-depth
  *
  * The `external_url` regex is re-validated before issuing

package/dist/server/serve_fact_route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve_fact_route.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/serve_fact_route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyEG;AAMH,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,yBAAyB,CAAC;AAepD,OAAO,EAAsC,KAAK,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAE1F,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,iBAAiB,CAAC;AAsC7C,MAAM,WAAW,+BAA+B;IAC/C;;;;;;OAMG;IACH,IAAI,EAAE,OAAO,CAAC;IACd,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,GAAG,EAAE,MAAM,CAAC;CACZ;AAwGD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iCAAiC,GAC7C,SAAS,+BAA+B,KACtC,SA8CF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,SAgCF,CAAC"}
+{"version":3,"file":"serve_fact_route.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/serve_fact_route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFG;AAMH,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,yBAAyB,CAAC;AAepD,OAAO,EAAsC,KAAK,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAE1F,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,iBAAiB,CAAC;AAkE7C,MAAM,WAAW,+BAA+B;IAC/C;;;;;;OAMG;IACH,IAAI,EAAE,OAAO,CAAC;IACd,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,GAAG,EAAE,MAAM,CAAC;CACZ;AA2GD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iCAAiC,GAC7C,SAAS,+BAA+B,KACtC,SA8CF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,SAgCF,CAAC"}

package/dist/server/serve_fact_route.js

@@ -63,6 +63,18 @@
  * is the doc cell, so serving goes view-doc-cell → doc-cell-refs-include-hash
  * → serve.
  *
+ * ## Untrusted-content hardening
+ *
+ * Fact bytes are served with a producer-supplied `content_type` emitted
+ * verbatim, inline. To stop a fact stored as (or sniffable to) `text/html`
+ * from executing as stored XSS for any reader of a referencing cell, **every**
+ * served-fact response carries `X-Content-Type-Options: nosniff` +
+ * `Content-Security-Policy: default-src 'none'; sandbox` (the
+ * `FACT_SECURITY_HEADERS` set, applied in all three serve branches). The same
+ * pair, byte-identical, is set by the Rust twin (`fuz_fact_serving::serve`).
+ * `Content-Disposition: attachment` is deliberately **not** added — it would
+ * force-download and break legitimate inline image rendering.
+ *
  * ## Defense-in-depth
  *
  * The `external_url` regex is re-validated before issuing
@@ -92,6 +104,31 @@ import { can_view_cell } from '../auth/cell_authorize.js';
 import { parse_file_fact_url } from '../db/file_fact_url.js';
 /** `Cache-Control` for fact responses — 5 min revocation window. */
 const CACHE_CONTROL = 'private, max-age=300';
+/**
+ * `X-Content-Type-Options` for fact responses — block MIME sniffing so an
+ * `application/octet-stream` fact can't be sniffed into executable HTML.
+ */
+const X_CONTENT_TYPE_OPTIONS = 'nosniff';
+/**
+ * `Content-Security-Policy` for fact responses. Fact bytes carry a
+ * producer-supplied `content_type` served verbatim inline, so a fact stored as
+ * (or sniffable to) `text/html` would otherwise execute as stored XSS for any
+ * reader of a referencing cell. `default-src 'none'; sandbox` neutralizes
+ * script execution and sub-resource loads even when a fact is rendered inline;
+ * harmless for directly-served images (they load no sub-resources). The same
+ * pair, byte-identical, is set by the Rust twin (`fuz_fact_serving::serve`).
+ */
+const CONTENT_SECURITY_POLICY = "default-src 'none'; sandbox";
+/**
+ * The untrusted-content hardening headers applied to every served-fact
+ * response across all three branches (embedded, `X-Accel-Redirect`,
+ * disk-stream). `Content-Disposition: attachment` is deliberately omitted — it
+ * would force-download and break legitimate inline image rendering.
+ */
+const FACT_SECURITY_HEADERS = {
+    'X-Content-Type-Options': X_CONTENT_TYPE_OPTIONS,
+    'Content-Security-Policy': CONTENT_SECURITY_POLICY,
+};
 /**
  * Path-param schema for the bare-hash route. Matching the canonical
  * fact-hash form here pushes malformed-hash 400s through the framework's
@@ -150,6 +187,7 @@ const serve_fact_bytes = async (c, route, hash, config) => {
             'Content-Type': content_type,
             'Content-Length': size,
             'Cache-Control': CACHE_CONTROL,
+            ...FACT_SECURITY_HEADERS,
         });
     }
     // External — defense-in-depth re-validate the URL before trusting it
@@ -167,6 +205,7 @@ const serve_fact_bytes = async (c, route, hash, config) => {
             'Content-Length': size,
             'Cache-Control': CACHE_CONTROL,
             'X-Accel-Redirect': `${x_accel_redirect_prefix}${shard}/${rest}`,
+            ...FACT_SECURITY_HEADERS,
         });
     }
     // Dev / tests: stream from disk. `createReadStream` errors land on the
@@ -178,6 +217,7 @@ const serve_fact_bytes = async (c, route, hash, config) => {
         'Content-Type': content_type,
         'Content-Length': size,
         'Cache-Control': CACHE_CONTROL,
+        ...FACT_SECURITY_HEADERS,
     });
 };
 /**

