neotoma 0.22.0 → 0.22.2

package/dist/docs/security/advisories/2026-08-26-jwt-bearer-unverified-fallback-auth-bypass.md

@@ -0,0 +1,59 @@
+# MCP session token validation trusted an unverified JWT's own claims (v0.22.1 fix)
+
+- **Date disclosed:** 2026-08-26
+- **GHSA:** _draft; publish after tag per release process_
+- **CVE:** _not requested_
+- **Severity:** High — a remote caller could authenticate as any user without a valid session.
+- **Affected:** all versions carrying this fallback in `validateSessionToken` prior to `0.22.1`.
+- **Fixed in:** `0.22.1`
+- **Reporter:** internal security review.
+- **CWEs:** [CWE-287](https://cwe.mitre.org/data/definitions/287.html) (Improper Authentication), [CWE-347](https://cwe.mitre.org/data/definitions/347.html) (Improper Verification of Cryptographic Signature).
+
+## Summary
+
+`validateSessionToken` (`src/services/mcp_auth.ts`) looked up the bearer token against `mcp_oauth_connections`. When no row matched, it fell back to decoding the bearer as an **unverified** JWT via a local `decodeJWTUnverified` helper and trusted the token's own `sub` (and `email`) claims as the authenticated identity — no signature, issuer, or expiry check. The accompanying comment described this as "local-only compatibility," but the fallback carried no local-only gate, so it ran for any caller, local or remote.
+
+## Impact
+
+A caller who could construct a syntactically valid but unsigned JWT (`{alg:"none"}` header, arbitrary payload, no verifiable signature) and present it as a `Bearer` token that matched no live OAuth connection was authenticated as the `sub` named in that token's own payload — including a specific victim's `user_id`, which is derivable as `sha256(email)`. Net effect: full authentication bypass on the MCP session-token path, independent of any real OAuth grant.
+
+## Root cause
+
+The fallback branch in `validateSessionToken` assumed that any bearer reaching this point without a matching connection row was a legitimate but differently-issued local token, and decoded-and-trusted it rather than rejecting it. This is the same regression class as the Ed25519 bearer path fixed in `0.21.4` (`2026-08-07-ed25519-bearer-forged-key-auth-bypass`): an unresolved bearer must fail closed, not fall through to trusting caller-supplied claims.
+
+## Fix
+
+`validateSessionToken` now fails closed: a bearer that resolves to no live `mcp_oauth_connections` row throws `Invalid session token`, unconditionally. The unused `decodeJWTUnverified` helper was removed so the unverified-decode code path no longer exists to regress into.
+
+Regression tests (`src/services/__tests__/mcp_oauth.test.ts`, `tests/services/mcp_auth.test.ts`) assert:
+
+- A forged `alg:none` JWT naming a real victim user's `user_id` is rejected.
+- A forged `alg:none` JWT naming an arbitrary/nonexistent `user_id` is rejected.
+- A random non-JWT bearer is rejected.
+- A legitimate, live OAuth connection token still authenticates correctly (no over-correction).
+
+## Operator action
+
+- Upgrade to `>= 0.22.1`.
+- No data migration required.
+- If an instance was reachable by untrusted callers prior to `0.22.1` with the MCP session-token path enabled, review any authentication logs for bearer tokens with a `{alg:"none"}` or otherwise unverifiable header shape.
+
+## Detection
+
+`src/services/__tests__/mcp_oauth.test.ts` and `tests/services/mcp_auth.test.ts` detect regressions of this class going forward.
+
+## Gates that catch this regression class going forward
+
+- **G3b auth topology matrix** (`tests/security/auth_topology_matrix.test.ts`) — asserts protected routes reject unauthenticated/unresolved callers.
+- **Regression tests above** — directly assert the fail-closed behavior for unresolved bearers on the MCP session-token path.
+- **Change guardrails rule MUST 5** — authorization must go through a resolved principal; caller-supplied claims are never trusted directly for access control.
+
+## Timeline
+
+| Date | Event |
+|------|-------|
+| 2026-08-26 | Vulnerability identified during internal security review |
+| 2026-08-26 | Fix PR #2232 merged |
+| 2026-08-26 | v0.22.1 supplement prepared |
+| TBD | v0.22.1 tagged and released |
+| TBD | GHSA published |

package/dist/docs/security/advisories/README.md

@@ -14,6 +14,7 @@ This index is the canonical cross-link target for:
 
 | Date | Title | GHSA | CVE | Affected | Fixed in | Gate that catches the regression class |
 |------|-------|------|-----|----------|----------|----------------------------------------|
+| 2026-08-26 | [MCP session token validation trusted an unverified JWT's own claims](2026-08-26-jwt-bearer-unverified-fallback-auth-bypass.md) | _draft_ | _not requested_ | all versions prior to `0.22.1` | `0.22.1` | `src/services/__tests__/mcp_oauth.test.ts`, `tests/services/mcp_auth.test.ts`, G3 auth topology matrix |
 | 2026-08-09 | [Stored XSS in rendered_page HTML route via author-supplied html_body](2026-08-09-rendered-page-stored-xss-csp.md) | [GHSA-qp63-9r52-4q25](https://github.com/markmhendrickson/neotoma/security/advisories/GHSA-qp63-9r52-4q25) | _not requested_ | all versions prior to `0.21.5` | `0.21.5` | `tests/security/rendered_page_csp.test.ts` |
 | 2026-08-07 | [Ed25519 bearer auth: unresolved principal returned caller-supplied user_id](2026-08-07-ed25519-bearer-forged-key-auth-bypass.md) | [GHSA-33x4-v5cf-2hfj](https://github.com/markmhendrickson/neotoma/security/advisories/GHSA-33x4-v5cf-2hfj) | _not requested_ | all versions prior to `0.21.4` | `0.21.4` | `tests/security/ed25519_forged_key_auth_bypass.test.ts`, G3 auth topology matrix |
