[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_4737":4738,"_4739":62,"_4740":18,"_4741":18,"_4742":18,"_4743":62,"_4744":18,"_4745":18,"_4746":18,"_4747":18,"_4748":-5,"_4749":4750},"routes/s.$postId",{"_9":10,"_11":12,"_13":-7,"_14":-7,"_15":16,"_17":18,"_19":18,"_20":-5,"_21":22},"kind","post_with_profile","postWithProfile",{"_23":24,"_25":26},"messagingRoomId","referrer","imagegenOgImagePolicy","current_wide","preferIntrinsicAspectRatioForOgImage",false,"enforceRenderedOgImg","ogImageVariantOverride","defaultOgDescription","ChatGPT helps you get answers, find inspiration, and be more productive.","post",{"_45":46,"_47":48,"_49":-5,"_50":-5,"_51":-5,"_52":-5,"_53":54,"_55":56,"_38":57,"_58":59,"_60":18},"profile",{"_27":28,"_29":28,"_30":31,"_32":-5,"_33":-5,"_34":35,"_36":18,"_37":-5,"_38":-5,"_39":-5,"_40":18,"_41":-5,"_42":-5,"_43":-5,"_44":18},"user_id","anonymous","username","profile_picture_url","https://cdn.openai.com/sora/images/profile_placeholder_v4.png","profile_picture_id","is_default_profile_picture","follower_count",0,"is_following","display_name","permalink","can_cameo","verified","character_count","owner_profile","social_context","follows_you","id","cd_6a6ef6eb09288191bb027ac2a4b8eefe","posted_at",1785657067.036064,"text","og_title","og_description","og_image_variant","attachments",[68],"preview_image_url","https://ogimg.chatgpt.com/?postId=cd_6a6ef6eb09288191bb027ac2a4b8eefe","https://chatgpt.com/s/cd_6a6ef6eb09288191bb027ac2a4b8eefe","permissions",{"_61":62,"_63":18,"_64":18,"_65":62,"_66":67},"use_experimental_unfurl","can_read",true,"can_write","can_delete","can_remix","share_setting","public",{"_45":69,"_70":71,"_9":72,"_73":74,"_75":76,"_77":78,"_79":80,"_81":82,"_83":-5},"cd_6a6ef6eb09288191bb027ac2a4b8eefe-attachment-0","tags",[],"codex","task",{"_45":4696,"_123":4697,"_318":4698,"_4699":62,"_86":87,"_4700":18,"_4701":4702,"_281":18,"_4703":4704,"_4705":-5,"_4706":4707},"current_user_turn",{"_96":332,"_45":88,"_100":332,"_3056":4687,"_3058":4688,"_3060":3061,"_136":-5,"_123":3062},"current_assistant_turn",{"_96":97,"_45":87,"_98":-5,"_99":-5,"_100":97,"_101":3894,"_103":3895,"_105":106,"_107":-5,"_108":3896,"_110":3897,"_112":3898,"_114":3899,"_116":117,"_118":-5,"_119":120,"_121":3900,"_123":124,"_125":-5,"_126":127,"_128":3901,"_130":131,"_132":133,"_134":-5,"_135":-5,"_136":88,"_137":3902,"_139":3903,"_141":-5,"_142":18,"_143":144,"_145":-5},"current_diff_task_turn",{"_96":97,"_45":87,"_98":-5,"_99":-5,"_100":97,"_101":3101,"_103":3102,"_105":106,"_107":-5,"_108":3103,"_110":3104,"_112":3105,"_114":3106,"_116":117,"_118":-5,"_119":120,"_121":3107,"_123":124,"_125":-5,"_126":127,"_128":3108,"_130":131,"_132":133,"_134":-5,"_135":-5,"_136":88,"_137":3109,"_139":3110,"_141":-5,"_142":18,"_143":144,"_145":-5},"turns",{"_84":85,"_86":87},"example_task_info","turn_mapping",{"_88":89,"_87":90},"current_turn_id","task_e_6a6ef6e81b4083288e32635561c7f015~assttrn_e_6a6ef6e9a6e48328a3766a8cc3d4c4bf","task_e_6a6ef6e81b4083288e32635561c7f015~usertrn_e_6a6ef6e96764832883fd74ebd48efff7",{"_45":88,"_91":3054,"_93":3055,"_95":-5},{"_45":87,"_91":92,"_93":94,"_95":88},"turn",{"_96":97,"_45":87,"_98":-5,"_99":-5,"_100":97,"_101":102,"_103":104,"_105":106,"_107":-5,"_108":109,"_110":111,"_112":113,"_114":115,"_116":117,"_118":-5,"_119":120,"_121":122,"_123":124,"_125":-5,"_126":127,"_128":129,"_130":131,"_132":133,"_134":-5,"_135":-5,"_136":88,"_137":138,"_139":140,"_141":-5,"_142":18,"_143":144,"_145":-5},"children",[],"parent","type","assistant","sibling_turn_ids","attempt_placement","role","output_items",[1531,1532,1533],"child_turns",[],"conversation_id","None","error","latest_event",{"_1526":1527,"_49":1528,"_1529":1530},"worklog",{"_1500":1501},"app_server_events",{"_342":1499},"thread_events",{"_342":343},"turn_status","completed","cancellation_requested_at","pull_request_status","updated","pull_request_data",{"_310":311,"_301":312,"_313":314,"_315":62,"_316":18,"_317":18,"_318":319,"_320":321,"_322":273,"_323":131,"_324":325,"_326":327,"_328":329,"_330":-5,"_331":-5,"_332":333,"_334":335,"_336":337,"_338":339,"_340":35},"created_at",1785657065.652068,"internal_only_rollouts","environment_id","6a6e1c8baf688191ace7dc65106ab305","environment",{"_45":127,"_199":200,"_201":202,"_203":18,"_204":205,"_206":207,"_208":209,"_210":-5,"_211":212,"_213":18,"_214":215,"_216":205,"_217":205,"_218":219,"_220":221,"_222":223,"_224":-5,"_225":226,"_227":228,"_229":230,"_231":232,"_58":-5,"_123":233,"_234":235,"_236":237,"_238":239,"_240":18,"_241":18},"branch","feat/277-e2e-smoke","base_commit_sha","2d9dce375aa2646f9c6909480b14df9deed30174","branch_name","direct_push_pushed_commit_sha","previous_turn_id","logs",{"_137":179},"proxy_events",[146,147,148,149,150,151,152],"debug_metadata","discarded","model_version","gpt-5.6-sol","languages",{"_153":178,"_155":156,"_157":158,"_159":160,"_161":162,"_163":164,"_165":35,"_166":-5},{"_153":177,"_155":156,"_157":158,"_159":160,"_161":174,"_163":164,"_165":35,"_166":-5},{"_153":175,"_155":156,"_157":158,"_159":160,"_161":176,"_163":164,"_165":35,"_166":-5},{"_153":173,"_155":156,"_157":158,"_159":160,"_161":174,"_163":164,"_165":35,"_166":-5},{"_153":172,"_155":168,"_157":169,"_159":160,"_161":171,"_163":164,"_165":35,"_166":-5},{"_153":167,"_155":168,"_157":169,"_159":170,"_161":171,"_163":164,"_165":35,"_166":-5},{"_153":154,"_155":156,"_157":158,"_159":160,"_161":162,"_163":164,"_165":35,"_166":-5},"timestamp","2026-08-02T07:51:47.306294","decision","block","reason","internet is disabled","method","CONNECT","domain","github.com:443","protocol","HTTP/1.1","size","path","2026-08-02T07:51:16.552459","allow","checks passed","GET","chatgpt.com:18080","2026-08-02T07:51:16.492694","2026-08-02T07:51:14.488307","chatgpt.com:443","2026-08-02T07:51:14.433902","api.github.com:443","2026-08-02T07:51:14.356849","2026-08-02T07:51:14.316294",[180,181,182],{"_183":195,"_185":196},{"_183":191,"_185":192},{"_183":184,"_185":186},"key",{"_187":188,"_96":189,"_123":190},"value","file_00000000b8c881f78bbce283809712d4","name","setup_autodetect","UserSetupScript","2026-08-02T05:30:59.417045",{"_187":193,"_96":189,"_123":194},"file_00000000878c81f7b772f3085c8b7e8c","auto_setup","2026-08-02T05:31:10.237010",{"_187":197,"_96":189,"_123":198},"file_000000007a5881f7b015eb1c9afed88e","warm_up_git_repo_1785657070","2026-08-02T07:51:10.555358","machine_id","wham-public/wham-universal","label","mforce/cluckwork","is_pinned","description","","workspace_dir","/workspace","agent_network_access",{"_303":304,"_305":-5,"_306":-5,"_307":-5,"_308":-5,"_309":-5},"codex_github_direct","github_connector_id","connector_76869538009648d5b282a4bb21c3d157","enable_gitlab_webhooks","repos",[263],"setup","maintenance_setup","repo_map",{"_263":264},"env_vars",{"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":256,"_257":258,"_259":260,"_261":262},"secrets",{},"secrets_with_domains","task_count",87,"creator_id","user-VHrW1UUowIx0Xlc12knvUuzF","share_settings","workspace","share_targets",[],1785601164.145096,"auto_setup_settings",{"_244":62},"cache_settings",{"_242":62,"_243":205},"etag","\"67004ff1-0000-0200-0000-6a6ef6e70000\"","enable_authtranslator","enable_docker_in_docker","post_setup_cache_enabled","cache_invalidation_key","use_auto_setup","CODEX_ENV_PYTHON_VERSION","3.12","CODEX_ENV_NODE_VERSION","20","CODEX_ENV_RUBY_VERSION","3.4.4","CODEX_ENV_RUST_VERSION","1.89.0","CODEX_ENV_GO_VERSION","1.24.3","CODEX_ENV_BUN_VERSION","1.2.14","CODEX_ENV_PHP_VERSION","8.4","CODEX_ENV_JAVA_VERSION","21","CODEX_ENV_SWIFT_VERSION","6.1","github-1301193065",{"_45":265,"_187":266,"_267":268,"_269":202,"_270":271,"_272":273,"_274":275,"_276":277,"_278":279,"_280":67,"_281":18,"_282":-5,"_283":-5,"_284":-5,"_285":-5,"_286":-5,"_287":-5,"_165":288,"_289":-5,"_58":290},"1301193065","cluckwork","owner",{"_295":296,"_45":297,"_96":298,"_299":300,"_301":302},"repository_full_name","clone_url","https://github.com/mforce/cluckwork.git","default_branch","main","git_commits_url","https://api.github.com/repos/mforce/cluckwork/git/commits{/sha}","git_refs_url","https://api.github.com/repos/mforce/cluckwork/git/refs{/sha}","git_url","git://github.com/mforce/cluckwork.git","visibility","archived","allow_auto_merge","allow_merge_commit","allow_rebase_merge","allow_squash_merge","allow_update_branch","language",4894,"master_branch",{"_291":18,"_292":18,"_293":18,"_294":18},"admin","maintain","push","pull","login","mforce",3101827,"User","avatar_url","https://avatars.githubusercontent.com/u/3101827?v=4","url","https://api.github.com/users/mforce","mode","off","preset_allowlist","allowlist_domains","allowlist_rules","denylist_domains","safe_methods_only","number",390,"https://github.com/mforce/cluckwork/pull/390","state","closed","merged","mergeable","draft","title","test(e2e): Playwright smoke suite for the SPA over the #243 simulation fixture","body","Closes #385. First of three stacked slices from **#277**; #386 (canary) and #387 (CI) branch off this one.\n\n## What this is\n\nThe browser-side sibling of the #243 k6 harness. A standalone Playwright project at **`tools/simulation/ui/`** driving the **real built SPA** against the **same `seed --profile simulation` fixture**, so every screen under test is populated — 2 flocks, 181 daily entries across three lifecycle states, 528 egg lots, 17 sales orders, 90 days of history.\n\n**28 specs, green, ~32s.** One further spec (the real 15-minute token expiry) is opt-in behind `CLUCKWORK_E2E_SLOW=1`.\n\n## Verification\n\n```\nBASELINE : GREEN (28 passed, 1 skipped)\nMUTANTS : 7 killed, 0 survived\nRESTORE : GREEN\n```\n\n`npm run mutation` breaks a guarantee at the network boundary — the shape a real regression takes as seen from a browser — and requires the spec claiming to cover it to go red. The seven: `audit-gate-removed`, `users-gate-removed`, `flock-scope-removed`, `stock-summary-broken`, `report-range-bound-removed`, `refresh-always-fails`, `logout-not-honoured`. A red baseline **aborts** the run rather than continuing, because a mutation pass over an already-failing suite reads exactly like success.\n\nIts stated limit: it cannot mutate client-only logic, so the nav role-gate assertions are covered structurally (each has a positive control) rather than behaviourally.\n\n## Coverage\n\n**Personas** — Owner (dashboard → reports → audit → a real `/export` download, asserted as bytes on disk), Manager (creates a flock → submits its entry → adjusts → voids), Sales (new customer → draft order → line → confirm → payment, asserted by the *\"record payment\"* button being withdrawn), Worker (records on the assigned flock; refused on the unassigned one, with an unrestricted worker as the control), ReadOnly (browses what it may; **server-side refusal** on `/audit` and `/users` deep links, with no table rendered).\n\n**Cross-cutting** — the access token never reaching browser storage and the refresh cookie being HttpOnly (#145, asserted from both sides); refresh-and-retry without bouncing to `/login`; es/tl rendering across the shell plus ``; the PWA shell installing, taking control, surviving offline, and keeping `/api` + `/health` off the cached shell.\n\n**#310** — logout during an in-flight refresh cannot be resurrected (asserted three ways: still on `/login`, no live refresh cookie, and a protected route still refused); an explicit login beats a pending bootstrap refresh, asserted through the two personas' *different* nav gates so the winner is named rather than inferred.\n\n**#311** — both sides of `MaxRangeDays`. The largest accepted span renders and its latency is **recorded, not thresholded**; one day beyond is refused. Note the `>=`: the maximum accepted `to - from` is 365, not 366.\n\n## Three findings, filed rather than absorbed\n\n- **#388** — flock assignment is enforced on **writes** (`422 FlockScope.NotAssigned`) but on **no read path**: a restricted worker sees both flocks, either flock's detail, and another flock's 90 days of history, all `200`. #277's Worker premise (\"sees only assigned flocks\") is therefore not what the app does. The spec asserts the guarantee that exists and links to #388.\n- **#389** — `UsersPage` renders its load failure without `role=\"alert\"`, unlike every sibling screen, so a screen-reader user is refused in silence. The ReadOnly spec asserts the app's own `p.error` instead, so it tests authorization rather than failing for an accessibility reason.\n- A daily entry dated **before its flock's placement date** is accepted (`201`). Noted in the session report; not filed pending a call on whether that is intended.\n\n## Decisions worth knowing\n\n- **Location `tools/simulation/ui/`, not `web/`** (owner call): it consumes this harness's fixture and cast file, and the SPA's dependency tree and `npm audit` surface stay untouched.\n- **Browser resolution is portable and probed, not assumed.** NixOS cannot launch Playwright's downloaded binaries (bundled Firefox does not start at all); a system Chromium does. CI is the mirror image. `src/browser.ts` resolves override → system → downloaded, prints which it chose, and hard-fails an explicit path that is not executable rather than silently running something else.\n- **Selectors read the SPA's own en/es/tl catalogs.** A missing key throws instead of falling back to English — a silent fallback would let an es spec assert an English string and pass while proving nothing. The i18n spec additionally asserts its witness strings actually *differ* from English before using them (`nav:dashboard` really is \"Dashboard\" in both en and tl).\n- **Farm-local dates via `Intl`, mirroring `web/src/lib/dates.ts`.** The zone is read from `GET /account`, not hardcoded, so a retuned `Simulation__TimeZoneId` cannot leave a stale constant behind. k6 cannot do this — its runtime has no `Intl` — which is why `dates.js` settles for UTC-yesterday.\n- **`workers: 1`, `retries: 0`.** The specs share one mutable fixture, and a retry would hide exactly the intermittent failures this suite exists to surface.\n- **Preflight refuses** an unseeded stack or a stale `.sim-cast.json`, and says which. Without it a half-seeded database fails as *\"expected a table, found 'No stock recorded yet'\"* — which reads like a UI regression and sends people into `web/`.\n\n## Known gap, stated rather than implied\n\n**The PWA update prompt has no end-to-end coverage.** Rendering it needs a byte-different `sw.js` to install and park in `waiting`. Playwright intercepts the *initial* registration fetch but sees **no `sw.js` request at all** after `registration.update()` — measured in both directions, and not a caching artefact (`/sw.js` is served `no-cache` with an ETag). The logic is covered by `UpdatePrompt.test.tsx` and `registerServiceWorker.test.ts`; what is uncovered is the browser genuinely parking a second worker, which is the property `registerType: \"prompt\"` exists to guarantee. Recorded in `docs/superpowers/notes/277-decisions.md` with a reversal path.\n\n## Docs\n\n`tools/simulation/ui/README.md`, a pointer from `tools/simulation/README.md`, and an `AGENTS.md` bullet carrying the three load-bearing rules (no hardcoded credentials, no hardcoded English, respect the farm clock) plus the #370 warning — nothing runs this for you.\n\nNo user-visible behaviour changes, so `GLOSSARY.md` and the Help page are untouched.\n","base","head","base_sha","fa84b055a8ac34c5d579be9125e8eedeac646e33","head_sha","287d783bf4897c6ba3e9921cc7d5f2787a590959","merge_commit_sha","9d342430cf57d12fac35df117097b4bc378f21fb","comments","diff","user",{"_295":296,"_187":296,"_341":-5,"_299":300,"_45":297},"commits",13,"changed_files",27,"additions",4062,"deletions","email","events",[344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437,438,439,440,441,442,443,444,445,446,447,448,449,450,451,452,453,454,455,456,457,458,459,460,461,462,463,464,465,466,467,468,469],{"_159":1472,"_471":1473},{"_159":488,"_471":1467},{"_159":1462,"_471":1463},{"_159":492,"_471":1454},{"_159":492,"_471":1448},{"_159":492,"_471":1441},{"_159":492,"_471":1433},{"_159":492,"_471":1428},{"_159":510,"_471":1417},{"_159":510,"_471":1412},{"_159":492,"_471":1404},{"_159":492,"_471":1399},{"_159":510,"_471":1390},{"_159":492,"_471":1380},{"_159":510,"_471":1375},{"_159":492,"_471":1367},{"_159":492,"_471":1362},{"_159":510,"_471":1352},{"_159":492,"_471":1343},{"_159":510,"_471":1338},{"_159":492,"_471":1332},{"_159":492,"_471":1327},{"_159":510,"_471":1318},{"_159":492,"_471":1310},{"_159":510,"_471":1305},{"_159":492,"_471":1297},{"_159":492,"_471":1292},{"_159":510,"_471":1277},{"_159":492,"_471":1268},{"_159":492,"_471":1263},{"_159":510,"_471":1242},{"_159":492,"_471":1233},{"_159":510,"_471":1228},{"_159":492,"_471":1220},{"_159":492,"_471":1215},{"_159":510,"_471":1205},{"_159":492,"_471":1196},{"_159":510,"_471":1191},{"_159":492,"_471":1181},{"_159":492,"_471":1176},{"_159":510,"_471":1158},{"_159":492,"_471":1149},{"_159":510,"_471":1144},{"_159":492,"_471":1138},{"_159":492,"_471":1133},{"_159":510,"_471":1115},{"_159":492,"_471":1106},{"_159":510,"_471":1101},{"_159":492,"_471":1093},{"_159":492,"_471":1088},{"_159":510,"_471":1068},{"_159":492,"_471":1060},{"_159":510,"_471":1055},{"_159":492,"_471":1047},{"_159":492,"_471":1042},{"_159":510,"_471":1024},{"_159":492,"_471":1015},{"_159":510,"_471":1010},{"_159":492,"_471":1000},{"_159":492,"_471":995},{"_159":510,"_471":987},{"_159":492,"_471":979},{"_159":510,"_471":974},{"_159":492,"_471":966},{"_159":492,"_471":961},{"_159":492,"_471":951},{"_159":510,"_471":940},{"_159":510,"_471":935},{"_159":492,"_471":927},{"_159":492,"_471":922},{"_159":510,"_471":913},{"_159":492,"_471":905},{"_159":510,"_471":900},{"_159":492,"_471":892},{"_159":492,"_471":887},{"_159":492,"_471":882},{"_159":510,"_471":877},{"_159":492,"_471":871},{"_159":492,"_471":867},{"_159":492,"_471":863},{"_159":492,"_471":859},{"_159":492,"_471":855},{"_159":492,"_471":851},{"_159":492,"_471":847},{"_159":492,"_471":843},{"_159":492,"_471":838},{"_159":492,"_471":833},{"_159":492,"_471":823},{"_159":510,"_471":818},{"_159":492,"_471":810},{"_159":492,"_471":805},{"_159":510,"_471":794},{"_159":492,"_471":789},{"_159":510,"_471":778},{"_159":492,"_471":771},{"_159":492,"_471":759},{"_159":510,"_471":745},{"_159":510,"_471":740},{"_159":492,"_471":730},{"_159":492,"_471":725},{"_159":510,"_471":712},{"_159":492,"_471":702},{"_159":492,"_471":697},{"_159":510,"_471":688},{"_159":492,"_471":679},{"_159":510,"_471":674},{"_159":492,"_471":666},{"_159":492,"_471":661},{"_159":510,"_471":652},{"_159":492,"_471":641},{"_159":510,"_471":636},{"_159":492,"_471":627},{"_159":492,"_471":622},{"_159":492,"_471":613},{"_159":492,"_471":608},{"_159":510,"_471":584},{"_159":492,"_471":574},{"_159":510,"_471":569},{"_159":492,"_471":560},{"_159":492,"_471":551},{"_159":510,"_471":531},{"_159":492,"_471":516},{"_159":510,"_471":511},{"_159":492,"_471":493},{"_159":488,"_471":489},{"_159":470,"_471":472},"turn/completed","params",{"_473":474,"_91":475},"threadId","019fc174-a34d-7123-af3e-b2c6b25e0112",{"_476":477,"_478":479,"_107":-5,"_45":480,"_481":482,"_483":484,"_485":486,"_487":117},"completedAt",1785657311,"durationMs",236958,"019fc174-a410-7782-9270-3522c727a7b0","items",[],"itemsView","notLoaded","startedAt",1785657074,"status","thread/status/changed",{"_487":490,"_473":474},{"_96":491},"idle","rawResponseItem/completed",{"_494":495,"_473":474,"_496":480},"item",{"_497":498,"_499":-5,"_45":500,"_501":502,"_503":504,"_100":97,"_96":505},"turnId","content",[507],"end_turn","msg_0d4acabd15c76513016a6ef7d654488194af1e36bc205c766e","internal_chat_message_metadata_passthrough",{"_506":480},"phase","final_answer","message","turn_id",{"_49":508,"_96":509},"### Summary\n\n* Prevented an older bootstrap refresh from overwriting the refresh cookie created by a newer explicit login, with a unit assertion confirming the pending refresh is aborted. 【F:web/src/api/client.ts†L163-L178】【F:web/src/api/client.test.ts†L965-L984】\n* Strengthened the session-race browser test by reloading the SPA and verifying that the durable cookie restores the newer Sales session rather than the superseded Owner session. 【F:tools/simulation/ui/specs/session-races.spec.ts†L150-L160】\n* Restricted maximum-range performance samples to report responses containing the exact requested `from` and `to` parameters, preventing initial seven-day requests from satisfying the assertion. 【F:tools/simulation/ui/specs/reports-range.spec.ts†L45-L62】\n* Made language coverage require a successful persistence response and verify that the selected language survives a complete SPA reload. 【F:tools/simulation/ui/specs/i18n.spec.ts†L90-L122】\n* Committed the changes as `73d3769` and created PR metadata titled **“test(e2e): close durable session and assertion gaps.”**\n\n**Testing**\n\n* ✅ `cd web && npm run typecheck`\n* ✅ `git diff --check`\n* ✅ `git status --short --branch` (working tree clean after commit)\n* ⚠️ `cd web && npm test -- --run src/api/client.test.ts` (environment limitation: the available Node 20 runtime rejects Vitest’s configured `--no-experimental-webstorage` worker option)\n* ⚠️ `cd tools/simulation/ui && npm run typecheck` (environment limitation: the local dependency installation is missing the Node type definitions)","output_text","item/completed",{"_512":513,"_494":514,"_473":474,"_496":480},"completedAtMs",1785657311651,{"_45":500,"_503":504,"_49":508,"_96":515},"agentMessage",{"_494":517,"_473":474,"_496":480},{"_518":519,"_45":-5,"_501":520,"_187":-5,"_521":522,"_96":523},"call_id","call_iz5MghIJFYDQEqFOxTkwGnSo",{"_506":480},"output",{"_320":524,"_525":-5},"custom_tool_call_output",[526,527],"success",{"_49":530,"_96":529},{"_49":528,"_96":529}," 160\t }\n 161\t}\n 162\t\n 163\texport async function login(body: LoginRequest): Promise {\n 164\t // #310 — bump first: login is a NEWER session than anything already in\n 165\t // flight (a bootstrap refresh, say), so its resolution must be the one that\n 166\t // wins, and any earlier flight must see its captured generation go stale.\n 167\t const generation = ++sessionGeneration;\n 168\t // A bootstrap refresh can rotate the shared HttpOnly cookie even though its\n 169\t // JavaScript result is rejected by the generation check below. Cancel it\n 170\t // before starting the explicit login so its late Set-Cookie cannot overwrite\n 171\t // the cookie belonging to the session the user deliberately chose.\n 172\t abortInFlightRefresh?.();\n 173\t // The server sets the HttpOnly refresh cookie; the body returns only the\n 174\t // access token, which lives in memory for this tab's lifetime.\n 175\t const res = await raw(\"/auth/login\", {\n 176\t method: \"POST\",\n 177\t body: JSON.stringify(body),\n 178\t });\n 179\t // Superseded while in flight (e.g. a logout landed before this resolved) —\n 180\t // do not resurrect a session the user already ended. The response already\n 181\t // set a refresh cookie, so revoke it too, not just the in-memory token.\n 182\t if (sessionGeneration !== generation) {\n 183\t await revokeSupersededCookie();\n 184\t throw new StaleSessionError();\n 185\t }\n 965\t it(\"does not let a late bootstrap refresh overwrite a newer explicit login\", async () => {\n 966\t clearAccessToken();\n 967\t const refreshGate = deferred();\n 968\t fetchMock.mockImplementation((url: string) => {\n 969\t if (url.endsWith(\"/auth/refresh\")) return refreshGate.promise;\n 970\t if (url.endsWith(\"/auth/login\")) return Promise.resolve(accessResponse(\"newLoginToken\"));\n 971\t throw new Error(`unexpected fetch: ${url}`);\n 972\t });\n 973\t\n 974\t const restoring = restoreSession(); // older bootstrap refresh in flight\n 975\t await drain();\n 976\t\n 977\t await login({ email: \"a@b.co\", password: \"pw\" }); // a newer, explicit login completes first\n 978\t const bootstrapSignal = callsTo(fetchMock, \"/auth/refresh\")[0]?.[1]?.signal as AbortSignal;\n 979\t expect(bootstrapSignal.aborted).toBe(true);\n 980\t expect(getAccessToken()).toBe(\"newLoginToken\");\n 981\t expect(onTokens).toHaveBeenCalledTimes(1);\n 982\t\n 983\t refreshGate.resolve(accessResponse(\"staleBootstrapToken\")); // the old refresh answers late\n 984\t await expect(restoring).resolves.toBe(false); // discarded, not adopted\n 985\t\n 145\t ).toBeHidden();\n 146\t await expect(nav.link(\"nav:users\")).toBeHidden();\n 147\t await expect(nav.link(\"nav:expenses\")).toBeHidden();\n 148\t await expect(nav.link(\"nav:dailyEntry\")).toBeHidden();\n 149\t\n 150\t // Control: the Sales-shaped destinations ARE there, so the assertions above\n 151\t // are proving \"the Sales session won\" rather than \"the sidebar is empty\".\n 152\t await expect(nav.link(\"nav:sales\")).toBeVisible();\n 153\t await expect(nav.link(\"nav:customers\")).toBeVisible();\n 154\t\n 155\t // The browser applies Set-Cookie before client code can reject a stale\n 156\t // response. Reload to prove the durable cookie also belongs to Sales, not\n 157\t // merely the in-memory access token used by the assertions above.\n 158\t await page.reload();\n 159\t await expect(nav.link(\"nav:sales\")).toBeVisible();\n 160\t await expect(nav.link(\"nav:audit\")).toBeHidden();\n 161\t });\n 162\t});\n 45\t const to = farmToday(farm.timeZoneId);\n 46\t const from = daysBefore(to, LARGEST_ACCEPTED_SPAN);\n 47\t\n 48\t // Collect every report response the screen makes — ReportsPage fans out to\n 49\t // production, sales, expenses and profit, so a single waitForResponse would\n 50\t // time one of four and call it \"the\" latency.\n 51\t const timings: Array<{ path: string; status: number; ms: number }> = [];\n 52\t page.on(\"response\", (res) => {\n 53\t if (!REPORT_PATH.test(res.url())) return;\n 54\t const url = new URL(res.url());\n 55\t if (url.searchParams.get(\"from\") !== from || url.searchParams.get(\"to\") !== to) return;\n 56\t const t = res.request().timing();\n 57\t timings.push({\n 58\t path: url.pathname,\n 59\t status: res.status(),\n 60\t ms: Math.round(t.responseEnd),\n 61\t });\n 62\t });\n 63\t\n 64\t await page.goto(\"/reports\");\n 65\t await expect(page.getByRole(\"heading\", { name: tEn(\"reports:title\") })).toBeVisible();\n 66\t\n 67\t // Widen to the maximum. `to` first: `from`'s own `max` attribute is `to`, so\n 68\t // setting `from` to a far-past date while `to` is still the default would be\n 69\t // clamped by the browser and the spec would quietly test a 7-day window.\n 70\t //\n 84\t // possible starting state.\n 85\t await page.goto(\"/account\");\n 86\t const selector = languageSelect(page);\n 87\t await selector.selectOption(\"en\");\n 88\t await expect(page.getByRole(\"link\", { name: tEn(\"nav:reports\"), exact: true })).toBeVisible();\n 89\t\n 90\t // The switch, made the way a user makes it.\n 91\t const persisted = page.waitForResponse((response) =>\n 92\t response.url().includes(\"/api/v1/me/language\")\n 93\t && response.request().method() === \"PUT\",\n 94\t );\n 95\t await selector.selectOption(lang);\n 96\t expect((await persisted).ok(), `the ${lang} preference was not persisted`).toBe(true);\n 97\t\n 98\t // THE ASSERTION: the destination the user reads in the sidebar is now in\n 99\t // the new language. The sidebar is the right place to look because it is\n 100\t // rendered by a different component tree than the screen that owns the\n 101\t // selector — a switch that only repainted the current screen would pass a\n 102\t // narrower check and still be broken everywhere else.\n 103\t await expect(\n 104\t page.getByRole(\"link\", { name: t(lang, \"nav:reports\"), exact: true }),\n 105\t `the sidebar did not switch to ${lang}`,\n 106\t ).toBeVisible();\n 107\t await expect(page.getByRole(\"link\", { name: tEn(\"nav:reports\"), exact: true })).toBeHidden();\n 108\t\n 109\t // follows. This is a real accessibility guarantee, not\n 110\t // decoration: it is what tells a screen reader which voice to use, and\n 111\t // index.html ships a static \"en\" that a broken listener would leave in\n 112\t // place while the visible text changed underneath it.\n 113\t await expect(page.locator(\"html\")).toHaveAttribute(\"lang\", lang);\n 114\t\n 115\t // A local i18next change is optimistic. Reload so the preference must be\n 116\t // recovered from the server rather than surviving only in component\n 117\t // memory.\n 118\t await page.reload();\n 119\t await expect(page.locator(\"html\")).toHaveAttribute(\"lang\", lang);\n 120\t await expect(\n 121\t page.getByRole(\"link\", { name: t(lang, \"nav:reports\"), exact: true }),\n 122\t ).toBeVisible();\n 123\t\n 124\t // And the screens still WORK in that language — the point of #277's \"not\n 125\t // broken\", as opposed to \"translated\". A populated data screen renders its\n 126\t // table, not an error.