package/dist/testing/CLAUDE.md

@@ -973,9 +973,29 @@ wire-shape check passes green on even when behavior is wrong.
 error_reason?, fields?, headers?, equivalence_group?}, note?, xfail?}`. A case is **data** — `method`
   resolves its `input`/`output` from the live registry (RPC) or `RouteSpec`
   (the 6 REST auth routes), so the case never carries a schema. `as` is the
-  closed `ConformancePrincipal` enum (`keeper` / `daemon` / `token` /
-  `anonymous` / `fresh_non_admin` / `role_holder` / `wrong_role` /
-  `expired_session`) — fixture accessors, never inline credential minting.
+  closed `ConformancePrincipal` enum (`keeper` / `daemon` / `invalid_daemon` /
+  `daemon_browser` / `token` / `bearer_browser` / `anonymous` /
+  `fresh_non_admin` / `role_holder` / `wrong_role` / `expired_session`) —
+  fixture accessors, never inline credential minting.
+  `invalid_daemon` sends a malformed `X-Daemon-Token` alongside the keeper
+  session cookie over a no-Origin transport: the middleware soft-fail-discards
+  the daemon token (matching the Rust spine's `None`), auth falls through to the
+  session leg, and a daemon-gated action then refuses the session credential
+  with `credential_type_required` — not a hard invalid-token 401 (the session
+  base credential is what makes the credential-type gate, not the auth gate, the
+  refusing layer).
+  `daemon_browser` sends a _valid_ `X-Daemon-Token` in a browser context
+  (default `Origin` present) alongside the keeper session cookie: the middleware
+  discards the header-bearing token as browser context (mirroring the bearer
+  guard + the Rust spine's `is_browser_context`), so auth falls through to the
+  session leg → `credential_type_required`. Unlike `daemon` (no Origin → token
+  honored → 400 confirm guard), the 403 proves a valid token is _dropped_, not
+  honored, when an `Origin` is present.
+  `bearer_browser` is the bearer twin: a _valid_ bearer api-token in a browser
+  context (default `Origin` present), fresh jar (no session) — the bearer
+  middleware discards it, so an authed action 401s, wire-indistinguishable from
+  `anonymous` (pinned by the `browser_bearer_replay` equivalence group). The
+  `token` principal is the honored counterpart (suppresses `Origin`).
   `expired_session` is the keeper behind an expired server-side session
   (`fixture.mint_expired_session()`: a backdated `auth_session` row behind a
   still-valid signed cookie, so the DB-row expiry gate is what refuses it).

package/dist/testing/audit_completeness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit_completeness.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/audit_completeness.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AA4B7B,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAU9D,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AA2B1B,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAC,mBAAmB,EAAC,MAAM,iCAAiC,CAAC;AACzE,OAAO,KAAK,EAAC,SAAS,EAAc,MAAM,0BAA0B,CAAC;AAErE;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC5C;;;;;OAKG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;;;;OAMG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,uCAAuC;IACvC,YAAY,EAAE,mBAAmB,CAAC;IAClC,yEAAyE;IACzE,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;OAGG;IACH,aAAa,EAAE,uBAAuB,CAAC;CACvC;AA8FD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iCAAiC,GAAI,SAAS,4BAA4B,KAAG,IAomBzF,CAAC"}
+{"version":3,"file":"audit_completeness.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/audit_completeness.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AA4B7B,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAU9D,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AA2B1B,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAC,mBAAmB,EAAC,MAAM,iCAAiC,CAAC;AACzE,OAAO,KAAK,EAAC,SAAS,EAAc,MAAM,0BAA0B,CAAC;AAErE;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC5C;;;;;OAKG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;;;;OAMG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,uCAAuC;IACvC,YAAY,EAAE,mBAAmB,CAAC;IAClC,yEAAyE;IACzE,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;OAGG;IACH,aAAa,EAAE,uBAAuB,CAAC;CACvC;AA8FD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iCAAiC,GAAI,SAAS,4BAA4B,KAAG,IAumBzF,CAAC"}

package/dist/testing/audit_completeness.js

@@ -445,7 +445,10 @@ export const describe_audit_completeness_tests = (options) => {
                     path: rpc_path,
                     spec: account_purge_action_spec,
                     params: { account_id: target.account.id, confirm: true },
-                    // Keeper-gated: daemon-token credential, not a session.
+                    // Keeper-gated: daemon-token credential, not a session. Suppress the
+                    // default `origin` header — the daemon-token middleware discards the
+                    // credential in a browser context (Origin/Referer present).
+                    suppress_default_origin: true,
                     headers: fixture.create_daemon_token_headers(),
                 });
                 assert.ok(res.ok, `account_purge failed: ${res.ok ? '' : JSON.stringify(res.error)}`);