 | 2026-08-07 | [sort_by / snapshot_filters ORDER BY SQL injection](2026-08-07-sort-by-order-by-sql-injection.md) | [GHSA-8f95-jfm5-jjmr](https://github.com/markmhendrickson/neotoma/security/advisories/GHSA-8f95-jfm5-jjmr) | _not requested_ | all versions prior to `0.21.4` | `0.21.4` | `tests/security/sort_by_sql_injection.test.ts`, `normalizeColumnName` fail-closed backstop |

package/dist/docs/security/practices.md

@@ -137,10 +137,14 @@ Every advisory in `docs/security/advisories/` MUST result in one of:
 1. A new gate, rule, or checklist category (documented in this file under the relevant section)
 2. An explicit waiver with a written reason (documented in the advisory's Gate Gap section)
 
-The two advisories filed to date have both produced gate or checklist work:
+Advisories filed to date have each produced gate or regression-test work:
 
 - `2026-05-11-inspector-auth-bypass` → G2 rules, G3a manifest, G3b matrix test, checklist categories 1–5 (all landed in v0.11.1)
 - `2026-05-21-relationship-endpoint-tenant-isolation` → G3b extension, checklist category 6 (pending, tracked in #372)
+- `2026-08-07-ed25519-bearer-forged-key-auth-bypass` → fail-closed fix on the Ed25519 bearer path plus `tests/security/ed25519_forged_key_auth_bypass.test.ts` (landed in v0.21.4)
+- `2026-08-07-sort-by-order-by-sql-injection` → `normalizeColumnName` fail-closed backstop plus `tests/security/sort_by_sql_injection.test.ts` (landed in v0.21.4)
+- `2026-08-09-rendered-page-stored-xss-csp` → CSP hardening plus `tests/security/rendered_page_csp.test.ts` (landed in v0.21.5)
+- `2026-08-26-jwt-bearer-unverified-fallback-auth-bypass` → fail-closed fix on the MCP session-token bearer path (removed the unverified-JWT decode fallback), plus regression tests in `src/services/__tests__/mcp_oauth.test.ts` and `tests/services/mcp_auth.test.ts` (landed in v0.22.1). Same regression class as the Ed25519 bearer path above — an unresolved bearer must fail closed rather than fall through to trusting caller-supplied claims.
 
 ### Single-tenant assumption
 

package/dist/docs/subsystems/agent_session_architecture.md

@@ -0,0 +1,69 @@
+# Subsystem: agent_session
+
+Runtime and resume record for a coding-agent session, across harnesses (Claude Code, Codex, Cursor) and across devices. An `agent_session` captures where a session's transcript lives, the git environment needed to reconstruct it, and (for autonomous swarm runs) the trigger and AAuth attribution. It is the resume-oriented sibling of the semantic `conversation`: `conversation` answers "what was discussed", `agent_session` answers "where is the transcript and how do I resume it".
+
+Neotoma owns the State Layer parts of this subsystem (the entity types, deterministic capture, durable transcript storage). The resume orchestration (materialize transcript, fetch git, recreate worktree, launch or re-dispatch) is Operational Layer work and lives in ateles, not here.
+
+## Entity model
+
+### `agent_session` (`category: agent_runtime`)
+
+- **Identity**: joint `canonical_name_fields: ["harness", "native_session_id"]` with `name_collision_policy: "reject"`. A native session id is only unique within its harness.
+- **`kind`**: `interactive` | `autonomous` | `subagent`.
+- **Runtime / git fields**: `cwd`, `repo`, `repo_remote_url`, `source_branch`, `branch`, `git_head_sha`, `worktree_path`, `origin_device`, `parent_session_id`. Paths and host are context only and are excluded from identity because they move and embed usernames.
+- **Activity**: `title`, `summary`, `model`, `status`, `message_count`, `created_at`, `last_activity_at`.
+- **Per-device app state**: `is_archived`, `auto_archive_exempt`, `is_pinned`, `is_bridged`, `bridge_session_ids`.
+- **Autonomous trigger and attribution block**: `trigger_kind`, `trigger_ref`, `dispatch_parent`, `aauth_sub`, `workflow_definition_ref`, `gate_name`. These are denormalized for discovery and filtering; the authoritative record stays in the linked orchestration entities (see below).
+- **`resume_command`**: literal harness-specific command to resume.
+
+### `session_transcript` (`category: agent_runtime`)
+
+The raw, lossless transcript artifact. Specialized asset type, modeled like `image_asset` and `audio_asset`: content-addressed bytes in the `sources` bucket at `{user_id}/{content_hash}`, surfaced via `retrieve_file_url`.
+
+- **Identity**: `canonical_name_fields: ["content_hash"]` (SHA-256 of the transcript bytes).
+- **Fields**: `source_id`, `mime_type`, `file_size`, `storage_url`, `harness`, `format` (`claude_code_jsonl` | `codex_rollout` | `cursor_sqlite`), `format_version`, `turn_count`, `transcript_kind` (`main` | `subagent`), `agent_session_id`.
+
+The raw transcript is the byte-exact resume artifact and the durable backup. The structured turns of the same session live separately in `conversation_message`. The two fidelities are complementary, not alternatives.
+
+## Relationship to existing entities
+
+`agent_session` links, it does not duplicate.
+
+- `agent_session` is `PART_OF` linked from a `conversation` (the semantic record already carries `session_id`, `client_name`/`harness`, and `repository_*`).
+- `agent_session` relates to its `session_transcript` (raw bytes) and to the `conversation_message` rows (structured turns).
+- For autonomous swarm runs, `agent_session` relates to the existing ateles orchestration entities rather than re-deriving them: `harness_event` (lifecycle plus `agent_sub` AAuth identity and `task_entity_id`), `participation_record` (gate dispatch and satisfaction), and the `agent_task` to `agent_attempt` to `agent_outcome` chain. The `agent_attempt` type already claims the alias `agent_run`, so `agent_session` deliberately does not introduce a competing run type; it is the per-session unifying record that the orchestration entities lacked.