\n 127\t await page.getByRole(\"link\", { name: t(lang, \"nav:reports\"), exact: true }).click();\n 128\t await expect(page.getByRole(\"heading\", { name: t(lang, \"reports:title\") })).toBeVisible();\n## work\n","input_text","Script completed\nWall time 0.2 seconds\nOutput:\n",{"_512":532,"_494":533,"_473":474,"_496":480},1785657297449,{"_534":528,"_535":536,"_537":538,"_539":540,"_478":35,"_541":35,"_45":542,"_543":544,"_545":546,"_487":117,"_96":547},"aggregatedOutput","command","/bin/bash -lc \"nl -ba web/src/api/client.ts | sed -n '160,185p'; nl -ba web/src/api/client.test.ts | sed -n '965,985p'; nl -ba tools/simulation/ui/specs/session-races.spec.ts | sed -n '145,170p'; nl -ba tools/simulation/ui/specs/reports-range.spec.ts | sed -n '45,70p'; nl -ba tools/simulation/ui/specs/i18n.spec.ts | sed -n '84,128p'; git status --short --branch\"","commandActions",[548],"cwd","/workspace/cluckwork","exitCode","exec-290ec98f-8ee1-4947-83cf-03ff124bc12d","processId","87947","source","unifiedExecStartup","commandExecution",{"_535":549,"_96":550},"nl -ba web/src/api/client.ts | sed -n '160,185p'; nl -ba web/src/api/client.test.ts | sed -n '965,985p'; nl -ba tools/simulation/ui/specs/session-races.spec.ts | sed -n '145,170p'; nl -ba tools/simulation/ui/specs/reports-range.spec.ts | sed -n '45,70p'; nl -ba tools/simulation/ui/specs/i18n.spec.ts | sed -n '84,128p'; git status --short --branch","unknown",{"_494":552,"_473":474,"_496":480},{"_518":519,"_45":553,"_554":555,"_501":556,"_187":557,"_558":-5,"_487":117,"_96":559},"ctc_0d4acabd15c76513016a6ef7cd717c81948275e28621a73c77","input","const r = await tools.exec_command({cmd:\"nl -ba web/src/api/client.ts | sed -n '160,185p'; nl -ba web/src/api/client.test.ts | sed -n '965,985p'; nl -ba tools/simulation/ui/specs/session-races.spec.ts | sed -n '145,170p'; nl -ba tools/simulation/ui/specs/reports-range.spec.ts | sed -n '45,70p'; nl -ba tools/simulation/ui/specs/i18n.spec.ts | sed -n '84,128p'; git status --short --branch\",\"workdir\":\"/workspace/cluckwork\",\"yield_time_ms\":10000,\"max_output_tokens\":12000}); text(r.output)\n",{"_506":480},"exec","namespace","custom_tool_call",{"_494":561,"_473":474,"_496":480},{"_497":-5,"_562":563,"_45":564,"_501":565,"_566":567,"_96":568},"encrypted_content","gAAAAABqbvfN8Lv6_emcgEiQ7NmI8o_QpDkF6kiQqQjpbcrf1Ith_T5w_vWcQHwWO6ukx90iEXD9G7IwRFPqTO-lq_zOFxHr4j--Iu_6nSp5HlWibcWIODxueqjOMCRQoKKI8zZv1NE2F1f8boMIww70kklaIFsuE5gD9aQypMwoaGgrUQCoD0UD8EXMAS_nEwArS7_EDNdafvh86TWTg-X-6kBfI3aIKlm5rv9nFaathaxIGWt--MPCpImfUcdmYiZczjHlRze-1nlKCEpPgWtmCWkDUjaA2k6H4ogMH4uPIok1cZ8WKI_14_9H9TkVCusMStyBBAViBkEOINXS8m7dObCQmQGQdHSa-8k5JICXq3u9fm_17-fOD3fWQlwNguX2l495IeIUfcizM28mcxzBENHfNytZfIXfi_B-y83dXuF7Tjhrw0YXGUxAFFK2gzLLSFCI2YaReioZGJTi1X_M7OAjZhEiNOA5A2ol5vfD0cpxsKmSBypiuJ0KR4c6sQ8-zFtdeo1MKn3pIf8s8HbS2x4mnUq8LJ683EIML6wc8CZ9wTAMI5bim4qeZtvrYCCOc-eusbgw7KnK9N-xjp7tqXRANTKd0_Gdwd2v3u-2obwXeCdwew3KB4moQYyfx5zY3w2PHh67EUUYxFR97abQo77DPAxOWz6I6rXR-GcwTckGea1MG_aytoKNxAdk4tpPU2s5NDI4zp615xjhR1j-cVnbldlm2eaJpJertCJAuJUskj5qMWuIbm7l1s5dzYOSI5G8E0A3XczEYLsz82O1_xSJTzp29RwsgS7C2REi31m_ySvpfo43HO93ecXAlDfJ_YAyvHLJvfNi7148mMpHTApyu2PqA1J8BLAYuyrnXarUI4-dAMkM5pk1aHn9GspPaOAnGUb_gk8eloyASuPwJsJagctwuSJla1uTvx9MdJdIQ56ssO_Mi0E5ED5Yuz7HuTbY3iU2r7hwRnWF40yp0xerpBh8pg==","rs_0d4acabd15c76513016a6ef7cd07248194b39ae17b83778424",{"_506":480},"summary",[],"reasoning",{"_512":570,"_494":571,"_473":474,"_496":480},1785657293468,{"_497":572,"_45":564,"_566":573,"_96":568},[],[],{"_494":575,"_473":474,"_496":480},{"_518":576,"_45":-5,"_501":577,"_187":-5,"_521":578,"_96":523},"call_LgKT2rm4AGODKFGrM19r4HKP",{"_506":480},{"_320":579,"_525":-5},[580,581],{"_49":583,"_96":529},{"_49":582,"_96":529},"{\n \"title\": \"test(e2e): close durable session and assertion gaps\",\n \"body\": \"## Summary\\n\\nFollow-up changes on top of the E2E smoke PR review:\\n\\n- abort an older bootstrap refresh when an explicit login begins, preventing its late `Set-Cookie` from replacing the newly selected session\\n- verify the session winner survives a full SPA reload\\n- scope maximum-range timing samples to responses carrying the requested `from`/`to` values\\n- require language persistence to return successfully and survive reload\\n- add a unit assertion for bootstrap-refresh cancellation\\n\\n## Testing\\n\\n- `cd web && npm run typecheck`\\n- `git diff --check`\\n- `cd web && npm test -- --run src/api/client.test.ts` *(environment limitation: Node 20 rejects the configured `--no-experimental-webstorage` worker option)*\\n- `cd tools/simulation/ui && npm run typecheck` *(environment limitation: local install lacks the Node type definitions)*\"\n}","Script completed\nWall time 0.0 seconds\nOutput:\n",{"_512":585,"_494":586,"_473":474,"_496":480},1785657290885,{"_587":-5,"_588":589,"_478":590,"_107":-5,"_45":591,"_592":-5,"_593":-5,"_594":-5,"_595":596,"_597":598,"_487":117,"_599":598,"_96":600},"appContext","arguments",{"_318":605,"_320":606},8,"exec-d9111840-a8dd-41cc-ae21-bee6ac8cda2c","mcpAppResourceUri","pluginId","readOnlyHint","result",{"_601":-5,"_497":602,"_603":604},"server","make_pr","tool","mcpToolCall","_meta",[607],"structuredContent",{"_318":605,"_320":606},"test(e2e): close durable session and assertion gaps","## Summary\n\nFollow-up changes on top of the E2E smoke PR review:\n\n- abort an older bootstrap refresh when an explicit login begins, preventing its late `Set-Cookie` from replacing the newly selected session\n- verify the session winner survives a full SPA reload\n- scope maximum-range timing samples to responses carrying the requested `from`/`to` values\n- require language persistence to return successfully and survive reload\n- add a unit assertion for bootstrap-refresh cancellation\n\n## Testing\n\n- `cd web && npm run typecheck`\n- `git diff --check`\n- `cd web && npm test -- --run src/api/client.test.ts` *(environment limitation: Node 20 rejects the configured `--no-experimental-webstorage` worker option)*\n- `cd tools/simulation/ui && npm run typecheck` *(environment limitation: local install lacks the Node type definitions)*",{"_96":49,"_49":582},{"_494":609,"_473":474,"_496":480},{"_518":576,"_45":610,"_554":611,"_501":612,"_187":557,"_558":-5,"_487":117,"_96":559},"ctc_0d4acabd15c76513016a6ef7c4a7cc81949341b4faa56a4e78","const r = await tools.mcp__make_pr__make_pr({title:\"test(e2e): close durable session and assertion gaps\",\"body\":\"## Summary\\n\\nFollow-up changes on top of the E2E smoke PR review:\\n\\n- abort an older bootstrap refresh when an explicit login begins, preventing its late `Set-Cookie` from replacing the newly selected session\\n- verify the session winner survives a full SPA reload\\n- scope maximum-range timing samples to responses carrying the requested `from`/`to` values\\n- require language persistence to return successfully and survive reload\\n- add a unit assertion for bootstrap-refresh cancellation\\n\\n## Testing\\n\\n- `cd web && npm run typecheck`\\n- `git diff --check`\\n- `cd web && npm test -- --run src/api/client.test.ts` *(environment limitation: Node 20 rejects the configured `--no-experimental-webstorage` worker option)*\\n- `cd tools/simulation/ui && npm run typecheck` *(environment limitation: local install lacks the Node type definitions)*\"}); for (const c of (r?.content ?? [])) { if (c.type === \"text\") text(c.text); }\n",{"_506":480},{"_494":614,"_473":474,"_496":480},{"_518":615,"_45":-5,"_501":616,"_187":-5,"_521":617,"_96":523},"call_RyIxIl6PEEmzCjXar3g77t44",{"_506":480},{"_320":618,"_525":-5},[619,620],{"_49":583,"_96":529},{"_49":621,"_96":529},"[{\"name\":\"mcp__make_pr__make_pr\",\"description\":\"Simple MCP server providing a make_pr tool for preparing pull request metadata.\\n\\nRecord a pull request title and body.\\ntitle: Title of the pull request\\nbody: Body message of the pull request\\n\\nexec tool declaration:\\n```ts\\ndeclare const tools: { mcp__make_pr__make_pr(args: { body: string; title: string; }): Promise>; };\\n```\"}]",{"_494":623,"_473":474,"_496":480},{"_518":615,"_45":624,"_554":625,"_501":626,"_187":557,"_558":-5,"_487":117,"_96":559},"ctc_0d4acabd15c76513016a6ef7c31f5081948e20b016d0607528","const matches = ALL_TOOLS.filter(x => x.name.includes(\"make_pr\")); text(matches);\n",{"_506":480},{"_494":628,"_473":474,"_496":480},{"_497":-5,"_562":629,"_45":630,"_501":631,"_566":632,"_96":568},"gAAAAABqbvfDpu-fC2kMZ3g8Chj-A3DKalPvz6eegbjrZSsR0kJYZ0U6Jwghoo0u6jHa4B6hp0_h7LAM3OS6c9U12wCYoGCtAhdLGZo0rbCO0lK4SAp4Eow4v_FJQ81VFhYoPcR2_vLSyqXCtGesJGKafLersFOrMgGoGs9YEVEF00jKlEM2COgUymC8f4RrdI-zDEzr3j0E7LeATx6acDKjRobj5FZYuQdYGYSfTIwMFG6hzXRNcga_JTOl7cQpQ6MT7WWIhOXibGdUUxBsaID8mcLe4xfu9pb6v25KEBdYvn7T09cQocInj_PMQl-lbIX8w5N_mjtYWXt6eOUWOFJJs96NGUGR41U0fwcpgbrXtkYhdjskPFFPWFHPy4bUvees_42V-zxGVeNjZBcH-51IstEAn_OkGsWNxXVhLiFruXpdjkOm6MN4f9Hwd_MaC9KzX0MNybOmCLiz88Y2zHrwkK4orS9_uD_y2Mv16acn48Df8ZYUrXRJ5c6A6YEp3jgM2gGp-rMEQDivsZQ7r3fW-fIcn47X9GA0nTg-NjJyM0HJd7VbhT-w83Zb73GqWLwV6YeZ-4wNkR2B2hRIAP40LS0CC6U5Nod9VGJx8QuKQzcZNfXi8HBQ3iV8zslQoqGqP_aI-6pm4XN_qXUgKSrcr0VE4Ch13TLX-4io7LlGztE19WY3cshtkJ4Y2PmHOyI0lestUnS8cLZAB-LQasqmcQa5UaWkA4RmM0UmbpMl5Ua119NR0lPs1HHpMl9w_XaFCFCJ6gP7Y4vWxJfnhD3_6EEdcZKm0hMnzOXJFZ2WLtDDWzO2G-JnQ7NplFWjmMlv9DxTCzevVG8_yQQRwGyXXwI82JOpUvhKEpjKgeQYgtWkLz8X_d2gh0ZmGigs2aF5KBT7WCQC2yfbCs-nQspDysxgeZvNOsJBC2Uc_1mWX6Rs9liaas88E7LQA7_T-UJKWaxDV4lZ","rs_0d4acabd15c76513016a6ef7c290288194af197810621ab178",{"_506":480},[633],{"_49":634,"_96":635},"**Planning pull request creation**","summary_text",{"_512":637,"_494":638,"_473":474,"_496":480},1785657283149,{"_497":639,"_45":630,"_566":640,"_96":568},[],[634],{"_494":642,"_473":474,"_496":480},{"_518":643,"_45":-5,"_501":644,"_187":-5,"_521":645,"_96":523},"call_DcaRWjbGqXI6Ls9tTxeJFF7C",{"_506":480},{"_320":646,"_525":-5},[647,648,649],{"_49":530,"_96":529},{"_49":651,"_96":529},{"_49":650,"_96":529},"EXIT:0","[work 73d3769] test(e2e): close durable session and assertion gaps\n 5 files changed, 31 insertions(+), 1 deletion(-)\n",{"_512":653,"_494":654,"_473":474,"_496":480},1785657280877,{"_534":651,"_535":655,"_537":656,"_539":540,"_478":35,"_541":35,"_45":657,"_543":658,"_545":546,"_487":117,"_96":547},"/bin/bash -lc 'git add tools/simulation/ui/specs/i18n.spec.ts tools/simulation/ui/specs/reports-range.spec.ts tools/simulation/ui/specs/session-races.spec.ts web/src/api/client.ts web/src/api/client.test.ts && git commit -m \"test(e2e): close durable session and assertion gaps\"'",[659],"exec-54ffbe9a-efa9-413a-a66c-eb70a5732701","55624",{"_535":660,"_96":550},"git add tools/simulation/ui/specs/i18n.spec.ts tools/simulation/ui/specs/reports-range.spec.ts tools/simulation/ui/specs/session-races.spec.ts web/src/api/client.ts web/src/api/client.test.ts && git commit -m \"test(e2e): close durable session and assertion gaps\"",{"_494":662,"_473":474,"_496":480},{"_518":643,"_45":663,"_554":664,"_501":665,"_187":557,"_558":-5,"_487":117,"_96":559},"ctc_0d4acabd15c76513016a6ef7bf1e008194bd77d1182430099c","const r = await tools.exec_command({cmd:\"git add tools/simulation/ui/specs/i18n.spec.ts tools/simulation/ui/specs/reports-range.spec.ts tools/simulation/ui/specs/session-races.spec.ts web/src/api/client.ts web/src/api/client.test.ts && git commit -m \\\"test(e2e): close durable session and assertion gaps\\\"\",\"workdir\":\"/workspace/cluckwork\",\"yield_time_ms\":30000,\"max_output_tokens\":20000}); text(r.output); text(`EXIT:${r.exit_code}`)\n",{"_506":480},{"_494":667,"_473":474,"_496":480},{"_497":-5,"_562":668,"_45":669,"_501":670,"_566":671,"_96":568},"gAAAAABqbve_0C1RxRCb3r3njKlC_Nr6XWjKDBTNkEmWvlUHZOhcVbe5PllT5WxTgEVXEEXSJE0X__D-sv3amdrvWkuDj3uDSK4GIe4zd4mXhzNjb34xMyQsEPcrFbgWpwBvXCXZ1Lz8CutaIjMrYSJjj71WQig5tqDd-xVGs-ALgqYiIsSI9r5FrvcKxxjzTo_c5tANvX5zUzOgrL8wPAnErG_E4S8UMAd2yx_vEyB0OBgzgxN1NFLEoXaq4L0R-rw1T6XazB0v3YGpaKL2SAx9jBJxACyhqb8QlN2dVFtdpNcY4lshJtL-gq5rJ-oyKeFMZjS6Inb2AHaJTaIqdLVV7V_5rBSzC5WikXrTaFGNFBj7dg4fexAzkVkn8-jLFQfvO_ZurdoLaOk3ozKBuLftTT55MM1gKNkzcgSegUqkt-ouccVOdlS64sQmRvRjHOc0ZapXYYu_NBAnuKZ250s2yljsN7FbEf7E-Qlqwtxt0-JHpt2ib1Ncn7YqzjvyFFNYYy6YlqiUi9m3zyVFMj9G87YXE7cSq44hm8D8JwIDr-knXnmeiNPsP4ZE6RZ086N5XrZtALsQOzPE4eRR6jq5VLe5dKYLCt5lrMjeFGD25A3CJWKxLla6vwnUIgKHTLXteMW92-icpBQVBi-krzo4_1pbpxYqdxKYKAxkwTn3v4EGrQaUVYqWR3G9H2NQb9hKeTcrTwiqBBQPpUJQ1rXHjaaAvGfGNKINohQTIyZnRg0kjIj_4U5YqqdWPC-v7teYRsSadwJ89CZyI_ioAGFFL3Rt7pNnVNH6Wwr9zL386AGiXXCf-oLdRguWlvxO6HTYlgGVolMaRMYoCca4mmrwP5HZsN4urovRYJKLFJGxtKqKyxD20Oq3Yl9jtKBofCzj6DVBBIXgSkNTcHK3VaGgQMnSTnkt8Y8XPZPqgzpVdOHfpXyv3jM=","rs_0d4acabd15c76513016a6ef7be69a481948c5cd9c9f8052e54",{"_506":480},[672],{"_49":673,"_96":635},"**Committing changes**",{"_512":675,"_494":676,"_473":474,"_496":480},1785657279142,{"_497":677,"_45":669,"_566":678,"_96":568},[],[673],{"_494":680,"_473":474,"_496":480},{"_518":681,"_45":-5,"_501":682,"_187":-5,"_521":683,"_96":523},"call_2mkBdhixOtQBftyWqYJfRHLN",{"_506":480},{"_320":684,"_525":-5},[685,686],{"_49":530,"_96":529},{"_49":687,"_96":529}," tools/simulation/ui/specs/i18n.spec.ts | 14 ++++++++++++++\n tools/simulation/ui/specs/reports-range.spec.ts | 4 +++-\n tools/simulation/ui/specs/session-races.spec.ts | 7 +++++++\n web/src/api/client.test.ts | 2 ++\n web/src/api/client.ts | 5 +++++\n 5 files changed, 31 insertions(+), 1 deletion(-)\ndiff --git a/tools/simulation/ui/specs/i18n.spec.ts b/tools/simulation/ui/specs/i18n.spec.ts\nindex d175635..a34e51d 100644\n--- a/tools/simulation/ui/specs/i18n.spec.ts\n+++ b/tools/simulation/ui/specs/i18n.spec.ts\n@@ -88,7 +88,12 @@ test.describe(\"i18n\", () => {\n await expect(page.getByRole(\"link\", { name: tEn(\"nav:reports\"), exact: true })).toBeVisible();\n \n // The switch, made the way a user makes it.\n+ const persisted = page.waitForResponse((response) =>\n+ response.url().includes(\"/api/v1/me/language\")\n+ && response.request().method() === \"PUT\",\n+ );\n await selector.selectOption(lang);\n+ expect((await persisted).ok(), `the ${lang} preference was not persisted`).toBe(true);\n \n // THE ASSERTION: the destination the user reads in the sidebar is now in\n // the new language. The sidebar is the right place to look because it is\n@@ -107,6 +112,15 @@ test.describe(\"i18n\", () => {\n // place while the visible text changed underneath it.\n await expect(page.locator(\"html\")).toHaveAttribute(\"lang\", lang);\n \n+ // A local i18next change is optimistic. Reload so the preference must be\n+ // recovered from the server rather than surviving only in component\n+ // memory.\n+ await page.reload();\n+ await expect(page.locator(\"html\")).toHaveAttribute(\"lang\", lang);\n+ await expect(\n+ page.getByRole(\"link\", { name: t(lang, \"nav:reports\"), exact: true }),\n+ ).toBeVisible();\n+\n // And the screens still WORK in that language — the point of #277's \"not\n // broken\", as opposed to \"translated\". A populated data screen renders its\n // table, not an error.\ndiff --git a/tools/simulation/ui/specs/reports-range.spec.ts b/tools/simulation/ui/specs/reports-range.spec.ts\nindex ab4cf9d..1377f77 100644\n--- a/tools/simulation/ui/specs/reports-range.spec.ts\n+++ b/tools/simulation/ui/specs/reports-range.spec.ts\n@@ -51,9 +51,11 @@ test.describe(\"#311 report range\", () => {\n const timings: Array<{ path: string; status: number; ms: number }> = [];\n page.on(\"response\", (res) => {\n if (!REPORT_PATH.test(res.url())) return;\n+ const url = new URL(res.url());\n+ if (url.searchParams.get(\"from\") !== from || url.searchParams.get(\"to\") !== to) return;\n const t = res.request().timing();\n timings.push({\n- path: new URL(res.url()).pathname,\n+ path: url.pathname,\n status: res.status(),\n ms: Math.round(t.responseEnd),\n });\ndiff --git a/tools/simulation/ui/specs/session-races.spec.ts b/tools/simulation/ui/specs/session-races.spec.ts\nindex 5486831..9e821b1 100644\n--- a/tools/simulation/ui/specs/session-races.spec.ts\n+++ b/tools/simulation/ui/specs/session-races.spec.ts\n@@ -151,5 +151,12 @@ test.describe(\"#310 session races\", () => {\n // are proving \"the Sales session won\" rather than \"the sidebar is empty\".\n await expect(nav.link(\"nav:sales\")).toBeVisible();\n await expect(nav.link(\"nav:customers\")).toBeVisible();\n+\n+ // The browser applies Set-Cookie before client code can reject a stale\n+ // response. Reload to prove the durable cookie also belongs to Sales, not\n+ // merely the in-memory access token used by the assertions above.\n+ await page.reload();\n+ await expect(nav.link(\"nav:sales\")).toBeVisible();\n+ await expect(nav.link(\"nav:audit\")).toBeHidden();\n });\n });\ndiff --git a/web/src/api/client.test.ts b/web/src/api/client.test.ts\nindex 28996b3..d3582dc 100644\n--- a/web/src/api/client.test.ts\n+++ b/web/src/api/client.test.ts\n@@ -975,6 +975,8 @@ describe(\"session generation (#310)\", () => {\n await drain();\n \n await login({ email: \"a@b.co\", password: \"pw\" }); // a newer, explicit login completes first\n+ const bootstrapSignal = callsTo(fetchMock, \"/auth/refresh\")[0]?.[1]?.signal as AbortSignal;\n+ expect(bootstrapSignal.aborted).toBe(true);\n expect(getAccessToken()).toBe(\"newLoginToken\");\n expect(onTokens).toHaveBeenCalledTimes(1);\n \ndiff --git a/web/src/api/client.ts b/web/src/api/client.ts\nindex 15ca0f8..eb7a713 100644\n--- a/web/src/api/client.ts\n+++ b/web/src/api/client.ts\n@@ -165,6 +165,11 @@ export async function login(body: LoginRequest): Promise {\n // flight (a bootstrap refresh, say), so its resolution must be the one that\n // wins, and any earlier flight must see its captured generation go stale.\n const generation = ++sessionGeneration;\n+ // A bootstrap refresh can rotate the shared HttpOnly cookie even though its\n+ // JavaScript result is rejected by the generation check below. Cancel it\n+ // before starting the explicit login so its late Set-Cookie cannot overwrite\n+ // the cookie belonging to the session the user deliberately chose.\n+ abortInFlightRefresh?.();\n // The server sets the HttpOnly refresh cookie; the body returns only the\n // access token, which lives in memory for this tab's lifetime.\n const res = await raw(\"/auth/login\", {\n M tools/simulation/ui/specs/i18n.spec.ts\n M tools/simulation/ui/specs/reports-range.spec.ts\n M tools/simulation/ui/specs/session-races.spec.ts\n M web/src/api/client.test.ts\n M web/src/api/client.ts\n",{"_512":689,"_494":690,"_473":474,"_496":480},1785657265766,{"_534":687,"_535":691,"_537":692,"_539":540,"_478":35,"_541":35,"_45":693,"_543":694,"_545":546,"_487":117,"_96":547},"/bin/bash -lc 'git diff --check && git diff --stat && git diff; git status --short'",[695],"exec-f63055a6-0af1-4d5d-846f-39ff2bee2993","98397",{"_535":696,"_96":550},"git diff --check && git diff --stat && git diff; git status --short",{"_494":698,"_473":474,"_496":480},{"_518":681,"_45":699,"_554":700,"_501":701,"_187":557,"_558":-5,"_487":117,"_96":559},"ctc_0d4acabd15c76513016a6ef7b082288194b927e65aab055d6f","const r = await tools.exec_command({cmd:\"git diff --check && git diff --stat && git diff; git status --short\",\"workdir\":\"/workspace/cluckwork\",\"yield_time_ms\":10000,\"max_output_tokens\":30000}); text(r.output)\n",{"_506":480},{"_494":703,"_473":474,"_496":480},{"_518":704,"_45":-5,"_501":705,"_187":-5,"_521":706,"_96":523},"call_PgdpJGaKyGJg7PP5RsuEukJX",{"_506":480},{"_320":707,"_525":-5},[708,709],{"_49":711,"_96":529},{"_49":710,"_96":529},"{}","Script completed\nWall time 0.1 seconds\nOutput:\n",{"_512":713,"_494":714,"_473":474,"_496":480},1785657262933,{"_715":716,"_45":717,"_487":117,"_96":718},"changes",[719],"exec-f35fdf7d-af45-4cf8-873a-a950dc9e753d","fileChange",{"_331":720,"_9":721,"_166":722},"@@ -42,6 +42,3 @@\n await new Promise((r) => setTimeout(r, HOLD_MS));\n- // Logout normally aborts an in-flight refresh as an optimisation. Keep\n- // this response alive so the test exercises the generation guard rather\n- // than passing merely because the network request was cancelled.\n- await route.continue({ headers: route.request().headers() });\n+ await route.continue();\n });\n",{"_723":-5,"_96":724},"/workspace/cluckwork/tools/simulation/ui/specs/session-races.spec.ts","move_path","update",{"_494":726,"_473":474,"_496":480},{"_518":704,"_45":727,"_554":728,"_501":729,"_187":557,"_558":-5,"_487":117,"_96":559},"ctc_0d4acabd15c76513016a6ef7ad61448194866dc77b16405d27","const patch = \"*** Begin Patch\\n*** Update File: /workspace/cluckwork/tools/simulation/ui/specs/session-races.spec.ts\\n@@\\n- // Logout normally aborts an in-flight refresh as an optimisation. Keep\\n- // this response alive so the test exercises the generation guard rather\\n- // than passing merely because the network request was cancelled.\\n- await route.continue({ headers: route.request().headers() });\\n+ await route.continue();\\n*** End Patch\";\ntext(await tools.apply_patch(patch));\n",{"_506":480},{"_494":731,"_473":474,"_496":480},{"_497":-5,"_562":732,"_45":733,"_501":734,"_566":735,"_96":568},"gAAAAABqbvetm4rxBcZ8XU12Q80Ybu0oqbzV42vZ_OtDL_XFUFD62_scv9ORx23Tem_7xB-jb0H26EvlMXqHUFFafFS9xL9DxlIJtYRwWlwcMYjm1Ant4YFpu_ZnQyoUg1EJZFlO0FB2WsaTYgIS7zeXVkpRqaLkdXCCg5EjwaVri0exshY7ADOBi2zWiyG7nO123Ua-Ts4b1KEk0dVdXBRsCf6CPijJVF42JQxGIBuk09gV84kV76uQogiqxKTB3cZBWE-hlAot-tTUUhxV3_zHcbHX2De5EqKqwO8ns4mG2j9ht4rXboSWb2pSQgdLneFjooGHHauwHsS3gHdZiI6qDMCllf2h8AklFPm8DjiiYZbv4firdztAQNUAZsYm75hRa5t5PuTUhKDSrX19nFQ_ud_CC6_8WBRBGMLzaAbQ3zyw2wUZpgnVkfvBN3XSBA9ZrHmMJfOI-f-QvKGZ-Cj92YHsExHhKgqdIxxcd5eFEVi-jfYLd9jT393Id2_VKcIkn-z9IJJnHkTOQxJu1XLO3zvhaEipWfxJJ-fZs16bsZjyi4ZsSCbMOMo1i8PgX9IGHtLRu0UKd88Uqe089DlA1CK3xAZfz87A7JNfgABxmO__GUXXWUZ-kJTTJ5mYiTC54jpB0Z8JO0MGlS01Bb75KgZQm-UrTJBNtbUpLcze94_ICRXk3TT_GxyjxnNVQnJxVzvH7JiXdnUG-89oyMjexbY4Sj6uWRg5Ml0pxKBpD5-7-tQidQP_ZSDoqcZI_p_a62QTpbJ-mAMf5IBX5D7soXUB1pxYCpmE7nH9RHF6gJ081L48yTxKp3zdzBISAoM2mcI95g04EygI01EQjN6NyHWxOrhRIEgRMTg4nerkq_JONbibjHbV9BaD71JLjikoNJqSAcGxmUh3F_kbkTkFtFLNfKCO3reC9aAIPU83pb1MDaHnhEgSRWAGXJ1osR0E6H0oqwyWej8KBi699wHQDA1NWqqqY49J5nuwxuek5HmVJSNUqH6T90ehWgXkMXSdTKLUZr96iFVfTmYQJP5wlk8e_1vm1HuAbiz8_jqnunD3nD_BmlWEAsh5ldyE-KPI1A7ON5T2JmaYF_xy40szY0Nx9h1MGVq303SK4oxqSYGuEbhSdbyamO5oG9mnejso4ImQu9pWR_vUFXrUIyYOVZ9FaNdjCVFd8dYb-GKdPq_OCiS5leIGJxIVDNZlzvSIGL2bgQIsIryEQUYdqNE2DGMpxWwCkEwLiRoAsKL0XX147hPzrsXxsoGWkp4dkQy_f2YNC-tOQqf7-_Bm_hgn3Nl_XL8K65385Ec1TfT5St7Z4NylfRfjJ2e7L_xSK2FZJdwbp38EUC8NpBIHGNPt8Rvl88N6QgHffqOeA9S0O7RG7orMnz2yqc9LuutO-Sc7crCmXPc2HYogqFXwSGiOw-czeDBtTUhveGCvu5YToxgVyl7teGnRzSVfNLpu9oPKoNSrw8LKEZBXq6q9TPJwVQ-a2JmSxgY02BZQu9OBKJ6OMlxNv-yJ7Xj_DL65KQ6Ovt1FEejVip0kKYSc6OBmmhzMhwRWRCMhfwcdtDroSRsgDY4nmnyCpjvbGNokqXTVQWV4Dr55whNrFaWuf1YrbjTTZlfk-hPMPFJcZkTvolzELIhYKaV5GRfIwdS1TEig5LL5JP046f6e_qbG3KLLRPzdAzY2esuml75kdv7rHS2Y-cHOfzNzjASFC-rBm7EoNdvnFca5vFscRjZwl13v4HSHyQGNDHMQQCDOlmQb4vJwpoaASzZAJhj9odjHCRggqaEH158kvhBW1n1QIrDoOLjWLGdgvm9o6G9fx180mee15q_6zYly3tqAdtFWbh8oi9Fzcrjgfb1MALTPWZZ6bDpDJpGmrGMR9I6MJnz25al0qmWyuxAyBoGC7FJ9EC7mSLfsW4xLf9_bfm1Xb6a8h8pCmgsw39CuUXulRZ1HG3n2tN1fJJpRgkP8pt0geqnqY2pyXx9Z9K-HlV8_LJvN794xL1OXM0TZ18vJWa4JbefUi3PwAXshOlPbZ7ojBElp5qxWboYTX1B13kdH_N4ySUV3S1NDfPxkkELPQMw1RIlTLD8c9wcptY0J1KDJjHu2UroeMHVPuZgeIo199oRJR46bvIsKGISLMW3yrlZ3e6KPXJIiOB_miwcHIo6Jh8DIjhx272LCr972lD8sMERvxSHV69W6gg--WfcK192D7i8ZkvTSQsGWfuEx16jnpNQVTaJkeOvIrn8meet0ln9SN9HyPqJghW6RLO0z5dmMllHBI84FFoak9wFZ8xW--ckcnrN73y5Qn0wjsc-8r_qG0Be9aQ59Js1o66YOD-xcKSO2lCvwxFCiRsQKt0G6lC-bh4rh1q8XmEnhyltbOTbwB8WcknLnA6XOovZdNLZhiiA34Jgc8lQaMHK0PDJJK3BkFXeJTHXDgxUEb5xa4muchl9Iwp8n7V3mdsXQASY11-kS-HIYEAm1h1hI7bKGeuHsQR8iFoYe9eNC2Bdt7pCUVw-_hZTFHqB11gdo3q-ye96aG-Tzae9SsIpgFphW6eokcFJKe2bv23OIYRfa65JSqfO1etJrn0LPHeSzJlGssAJp-v7pa4NGq2vTkqcLfktcvjOx1kLsrP80LhuuIaHdtXRCgcGPfqcy3sif3GtFjJ7BtcPay2VY8Is7h01m8t74zrtwHwBrGHc8uCYhYSKeHL6O0ajfqPQ-i381mCoJx1mPtbMZMLD4KYI74K1bzChNz33u8vOj","rs_0d4acabd15c76513016a6ef79ed9948194a91f4fbd7a6d9e39",{"_506":480},[736,737],{"_49":739,"_96":635},{"_49":738,"_96":635},"**Adding page InitScript to override AbortController**","**Reviewing login abort and refresh logic**",{"_512":741,"_494":742,"_473":474,"_496":480},1785657261417,{"_497":743,"_45":733,"_566":744,"_96":568},[],[739,738],{"_512":746,"_494":747,"_473":474,"_496":480},1785657260369,{"_534":748,"_535":749,"_537":750,"_539":751,"_478":752,"_541":753,"_45":754,"_543":755,"_545":546,"_487":756,"_96":547},"npm warn Unknown env config \"http-proxy\". This will stop working in the next major version of npm.\n\n> cluckwork-web@0.0.0 test\n> vitest run --run src/api/client.test.ts\n\n\n RUN v4.1.10 /workspace/cluckwork/web\n\n/root/.nvm/versions/node/v20.20.2/bin/node: bad option: --no-experimental-webstorage\n⎯⎯⎯⎯⎯⎯ Unhandled Errors ⎯⎯⎯⎯⎯⎯\n\nVitest caught 1 unhandled error during the test run.\nThis might cause false positive tests. Resolve unhandled errors to make sure your tests are not affected.\n\n⎯⎯⎯⎯⎯⎯ Unhandled Error ⎯⎯⎯⎯⎯⎯⎯\nError: [vitest-pool]: Worker forks emitted error.\n ❯ EventEmitter.onTaskError node_modules/vitest/dist/chunks/cli-api.BK8pd4xc.js:3459:21\n ❯ EventEmitter.emit node:events:524:28\n ❯ ChildProcess.emitUnexpectedExit node_modules/vitest/dist/chunks/cli-api.BK8pd4xc.js:3025:22\n ❯ ChildProcess.emit node:events:524:28\n ❯ Process.ChildProcess._handle.onexit node:internal/child_process:293:12\n\nCaused by: Error: Worker exited unexpectedly\n ❯ ChildProcess.emitUnexpectedExit node_modules/vitest/dist/chunks/cli-api.BK8pd4xc.js:3023:33\n ❯ ChildProcess.emit node:events:524:28\n ❯ Process.ChildProcess._handle.onexit node:internal/child_process:293:12\n\n⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯\n\n\n Test Files no tests\n Tests no tests\n Errors 1 error\n Start at 07:53:20\n Duration 38ms (transform 0ms, setup 0ms, import 0ms, tests 0ms, environment 0ms)\n\n","/bin/bash -lc 'npm test -- --run src/api/client.test.ts && npm run typecheck'",[757],"/workspace/cluckwork/web",62901,1,"exec-47454b18-66b5-4452-93cb-b12471603296","4084","failed",{"_535":758,"_96":550},"npm test -- --run src/api/client.test.ts && npm run typecheck",{"_494":760,"_473":474,"_496":480},{"_518":761,"_45":-5,"_501":762,"_521":763,"_96":764},"call_QhgrNxkzsrMNUxgS8vU1J2Mp",{"_506":480},{"_320":765,"_525":-5},"function_call_output",[766,767,768],{"_49":583,"_96":529},{"_49":770,"_96":529},{"_49":769,"_96":529},"---1---\nnpm warn Unknown env config \"http-proxy\". This will stop working in the next major version of npm.\n\n> cluckwork-sim-ui@0.0.0 typecheck\n> tsc --noEmit\n\nerror TS2688: Cannot find type definition file for 'node'.\n The file is in the program because:\n Entry point of type library 'node' specified in compilerOptions\n\nEXIT 2","---0---\nnpm warn Unknown env config \"http-proxy\". This will stop working in the next major version of npm.\n\n> cluckwork-web@0.0.0 typecheck\n> tsc -b --noEmit\n\n\nEXIT 0",{"_494":772,"_473":474,"_496":480},{"_588":773,"_518":761,"_45":774,"_501":775,"_187":776,"_558":-5,"_96":777},"{\"cell_id\":\"15\",\"yield_time_ms\":1000,\"max_tokens\":20000}","fc_0d4acabd15c76513016a6ef79c9ad08194a09a21125ba5b1a7",{"_506":480},"wait","function_call",{"_512":779,"_494":780,"_473":474,"_496":480},1785657244866,{"_534":781,"_535":782,"_537":783,"_539":751,"_478":784,"_541":35,"_45":785,"_543":786,"_545":546,"_487":117,"_96":547},"npm warn Unknown env config \"http-proxy\". This will stop working in the next major version of npm.\n\n> cluckwork-web@0.0.0 typecheck\n> tsc -b --noEmit\n\n","/bin/bash -lc 'npm run typecheck'",[787],11723,"exec-176ea148-ab5e-4583-b108-62cd29bf0860","70654",{"_535":788,"_96":550},"npm run typecheck",{"_494":790,"_473":474,"_496":480},{"_518":791,"_45":-5,"_501":792,"_187":-5,"_521":793,"_96":523},"call_sfqgF2CXjebB9behHY2UlfI1",{"_506":480},"Script running with cell ID 15\nWall time 10.0 seconds\nOutput:\n",{"_512":795,"_494":796,"_473":474,"_496":480},1785657239637,{"_534":797,"_535":782,"_537":798,"_539":799,"_478":800,"_541":801,"_45":802,"_543":803,"_545":546,"_487":756,"_96":547},"npm warn Unknown env config \"http-proxy\". This will stop working in the next major version of npm.\n\n> cluckwork-sim-ui@0.0.0 typecheck\n> tsc --noEmit\n\nerror TS2688: Cannot find type definition file for 'node'.\n The file is in the program because:\n Entry point of type library 'node' specified in compilerOptions\n",[804],"/workspace/cluckwork/tools/simulation/ui",6498,2,"exec-cde68ed8-7c8f-4495-8b06-8b9983210e3c","25682",{"_535":788,"_96":550},{"_494":806,"_473":474,"_496":480},{"_518":791,"_45":807,"_554":808,"_501":809,"_187":557,"_558":-5,"_487":117,"_96":559},"ctc_0d4acabd15c76513016a6ef78f1f488194974a6683b5a725e2","const results = await Promise.all([\n tools.exec_command({cmd:\"npm run typecheck\",\"workdir\":\"/workspace/cluckwork/web\",\"yield_time_ms\":30000,\"max_output_tokens\":10000}),\n tools.exec_command({cmd:\"npm run typecheck\",\"workdir\":\"/workspace/cluckwork/tools/simulation/ui\",\"yield_time_ms\":30000,\"max_output_tokens\":10000})\n]); results.forEach((r,i)=>{text(`---${i}---\\n${r.output}\\nEXIT ${r.exit_code}`)});\n",{"_506":480},{"_494":811,"_473":474,"_496":480},{"_497":-5,"_562":812,"_45":813,"_501":814,"_566":815,"_96":568},"gAAAAABqbvePKOkWtBEwGsqFThe0mRhmB0XFlu7-GgOyxZjeVoq4QkMwJpSgEB131LElIyyrx9_2DmTYJQWPBvQ7nQcVdVzqxPXqy7_36vg0431TzP1NkyEFXdZ7appYe_1a_sNnw9sa-mpPqtXVaJZnJJgKw0XOySdhL2IwigZPRZPVG12SLFk7CTd_HYrrIAnSqyTYBjIj_Err1r7OmySOneQHnL0_HrmFqBYoKBhThZXv3K4RUSfUrUJhzO61HrZqKlIPiP4W0sXAObSs6lteFDO7WIVVBokrQH2Ok-ifF6vzqv6J8GhcEmD3_gevM7hq87VC9EIKI_LZKNxiNVsjB30ZL3db4mcXc0YVvArithp1HNUWO6XNOAZEafcXUKPeNmwdcMfd4RIuNHAoKbMUHwhCvfr3V9p7dSJQ1gLo_QXu5ftaNDPKm79CePbRLpXHLlulMNFQ3kRL-kZUZEhS7yHRIs8Mfj11EMbqiVzAbB4b6RQ6zJpyuy2fVd0dEhYMROIZ20hFPSiw4yQPYDUtl1vzdIy45FZo17-4SHW5PHWVor3CfEGoOX8w1XqbYtQF8BonN2S9c3R4mYxN_2zS84zwL6sHkRrX_dFFsx9SpjjqeZMqBYd1eOjXNGr61_V3yt4JEPJmgj5Okps917ZTpXPLM-lUoVtI0AkQA4y5D5OZrdGVXGRFpiqVH4PF13BPZJcYlHf3c37v8nU3amJlYOrVy2CIuoc6AHNDFRhQSZicDzyqG3ILVj_QVzYHwkzukbPzKWRcyusTgOLB1xUdyCqP-GrgksIcKjZW90YCvpzq3WVDrF1wHfYcgMh6LkL5zlk-gFT0OYqOUUvvOmn-oaYNiMLlpCGm3AEpdTaE4bLK2OotEbtWeuheC-_3T70-9pnF76kSzORTEznKcto0BvUBpguqxs7ci2ss_exgmjrRNTz-A4oIvb9qm2stloPiD-vT0TZoNIj2ppLxnifmiTnNFkw-oJZwM0jfAyT-pFW1KLwAWbg=","rs_0d4acabd15c76513016a6ef78e54b48194a30348aed8d8c07e",{"_506":480},[816],{"_49":817,"_96":635},"**Running web and UI type checks**",{"_512":819,"_494":820,"_473":474,"_496":480},1785657231148,{"_497":821,"_45":813,"_566":822,"_96":568},[],[817],{"_494":824,"_473":474,"_496":480},{"_518":825,"_45":-5,"_501":826,"_521":827,"_96":764},"call_KIz7CFQB9J4GZz1YCYUDJFdp",{"_506":480},{"_320":828,"_525":-5},[829,830,831],{"_49":583,"_96":529},{"_49":748,"_96":529},{"_49":832,"_96":529},"EXIT:undefined",{"_494":834,"_473":474,"_496":480},{"_588":835,"_518":825,"_45":836,"_501":837,"_187":776,"_558":-5,"_96":777},"{\"cell_id\":\"14\",\"yield_time_ms\":1000,\"max_tokens\":20000}","fc_0d4acabd15c76513016a6ef78c6ef08194bb4ee5115a683eef",{"_506":480},{"_494":839,"_473":474,"_496":480},{"_518":840,"_45":-5,"_501":841,"_521":842,"_96":764},"call_nlafxO23iXHoT1r1GT6JPuwN",{"_506":480},"Script running with cell ID 14\nWall time 1.0 seconds\nOutput:\n",{"_494":844,"_473":474,"_496":480},{"_588":835,"_518":840,"_45":845,"_501":846,"_187":776,"_558":-5,"_96":777},"fc_0d4acabd15c76513016a6ef788a7cc81948cbb46ad38ce2891",{"_506":480},{"_494":848,"_473":474,"_496":480},{"_518":849,"_45":-5,"_501":850,"_521":842,"_96":764},"call_c2AeYVzNKZAzH7US84BF0cYJ",{"_506":480},{"_494":852,"_473":474,"_496":480},{"_588":835,"_518":849,"_45":853,"_501":854,"_187":776,"_558":-5,"_96":777},"fc_0d4acabd15c76513016a6ef783ded48194ae042bd8a80f6e0b",{"_506":480},{"_494":856,"_473":474,"_496":480},{"_518":857,"_45":-5,"_501":858,"_521":842,"_96":764},"call_BWBv5NxReOlyIahyqOVa1R5B",{"_506":480},{"_494":860,"_473":474,"_496":480},{"_588":835,"_518":857,"_45":861,"_501":862,"_187":776,"_558":-5,"_96":777},"fc_0d4acabd15c76513016a6ef77f1c90819496534e3283998ffc",{"_506":480},{"_494":864,"_473":474,"_496":480},{"_518":865,"_45":-5,"_501":866,"_521":842,"_96":764},"call_MDXu07McLGyv8V8LGKuGcNwn",{"_506":480},{"_494":868,"_473":474,"_496":480},{"_588":835,"_518":865,"_45":869,"_501":870,"_187":776,"_558":-5,"_96":777},"fc_0d4acabd15c76513016a6ef77acd908194a46868b204490d5d",{"_506":480},{"_494":872,"_473":474,"_496":480},{"_497":-5,"_562":873,"_45":874,"_501":875,"_566":876,"_96":568},"gAAAAABqbvd6fW-4FCr-KrsBiwt-WsNCsnzhWFytktz6_R4FBcRFr8Oub8drwG2Lf6uHeHROcNcunq1Eylg1RWKQjC0JGAPZ8qT93u2URmIyV-D49ErKQrV74PvE3qFNka6i2xw9UrIBG6A7MHk3sT2mX6wM1cvXgBuZoOblWiW6Qq4z4XNaGbEZ33o9q4DbDxQlcu1703WHAYP_UP6RgL1sz_5Y8MuF7U4Tmu4yK2NAVoq71Oith_J205bFx2dbw4YbGbEkUwCdn7HsSznp-63eFIAYc55HLw3l2AZwHmqepamZQwJFb-ry29pEGGNNh8ytvvQn9hZRoP8rQAp25xmvi1cHCiAlQfgqqWyHpy6jEoQlVARb3BqsL1XASVyIURsbM0q_jdDWkcfFhPucWff-kZiwQj1u0lTywr40Ws7Vp8UAPLmN6fAYpKWsSaov4p5NArqQBN5Y-iIklJ6MuaQCFI6VNxQBoDB1x2rulIIPrlZDGUnkzrUiVnFe1xj5ODqzM5lBNfe8Z7SQuq8N-0VWzpTQJzWuwqjhvdHuC-H2b2CWDUqxb-4ksgiEuHsujznA6SvvFY0rNXoEROeWRlb8KrTC6FzYtO34imb2LVPfrfD4sq5nY2cXxQnxnRhY7VZ5tdc4pE1vP56woPZfctTbrMKaBWbExjf5QUaXosKk3lMNqimF9tbJJUEOzJNgRIGkv6IfRhKk2LjNIESsZt6MGmnCbi43A9211CA6Z81XS_A5Psr7Yznd_vfBWzjpvCjIv-0cgA0S1rxQiyt92IZkeBmbzzK58pwGFgLoBGHIK-aFB2BWShxiLSRJwioLXqpDfz-140N5ApPc352IbumfZn_anZLqvEkMVKEGp1CWPNlIl72RK-NOmFcPnNBkzlI03R1ZB6yEoLtes8BqUtDYt54QIfIkogtftG7LBzc8lh9xz2EPxuI=","rs_0d4acabd15c76513016a6ef77a5d048194a208b7346bfc6022",{"_506":480},[],{"_512":878,"_494":879,"_473":474,"_496":480},1785657210827,{"_497":880,"_45":874,"_566":881,"_96":568},[],[],{"_494":883,"_473":474,"_496":480},{"_518":884,"_45":-5,"_501":885,"_187":-5,"_521":886,"_96":523},"call_hLvj2BTVNV8IPhDHL2PmF3tr",{"_506":480},"Script running with cell ID 14\nWall time 10.0 seconds\nOutput:\n",{"_494":888,"_473":474,"_496":480},{"_518":884,"_45":889,"_554":890,"_501":891,"_187":557,"_558":-5,"_487":117,"_96":559},"ctc_0d4acabd15c76513016a6ef76c858c819494273b1a229f39f4","const r = await tools.exec_command({cmd:\"npm test -- --run src/api/client.test.ts && npm run typecheck\",\"workdir\":\"/workspace/cluckwork/web\",\"yield_time_ms\":30000,\"max_output_tokens\":20000}); text(r.output); text(`EXIT:${r.exit_code}`)\n",{"_506":480},{"_494":893,"_473":474,"_496":480},{"_497":-5,"_562":894,"_45":895,"_501":896,"_566":897,"_96":568},"gAAAAABqbvdsut_q1k-TN23m_SFi6eYL3eMEYOA9M9dGdAl_Ot7Uw3vNaJTxKpXVDl_XwT4QBht5c9pQfSSb2kF7EzQEDMxw5tvLoARVFI6CCV3qLwN9BQx6FCkTgQ2SMs5x2CefO8O87csXMOLXAK2Zg4g97MHkmByDLhNzSKDpq8pnORGFNr8gXtzskTQiNePbwYzC2DyMd7lquw-3-1ZVLige_YH4zWfQNQUparcij5BKF9qFgK9L_6vXhHIBPTsKpjL4kJTAbSOXfkNyqpZZIgpFqSPUognMr8cCEHkTnXhuYHyFA56b7hBYKd67ZDBIZf7EJj8abT2oxtXDrM_WiUYVKw6LCsNuBb3cunacmwCUM9c1UduEzAqRObUAOE9U3Kwy_g0i12ZnRVS2uiCAjdfDjpE0icJmsx0UZuJ3kdZlS5ssYXeRr-niK6auIK4KzmSTzBEJeEFuLRw8uZFEMuoxLr6qHyXR3NYEyoRJL3xxW_a5KqVjEpET8um6C3iojp3o7ll3eP5X7jDPIb5mawKtStwipJJ6NoVhzf_U7S-uHns0tYHb_PABmu9nTeXLZhd7IwvjHcM6cbT2JpjctkWrf7HNhQCxv0Eyfy494QHAeyJRqsqz3Ls9zPojiW2IdC5a5xJw9RnhQqMR5NLhvQyxANLaHU0_VjtW0GcoCJj5JpGcKq1gwbPhe-XOFBLj7NXKsp7CQ7nd_T8ZcNs1TFqnRp7K-SRMpuNHge_UkA-A_5JWh8XDMZWmAZzwumCgkhqTFJsFV-hOh73QObzW7rhpxGa3uRyOVOmAhj9T0pJXdkHOuiPvi41xUt_GIwzttO2CJuvkUA-ZDa1WP5hS5L0kxdjSjs33691mQ4780PbYNiDfOQ846RQnm9qbF6ilZdJPeeCAR2xPmoA_dImAYRIN9fj2t8e461-ZMFZxbtQTA7XUIMKzTnnQGcXnJJrzFfvr-YRf8daJraNKQoV0nUjRg8N6V2efFnAfQIZGGi0dltRHnBo=","rs_0d4acabd15c76513016a6ef76b73948194b6bcf6fb474ef722",{"_506":480},[898],{"_49":899,"_96":635},"**Planning UI typecheck dependencies**",{"_512":901,"_494":902,"_473":474,"_496":480},1785657196563,{"_497":903,"_45":895,"_566":904,"_96":568},[],[899],{"_494":906,"_473":474,"_496":480},{"_518":907,"_45":-5,"_501":908,"_187":-5,"_521":909,"_96":523},"call_6a7kNMrOtzNn3PKJpwRi5eUL",{"_506":480},{"_320":910,"_525":-5},[911,912],{"_49":583,"_96":529},{"_49":710,"_96":529},{"_512":914,"_494":915,"_473":474,"_496":480},1785657194369,{"_715":916,"_45":917,"_487":117,"_96":718},[918],"exec-f24792a0-01a7-4196-b3d0-ffc7429431b3",{"_331":919,"_9":920,"_166":921},"@@ -967,4 +967,3 @@\n const refreshGate = deferred();\n- let bootstrapSignal: AbortSignal | null = null;\n- fetchMock.mockImplementation((url: string, init?: RequestInit) => {\n+ fetchMock.mockImplementation((url: string) => {\n if (url.endsWith(\"/auth/refresh\")) return refreshGate.promise;\n@@ -978,3 +977,3 @@\n await login({ email: \"a@b.co\", password: \"pw\" }); // a newer, explicit login completes first\n- bootstrapSignal = callsTo(fetchMock, \"/auth/refresh\")[0]?.