package/dist/testing/cross_backend/bootstrap_backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap_backend.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/bootstrap_backend.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAIvD,OAAO,KAAK,EAAC,yBAAyB,EAAC,MAAM,YAAY,CAAC;AAE1D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAC7B,QAAQ,aAAa,KACnB,OAAO,CAAC,yBAAyB,CAgBnC,CAAC"}
+{"version":3,"file":"bootstrap_backend.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/bootstrap_backend.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAIvD,OAAO,KAAK,EAAC,yBAAyB,EAAC,MAAM,YAAY,CAAC;AAE1D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAC7B,QAAQ,aAAa,KACnB,OAAO,CAAC,yBAAyB,CAwBnC,CAAC"}

package/dist/testing/cross_backend/bootstrap_backend.js

@@ -22,6 +22,14 @@ export const bootstrap_backend = async (config) => {
         return {
             ...handle,
             keeper_transport,
+            // Origin-free twin carrying the same keeper cookie jar — the
+            // daemon-token middleware discards the credential in a browser
+            // context, so the `_testing_*` daemon-token calls route through this.
+            keeper_daemon_transport: create_fetch_transport({
+                base_url: config.base_url,
+                initial_cookies: keeper.cookies,
+                origin: null,
+            }),
             keeper_account: keeper.account,
             keeper_actor: keeper.actor,
             keeper_cookies: keeper.cookies,

package/dist/testing/cross_backend/cell_crud.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_crud.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_crud.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAsD9B,OAAO,KAAK,EAAC,wBAAwB,EAAC,MAAM,YAAY,CAAC;AAGzD,eAAO,MAAM,8BAA8B,GAAI,SAAS,wBAAwB,KAAG,IAwSlF,CAAC"}
+{"version":3,"file":"cell_crud.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_crud.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAsD9B,OAAO,KAAK,EAAC,wBAAwB,EAAC,MAAM,YAAY,CAAC;AAGzD,eAAO,MAAM,8BAA8B,GAAI,SAAS,wBAAwB,KAAG,IA6VlF,CAAC"}

package/dist/testing/cross_backend/cell_crud.js

@@ -83,6 +83,29 @@ export const describe_cell_crud_cross_tests = (options) => {
             assert.ok(!gone.ok, 'deleted cell still readable');
             assert.strictEqual(error_reason(gone), 'cell_not_found');
         });
+        test_if(capabilities.cell_crud, 'refs are deduped and lexicographically sorted (deterministic, cross-impl-identical)', async () => {
+            const fixture = await setup_test();
+            const owner = await fixture.create_account({ username: 'cell_refs_owner' });
+            const t = fixture.fresh_transport();
+            const owner_headers = owner.create_session_headers();
+            // Three valid distinct fact hashes that sort a < b < c, embedded in
+            // `data` in a deliberately unsorted, nested, duplicated order. Both
+            // spines must derive `refs` as the sorted [a, b, c] regardless of
+            // traversal order or `HashSet` iteration — the byte-identical
+            // cross-backend contract (Rust `extract_refs` ↔ TS `derive_refs`).
+            const ref_a = `blake3:${'a'.repeat(64)}`;
+            const ref_b = `blake3:${'b'.repeat(64)}`;
+            const ref_c = `blake3:${'c'.repeat(64)}`;
+            const sorted = [ref_a, ref_b, ref_c];
+            const created = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { data: { kind: 'note', cover: ref_c, nested: { attachments: [ref_b, ref_a, ref_b] } } }, owner_headers), CellCreateOutput);
+            assert.deepStrictEqual(created.cell.refs, sorted, 'create did not return sorted refs');
+            // Read it back — the stored column round-trips sorted too.
+            const got = expect_output(await cross_rpc_call(t, rpc_path, 'cell_get', { id: created.cell.id }, owner_headers), CellGetOutput);
+            assert.deepStrictEqual(got.cell.refs, sorted, 'get did not return sorted refs');
+            // Update reorders the embedded refs — the new column is still sorted.
+            const updated = expect_output(await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id: created.cell.id, data: { refs: [ref_b, ref_c, ref_a] } }, owner_headers), CellUpdateOutput);
+            assert.deepStrictEqual(updated.cell.refs, sorted, 'update did not return sorted refs');
+        });
         test_if(capabilities.cell_crud, 'anon sees public cells only; private is 404', async () => {
             const fixture = await setup_test();
             const owner = await fixture.create_account({ username: 'cell_anon_owner' });