+
+## Deterministic capture
+
+Capture does not depend on the model calling the MCP `store` tool. Neotoma already runs deterministic harness hooks (`claude-code-plugin`, `cursor-hooks`, `codex-hooks`, `opencode-plugin`, `claude-agent-sdk-adapter`) that record structured turns. This subsystem extends that path with:
+
+1. A raw-transcript tail in the Stop and SessionEnd hooks that reads transcript lines appended since a per-session offset cursor and appends the delta to a durable local queue, then exits fast with no synchronous Neotoma call.
+2. An async drainer that ships queued deltas to Neotoma: `storeRawContent` for the `session_transcript` blob plus the structured `conversation_message` rows. Idempotent via the JSONL `uuid` and `parentUuid` natural keys plus the offset cursor.
+3. A filesystem-watcher backstop for sessions whose harness has no hooks installed, or that die before Stop fires.
+
+A backfill scanner provides historical coverage and repair. The scanner reads `cwd` and `gitBranch` from the message lines of the transcript, not from line one (line one is a hook or summary event without `cwd`). Validation across 1288 desktop sessions showed reading only line one left `cwd` null on 91 percent of sessions; reading the message lines raised resolution to 99.5 percent.
+
+## Autonomous and swarm sessions
+
+The ateles swarm runs T2, T3, and T4 agents headlessly through `claude --print` subprocesses, with no interactive UI harness. These are still Claude Code sessions: they write standard JSONL transcripts under `~/.claude/projects` and fire the same hooks, because the daemon sets no `CLAUDE_CONFIG_DIR` override.
+
+Empirical hook firing under `--print` (60 sampled swarm sessions): `SessionStart` 60 of 60, `PostToolUse` 60 of 60, `Stop` 59 of 60 (the miss was a run killed mid-execution), `PreCompact` 1 of 60 (only on compaction), `UserPromptSubmit` 15 of 60. `UserPromptSubmit` is unreliable headlessly because the prompt is piped rather than interactively submitted, so capture reads the prompt and turns from the transcript, not from that hook. The roughly 2 percent of runs that die before `Stop`, plus daemon timeouts, are covered by the watcher and scanner backstops.
+
+Sub-agent runs spawned by the Task tool write their own nested `~/.claude/projects/<session>/subagents/*.jsonl` transcripts. These are modeled as child `agent_session` rows with `kind: subagent` and `parent_session_id` set, each with its own `session_transcript`.
+
+## Layer boundaries and invariants
+
+- State Layer only. No resume orchestration, dispatch logic, or scheduled runs live in Neotoma. Resume and re-dispatch live in ateles.
+- Immutability. The drainer writes via observations; corrections create new observations. Content-addressed transcript storage makes re-ingest of identical bytes a no-op.
+- Determinism. Entity and event ids are reproducible; the offset cursor and content hash make capture idempotent.
+- Schema-first. Behavior that varies by type is declared on the schema, not branched in code.
+
+## Resume fidelity ladder (ateles, Operational Layer)
+
+The `/resume-session` flow auto-selects the highest available tier; `--mode` can force one.
+
+1. **Native**: materialize the transcript from the `session_transcript` blob (or a reachable peer device), then `claude --resume` or `codex resume`. Exact fidelity, same session id.
+2. **Context injection**: start a fresh session in any harness and inject a reconstructed context block (summary plus the last N turns verbatim plus key entities), restoring model and effort from the `agent_session`. Portable, new session id.
+3. **Re-dispatch** (autonomous): re-fire the trigger or re-run the skill with the same task entity. Used for swarm runs, which have no UI to reopen. Builds on the existing ateles idempotent re-dispatch and gate-state recovery.
+
+Cross-harness transcript translation is intentionally not built.

package/dist/docs/subsystems/usage_digest.md

@@ -412,6 +412,132 @@ await emitUsageDigest(
 );
 ```
 
+## `/usage` HTTP API endpoint
+
+`GET /usage` is a separate, complementary surface that exposes **pre-aggregated dashboard metrics** computed on the fly from the live database. It is _not_ the same as querying `usage_digest` entities: the endpoint returns ephemeral per-request aggregates scoped to the authenticated user, while `usage_digest` entities are durable, periodic telemetry records submitted by external observers.
+
+### Purpose
+
+The endpoint powers the Neotoma Inspector dashboard (the summary tiles showing total entities, recent ingestion, and schema coverage). It can also be called directly by operators or agents that want a quick snapshot of their local deployment's current state without parsing raw entity records.
+
+### Endpoint
+
+```
+GET /usage
+```
+
+`operationId: getUsage` — declared in `openapi.yaml` and mapped in `src/shared/contract_mappings.ts` with `adapter: "cli"` (CLI-accessible via `neotoma request --operation getUsage`).
+
+### Authentication
+
+**Authentication is required.** All figures are scoped to the authenticated user.
+
+Supported auth methods (same as all other authenticated endpoints):
+
+| Method          | How to supply                                   |
+| --------------- | ----------------------------------------------- |
+| Bearer token    | `Authorization: Bearer <NEOTOMA_BEARER_TOKEN>`  |
+| AAuth grant     | Agent identity admitted via `X-AAuth-*` headers |
+| MCP OAuth token | Bearer token issued through MCP OAuth flow      |
+
+Guest principals cannot call this endpoint. A missing or invalid token returns `401 AUTH_REQUIRED`.
+
+Optional query parameter: `user_id` (UUID string). When supplied, the authenticated user's ID must match — useful for CLI tooling that passes its local user ID explicitly. AAuth-admitted agents cannot override `user_id` to a different user.