[1]?.signal as AbortSignal;\n+ const bootstrapSignal = callsTo(fetchMock, \"/auth/refresh\")[0]?.[1]?.signal as AbortSignal;\n expect(bootstrapSignal.aborted).toBe(true);\n",{"_723":-5,"_96":724},"/workspace/cluckwork/web/src/api/client.test.ts",{"_494":923,"_473":474,"_496":480},{"_518":907,"_45":924,"_554":925,"_501":926,"_187":557,"_558":-5,"_487":117,"_96":559},"ctc_0d4acabd15c76513016a6ef7674b5c8194937e04cb9f6636aa","const patch = \"*** Begin Patch\\n*** Update File: /workspace/cluckwork/web/src/api/client.test.ts\\n@@\\n- let bootstrapSignal: AbortSignal | null = null;\\n- fetchMock.mockImplementation((url: string, init?: RequestInit) => {\\n+ fetchMock.mockImplementation((url: string) => {\\n@@\\n- bootstrapSignal = callsTo(fetchMock, \\\"/auth/refresh\\\")[0]?.[1]?.signal as AbortSignal;\\n- expect(bootstrapSignal.aborted).toBe(true);\\n+ const bootstrapSignal = callsTo(fetchMock, \\\"/auth/refresh\\\")[0]?.[1]?.signal as AbortSignal;\\n+ expect(bootstrapSignal.aborted).toBe(true);\\n*** End Patch\";\ntext(await tools.apply_patch(patch));\n",{"_506":480},{"_494":928,"_473":474,"_496":480},{"_497":-5,"_562":929,"_45":930,"_501":931,"_566":932,"_96":568},"gAAAAABqbvdnKKGMiyt3Sg1hNlOH_GHbk97ElruzEWf8KvDRolJ2guKFLBeSTPOeQQffoJ-G5rUmEn9yJMi5bvNjnH0x7bJhntcHNeZ5iT6_7cHgexbhlmiP8RPOO1De4PM_vB8K4OsQzZx-nN31Q041Mf4MY0GsJsvVOmRHns0xaKawhm9mIuKWOLqS1Ko_8O7Gtec6iOfIwfNMUVlkDgKVaXiAH53iRu0XaQRmZKDLffgAI2DRlROSyEmftQamGcmzZIqDLUfrD1rbj3_hVQ8C-bqkCMJ-pFtxAOz5cWIWhAJEaLe5KqlQYozMNFxHsTaJTLo4HigIbvvc1TcbARU2XQZMqkYXbJujTLLQNrS4lnSOK4JXMWkkUweZQIRUW4wIEIat6Vq4x3r9aMxPM5Ee87rq3FnGFgJnmqbpf8PELwO37S6uxztkwhEdR-COov1zXn4AhTfjljZ2rGHU_JvqDPNIo03VKuLNaF4Ke2NWDO03HjT8un79x8dcWwe-AQKRcxSyHAebWBn63D2vVS29GHE9R74f9DVPIwQp5iHGiKYIipWShZo4ipP_TRwiBDN7nWL15LBEmhiMEWMmUL6kcIECy_LrSp_EQynaXsdQ4yne-mgE9hird5RaqD-0SvLESw_3IweW0h02_Wd6umizfjYnWU3skSNpvlW2JcFdxkuLydhJ9bmYoh2xg74RDTpdJSndNq_UBTCPHEk-6N41yf0ueX-JEuVMXaHcNrgcb5S9RDlV4KDQbllGzZ899zBN4Kv_osIXFQc_9QxD85TOML8-aWy3K9iDngR6IxPZ-JCxm4ZzCIVsi2GsA6QD2T--UYRX0JzsTpMXXRDrojze8dpi96p8GsZRtv8Bs0dVXnTi4iDeqvZSf0n8Lqd571Ya0z_L3LAMXX_Lc5dAZN6Sm-k26PxzrBjyPlmDdOHleo8uIxwnIKBl9liVLCEi-x0GmuJb23w8z2FIKvV9CJcQBIVIDkBrlquPRneLvy-vwNXOHGxW3kBNuHmQOaMT_qha-DfK4JPd","rs_0d4acabd15c76513016a6ef766ab588194b7f5c4c82bdc0992",{"_506":480},[933],{"_49":934,"_96":635},"**Removing variable and init parameter**",{"_512":936,"_494":937,"_473":474,"_496":480},1785657191333,{"_497":938,"_45":930,"_566":939,"_96":568},[],[934],{"_512":941,"_494":942,"_473":474,"_496":480},1785657188839,{"_534":943,"_535":944,"_537":945,"_539":540,"_478":946,"_541":753,"_45":947,"_543":948,"_545":546,"_487":756,"_96":547},"npm warn Unknown env config \"http-proxy\". This will stop working in the next major version of npm.\n\n> cluckwork-web@0.0.0 typecheck\n> tsc -b --noEmit\n\nsrc/api/client.test.ts(969,48): error TS6133: 'init' is declared but its value is never read.\n","/bin/bash -lc \"rg -n \\\"function callsTo\\\" web/src/api/client.test.ts; sed -n '1,90p' web/src/api/client.test.ts; git diff --check; cd web && npm run typecheck\"",[949],7016,"exec-991467fc-cf02-4c92-a329-d66b51b892f2","30363",{"_535":950,"_96":550},"rg -n \"function callsTo\" web/src/api/client.test.ts; sed -n '1,90p' web/src/api/client.test.ts; git diff --check; cd web && npm run typecheck",{"_494":952,"_473":474,"_496":480},{"_518":953,"_45":-5,"_501":954,"_187":-5,"_521":955,"_96":523},"call_f5kIBVjtiMMityoDattE2cgv",{"_506":480},{"_320":956,"_525":-5},[957,958],{"_49":960,"_96":529},{"_49":959,"_96":529},"54:function callsTo(mock: ReturnType, suffix: string): Call[] {\nimport { describe, it, expect, vi, beforeEach, afterEach } from \"vitest\";\nimport {\n apiGet,\n apiPost,\n apiPut,\n apiPutBytes,\n apiDelete,\n apiFetch,\n apiGetBlob,\n login,\n logout,\n restoreSession,\n changePassword,\n stepUp,\n STEP_UP_HEADER,\n ApiError,\n setOnUnauthenticated,\n setOnTokensChanged,\n getLastTraceId,\n} from \"./client\";\nimport { getAccessToken, setAccessToken, clearAccessToken } from \"../auth/tokenStore\";\n\n// The fetch client owns the SPA's session lifecycle: bearer-attach, one\n// transparent refresh-and-retry on 401, single-flight refresh, and fail-closed\n// teardown. Since #145 the refresh token rides an HttpOnly cookie (the browser\n// attaches it), so refresh/logout send NO refresh body — only the CSRF header.\n// All exercised here against a stubbed global fetch — no network.\n\nconst FUTURE = \"2099-01-01T00:00:00Z\";\nconst CSRF = \"X-Cluckwork-Auth\";\n\nfunction jsonResponse(body: unknown, status = 200): Response {\n return new Response(JSON.stringify(body), {\n status,\n headers: { \"Content-Type\": \"application/json\" },\n });\n}\n\n// The access-token body login/refresh now return (no refresh token).\nfunction accessResponse(accessToken: string, status = 200): Response {\n return jsonResponse({ accessToken, accessTokenExpiry: FUTURE }, status);\n}\n\ntype Call = [string, RequestInit];\n\nfunction authOf(call: Call): string | null {\n return new Headers(call[1]?.headers ?? {}).get(\"Authorization\");\n}\n\nfunction headerOf(call: Call, name: string): string | null {\n return new Headers(call[1]?.headers ?? {}).get(name);\n}\n\nfunction callsTo(mock: ReturnType, suffix: string): Call[] {\n return (mock.mock.calls as Call[]).filter(([url]) => url.endsWith(suffix));\n}\n\n// A promise whose resolution the test controls — lets us hold a refresh open\n// until both concurrent callers have provably parked on it (no timing guesses).\nfunction deferred() {\n let resolve!: (v: T) => void;\n const promise = new Promise((r) => (resolve = r));\n return { promise, resolve };\n}\n\n// Runs pending microtasks AND the macrotask queue once, so every in-flight\n// fetch resolution + catch handler has settled before we assert / release.\nconst drain = () => new Promise((r) => setTimeout(r, 0));\n\nlet fetchMock: ReturnType;\nlet onUnauth: ReturnType void>>;\nlet onTokens: ReturnType void>>;\n\nbeforeEach(() => {\n fetchMock = vi.fn();\n vi.stubGlobal(\"fetch\", fetchMock);\n onUnauth = vi.fn();\n onTokens = vi.fn();\n setOnUnauthenticated(onUnauth);\n setOnTokensChanged(onTokens);\n setAccessToken(\"at1\");\n});\n\nafterEach(() => {\n vi.unstubAllGlobals();\n setOnUnauthenticated(null);\n setOnTokensChanged(null);\n clearAccessToken();\n});\n\nnpm warn Unknown env config \"http-proxy\". This will stop working in the next major version of npm.\n\n> cluckwork-web@0.0.0 typecheck\n> tsc -b --noEmit\n\nsrc/api/client.test.ts(969,48): error TS6133: 'init' is declared but its value is never read.\n","Script completed\nWall time 7.1 seconds\nOutput:\n",{"_494":962,"_473":474,"_496":480},{"_518":953,"_45":963,"_554":964,"_501":965,"_187":557,"_558":-5,"_487":117,"_96":559},"ctc_0d4acabd15c76513016a6ef75c78348194b0449bec6811c624","const r = await tools.exec_command({cmd:\"rg -n \\\"function callsTo\\\" web/src/api/client.test.ts; sed -n '1,90p' web/src/api/client.test.ts; git diff --check; cd web && npm run typecheck\",\"workdir\":\"/workspace/cluckwork\",\"yield_time_ms\":30000,\"max_output_tokens\":12000}); text(r.output)\n",{"_506":480},{"_494":967,"_473":474,"_496":480},{"_497":-5,"_562":968,"_45":969,"_501":970,"_566":971,"_96":568},"gAAAAABqbvdcketvAcXzBkTBTotp9vJ58nD-33OtfZ8pL6P-ORcBsKc5f_WrvHvsavPzqO6nGkTbUqJ_p2uici3cEe15n-rYTs0Ver5HLkxB2qqJJZCEZfXzZzxC4uQNHfv9Gg3nQdr_UGBQ_Mt63BxygS5xXmWJPDCUcyiEDGeyYlHtl52MZ-B2v3HimsQxv2JcwD8eizAGvTIeZGVAtehchsVp1lQSkYso3-jftmNk7NsKPmrw6nwpQUOk2_9VrWZqMbwJZu5S86DtVRKX0fLhGSWFdoU2cimanbu1et0Zs-PijxAK6yMjBOl663RB9c0qi2Je0STU-02igxjMpuHCjOvCvNDxU-AOOocN_5S6k-HE8SWlfGvHNkIU1OpAeGFomChOLjU6zV3EIFms_uZj6e384nuxZDTDTldLF9hOtdE1usR5JVXmeWeoepnZpc6lIkfKTTfK91ZqvkQYxSZlRG-TB8gNUS71VSXgZNMN0gTjbDMZjxKa2pa9XCbGDLIuvDK_k15PrPJSjlC36CgmPPpO6iu0fnWBNKeagcDTKuJ-ftB9F5RFoUxo75Oljp1Xe-HtA5xWH8luXev1vlaUd5V0qPJKVdfUG6wMxJm2sdY992uSxrGOKztOxkQQdhbqbyZQCAcwWI2kk0lRMr7d-jm9BgRdM_9VIQKnNAQ9nsu2WCgiteaieL_6l8z05BKcineqz8HCFPhQ7dZHwT_TrfYm8g4_BHAKCHqMlT9_jYBIKToXQxeV2tot_3uqEtRZVsARp_qnZMKmTU95Mv2td7qeDV_WadQvZLoeJ9c19vnDOPd9lDd7XntUsdurJ9L8n9pBRU_OOechInXHLltAf58fIzh86zDElNW6dT2sCIqasiocSHORsYydAUgSqqgzK9oTqhYODjCCzbzW57uNliGWXgBV5o2mw_pR69yUCZbykqyl0RNSkXPa9pMtbiUKlaaxSmYU2hkEPfbdy3fvXgjPM53SzFPpbTtTkjtdCBNL-EsTMqB76cMvcRfsY7QgX1jTib--WDtgAep-O-CteaVQMIV73g==","rs_0d4acabd15c76513016a6ef75b9a188194ae8c0ea49b115bb5",{"_506":480},[972],{"_49":973,"_96":635},"**Inspecting call tuple issue**",{"_512":975,"_494":976,"_473":474,"_496":480},1785657180493,{"_497":977,"_45":969,"_566":978,"_96":568},[],[973],{"_494":980,"_473":474,"_496":480},{"_518":981,"_45":-5,"_501":982,"_187":-5,"_521":983,"_96":523},"call_6tFJZGNBHBCiklDYLCaXOOqC",{"_506":480},{"_320":984,"_525":-5},[985,986],{"_49":711,"_96":529},{"_49":710,"_96":529},{"_512":988,"_494":989,"_473":474,"_496":480},1785657177333,{"_715":990,"_45":991,"_487":117,"_96":718},[992],"exec-7a88cf7d-31f3-455e-9b7b-62fd1561795f",{"_331":993,"_9":994,"_166":921},"@@ -967,3 +967,4 @@\n const refreshGate = deferred();\n- fetchMock.mockImplementation((url: string) => {\n+ let bootstrapSignal: AbortSignal | null = null;\n+ fetchMock.mockImplementation((url: string, init?: RequestInit) => {\n if (url.endsWith(\"/auth/refresh\")) return refreshGate.promise;\n@@ -977,2 +978,4 @@\n await login({ email: \"a@b.co\", password: \"pw\" }); // a newer, explicit login completes first\n+ bootstrapSignal = callsTo(fetchMock, \"/auth/refresh\")[0]?.[1]?.signal as AbortSignal;\n+ expect(bootstrapSignal.aborted).toBe(true);\n expect(getAccessToken()).toBe(\"newLoginToken\");\n",{"_723":-5,"_96":724},{"_494":996,"_473":474,"_496":480},{"_518":981,"_45":997,"_554":998,"_501":999,"_187":557,"_558":-5,"_487":117,"_96":559},"ctc_0d4acabd15c76513016a6ef754d64c8194876c644c4f241d8d","const patch = \"*** Begin Patch\\n*** Update File: /workspace/cluckwork/web/src/api/client.test.ts\\n@@\\n it(\\\"does not let a late bootstrap refresh overwrite a newer explicit login\\\", async () => {\\n clearAccessToken();\\n const refreshGate = deferred();\\n- fetchMock.mockImplementation((url: string) => {\\n+ let bootstrapSignal: AbortSignal | null = null;\\n+ fetchMock.mockImplementation((url: string, init?: RequestInit) => {\\n if (url.endsWith(\\\"/auth/refresh\\\")) return refreshGate.promise;\\n if (url.endsWith(\\\"/auth/login\\\")) return Promise.resolve(accessResponse(\\\"newLoginToken\\\"));\\n throw new Error(`unexpected fetch: ${url}`);\\n });\\n@@\\n await login({ email: \\\"a@b.co\\\", password: \\\"pw\\\" }); // a newer, explicit login completes first\\n+ bootstrapSignal = callsTo(fetchMock, \\\"/auth/refresh\\\")[0]?.[1]?.signal as AbortSignal;\\n+ expect(bootstrapSignal.aborted).toBe(true);\\n expect(getAccessToken()).toBe(\\\"newLoginToken\\\");\\n*** End Patch\";\ntext(await tools.apply_patch(patch));\n",{"_506":480},{"_494":1001,"_473":474,"_496":480},{"_497":-5,"_562":1002,"_45":1003,"_501":1004,"_566":1005,"_96":568},"gAAAAABqbvdUM3Vji1R7ClzL2BWt4SuXDzFpzdmcgisJBbb60TkL-lPEJfsMBgYkW4FvrLCuY2cgFTKUAgBBozu6pubyLfmXutdmR8Z-UACuNysUcHtzAgZhOIvU-T3VbI6C7wU2JNMW4vJ8n5w0_qKL6a2MC9Uvg-8HK6Yk_kEyh6FarxsmKa0rolo_uhjgkZBqHtQUYH5lTFxcPLucOP7irxNoF8Spm3xSWxzDN6hCQVRbZRcHqIxoBvyi4LM3idsar1HfTvKMRJAiYwo6nBFGuiqdBySgE71qpYA4zek31SpKzazEaaj4y1OQH3Zkxsxvi8_4IDnOfKiF4TTBSN2-hjngnH7EzlRj6QaikqBHAH3F-1F--klAT0xK-6sfGC-9tRmOqhS4BbjXiO-Wc-91Q0FfGZ-uVojnm8kteL2mX3sGWnMgN9kCliLEHwCGuMwlSm8TJB5ws4m7rMG-9p7THDksLZsvflCYk5l96LkrHlms-bRO5-pHpfaF0Fir03SjpvoZcvuAf3iUS26oPja2AImYxcmRe3syrPzagJYmeXdybVB5r3wNmJLz9k5AoOvZviP4KnDzE3q2n_I8R6W7tIwBq8iSN-p1m5VdLx4JBEXW8i9_thFa3Zdc_8uzAob1u5--VaigtoJwGK6cNJY4KMIwVo139gu68OlA7dm9mV2eI5_HCADYcVzPog70_WB36NbrDPGSQs15OwWa1AR6Cx7SeHkdvFTYb1EA5hHbkMARz_m6yQdOEhUJ8FKJiz7j8PglC9rBvxFXqlanOgNKoZhHBqX9FtkIez8Zw2tggO2smru_QFP3FQVhJAbnHMqq1ViNPQDsFWGVjqcqpUtWbQfERFhpxDVhgzxHo8mQHeRCfK9qsUN0y9VoK-bQ-19hl_uUFvDEsjj-zQNgpozn1cwSYPgVe90tQ8rfNNh9ZG5UArp2kfjCiZASrzHY6X5XaBWtoED22ncuS1lnsKCcqqCKBg17UcR9AmOLpz0Y3AMRGenZfYifE4g8--eo-9VwymcuN9DafH0s_aGipf5opHj7Hev-KaI59bgUnBilJerpwnH-Fz9KXCuMn6Qge4lFxysJtwANmVmyM5oxlVB4svhxGMhXueAB7VuyO5QgQshL1pCn5amRP_2nZ_BTBZyobMwOIZzAK2t704ZWNGuwXVS2-NeSODgL9C1T61HSaswprCanEN_rUFwYohHSbOKq4-vxjEpB3PIgJfShq0topMvYoZWMo_oq5vUoxTgK8NYbQeQbYKOWD92smf5iXuU44e89d1qBLZAztocwMQ_t6PB8tyu2PqXX5hDnJcEMCzRUn77Ncg_LX1hv5uKtXIhhMcv1Y-lYBh_QuLUWQzi5XeVnZyP4zso8YjjYfAjbCHhp4IvpYrfZku1uBeCCwqjlpnuzGSlJjrR-MHlRIzxdvtLTjBWNBlfT5zVQt51ClfydXKzjL8hrKHyaJGlDSUC8vCFGXEoQ3n4Y9iV5Ep49b1fID5YmQxpkz0OqpX3Es7tF3LZMvYNCjRADJzWt82tQC889KklvUulmLLNjTX6vjhFXugN_BAHLIysZ7SXcv8NpvUdy6m0IVkVSZ2jv_1LB9tPvJL0YC7SgbmkNDlMZWTtCKwMz1iMBjHRzyh-56l6bcUZe3meuAo4yk7JNWiA8NRFs2aGs41YnKAlcFCOQD1REAlDeJ0CftT5oiARUgn5g4mBSQ_ztrCOukuQ7cOZRnfJJPm93QNXKKJzv1_WNYMNxJo1esKMZVkiyifFzVMJ1_XPtpasKpd0_mbsxgmtr6_3syukbZv_elVriQRfwHemkMKhZdVUnONe1GgfnjPnBcQ1MAkuLpajwH3Efi2jONJlB-wddoBPep2CM787iB3YurNKIu1dRjmOqqgzo4dOVh39F6UYEXuP0KhansXg0GYueLBKf7Yoyd-mOSebvZdqfpqLayYsjQ8lTqKvg3TIgNpa_bIJA54IlA7bxtonCbk6rn5I6-k1mhneM_fBet4__8bAZ_9_i8y42wvWIHQhTguTKMSTLO3NKmWwduDzJXe4uS5oGeJB0WHGtSbjVv98qw5I81tQxaeAB4N3gGoYRaTv-rByieO-ekOzX78peoSA6UqieDmHXvg8nXBBrIrFMYa7GCbRhtNysyOkR7gejiyl8AHwjElsTJzQV8Rdy3kYsaHmmTP9AwU12Q3qCRGpURXkHV6WqMZ3J7iYRlqH2Pc3rzla7i6oPnok1d64Y_YBO-EegpHpb3CfX5ygZRB6o0B1WMA7_MXsIP-6qd1RtN5vBjEaA421pWzIPkXYUuc8iDYIe6_8_4VTk3PhsGnby3xy7DUpsdUyR1tN2V4AAnIi-DDUpk5N_04-Z9CVB52CBXdVRnvXEnPiGg1BTWpK5KDkLmuiQsKMGfh4eS-Lxynltiz87SrQEYK42Ui0VXemZz2ZR7YCxFvAMhRQ2M6c9TvJx3kJSYFmyCuquNXmBqHn8zBGAKJApRteB7A2-nl9EBbmc68q0NeynVFczfIw2rmoPiT7aewUmZkgLlHCScDYM9B-pO4mzD50HGNDIXdJbdRh5BKkdIOCxQ0BWCfrvj1U0aP1D6gAdjztfeQTcDouz677v44hXNqhOENh9gz4tViwa-HEXDtuRjedD0bq3TmBDIJ8niGUne7UsUxX_08rCxSgehEZlWvnqqiwXm-mpn1ngTKbnEya83iL-beDEoyd1LsN_XPqUYQTAq_Zk7zTOotQTvPT3-3A9z6vTlnpQYLQSfqOzU6D22SgMH-WIDPHdzCXz6_Q-L-GymROHnQEgL0q4CDl4erzbq3xV8e4eiGgMyLB1NqZnQFaFrHMkFpdEN7LzsQb6IysSbit5BuZKYNU1voNjd2U5s07Hk3_a6dpizCB3QfHzCAOCPVThkAP3DQ==","rs_0d4acabd15c76513016a6ef74a1434819496f439f90abe0370",{"_506":480},[1006,1007],{"_49":1009,"_96":635},{"_49":1008,"_96":635},"**Designing robust route fetch and logout flow**","**Updating unit tests for abort behavior**",{"_512":1011,"_494":1012,"_473":474,"_496":480},1785657172872,{"_497":1013,"_45":1003,"_566":1014,"_96":568},[],[1009,1008],{"_494":1016,"_473":474,"_496":480},{"_518":1017,"_45":-5,"_501":1018,"_187":-5,"_521":1019,"_96":523},"call_oZHE9i37Ep6o909LW2fdzMmw",{"_506":480},{"_320":1020,"_525":-5},[1021,1022],{"_49":711,"_96":529},{"_49":1023,"_96":529}," });\n});\n\n// #310 — login, bootstrap refresh, explicit refresh, and logout are one browser\n// session state machine. A stale completion (one whose generation was superseded\n// by a later login or an earlier logout) may never commit tokens or state.\ndescribe(\"session generation (#310)\", () => {\n it(\"commits a bootstrap refresh normally when nothing else races it (control)\", async () => {\n clearAccessToken();\n fetchMock.mockResolvedValueOnce(accessResponse(\"bootedToken\"));\n\n await expect(restoreSession()).resolves.toBe(true);\n\n expect(getAccessToken()).toBe(\"bootedToken\");\n expect(onTokens).toHaveBeenCalledTimes(1);\n });\n\n it(\"discards a bootstrap refresh that resolves after logout — the session does not resurrect\", async () => {\n clearAccessToken();\n const refreshGate = deferred();\n fetchMock.mockImplementation((url: string) => {\n if (url.endsWith(\"/auth/refresh\")) return refreshGate.promise;\n if (url.endsWith(\"/auth/logout\")) return Promise.resolve(new Response(null, { status: 204 }));\n throw new Error(`unexpected fetch: ${url}`);\n });\n\n const restoring = restoreSession(); // bootstrap refresh in flight, held open\n await drain();\n expect(callsTo(fetchMock, \"/auth/refresh\")).toHaveLength(1);\n\n await logout(); // user logs out while the bootstrap refresh is still pending\n\n refreshGate.resolve(accessResponse(\"resurrected-token\")); // the stale refresh finally answers\n await expect(restoring).resolves.toBe(false); // discarded — never reports a restored session\n\n expect(getAccessToken()).toBeNull(); // must stay logged out\n expect(onTokens).not.toHaveBeenCalled(); // the stale completion must not fire tokensChanged\n // #310 review — clearing the in-memory token is only half of it. That\n // response carried a rotated refresh cookie, which the browser applied\n // before any of our code ran, so the server session must be revoked too:\n // one revoke for the logout itself, a second for the cookie the discarded\n // refresh issued. Without it a reload walks straight back in.\n expect(callsTo(fetchMock, \"/auth/logout\")).toHaveLength(2);\n });\n\n it(\"commits an explicit login normally when nothing else races it (control)\", async () => {\n clearAccessToken();\n fetchMock.mockResolvedValueOnce(accessResponse(\"loggedInToken\"));\n\n await login({ email: \"a@b.co\", password: \"pw\" });\n\n expect(getAccessToken()).toBe(\"loggedInToken\");\n expect(onTokens).toHaveBeenCalledTimes(1);\n });\n\n it(\"does not let a late bootstrap refresh overwrite a newer explicit login\", async () => {\n clearAccessToken();\n const refreshGate = deferred();\n fetchMock.mockImplementation((url: string) => {\n if (url.endsWith(\"/auth/refresh\")) return refreshGate.promise;\n if (url.endsWith(\"/auth/login\")) return Promise.resolve(accessResponse(\"newLoginToken\"));\n throw new Error(`unexpected fetch: ${url}`);\n });\n\n const restoring = restoreSession(); // older bootstrap refresh in flight\n await drain();\n\n await login({ email: \"a@b.co\", password: \"pw\" }); // a newer, explicit login completes first\n expect(getAccessToken()).toBe(\"newLoginToken\");\n expect(onTokens).toHaveBeenCalledTimes(1);\n\n refreshGate.resolve(accessResponse(\"staleBootstrapToken\")); // the old refresh answers late\n await expect(restoring).resolves.toBe(false); // discarded, not adopted\n\n expect(getAccessToken()).toBe(\"newLoginToken\"); // untouched by the stale refresh\n expect(onTokens).toHaveBeenCalledTimes(1); // still just the login's single notification\n });\n\n it(\"a late-FAILING obsolete refresh does not clear or corrupt a newer session\", async () => {\n // Distinct from the success case above: here the stale refresh's own network\n // call fails (refresh token revoked) — the failure path must be gated too, or\n // it would clearAccessToken()/onUnauthenticated() and boot the fresh login.\n clearAccessToken();\n const refreshGate = deferred();\n fetchMock.mockImplementation((url: string) => {\n if (url.endsWith(\"/auth/refresh\")) return refreshGate.promise;\n if (url.endsWith(\"/auth/login\")) return Promise.resolve(accessResponse(\"freshLoginToken\"));\n if (url.endsWith(\"/stock\")) return Promise.resolve(jsonResponse({ ok: true }));\n throw new Error(`unexpected fetch: ${url}`);\n });\n\n // apiGet with no in-memory token forces currentAccessToken() to park on a\n // silent refresh — the same refresh a bootstrap would trigger.\n const fetching = apiGet<{ ok: boolean }>(\"/stock\").catch((e: unknown) => e);\n await drain();\n\n await login({ email: \"a@b.co\", password: \"pw\" }); // supersedes the still-parked refresh\n expect(getAccessToken()).toBe(\"freshLoginToken\");\n\n refreshGate.resolve(jsonResponse({ title: \"refresh token revoked\" }, 401)); // stale refresh FAILS late\n const settled = await fetching;\n{\n \"name\": \"cluckwork-web\",\n \"private\": true,\n \"version\": \"0.0.0\",\n \"type\": \"module\",\n \"scripts\": {\n \"dev\": \"vite\",\n \"build\": \"tsc -b && vite build\",\n \"verify:sw\": \"node scripts/verify-sw.mjs\",\n \"i18n:scan\": \"node scripts/i18n-scan.mjs\",\n \"typecheck\": \"tsc -b --noEmit\",\n \"test\": \"vitest run\",\n \"test:coverage\": \"vitest run --coverage\",\n \"test:watch\": \"vitest\",\n \"preview\": \"vite preview\"\n },\n \"dependencies\": {\n \"@fontsource-variable/inter\": \"^5.3.0\",\n \"i18next\": \"^26.3.6\",\n \"lucide-react\": \"^1.26.0\",\n \"react\": \"^19.2.8\",\n \"react-dom\": \"^19.2.8\",\n \"react-i18next\": \"^17.0.11\",\n \"react-router\": \"^8.3.0\"\n },\n \"devDependencies\": {\n \"@testing-library/jest-dom\": \"^7.0.0\",\n \"@testing-library/react\": \"^16.3.2\",\n \"@testing-library/user-event\": \"^14.6.1\",\n \"@types/node\": \"^26.1.2\",\n \"@types/react\": \"^19.1.0\",\n \"@types/react-dom\": \"^19.1.0\",\n \"@vitejs/plugin-react\": \"^6.0.4\",\n \"@vitest/coverage-v8\": \"^4.1.10\",\n \"jsdom\": \"^30.0.1\",\n \"typescript\": \"^7.0.2\",\n \"vite\": \"^8.1.5\",\n \"vite-plugin-pwa\": \"^1.3.0\",\n \"vitest\": \"^4.1.10\"\n },\n \"overrides\": {\n \"brace-expansion\": \"5.0.8\"\n }\n}\n{\n \"name\": \"cluckwork-sim-ui\",\n \"private\": true,\n \"version\": \"0.0.0\",\n \"type\": \"module\",\n \"description\": \"Playwright E2E suite (#277/#385) driving the real SPA against the #243 simulation fixture. Deliberately a separate npm project from web/ — see README.md.\",\n \"scripts\": {\n \"test\": \"playwright test\",\n \"test:headed\": \"playwright test --headed\",\n \"test:ui\": \"playwright test --ui\",\n \"report\": \"playwright show-report\",\n \"typecheck\": \"tsc --noEmit\"\n },\n \"devDependencies\": {\n \"@playwright/test\": \"^1.62.1\",\n \"@types/node\": \"^26.1.2\",\n \"typescript\": \"^7.0.2\"\n }\n}\n",{"_512":1025,"_494":1026,"_473":474,"_496":480},1785657158054,{"_534":1023,"_535":1027,"_537":1028,"_539":540,"_478":35,"_541":35,"_45":1029,"_543":1030,"_545":546,"_487":117,"_96":547},"/bin/bash -lc \"sed -n '910,1010p' web/src/api/client.test.ts; cat web/package.json; cat tools/simulation/ui/package.json\"",[1031,1032,1033],"exec-c7232ea2-ba53-422a-a9e4-099234781caa","60308",{"_535":1040,"_187":1041,"_166":921,"_96":1037},{"_535":1038,"_187":1035,"_166":1039,"_96":1037},{"_535":1034,"_187":1035,"_166":1036,"_96":1037},"cat tools/simulation/ui/package.json","package.json","/workspace/cluckwork/tools/simulation/ui/package.json","read","cat web/package.json","/workspace/cluckwork/web/package.json","sed -n '910,1010p' web/src/api/client.test.ts","client.test.ts",{"_494":1043,"_473":474,"_496":480},{"_518":1017,"_45":1044,"_554":1045,"_501":1046,"_187":557,"_558":-5,"_487":117,"_96":559},"ctc_0d4acabd15c76513016a6ef74505c8819483806edfc46c5576","const r = await tools.exec_command({cmd:\"sed -n '910,1010p' web/src/api/client.test.ts; cat web/package.json; cat tools/simulation/ui/package.json\",\"workdir\":\"/workspace/cluckwork\",\"yield_time_ms\":10000,\"max_output_tokens\":16000}); text(r.output)\n",{"_506":480},{"_494":1048,"_473":474,"_496":480},{"_497":-5,"_562":1049,"_45":1050,"_501":1051,"_566":1052,"_96":568},"gAAAAABqbvdFXmDH8XlkhDopLhfp6FR-Dn4sYrasy9iJHKRYGsoInzSj3yiYEfefWaxeZ39UCiCv0gzD9a9IysjzybBN55hzqXH0Ck_84Az0OA-oma80kWjlh9acwY6ICnrxcmtbZK4FslPQC55kvs416cQEY2sgeb92Q137IgFGTzvAQRjEue3Rxh2tm7OT5KZ65keqyesU-zgAEXkcxMkRP8jm2uThhK2ivQ95gs9eIEhUewLbfphlmx61sI0ZyaZuV8nTJpn5U1Fxk4LtyrZJ1wJGiz8AWASq_7ugMizsuDed8fwfF_4wsh8bxu09uWyZGdsRJOTG_4zpsvWPZE-qToOAqjgcU7Ua_k1oRN-O8dlaw0Pitf4XIrzDUEF5m72XL7SLJQwcoNLhI4GzHvTCThvG6ZVT0Edg1JOreec1BlmyJcH0sPxkygm-Mm8enIlozFkBnAfdN69-VVeb_W5quiLGbslItTiyskttKLakKQg1rBckspSFyA658gSeNMZMB67C0N42FgUSUBCBClKabdRbj5WbGP2oZCl1sM3izgWYaciEmHxTTfSk-7Yz2pFWEhkMc4CXhnDV8UuTpnXdgefmH8oICMKReNy-kKZeQqr8dHQ5_aFufvLKEf5TBCUKbgtD97Fcjijd9l-S1SjcPblxHGIhQMhv5WsOSmN-tzps8Lz9o5gvCMa_vPB73luMtPKPfPHIMRL-VroVFIl6fhSa7M8Ql8Q4P-F3e3QZSwwkWlmcDXXada7XXC6rMGNXihe4PPAy_CW0nfGtIxAiUSQLr6HMg8TNBR3P5GOPAVeGhEmzrtncXg4kKFSzIQ2Dfqkn46ntDOJDZpcBBLo3z_0I7BHmvanhdbWAIT0LJp--vRRUDWPv-s5mU2Lw1F0-FqvmpF9XeLX-5SENKI97o9Yej2XnmOKBjAvAGoqdINkGdTmfsZxfHlXEX5m2o-XEVkVokKi5C8nCwFUORD23rgCX2Tz4LLvbJ0AIY6ikqre3HKtqIgW1mh4wfvvsXn1rnEstR15vaoPYUfZ1w6TAsMu0aLIjpXi9YPDb56vriUMR05-hJu4-EswQTxZqRbOU9U-k8I6SomnvCg2mF9aXZ1DyubXokCHVThEmJb81Q7elR54STACerY4gHHDAg3fXvTrODdAXg42cgdcdVSmSTltjheK_4oUIp_30z8wF_-PgXlY0HsiP8vSv3BoCcPCO-1KPElfeROL7_LYPTsvxM92XxrZe-CP-OFD05gGH7imwlJQCivzQr1vGrRiPipbTigB4qHbzGu4VXZtoTf29BlwXuvcpA85GvUi-SshsSzs7LKi9sFLDdyRLvw8LtRz7HCmu3DMIxFwEFsUmkicZnDDJ6lPP_fXSvz9P8wuQCZHhDMkdnkbXPZZPKxhM9HJ9nxYdzzq_aYAlnUldndKgwfm0xPzfNYTzpL3nBz1uWBU2h8K2SyCeTGwC7w0ASD1rzHXcQ2FQYvmOCY005G5vo9o01yJrevE20naBKKrhpEPXFzxv58Be4cHwPEVpKR1iV_EU28yg0NLutyuAXJhef71zbzKq5LtDO0ns0J-LSmpttu60EziaN1EexX4SdRA87Qj4WDkRVHb3HYhA_rM-DPoRrb2n-oBB0S4aeZVFCOk0m5hSmCyBAT1OcTGPjeI5EYUsm8gWa35Cta6SAckkiwRk9yXm1y2XB3LtalWc8w1O0psUHfSazwJ8IhRNi2mTEVrujKVrk2QkxllsHSMdA48HoNUxKg==","rs_0d4acabd15c76513016a6ef73ed1248194862e8ad66c2fe99e",{"_506":480},[1053],{"_49":1054,"_96":635},"**Investigating route abort behavior**",{"_512":1056,"_494":1057,"_473":474,"_496":480},1785657157048,{"_497":1058,"_45":1050,"_566":1059,"_96":568},[],[1054],{"_494":1061,"_473":474,"_496":480},{"_518":1062,"_45":-5,"_501":1063,"_187":-5,"_521":1064,"_96":523},"call_biMqZ0NTLjkOrRIDqW79xsUG",{"_506":480},{"_320":1065,"_525":-5},[1066,1067],{"_49":583,"_96":529},{"_49":710,"_96":529},{"_512":1069,"_494":1070,"_473":474,"_496":480},1785657148854,{"_715":1071,"_45":1072,"_487":117,"_96":718},[1073,1074,1075,1076],"exec-21e5e237-b1d2-422a-9281-108db5187044",{"_331":1085,"_9":1086,"_166":1087},{"_331":1082,"_9":1083,"_166":1084},{"_331":1080,"_9":1081,"_166":722},{"_331":1077,"_9":1078,"_166":1079},"@@ -167,2 +167,7 @@\n const generation = ++sessionGeneration;\n+ // A bootstrap refresh can rotate the shared HttpOnly cookie even though its\n+ // JavaScript result is rejected by the generation check below. Cancel it\n+ // before starting the explicit login so its late Set-Cookie cannot overwrite\n+ // the cookie belonging to the session the user deliberately chose.\n+ abortInFlightRefresh?.();\n // The server sets the HttpOnly refresh cookie; the body returns only the\n",{"_723":-5,"_96":724},"/workspace/cluckwork/web/src/api/client.ts","@@ -42,3 +42,6 @@\n await new Promise((r) => setTimeout(r, HOLD_MS));\n- await route.continue();\n+ // Logout normally aborts an in-flight refresh as an optimisation. Keep\n+ // this response alive so the test exercises the generation guard rather\n+ // than passing merely because the network request was cancelled.\n+ await route.continue({ headers: route.request().headers() });\n });\n@@ -153,2 +156,9 @@\n await expect(nav.link(\"nav:customers\")).toBeVisible();\n+\n+ // The browser applies Set-Cookie before client code can reject a stale\n+ // response. Reload to prove the durable cookie also belongs to Sales, not\n+ // merely the in-memory access token used by the assertions above.\n+ await page.reload();\n+ await expect(nav.link(\"nav:sales\")).toBeVisible();\n+ await expect(nav.link(\"nav:audit\")).toBeHidden();\n });\n",{"_723":-5,"_96":724},"@@ -53,5 +53,7 @@\n if (!REPORT_PATH.test(res.url())) return;\n+ const url = new URL(res.url());\n+ if (url.searchParams.get(\"from\") !== from || url.searchParams.get(\"to\") !== to) return;\n const t = res.request().timing();\n timings.push({\n- path: new URL(res.url()).pathname,\n+ path: url.pathname,\n status: res.status(),\n",{"_723":-5,"_96":724},"/workspace/cluckwork/tools/simulation/ui/specs/reports-range.spec.ts","@@ -90,3 +90,8 @@\n // The switch, made the way a user makes it.\n+ const persisted = page.waitForResponse((response) =>\n+ response.url().includes(\"/api/v1/me/language\")\n+ && response.request().method() === \"PUT\",\n+ );\n await selector.selectOption(lang);\n+ expect((await persisted).ok(), `the ${lang} preference was not persisted`).toBe(true);\n \n@@ -109,2 +114,11 @@\n \n+ // A local i18next change is optimistic. Reload so the preference must be\n+ // recovered from the server rather than surviving only in component\n+ // memory.\n+ await page.reload();\n+ await expect(page.locator(\"html\")).toHaveAttribute(\"lang\", lang);\n+ await expect(\n+ page.getByRole(\"link\", { name: t(lang, \"nav:reports\"), exact: true }),\n+ ).toBeVisible();\n+\n // And the screens still WORK in that language — the point of #277's \"not\n",{"_723":-5,"_96":724},"/workspace/cluckwork/tools/simulation/ui/specs/i18n.spec.ts",{"_494":1089,"_473":474,"_496":480},{"_518":1062,"_45":1090,"_554":1091,"_501":1092,"_187":557,"_558":-5,"_487":117,"_96":559},"ctc_0d4acabd15c76513016a6ef72baa7c8194b77b83801fb467b9","const patch = \"*** Begin Patch\\n*** Update File: /workspace/cluckwork/web/src/api/client.ts\\n@@\\n export async function login(body: LoginRequest): Promise {\\n@@\\n const generation = ++sessionGeneration;\\n+ // A bootstrap refresh can rotate the shared HttpOnly cookie even though its\\n+ // JavaScript result is rejected by the generation check below. Cancel it\\n+ // before starting the explicit login so its late Set-Cookie cannot overwrite\\n+ // the cookie belonging to the session the user deliberately chose.\\n+ abortInFlightRefresh?.();\\n*** Update File: /workspace/cluckwork/tools/simulation/ui/specs/session-races.spec.ts\\n@@\\n await page.route(\\\"**/api/v1/auth/refresh\\\", async (route) => {\\n await new Promise((r) => setTimeout(r, HOLD_MS));\\n- await route.continue();\\n+ // Logout normally aborts an in-flight refresh as an optimisation. Keep\\n+ // this response alive so the test exercises the generation guard rather\\n+ // than passing merely because the network request was cancelled.\\n+ await route.continue({ headers: route.request().headers() });\\n@@\\n await expect(nav.link(\\\"nav:customers\\\")).toBeVisible();\\n+\\n+ // The browser applies Set-Cookie before client code can reject a stale\\n+ // response. Reload to prove the durable cookie also belongs to Sales, not\\n+ // merely the in-memory access token used by the assertions above.\\n+ await page.reload();\\n+ await expect(nav.link(\\\"nav:sales\\\")).toBeVisible();\\n+ await expect(nav.link(\\\"nav:audit\\\")).toBeHidden();\\n });\\n });\\n*** Update File: /workspace/cluckwork/tools/simulation/ui/specs/reports-range.spec.ts\\n@@\\n- page.on(\\\"response\\\", (res) => {\\n- if (!REPORT_PATH.test(res.url())) return;\\n+ page.on(\\\"response\\\", (res) => {\\n+ if (!REPORT_PATH.test(res.url())) return;\\n+ const url = new URL(res.url());\\n+ if (url.searchParams.get(\\\"from\\\") !== from || url.searchParams.get(\\\"to\\\") !== to) return;\\n const t = res.request().timing();\\n timings.push({\\n- path: new URL(res.url()).pathname,\\n+ path: url.pathname,\\n*** Update File: /workspace/cluckwork/tools/simulation/ui/specs/i18n.spec.ts\\n@@\\n // The switch, made the way a user makes it.\\n- await selector.selectOption(lang);\\n+ const persisted = page.waitForResponse((response) =>\\n+ response.url().includes(\\\"/api/v1/me/language\\\")\\n+ && response.request().method() === \\\"PUT\\\",\\n+ );\\n+ await selector.selectOption(lang);\\n+ expect((await persisted).ok(), `the ${lang} preference was not persisted`).toBe(true);\\n@@\\n await expect(page.locator(\\\"html\\\")).toHaveAttribute(\\\"lang\\\", lang);\\n+\\n+ // A local i18next change is optimistic. Reload so the preference must be\\n+ // recovered from the server rather than surviving only in component\\n+ // memory.