package/dist/testing/cross_backend/conformance_case.d.ts

@@ -33,8 +33,39 @@ import { z } from 'zod';
  * - `keeper` — the per-test bootstrapped keeper (holds `ROLE_KEEPER` +
  *   `ROLE_ADMIN`), session credential.
  * - `daemon` — the keeper authenticated via the daemon-token header.
+ * - `invalid_daemon` — a *malformed/invalid* `X-Daemon-Token` carried
+ *   alongside the keeper's session cookie, over a non-browser (no-Origin)
+ *   transport. The middleware soft-fail-discards the invalid daemon token
+ *   (matching the Rust spine's `None`), so auth falls through to the session
+ *   leg: the request authenticates as the keeper-via-session and a
+ *   daemon-gated action then refuses the session credential with
+ *   `credential_type_required` — not a hard `invalid_daemon_token` 401. The
+ *   no-Origin transport keeps the daemon token on the invalid-token path
+ *   rather than the browser-context discard; the session base credential is
+ *   what makes the credential-type gate (not the auth gate) the refusing
+ *   layer (without it the discard would 401 anonymous).
+ * - `daemon_browser` — a *valid* `X-Daemon-Token` carried in a browser
+ *   context (default `Origin` present) alongside the keeper's session cookie.
+ *   Browsers attach `Origin` automatically; the daemon-token middleware
+ *   discards a header-bearing daemon token as browser context (mirroring the
+ *   bearer guard and the Rust spine's `is_browser_context`), so the *valid*
+ *   token is dropped and auth falls through to the session leg → a daemon-gated
+ *   action then refuses the session credential with `credential_type_required`.
+ *   Distinct from `invalid_daemon`: here the token is well-formed and current,
+ *   so a 403 (not a 400 confirm-guard hit like `daemon`) proves the
+ *   browser-context discard fired — a valid daemon token does NOT authenticate
+ *   when an `Origin` is present. `Origin` is deliberately NOT suppressed; its
+ *   presence is the signal under test.
  * - `token` — the keeper authenticated via a bearer api-token (non-browser
  *   context; the runner suppresses `Origin` so the token isn't discarded).
+ * - `bearer_browser` — a *valid* bearer api-token carried in a browser context
+ *   (default `Origin` present), fresh jar so NO session rides alongside. The
+ *   bearer middleware discards the token as browser context (mirroring the
+ *   daemon guard + the Rust spine's `is_browser_context`), so the request
+ *   arrives anonymous and an authed action 401s. Proves a stolen bearer cannot
+ *   be replayed from a browser — wire-indistinguishable from sending no
+ *   credential (the `token` principal is the honored counterpart: it suppresses
+ *   `Origin`, so the same token authenticates).
  * - `anonymous` — no credential, fresh cookie jar.
  * - `fresh_non_admin` — a freshly minted account with no roles, session
  *   credential (via the production invite → signup → login flow).
@@ -53,6 +84,9 @@ export declare const ConformancePrincipal: z.ZodEnum<{
     keeper: "keeper";
     token: "token";
     daemon: "daemon";
+    invalid_daemon: "invalid_daemon";
+    daemon_browser: "daemon_browser";
+    bearer_browser: "bearer_browser";
     anonymous: "anonymous";
     fresh_non_admin: "fresh_non_admin";
     role_holder: "role_holder";
@@ -68,6 +102,9 @@ export declare const ConformanceCaseRequest: z.ZodObject<{
         keeper: "keeper";
         token: "token";
         daemon: "daemon";
+        invalid_daemon: "invalid_daemon";
+        daemon_browser: "daemon_browser";
+        bearer_browser: "bearer_browser";
         anonymous: "anonymous";
         fresh_non_admin: "fresh_non_admin";
         role_holder: "role_holder";
@@ -120,6 +157,9 @@ export declare const ConformanceCase: z.ZodObject<{
             keeper: "keeper";
             token: "token";
             daemon: "daemon";
+            invalid_daemon: "invalid_daemon";
+            daemon_browser: "daemon_browser";
+            bearer_browser: "bearer_browser";
             anonymous: "anonymous";
             fresh_non_admin: "fresh_non_admin";
             role_holder: "role_holder";

package/dist/testing/cross_backend/conformance_case.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conformance_case.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/conformance_case.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;EAS/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,6CAA6C;AAC7C,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;kBAgBjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,8DAA8D;AAC9D,eAAO,MAAM,0BAA0B;;;;;;kBAiDrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;kBAK/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAS1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC"}
+{"version":3,"file":"conformance_case.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/conformance_case.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;EAY/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,6CAA6C;AAC7C,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;kBAgBjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,8DAA8D;AAC9D,eAAO,MAAM,0BAA0B;;;;;;kBAiDrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;kBAK/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAS1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC"}