+
+### Response shape
+
+**`200 OK`** — `application/json` — `UsageStats` object:
+
+| Field                           | Type                     | Description                                                                                                                                                 |
+| ------------------------------- | ------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `entities_by_type`              | `Record<string, number>` | Count of active (non-merged) entities per `entity_type`, sorted by count descending.                                                                        |
+| `total_entities`                | `number`                 | Total active entities across all types.                                                                                                                     |
+| `observations_by_source`        | `Record<string, number>` | Count of observations grouped by `observation_source` value, sorted by count descending. Sources not present on any observation appear as `"unclassified"`. |
+| `total_observations`            | `number`                 | Total observation records for this user.                                                                                                                    |
+| `entities_created_last_7_days`  | `number`                 | Entities whose `created_at` timestamp falls within the last 7 days.                                                                                         |
+| `entities_created_last_30_days` | `number`                 | Entities whose `created_at` timestamp falls within the last 30 days.                                                                                        |
+| `entity_types_with_schema`      | `number`                 | Count of distinct `entity_type` values present in the entities table that also have an active entry in `schema_registry`.                                   |
+| `entity_types_total`            | `number`                 | Total distinct `entity_type` values present across all active entities for this user.                                                                       |
+| `last_updated`                  | `string` (ISO-8601)      | ISO timestamp generated at the moment the aggregates were computed. Reflects when the response was assembled, not a database watermark.                     |
+
+All figures are computed fresh on each request — there is no server-side cache. The `last_updated` timestamp reflects the time of the request, not a cache expiry.
+
+### Example
+
+**Request:**
+
+```http
+GET /usage HTTP/1.1
+Authorization: Bearer <NEOTOMA_BEARER_TOKEN>
+```
+
+**Response:**
+
+```json
+{
+  "entities_by_type": {
+    "conversation": 214,
+    "task": 156,
+    "contact": 88,
+    "harness_event": 42
+  },
+  "total_entities": 500,
+  "observations_by_source": {
+    "human": 310,
+    "llm_summary": 140,
+    "sensor": 50
+  },
+  "total_observations": 500,
+  "entities_created_last_7_days": 34,
+  "entities_created_last_30_days": 112,
+  "entity_types_with_schema": 6,
+  "entity_types_total": 10,
+  "last_updated": "2026-06-19T09:00:00.000Z"
+}
+```
+
+**curl example:**
+
+```bash
+curl -s \
+  -H "Authorization: Bearer $NEOTOMA_BEARER_TOKEN" \
+  http://localhost:3080/usage | jq .
+```
+
+### Error responses
+
+| Status | `error_code`      | Cause                                                                 |
+| ------ | ----------------- | --------------------------------------------------------------------- |
+| `401`  | `AUTH_REQUIRED`   | Missing or invalid Bearer token; guest principal attempted.           |
+| `403`  | `FORBIDDEN`       | Supplied `user_id` query param does not match the authenticated user. |
+| `500`  | `DB_QUERY_FAILED` | Database query failed; check server logs for `APIError:usage_stats`.  |
+
+### Inspector / dashboard consumption
+
+The Neotoma Inspector dashboard polls `GET /usage` on page load via React Query (`queryKey: ["usage"]`). The response drives the four summary tiles:
+
+- **Total entities** — `total_entities` with `entity_types_total` entity types as a subtitle.
+- **Total observations** — `total_observations`.
+- **New (7 days)** — `entities_created_last_7_days` with `entities_created_last_30_days` last 30 days as a subtitle.
+- **Schema coverage** — derived from `entity_types_with_schema` / `entity_types_total`.
+
+The dashboard does not poll on an interval; it refetches on manual navigation or page reload. There is no server-sent staleness header.
+
+### Distinction from `usage_digest` entities
+
+|                      | `GET /usage`                                          | `usage_digest` entities                                                |
+| -------------------- | ----------------------------------------------------- | ---------------------------------------------------------------------- |
+| **Durability**       | Ephemeral — computed on each request, not stored.     | Durable — persisted entities queryable over time.                      |
+| **Scope**            | Current live state for the authenticated user.        | Historical rollup for a bounded time window from an external observer. |
+| **Writer**           | Neotoma server, on each HTTP call.                    | External agent / observer daemon via `store` MCP operation.            |
+| **Auth**             | Requires authenticated user (Bearer / AAuth / OAuth). | Can accept guest `store` writes via `submit_only` guest policy.        |
+| **PII risk**         | No free-text fields; counts only.                     | Contains `friction_notes` / `notes` — redacted on ingest.              |
+| **Primary consumer** | Inspector dashboard, CLI operators.                   | Telemetry dashboards, cross-deployment trend analysis.                 |
+
+### OpenAPI reference
+
+The full schema for `UsageStats` and the `getUsage` operation are declared in `openapi.yaml`. The generated TypeScript types live in `src/shared/openapi_types.ts` under `components["schemas"]["UsageStats"]` and `operations["getUsage"]`.
+
 ## Related
 
 - [`daemon_report`](../../src/services/schema_definitions.ts) — per-incident anomaly reports; the drill-down companion to usage digests.
@@ -419,3 +545,4 @@ await emitUsageDigest(
 - [`guest_access_policy.md`](guest_access_policy.md) — configuring keyless write access for telemetry sinks.
 - [`aauth.md`](aauth.md) — issuing agent grants for authenticated digest submission.
 - [`subscriptions.md`](subscriptions.md) — subscribing to `UsageDigestClosed` timeline events for downstream alerting.
+- [`docs/api/rest_api.md`](../api/rest_api.md) — top-level REST API reference including the `/usage` endpoint entry.

package/dist/docs/testing/automated_test_catalog.md

@@ -27,7 +27,7 @@ This document does not cover:
 ## Definitions
 - **Automated test file**: A repo test source matched by this catalog's scanner (`tests/**`, `src/**`, `frontend/src/**`, `playwright/tests/**`).
 - **Catalog generator**: `scripts/generate-automated-test-catalog.ts`, the only source allowed to rewrite this file.
-- **Catalog validator**: `npm run validate:test-catalog`, which fails when this file drifts from the repo tree.