\\n+ await page.reload();\\n+ await expect(page.locator(\\\"html\\\")).toHaveAttribute(\\\"lang\\\", lang);\\n+ await expect(\\n+ page.getByRole(\\\"link\\\", { name: t(lang, \\\"nav:reports\\\"), exact: true }),\\n+ ).toBeVisible();\\n*** End Patch\";\ntext(await tools.apply_patch(patch));\n",{"_506":480},{"_494":1094,"_473":474,"_496":480},{"_497":-5,"_562":1095,"_45":1096,"_501":1097,"_566":1098,"_96":568},"gAAAAABqbvcrOQMkS_OgIb_WTFne1O4M-Mgi3gXowe8pvt_SCoU9GAbsAckuMG5k-A_k7kHaHV0NYfd7hNTI55rRHioWJUQ6as2zDyIAcp44TUjvbuSXZCPix7WSd7LRTH8-bCCQlQPDA01BxjkR3gQc5tnZ6isytipe045qbj_if5pykeLyy_cV5rcw0cgedTg2ftTUoswSAAYGHCp5dF4ZCsu-1DNNTP4ahr1Prr05KZIkxHGnKMIqvKn71AQd9Dg0mfKP4HAntN2m8cqPtdLO_mPvXp81qBd4avaoB4R-SOr0uDBGNqN1WAFBIRmJaejKIbnntUxCkTI43G5GTm9tAergerkNtTB8-hcHCT74tJU209W00GAgqJbP__pggfo8jnghh_07oDgP9FGIx33IlAYY3tzcdOHqdIXZHbKV2vWKkl_QQcLXq2Jk0Vq6IRFNn9Xjyxnf3xaH39bWeBPkAFX_QmosePt4KCakpZ7jYEHLAQ8yLjvfHtw5U-d-9399j83kiw3KWVlYHMP10lxjFfbNfkQGJ-37osEWwEz9u4WVO-7KwhFLl_AW9iLheR23LBZyJndazGhuCH62cH37HjqY9_tiZxDa6W0L4R1M-f82YTzbC4l0vUyPVNJ-COokLyyWe513Azd7n_EAzsFppQw8oZluP_UAda6Sd3pq8jXO44tdNXEy4fhhTjrqfc5048GF_SDWF1HjYmdn50luygZAC6CJ-34S6lAWDzadQiHtd2xj_Wwn3asz4JM8TeQZBC8O06_E3XyAxZ-2WvnZvDgh6Vdv3d9s7JZuP4P1g7EY_DfzMMWfvpWKlENc1gnnsszhrdaWNSzsrgr0xPaephSOaTgF37UypmmgeK986Y6Wv03YcQDX7yOOLeJ9fgjfD5kS2ovorJWpRtZiM3yuME2uXWVR5vTcR-GcV4KqZwZkzVM_sTho65JPLlCJkifn5qXkjNZeAVRHqbyA_BZRAW5ulR0tVeFqao5tRcPZlks9DJ1Lysgmm-T6lms20pLl8S7hX-CNpI5HGzpgkW5S1ul5q6fv3CtBOO5wBK0-9OguKv9IhChs4xV7gUzKjlkkjBIpaVsgqb0eN-hwmugL17qMgFpCjGLqZLZ99GAHwCGkGHX1veJppd8C-vh3HDb6kMzY4yFl9XtX0eJt1odFMZzoZmcU_jvUrRZCxNt8moHQkYntC0phJTxIaDwOHvM8R0Vba-8k4xPdXLm1mdKn5QsUXVZIcTyR4fmT85xgnjmKWivRk28=","rs_0d4acabd15c76513016a6ef728b8d88194b39afe7e5afec8dd",{"_506":480},[1099],{"_49":1100,"_96":635},"**Implementing modifications with test updates**",{"_512":1102,"_494":1103,"_473":474,"_496":480},1785657131690,{"_497":1104,"_45":1096,"_566":1105,"_96":568},[],[1100],{"_494":1107,"_473":474,"_496":480},{"_518":1108,"_45":-5,"_501":1109,"_187":-5,"_521":1110,"_96":523},"call_ML2IlbWzdBbt7atmQ9bjjDhI",{"_506":480},{"_320":1111,"_525":-5},[1112,1113],{"_49":530,"_96":529},{"_49":1114,"_96":529},"9:// #145 — refresh/logout ride the HttpOnly refresh cookie; this custom header\n30:// Called when the session is unrecoverable (refresh failed). AuthContext wires\n37:// Called whenever a new token pair is saved (login or transparent refresh).\n122:// #310 — login, the load-time bootstrap refresh, an explicit (401-triggered)\n123:// refresh, and logout are treated as ONE browser-session state machine, not\n142:// rotates the refresh cookie (/auth/login and /auth/refresh both do). The\n144:// code runs, so a login that lands after logout leaves a VALID HttpOnly refresh\n146:// restoreSession() and the session the user ended comes back.\n159: console.error(\"discarded response: revoking its refresh cookie failed\", err);\n165: // flight (a bootstrap refresh, say), so its resolution must be the one that\n168: // The server sets the HttpOnly refresh cookie; the body returns only the\n176: // set a refresh cookie, so revoke it too, not just the in-memory token.\n187:// swap in the returned access token; the rotated refresh cookie is set by the\n193:// rotated Set-Cookie — leaving the client holding a revoked refresh cookie\n199: // #310 — this is a token-store writer like login/refresh, so it needs the\n206: // This response rotates the refresh cookie too, so a discarded one needs that\n226:// refresh-and-retry every 401 triggers. That is only safe because the server\n231:// halving the server's five-attempt account lockout and rotating the refresh\n240: // login/refresh does later. Also cancel any refresh currently in flight —\n241: // note this only reaches a refresh that has already been GRANTED the\n247: // discarded on arrival by the generation check in refreshTokens().\n256: // Cookie-authenticated: the HttpOnly refresh cookie rides along and the CSRF\n261: // #336 — the bearer is sent too, when this tab still has one. The refresh\n284:// #169 — serialise refresh across tabs. The refresh token lives only in the\n285:// shared HttpOnly cookie (#145), so two tabs refreshing at once each present the\n288:// Locks API lets only one tab refresh at a time: the next tab runs its refresh\n295:// atomic): if a tab is closed in the sub-second between sending a refresh and\n298:// full fix needs an idempotent server refresh — tracked in #176.\n299:const REFRESH_LOCK = \"cluckwork.auth.refresh\";\n302:// timeout, so a hung /auth/refresh would otherwise keep the lock — and every\n303:// other tab's refresh — parked indefinitely (#169 review). On timeout we abort,\n307:// #310 — the abort handle of whichever refresh attempt is currently running\n314: const controller = new AbortController();\n326:// Single-flight refresh: concurrent 401s (and the load-time bootstrap) share one\n327:// in-flight refresh call. The refresh token rides the cookie; no body is sent.\n329:// serialises whatever refresh each tab still needs against the other tabs.\n330:let refreshInFlight: Promise | null = null;\n332:async function refreshTokens(): Promise {\n333: if (refreshInFlight) return refreshInFlight;\n340: refreshInFlight = withRefreshLock((signal) =>\n341: raw(\"/auth/refresh\", {\n349: // A SUCCESSFUL refresh rotated the cookie before we got here, so a\n361: // a late success: the real error (e.g. a genuinely revoked refresh\n363: // revoke here — a failed refresh issued no cookie to revoke.\n368: refreshInFlight = null;\n371: return refreshInFlight;\n375:// after a reload — try one silent refresh against the cookie. Resolves true if a\n377:export async function restoreSession(): Promise {\n379: await refreshTokens();\n386:// --- Authenticated request with one transparent refresh-and-retry ---------\n427:// refresh-and-retry as apiPut, but the body goes up as it is instead of being\n454:// File download with the same auth + one transparent refresh-and-retry as\n465: const refreshed = await refreshTokens();\n466: return await rawBlob(path, refreshed);\n467: } catch (refreshErr) {\n469: if (refreshErr instanceof StaleSessionError) {\n474: if (isTransientRefreshFailure(refreshErr)) throw refreshErr;\n505: const refreshed = await refreshTokens();\n506: return await raw(path, init, refreshed);\n507: } catch (refreshErr) {\n511: if (refreshErr instanceof StaleSessionError) {\n516: if (isTransientRefreshFailure(refreshErr)) throw refreshErr;\n524:// The in-memory access token, or one obtained via a silent refresh when memory\n531: return await refreshTokens();\n543:// #310 review — resolve a discarded refresh against whatever superseded it.\n557:// A refresh failure is \"transient\" when the session is likely still valid, so we\n561:// refresh; the cookie is untouched, so the next attempt can still succeed.\n562:// - StaleSessionError (#310): the refresh belonged to an obsolete generation\n //\n // #336 — the bearer is sent too, when this tab still has one. The refresh\n // cookie is per-origin (one per browser, last login wins) while this store\n // is per-tab, so the cookie can belong to a DIFFERENT user than the one\n // logging out here; without the bearer the server would revoke that other\n // user's step-up grants and leave this user's alive. It stays OPTIONAL —\n // the endpoint is AllowAnonymous, so an already-expired token just leaves\n // the call unauthenticated and the cookie path still ends the session, and\n // the server exempts /auth/logout from the Idempotency-Key requirement so\n // authenticating it does not make the request need one.\n await raw(\n \"/auth/logout\",\n { method: \"POST\", headers: { [CSRF_HEADER]: \"1\" } },\n bearer ?? undefined,\n );\n } catch (err) {\n // Best-effort revoke: the in-memory token is already cleared above and this\n // failure can never reverse that. Still surfaced (not silently swallowed,\n // #310) so an operator can see the server-side session may be un-revoked —\n // logged, never the (already-cleared) token itself.\n console.error(\"logout: server-side session revoke failed\", err);\n }\n}\n\n// #169 — serialise refresh across tabs. The refresh token lives only in the\n// shared HttpOnly cookie (#145), so two tabs refreshing at once each present the\n// SAME cookie value; the second hits an already-rotated token, the server reads\n// that as a replay and revokes the whole family — logging BOTH tabs out. The Web\n// Locks API lets only one tab refresh at a time: the next tab runs its refresh\n// only AFTER the first has rotated the cookie, so it presents the fresh token,\n// not a replay. Server-side reuse-detection stays strict (unchanged). Browsers\n// without navigator.locks (older Safari, insecure origins) degrade to per-tab\n// single-flight only: no cross-tab guarantee, but never worse than before #169.\n//\n// Residual (a page-owned lock cannot make server rotation + cookie receipt\n// atomic): if a tab is closed in the sub-second between sending a refresh and\n// receiving the rotated cookie, the lock auto-releases while the cookie is still\n// the old value, so the next tab can still trip reuse-detection. Narrow, but a\n// full fix needs an idempotent server refresh — tracked in #176.\nconst REFRESH_LOCK = \"cluckwork.auth.refresh\";\n\n// Cap how long one tab may hold the cross-tab lock. fetch() has no default\n// timeout, so a hung /auth/refresh would otherwise keep the lock — and every\n// other tab's refresh — parked indefinitely (#169 review). On timeout we abort,\n// which releases the lock; the aborting tab recovers on its next request.\nconst REFRESH_TIMEOUT_MS = 15_000;\n\n// #310 — the abort handle of whichever refresh attempt is currently running\n// (if any), so logout() can cancel it outright rather than only waiting for\n// the generation check below to discard its result on arrival.\nlet abortInFlightRefresh: (() => void) | null = null;\n\nfunction withRefreshLock(run: (signal: AbortSignal) => Promise): Promise {\n const attempt = () => {\n const controller = new AbortController();\n abortInFlightRefresh = () => controller.abort();\n const timer = setTimeout(() => controller.abort(), REFRESH_TIMEOUT_MS);\n return run(controller.signal).finally(() => {\n clearTimeout(timer);\n abortInFlightRefresh = null;\n });\n };\n const locks: LockManager | undefined = globalThis.navigator?.locks;\n return locks ? (locks.request(REFRESH_LOCK, attempt) as Promise) : attempt();\n}\n\n// Single-flight refresh: concurrent 401s (and the load-time bootstrap) share one\n// in-flight refresh call. The refresh token rides the cookie; no body is sent.\n// The per-tab latch dedupes within a tab; the cross-tab Web Lock (above) then\n// serialises whatever refresh each tab still needs against the other tabs.\nlet refreshInFlight: Promise | null = null;\n\nasync function refreshTokens(): Promise {\n if (refreshInFlight) return refreshInFlight;\n\n // #310 — captured once, at the START of this flight. Checked again at\n // settlement (success or failure) so a logout/login that lands WHILE this\n // network call is in the air discards its outcome instead of committing it.\n const generation = sessionGeneration;\n\n refreshInFlight = withRefreshLock((signal) =>\n raw(\"/auth/refresh\", {\n method: \"POST\",\n headers: { [CSRF_HEADER]: \"1\" },\n signal,\n }),\n )\n .then(\n async (res) => {\n // A SUCCESSFUL refresh rotated the cookie before we got here, so a\n // discarded one leaves live credentials in the browser — revoke them.\n if (sessionGeneration !== generation) {\n await revokeSupersededCookie();\n throw new StaleSessionError();\n }\n setAccessToken(res.accessToken);\n onTokensChanged?.();\n return res.accessToken;\n },\n (err: unknown) => {\n // A late FAILURE from an obsolete generation is discarded the same as\n // a late success: the real error (e.g. a genuinely revoked refresh\n // token) might otherwise tear down a newer, still-valid session. No\n // revoke here — a failed refresh issued no cookie to revoke.\n throw sessionGeneration !== generation ? new StaleSessionError() : err;\n },\n )\n .finally(() => {\n refreshInFlight = null;\n });\n\n return refreshInFlight;\n}\n\n// Session bootstrap (page load): the access token is memory-only, so it's gone\n// after a reload — try one silent refresh against the cookie. Resolves true if a\n// session was restored, false if unauthenticated (→ clean login, no error flash).\nexport async function restoreSession(): Promise {\n try {\n await refreshTokens();\n return true;\n } catch {\n return false;\n }\n}\n\n// --- Authenticated request with one transparent refresh-and-retry ---------\n\nexport function apiGet(path: string): Promise {\n return apiFetch(path, { method: \"GET\" });\n}\n\n// Writes require an Idempotency-Key (server middleware): a retry with the same\n// key replays the original response instead of repeating the side effect.\n// Callers retrying a logical mutation after an ambiguous failure should pass\n// the SAME key so the server dedupes instead of repeating the write.\n//\n// #308 — extraHeaders is how CreateUser/SetUserPassword attach the\n// X-Cluckwork-Step-Up header for a sensitive operation; every other caller\n// omits it.\nexport function apiPost(\n111: fetchMock.mockResolvedValueOnce(jsonResponse({ title: \"no cookie\" }, 401)); // the bootstrap refresh\n871: it(\"aborts and releases the lock if a refresh hangs past the timeout (no cross-tab starvation)\", async () => {\n875: // A hung server: the fetch never resolves on its own — only the abort signal\n880: init.signal?.addEventListener(\"abort\", () =>\n889: // The timeout aborted the fetch and released the lock: the promise settles\n890: // (does not hang forever) — restoreSession catches the abort and reports no\n913:// #310 — login, bootstrap refresh, explicit refresh, and logout are one browser\n917: it(\"commits a bootstrap refresh normally when nothing else races it (control)\", async () => {\n927: it(\"discards a bootstrap refresh that resolves after logout — the session does not resurrect\", async () => {\n936: const restoring = restoreSession(); // bootstrap refresh in flight, held open\n940: await logout(); // user logs out while the bootstrap refresh is still pending\n965: it(\"does not let a late bootstrap refresh overwrite a newer explicit login\", async () => {\n974: const restoring = restoreSession(); // older bootstrap refresh in flight\n1002: // silent refresh — the same refresh a bootstrap would trigger.\n",{"_512":1116,"_494":1117,"_473":474,"_496":480},1785657126652,{"_534":1114,"_535":1118,"_537":1119,"_539":540,"_478":35,"_541":35,"_45":1120,"_543":1121,"_545":546,"_487":117,"_96":547},"/bin/bash -lc \"rg -n \\\"AbortController|refreshFlight|restoreSession|refresh\\\" web/src/api/client.ts | head -80; sed -n '260,400p' web/src/api/client.ts; rg -n \\\"bootstrap|abort\\\" web/src/api/client.test.ts | tail -40\"",[1122,1123,1124],"exec-74eeceed-05bc-486f-99c5-662688c0ba3e","11116",{"_535":1131,"_166":1130,"_1126":1132,"_96":1128},{"_535":1129,"_187":1130,"_166":1079,"_96":1037},{"_535":1125,"_166":1041,"_1126":1127,"_96":1128},"rg -n 'bootstrap|abort' web/src/api/client.test.ts","query","bootstrap|abort","search","sed -n '260,400p' web/src/api/client.ts","client.ts","rg -n 'AbortController|refreshFlight|restoreSession|refresh' web/src/api/client.ts","AbortController|refreshFlight|restoreSession|refresh",{"_494":1134,"_473":474,"_496":480},{"_518":1108,"_45":1135,"_554":1136,"_501":1137,"_187":557,"_558":-5,"_487":117,"_96":559},"ctc_0d4acabd15c76513016a6ef723e1c8819496ce24d0e5d8e31a","const r = await tools.exec_command({cmd:\"rg -n \\\"AbortController|refreshFlight|restoreSession|refresh\\\" web/src/api/client.ts | head -80; sed -n '260,400p' web/src/api/client.ts; rg -n \\\"bootstrap|abort\\\" web/src/api/client.test.ts | tail -40\",\"workdir\":\"/workspace/cluckwork\",\"yield_time_ms\":10000,\"max_output_tokens\":12000}); text(r.output)\n",{"_506":480},{"_494":1139,"_473":474,"_496":480},{"_497":-5,"_562":1140,"_45":1141,"_501":1142,"_566":1143,"_96":568},"gAAAAABqbvcjIONy1MgUPfiA7vy1zCmaVF0fIMtsy4jnRQ3mX46HrAn8acBAnrOkQnIjRYJDY4w8MP8zVE0MzXJvbVbBR2cX2KVCNYAGmymMXDO3EwJOECdhzxywBOM8Z7Us_sgK-eUA7WxwYq4XL49kvG57C4Hi63psXezjbHkIdVSVzN5EDnegPT99DqHyIj1JRlCeguDc5D1N8tWV1IEt-tzDm1IWfYr3j7vAnlm1rYtJLyQFlNcOVo9Xsddk0tHE-mIW30dtQ3WtcpxFbJgvRpuF8ipHpLq8bpHKylEQyREF9neP2JTYlDQN-XHAN0IjnF3S5kfhgyi4GOS4QOgk__Q0YmiWiaXrZHYeAp3yJQBy8xQrrXGNvdOaFGFL1HScZsZWr87_XDg6TfWe0J5y6P8FcTR_ccr-Fk7N-ZYINoZY0YRyG1WUrGz38CCUFo9NrEVBUz8BBPXBpjRt-CCVKE2jOJW-pmWl958AcIZknd7WYJoAYRBbJZ24QC-8puYKnTerlQdZJeEP0tL8vpa8HqcF1clnziIwi4-eHgQbsqyadx1OtoqG995z5Pyc760-hy53LCWJiEC5S5SZnDvyn8BF50aOwHkvf4com577ZCOeujE_RZHBKegIwMJxqPyFpuBLY-b1TyXigmgeXMZkf6dh3jGsjN3aIfd6LE8zTuUERLBv8CICeRl_qa1DaBRKDW4vyGvkx4fCUhgVGRY_xEmVuVMcznF03v-A---kUEByEpb7Slm6-J_G11IgzWYfPy3-HJJM-YyO22D4ia9FOS5x7pwkGzSqtaJT7MVLAD20pTH8PAt0lMne9NWbAkAkuMTsMySVdKGlOcWzBguPI3q0BWxo7YzuadunGIZcWJ17wZc-MqqQN6itkO18rpZ8jcQJNsqa_FJSVVs4KVqIeH73g4QfD7WifirS9BhGqQiFQ2nHFEoXsbXkRsEl_dDbVyxZThJAbv1UVgbhowV12tUfH2vybIhVIqooU-hOn3-XlLkwy0w_5zLpTy1FqPEOKjpg3jHvxOpm7q4-MKQV8YcmzsA33_wORUTughwRtfn7zW3eaDvvDsQD9iY43litze4nqtTVYBKens_6tBNk46XAQZv79zcaUgFLkS-hJnLDvFxES0HCB3n5vMPd4-OxK4cOhwhj20Di5Xc9bZW1UQdMsCcQcfutR7pzVnxOE7LyNoVxjNIM1GrU5-X0eqr4zvp6X0MDVu5HNVNfNESfO88UykXjtcB-koSZt2Lm6Z7nc8m2YtxtOI63L9M-Ymo4k2C1fNv9KYl7byr0F9YgJjGX4oJ2YcX5LCA7gLyrBR34NKYWULUgtspF2LredtOy9dERj6sP","rs_0d4acabd15c76513016a6ef720d15c8194ae7b46fd22a9971a",{"_506":480},[],{"_512":1145,"_494":1146,"_473":474,"_496":480},1785657123913,{"_497":1147,"_45":1141,"_566":1148,"_96":568},[],[],{"_494":1150,"_473":474,"_496":480},{"_518":1151,"_45":-5,"_501":1152,"_187":-5,"_521":1153,"_96":523},"call_ZgsrtvoezS7jNkaXrTADsMFH",{"_506":480},{"_320":1154,"_525":-5},[1155,1156],{"_49":530,"_96":529},{"_49":1157,"_96":529},"// #310 acceptance — the two session-generation races, driven in a real browser.\n//\n// #310 is CLOSED; this is the end-to-end regression layer for it, not the fix.\n// The fix is `sessionGeneration` in `web/src/api/client.ts`: a module-level\n// counter that `login()` and `logout()` bump, captured before each await and\n// re-checked on settlement, so a superseded completion is discarded\n// (`StaleSessionError`) instead of committing tokens.\n//\n// ================== WHY A BROWSER IS THE RIGHT INSTRUMENT ==================\n//\n// Both races are about what happens to a REAL in-flight fetch when the user does\n// something else mid-flight. A unit test can assert the counter's arithmetic; it\n// cannot tell you whether the user ends up looking at somebody else's farm. The\n// assertions below are therefore all about the resulting SCREEN — which session\n// the browser is actually in — not about a counter or a request.\n//\n// ================== HOW THE RACE IS MADE DETERMINISTIC ==================\n//\n// `page.route` holds the refresh request open for a fixed window, so \"in flight\"\n// is a state the spec controls rather than one it hopes to hit. The alternative,\n// firing both actions and hoping the interleaving lands, is a spec that passes\n// most of the time for the wrong reason — and this is precisely the class of bug\n// where \"passed 9 times out of 10\" means \"did not test it 9 times out of 10\".\n\nimport { expect, test } from \"../src/fixtures\";\nimport { castMember, owner } from \"../src/cast\";\nimport { tEn } from \"../src/i18n\";\n\n/** How long a held refresh stays in flight. Long enough to act inside, short enough to run. */\nconst HOLD_MS = 3_000;\n\ntest.describe(\"#310 session races\", () => {\n test(\"a logout during an in-flight refresh cannot be resurrected by the late response\", async ({\n page,\n signIn,\n nav,\n }) => {\n await signIn(owner());\n\n // Hold every refresh open for HOLD_MS.\n await page.route(\"**/api/v1/auth/refresh\", async (route) => {\n await new Promise((r) => setTimeout(r, HOLD_MS));\n await route.continue();\n });\n\n // Provoke a refresh by injecting one 401 (same one-shot technique as\n // session-refresh.spec.ts). The refresh it triggers is now held open.\n let injected = false;\n await page.route(\"**/api/v1/**\", async (route) => {\n const url = route.request().url();\n if (injected || url.includes(\"/auth/\")) {\n await route.fallback();\n return;\n }\n injected = true;\n await route.fulfill({\n status: 401,\n contentType: \"application/problem+json\",\n body: JSON.stringify({ title: \"Unauthorized\", status: 401 }),\n });\n });\n\n await nav.link(\"nav:reports\").click();\n // Do NOT await the refresh here — the whole point is to act while it is\n // still outstanding.\n await page.waitForRequest((r) => r.url().includes(\"/api/v1/auth/refresh\"));\n\n // The user signs out mid-flight.\n await nav.signOut.click();\n await expect(page).toHaveURL(/\\/login/);\n\n // Now let the held refresh land, and then some.\n await page.waitForTimeout(HOLD_MS + 2_000);\n\n // THE GUARANTEE, in three independent forms — because \"we are on /login\" on\n // its own would be satisfied by a router that moved while the session\n // quietly survived underneath it.\n //\n // 1. Still on the login screen, not swept back into the app.\n await expect(page).toHaveURL(/\\/login/);\n await expect(page.getByRole(\"navigation\", { name: tEn(\"nav:primaryNavAriaLabel\") }))\n .toBeHidden();\n\n // 2. The credential itself is gone. If the late refresh had committed, its\n // rotated cookie would be sitting here ready to restore the session.\n const cookies = await page.context().cookies();\n const refreshCookie = cookies.find((c) => c.name === \"cluckwork_rt\" && c.value !== \"\");\n expect(\n refreshCookie,\n \"a live refresh cookie survived the logout — the late response resurrected the session\",\n ).toBeUndefined();\n\n // 3. The strongest form: ask for a protected screen and be refused. This is\n // what an attacker with the abandoned tab would actually try.\n await page.goto(\"/\");\n await expect(\n page,\n \"a protected route was served after logout — the session outlived the sign-out\",\n ).toHaveURL(/\\/login/);\n });\n\n test(\"an explicit login beats a pending bootstrap refresh, and the newer login wins\", async ({\n page,\n signIn,\n nav,\n }) => {\n // Establish a real Owner session first, so the browser is holding a VALID\n // refresh cookie — the bootstrap refresh this race needs must be one that\n // would genuinely succeed. A race against a doomed request proves nothing.\n await signIn(owner());\n\n await page.route(\"**/api/v1/auth/refresh\", async (route) => {\n await new Promise((r) => setTimeout(r, HOLD_MS));\n await route.continue();\n });\n\n // Land on /login with that cookie present: AuthContext's bootstrap fires\n // `restoreSession()` immediately, and it is now held open. /login is outside\n // ProtectedRoute, so the form is interactive while that is pending.\n await page.goto(\"/login\");\n await page.waitForRequest((r) => r.url().includes(\"/api/v1/auth/refresh\"));\n\n // A DIFFERENT person signs in on the same browser while the old session's\n // refresh is still outstanding. Different persona on purpose: the two\n // sessions are then distinguishable on screen, so the assertion can name\n // which one won instead of inferring it.\n const sales = castMember(\"Sales\");\n await page.getByLabel(tEn(\"auth:email\")).fill(sales.email);\n await page.getByLabel(tEn(\"auth:password\")).fill(sales.password);\n await page.getByRole(\"button\", { name: tEn(\"auth:signIn\") }).click();\n\n await expect(page.getByRole(\"navigation\", { name: tEn(\"nav:primaryNavAriaLabel\") }))\n .toBeVisible();\n\n // Let the superseded bootstrap refresh land on top of the new session.\n await page.waitForTimeout(HOLD_MS + 2_000);\n\n // THE GUARANTEE: this is the Sales session, and the Owner's has not been\n // restored underneath it. Asserted through the nav's role gates, which\n // differ between the two personas — Sales is not an admin, so the Setup\n // group is absent, and Sales cannot produce, so the Production group is too.\n await expect(\n nav.link(\"nav:audit\"),\n \"an admin destination appeared — the late Owner refresh overwrote the Sales login\",\n ).toBeHidden();\n await expect(nav.link(\"nav:users\")).toBeHidden();\n await expect(nav.link(\"nav:expenses\")).toBeHidden();\n await expect(nav.link(\"nav:dailyEntry\")).toBeHidden();\n\n // Control: the Sales-shaped destinations ARE there, so the assertions above\n // are proving \"the Sales session won\" rather than \"the sidebar is empty\".\n await expect(nav.link(\"nav:sales\")).toBeVisible();\n await expect(nav.link(\"nav:customers\")).toBeVisible();\n });\n});\n// #311 acceptance — the report at its maximum supported date range.\n//\n// #311 is CLOSED; this is the regression layer, not the fix.\n//\n// ================== WHERE THE BOUND ACTUALLY LIVES ==================\n//\n// `src/Cluckwork.Api/Endpoints/Reports/ReportEndpoints.cs`:\n//\n// private const int MaxRangeDays = 366;\n// if (t.DayNumber - f.DayNumber >= MaxRangeDays)\n// return Results.Problem($\"Range cannot exceed {MaxRangeDays} days.\",\n// statusCode: 400, title: \"Report.RangeTooLarge\");\n//\n// Note the `>=`. The largest range the server ACCEPTS is therefore a 365-day\n// difference between `from` and `to` (a 366-day inclusive window) — not 366.\n// Off-by-one here is the difference between testing the boundary and testing a\n// point comfortably inside it, so the spec probes BOTH SIDES: the largest\n// accepted range must work, and one day more must be refused. A test that only\n// asserted the accepted side would still pass if the bound were quietly widened\n// to a year and a half.\n//\n// ReportsPage enforces NO client-side cap — `from` is bounded only by `to`, and\n// `to` only by farm-local today — so the browser genuinely sends these.\n\nimport { expect, test } from \"../src/fixtures\";\nimport { owner } from \"../src/cast\";\nimport { daysBefore, farmToday } from \"../src/farm\";\nimport { tEn } from \"../src/i18n\";\n\n/** Mirrors ReportEndpoints.MaxRangeDays. The comparison there is `>=`. */\nconst MAX_RANGE_DAYS = 366;\n/** The largest `to - from` the server accepts. */\nconst LARGEST_ACCEPTED_SPAN = MAX_RANGE_DAYS - 1;\n\nconst REPORT_PATH = /\\/api\\/v1\\/reports\\//;\n\ntest.describe(\"#311 report range\", () => {\n test(\"renders at the maximum supported range, and records what it cost\", async ({\n page,\n signIn,\n farm,\n }, testInfo) => {\n await signIn(owner());\n\n const to = farmToday(farm.timeZoneId);\n const from = daysBefore(to, LARGEST_ACCEPTED_SPAN);\n\n // Collect every report response the screen makes — ReportsPage fans out to\n // production, sales, expenses and profit, so a single waitForResponse would\n // time one of four and call it \"the\" latency.\n const timings: Array<{ path: string; status: number; ms: number }> = [];\n page.on(\"response\", (res) => {\n if (!REPORT_PATH.test(res.url())) return;\n const t = res.request().timing();\n timings.push({\n path: new URL(res.url()).pathname,\n status: res.status(),\n ms: Math.round(t.responseEnd),\n });\n });\n\n await page.goto(\"/reports\");\n await expect(page.getByRole(\"heading\", { name: tEn(\"reports:title\") })).toBeVisible();\n\n // Widen to the maximum. `to` first: `from`'s own `max` attribute is `to`, so\n // setting `from` to a far-past date while `to` is still the default would be\n // clamped by the browser and the spec would quietly test a 7-day window.\n //\n // `exact: true` on both: the labels are the single words \"From\" and \"To\",\n // and getByLabel substring-matches accessible names — so a bare \"To\" also\n // resolves the theme toggle (\"Switch to night mode\"). Two elements, strict\n // mode violation, and the failure names the toggle rather than the ambiguity.\n const startedAt = Date.now();\n await page.getByLabel(tEn(\"reports:toLabel\"), { exact: true }).fill(to);\n await page.getByLabel(tEn(\"reports:fromLabel\"), { exact: true }).fill(from);\n\n // THE GUARANTEE: the screen renders the report, rather than the bound\n // refusing it. `role=\"alert\"` is ReportsPage's error region.\n const production = page\n .getByRole(\"table\")\n .filter({ has: page.getByRole(\"columnheader\", { name: tEn(\"reports:dateHeader\") }) });\n await expect(production).toBeVisible();\n await expect(\n page.getByRole(\"alert\"),\n `a ${LARGEST_ACCEPTED_SPAN}-day range was refused, but MaxRangeDays=${MAX_RANGE_DAYS} should accept it`,\n ).toBeHidden();\n const renderedInMs = Date.now() - startedAt;\n\n // The date fields really do hold the wide range — proof the browser did not\n // clamp what was typed, which would make every assertion above describe a\n // narrower request than the one this spec claims to have made.\n await expect(page.getByLabel(tEn(\"reports:fromLabel\"), { exact: true })).toHaveValue(from);\n await expect(page.getByLabel(tEn(\"reports:toLabel\"), { exact: true })).toHaveValue(to);\n\n const atMaxRange = timings.filter((t) => t.status === 200);\n expect(atMaxRange.length, \"no report endpoint responded at the maximum range\").toBeGreaterThan(0);\n\n // Recorded, not asserted. A latency THRESHOLD here would be a flaky test\n // dressed as a performance gate — the number depends on the host, and under\n // the canary (#386) it is supposed to degrade. #311's acceptance item asks\n // for the figure to be captured; the canary is where it gets compared.\n const slowest = Math.max(...atMaxRange.map((t) => t.ms));\n const summary = [\n `range: ${from} .. ${to} (${LARGEST_ACCEPTED_SPAN} days, the documented maximum)`,\n `server: ${atMaxRange.map((t) => `${t.path} ${t.ms}ms`).join(\", \")}`,\n `slowest endpoint: ${slowest}ms`,\n `browser: table rendered ${renderedInMs}ms after the range was applied`,\n ].join(\"\\n\");\n await testInfo.attach(\"report-max-range-timing\", {\n body: summary,\n contentType: \"text/plain\",\n });\n testInfo.annotations.push({ type: \"#311 max-range timing\", description: summary });\n });\n\n test(\"refuses one day beyond the documented bound\", async ({ page, signIn, farm }) => {\n await signIn(owner());\n\n const to = farmToday(farm.timeZoneId);\n // One day wider than the largest accepted span — the first value the\n // server's `>=` rejects.\n const from = daysBefore(to, MAX_RANGE_DAYS);\n\n await page.goto(\"/reports\");\n await page.getByLabel(tEn(\"reports:toLabel\"), { exact: true }).fill(to);\n await page.getByLabel(tEn(\"reports:fromLabel\"), { exact: true }).fill(from);\n\n // The user is TOLD. A silently empty table would be worse than the refusal:\n // it reads as \"no data in that period\" for a farm that has plenty.\n await expect(\n page.getByRole(\"alert\"),\n `a ${MAX_RANGE_DAYS}-day range was accepted — the documented bound is not being enforced`,\n ).toBeVisible();\n\n // And the screen offers a way out rather than stranding them.\n await expect(page.getByRole(\"button\", { name: tEn(\"common:retry\") })).toBeVisible();\n });\n});\n// i18n render — es and tl do not break the screens (#277 cross-cutting, #182).\n//\n// ================== WHAT MAKES THIS NON-VACUOUS ==================\n//\n// The suite builds its selectors from the SPA's own catalogs (src/i18n.ts), so\n// there is an obvious way for this spec to be worthless: pick a key whose\n// Spanish and English strings happen to be identical, assert it renders, and\n// pass no matter what the language machinery does. That is not hypothetical —\n// `nav:dashboard` really is \"Dashboard\" in BOTH en and tl.\n//\n// So the spec asserts, first, that the strings it is about to look for ACTUALLY\n// DIFFER from English, and fails loudly if a catalog change ever makes them the\n// same. Verify the instrument can observe the thing before trusting what it says.\n//\n// ================== AND WHY IT USES ITS OWN PERSONA ==================\n//\n// `LanguageSelector` persists through `PUT /me/language`. Switching language is\n// a durable change to that USER, not a page-local toggle — see `i18nPersona()`.