package/dist/testing/cross_backend/conformance_case.js

@@ -33,8 +33,39 @@ import { z } from 'zod';
  * - `keeper` — the per-test bootstrapped keeper (holds `ROLE_KEEPER` +
  *   `ROLE_ADMIN`), session credential.
  * - `daemon` — the keeper authenticated via the daemon-token header.
+ * - `invalid_daemon` — a *malformed/invalid* `X-Daemon-Token` carried
+ *   alongside the keeper's session cookie, over a non-browser (no-Origin)
+ *   transport. The middleware soft-fail-discards the invalid daemon token
+ *   (matching the Rust spine's `None`), so auth falls through to the session
+ *   leg: the request authenticates as the keeper-via-session and a
+ *   daemon-gated action then refuses the session credential with
+ *   `credential_type_required` — not a hard `invalid_daemon_token` 401. The
+ *   no-Origin transport keeps the daemon token on the invalid-token path
+ *   rather than the browser-context discard; the session base credential is
+ *   what makes the credential-type gate (not the auth gate) the refusing
+ *   layer (without it the discard would 401 anonymous).
+ * - `daemon_browser` — a *valid* `X-Daemon-Token` carried in a browser
+ *   context (default `Origin` present) alongside the keeper's session cookie.
+ *   Browsers attach `Origin` automatically; the daemon-token middleware
+ *   discards a header-bearing daemon token as browser context (mirroring the
+ *   bearer guard and the Rust spine's `is_browser_context`), so the *valid*
+ *   token is dropped and auth falls through to the session leg → a daemon-gated
+ *   action then refuses the session credential with `credential_type_required`.
+ *   Distinct from `invalid_daemon`: here the token is well-formed and current,
+ *   so a 403 (not a 400 confirm-guard hit like `daemon`) proves the
+ *   browser-context discard fired — a valid daemon token does NOT authenticate
+ *   when an `Origin` is present. `Origin` is deliberately NOT suppressed; its
+ *   presence is the signal under test.
  * - `token` — the keeper authenticated via a bearer api-token (non-browser
  *   context; the runner suppresses `Origin` so the token isn't discarded).
+ * - `bearer_browser` — a *valid* bearer api-token carried in a browser context
+ *   (default `Origin` present), fresh jar so NO session rides alongside. The
+ *   bearer middleware discards the token as browser context (mirroring the
+ *   daemon guard + the Rust spine's `is_browser_context`), so the request
+ *   arrives anonymous and an authed action 401s. Proves a stolen bearer cannot
+ *   be replayed from a browser — wire-indistinguishable from sending no
+ *   credential (the `token` principal is the honored counterpart: it suppresses
+ *   `Origin`, so the same token authenticates).
  * - `anonymous` — no credential, fresh cookie jar.
  * - `fresh_non_admin` — a freshly minted account with no roles, session
  *   credential (via the production invite → signup → login flow).
@@ -52,7 +83,10 @@ import { z } from 'zod';
 export const ConformancePrincipal = z.enum([
     'keeper',
     'daemon',
+    'invalid_daemon',
+    'daemon_browser',
     'token',
+    'bearer_browser',
     'anonymous',
     'fresh_non_admin',
     'role_holder',

package/dist/testing/cross_backend/conformance_table.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conformance_table.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/conformance_table.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA8B9B,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,uBAAuB,CAAC;AAE1D,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,8BAA8B,CAAC;AAMjE,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAC,KAAK,eAAe,EAA4B,MAAM,uBAAuB,CAAC;AACtF,OAAO,KAAK,EAAC,mBAAmB,EAAC,MAAM,mBAAmB,CAAC;AAC3D,OAAO,KAAK,EAAC,SAAS,EAAc,MAAM,YAAY,CAAC;AAGvD;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IAC1C,iEAAiE;IACjE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,sDAAsD;AACtD,MAAM,WAAW,uBAAuB;IACvC,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC/C,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,kEAAkE;IAClE,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD,4EAA4E;IAC5E,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC;IACjD,iEAAiE;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AA+FD;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,EAAE,aAAa,CAAC,MAAM,CAIrD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,MAAM,KACX,IAQF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GACnC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,EACvC,OAAO,MAAM,KACX,IAYF,CAAC;AAgKF;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAAI,SAAS,uBAAuB,KAAG,IAkEnF,CAAC"}
+{"version":3,"file":"conformance_table.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/conformance_table.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA8B9B,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,uBAAuB,CAAC;AAE1D,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,8BAA8B,CAAC;AAOjE,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAC,KAAK,eAAe,EAA4B,MAAM,uBAAuB,CAAC;AACtF,OAAO,KAAK,EAAC,mBAAmB,EAAC,MAAM,mBAAmB,CAAC;AAC3D,OAAO,KAAK,EAAC,SAAS,EAAc,MAAM,YAAY,CAAC;AAGvD;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IAC1C,iEAAiE;IACjE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,sDAAsD;AACtD,MAAM,WAAW,uBAAuB;IACvC,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC/C,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,kEAAkE;IAClE,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD,4EAA4E;IAC5E,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC;IACjD,iEAAiE;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAyJD;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,EAAE,aAAa,CAAC,MAAM,CAIrD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,MAAM,KACX,IAQF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GACnC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,EACvC,OAAO,MAAM,KACX,IAYF,CAAC;AAgKF;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAAI,SAAS,uBAAuB,KAAG,IAkEnF,CAAC"}