+- **Catalog validator**: `npm run validate:test-catalog`, which fails when this file drifts from the repo tree. It is the local, pre-PR advisory gate. CI does not use it: the baseline lane runs `npm run generate:test-catalog`, which renders this file rather than failing on drift, so a stale copy never blocks a pull request.
 
 ## Data models or schemas
 None.
@@ -52,8 +52,8 @@ flowchart TD
 
 ## Testing requirements
 - `npm run generate:test-catalog` must be run when automated test inventory changes.
-- `npm run validate:test-catalog` must pass before merge.
-- CI runs `npm run validate:test-catalog` in the baseline lane.
+- `npm run validate:test-catalog` should pass before merge, but does not block it.
+- CI runs `npm run generate:test-catalog` in the baseline lane, which renders this file rather than failing on drift.
 
 ## Maintenance
 - Canonical policy doc: `docs/testing/testing_standard.md`.
@@ -61,22 +61,22 @@ flowchart TD
 - Do not hand-edit suite inventory entries in this file. Update the generator or the repository tree, then regenerate.
 
 ## Repo-wide summary
-- Total automated test files: **582**
-- Backend and repo Vitest files: **547**
+- Total automated test files: **605**
+- Backend and repo Vitest files: **570**
 - Frontend Vitest files: **9**
 - Playwright spec files: **26**
 
 ### Suite counts
 | Suite | Files |
 |---|---:|
-| Vitest unit tests | 162 |
-| Vitest service tests | 43 |
-| Source-adjacent tests | 65 |
-| Vitest integration tests | 165 |
-| Vitest CLI tests | 77 |
-| Vitest contract tests | 15 |
-| Vitest security tests | 7 |
-| Vitest subscription tests | 5 |
+| Vitest unit tests | 166 |
+| Vitest service tests | 44 |
+| Source-adjacent tests | 66 |
+| Vitest integration tests | 172 |
+| Vitest CLI tests | 78 |
+| Vitest contract tests | 19 |
+| Vitest security tests | 9 |
+| Vitest subscription tests | 6 |
 | Vitest agent tests | 1 |
 | Vitest fixture tests | 1 |
 | Vitest helper tests | 1 |
@@ -84,8 +84,8 @@ flowchart TD
 | Frontend Vitest tests | 9 |
 | Playwright E2E tests | 22 |
 | Playwright Inspector E2E tests | 4 |
-| Tests Performance | 1 |
-| Tests Scripts | 3 |
+| Tests Performance | 2 |
+| Tests Scripts | 4 |
 
 ## Primary validation commands
 - `npm test`
@@ -97,7 +97,7 @@ flowchart TD
 - `npm run validate:doc-deps`
 
 ## CI lanes
-- Baseline CI runs `type-check`, `lint`, `lint:site-copy`, `npm test`, `validate:coverage`, `validate:test-catalog`, and `validate:doc-deps`.
+- Baseline CI runs `type-check`, `lint`, `lint:site-copy`, `npm test`, `validate:coverage`, `generate:test-catalog`, and `validate:doc-deps`.
 - Frontend CI runs `npm run test:frontend`.
 - Site/export CI runs route, locale, and export validation tasks.
 - Python SDK CI runs `pytest packages/client-python/tests/ -v` on Python 3.12.
@@ -109,7 +109,7 @@ flowchart TD
 **Runner:** `vitest`
 **Command:** `npm test -- tests/unit`
 **Requirements:** Basic `.env` if required by the module under test.
-**Files (162):**
+**Files (166):**
 - `tests/unit/aauth_admission.test.ts`
 - `tests/unit/aauth_attestation_apple_se.test.ts`
 - `tests/unit/aauth_attestation_revocation.test.ts`
@@ -152,6 +152,7 @@ flowchart TD
 - `tests/unit/config_data_dir_resolution.test.ts`
 - `tests/unit/config_db_backend.test.ts`
 - `tests/unit/config_sqlite_path.test.ts`
+- `tests/unit/config_trusted_callbacks.test.ts`
 - `tests/unit/content_field_store_warning.test.ts`
 - `tests/unit/conversation_schema_bootstrap.test.ts`
 - `tests/unit/conversation_session_uuid_bridge.test.ts`
@@ -181,6 +182,7 @@ flowchart TD
 - `tests/unit/external_actor_provenance.test.ts`
 - `tests/unit/features/FU-2026-Q3-aauth-inspector-attestation-viz/agent_badge_tier_icon.test.ts`