\n\nimport { expect, test, type Page } from \"../src/fixtures\";\nimport { i18nPersona } from \"../src/cast\";\nimport { t, tEn, type Language } from \"../src/i18n\";\n\n/**\n * The language ``, located WITHOUT using its label."," *"," * Its label is `account:language`, which is itself translated (\"Language\" ->"," * \"Idioma\" -> \"Wika\") — so the moment the switch under test works, a"," * `getByLabel(tEn(...))` locator stops matching. That is not a hypothetical: it"," * turned the cleanup hook into a 45-second hang that reported as a failure of"," * the NEXT test. Matching on the option values, which are language-invariant"," * codes, keeps the handle stable across exactly the change being tested."," */","function languageSelect(page: Page) {"," return page.locator('select:has(option[value=\"en\"]):has(option[value=\"es\"])');","}"," * Keys chosen because all three catalogs give them genuinely different strings"," * (en \"Language\" / es \"Idioma\" / tl \"Wika\"; en \"Reports\" / es \"Informes\" /"," * tl \"Mga Report\"). The guard below re-checks that at run time rather than"," * trusting this comment.","const WITNESS_KEYS = [\"account:language\", \"nav:reports\"] as const;","const LANGUAGE_OPTION = { en: \"English\", es: \"Español\", tl: \"Tagalog\" } as const;","test.describe(\"i18n\", () => {"," // Always hand the persona back in English, even when an assertion above fails"," // — otherwise one red run leaves the account in Spanish and the NEXT run of"," // this spec starts from a state it did not choose."," test.afterEach(async ({ page }) => {"," // Best-effort and time-boxed: this is cleanup, and a cleanup hook that can"," // itself hang converts one failure into a cascade across the whole file."," try {"," await page.goto(\"/account\", { timeout: 10_000 });"," await languageSelect(page).selectOption(\"en\", { timeout: 10_000 });"," // Wait for the persist to land, not just the local switch — the point of"," // the reset is the SERVER-side preference, which is what the next run"," // bootstraps from."," await expect(page.locator(\"html\")).toHaveAttribute(\"lang\", \"en\", { timeout: 10_000 });"," } catch {"," // Deliberately swallowed. A failed reset is worth knowing about but is not"," // itself the finding, and re-throwing here would mask the real failure."," }"," });"," for (const lang of [\"es\", \"tl\"] as const satisfies readonly Language[]) {"," test(`switching to ${lang} renders that language across the shell`, async ({ page, signIn }) => {"," // The guard. A key whose translation equals English cannot distinguish"," // \"the language switched\" from \"nothing happened\"."," for (const key of WITNESS_KEYS) {"," expect("," t(lang, key),"," `\"${key}\" is identical in en and ${lang}, so this spec cannot tell a working language `"," + `switch from a broken one. Pick a different witness key.`,"," ).not.toBe(tEn(key));"," }"," await signIn(i18nPersona());"," // Start from a known language rather than whatever this account was last"," // left in — the persona is reserved, but a previous failed run is still a"," // possible starting state."," await page.goto(\"/account\");"," const selector = languageSelect(page);"," await selector.selectOption(\"en\");"," await expect(page.getByRole(\"link\", { name: tEn(\"nav:reports\"), exact: true })).toBeVisible();"," // The switch, made the way a user makes it."," const persisted = page.waitForResponse((response) =>"," response.url().includes(\"/api/v1/me/language\")"," && response.request().method() === \"PUT\","," );"," await selector.selectOption(lang);"," expect((await persisted).ok(), `the ${lang} preference was not persisted`).toBe(true);"," // THE ASSERTION: the destination the user reads in the sidebar is now in"," // the new language. The sidebar is the right place to look because it is"," // rendered by a different component tree than the screen that owns the"," // selector — a switch that only repainted the current screen would pass a"," // narrower check and still be broken everywhere else."," await expect("," page.getByRole(\"link\", { name: t(lang, \"nav:reports\"), exact: true }),"," `the sidebar did not switch to ${lang}`,"," ).toBeVisible();"," await expect(page.getByRole(\"link\", { name: tEn(\"nav:reports\"), exact: true })).toBeHidden();"," // follows. This is a real accessibility guarantee, not"," // decoration: it is what tells a screen reader which voice to use, and"," // index.html ships a static \"en\" that a broken listener would leave in"," // place while the visible text changed underneath it."," await expect(page.locator(\"html\")).toHaveAttribute(\"lang\", lang);"," // A local i18next change is optimistic. Reload so the preference must be"," // recovered from the server rather than surviving only in component"," // memory."," await page.reload();"," // And the screens still WORK in that language — the point of #277's \"not"," // broken\", as opposed to \"translated\". A populated data screen renders its"," // table, not an error."," await page.getByRole(\"link\", { name: t(lang, \"nav:reports\"), exact: true }).click();"," await expect(page.getByRole(\"heading\", { name: t(lang, \"reports:title\") })).toBeVisible();"," await expect(page.getByRole(\"alert\")).toBeHidden();"," page"," .getByRole(\"table\")"," .filter({ has: page.getByRole(\"columnheader\", { name: t(lang, \"reports:dateHeader\") }) }),"," });"," }"," test(\"the language selector offers every installed pack in its own script\", async ({"," page,"," signIn,"," }) => {"," await signIn(i18nPersona());"," await page.goto(\"/account\");"," // Each pack is named in ITS OWN language (\"Español\", not \"Spanish\") — the"," // one string in the app deliberately left untranslated, because somebody who"," // cannot read the current language must still be able to find their own."," for (const [code, name] of Object.entries(LANGUAGE_OPTION)) {"," await expect(languageSelect(page).locator(`option[value=\"${code}\"]`)).toHaveText(name);","});","tools/simulation/ui/specs/reports-range.spec.ts",[1701],{"_1571":753,"_1572":1702,"_497":1703,"_1575":62},140,[1704,1577,1705,1577,1706,1577,1707,1577,1708,1709,1710,1711,1577,1712,1713,1714,1715,1716,1717,1718,1577,1719,1720,205,1721,1722,1723,1724,205,1725,1726,1727,1728,205,1729,205,1730,1731,1688,1689,1732,1733,1734,205,1735,1736,205,1737,1738,1739,1740,1741,1742,1743,1744,1745,1746,1747,1748,1749,1750,1685,205,1751,1752,205,1753,1754,1755,1756,1757,1758,1759,1760,1761,1762,1763,205,1764,1765,1766,1767,1768,1769,1770,1771,1772,1773,1774,205,1775,1776,1777,1778,1779,205,1780,1781,205,1782,1783,1784,1785,1786,1787,1788,1789,1790,1791,1792,1793,1794,1795,1685,1796,1630,205,1797,1734,205,1735,1798,1799,1800,205,1751,1762,1763,205,1801,1802,1770,1771,1803,1804,205,1805,1806,1630,1698],"// #311 acceptance — the report at its maximum supported date range.","// #311 is CLOSED; this is the regression layer, not the fix.","// ================== WHERE THE BOUND ACTUALLY LIVES ==================","// `src/Cluckwork.Api/Endpoints/Reports/ReportEndpoints.cs`:","// private const int MaxRangeDays = 366;","// if (t.DayNumber - f.DayNumber >= MaxRangeDays)","// return Results.Problem($\"Range cannot exceed {MaxRangeDays} days.\",","// statusCode: 400, title: \"Report.RangeTooLarge\");","// Note the `>=`. The largest range the server ACCEPTS is therefore a 365-day","// difference between `from` and `to` (a 366-day inclusive window) — not 366.","// Off-by-one here is the difference between testing the boundary and testing a","// point comfortably inside it, so the spec probes BOTH SIDES: the largest","// accepted range must work, and one day more must be refused. A test that only","// asserted the accepted side would still pass if the bound were quietly widened","// to a year and a half.","// ReportsPage enforces NO client-side cap — `from` is bounded only by `to`, and","// `to` only by farm-local today — so the browser genuinely sends these.","import { expect, test } from \"../src/fixtures\";","import { owner } from \"../src/cast\";","import { daysBefore, farmToday } from \"../src/farm\";","import { tEn } from \"../src/i18n\";","/** Mirrors ReportEndpoints.MaxRangeDays. The comparison there is `>=`. */","const MAX_RANGE_DAYS = 366;","/** The largest `to - from` the server accepts. */","const LARGEST_ACCEPTED_SPAN = MAX_RANGE_DAYS - 1;","const REPORT_PATH = /\\/api\\/v1\\/reports\\//;","test.describe(\"#311 report range\", () => {"," test(\"renders at the maximum supported range, and records what it cost\", async ({"," farm,"," }, testInfo) => {"," await signIn(owner());"," const to = farmToday(farm.timeZoneId);"," const from = daysBefore(to, LARGEST_ACCEPTED_SPAN);"," // Collect every report response the screen makes — ReportsPage fans out to"," // production, sales, expenses and profit, so a single waitForResponse would"," // time one of four and call it \"the\" latency."," const timings: Array<{ path: string; status: number; ms: number }> = [];"," page.on(\"response\", (res) => {"," if (!REPORT_PATH.test(res.url())) return;"," const url = new URL(res.url());"," if (url.searchParams.get(\"from\") !== from || url.searchParams.get(\"to\") !== to) return;"," const t = res.request().timing();"," timings.push({"," path: url.pathname,"," status: res.status(),"," ms: Math.round(t.responseEnd),"," });"," await page.goto(\"/reports\");"," await expect(page.getByRole(\"heading\", { name: tEn(\"reports:title\") })).toBeVisible();"," // Widen to the maximum. `to` first: `from`'s own `max` attribute is `to`, so"," // setting `from` to a far-past date while `to` is still the default would be"," // clamped by the browser and the spec would quietly test a 7-day window."," //"," // `exact: true` on both: the labels are the single words \"From\" and \"To\","," // and getByLabel substring-matches accessible names — so a bare \"To\" also"," // resolves the theme toggle (\"Switch to night mode\"). Two elements, strict"," // mode violation, and the failure names the toggle rather than the ambiguity."," const startedAt = Date.now();"," await page.getByLabel(tEn(\"reports:toLabel\"), { exact: true }).fill(to);"," await page.getByLabel(tEn(\"reports:fromLabel\"), { exact: true }).fill(from);"," // THE GUARANTEE: the screen renders the report, rather than the bound"," // refusing it. `role=\"alert\"` is ReportsPage's error region."," const production = page"," .getByRole(\"table\")"," .filter({ has: page.getByRole(\"columnheader\", { name: tEn(\"reports:dateHeader\") }) });"," await expect(production).toBeVisible();"," await expect("," page.getByRole(\"alert\"),"," `a ${LARGEST_ACCEPTED_SPAN}-day range was refused, but MaxRangeDays=${MAX_RANGE_DAYS} should accept it`,"," ).toBeHidden();"," const renderedInMs = Date.now() - startedAt;"," // The date fields really do hold the wide range — proof the browser did not"," // clamp what was typed, which would make every assertion above describe a"," // narrower request than the one this spec claims to have made."," await expect(page.getByLabel(tEn(\"reports:fromLabel\"), { exact: true })).toHaveValue(from);"," await expect(page.getByLabel(tEn(\"reports:toLabel\"), { exact: true })).toHaveValue(to);"," const atMaxRange = timings.filter((t) => t.status === 200);"," expect(atMaxRange.length, \"no report endpoint responded at the maximum range\").toBeGreaterThan(0);"," // Recorded, not asserted. A latency THRESHOLD here would be a flaky test"," // dressed as a performance gate — the number depends on the host, and under"," // the canary (#386) it is supposed to degrade. #311's acceptance item asks"," // for the figure to be captured; the canary is where it gets compared."," const slowest = Math.max(...atMaxRange.map((t) => t.ms));"," const summary = ["," `range: ${from} .. ${to} (${LARGEST_ACCEPTED_SPAN} days, the documented maximum)`,"," `server: ${atMaxRange.map((t) => `${t.path} ${t.ms}ms`).join(\", \")}`,"," `slowest endpoint: ${slowest}ms`,"," `browser: table rendered ${renderedInMs}ms after the range was applied`,"," ].join(\"\\n\");"," await testInfo.attach(\"report-max-range-timing\", {"," body: summary,"," contentType: \"text/plain\","," testInfo.annotations.push({ type: \"#311 max-range timing\", description: summary });"," test(\"refuses one day beyond the documented bound\", async ({ page, signIn, farm }) => {"," // One day wider than the largest accepted span — the first value the"," // server's `>=` rejects."," const from = daysBefore(to, MAX_RANGE_DAYS);"," // The user is TOLD. A silently empty table would be worse than the refusal:"," // it reads as \"no data in that period\" for a farm that has plenty."," `a ${MAX_RANGE_DAYS}-day range was accepted — the documented bound is not being enforced`,"," ).toBeVisible();"," // And the screen offers a way out rather than stranding them."," await expect(page.getByRole(\"button\", { name: tEn(\"common:retry\") })).toBeVisible();","tools/simulation/ui/specs/session-races.spec.ts",[1809],{"_1571":753,"_1572":1810,"_497":1811,"_1575":62},162,[1812,1577,1813,1814,1815,1816,1817,1577,1818,1577,1819,1820,1821,1822,1823,1577,1824,1577,1825,1826,1827,1828,1829,205,1721,1830,1724,205,1831,1832,205,1833,1834,1688,1689,1835,1690,1734,205,1836,1837,1838,1839,1685,205,1840,1841,1842,1843,1844,1845,1846,1847,1641,1848,1849,1850,1851,1852,1750,1685,205,1853,1854,1855,1856,205,1857,1858,1859,205,1860,1861,205,1862,1863,1864,1756,1865,1859,1866,1867,205,1868,1869,1870,1871,1872,1873,1874,1875,205,1876,1877,1878,1770,1879,1880,1881,1630,205,1882,1688,1689,1835,1690,1883,1884,1885,1734,205,1837,1838,1839,1685,205,1886,1887,1888,1889,1856,205,1890,1891,1892,1893,1894,1895,1896,1897,205,1866,1898,205,1899,1861,205,1900,1901,1902,1903,1770,1904,1905,1773,1906,1907,1908,205,1909,1910,1911,1912,205,1913,1914,1915,1916,1911,1917,1630,1698],"// #310 acceptance — the two session-generation races, driven in a real browser.","// #310 is CLOSED; this is the end-to-end regression layer for it, not the fix.","// The fix is `sessionGeneration` in `web/src/api/client.ts`: a module-level","// counter that `login()` and `logout()` bump, captured before each await and","// re-checked on settlement, so a superseded completion is discarded","// (`StaleSessionError`) instead of committing tokens.","// ================== WHY A BROWSER IS THE RIGHT INSTRUMENT ==================","// Both races are about what happens to a REAL in-flight fetch when the user does","// something else mid-flight. A unit test can assert the counter's arithmetic; it","// cannot tell you whether the user ends up looking at somebody else's farm. The","// assertions below are therefore all about the resulting SCREEN — which session","// the browser is actually in — not about a counter or a request.","// ================== HOW THE RACE IS MADE DETERMINISTIC ==================","// `page.route` holds the refresh request open for a fixed window, so \"in flight\"","// is a state the spec controls rather than one it hopes to hit. The alternative,","// firing both actions and hoping the interleaving lands, is a spec that passes","// most of the time for the wrong reason — and this is precisely the class of bug","// where \"passed 9 times out of 10\" means \"did not test it 9 times out of 10\".","import { castMember, owner } from \"../src/cast\";","/** How long a held refresh stays in flight. Long enough to act inside, short enough to run. */","const HOLD_MS = 3_000;","test.describe(\"#310 session races\", () => {"," test(\"a logout during an in-flight refresh cannot be resurrected by the late response\", async ({"," nav,"," // Hold every refresh open for HOLD_MS."," await page.route(\"**/api/v1/auth/refresh\", async (route) => {"," await new Promise((r) => setTimeout(r, HOLD_MS));"," await route.continue();"," // Provoke a refresh by injecting one 401 (same one-shot technique as"," // session-refresh.spec.ts). The refresh it triggers is now held open."," let injected = false;"," await page.route(\"**/api/v1/**\", async (route) => {"," const url = route.request().url();"," if (injected || url.includes(\"/auth/\")) {"," await route.fallback();"," return;"," injected = true;"," await route.fulfill({"," status: 401,"," contentType: \"application/problem+json\","," body: JSON.stringify({ title: \"Unauthorized\", status: 401 }),"," await nav.link(\"nav:reports\").click();"," // Do NOT await the refresh here — the whole point is to act while it is"," // still outstanding."," await page.waitForRequest((r) => r.url().includes(\"/api/v1/auth/refresh\"));"," // The user signs out mid-flight."," await nav.signOut.click();"," await expect(page).toHaveURL(/\\/login/);"," // Now let the held refresh land, and then some."," await page.waitForTimeout(HOLD_MS + 2_000);"," // THE GUARANTEE, in three independent forms — because \"we are on /login\" on"," // its own would be satisfied by a router that moved while the session"," // quietly survived underneath it."," // 1. Still on the login screen, not swept back into the app."," await expect(page.getByRole(\"navigation\", { name: tEn(\"nav:primaryNavAriaLabel\") }))"," .toBeHidden();"," // 2. The credential itself is gone. If the late refresh had committed, its"," // rotated cookie would be sitting here ready to restore the session."," const cookies = await page.context().cookies();"," const refreshCookie = cookies.find((c) => c.name === \"cluckwork_rt\" && c.value !== \"\");"," expect("," refreshCookie,"," \"a live refresh cookie survived the logout — the late response resurrected the session\","," ).toBeUndefined();"," // 3. The strongest form: ask for a protected screen and be refused. This is"," // what an attacker with the abandoned tab would actually try."," await page.goto(\"/\");"," page,"," \"a protected route was served after logout — the session outlived the sign-out\","," ).toHaveURL(/\\/login/);"," test(\"an explicit login beats a pending bootstrap refresh, and the newer login wins\", async ({"," // Establish a real Owner session first, so the browser is holding a VALID"," // refresh cookie — the bootstrap refresh this race needs must be one that"," // would genuinely succeed. A race against a doomed request proves nothing."," // Land on /login with that cookie present: AuthContext's bootstrap fires"," // `restoreSession()` immediately, and it is now held open. /login is outside"," // ProtectedRoute, so the form is interactive while that is pending."," await page.goto(\"/login\");"," // A DIFFERENT person signs in on the same browser while the old session's"," // refresh is still outstanding. Different persona on purpose: the two"," // sessions are then distinguishable on screen, so the assertion can name"," // which one won instead of inferring it."," const sales = castMember(\"Sales\");"," await page.getByLabel(tEn(\"auth:email\")).fill(sales.email);"," await page.getByLabel(tEn(\"auth:password\")).fill(sales.password);"," await page.getByRole(\"button\", { name: tEn(\"auth:signIn\") }).click();"," .toBeVisible();"," // Let the superseded bootstrap refresh land on top of the new session."," // THE GUARANTEE: this is the Sales session, and the Owner's has not been"," // restored underneath it. Asserted through the nav's role gates, which"," // differ between the two personas — Sales is not an admin, so the Setup"," // group is absent, and Sales cannot produce, so the Production group is too."," nav.link(\"nav:audit\"),"," \"an admin destination appeared — the late Owner refresh overwrote the Sales login\","," await expect(nav.link(\"nav:users\")).toBeHidden();"," await expect(nav.link(\"nav:expenses\")).toBeHidden();"," await expect(nav.link(\"nav:dailyEntry\")).toBeHidden();"," // Control: the Sales-shaped destinations ARE there, so the assertions above"," // are proving \"the Sales session won\" rather than \"the sidebar is empty\"."," await expect(nav.link(\"nav:sales\")).toBeVisible();"," await expect(nav.link(\"nav:customers\")).toBeVisible();"," // The browser applies Set-Cookie before client code can reject a stale"," // response. Reload to prove the durable cookie also belongs to Sales, not"," // merely the in-memory access token used by the assertions above."," await page.reload();"," await expect(nav.link(\"nav:audit\")).toBeHidden();","web/src/api/client.test.ts",[1920],{"_1571":753,"_1572":1921,"_497":1922,"_1575":62},1216,[1923,1924,1925,1926,1927,1928,1929,1930,1931,1932,1933,1934,1935,1936,1937,1938,1939,1940,1941,1942,1943,205,1944,1945,1946,1947,1948,205,1949,1950,205,1951,1952,1953,1954,1630,1605,205,1955,1956,1957,1605,205,1958,205,1959,1960,1605,205,1961,1962,1605,205,1963,1964,1605,205,1965,1966,1967,1968,1969,1970,1605,205,1971,1972,1973,205,1974,1975,1976,205,1977,1978,1979,1980,1981,1982,1983,1984,1698,205,1985,1986,1987,1988,1989,1698,205,1990,1991,1992,1993,1994,1995,1996,1997,1998,1630,205,1999,2000,2001,1630,1698,205,2002,2003,2004,2005,2006,2007,2008,2009,2010,1630,205,2011,2004,2012,2013,2014,2015,2016,2017,1630,1698,205,2018,2019,2020,2021,2022,205,2023,2024,2025,2026,1630,205,2027,2028,2029,2030,2031,2032,2026,1630,205,2033,2012,2034,2035,2025,2036,2037,2038,205,2039,2040,1630,205,2041,2042,2043,2044,2045,1630,1698,205,2046,2047,2048,2049,2050,1630,205,2051,2052,2053,2054,2055,2056,2057,2058,1630,205,2059,2060,2061,1630,205,2062,2063,2064,2052,2065,2066,2067,2068,2069,2070,2071,2072,2054,2055,2056,2073,2074,2075,2076,2077,2054,1630,205,2078,2052,2065,2066,2079,2080,2070,2071,2072,2054,2055,2056,2081,2082,1630,205,2083,2084,2052,2085,2054,2055,2056,2058,1630,1698,205,2086,2087,2012,2088,2089,2090,205,2015,2016,2091,205,2092,2093,2094,2095,2096,2097,2098,2099,2100,2101,2102,2103,2104,1630,205,2105,2012,2106,2089,2107,205,2108,2092,2109,2110,2111,2112,2113,2114,2115,2116,2117,1630,205,2118,2119,2120,2121,2122,2123,2124,2125,2126,1641,2127,2128,1685,205,2129,2130,2131,2132,205,2133,2134,2135,2103,1630,205,2136,2012,2137,2138,2139,2140,2141,2142,205,2143,2144,2145,2146,1630,1698,205,2147,2148,2012,2149,2150,205,2055,2056,2151,2152,2153,2007,2154,1630,205,2155,2012,2088,2156,2157,205,2055,2151,2158,2159,2009,2007,2154,1630,205,2160,2012,2088,2161,205,2055,2056,2151,2007,2154,1630,205,2162,2163,2164,2165,2012,2149,2166,205,2055,2056,2167,2168,2169,1630,205,2170,2012,2171,2172,2173,205,2174,2175,2176,2012,2177,2156,2178,2179,2180,1630,1698,205,2181,2182,2183,2184,2185,1630,205,2186,2187,2188,2189,2190,2191,2192,2193,2194,1630,205,2195,2183,2196,2197,1630,205,2198,2000,2199,1995,2200,2201,2202,1630,205,2203,2000,2199,2204,1630,205,2205,2206,2207,2208,2183,2209,2210,1630,205,2211,2183,2184,2212,1630,205,2213,2000,2214,2215,1630,205,2216,2217,2218,205,2219,205,1995,2220,2201,2221,2222,2223,2224,2225,2226,1630,205,2227,2217,2228,2185,1630,205,2229,2230,2231,2012,2232,2233,2234,205,2219,205,2235,2236,2237,2238,2239,2240,2241,1630,205,2242,2000,2243,1995,2244,2245,2246,1630,1698,205,2247,2248,2052,2249,2250,2251,2252,2054,2253,2254,2255,2256,1630,205,2257,2031,2258,2259,1630,205,2260,2012,2261,2089,2262,205,2263,2264,2091,2265,1630,205,2266,2004,2267,2268,2007,2009,2269,1630,1698,205,2270,2271,2004,2272,2273,2274,2275,2103,1995,2276,2277,1630,205,2278,2279,2000,2280,2281,1995,2282,2283,2284,2285,2154,1630,205,2286,2287,2288,2289,2290,2291,2292,2293,2294,2000,205,2280,205,2295,2154,1630,205,2296,2297,2298,2299,2004,2000,205,2280,205,2281,2300,1630,205,2301,2302,2303,2154,1630,205,2304,2004,2000,2305,2281,2306,1630,205,2307,2308,2309,2310,2311,205,2312,2313,2154,205,2314,2315,1630,205,2316,2317,2318,2311,2319,2305,2154,1630,205,2320,2321,2322,2323,2324,2325,2326,2293,2294,2319,205,2305,205,2154,2327,2328,2329,2330,1630,1698,205,2331,2332,2333,2334,2335,2336,2337,2338,2339,2340,205,2341,205,2342,2343,2344,2345,2346,2347,2348,2349,205,2350,2351,2352,2353,1630,205,2354,2355,205,2356,2357,1630,1698,205,2358,2359,2360,2361,2362,2363,2364,205,2365,205,2342,2366,2367,2368,2369,2370,1630,205,2371,2052,2372,205,2373,2056,2374,1630,205,2375,2376,2377,2378,2379,2380,2381,2382,2372,205,2383,205,2281,2384,2385,2386,2387,2388,2389,1630,205,2390,2391,2392,2393,2012,2394,2138,2395,205,2396,205,2370,2397,2009,1630,205,2398,2363,2399,2357,2389,1630,1698,205,2400,2401,2402,2403,2404,2405,2406,2407,2408,2409,2410,2411,2412,1685,2413,1686,205,2414,2415,2416,2417,1686,205,2418,2419,2420,205,2421,2422,2423,205,2424,2425,2426,2054,205,2427,2428,205,2429,2385,205,2430,2431,205,2133,2432,2009,2433,2434,2435,2104,1630,205,2436,2419,2420,205,2437,2438,2439,205,2004,2425,2426,2054,205,2440,2441,205,2133,2009,1630,205,2442,2443,2444,2445,2012,2446,2447,205,2448,2449,205,2450,2180,2104,1630,205,2451,2452,1619,2453,2454,2455,2456,2457,2458,2459,2460,2461,2462,1654,205,2463,2464,205,2465,2466,2467,2468,2469,2470,1629,1630,205,2471,2472,2004,2425,2426,2054,205,2473,205,2133,2474,2104,1630,1698,205,2475,2476,2477,2478,2479,2004,2480,205,2449,205,2481,2103,1630,205,2482,2004,2483,2484,2485,2486,2487,1685,205,2488,2428,2009,205,2489,205,2490,2491,205,2492,2493,2494,2495,2496,2497,2498,2499,1630,205,2500,2004,2501,205,2273,205,2502,2103,1630,205,2503,2004,2483,2484,2485,2504,2487,1685,205,2505,2428,205,2506,2507,2508,2509,2103,205,2510,2511,205,2512,2513,1630,205,2514,2515,2516,2517,2004,2483,2484,2485,2518,2519,2487,1685,205,2520,2521,2522,2428,205,2523,2524,205,2525,2526,205,2527,2528,2529,2530,2531,2532,2533,1630,205,2534,2535,2536,2537,2538,2539,2540,2484,2541,2542,2487,1685,205,2543,2544,2428,205,2280,2154,205,2545,2546,205,2547,1630,205,2548,2540,2333,205,2549,205,2352,1630,205,2550,2004,2551,2484,2552,2486,2487,1685,205,2553,2428,205,2554,205,2555,2556,2557,205,2154,2389,2558,2559,2499,1630,205,2560,2561,2562,2563,2564,2004,2483,2484,2485,2486,2487,1685,205,2565,2428,205,2280,2566,205,2526,2567,2568,1630,205,2569,2570,2571,2572,2483,2484,2573,2574,2575,2485,2504,2487,1685,205,2576,2428,205,2273,2577,205,2578,1630,205,2579,2483,2484,2575,2485,2486,2487,1685,205,2565,2428,205,2280,2566,205,2526,2567,2568,1630,205,2580,2581,2582,2483,2484,2583,2584,2585,2485,2504,2487,1685,205,2586,2428,205,2587,2577,205,2588,2589,1630,205,2590,2483,2484,2585,2485,2486,2487,1685,205,2591,2428,205,2280,2566,205,2592,2567,2568,1630,205,2593,2594,2595,2596,2004,2483,2484,2485,2504,2486,2487,1685,205,2597,2428,205,2587,2598,2599,205,2600,2601,1630,1698],"import { describe, it, expect, vi, beforeEach, afterEach } from \"vitest\";","import {"," apiGet,"," apiPost,"," apiPut,"," apiPutBytes,"," apiDelete,"," apiFetch,"," apiGetBlob,"," login,"," logout,"," restoreSession,"," changePassword,"," stepUp,"," STEP_UP_HEADER,"," ApiError,"," setOnUnauthenticated,"," setOnTokensChanged,"," getLastTraceId,","} from \"./client\";","import { getAccessToken, setAccessToken, clearAccessToken } from \"../auth/tokenStore\";","// The fetch client owns the SPA's session lifecycle: bearer-attach, one","// transparent refresh-and-retry on 401, single-flight refresh, and fail-closed","// teardown. Since #145 the refresh token rides an HttpOnly cookie (the browser","// attaches it), so refresh/logout send NO refresh body — only the CSRF header.","// All exercised here against a stubbed global fetch — no network.","const FUTURE = \"2099-01-01T00:00:00Z\";","const CSRF = \"X-Cluckwork-Auth\";","function jsonResponse(body: unknown, status = 200): Response {"," return new Response(JSON.stringify(body), {"," status,"," headers: { \"Content-Type\": \"application/json\" },","// The access-token body login/refresh now return (no refresh token).","function accessResponse(accessToken: string, status = 200): Response {"," return jsonResponse({ accessToken, accessTokenExpiry: FUTURE }, status);","type Call = [string, RequestInit];","function authOf(call: Call): string | null {"," return new Headers(call[1]?.headers ?? {}).get(\"Authorization\");","function headerOf(call: Call, name: string): string | null {"," return new Headers(call[1]?.headers ?? {}).get(name);","function callsTo(mock: ReturnType, suffix: string): Call[] {"," return (mock.mock.calls as Call[]).filter(([url]) => url.endsWith(suffix));","// A promise whose resolution the test controls — lets us hold a refresh open","// until both concurrent callers have provably parked on it (no timing guesses).","function deferred() {"," let resolve!: (v: T) => void;"," const promise = new Promise((r) => (resolve = r));"," return { promise, resolve };","// Runs pending microtasks AND the macrotask queue once, so every in-flight","// fetch resolution + catch handler has settled before we assert / release.","const drain = () => new Promise((r) => setTimeout(r, 0));","let fetchMock: ReturnType;","let onUnauth: ReturnType void>>;","let onTokens: ReturnType void>>;","beforeEach(() => {"," fetchMock = vi.fn();"," vi.stubGlobal(\"fetch\", fetchMock);"," onUnauth = vi.fn();"," onTokens = vi.fn();"," setOnUnauthenticated(onUnauth);"," setOnTokensChanged(onTokens);"," setAccessToken(\"at1\");","afterEach(() => {"," vi.unstubAllGlobals();"," setOnUnauthenticated(null);"," setOnTokensChanged(null);"," clearAccessToken();","describe(\"apiFetch — happy path\", () => {"," it(\"attaches the bearer token and returns parsed JSON\", async () => {"," fetchMock.mockResolvedValueOnce(jsonResponse({ value: 42 }));"," const body = await apiGet<{ value: number }>(\"/stock\");"," expect(body).toEqual({ value: 42 });"," const [url, init] = fetchMock.mock.calls[0] as Call;"," expect(url).toBe(\"/api/v1/stock\");"," expect(new Headers(init.headers).get(\"Authorization\")).toBe(\"Bearer at1\");"," expect(onTokens).not.toHaveBeenCalled(); // a plain GET must not touch the token"," it(\"returns undefined for 204 No Content\", async () => {"," fetchMock.mockResolvedValueOnce(new Response(null, { status: 204 }));"," await expect(apiFetch(\"/thing\", { method: \"DELETE\" })).resolves.toBeUndefined();","describe(\"apiFetch — no in-memory token\", () => {"," it(\"attempts one silent refresh; on failure throws 401 and fires onUnauthenticated\", async () => {"," clearAccessToken();"," fetchMock.mockResolvedValueOnce(jsonResponse({ title: \"no cookie\" }, 401)); // the bootstrap refresh"," await expect(apiGet(\"/stock\")).rejects.toMatchObject({ status: 401 });"," expect(onUnauth).toHaveBeenCalledTimes(1);"," // exactly one fetch — the refresh attempt — and it targeted /auth/refresh"," expect(callsTo(fetchMock, \"/auth/refresh\")).toHaveLength(1);"," expect(callsTo(fetchMock, \"/stock\")).toHaveLength(0);"," it(\"uses the refreshed token when the silent refresh succeeds\", async () => {"," fetchMock"," .mockResolvedValueOnce(accessResponse(\"at2\")) // silent refresh"," .mockResolvedValueOnce(jsonResponse({ ok: true })); // the request, now authed"," const body = await apiGet<{ ok: boolean }>(\"/stock\");"," expect(body).toEqual({ ok: true });"," expect(authOf(callsTo(fetchMock, \"/stock\")[0])).toBe(\"Bearer at2\");","// #217 — every request mints a W3C traceparent so a browser action correlates","// with the API's request log and spans (#214). The client remembers the last","// trace id so a crash report can join the failed screen's server-side story.","describe(\"traceparent correlation\", () => {"," const TRACEPARENT = /^00-[0-9a-f]{32}-[0-9a-f]{16}-01$/;"," it(\"attaches a spec-shaped traceparent header to every JSON request\", async () => {"," fetchMock.mockResolvedValueOnce(jsonResponse({ ok: true }));"," await apiGet(\"/stock\");"," expect(headerOf(fetchMock.mock.calls[0] as Call, \"traceparent\")).toMatch(TRACEPARENT);"," it(\"attaches a traceparent to blob downloads too\", async () => {"," // String body, not `new Blob(...)