package/dist/testing/cross_backend/conformance_table.js

@@ -25,10 +25,21 @@ import '../assert_dev_env.js';
  * @module
  */
 import { assert, describe, test } from 'vitest';
+import { DAEMON_TOKEN_HEADER } from '../../auth/daemon_token.js';
 import { find_auth_route, rest_auth_route_suffixes, } from '../integration_helpers.js';
 import { find_rpc_action, headers_to_record, rpc_call, resolve_rpc_endpoints_for_setup, } from '../rpc_helpers.js';
 import {} from './conformance_case.js';
 import { xfail_until } from './xfail.js';
+/**
+ * A deliberately malformed `X-Daemon-Token` value for the `invalid_daemon`
+ * principal. Fails the `DaemonToken` Zod schema (not 43 base64url chars), so
+ * the daemon-token middleware soft-fail-discards it rather than authenticating
+ * — the request falls through with no identity, surfacing
+ * `credential_type_required` on a daemon-gated action (matching the Rust
+ * spine's `None`). Sent over a no-Origin transport so it lands on the
+ * invalid-token path, not the browser-context discard.
+ */
+const INVALID_DAEMON_TOKEN_VALUE = 'not-a-valid-daemon-token';
 /**
  * Map a `ConformancePrincipal` onto the transport + headers it
  * authenticates with, reading exclusively from the per-test `TestFixture`.
@@ -51,6 +62,39 @@ const resolve_principal = async (fixture, as, principals) => {
                 headers: fixture.create_daemon_token_headers(),
                 suppress_default_origin: true,
             };
+        case 'invalid_daemon':
+            // A malformed `X-Daemon-Token` carried ALONGSIDE the keeper's session
+            // cookie, over a non-browser (no-Origin) transport. The invalid daemon
+            // token is soft-fail-discarded (matching the Rust spine's `None`), so
+            // auth falls through to the session leg: the request authenticates as
+            // the keeper-via-session (clearing `require_auth`), then the daemon-gated
+            // action's credential-type gate refuses the session credential →
+            // `403 credential_type_required`. No-Origin keeps the daemon token on
+            // the invalid-token path, NOT the browser-context discard. Without the
+            // base credential this would 401 (anonymous) — the session is what makes
+            // the *credential-type* gate, not the auth gate, the refusing layer.
+            return {
+                transport: fixture.fresh_transport({ origin: null }),
+                headers: fixture.create_session_headers({
+                    [DAEMON_TOKEN_HEADER]: INVALID_DAEMON_TOKEN_VALUE,
+                }),
+                suppress_default_origin: true,
+            };
+        case 'daemon_browser':
+            // A VALID `X-Daemon-Token` carried in a browser context (default Origin
+            // present) ALONGSIDE the keeper's session cookie. The daemon-token
+            // middleware discards a header-bearing daemon token as browser context
+            // (mirroring the bearer guard + the Rust spine's `is_browser_context`),
+            // so the valid token is dropped and auth falls through to the session
+            // leg → keeper-via-session → a daemon-gated action refuses the session
+            // credential with `credential_type_required`. Origin is NOT suppressed —
+            // its presence is the browser-context signal under test. Unlike the
+            // `daemon` principal (no Origin → token honored → reaches the 400 confirm
+            // guard), the 403 here proves the valid token was discarded, not honored.
+            return {
+                transport: fixture.transport,
+                headers: fixture.create_session_headers(fixture.create_daemon_token_headers()),
+            };
         case 'token':
             // Bearer is discarded in a browser context — empty jar + no Origin.
             return {
@@ -58,6 +102,20 @@ const resolve_principal = async (fixture, as, principals) => {
                 headers: fixture.create_bearer_headers(),
                 suppress_default_origin: true,
             };
+        case 'bearer_browser':
+            // A VALID bearer api-token in a browser context (default Origin
+            // present), fresh jar so no session rides alongside. The bearer
+            // middleware discards a header-bearing token as browser context
+            // (mirroring the daemon guard + the Rust spine's `is_browser_context`),
+            // so the request arrives anonymous → an authed action 401s. Origin is
+            // NOT suppressed (its presence is the browser-context signal) — the
+            // inverse of the `token` principal, which suppresses it so the same
+            // token is honored. The 401 proves the valid token was discarded, not
+            // honored (a non-discarding leg would authenticate → 200).
+            return {
+                transport: fixture.fresh_transport(),
+                headers: fixture.create_bearer_headers(),
+            };
         case 'anonymous':
             // Fresh jar so the keeper cookie (cross-process) can't leak in.
             return { transport: fixture.fresh_transport(), headers: {} };

package/dist/testing/cross_backend/fact_serving.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fact_serving.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/fact_serving.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAiD9B,OAAO,KAAK,EAAC,wBAAwB,EAAE,SAAS,EAAC,MAAM,YAAY,CAAC;AAEpE;;;;;GAKG;AACH,MAAM,WAAW,2BAA4B,SAAQ,wBAAwB;IAC5E,QAAQ,CAAC,sBAAsB,CAAC,EAAE,SAAS,CAAC;CAC5C;AA8BD,eAAO,MAAM,iCAAiC,GAAI,SAAS,2BAA2B,KAAG,IA8NxF,CAAC"}
+{"version":3,"file":"fact_serving.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/fact_serving.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAiD9B,OAAO,KAAK,EAAC,wBAAwB,EAAE,SAAS,EAAC,MAAM,YAAY,CAAC;AAEpE;;;;;GAKG;AACH,MAAM,WAAW,2BAA4B,SAAQ,wBAAwB;IAC5E,QAAQ,CAAC,sBAAsB,CAAC,EAAE,SAAS,CAAC;CAC5C;AA8BD,eAAO,MAAM,iCAAiC,GAAI,SAAS,2BAA2B,KAAG,IAiOxF,CAAC"}