 - `tests/unit/field_constraints.test.ts`
+- `tests/unit/file_input_diagnostics.test.ts`
 - `tests/unit/github_issue_thread.test.ts`
 - `tests/unit/github_mirror_guidance.test.ts`
 - `tests/unit/github_pages_asset_paths.test.ts`
@@ -228,6 +230,7 @@ flowchart TD
 - `tests/unit/product_feedback_schema.test.ts`
 - `tests/unit/protected_entity_types.test.ts`
 - `tests/unit/pull_request_schema.test.ts`
+- `tests/unit/readiness_probe.test.ts`
 - `tests/unit/recover_json_array_string.test.ts`
 - `tests/unit/relationship_batch_schemas.test.ts`
 - `tests/unit/relationship_reducer.test.ts`
@@ -264,6 +267,7 @@ flowchart TD
 - `tests/unit/submit_issue_dx.test.ts`
 - `tests/unit/subscription_types.test.ts`
 - `tests/unit/substrate_event_bus.test.ts`
+- `tests/unit/test_prerequisites.test.ts`
 - `tests/unit/timeline_events.test.ts`
 - `tests/unit/timeline_query.test.ts`
 - `tests/unit/turn_summary_widget.test.ts`
@@ -278,7 +282,7 @@ flowchart TD
 **Runner:** `vitest`
 **Command:** `npm test -- tests/services`
 **Requirements:** Basic `.env` if required by the module under test.
-**Files (43):**
+**Files (44):**
 - `tests/services/auto_enhancement_converter_detection.test.ts`
 - `tests/services/auto_enhancement_processor.test.ts`
 - `tests/services/capability_registry.test.ts`
@@ -317,6 +321,7 @@ flowchart TD
 - `tests/services/schema_registry_bootstrap.test.ts`
 - `tests/services/schema_registry_incremental.test.ts`
 - `tests/services/schema_seeding_fresh_instance_gap.test.ts`
+- `tests/services/schema_seeding_preserves_custom_identity.test.ts`
 - `tests/services/session_seed_schema.test.ts`
 - `tests/services/summary.test.ts`
 - `tests/services/sync_issues_from_github.test.ts`
@@ -328,7 +333,7 @@ flowchart TD
 **Runner:** `vitest`
 **Command:** `npm test -- src`
 **Requirements:** Basic `.env` if required by the module under test.
-**Files (65):**
+**Files (66):**
 - `src/cli/parse_cli_corrected_value.test.ts`
 - `src/crypto/crypto.test.ts`
 - `src/proxy/mcp_stdio_proxy.test.ts`
@@ -382,6 +387,7 @@ flowchart TD
 - `src/services/plans/seed_schema.test.ts`
 - `src/services/rendered_page/conformance.test.ts`
 - `src/services/rendered_page/publish.test.ts`
+- `src/services/route_shadowing.test.ts`
 - `src/services/sync/peer_health.test.ts`
 - `src/shared/action_handlers/entity_handlers.test.ts`
 - `src/shared/action_schemas.test.ts`
@@ -400,7 +406,7 @@ flowchart TD
 **Runner:** `vitest`
 **Command:** `npm run test:integration` or `npx vitest run tests/integration`
 **Requirements:** Database configured; remote-dependent subsets additionally need `RUN_REMOTE_TESTS=1`.
-**Files (165):**
+**Files (172):**
 - `tests/integration/aauth_attribution_stamping.test.ts`
 - `tests/integration/aauth_mcp_capability_parity.test.ts`
 - `tests/integration/aauth_mcp_initialize_admission.test.ts`
@@ -417,6 +423,7 @@ flowchart TD
 - `tests/integration/agentic_eval_matrix.test.ts`
 - `tests/integration/agents_directory_api.test.ts`
 - `tests/integration/anonymous_write_policy.test.ts`
+- `tests/integration/attachment_resolution_equivalence.test.ts`
 - `tests/integration/attribution_parity.test.ts`
 - `tests/integration/auto_link_retraction_organization_change.test.ts`
 - `tests/integration/cli_init_bootstrap.test.ts`
@@ -434,6 +441,7 @@ flowchart TD
 - `tests/integration/csp_local_http.test.ts`
 - `tests/integration/cursor_hook_stop_backfill.test.ts`
 - `tests/integration/dashboard_stats.test.ts`
+- `tests/integration/db_abort_client_disconnect_survival.test.ts`
 - `tests/integration/describe_entity_type.test.ts`
 - `tests/integration/describe_instance_policy_auth.test.ts`
 - `tests/integration/docs_route.test.ts`
@@ -443,6 +451,7 @@ flowchart TD
 - `tests/integration/entity_queries_cursor.test.ts`
 - `tests/integration/entity_queries_status_column.test.ts`
 - `tests/integration/entity_queries.test.ts`
+- `tests/integration/entity_query_deleted_count.test.ts`
 - `tests/integration/entity_search_mode.test.ts`
 - `tests/integration/events_stream.test.ts`
 - `tests/integration/field_converters.test.ts`
@@ -484,9 +493,11 @@ flowchart TD
 - `tests/integration/mcp_graph_variations.test.ts`
 - `tests/integration/mcp_handler_cross_user_scoping.test.ts`
 - `tests/integration/mcp_invalid_bearer_auth.test.ts`
+- `tests/integration/mcp_list_relationships_entity_filters.test.ts`
 - `tests/integration/mcp_npm_check_update_capability_delta.test.ts`
 - `tests/integration/mcp_npm_check_update.test.ts`
 - `tests/integration/mcp_oauth_token_endpoint.test.ts`
+- `tests/integration/mcp_oauth_trusted_callback.test.ts`
 - `tests/integration/mcp_query_variations.test.ts`
 - `tests/integration/mcp_relationship_variations.test.ts`
 - `tests/integration/mcp_resource_variations.test.ts`
@@ -496,6 +507,7 @@ flowchart TD
 - `tests/integration/mcp_schema_variations.test.ts`
 - `tests/integration/mcp_session_404_reconnect.test.ts`
 - `tests/integration/mcp_stdio_attribution.test.ts`
+- `tests/integration/mcp_store_attribution_policy.test.ts`
 - `tests/integration/mcp_store_canonical_name_unknown_fields.test.ts`
 - `tests/integration/mcp_store_intra_batch_relationships.test.ts`