`: under vitest's jsdom env `Blob` is"," // jsdom's (no .stream()) while `Response` is undici's, and whether that"," // mix works depends on the Node version — it broke on CI's Node."," fetchMock.mockResolvedValueOnce(new Response(\"x\", { status: 200 }));"," await apiGetBlob(\"/export/eggs.csv\");"," it(\"mints a fresh trace id per request and exposes the last one\", async () => {"," .mockResolvedValueOnce(jsonResponse({ ok: true }))"," .mockResolvedValueOnce(jsonResponse({ ok: true }));"," const first = headerOf(fetchMock.mock.calls[0] as Call, \"traceparent\")!;"," await apiGet(\"/flocks\");"," const second = headerOf(fetchMock.mock.calls[1] as Call, \"traceparent\")!;"," expect(second).not.toBe(first);"," expect(getLastTraceId()).toBe(second.split(\"-\")[1]);"," it(\"remembers the trace id even when the request fails — that is the one worth reporting\", async () => {"," fetchMock.mockResolvedValueOnce(jsonResponse({ title: \"boom\" }, 500));"," await expect(apiGet(\"/stock\")).rejects.toBeInstanceOf(ApiError);"," const sent = headerOf(fetchMock.mock.calls[0] as Call, \"traceparent\")!;"," expect(getLastTraceId()).toBe(sent.split(\"-\")[1]);","describe(\"apiFetch — error mapping\", () => {"," it(\"passes a non-401 error through without attempting a refresh\", async () => {"," fetchMock.mockResolvedValueOnce(jsonResponse({ title: \"Bad\", detail: \"nope\" }, 400));"," await expect(apiGet(\"/stock\")).rejects.toMatchObject({ status: 400, title: \"Bad\" });"," expect(fetchMock).toHaveBeenCalledTimes(1); // no refresh on non-401"," it(\"flattens a ValidationProblem errors map into the message\", async () => {"," fetchMock.mockResolvedValueOnce("," jsonResponse({ title: \"Validation failed\", errors: { name: [\"required\"], qty: [\"too big\", \"nan\"] } }, 400),"," );"," const err = await apiGet(\"/stock\").catch((e: unknown) => e);"," expect(err).toBeInstanceOf(ApiError);"," expect((err as ApiError).title).toBe(\"Validation failed\");"," expect((err as ApiError).message).toBe(\"required too big nan\");"," it(\"keeps status text when the error body is not JSON\", async () => {"," fetchMock.mockResolvedValueOnce(new Response(\"502\", { status: 502, statusText: \"Bad Gateway\" }));"," await expect(apiGet(\"/stock\")).rejects.toMatchObject({ status: 502, title: \"Bad Gateway\" });"," it(\"maps a known errorCode to its catalog message; an uncoded field (omitted from errorCodes, the real API shape) keeps English\", async () => {"," // The real API OMITS a wholly-uncoded field from errorCodes (ValidationResponse.cs),"," // so `name` has no errorCodes entry at all — it must keep its English message."," jsonResponse("," {"," title: \"Validation\","," errors: { language: [\"Language must be a 2–8 letter code.\"], name: [\"required\"] },"," errorCodes: { language: [\"Me.Language.Format\"] },"," },"," 400,"," ),"," // Exact match (not just toContain): the catalog string adds \", for example"," // 'en'.\" — absent from the server's plain English — so this fails pre-fix"," // (plain flatten yields \"Language must be a 2–8 letter code. required\")."," expect((err as ApiError).message).toBe("," \"Language must be a 2–8 letter code, for example 'en'. required\","," it(\"falls back to the English message for an UNKNOWN code (no catalog key)\", async () => {"," errors: { language: [\"some english message\"] },"," errorCodes: { language: [\"Not.A.Real.Code\"] },"," // defaultValue is the server English message → unknown code degrades to it."," expect((err as ApiError).message).toBe(\"some english message\");"," it(\"keeps the plain flattened English message when there are no errorCodes\", async () => {"," // The pre-#182 contract, unchanged."," jsonResponse({ errors: { name: [\"required\"], qty: [\"too big\", \"nan\"] } }, 400),","describe(\"apiFetch — transparent refresh\", () => {"," it(\"on 401, refreshes once and retries the original request with the new token\", async () => {"," .mockResolvedValueOnce(jsonResponse({ title: \"expired\" }, 401)) // original"," .mockResolvedValueOnce(accessResponse(\"at2\")) // refresh"," .mockResolvedValueOnce(jsonResponse({ ok: true })); // retry"," expect(fetchMock).toHaveBeenCalledTimes(3);"," const calls = fetchMock.mock.calls as Call[];"," // Refresh request contract (#145): POST /auth/refresh with NO body and NO"," // bearer — it authenticates by the HttpOnly cookie — plus the CSRF header."," expect(calls[1][0]).toBe(\"/api/v1/auth/refresh\");"," expect(calls[1][1].method).toBe(\"POST\");"," expect(calls[1][1].body).toBeUndefined();"," expect(authOf(calls[1])).toBeNull();"," expect(headerOf(calls[1], CSRF)).toBe(\"1\");"," // Retry hits the same URL with the refreshed token."," expect(calls[2][0]).toBe(\"/api/v1/stock\");"," expect(authOf(calls[2])).toBe(\"Bearer at2\");"," expect(onTokens).toHaveBeenCalledTimes(1);"," expect(getAccessToken()).toBe(\"at2\");"," it(\"replays a write across a refresh with the SAME idempotency key and body\", async () => {"," .mockResolvedValueOnce(jsonResponse({ title: \"expired\" }, 401)) // original POST"," .mockResolvedValueOnce(jsonResponse({ id: \"1\" })); // retry POST"," await apiPost(\"/customers\", { name: \"x\" }, \"fixed-key\");"," const original = calls[0];"," const retry = calls[2];"," expect(original[1].method).toBe(\"POST\");"," expect(retry[1].method).toBe(\"POST\");"," expect(retry[1].body).toBe(original[1].body); // same payload, not re-serialized differently"," // Same idempotency key → the server dedupes the replay instead of double-writing."," expect(headerOf(retry, \"Idempotency-Key\")).toBe(\"fixed-key\");"," expect(headerOf(original, \"Idempotency-Key\")).toBe(\"fixed-key\");"," expect(authOf(retry)).toBe(\"Bearer at2\"); // only the bearer changed"," it(\"shares a single in-flight refresh across concurrent 401s (single-flight)\", async () => {"," const gate = deferred();"," let refreshes = 0;"," fetchMock.mockImplementation(async (url: string, init: RequestInit) => {"," if (url.endsWith(\"/auth/refresh\")) {"," refreshes += 1;"," if (refreshes > 1) throw new Error(\"a second refresh must not start while one is in flight\");"," await gate.promise; // hold open until both 401s have parked on this refresh"," return accessResponse(\"at2\");"," const auth = new Headers(init.headers).get(\"Authorization\");"," return auth === \"Bearer at1\" ? jsonResponse({ title: \"expired\" }, 401) : jsonResponse({ ok: true });"," const inflight = Promise.all([apiGet<{ ok: boolean }>(\"/a\"), apiGet<{ ok: boolean }>(\"/b\")]);"," await drain(); // both 401s land, both callers park on the one refresh"," gate.resolve();"," const [a, b] = await inflight;"," expect(a).toEqual({ ok: true });"," expect(b).toEqual({ ok: true });"," expect(refreshes).toBe(1); // exactly one refresh, and the guard proves no second one started"," it(\"refreshes again on a later 401 — the single-flight latch is cleared on success\", async () => {"," .mockResolvedValueOnce(jsonResponse({ title: \"expired\" }, 401)) // cycle 1 original"," .mockResolvedValueOnce(accessResponse(\"at2\"))"," .mockResolvedValueOnce(jsonResponse({ ok: 1 })) // cycle 1 retry"," .mockResolvedValueOnce(jsonResponse({ title: \"expired\" }, 401)) // cycle 2 original"," .mockResolvedValueOnce(accessResponse(\"at3\"))"," .mockResolvedValueOnce(jsonResponse({ ok: 2 })); // cycle 2 retry"," await apiGet(\"/a\");"," await apiGet(\"/b\");"," expect(callsTo(fetchMock, \"/auth/refresh\")).toHaveLength(2); // a stuck latch would only refresh once"," expect(getAccessToken()).toBe(\"at3\");","describe(\"apiFetch — refresh failure is fail-closed and non-recursive\", () => {"," it(\"clears the session and rethrows the ORIGINAL error when refresh 401s\", async () => {"," .mockResolvedValueOnce(jsonResponse({ title: \"expired\" }, 401)) // original 401"," .mockResolvedValueOnce(jsonResponse({ title: \"bad refresh token\" }, 401)); // refresh 401"," expect((err as ApiError).status).toBe(401);"," expect((err as ApiError).title).toBe(\"expired\"); // original, not the refresh error"," expect(fetchMock).toHaveBeenCalledTimes(2); // no retry after refresh failed"," expect(getAccessToken()).toBeNull();"," it(\"does NOT retry-refresh when the retry itself 401s (one transparent refresh only)\", async () => {"," .mockResolvedValueOnce(accessResponse(\"at2\")) // refresh ok"," .mockResolvedValueOnce(jsonResponse({ title: \"still 401\" }, 401)); // retry 401"," expect((err as ApiError).title).toBe(\"expired\"); // original surfaced, no recursion"," expect(fetchMock).toHaveBeenCalledTimes(3); // original + one refresh + one retry, then stop"," it(\"surfaces the original 401 when the refresh network call rejects\", async () => {"," .mockRejectedValueOnce(new TypeError(\"network down\")); // refresh fetch rejects"," it(\"does NOT clear the session when refresh is rate-limited (429) — keeps the token and rethrows the 429\", async () => {"," // A 429 during transparent refresh is transient throttling (#143), not a"," // dead session. Wiping the token here would force a re-login through the same"," // rate limit; instead the token is kept and the 429 surfaces."," .mockResolvedValueOnce(jsonResponse({ title: \"Too many requests\" }, 429)); // refresh 429"," expect((err as ApiError).status).toBe(429); // the 429, not the original 401"," expect(onUnauth).not.toHaveBeenCalled(); // session preserved"," expect(getAccessToken()).toBe(\"at1\"); // token untouched"," it(\"recovers on the next request after a failed refresh — the latch is cleared on failure too\", async () => {"," .mockResolvedValueOnce(jsonResponse({ title: \"expired\" }, 401)) // req 1 original"," .mockResolvedValueOnce(jsonResponse({ title: \"bad refresh\" }, 401)); // req 1 refresh fails"," await apiGet(\"/a\").catch(() => {});"," // Session was torn down; a fresh login reseeds the token and the next 401 must"," // be able to start a brand-new refresh (not reuse a rejected latch)."," setAccessToken(\"at1b\");"," .mockResolvedValueOnce(jsonResponse({ title: \"expired\" }, 401)) // req 2 original"," .mockResolvedValueOnce(jsonResponse({ ok: true })); // req 2 retry"," await expect(apiGet<{ ok: boolean }>(\"/b\")).resolves.toEqual({ ok: true });"," expect(callsTo(fetchMock, \"/auth/refresh\")).toHaveLength(2);","describe(\"write idempotency\", () => {"," it(\"apiPost generates an Idempotency-Key when none is given\", async () => {"," fetchMock.mockResolvedValueOnce(jsonResponse({ id: \"1\" }));"," await apiPost(\"/customers\", { name: \"x\" });"," expect(headerOf(fetchMock.mock.calls[0] as Call, \"Idempotency-Key\")).toBeTruthy();"," it(\"generates a DISTINCT key per call (so two writes are not deduped as one)\", async () => {"," fetchMock.mockImplementation(() => Promise.resolve(jsonResponse({ id: \"1\" }))); // fresh body each call"," await apiPost(\"/customers\", { name: \"a\" });"," await apiPost(\"/customers\", { name: \"b\" });"," const k0 = headerOf(fetchMock.mock.calls[0] as Call, \"Idempotency-Key\");"," const k1 = headerOf(fetchMock.mock.calls[1] as Call, \"Idempotency-Key\");"," expect(k0).toBeTruthy();"," expect(k1).toBeTruthy();"," expect(k0).not.toBe(k1);"," it(\"apiPost honours an explicit Idempotency-Key (retry-safe replay)\", async () => {"," await apiPost(\"/customers\", { name: \"x\" }, \"my-fixed-key\");"," expect(headerOf(fetchMock.mock.calls[0] as Call, \"Idempotency-Key\")).toBe(\"my-fixed-key\");"," it(\"apiPut sends method PUT with an Idempotency-Key\", async () => {"," await apiPut(\"/egg-grades/1\", { name: \"A\" }, \"put-key\");"," expect(url).toBe(\"/api/v1/egg-grades/1\");"," expect(init.method).toBe(\"PUT\");"," expect(headerOf(fetchMock.mock.calls[0] as Call, \"Idempotency-Key\")).toBe(\"put-key\");"," it(\"apiPut declares JSON — the default no caller has to state\", async () => {"," expect(headerOf(fetchMock.mock.calls[0] as Call, \"Content-Type\")).toBe(\"application/json\");"," // #308 — apiPost/apiPut's optional 4th param is how CreateUser/SetUserPassword"," // attach the step-up grant. Both sides of the boundary: present when a caller"," // passes one, absent otherwise (every other write in the app)."," it(\"apiPost attaches an extra header (e.g. the step-up grant) when given one\", async () => {"," await apiPost(\"/users\", { role: \"Admin\" }, \"key\", { [STEP_UP_HEADER]: \"grant-abc\" });"," expect(headerOf(fetchMock.mock.calls[0] as Call, STEP_UP_HEADER)).toBe(\"grant-abc\");"," it(\"apiPost carries no step-up header when none is given (every ordinary write)\", async () => {"," expect(headerOf(fetchMock.mock.calls[0] as Call, STEP_UP_HEADER)).toBeNull();"," it(\"apiPut attaches an extra header (e.g. the step-up grant) when given one\", async () => {"," await apiPut(\"/users/1/password\", { newPassword: \"x\" }, \"key\", { [STEP_UP_HEADER]: \"grant-def\" });"," expect(headerOf(fetchMock.mock.calls[0] as Call, STEP_UP_HEADER)).toBe(\"grant-def\");"," it(\"apiPutBytes sends the body as-is under its own content type (#123 logo upload)\", async () => {"," fetchMock.mockResolvedValueOnce(jsonResponse({ contentHash: \"abc\" }));"," const bytes = new Blob([new Uint8Array([1, 2, 3])], { type: \"image/png\" });"," await apiPutBytes(\"/account/logo\", bytes, \"image/png\", \"logo-key\");"," expect(url).toBe(\"/api/v1/account/logo\");"," // The caller's type survives: raw() must not overwrite it with JSON, or the"," // body would go up declared as something it is not."," expect(headerOf(fetchMock.mock.calls[0] as Call, \"Content-Type\")).toBe(\"image/png\");"," expect(headerOf(fetchMock.mock.calls[0] as Call, \"Idempotency-Key\")).toBe(\"logo-key\");"," // Not JSON-encoded — the Blob itself is the body."," expect(init.body).toBe(bytes);"," it(\"apiPutBytes generates a key when none is given\", async () => {"," await apiPutBytes(\"/account/logo\", new Blob([\"x\"]), \"application/octet-stream\");"," it(\"apiPutBytes retries the SAME bytes after a 401 refresh\", async () => {"," setAccessToken(\"stale\");"," const bytes = new Blob([\"png\"], { type: \"image/png\" });"," .mockResolvedValueOnce(new Response(null, { status: 401 })) // the write"," .mockResolvedValueOnce(accessResponse(\"fresh\")) // the refresh"," .mockResolvedValueOnce(jsonResponse({ contentHash: \"abc\" })); // the retry"," const writes = callsTo(fetchMock, \"/account/logo\");"," expect(writes).toHaveLength(2);"," // A body consumed by the first attempt would make the retry upload nothing;"," // a Blob can be read again, which is why the retry is safe at all."," expect(writes[1][1].body).toBe(bytes);"," expect(authOf(writes[1])).toBe(\"Bearer fresh\");"," expect(headerOf(writes[1], \"Idempotency-Key\")).toBe(\"logo-key\");"," it(\"apiDelete sends method DELETE with an Idempotency-Key\", async () => {"," await apiDelete(\"/sales/1/items/2\", \"del-key\");"," expect(url).toBe(\"/api/v1/sales/1/items/2\");"," expect(init.method).toBe(\"DELETE\");"," expect(headerOf(fetchMock.mock.calls[0] as Call, \"Idempotency-Key\")).toBe(\"del-key\");","describe(\"apiGetBlob — file download\", () => {"," it(\"returns the blob and parses the Content-Disposition filename\", async () => {"," new Response(\"col1,col2\\n\", {"," status: 200,"," headers: { \"Content-Type\": \"text/csv\", \"Content-Disposition\": 'attachment; filename=\"export.csv\"' },"," }),"," const { blob, filename } = await apiGetBlob(\"/export/all\");"," expect(filename).toBe(\"export.csv\");"," expect(blob.size).toBe(10); // \"col1,col2\\n\" — body flowed through unread"," expect(authOf(fetchMock.mock.calls[0] as Call)).toBe(\"Bearer at1\");"," it(\"has null filename when no Content-Disposition is present\", async () => {"," const { filename } = await apiGetBlob(\"/export/flocks\");"," expect(filename).toBeNull();"," it(\"transparently refreshes on 401 and retries the download with the new token\", async () => {"," .mockResolvedValueOnce(jsonResponse({ title: \"expired\" }, 401)) // original blob request"," .mockResolvedValueOnce(new Response(\"data\", { status: 200 })); // retry"," const { blob } = await apiGetBlob(\"/export/all\");"," expect(blob.size).toBe(4); // \"data\""," expect(authOf(fetchMock.mock.calls[2] as Call)).toBe(\"Bearer at2\");"," it(\"with no session, attempts one refresh, then throws 401 + fires onUnauthenticated\", async () => {"," fetchMock.mockResolvedValueOnce(jsonResponse({ title: \"no cookie\" }, 401)); // silent refresh"," await expect(apiGetBlob(\"/export/all\")).rejects.toMatchObject({ status: 401 });"," expect(callsTo(fetchMock, \"/export/all\")).toHaveLength(0);","describe(\"auth endpoints\", () => {"," it(\"login stores the access token (memory only) and notifies listeners\", async () => {"," fetchMock.mockResolvedValueOnce(accessResponse(\"atL\"));"," await login({ email: \"a@b.co\", password: \"pw\" });"," expect(getAccessToken()).toBe(\"atL\");"," expect(localStorage.length).toBe(0); // never persisted"," expect(url).toBe(\"/api/v1/auth/login\");"," expect(new Headers(init.headers).get(\"Authorization\")).toBeNull(); // login is unauthenticated"," it(\"logout revokes cookie-authenticated (CSRF header, no body), then clears the token\", async () => {"," setAccessToken(\"at-logout\");"," await logout();"," expect(fetchMock).toHaveBeenCalledTimes(1);"," expect(url).toBe(\"/api/v1/auth/logout\");"," expect(init.method).toBe(\"POST\");"," expect(init.body).toBeUndefined(); // refresh token is in the cookie, not the body"," expect(headerOf(fetchMock.mock.calls[0] as Call, CSRF)).toBe(\"1\");"," // #336 — the refresh cookie is per-ORIGIN (one per browser, last login wins)"," // while this token store is per-TAB, so the cookie can belong to a DIFFERENT"," // user than the one logging out. The bearer is what tells the server who"," // actually clicked logout, so their step-up grants are the ones revoked;"," // without it the server revokes the cookie owner's and leaves this user's"," // alive. It must be read BEFORE the synchronous clear, or it is always null."," it(\"logout sends this tab's bearer, captured before the token is cleared\", async () => {"," const token = `tok-${crypto.randomUUID()}`;"," setAccessToken(token);"," expect(authOf(fetchMock.mock.calls[0] as Call)).toBe(`Bearer ${token}`);"," // …but it stays OPTIONAL. The endpoint is AllowAnonymous, so a tab with no"," // token (or an expired one already dropped) must still fire the request and"," // end the session off the cookie alone — never send \"Bearer null\"."," it(\"logout omits the bearer entirely when this tab holds no access token\", async () => {"," expect(authOf(fetchMock.mock.calls[0] as Call)).toBeNull();"," it(\"logout clears the local token even when the server revoke fails\", async () => {"," fetchMock.mockResolvedValueOnce(jsonResponse({ title: \"revoke failed\" }, 500));"," await expect(logout()).resolves.toBeUndefined(); // best-effort, does not throw"," it(\"logout always calls the endpoint — a cookie may exist even with no in-memory token\", async () => {"," await expect(logout()).resolves.toBeUndefined();"," expect((fetchMock.mock.calls[0] as Call)[0]).toBe(\"/api/v1/auth/logout\");"," // #310 — local invalidation must win immediately, independent of the network."," it(\"clears in-memory auth state synchronously, before the server call settles\", async () => {"," const gate = deferred();"," fetchMock.mockReturnValueOnce(gate.promise); // server call hangs"," setAccessToken(\"live-token\");"," const done = logout();"," await Promise.resolve(); // let logout()'s synchronous prefix run; network still pending"," gate.resolve(new Response(null, { status: 204 }));"," await done;"," // #310 — a full network rejection (not just a non-2xx response) must behave"," // the same as the existing 500 case above: local state wins regardless."," it(\"clears the local token even when the server call rejects outright (network error)\", async () => {"," fetchMock.mockRejectedValueOnce(new TypeError(\"network down\"));"," // #310 — the revoke failure must be observable (not silently swallowed) but"," // must never expose the token that was already cleared."," it(\"reports a server-side revoke failure without leaking the token\", async () => {"," const consoleErr = vi.spyOn(console, \"error\").mockImplementation(() => {});"," // Generated, not a literal: nothing secret-shaped belongs in source"," // (GitGuardian scans test files too), and a unique value makes the"," // \"did not leak\" assertion exact rather than coincidental."," expect(consoleErr).toHaveBeenCalledTimes(1);"," const logged = consoleErr.mock.calls[0].map((a) => String(a)).join(\" \");"," expect(logged).not.toContain(token);"," consoleErr.mockRestore();","describe(\"changePassword (#165)\", () => {"," it(\"posts to /auth/change-password and swaps in the returned access token\", async () => {"," fetchMock.mockResolvedValueOnce(accessResponse(\"at-after-change\"));"," // Runtime-generated so no literal secret lands in source. Built through a"," // helper rather than inline: a password-shaped literal sitting directly on a"," // `currentPassword = ...` line trips secret scanners even when the value is"," // a fresh UUID (GitGuardian flagged exactly this on PR #183)."," const freshPassword = () => `Aa1!${crypto.randomUUID()}`;"," const currentPassword = freshPassword();"," const newPassword = freshPassword();"," await changePassword({ currentPassword, newPassword });"," const call = fetchMock.mock.calls[0] as Call;"," expect(call[0]).toBe(\"/api/v1/auth/change-password\");"," // A key rides along (apiPost adds one to every write) but is inert: the"," // SERVER exempts this route from the response cache, because replaying it"," // would return the token without the rotated Set-Cookie (#165 review). The"," // exemption itself is asserted server-side in UserPasswordTests."," expect(authOf(call)).toBe(\"Bearer at1\"); // authenticated write"," expect(JSON.parse(String(call[1].body))).toEqual({ currentPassword, newPassword });"," // The server rotated the session; the returned token replaces the old one so"," // this tab keeps working after every other session was revoked."," expect(getAccessToken()).toBe(\"at-after-change\");"," expect(onTokens).toHaveBeenCalled();"," it(\"propagates a rejection (e.g. wrong current password) and leaves the token alone\", async () => {"," fetchMock.mockResolvedValueOnce(jsonResponse({ title: \"Current password is incorrect.\" }, 400));"," await expect(changePassword({ currentPassword: \"x\", newPassword: \"y\" })).rejects.toThrow(ApiError);"," expect(getAccessToken()).toBe(\"at1\"); // unchanged","// #308 — step-up grant issuance. Consumed by UsersPage.tsx immediately before","// the one sensitive write it unlocks; this file only proves the transport","// contract (posts the password, authenticated, returns the grant as-is).","describe(\"stepUp (#308)\", () => {"," it(\"posts the password to /auth/step-up as an authenticated write and returns the grant\", async () => {"," fetchMock.mockResolvedValueOnce(jsonResponse({ token: \"grant-abc\", expiresAt: FUTURE }));"," const password = `Aa1!${crypto.randomUUID()}`;"," const grant = await stepUp(password);"," expect(call[0]).toBe(\"/api/v1/auth/step-up\");"," expect(call[1].method).toBe(\"POST\");"," expect(authOf(call)).toBe(\"Bearer at1\");"," expect(JSON.parse(String(call[1].body))).toEqual({ password });"," expect(grant).toEqual({ token: \"grant-abc\", expiresAt: FUTURE });"," it(\"propagates a rejection (wrong current password) as an ApiError carrying the server's message\", async () => {"," jsonResponse({ title: \"Users.CurrentPasswordIncorrect\", detail: \"Current password is incorrect.\" }, 400));"," const err = await stepUp(\"wrong\").catch((e: unknown) => e);"," expect(err).toMatchObject({ status: 400, message: \"Current password is incorrect.\" });"," // #336 review — the damage a 401 here would do is NOT the status the user"," // sees, it is the replay: apiFetch treats every 401 as an expired access"," // token, refreshes, and re-sends the SAME password. One typed password would"," // then reach the server's password check twice, so its five-attempt account"," // lockout would trip after three submissions and each attempt would burn a"," // refresh-token rotation. Pin the single request, not just the status."," it(\"issues exactly one request for a rejected password — no refresh, no replay\", async () => {"," fetchMock.mockResolvedValue("," await expect(stepUp(\"wrong\")).rejects.toThrow(ApiError);"," expect(callsTo(fetchMock, \"/auth/step-up\")).toHaveLength(1);"," expect(callsTo(fetchMock, \"/auth/refresh\")).toHaveLength(0);"," // The session is untouched: no teardown, no navigate-to-login."," expect(getAccessToken()).toBe(\"at1\");"," expect(onUnauth).not.toHaveBeenCalled();"," expect(onTokens).not.toHaveBeenCalled();"," // The other side of the boundary: a REAL 401 (the session truly expired) must"," // still take the refresh-and-retry path, so the fix above is a status"," // distinction and not a blanket opt-out of transparent refresh."," it(\"still refreshes and retries when the session itself has expired (401)\", async () => {"," .mockResolvedValueOnce(jsonResponse({ title: \"Unauthorized\" }, 401))"," .mockResolvedValueOnce(jsonResponse({ token: \"grant-abc\", expiresAt: FUTURE }));"," const grant = await stepUp(\"right\");"," expect(callsTo(fetchMock, \"/auth/step-up\")).toHaveLength(2);"," it(\"does not touch in-memory auth state — it is not a token-store writer\", async () => {"," await stepUp(\"whatever\");","describe(\"cross-tab refresh coordination (#169)\", () => {"," // A minimal Web Locks stand-in that is NAME-SCOPED, like the real API: each"," // lock name has its own FIFO queue, and different names never contend. Modelling"," // the scoping is what makes \"the SUT waits behind the SAME name\" a meaningful"," // assertion — if the fake ignored the name, a per-tab (non-shared) lock name"," // would look identical and the #169 fix could silently regress."," function fakeLockManager() {"," const tails = new Map>();"," const request = vi.fn((name: string, cb: () => Promise) => {"," const prev = tails.get(name) ?? Promise.resolve();"," const run = prev.then(() => cb());"," tails.set(name, run.catch(() => {})); // next waiter proceeds even if this one throws"," return run;"," return { request };"," // The SUT's OWN lock acquisition (asserting on `toHaveBeenCalledWith` alone"," // would be satisfied by a test's own setup call, proving nothing about the code)."," function sutLockName(locks: ReturnType): string | undefined {"," return locks.request.mock.calls.at(-1)?.[0] as string | undefined;"," it(\"waits for another tab's in-progress refresh before hitting the server (no cross-tab replay)\", async () => {"," const locks = fakeLockManager();"," vi.stubGlobal(\"navigator\", { locks });"," // Occupy the lock as 'another tab' still rotating the cookie; ours must queue."," const otherTab = deferred();"," locks.request(\"cluckwork.auth.refresh\", () => otherTab.promise);"," clearAccessToken(); // next call forces a silent refresh"," fetchMock.mockImplementation(async (url: string) =>"," url.endsWith(\"/auth/refresh\") ? accessResponse(\"at2\") : jsonResponse({ ok: true }),"," const inflight = apiGet<{ ok: boolean }>(\"/a\");"," await drain();"," // Blocked behind the other tab: our refresh has NOT reached the server yet."," otherTab.resolve(); // the other tab finished; the cookie is now the fresh token"," const a = await inflight;"," // Serialized strictly after the other tab — exactly one refresh, no replay."," // The SUT acquired the SHARED, stable lock name — the crux of cross-tab"," // coordination. (Asserted on the code's own call, not the setup call above.)"," expect(sutLockName(locks)).toBe(\"cluckwork.auth.refresh\");"," it(\"a lock held under a DIFFERENT name does not block refresh (fake is name-scoped, like the real API)\", async () => {"," // Some unrelated feature holds a different lock — must NOT serialise refresh."," const unrelated = deferred();"," locks.request(\"some-other-feature\", () => unrelated.promise);"," const a = await apiGet<{ ok: boolean }>(\"/a\"); // proceeds despite the other lock"," unrelated.resolve();"," it(\"clears the single-flight latch after a lock-guarded refresh FAILS, so a later refresh retries\", async () => {"," // Covers the lock-wrapped rejection path specifically (the existing latch test"," // runs in jsdom with no navigator.locks, i.e. only the fallback branch)."," vi.stubGlobal(\"navigator\", { locks: fakeLockManager() });"," .mockResolvedValueOnce(jsonResponse({ title: \"boom\" }, 500)) // refresh 1 (under lock) fails"," .mockResolvedValueOnce(accessResponse(\"at2\")); // refresh 2 succeeds"," await expect(restoreSession()).resolves.toBe(false);"," await expect(restoreSession()).resolves.toBe(true);"," // A stuck latch would have refused the second refresh entirely."," it(\"aborts and releases the lock if a refresh hangs past the timeout (no cross-tab starvation)\", async () => {"," vi.useFakeTimers();"," vi.stubGlobal(\"navigator\", { locks: fakeLockManager() });"," // A hung server: the fetch never resolves on its own — only the abort signal"," // (fired by our lock timeout) can settle it."," fetchMock.mockImplementation("," (_url: string, init: RequestInit) =>"," new Promise((_resolve, reject) =>"," init.signal?.addEventListener(\"abort\", () =>"," reject(new DOMException(\"timed out\", \"AbortError\")),"," ),"," ),"," const restored = restoreSession(); // parks on the hung refresh"," await vi.advanceTimersByTimeAsync(20_000); // past REFRESH_TIMEOUT_MS"," // The timeout aborted the fetch and released the lock: the promise settles"," // (does not hang forever) — restoreSession catches the abort and reports no"," // session, but crucially the lock is freed for other tabs."," await expect(restored).resolves.toBe(false);"," } finally {"," vi.useRealTimers();"," it(\"degrades gracefully when the Web Locks API is unavailable (older browsers)\", async () => {"," vi.stubGlobal(\"navigator\", {}); // no .locks — like jsdom / older Safari"," const a = await apiGet<{ ok: boolean }>(\"/a\");"," expect(callsTo(fetchMock, \"/auth/refresh\")).toHaveLength(1); // still refreshes, just uncoordinated","// #310 — login, bootstrap refresh, explicit refresh, and logout are one browser","// session state machine. A stale completion (one whose generation was superseded","// by a later login or an earlier logout) may never commit tokens or state.","describe(\"session generation (#310)\", () => {"," it(\"commits a bootstrap refresh normally when nothing else races it (control)\", async () => {"," fetchMock.mockResolvedValueOnce(accessResponse(\"bootedToken\"));"," expect(getAccessToken()).toBe(\"bootedToken\");"," it(\"discards a bootstrap refresh that resolves after logout — the session does not resurrect\", async () => {"," const refreshGate = deferred();"," fetchMock.mockImplementation((url: string) => {"," if (url.endsWith(\"/auth/refresh\")) return refreshGate.promise;"," if (url.endsWith(\"/auth/logout\")) return Promise.resolve(new Response(null, { status: 204 }));"," throw new Error(`unexpected fetch: ${url}`);"," const restoring = restoreSession(); // bootstrap refresh in flight, held open"," await logout(); // user logs out while the bootstrap refresh is still pending"," refreshGate.resolve(accessResponse(\"resurrected-token\")); // the stale refresh finally answers"," await expect(restoring).resolves.toBe(false); // discarded — never reports a restored session"," expect(getAccessToken()).toBeNull(); // must stay logged out"," expect(onTokens).not.toHaveBeenCalled(); // the stale completion must not fire tokensChanged"," // #310 review — clearing the in-memory token is only half of it. That"," // response carried a rotated refresh cookie, which the browser applied"," // before any of our code ran, so the server session must be revoked too:"," // one revoke for the logout itself, a second for the cookie the discarded"," // refresh issued. Without it a reload walks straight back in."," expect(callsTo(fetchMock, \"/auth/logout\")).toHaveLength(2);"," it(\"commits an explicit login normally when nothing else races it (control)\", async () => {"," fetchMock.mockResolvedValueOnce(accessResponse(\"loggedInToken\"));"," expect(getAccessToken()).toBe(\"loggedInToken\");"," it(\"does not let a late bootstrap refresh overwrite a newer explicit login\", async () => {"," if (url.endsWith(\"/auth/login\")) return Promise.resolve(accessResponse(\"newLoginToken\"));"," const restoring = restoreSession(); // older bootstrap refresh in flight"," await login({ email: \"a@b.co\", password: \"pw\" }); // a newer, explicit login completes first"," const bootstrapSignal = callsTo(fetchMock, \"/auth/refresh\")[0]?.