package/dist/testing/cross_backend/fact_serving.js

@@ -68,7 +68,11 @@ export const describe_fact_serving_cross_tests = (options) => {
     const { setup_test, setup_test_multi_actor, capabilities } = options;
     const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
     /** Seed an embedded fact over the daemon channel; returns its `blake3:` hash. */
-    const put_fact = async (fixture, content, content_type) => expect_output(await cross_rpc_call(fixture.transport, rpc_path, '_testing_put_fact', content_type === undefined ? { content } : { content, content_type }, fixture.create_daemon_token_headers()), TestingPutFactOutput).hash;
+    const put_fact = async (fixture, content, content_type) => expect_output(await cross_rpc_call(
+    // Origin-free transport — the daemon-token middleware discards the
+    // credential when an `Origin` / `Referer` is present (browser
+    // context), and cross-process `fixture.transport` auto-adds `Origin`.
+    fixture.fresh_transport({ origin: null }), rpc_path, '_testing_put_fact', content_type === undefined ? { content } : { content, content_type }, fixture.create_daemon_token_headers()), TestingPutFactOutput).hash;
     /**
      * Create a cell referencing `hash` (`extract_refs` lifts it into `cell.refs`).
      * Pass `acting` when the caller's account holds more than one actor —

package/dist/testing/cross_backend/setup.d.ts

@@ -253,6 +253,11 @@ export interface RpcPathCrossSuiteOptions extends CrossSuiteOptions {
  * const bootstrapped: BootstrappedBackendHandle = {
  *   ...handle,
  *   keeper_transport,
+ *   keeper_daemon_transport: create_fetch_transport({
+ *     base_url: config.base_url,
+ *     initial_cookies: keeper.cookies,
+ *     origin: null,
+ *   }),
  *   keeper_account: keeper.account,
  *   keeper_actor: keeper.actor,
  *   keeper_cookies: keeper.cookies,
@@ -268,6 +273,18 @@ export interface RpcPathCrossSuiteOptions extends CrossSuiteOptions {
 export interface BootstrappedBackendHandle extends BackendHandle {
     /** Transport carrying the keeper session cookie + cookie jar. */
     readonly keeper_transport: FetchTransport;
+    /**
+     * Daemon-token transport for the keeper — same cookie jar as
+     * `keeper_transport` but with `origin: null` so it sends no `Origin`
+     * header. The daemon-token middleware discards the credential in a
+     * browser context (any `Origin` / `Referer`), so the `_testing_*`
+     * daemon-token calls (`_testing_reset` / `_testing_schema_snapshot` /
+     * `_testing_action_manifest` / `_testing_mint_session`) must route
+     * through this Origin-free transport. CSRF/cookie-session calls
+     * (`invite_create`, `role_grant_offer_create`) stay on `keeper_transport`,
+     * which keeps its default `Origin`.
+     */
+    readonly keeper_daemon_transport: FetchTransport;
     /** Keeper account JSON captured from `POST /bootstrap`. */
     readonly keeper_account: {
         readonly id: Uuid;