 - `tests/integration/mcp_store_parquet.test.ts`
@@ -536,6 +548,7 @@ flowchart TD
 - `tests/integration/seed_then_works_at_e2e.test.ts`
 - `tests/integration/session_introspection.test.ts`
 - `tests/integration/snapshot_ingestion_cutoff.test.ts`
+- `tests/integration/snapshot_seam_callers.test.ts`
 - `tests/integration/standing_rules_initialize_effect.test.ts`
 - `tests/integration/store_builtin_identity_opt_out_schemas.test.ts`
 - `tests/integration/store_canonical_name_recompute.test.ts`
@@ -572,7 +585,7 @@ flowchart TD
 **Runner:** `vitest`
 **Command:** `npm test -- tests/cli`
 **Requirements:** Basic `.env`; some tests provision temp config homes automatically.
-**Files (77):**
+**Files (78):**
 - `tests/cli/api_client_offline_fallback.test.ts`
 - `tests/cli/backup_verify.test.ts`
 - `tests/cli/cli_access_commands.test.ts`
@@ -628,6 +641,7 @@ flowchart TD
 - `tests/cli/discovery_codex_sessions.test.ts`
 - `tests/cli/discovery_harness.test.ts`
 - `tests/cli/extract_user_cli_args.test.ts`
+- `tests/cli/ingest_agent_sessions.test.ts`
 - `tests/cli/instance_scripts.test.ts`
 - `tests/cli/instance_skills_client.test.ts`
 - `tests/cli/instance_skills.test.ts`
@@ -656,19 +670,23 @@ flowchart TD
 **Runner:** `vitest`
 **Command:** `npm test -- tests/contract`
 **Requirements:** Generated contract artifacts present when the suite expects them.
-**Files (15):**
+**Files (19):**
 - `tests/contract/cli_handler_dist_smoke.test.ts`
 - `tests/contract/contract_mapping.test.ts`
 - `tests/contract/contract_mcp_cli_parity.test.ts`
+- `tests/contract/deploy_workflow_config.test.ts`
+- `tests/contract/fly_deploy_config.test.ts`
 - `tests/contract/get_entities_alias.test.ts`
 - `tests/contract/ironclaw_integration.test.ts`
 - `tests/contract/legacy_payloads/replay.test.ts`
+- `tests/contract/mcp_oauth_authorize_responses.test.ts`
 - `tests/contract/mcp_stdio_output_safety.test.ts`
 - `tests/contract/mcp_tool_dispatch_coverage.test.ts`
 - `tests/contract/openapi_schema.test.ts`
 - `tests/contract/openclaw_plugin.test.ts`
 - `tests/contract/package_contents.test.ts`
 - `tests/contract/package_scripts.test.ts`
+- `tests/contract/relationship_type_enum_parity.test.ts`
 - `tests/contract/sdk_client_store_shape.test.ts`
 - `tests/contract/update_schema_incremental_canonical_parity_2018.test.ts`
 - `tests/contract/vite_config.test.ts`
@@ -678,12 +696,14 @@ flowchart TD
 **Runner:** `vitest`
 **Command:** `npx vitest run tests/security`
 **Requirements:** Use alongside the dedicated security validation scripts when changing auth or route protection.
-**Files (7):**
+**Files (9):**
 - `tests/security/auth_topology_matrix.test.ts`
 - `tests/security/cross_user_read_scoping.test.ts`
 - `tests/security/ed25519_forged_key_auth_bypass.test.ts`
+- `tests/security/mcp_resource_tenant_isolation.test.ts`
 - `tests/security/rendered_page_csp.test.ts`
 - `tests/security/sandbox_mode_resolver.test.ts`
+- `tests/security/schemas_per_type_scope_guard.test.ts`
 - `tests/security/sort_by_sql_injection.test.ts`
 - `tests/security/tenant_isolation_matrix.test.ts`
 
@@ -692,9 +712,10 @@ flowchart TD
 **Runner:** `vitest`
 **Command:** `npx vitest run tests/subscriptions`
 **Requirements:** Basic `.env`; some tests start an in-process HTTP server.
-**Files (5):**
+**Files (6):**
 - `tests/subscriptions/durable_event_log.test.ts`
 - `tests/subscriptions/guest_write_rate_limit_routing.test.ts`
+- `tests/subscriptions/sse_hub_dead_client_eviction.test.ts`
 - `tests/subscriptions/sse_ring_gap_detection.test.ts`
 - `tests/subscriptions/subscription_guest_auth.test.ts`
 - `tests/subscriptions/subscription_loop_prevention.test.ts`
@@ -792,7 +813,8 @@ flowchart TD
 **Runner:** `vitest`
 **Command:** `npx vitest run tests/performance`
 **Requirements:** Basic `.env` if required by the module under test.
-**Files (1):**
+**Files (2):**
+- `tests/performance/entity_query_count.bench.test.ts`
 - `tests/performance/graph_traversal.bench.test.ts`
 
 ### Tests Scripts
@@ -800,8 +822,9 @@ flowchart TD
 **Runner:** `vitest`
 **Command:** `npx vitest run tests/scripts`
 **Requirements:** Basic `.env` if required by the module under test.
-**Files (3):**
+**Files (4):**
 - `tests/scripts/bundles_scaffold.test.ts`
+- `tests/scripts/generate_automated_test_catalog.test.ts`
 - `tests/scripts/launchd_cli_sync_tooling.test.ts`
 - `tests/scripts/validate_libsql_migration.test.ts`
 

package/dist/docs/testing/testing_standard.md

@@ -121,7 +121,7 @@ See `docs/testing/automated_test_catalog.md` for the canonical repo-wide invento
 - The catalog is generated by `npm run generate:test-catalog`.
 - When automated test files are added, removed, moved, or renamed, regenerate the catalog in the same change.
 - When test commands, CI lanes, or default-vs-optional execution modes change, update both the catalog and this policy doc in the same change.
-- `npm run validate:test-catalog` must pass before merge.
+- `npm run validate:test-catalog` should pass before merge, but does not block it: the baseline CI lane runs `npm run generate:test-catalog`, which renders the catalog rather than failing on drift.