[1]?.signal as AbortSignal;"," expect(bootstrapSignal.aborted).toBe(true);"," expect(getAccessToken()).toBe(\"newLoginToken\");"," refreshGate.resolve(accessResponse(\"staleBootstrapToken\")); // the old refresh answers late"," await expect(restoring).resolves.toBe(false); // discarded, not adopted"," expect(getAccessToken()).toBe(\"newLoginToken\"); // untouched by the stale refresh"," expect(onTokens).toHaveBeenCalledTimes(1); // still just the login's single notification"," it(\"a late-FAILING obsolete refresh does not clear or corrupt a newer session\", async () => {"," // Distinct from the success case above: here the stale refresh's own network"," // call fails (refresh token revoked) — the failure path must be gated too, or"," // it would clearAccessToken()/onUnauthenticated() and boot the fresh login."," if (url.endsWith(\"/auth/login\")) return Promise.resolve(accessResponse(\"freshLoginToken\"));"," if (url.endsWith(\"/stock\")) return Promise.resolve(jsonResponse({ ok: true }));"," // apiGet with no in-memory token forces currentAccessToken() to park on a"," // silent refresh — the same refresh a bootstrap would trigger."," const fetching = apiGet<{ ok: boolean }>(\"/stock\").catch((e: unknown) => e);"," await login({ email: \"a@b.co\", password: \"pw\" }); // supersedes the still-parked refresh"," expect(getAccessToken()).toBe(\"freshLoginToken\");"," refreshGate.resolve(jsonResponse({ title: \"refresh token revoked\" }, 401)); // stale refresh FAILS late"," const settled = await fetching;"," expect(getAccessToken()).toBe(\"freshLoginToken\"); // untouched by the stale failure"," expect(onUnauth).not.toHaveBeenCalled(); // must not tear down the fresh session"," // #310 review — the parked request itself must not surface the internal"," // discard marker. The login committed a valid token, so the request the"," // user is actually waiting on proceeds on it rather than failing with"," // \"Discarded: superseded by…\", which every screen would render verbatim."," expect(settled).toEqual({ ok: true });"," // #310 review — changePassword is a token-store writer too, and logout is"," // reachable from every screen, so it needs the same generation guard as"," // login/refresh; without it the response writes a fresh token back over a"," // session the user already ended."," it(\"discards a change-password response that resolves after logout (#310)\", async () => {"," const changeGate = deferred();"," setAccessToken(`tok-${crypto.randomUUID()}`);"," if (url.endsWith(\"/auth/change-password\")) return changeGate.promise;"," if (url.endsWith(\"/auth/logout\")) return Promise.resolve(jsonResponse({}, 204));"," const changing = changePassword({ currentPassword: \"a\", newPassword: \"b\" })"," .catch((e: unknown) => e);"," changeGate.resolve(jsonResponse({ accessToken: \"resurrected\" }));"," await changing;"," expect(getAccessToken()).toBeNull(); // the ended session stays ended"," it(\"commits a change-password response normally when nothing races it (control)\", async () => {"," await changePassword({ currentPassword: \"a\", newPassword: \"b\" });"," it(\"discards a login that resolves after a concurrent logout — does not resurrect authentication\", async () => {"," const loginGate = deferred();"," if (url.endsWith(\"/auth/login\")) return loginGate.promise;"," const loggingIn = login({ email: \"a@b.co\", password: \"pw\" }).catch((e: unknown) => e);"," await logout(); // fires while the login request is still in flight"," loginGate.resolve(accessResponse(\"late-login-token\"));"," const result = await loggingIn;"," expect(result).toBeInstanceOf(Error); // discarded, surfaced as a rejection — not silently accepted"," // The late login's Set-Cookie already reached the browser; revoke it, or a"," // reload restores the session the user just ended."," // #310 review — a request parked on a refresh that a LOGOUT discarded must"," // surface a normal 401, not the internal StaleSessionError whose message"," // every screen would render verbatim. (The newer-login counterpart, where the"," // request proceeds on the fresh token, is asserted above.)"," it(\"surfaces a plain 401 — not the discard marker — when logout ended the session\", async () => {"," const fetching = apiGet(\"/stock\").catch((e: unknown) => e);"," refreshGate.resolve(accessResponse(\"discarded-token\"));"," expect(settled).toBeInstanceOf(ApiError);"," expect(settled).toMatchObject({ status: 401 });"," // The two outcomes again for apiFetch's 401-RETRY branch specifically. The"," // test above enters through currentAccessToken (empty token store); this one"," // starts authenticated, 401s, and is superseded mid-retry — a separate branch."," it(\"retries a request on the newer login's token when the retry refresh is superseded\", async () => {"," if (url.endsWith(\"/stock\") && getAccessToken() === \"newLoginToken\")"," return Promise.resolve(jsonResponse({ value: 7 }));"," if (url.endsWith(\"/stock\")) return Promise.resolve(jsonResponse({ title: \"expired\" }, 401));"," const fetching = apiGet<{ value: number }>(\"/stock\");"," refreshGate.resolve(accessResponse(\"stale-token\"));"," expect(await fetching).toEqual({ value: 7 });"," it(\"surfaces the original 401 when logout supersedes a retry refresh\", async () => {"," // The same two outcomes for the blob path, whose 401-retry is a separate"," // branch from apiFetch's."," it(\"retries a download on the newer login's token when a refresh is superseded\", async () => {"," if (url.endsWith(\"/export/all\") && getAccessToken() === \"newLoginToken\")"," return Promise.resolve(new Response(\"data\", { status: 200 }));"," if (url.endsWith(\"/export/all\")) return Promise.resolve(jsonResponse({ title: \"expired\" }, 401));"," const downloading = apiGetBlob(\"/export/all\");"," await login({ email: \"a@b.co\", password: \"pw\" }); // supersedes the parked refresh"," const { blob } = await downloading;"," expect(blob.size).toBe(4); // \"data\" — served on the live login's token"," it(\"surfaces the original 401 on a download when logout ended the session\", async () => {"," const downloading = apiGetBlob(\"/export/all\").catch((e: unknown) => e);"," const settled = await downloading;"," // #310 review — the revoke is scoped to \"the session is gone\". When a newer"," // LOGIN supersedes an older flight, the cookie in the browser belongs to that"," // live login; revoking it would sign the user out of the thing they just did."," it(\"does not revoke the cookie when a newer login superseded the flight\", async () => {"," const restoring = restoreSession();"," refreshGate.resolve(accessResponse(\"stale-refresh-token\"));"," await restoring;"," expect(getAccessToken()).toBe(\"newLoginToken\"); // the live login survives"," expect(callsTo(fetchMock, \"/auth/logout\")).toHaveLength(0); // and is NOT revoked","web/src/api/client.ts",[2604],{"_1571":753,"_1572":2605,"_497":2606,"_1575":62},574,[2607,2608,2609,2610,2611,205,2612,205,2613,2614,2615,2616,205,2617,2618,2619,2620,205,2621,2622,2623,2624,2625,2626,2627,2628,1686,1605,205,2629,2630,2631,2632,2633,1605,205,2634,2635,2636,2637,2638,2639,1605,205,2640,2641,2642,2643,2644,2645,2646,2647,2648,2649,2650,2651,2652,2653,2654,2655,2656,2657,2658,2659,2660,2661,2662,2663,2664,2665,2666,2667,2668,1641,2669,2670,2671,1629,2672,2673,1686,2674,1605,205,2675,2676,2677,2678,2679,2680,1605,205,2681,2682,2683,2684,2685,2686,2687,1605,205,2688,2689,2690,2691,2692,2693,2694,2695,2696,2697,2698,205,2699,2700,2701,2702,1605,205,2703,205,2704,2705,2706,2707,2708,2709,2710,2711,2712,2713,2714,205,2715,2716,2717,2718,1686,1605,205,2719,2720,2721,2722,2723,2724,1577,2725,2726,2727,2728,2729,2730,2643,2731,2732,2733,2734,2735,1686,1605,205,2736,2737,2738,2739,2740,2741,2742,2743,2744,2745,2746,2747,2748,2749,2750,1630,2751,2752,2753,2754,2755,2756,1686,2757,2758,1605,205,2759,2760,2761,2762,1577,2763,2764,2765,2766,2767,2768,2769,2770,2771,2772,2773,2774,2775,2776,2777,2778,2779,2780,2754,2755,2756,1686,2757,2758,1605,205,2781,2782,2783,2784,2785,2786,2787,2788,1577,2789,2790,2791,2792,2793,2794,2795,2796,2797,2798,1605,205,2799,2800,2801,2802,2803,2804,2805,2806,2807,2808,2809,2810,2745,2811,2812,2813,2814,1989,2643,2815,2816,2817,2818,1756,2819,2820,2821,2822,2823,2824,2825,2826,2827,2828,2829,2830,2831,2054,2732,2832,2833,2834,2835,2836,1686,1605,205,2837,2838,2839,2840,2841,2842,2843,2844,2845,1577,2846,2847,2848,2849,2850,2851,205,2852,2853,2854,2855,2856,205,2857,2858,2859,2860,205,2861,2862,2863,2864,2865,2866,2867,2868,1685,2869,2870,2871,1605,205,2872,2873,2874,2875,2876,205,2877,2878,205,2879,2880,2881,2777,205,2882,2883,2884,2885,2886,2887,2888,2889,2890,2891,2892,2893,2894,2895,2896,2897,2898,2899,2900,2901,2902,2903,2904,2905,2906,2900,2907,2908,2909,1685,205,2910,1605,205,2911,2912,2913,2914,2643,2915,2916,2672,2917,1686,1605,205,2918,205,2919,2920,1605,205,2921,2922,2923,2924,1577,2925,2926,2927,2928,2689,2929,2930,2931,2692,2932,2749,2933,2934,1630,1605,205,2935,2689,2936,2930,2931,2692,2932,2937,2933,2750,1630,1605,205,2938,2939,2940,2941,2942,2943,2689,2944,2945,2930,2692,2932,2937,2946,2947,2948,2949,2950,1630,1605,205,2951,2932,2952,2953,1630,1605,205,2954,2955,2956,2689,2957,2958,2643,2959,2732,2960,1619,2961,2962,2963,2964,2965,2966,2967,2968,1641,2969,2970,2971,2972,1629,1686,1605,205,2973,2689,2974,2957,2975,2698,2976,2700,2977,2978,2979,2980,2981,2869,1605,205,2982,2958,2643,2983,2732,2960,1619,2961,2984,2963,2985,2986,2987,2965,2966,2988,2968,1641,2969,2970,2971,2972,1629,1686,1605,205,2989,2990,2991,2992,2993,2994,2643,2995,2732,2996,2997,2998,2999,3000,3001,3002,1686,1605,205,3003,3004,3005,3006,3007,3008,3009,3010,3011,3012,3013,3014,1605,205,3015,3016,3017,3018,3019,3020,3021,3022,3023,3024,3025,3026,1605],"import type { AccessTokenResponse, LoginRequest, ProblemDetails } from \"./types\";","import { clearAccessToken, getAccessToken, setAccessToken } from \"../auth/tokenStore\";","import { newId } from \"../lib/ids\";","import i18n from \"../i18n\";","import { newTraceparent } from \"../lib/traceparent\";","const BASE = \"/api/v1\";","// #145 — refresh/logout ride the HttpOnly refresh cookie; this custom header","// (which a cross-site simple request cannot set) is the CSRF second factor","// alongside the cookie's SameSite=Strict. Mirrors AuthCookies.CsrfHeaderName.","const CSRF_HEADER = \"X-Cluckwork-Auth\";","// #308 — carries a short-lived step-up grant (see stepUp() below) on the two","// sensitive user-administration calls that need one. Mirrors","// AuthEndpoints.StepUpHeaderName.","export const STEP_UP_HEADER = \"X-Cluckwork-Step-Up\";","export class ApiError extends Error {"," constructor("," public status: number,"," public title: string,"," message: string,"," ) {"," super(message);"," this.name = \"ApiError\";","// Called when the session is unrecoverable (refresh failed). AuthContext wires","// this to drop React auth state and bounce to /login.","let onUnauthenticated: (() => void) | null = null;","export function setOnUnauthenticated(cb: (() => void) | null): void {"," onUnauthenticated = cb;","// Called whenever a new token pair is saved (login or transparent refresh).","// AuthContext re-derives the role from the fresh access token so a demotion","// or promotion shows in the UI within one token lifetime, not at next reload.","let onTokensChanged: (() => void) | null = null;","export function setOnTokensChanged(cb: (() => void) | null): void {"," onTokensChanged = cb;","async function parseError(res: Response): Promise {"," let title = res.statusText;"," let detail = res.statusText;"," try {"," const body = (await res.json()) as ProblemDetails & {"," errors?: Record;"," errorCodes?: Record;"," };"," title = body.title ?? title;"," // ValidationProblem carries an errors map and usually no detail — flatten"," // it so the user sees which field is wrong, not just \"Bad Request\"."," if (body.errors && Object.keys(body.errors).length > 0) {"," // Per-field, index-aligned: a slot with an explicit code whose catalog key"," // exists renders the translated message; otherwise the English server"," // message at the SAME index (uncoded slots, or codes without a catalog key,"," // keep their English — matching the additive, explicit-only #45 contract)."," const parts: string[] = [];"," for (const [field, messages] of Object.entries(body.errors)) {"," const codes = body.errorCodes?.[field] ?? [];"," messages.forEach((msg, i) => {"," const code = codes[i];"," // `defaultValue: msg` IS the fallback: a known catalog key wins, an"," // unknown code (or an uncoded/null slot) renders the server English"," // message. This also satisfies i18next's typed t() — a runtime string"," // key needs the defaultValue overload (a bare i18n.t(dynamicKey) is a"," // type error under CustomTypeOptions). keySeparator:false makes the"," // dotted `errors:Me.Language.Format` a literal key, not a nested path."," parts.push(code ? i18n.t(`errors:${code}`, { defaultValue: msg }) : msg);"," });"," detail = parts.join(\" \");"," } else {"," detail = body.detail ?? detail;"," } catch {"," // non-JSON body — keep status text"," return new ApiError(res.status, title, detail);","// #217 — the trace id of the most recent API request, success or failure (a","// FAILED request's id is exactly the one worth having: the crash report","// attaches it, joining a browser crash to that request's server-side story).","let lastTraceId: string | null = null;","export function getLastTraceId(): string | null {"," return lastTraceId;","// Mint per request, never reused: the server treats the incoming id as the","// request's TraceId (#214), so sharing one across requests would fuse","// unrelated request logs into one trace.","function attachTraceparent(headers: Headers): void {"," const tp = newTraceparent();"," headers.set(\"traceparent\", tp.header);"," lastTraceId = tp.traceId;","async function raw("," path: string,"," init: RequestInit,"," accessToken?: string,","): Promise {"," const headers = new Headers(init.headers);"," // A caller that declared its own type keeps it: the farm-logo upload (#123)"," // PUTs raw image bytes, not JSON."," if (!headers.has(\"Content-Type\")) headers.set(\"Content-Type\", \"application/json\");"," if (accessToken) headers.set(\"Authorization\", `Bearer ${accessToken}`);"," attachTraceparent(headers);"," const res = await fetch(`${BASE}${path}`, { ...init, headers });"," if (!res.ok) throw await parseError(res);"," if (res.status === 204) return undefined as T;"," return (await res.json()) as T;","// --- Auth endpoints -------------------------------------------------------","// #310 — login, the load-time bootstrap refresh, an explicit (401-triggered)","// refresh, and logout are treated as ONE browser-session state machine, not","// four independent calls racing each other. Every entry into that machine","// captures the CURRENT generation before its own await; login and logout each","// bump it (login because it is by definition a newer session than anything","// already in flight, logout because ending the session must supersede","// everything). A completion — success OR failure — may only commit tokens or","// user state while the generation it captured is still the current one;","// otherwise it is stale and must be discarded rather than resurrecting or","// clobbering whatever the (newer) generation already did.","let sessionGeneration = 0;","class StaleSessionError extends Error {"," constructor() {"," super(\"Discarded: superseded by a newer login or an intervening logout.\");"," this.name = \"StaleSessionError\";","// #310 review — discarding the JS result is NOT enough for a request that also","// rotates the refresh cookie (/auth/login and /auth/refresh both do). The","// browser applies Set-Cookie the moment the response arrives, before any of our","// code runs, so a login that lands after logout leaves a VALID HttpOnly refresh","// cookie behind: the next reload authenticates straight through","// restoreSession() and the session the user ended comes back.","// So when a cookie-setting response is discarded, ask the server to revoke what","// it just issued. Only when the session is actually gone (no access token): if a","// newer LOGIN superseded this flight, the cookie now belongs to that live","// session and revoking it would sign the user out of the thing they just did.","async function revokeSupersededCookie(): Promise {"," if (getAccessToken()) return; // superseded by a newer login, not by a logout"," await raw(\"/auth/logout\", { method: \"POST\", headers: { [CSRF_HEADER]: \"1\" } });"," } catch (err) {"," // Best-effort, like logout's own revoke: report it rather than swallow, but"," // never surface it to the caller whose result was already discarded."," console.error(\"discarded response: revoking its refresh cookie failed\", err);","export async function login(body: LoginRequest): Promise {"," // #310 — bump first: login is a NEWER session than anything already in"," // flight (a bootstrap refresh, say), so its resolution must be the one that"," // wins, and any earlier flight must see its captured generation go stale."," const generation = ++sessionGeneration;"," // A bootstrap refresh can rotate the shared HttpOnly cookie even though its"," // JavaScript result is rejected by the generation check below. Cancel it"," // before starting the explicit login so its late Set-Cookie cannot overwrite"," // the cookie belonging to the session the user deliberately chose."," abortInFlightRefresh?.();"," // The server sets the HttpOnly refresh cookie; the body returns only the"," // access token, which lives in memory for this tab's lifetime."," const res = await raw(\"/auth/login\", {"," method: \"POST\","," body: JSON.stringify(body),"," // Superseded while in flight (e.g. a logout landed before this resolved) —"," // do not resurrect a session the user already ended. The response already"," // set a refresh cookie, so revoke it too, not just the in-memory token."," if (sessionGeneration !== generation) {"," await revokeSupersededCookie();"," throw new StaleSessionError();"," setAccessToken(res.accessToken);"," onTokensChanged?.();","// #165 — self-service password change. The server revokes every session for the","// user (other devices are signed out) and hands this one a fresh pair, so we","// swap in the returned access token; the rotated refresh cookie is set by the","// response.","// apiPost attaches an Idempotency-Key like any write, but the SERVER exempts","// this route from the response cache, so that key is inert here. Caching this","// response would persist the access token and, on replay, return it WITHOUT the","// rotated Set-Cookie — leaving the client holding a revoked refresh cookie","// (#165 review). Replay protection isn't needed anyway: a repeat can't re-apply,","// because the current password no longer matches.","export async function changePassword("," body: { currentPassword: string; newPassword: string },","): Promise {"," // #310 — this is a token-store writer like login/refresh, so it needs the"," // same generation guard: logout is reachable from every screen (AppLayout's"," // persistent button), so a user who submits a password change and logs out"," // before it lands would otherwise have the response write a fresh token back"," // over the cleared session."," const generation = sessionGeneration;"," const res = await apiPost(\"/auth/change-password\", body);"," // This response rotates the refresh cookie too, so a discarded one needs that"," // cookie revoked, not merely the in-memory token dropped.","// #308 — re-confirms the CURRENT password to mint a short-lived step-up grant","// for one sensitive user-administration call (creating another Owner;","// resetting an Owner's password). The grant is returned to the caller and","// used EXACTLY ONCE, immediately, as the X-Cluckwork-Step-Up header on that","// one follow-up request (see UsersPage.tsx) — this function itself never","// stores the token or the password anywhere longer-lived than its own return","// value, and there is nothing here to clear on logout: unlike the access","// token, no module-level state holds a step-up grant at all.","// #336 review — this goes through apiPost, so it inherits the transparent","// refresh-and-retry every 401 triggers. That is only safe because the server","// answers a REJECTED password with 400 (Users.CurrentPasswordIncorrect), the","// same status change-password uses, and reserves 401 for a genuinely","// unauthenticated caller. If /auth/step-up ever went back to 401 for a wrong","// password, one typed password would be replayed as two failed accesses —","// halving the server's five-attempt account lockout and rotating the refresh","// token per attempt. The contract is pinned by a test in client.test.ts.","export async function stepUp(password: string): Promise<{ token: string; expiresAt: string }> {"," return apiPost<{ token: string; expiresAt: string }>(\"/auth/step-up\", { password });","export async function logout(): Promise {"," // #310 — bump the generation and clear in-memory state SYNCHRONOUSLY, before"," // any await: local logout must win immediately, whatever a slower in-flight"," // login/refresh does later. Also cancel any refresh currently in flight —"," // note this only reaches a refresh that has already been GRANTED the"," // cross-tab lock (#169); one still queued behind another tab has no"," // controller yet, so it will still fire its request and then be discarded on"," // arrival by the generation check. Correctness rests on the generation, not"," // on the abort; the abort is only an optimisation so it stops sooner"," // instead of only being"," // discarded on arrival by the generation check in refreshTokens()."," sessionGeneration++;"," // #336 — capture BEFORE clearing: this tab's access token names the user who"," // actually clicked logout, and the clear below is deliberately synchronous."," // Read it after and we would always send nothing."," const bearer = getAccessToken();"," // Cookie-authenticated: the HttpOnly refresh cookie rides along and the CSRF"," // header satisfies the check. Always fires — JS can't read the HttpOnly"," // cookie to know whether a session exists, so we always ask the server to"," // revoke + clear it."," // #336 — the bearer is sent too, when this tab still has one. The refresh"," // cookie is per-origin (one per browser, last login wins) while this store"," // is per-tab, so the cookie can belong to a DIFFERENT user than the one"," // logging out here; without the bearer the server would revoke that other"," // user's step-up grants and leave this user's alive. It stays OPTIONAL —"," // the endpoint is AllowAnonymous, so an already-expired token just leaves"," // the call unauthenticated and the cookie path still ends the session, and"," // the server exempts /auth/logout from the Idempotency-Key requirement so"," // authenticating it does not make the request need one."," await raw("," \"/auth/logout\","," { method: \"POST\", headers: { [CSRF_HEADER]: \"1\" } },"," bearer ?? undefined,"," // Best-effort revoke: the in-memory token is already cleared above and this"," // failure can never reverse that. Still surfaced (not silently swallowed,"," // #310) so an operator can see the server-side session may be un-revoked —"," // logged, never the (already-cleared) token itself."," console.error(\"logout: server-side session revoke failed\", err);","// #169 — serialise refresh across tabs. The refresh token lives only in the","// shared HttpOnly cookie (#145), so two tabs refreshing at once each present the","// SAME cookie value; the second hits an already-rotated token, the server reads","// that as a replay and revokes the whole family — logging BOTH tabs out. The Web","// Locks API lets only one tab refresh at a time: the next tab runs its refresh","// only AFTER the first has rotated the cookie, so it presents the fresh token,","// not a replay. Server-side reuse-detection stays strict (unchanged). Browsers","// without navigator.locks (older Safari, insecure origins) degrade to per-tab","// single-flight only: no cross-tab guarantee, but never worse than before #169.","// Residual (a page-owned lock cannot make server rotation + cookie receipt","// atomic): if a tab is closed in the sub-second between sending a refresh and","// receiving the rotated cookie, the lock auto-releases while the cookie is still","// the old value, so the next tab can still trip reuse-detection. Narrow, but a","// full fix needs an idempotent server refresh — tracked in #176.","const REFRESH_LOCK = \"cluckwork.auth.refresh\";","// Cap how long one tab may hold the cross-tab lock. fetch() has no default","// timeout, so a hung /auth/refresh would otherwise keep the lock — and every","// other tab's refresh — parked indefinitely (#169 review). On timeout we abort,","// which releases the lock; the aborting tab recovers on its next request.","const REFRESH_TIMEOUT_MS = 15_000;","// #310 — the abort handle of whichever refresh attempt is currently running","// (if any), so logout() can cancel it outright rather than only waiting for","// the generation check below to discard its result on arrival.","let abortInFlightRefresh: (() => void) | null = null;","function withRefreshLock(run: (signal: AbortSignal) => Promise): Promise {"," const attempt = () => {"," const controller = new AbortController();"," abortInFlightRefresh = () => controller.abort();"," const timer = setTimeout(() => controller.abort(), REFRESH_TIMEOUT_MS);"," return run(controller.signal).finally(() => {"," clearTimeout(timer);"," abortInFlightRefresh = null;"," };"," const locks: LockManager | undefined = globalThis.navigator?.locks;"," return locks ? (locks.request(REFRESH_LOCK, attempt) as Promise) : attempt();","// Single-flight refresh: concurrent 401s (and the load-time bootstrap) share one","// in-flight refresh call. The refresh token rides the cookie; no body is sent.","// The per-tab latch dedupes within a tab; the cross-tab Web Lock (above) then","// serialises whatever refresh each tab still needs against the other tabs.","let refreshInFlight: Promise | null = null;","async function refreshTokens(): Promise {"," if (refreshInFlight) return refreshInFlight;"," // #310 — captured once, at the START of this flight. Checked again at"," // settlement (success or failure) so a logout/login that lands WHILE this"," // network call is in the air discards its outcome instead of committing it."," refreshInFlight = withRefreshLock((signal) =>"," raw(\"/auth/refresh\", {"," method: \"POST\","," headers: { [CSRF_HEADER]: \"1\" },"," signal,"," }),"," )"," .then("," async (res) => {"," // A SUCCESSFUL refresh rotated the cookie before we got here, so a"," // discarded one leaves live credentials in the browser — revoke them."," if (sessionGeneration !== generation) {"," await revokeSupersededCookie();"," throw new StaleSessionError();"," }"," setAccessToken(res.accessToken);"," onTokensChanged?.();"," return res.accessToken;"," },"," (err: unknown) => {"," // A late FAILURE from an obsolete generation is discarded the same as"," // a late success: the real error (e.g. a genuinely revoked refresh"," // token) might otherwise tear down a newer, still-valid session. No"," // revoke here — a failed refresh issued no cookie to revoke."," throw sessionGeneration !== generation ? new StaleSessionError() : err;"," )"," .finally(() => {"," refreshInFlight = null;"," return refreshInFlight;","// Session bootstrap (page load): the access token is memory-only, so it's gone","// after a reload — try one silent refresh against the cookie. Resolves true if a","// session was restored, false if unauthenticated (→ clean login, no error flash).","export async function restoreSession(): Promise {"," await refreshTokens();"," return true;"," return false;","// --- Authenticated request with one transparent refresh-and-retry ---------","export function apiGet(path: string): Promise {"," return apiFetch(path, { method: \"GET\" });","// Writes require an Idempotency-Key (server middleware): a retry with the same","// key replays the original response instead of repeating the side effect.","// Callers retrying a logical mutation after an ambiguous failure should pass","// the SAME key so the server dedupes instead of repeating the write.","// #308 — extraHeaders is how CreateUser/SetUserPassword attach the","// X-Cluckwork-Step-Up header for a sensitive operation; every other caller","// omits it.","export function apiPost("," body?: unknown,"," idempotencyKey?: string,"," extraHeaders?: Record,"," return apiFetch(path, {"," headers: { \"Idempotency-Key\": idempotencyKey ?? newId(), ...extraHeaders },"," body: body === undefined ? undefined : JSON.stringify(body),","export function apiPut("," body: unknown,"," method: \"PUT\",","// Raw-bytes write (#123's logo upload): same auth and the same transparent","// refresh-and-retry as apiPut, but the body goes up as it is instead of being","// JSON-encoded. Safe to retry — a Blob can be read more than once. The declared","// content type is courtesy only: the API sniffs the format from the bytes and","// ignores what the client claims.","export function apiPutBytes("," body: Blob,"," contentType: string,"," headers: {"," \"Content-Type\": contentType,"," \"Idempotency-Key\": idempotencyKey ?? newId(),"," },"," body,","export function apiDelete(path: string, idempotencyKey?: string): Promise {"," method: \"DELETE\","," headers: { \"Idempotency-Key\": idempotencyKey ?? newId() },","// File download with the same auth + one transparent refresh-and-retry as","// apiFetch. Returns the body as a Blob plus the server's suggested filename.","export async function apiGetBlob(","): Promise<{ blob: Blob; filename: string | null }> {"," const token = await currentAccessToken();"," return await rawBlob(path, token);"," if (!(err instanceof ApiError) || err.status !== 401) throw err;"," const refreshed = await refreshTokens();"," return await rawBlob(path, refreshed);"," } catch (refreshErr) {"," // #310 review — same supersession handling as apiFetch."," if (refreshErr instanceof StaleSessionError) {"," const fresh = getAccessToken();"," if (fresh) return await rawBlob(path, fresh);"," throw err;"," if (isTransientRefreshFailure(refreshErr)) throw refreshErr;"," clearAccessToken();"," onUnauthenticated?.();"," throw err;","async function rawBlob("," accessToken: string,"," const headers = new Headers({ Authorization: `Bearer ${accessToken}` });"," const res = await fetch(`${BASE}${path}`, { headers });"," const disposition = res.headers.get(\"Content-Disposition\");"," const match = disposition?.match(/filename\\*?=(?:UTF-8''|\")?([^\";]+)/i);"," return {"," blob: await res.blob(),"," filename: match ? decodeURIComponent(match[1]) : null,","export async function apiFetch(path: string, init: RequestInit = {}): Promise {"," return await raw(path, init, token);"," return await raw(path, init, refreshed);"," // #310 review — superseded mid-retry: retry once on the newer login's"," // token, or surface the ORIGINAL 401 if a logout ended the session."," // Never let the internal marker reach the caller."," if (fresh) return await raw(path, init, fresh);","// The in-memory access token, or one obtained via a silent refresh when memory","// is empty (e.g. a request racing the load-time bootstrap). Throws + signals","// unauthenticated if no session can be established.","async function currentAccessToken(): Promise {"," const token = getAccessToken();"," if (token) return token;"," return await refreshTokens();"," // #310 — a stale (obsolete-generation) failure belongs to an already-"," // superseded session: a newer login already committed its own token, or a"," // logout already tore everything down. Either way, this failure must not"," // touch the CURRENT session — no clearing, no onUnauthenticated navigate."," if (err instanceof StaleSessionError) return supersededToken();"," onUnauthenticated?.