package/dist/testing/cross_backend/setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/setup.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA0B9B,OAAO,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AAK5C,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,EAAC,mBAAmB,EAAC,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAyB,KAAK,cAAc,EAAC,MAAM,kCAAkC,CAAC;AAC7F,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAC,cAAc,EAAC,MAAM,sBAAsB,CAAC;AACpD,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,oBAAoB,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAC;AAE7C;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACtC;AAED,sEAAsE;AACtE,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,OAAO,EAAE;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACjE,QAAQ,CAAC,KAAK,EAAE;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5F,QAAQ,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3F;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2BAA2B,GACvC,QAAQ;IACP,OAAO,EAAE;QAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACtC,KAAK,EAAE;QAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,EACD,aAAa,MAAM,KACjB,mBAaD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,eAAe;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,QAAQ,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,EAAE;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAC,KAAK,cAAc,CAAC;IAC1F,+CAA+C;IAC/C,QAAQ,CAAC,OAAO,EAAE;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACjE,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IACpC,8DAA8D;IAC9D,QAAQ,CAAC,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5F,4DAA4D;IAC5D,QAAQ,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3F,iEAAiE;IACjE,QAAQ,CAAC,2BAA2B,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjG;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE,wBAAwB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC7F;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACvE;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAC,CAAC,CAAC;IACjF;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,oBAAoB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACrD;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,WAAW,GAAG,eAAe,CAAC;AAE1C;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;AAEnD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IACjC,wEAAwE;IACxE,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;CAC3C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IAClE,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,yBAA0B,SAAQ,aAAa;IAC/D,iEAAiE;IACjE,QAAQ,CAAC,gBAAgB,EAAE,cAAc,CAAC;IAC1C,2DAA2D;IAC3D,QAAQ,CAAC,cAAc,EAAE;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACxE,yDAAyD;IACzD,QAAQ,CAAC,YAAY,EAAE;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IAC3C,wGAAwG;IACxG,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC/C;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,sCAAsC,GAAG,IAAI,CACxD,yBAAyB,EACzB,OAAO,GAAG,UAAU,CACpB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,qCAAqC;IACrD,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IACrD,QAAQ,CAAC,cAAc,EAAE,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;IACrE,QAAQ,CAAC,YAAY,EAAE,yBAAyB,CAAC,cAAc,CAAC,CAAC;IACjE,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC/C;AAED;;;GAGG;AACH,eAAO,MAAM,6BAA6B,GACzC,QAAQ,yBAAyB,KAC/B,qCAMD,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,GAC3C,YAAY,qCAAqC,KAC/C,sCAUD,CAAC;AAEH,iDAAiD;AACjD,MAAM,WAAW,wBAAwB;IACxC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACpD;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAC1D;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC9C;AAqFD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,GACnC,QAAQ,sCAAsC,EAC9C,UAAS;IAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;CAAM,KACpD,OAAO,CAAC,cAAc,CAcxB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,GACnC,QAAQ,sCAAsC,KAC5C,OAAO,CAAC,cAAc,CAUxB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,MAAM,CAAC;AA8SlD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,2BAA2B,GACvC,QAAQ,sCAAsC,EAC9C,UAAU,wBAAwB,KAChC,SAqIF,CAAC"}
+{"version":3,"file":"setup.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/setup.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA0B9B,OAAO,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AAK5C,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,EAAC,mBAAmB,EAAC,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAyB,KAAK,cAAc,EAAC,MAAM,kCAAkC,CAAC;AAC7F,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAC,cAAc,EAAC,MAAM,sBAAsB,CAAC;AACpD,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,oBAAoB,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAC;AAE7C;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACtC;AAED,sEAAsE;AACtE,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,OAAO,EAAE;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACjE,QAAQ,CAAC,KAAK,EAAE;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5F,QAAQ,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3F;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2BAA2B,GACvC,QAAQ;IACP,OAAO,EAAE;QAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACtC,KAAK,EAAE;QAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,EACD,aAAa,MAAM,KACjB,mBAaD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,eAAe;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,QAAQ,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,EAAE;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAC,KAAK,cAAc,CAAC;IAC1F,+CAA+C;IAC/C,QAAQ,CAAC,OAAO,EAAE;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACjE,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IACpC,8DAA8D;IAC9D,QAAQ,CAAC,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5F,4DAA4D;IAC5D,QAAQ,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3F,iEAAiE;IACjE,QAAQ,CAAC,2BAA2B,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjG;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE,wBAAwB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC7F;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACvE;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAC,CAAC,CAAC;IACjF;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,oBAAoB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACrD;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,WAAW,GAAG,eAAe,CAAC;AAE1C;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;AAEnD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IACjC,wEAAwE;IACxE,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;CAC3C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IAClE,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,WAAW,yBAA0B,SAAQ,aAAa;IAC/D,iEAAiE;IACjE,QAAQ,CAAC,gBAAgB,EAAE,cAAc,CAAC;IAC1C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,uBAAuB,EAAE,cAAc,CAAC;IACjD,2DAA2D;IAC3D,QAAQ,CAAC,cAAc,EAAE;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACxE,yDAAyD;IACzD,QAAQ,CAAC,YAAY,EAAE;QAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;KAAC,CAAC;IAC3C,wGAAwG;IACxG,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC/C;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,sCAAsC,GAAG,IAAI,CACxD,yBAAyB,EACzB,OAAO,GAAG,UAAU,CACpB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,qCAAqC;IACrD,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IACrD,QAAQ,CAAC,cAAc,EAAE,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;IACrE,QAAQ,CAAC,YAAY,EAAE,yBAAyB,CAAC,cAAc,CAAC,CAAC;IACjE,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC/C;AAED;;;GAGG;AACH,eAAO,MAAM,6BAA6B,GACzC,QAAQ,yBAAyB,KAC/B,qCAMD,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,GAC3C,YAAY,qCAAqC,KAC/C,sCAmBD,CAAC;AAEH,iDAAiD;AACjD,MAAM,WAAW,wBAAwB;IACxC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACpD;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAC1D;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC9C;AAqFD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,GACnC,QAAQ,sCAAsC,EAC9C,UAAS;IAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;CAAM,KACpD,OAAO,CAAC,cAAc,CAcxB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,GACnC,QAAQ,sCAAsC,KAC5C,OAAO,CAAC,cAAc,CAUxB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,MAAM,CAAC;AA+TlD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,2BAA2B,GACvC,QAAQ,sCAAsC,EAC9C,UAAU,wBAAwB,KAChC,SA8IF,CAAC"}