 
 ## High-risk surface classes (mandatory coverage)
 

package/dist/middleware/aauth_admission.js

@@ -19,7 +19,7 @@ import { admitFromAAuthContext } from "../services/aauth_admission.js";
 import { getAAuthContextFromRequest } from "./aauth_verify.js";
 import { getRequestContext, runWithRequestContext } from "../services/request_context.js";
 /** Skip admission lookups on cheap public discovery endpoints. */
-const PUBLIC_DISCOVERY_PREFIXES = ["/.well-known/", "/health"];
+const PUBLIC_DISCOVERY_PREFIXES = ["/.well-known/", "/health", "/ready"];
 function isPublicDiscovery(req) {
     const path = req.path || req.url || "";
     return PUBLIC_DISCOVERY_PREFIXES.some((prefix) => path.startsWith(prefix));

package/dist/middleware/aauth_admission.js.map

@@ -1 +1 @@
-{"version":3,"file":"aauth_admission.js","sourceRoot":"","sources":["../../src/middleware/aauth_admission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAG1F,kEAAkE;AAClE,MAAM,yBAAyB,GAA0B,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;AAEtF,SAAS,iBAAiB,CAAC,GAAY;IACrC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;IACvC,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC/D,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAA+B,0BAA0B,CAAC,GAAG,CAAC,CAAC;QACxE,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,mEAAmE;YACnE,4DAA4D;YAC5D,gDAAgD;YAChD,MAAM,QAAQ,GAA0B;gBACtC,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,YAAY;aACrB,CAAC;YACF,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC9B,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;YAClC,qBAAqB,CACnB;gBACE,aAAa,EAAE,KAAK,EAAE,aAAa,IAAI,IAAI;gBAC3C,mBAAmB,EAAE,KAAK,EAAE,mBAAmB,IAAI,IAAI;gBACvD,cAAc,EAAE,QAAQ;aACzB,EACD,GAAG,EAAE;gBACH,IAAI,EAAE,CAAC;YACT,CAAC,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,KAAK,qBAAqB,CAAC,GAAG,CAAC;aAC5B,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;YACjB,MAAM,SAAS,GAA0B;gBACvC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,YAAY,EAAE,QAAQ,CAAC,YAAY;aACpC,CAAC;YACF,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC/B,IAAI,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;gBAC3C,GAAkD,CAAC,mBAAmB;oBACrE,SAAS,CAAC,OAAO,CAAC;YACtB,CAAC;YACD,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;YAClC,qBAAqB,CACnB;gBACE,aAAa,EAAE,KAAK,EAAE,aAAa,IAAI,IAAI;gBAC3C,mBAAmB,EAAE,KAAK,EAAE,mBAAmB,IAAI,IAAI;gBACvD,cAAc,EAAE,SAAS;aAC1B,EACD,GAAG,EAAE;gBACH,IAAI,EAAE,CAAC;YACT,CAAC,CACF,CAAC;QACJ,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,gEAAgE;YAChE,+DAA+D;YAC/D,8CAA8C;YAC9C,MAAM,QAAQ,GAA0B;gBACtC,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,UAAU;aACnB,CAAC;YACF,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC9B,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;YAClC,qBAAqB,CACnB;gBACE,aAAa,EAAE,KAAK,EAAE,aAAa,IAAI,IAAI;gBAC3C,mBAAmB,EAAE,KAAK,EAAE,mBAAmB,IAAI,IAAI;gBACvD,cAAc,EAAE,QAAQ;aACzB,EACD,GAAG,EAAE;gBACH,IAAI,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACrD,CAAC,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACP,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,GAAY,EAAE,SAAgC;IACnE,GAA4D,CAAC,cAAc,GAAG,SAAS,CAAC;AAC3F,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,4BAA4B,CAAC,GAAY;IACvD,OAAQ,GAA4D,CAAC,cAAc,IAAI,IAAI,CAAC;AAC9F,CAAC"}
+{"version":3,"file":"aauth_admission.js","sourceRoot":"","sources":["../../src/middleware/aauth_admission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAG1F,kEAAkE;AAClE,MAAM,yBAAyB,GAA0B,CAAC,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AAEhG,SAAS,iBAAiB,CAAC,GAAY;IACrC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;IACvC,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC/D,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAA+B,0BAA0B,CAAC,GAAG,CAAC,CAAC;QACxE,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,mEAAmE;YACnE,4DAA4D;YAC5D,gDAAgD;YAChD,MAAM,QAAQ,GAA0B;gBACtC,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,YAAY;aACrB,CAAC;YACF,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC9B,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;YAClC,qBAAqB,CACnB;gBACE,aAAa,EAAE,KAAK,EAAE,aAAa,IAAI,IAAI;gBAC3C,mBAAmB,EAAE,KAAK,EAAE,mBAAmB,IAAI,IAAI;gBACvD,cAAc,EAAE,QAAQ;aACzB,EACD,GAAG,EAAE;gBACH,IAAI,EAAE,CAAC;YACT,CAAC,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,KAAK,qBAAqB,CAAC,GAAG,CAAC;aAC5B,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;YACjB,MAAM,SAAS,GAA0B;gBACvC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,YAAY,EAAE,QAAQ,CAAC,YAAY;aACpC,CAAC;YACF,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC/B,IAAI,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;gBAC3C,GAAkD,CAAC,mBAAmB;oBACrE,SAAS,CAAC,OAAO,CAAC;YACtB,CAAC;YACD,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;YAClC,qBAAqB,CACnB;gBACE,aAAa,EAAE,KAAK,EAAE,aAAa,IAAI,IAAI;gBAC3C,mBAAmB,EAAE,KAAK,EAAE,mBAAmB,IAAI,IAAI;gBACvD,cAAc,EAAE,SAAS;aAC1B,EACD,GAAG,EAAE;gBACH,IAAI,EAAE,CAAC;YACT,CAAC,CACF,CAAC;QACJ,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,gEAAgE;YAChE,+DAA+D;YAC/D,8CAA8C;YAC9C,MAAM,QAAQ,GAA0B;gBACtC,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,UAAU;aACnB,CAAC;YACF,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC9B,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;YAClC,qBAAqB,CACnB;gBACE,aAAa,EAAE,KAAK,EAAE,aAAa,IAAI,IAAI;gBAC3C,mBAAmB,EAAE,KAAK,EAAE,mBAAmB,IAAI,IAAI;gBACvD,cAAc,EAAE,QAAQ;aACzB,EACD,GAAG,EAAE;gBACH,IAAI,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACrD,CAAC,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACP,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,GAAY,EAAE,SAAgC;IACnE,GAA4D,CAAC,cAAc,GAAG,SAAS,CAAC;AAC3F,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,4BAA4B,CAAC,GAAY;IACvD,OAAQ,GAA4D,CAAC,cAAc,IAAI,IAAI,CAAC;AAC9F,CAAC"}