();"," throw new ApiError(401, \"NoSession\", \"Not authenticated.\");","// #310 review — resolve a discarded refresh against whatever superseded it.","// A newer LOGIN has already committed its token, so the caller's request is","// perfectly valid and should proceed on it. A newer LOGOUT left no session,","// and has already navigated, so this raises a plain 401 rather than firing","// onUnauthenticated a second time. Either way StaleSessionError itself stops","// here: it is an internal control marker, and every screen renders a non-","// ApiError's `.message` verbatim, so letting it escape would show the user","// \"Discarded: superseded by...\" in place of a real error.","function supersededToken(): string {"," const fresh = getAccessToken();"," if (fresh) return fresh;"," throw new ApiError(401, \"NoSession\", \"Not authenticated.\");","// A refresh failure is \"transient\" when the session is likely still valid, so we","// keep the tokens and surface the error rather than forcing a re-login:","// - 429: rate-limit throttling (#143) — re-logging in hits the same limit.","// - AbortError: our own cross-tab lock timeout (#169) fired on a slow/hung","// refresh; the cookie is untouched, so the next attempt can still succeed.","// - StaleSessionError (#310): the refresh belonged to an obsolete generation","// (superseded by a newer login, or discarded by a logout) — a newer/","// already-torn-down session must not be clobbered by this stale failure.","function isTransientRefreshFailure(err: unknown): boolean {"," if (err instanceof StaleSessionError) return true;"," if (err instanceof ApiError && err.status === 429) return true;"," return err instanceof DOMException && err.name === \"AbortError\";",[3028,3029,3030,3031,3032,3033,3034,3035,3036,3037],{"_1521":49,"_49":3053},{"_1521":3039,"_166":2602,"_1571":3051,"_1572":3052},{"_1521":3039,"_166":1918,"_1571":3049,"_1572":3050},{"_1521":49,"_49":3048},{"_1521":3039,"_166":1807,"_1571":3046,"_1572":3047},{"_1521":49,"_49":3045},{"_1521":3039,"_166":1699,"_1571":3043,"_1572":3044},{"_1521":49,"_49":3042},{"_1521":3039,"_166":1565,"_1571":3040,"_1572":3041},{"_1521":49,"_49":3038},"\n* Committed the changes as `73d3769` and created PR metadata titled **“test(e2e): close durable session and assertion gaps.”**\n\n**Testing**\n\n* ✅ `cd web && npm run typecheck`\n* ✅ `git diff --check`\n* ✅ `git status --short --branch` (working tree clean after commit)\n* ⚠️ `cd web && npm test -- --run src/api/client.test.ts` (environment limitation: the available Node 20 runtime rejects Vitest’s configured `--no-experimental-webstorage` worker option)\n* ⚠️ `cd tools/simulation/ui && npm run typecheck` (environment limitation: the local dependency installation is missing the Node type definitions)","repo_file_citation",90,122,"\n* Made language coverage require a successful persistence response and verify that the selected language survives a complete SPA reload. ",45,62,"\n* Restricted maximum-range performance samples to report responses containing the exact requested `from` and `to` parameters, preventing initial seven-day requests from satisfying the assertion. ",150,160,"\n* Strengthened the session-race browser test by reloading the SPA and verifying that the durable cookie restores the newer Sales session rather than the superseded Owner session. ",965,984,163,178,"### Summary\n\n* Prevented an older bootstrap refresh from overwriting the refresh cookie created by a newer explicit login, with a unit assertion confirming the pending refresh is aborted. ",{"_96":332,"_45":88,"_100":332,"_3056":3057,"_3058":3059,"_3060":3061,"_136":-5,"_123":3062},[87],"input_items",[3081,3082,3083,3084,3085],"external_post_config",{"_3063":3064,"_269":202,"_3065":311,"_280":-5,"_1541":263,"_3066":-5,"_3067":-5,"_3068":3069,"_3070":3071,"_3072":-5,"_3073":-5,"_3074":3075,"_3076":18,"_3077":62,"_3078":57,"_3079":18,"_3080":-5},"user_model_slug","slug",1785657065.650595,"installation_id",150444056,"pr_number","gitlab_service_account_project_id","review_trigger","comment_id",5156334582,"comment_type","issue","pr_write_guard_token","pending_pr_reaction_id","pending_comment_reaction_id",391568076,"comment_if_no_findings","comment_on_error","share_url","is_parallel_review","review_summary_id",{"_96":505,"_100":332,"_497":3098},{"_318":319,"_320":321,"_3095":325,"_3096":133,"_328":-5,"_96":3097},{"_96":3086,"_320":3091,"_166":3092,"_3088":3093,"_3089":3094},{"_96":3086,"_320":3090,"_166":-5,"_3088":-5,"_3089":-5},{"_96":3086,"_320":3087,"_166":-5,"_3088":-5,"_3089":-5},"pull_request_comment","### Summary\n\n* Closed the logout-race coverage gap by disabling the abort optimization in that scenario, ensuring the late refresh actually settles and exercises the `sessionGeneration` protection. [tools/simulation/ui/specs/session-races.spec.tsL33-L49](https://github.com/mforce/cluckwork/blob/2d9dce375aa2646f9c6909480b14df9deed30174/tools/simulation/ui/specs/session-races.spec.ts#L33-L49)\n* Prevented a pending bootstrap refresh from overwriting a newer login’s refresh cookie by aborting it when explicit login begins, with a unit assertion verifying the abort signal. [web/src/api/client.tsL163-L178](https://github.com/mforce/cluckwork/blob/2d9dce375aa2646f9c6909480b14df9deed30174/web/src/api/client.ts#L163-L178) [web/src/api/client.test.tsL965-L987](https://github.com/mforce/cluckwork/blob/2d9dce375aa2646f9c6909480b14df9deed30174/web/src/api/client.test.ts#L965-L987)\n* Strengthened the newer-login race test by reloading the SPA and confirming the durable refresh cookie still restores the Sales persona rather than the former Owner. [tools/simulation/ui/specs/session-races.spec.tsL156-L170](https://github.com/mforce/cluckwork/blob/2d9dce375aa2646f9c6909480b14df9deed30174/tools/simulation/ui/specs/session-races.spec.ts#L156-L170)\n* Made maximum-range report timing assertions match the requested `from` and `to` query parameters, preventing initial seven-day responses from satisfying the test. [tools/simulation/ui/specs/reports-range.spec.tsL48-L63](https://github.com/mforce/cluckwork/blob/2d9dce375aa2646f9c6909480b14df9deed30174/tools/simulation/ui/specs/reports-range.spec.ts#L48-L63)\n* Made language tests require a successful persistence response and verify the selected language survives a full SPA reload. [tools/simulation/ui/specs/i18n.spec.tsL96-L116](https://github.com/mforce/cluckwork/blob/2d9dce375aa2646f9c6909480b14df9deed30174/tools/simulation/ui/specs/i18n.spec.ts#L96-L116) [tools/simulation/ui/specs/i18n.spec.tsL130-L136](https://github.com/mforce/cluckwork/blob/2d9dce375aa2646f9c6909480b14df9deed30174/tools/simulation/ui/specs/i18n.spec.ts#L130-L136)\n* Committed the changes as `8c2b1b0` and created PR metadata titled **“test(e2e): close remaining round-1 assertion gaps.”**\n\n**Testing**\n\n* ✅ `cd web && npm run typecheck`\n* ✅ `git diff --check`\n* ⚠️ `cd tools/simulation/ui && npm ci && npm run typecheck` (package registry returned HTTP 403 while fetching `playwright-core`)\n* ⚠️ `cd web && npm test -- --run src/api/client.test.ts` (the available Node 20 runtime rejects Vitest’s configured `--no-experimental-webstorage` worker option)\n* ⚠️ `graphify update .` (`graphify` is not installed in the environment)\n\n [View task →](https://chatgpt.com/s/cd_6a6ef097f398819197019aa5f8ed983d)","side","line","@codex Round-1 review applied. Four reviewers ran (codex, two Claude agents, pi/glm-5.2); findings consolidated below with agreement counts. Fixes are in `7347cad` (distributed across the stack as `feat/277-e2e-smoke` → `feat/386-canary` → `chore/387-e2e-ci`, by merge rather than rebase — these branches are already pushed and force-pushing them is off the table).\n\n## Blocker — confirmed, fixed, and the credential rotated\n\n**Committed Playwright trace archives (3/4 reviewers).** Confirmed by extracting them: **36 occurrences of the Owner password in plaintext, 60 JWTs, 24 refresh-cookie entries** across four zips. Root cause: `.gitignore` listed `playwright-report/`, a trailing-slash pattern that is a literal directory name and never matched `playwright-report-canary/`, combined with `git add -A`.\n\nDone:\n- Files removed; ignore patterns are now globs (`playwright-report*/`, `test-results*/`, `blob-report*/`).\n- **Credentials rotated and verified dead.** I recovered the leaked password *from the committed trace itself* via git history and re-tested it: **401**. The new one: **200**. `bootstrap.sh --force` had silently failed first (`requires openssl on PATH` — this box is NixOS), so the first rotation attempt did nothing; caught by testing rather than assuming.\n- Worth flagging: **GitGuardian passed this PR.** Its scan does not look inside a zip.\n\nThe blobs remain in these branches' history. Purging needs a force-push, which I have not done — the credentials are throwaway, local-only and now rotated, so the exposure is inert, but the call is the owner's.\n\n## Vacuous assertions — all confirmed, all fixed\n\nEach of these would have stayed green with the guarantee removed:\n\n| Finding | Agreement | Fix |\n| --- | --- | --- |\n| Audit filter asserted `filtered <= all` — true for a filter that does nothing | 3/4 | Asserts every visible row carries the selected action |\n| `getByRole(\"row\")` counts the `` row, so a header-only table passed `not.toHaveCount(0)` | codex | `tbody tr` |\n| Dashboard test promised \"sales data\" and never looked at the sales panel | codex | Asserts the sales table has body rows |\n| PWA denylist probed with `fetch()`, which `navigateFallback` does not govern at all | codex | Real `page.goto()` navigations |\n| ReadOnly deep-link asserted a visible error, which a 500 also satisfies | codex | Captures the response and requires **403** |\n| Canary vitals recorded but never validated — deleting every observer gave all-nulls and green | codex | Asserts the instrument collected something |\n\n**The audit fix needed a second pass.** My first version asserted a strict row-count drop; it passed alone and failed **intermittently** in a full run, because the audit log paginates *and* the other specs write to it while it runs. The count comparison is gone — \"every row matches the selected action\" is page-size- and growth-independent. Verified stable over three consecutive full runs.\n\n## Mutation harness — two real defects in my own harness\n\n- **`KILLED` was awarded to any failure, including a crash** (codex + pi). An uncaught `TypeError` reports as `1 failed` exactly like a failed expectation, so the check that claimed to exclude crashes did not. Now requires an assertion-shaped failure; anything else is `INCONCLUSIVE` and **counts as survived**.\n- **`mutants.ts` claimed nav-gate coverage via \"spec-level vacuity mutants\" that did not exist** (3/4). That comment was actively hiding the gap it described. Three mutants added: `nav-role-gate-bypassed`, `payment-never-settles`, `export-returns-nothing`.\n\nThe nav mutant **survived on its first run**, and the harness reporting that is the point: forging the login token is not enough, because the SPA's bootstrap refresh replaces it before the nav renders. Fixed by forging both, and the reasoning is now in the file.\n\n```\nbaseline : GREEN\nkilled : 10 survived : 0\nrestore : GREEN\n```\n\n## Security, beyond the blocker\n\n- **`reset.sh` echoed `bootstrap-admin`'s one-time password** (codex). Unmasked in every CI log of the new workflow. Redacted at the source, so local runs stop printing it too.\n- **Trace archives were being uploaded as a CI artifact** (codex). Same leak as committing them, through a different door. The workflow now strips every `*.zip` before upload and prints what remains; retention cut to 7 days.\n\n## Prose corrected where it claimed more than the code delivered\n\n`mutants.ts` (coverage that did not exist), `browser.ts` (claimed the canary records the browser version — it does not, and that gap is now stated), `vitals.ts` (called a pre-finalisation LCP read \"exact\"), `README.md` (omitted the `CLUCKWORK_E2E_BUNDLED_BROWSER` short-circuit from the resolution order).\n\n## Declined, with reasons\n\n- **\"Worker spec is not re-runnable\" (pi).** Checked rather than accepted: `RecordDailyEntry` is an upsert on `(account, farm, house, flock, date)`, and the spec saves a draft and never submits — so a second run updates the same row. Verified by repeated consecutive runs. The real defect was that this was undocumented, which is fixed.\n- **\"Sales spec exhausts stock\" (2/4).** Real but not fixable here without isolated inventory. Documented in the spec with the symptom and the remedy (`reset.sh`), matching how `manager.spec.ts` already treats its own fixture growth.\n\n## Still open — carried, not silently dropped\n\nThese are codex findings I have **not** fixed, listed so they are visible rather than buried:\n\n1. `session-races.spec.ts` — logout aborts the held refresh via `AbortController`, so the \"late response\" may never settle; the test could pass without the `sessionGeneration` guard.\n2. `session-races.spec.ts` — \"newer login wins\" is asserted only against the in-memory token; a late `Set-Cookie` could still restore Owner after a reload.\n3. `reports-range.spec.ts` — `timings` includes the initial 7-day requests, so removing refetch-on-date-change may leave it green.\n4. `i18n.spec.ts` — assertions observe the optimistic local `changeLanguage`; deleting `PUT /me/language` would leave them green despite the durable-preference claim.\n5. `run-baseline.sh` — a stale canary vitals directory from another commit is folded into any baseline and described as the same window; needs run/commit stamping.\n6. `run-canary.sh` — k6 liveness is only checked during the initial 45s wait, so later screens could run quietly while still labelled \"under load\".\n7. `logout-not-honoured` mutant is killed by the cookie never clearing, not by the stale-refresh guarantee it is mapped to.\n\n(1)–(4) are further vacuous-assertion candidates and are the ones I would take next.\n","## CodeQL / File data in outbound network request\n\nOutbound network request depends on [file data](1).\n\n[Show more details](https://github.com/mforce/cluckwork/security/code-scanning/120)","tools/simulation/ui/src/api.ts","RIGHT",39,"base_ref","head_ref","pull_request_info",[3099],{"_1521":49,"_49":3100},"@codex Round 2 complete — full four-way again (codex, two Claude agents, pi). Fixes in `6992b8f`.\n\n**Every finding that mattered this round was against round 1's own fixes.** That is the argument for running a second round, so it is worth stating plainly.\n\n## Security — one new high, and it invalidated a fix that looked complete\n\n**The Playwright HTML report is credential-bearing by construction.** Playwright embeds a base64 copy of the run inside `index.html` and renders step titles containing literal fill values — a sign-in step reads `Fill \"\"`. Round 1's \"strip the trace zips\" left that untouched: the credential simply rode in the HTML instead.\n\nCI no longer uploads the report at all. Screenshots and video only (the password field is masked in the DOM, and they carry no request bodies); which spec failed on which assertion is already in the job log via the `list` reporter.\n\nAlso fixed:\n- **The strip step failed open** — `|| true` on both `find`s, while the upload runs `if: always()`. A mechanism to stop a credential reaching a retained artifact, with no enforcement. Now a real gate that exits non-zero.\n- `error-context.md` can embed a failed request's body — stripped too.\n- `reset.sh`'s redaction was anchored to `^Temporary password:`, so any indent or log-level prefix would leak it.\n\n## The mutation harness was wrong twice, in opposite directions\n\n1. The round-1 \"assertion-shaped failure\" grep matched `expect(` **anywhere in the log**, including the source **code frame** Playwright prints around *every* failure. A reviewer reproduced it: a `TypeError` two lines after a passing `expect(true).toBe(true)` reported as `KILLED`. Now anchored to the matcher-summary line, which a code frame cannot match (it carries a `> N |` prefix).\n2. That anchor then demoted **three genuine kills** to `INCONCLUSIVE` — Playwright prints the matcher inline after `Error: ` when no custom message is supplied. The optional prefix is now accepted.\n\nThe harness caught the second one on itself, by reporting the three as survivors rather than passing quietly. Verified against the real logs of all ten mutants rather than assumed.\n\n**`nav-role-gate-bypassed` is a FALSE kill and is now labelled as one.** The forged token is rejected by the server, so sign-in fails before the nav assertion is ever reached — 2/4 reviewers caught this independently and my own log inspection agreed. The nav role gates are recorded as **unmutated**, not covered. This is the second time that claim has had to be withdrawn; the generalisable reason is now in the file: *a client-side gate whose input the server also validates cannot be mutated from the network boundary, because breaking the input breaks the session first.*\n\n## Specs\n\n- **Audit filter** had an unstated cross-file ordering coupling — it selected `options[1]`, which only existed because `manager.spec.ts` sorts earlier and performs one adjust per run. It now derives the target from the rows actually on screen.\n- **Audit filter, again** — the \"wait\" before reading filtered rows was `expect(getByRole(\"alert\")).toBeHidden()`, which is *vacuous* on this screen (no alert renders on the success path, so it resolves on the first poll), and `allInnerTexts()` does not retry. Now polls for a settled result. This is the third revision of this one assertion.\n- **`pwa.spec.ts`** no longer accepts `ERR_ABORTED` (the signature of the settle-race the fix itself introduced) and requires an observed non-HTML **server response**, so a down backend cannot read as green.\n- **Canary** no longer requires a non-null LCP on every screen — a sparse page has no candidate, which is a fact about the page, not the instrument.\n- **`run-canary.sh`** clears prior vitals only after preconditions pass; CI calls the script rather than `npm run canary`, which bypassed that cleanup.\n\n## Verified\n\n```\nsmoke : 28 passed, 1 skipped\ncanary : 4 passed\ntypecheck: clean\nmutation : baseline GREEN -> 10 killed / 0 survived -> restore GREEN\n```\n\n## Still open — carried, not dropped\n\n- **The four trace blobs remain reachable via ancestor `076bf3c`.** Confirmed by codex. Removing them from HEAD did not remove them from history; a purge needs a force-push, which is the owner's call. The credentials were rotated and verified dead (leaked value → 401, new → 200), so the exposure is inert.\n- Seven round-1 findings remain open — the two `session-races` ones, `reports-range` timings, `i18n` durable preference, `run-baseline` stale-vitals stamping, `run-canary` k6 liveness, and the `logout-not-honoured` mutant's mismapping.\n- Round 2 additions not yet done: `run-baseline.sh` does not warn on a partial canary directory (missing screens render as a smaller run), and the findings-doc note still says the bounds \"can only over-report\".\n\nReady for round 3.\n",[3856,3857,3858],[],{"_1526":1527,"_49":1528,"_1529":1530},{"_1500":3847},{"_342":3846},{"_342":3137},{"_310":311,"_301":312,"_313":314,"_315":62,"_316":18,"_317":18,"_318":319,"_320":321,"_322":273,"_323":131,"_324":325,"_326":327,"_328":329,"_330":-5,"_331":-5,"_332":3136,"_334":335,"_336":337,"_338":339,"_340":35},{"_45":127,"_199":200,"_201":202,"_203":18,"_204":205,"_206":207,"_208":3125,"_210":-5,"_211":212,"_213":18,"_214":3126,"_216":205,"_217":205,"_218":3127,"_220":3128,"_222":3129,"_224":-5,"_225":226,"_227":228,"_229":230,"_231":3130,"_58":-5,"_123":233,"_234":3131,"_236":3132,"_238":239,"_240":18,"_241":18},{"_137":3118},[3111,3112,3113,3114,3115,3116,3117],{"_153":178,"_155":156,"_157":158,"_159":160,"_161":162,"_163":164,"_165":35,"_166":-5},{"_153":177,"_155":156,"_157":158,"_159":160,"_161":174,"_163":164,"_165":35,"_166":-5},{"_153":175,"_155":156,"_157":158,"_159":160,"_161":176,"_163":164,"_165":35,"_166":-5},{"_153":173,"_155":156,"_157":158,"_159":160,"_161":174,"_163":164,"_165":35,"_166":-5},{"_153":172,"_155":168,"_157":169,"_159":160,"_161":171,"_163":164,"_165":35,"_166":-5},{"_153":167,"_155":168,"_157":169,"_159":170,"_161":171,"_163":164,"_165":35,"_166":-5},{"_153":154,"_155":156,"_157":158,"_159":160,"_161":162,"_163":164,"_165":35,"_166":-5},[3119,3120,3121],{"_183":3124,"_185":196},{"_183":3123,"_185":192},{"_183":3122,"_185":186},{"_187":188,"_96":189,"_123":190},{"_187":193,"_96":189,"_123":194},{"_187":197,"_96":189,"_123":198},{"_303":304,"_305":-5,"_306":-5,"_307":-5,"_308":-5,"_309":-5},[263],{"_263":3133},{"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":256,"_257":258,"_259":260,"_261":262},{},[],{"_244":62},{"_242":62,"_243":205},{"_45":265,"_187":266,"_267":3134,"_269":202,"_270":271,"_272":273,"_274":275,"_276":277,"_278":279,"_280":67,"_281":18,"_282":-5,"_283":-5,"_284":-5,"_285":-5,"_286":-5,"_287":-5,"_165":288,"_289":-5,"_58":3135},{"_295":296,"_45":297,"_96":298,"_299":300,"_301":302},{"_291":18,"_292":18,"_293":18,"_294":18},{"_295":296,"_187":296,"_341":-5,"_299":300,"_45":297},[3138,3139,3140,3141,3142,3143,3144,3145,3146,3147,3148,3149,3150,3151,3152,3153,3154,3155,3156,3157,3158,3159,3160,3161,3162,3163,3164,3165,3166,3167,3168,3169,3170,3171,3172,3173,3174,3175,3176,3177,3178,3179,3180,3181,3182,3183,3184,3185,3186,3187,3188,3189,3190,3191,3192,3193,3194,3195,3196,3197,3198,3199,3200,3201,3202,3203,3204,3205,3206,3207,3208,3209,3210,3211,3212,3213,3214,3215,3216,3217,3218,3219,3220,3221,3222,3223,3224,3225,3226,3227,3228,3229,3230,3231,3232,3233,3234,3235,3236,3237,3238,3239,3240,3241,3242,3243,3244,3245,3246,3247,3248,3249,3250,3251,3252,3253,3254,3255,3256,3257,3258,3259,3260,3261,3262,3263],{"_159":1472,"_471":3842},{"_159":488,"_471":3839},{"_159":1462,"_471":3836},{"_159":492,"_471":3830},{"_159":492,"_471":3825},{"_159":492,"_471":3820},{"_159":492,"_471":3814},{"_159":492,"_471":3809},{"_159":510,"_471":3804},{"_159":510,"_471":3800},{"_159":492,"_471":3795},{"_159":492,"_471":3792},{"_159":510,"_471":3788},{"_159":492,"_471":3781},{"_159":510,"_471":3777},{"_159":492,"_471":3772},{"_159":492,"_471":3769},{"_159":510,"_471":3765},{"_159":492,"_471":3758},{"_159":510,"_471":3754},{"_159":492,"_471":3750},{"_159":492,"_471":3747},{"_159":510,"_471":3743},{"_159":492,"_471":3736},{"_159":510,"_471":3732},{"_159":492,"_471":3727},{"_159":492,"_471":3724},{"_159":510,"_471":3718},{"_159":492,"_471":3711},{"_159":492,"_471":3708},{"_159":510,"_471":3701},{"_159":492,"_471":3694},{"_159":510,"_471":3690},{"_159":492,"_471":3685},{"_159":492,"_471":3682},{"_159":510,"_471":3678},{"_159":492,"_471":3671},{"_159":510,"_471":3667},{"_159":492,"_471":3661},{"_159":492,"_471":3658},{"_159":510,"_471":3651},{"_159":492,"_471":3644},{"_159":510,"_471":3640},{"_159":492,"_471":3636},{"_159":492,"_471":3633},{"_159":510,"_471":3627},{"_159":492,"_471":3620},{"_159":510,"_471":3616},{"_159":492,"_471":3611},{"_159":492,"_471":3608},{"_159":510,"_471":3597},{"_159":492,"_471":3590},{"_159":510,"_471":3586},{"_159":492,"_471":3581},{"_159":492,"_471":3578},{"_159":510,"_471":3572},{"_159":492,"_471":3565},{"_159":510,"_471":3561},{"_159":492,"_471":3555},{"_159":492,"_471":3552},{"_159":510,"_471":3547},{"_159":492,"_471":3540},{"_159":510,"_471":3536},{"_159":492,"_471":3531},{"_159":492,"_471":3528},{"_159":492,"_471":3521},{"_159":510,"_471":3517},{"_159":510,"_471":3513},{"_159":492,"_471":3508},{"_159":492,"_471":3505},{"_159":510,"_471":3500},{"_159":492,"_471":3493},{"_159":510,"_471":3489},{"_159":492,"_471":3484},{"_159":492,"_471":3481},{"_159":492,"_471":3478},{"_159":510,"_471":3474},{"_159":492,"_471":3470},{"_159":492,"_471":3467},{"_159":492,"_471":3464},{"_159":492,"_471":3461},{"_159":492,"_471":3458},{"_159":492,"_471":3455},{"_159":492,"_471":3452},{"_159":492,"_471":3449},{"_159":492,"_471":3446},{"_159":492,"_471":3443},{"_159":492,"_471":3435},{"_159":510,"_471":3431},{"_159":492,"_471":3426},{"_159":492,"_471":3423},{"_159":510,"_471":3419},{"_159":492,"_471":3416},{"_159":510,"_471":3412},{"_159":492,"_471":3409},{"_159":492,"_471":3401},{"_159":510,"_471":3397},{"_159":510,"_471":3393},{"_159":492,"_471":3387},{"_159":492,"_471":3384},{"_159":510,"_471":3379},{"_159":492,"_471":3372},{"_159":492,"_471":3369},{"_159":510,"_471":3365},{"_159":492,"_471":3358},{"_159":510,"_471":3354},{"_159":492,"_471":3349},{"_159":492,"_471":3346},{"_159":510,"_471":3342},{"_159":492,"_471":3334},{"_159":510,"_471":3330},{"_159":492,"_471":3325},{"_159":492,"_471":3322},{"_159":492,"_471":3315},{"_159":492,"_471":3312},{"_159":510,"_471":3305},{"_159":492,"_471":3298},{"_159":510,"_471":3294},{"_159":492,"_471":3290},{"_159":492,"_471":3287},{"_159":510,"_471":3283},{"_159":492,"_471":3276},{"_159":510,"_471":3274},{"_159":492,"_471":3269},{"_159":488,"_471":3267},{"_159":470,"_471":3264},{"_473":474,"_91":3265},{"_476":477,"_478":479,"_107":-5,"_45":480,"_481":3266,"_483":484,"_485":486,"_487":117},[],{"_487":3268,"_473":474},{"_96":491},{"_494":3270,"_473":474,"_496":480},{"_497":3271,"_499":-5,"_45":500,"_501":3272,"_503":504,"_100":97,"_96":505},[3273],{"_506":480},{"_49":508,"_96":509},{"_512":513,"_494":3275,"_473":474,"_496":480},{"_45":500,"_503":504,"_49":508,"_96":515},{"_494":3277,"_473":474,"_496":480},{"_518":519,"_45":-5,"_501":3278,"_187":-5,"_521":3279,"_96":523},{"_506":480},{"_320":3280,"_525":-5},[3281,3282],{"_49":530,"_96":529},{"_49":528,"_96":529},{"_512":532,"_494":3284,"_473":474,"_496":480},{"_534":528,"_535":536,"_537":3285,"_539":540,"_478":35,"_541":35,"_45":542,"_543":544,"_545":546,"_487":117,"_96":547},[3286],{"_535":549,"_96":550},{"_494":3288,"_473":474,"_496":480},{"_518":519,"_45":553,"_554":555,"_501":3289,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":3291,"_473":474,"_496":480},{"_497":-5,"_562":563,"_45":564,"_501":3292,"_566":3293,"_96":568},{"_506":480},[],{"_512":570,"_494":3295,"_473":474,"_496":480},{"_497":3296,"_45":564,"_566":3297,"_96":568},[],[],{"_494":3299,"_473":474,"_496":480},{"_518":576,"_45":-5,"_501":3300,"_187":-5,"_521":3301,"_96":523},{"_506":480},{"_320":3302,"_525":-5},[3303,3304],{"_49":583,"_96":529},{"_49":582,"_96":529},{"_512":585,"_494":3306,"_473":474,"_496":480},{"_587":-5,"_588":3307,"_478":590,"_107":-5,"_45":591,"_592":-5,"_593":-5,"_594":-5,"_595":3308,"_597":598,"_487":117,"_599":598,"_96":600},{"_318":605,"_320":606},{"_601":-5,"_497":3309,"_603":3310},[3311],{"_318":605,"_320":606},{"_96":49,"_49":582},{"_494":3313,"_473":474,"_496":480},{"_518":576,"_45":610,"_554":611,"_501":3314,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":3316,"_473":474,"_496":480},{"_518":615,"_45":-5,"_501":3317,"_187":-5,"_521":3318,"_96":523},{"_506":480},{"_320":3319,"_525":-5},[3320,3321],{"_49":583,"_96":529},{"_49":621,"_96":529},{"_494":3323,"_473":474,"_496":480},{"_518":615,"_45":624,"_554":625,"_501":3324,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":3326,"_473":474,"_496":480},{"_497":-5,"_562":629,"_45":630,"_501":3327,"_566":3328,"_96":568},{"_506":480},[3329],{"_49":634,"_96":635},{"_512":637,"_494":3331,"_473":474,"_496":480},{"_497":3332,"_45":630,"_566":3333,"_96":568},[],[634],{"_494":3335,"_473":474,"_496":480},{"_518":643,"_45":-5,"_501":3336,"_187":-5,"_521":3337,"_96":523},{"_506":480},{"_320":3338,"_525":-5},[3339,3340,3341],{"_49":530,"_96":529},{"_49":651,"_96":529},{"_49":650,"_96":529},{"_512":653,"_494":3343,"_473":474,"_496":480},{"_534":651,"_535":655,"_537":3344,"_539":540,"_478":35,"_541":35,"_45":657,"_543":658,"_545":546,"_487":117,"_96":547},[3345],{"_535":660,"_96":550},{"_494":3347,"_473":474,"_496":480},{"_518":643,"_45":663,"_554":664,"_501":3348,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":3350,"_473":474,"_496":480},{"_497":-5,"_562":668,"_45":669,"_501":3351,"_566":3352,"_96":568},{"_506":480},[3353],{"_49":673,"_96":635},{"_512":675,"_494":3355,"_473":474,"_496":480},{"_497":3356,"_45":669,"_566":3357,"_96":568},[],[673],{"_494":3359,"_473":474,"_496":480},{"_518":681,"_45":-5,"_501":3360,"_187":-5,"_521":3361,"_96":523},{"_506":480},{"_320":3362,"_525":-5},[3363,3364],{"_49":530,"_96":529},{"_49":687,"_96":529},{"_512":689,"_494":3366,"_473":474,"_496":480},{"_534":687,"_535":691,"_537":3367,"_539":540,"_478":35,"_541":35,"_45":693,"_543":694,"_545":546,"_487":117,"_96":547},[3368],{"_535":696,"_96":550},{"_494":3370,"_473":474,"_496":480},{"_518":681,"_45":699,"_554":700,"_501":3371,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":3373,"_473":474,"_496":480},{"_518":704,"_45":-5,"_501":3374,"_187":-5,"_521":3375,"_96":523},{"_506":480},{"_320":3376,"_525":-5},[3377,3378],{"_49":711,"_96":529},{"_49":710,"_96":529},{"_512":713,"_494":3380,"_473":474,"_496":480},{"_715":3381,"_45":717,"_487":117,"_96":718},[3382],{"_331":720,"_9":3383,"_166":722},{"_723":-5,"_96":724},{"_494":3385,"_473":474,"_496":480},{"_518":704,"_45":727,"_554":728,"_501":3386,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":3388,"_473":474,"_496":480},{"_497":-5,"_562":732,"_45":733,"_501":3389,"_566":3390,"_96":568},{"_506":480},[3391,3392],{"_49":739,"_96":635},{"_49":738,"_96":635},{"_512":741,"_494":3394,"_473":474,"_496":480},{"_497":3395,"_45":733,"_566":3396,"_96":568},[],[739,738],{"_512":746,"_494":3398,"_473":474,"_496":480},{"_534":748,"_535":749,"_537":3399,"_539":751,"_478":752,"_541":753,"_45":754,"_543":755,"_545":546,"_487":756,"_96":547},[3400],{"_535":758,"_96":550},{"_494":3402,"_473":474,"_496":480},{"_518":761,"_45":-5,"_501":3403,"_521":3404,"_96":764},{"_506":480},{"_320":3405,"_525":-5},[3406,3407,3408],{"_49":583,"_96":529},{"_49":770,"_96":529},{"_49":769,"_96":529},{"_494":3410,"_473":474,"_496":480},{"_588":773,"_518":761,"_45":774,"_501":3411,"_187":776,"_558":-5,"_96":777},{"_506":480},{"_512":779,"_494":3413,"_473":474,"_496":480},{"_534":781,"_535":782,"_537":3414,"_539":751,"_478":784,"_541":35,"_45":785,"_543":786,"_545":546,"_487":117,"_96":547},[3415],{"_535":788,"_96":550},{"_494":3417,"_473":474,"_496":480},{"_518":791,"_45":-5,"_501":3418,"_187":-5,"_521":793,"_96":523},{"_506":480},{"_512":795,"_494":3420,"_473":474,"_496":480},{"_534":797,"_535":782,"_537":3421,"_539":799,"_478":800,"_541":801,"_45":802,"_543":803,"_545":546,"_487":756,"_96":547},[3422],{"_535":788,"_96":550},{"_494":3424,"_473":474,"_496":480},{"_518":791,"_45":807,"_554":808,"_501":3425,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":3427,"_473":474,"_496":480},{"_497":-5,"_562":812,"_45":813,"_501":3428,"_566":3429,"_96":568},{"_506":480},[3430],{"_49":817,"_96":635},{"_512":819,"_494":3432,"_473":474,"_496":480},{"_497":3433,"_45":813,"_566":3434,"_96":568},[],[817],{"_494":3436,"_473":474,"_496":480},{"_518":825,"_45":-5,"_501":3437,"_521":3438,"_96":764},{"_506":480},{"_320":3439,"_525":-5},[3440,3441,3442],{"_49":583,"_96":529},{"_49":748,"_96":529},{"_49":832,"_96":529},{"_494":3444,"_473":474,"_496":480},{"_588":835,"_518":825,"_45":836,"_501":3445,"_187":776,"_558":-5,"_96":777},{"_506":480},{"_494":3447,"_473":474,"_496":480},{"_518":840,"_45":-5,"_501":3448,"_521":842,"_96":764},{"_506":480},{"_494":3450,"_473":474,"_496":480},{"_588":835,"_518":840,"_45":845,"_501":3451,"_187":776,"_558":-5,"_96":777},{"_506":480},{"_494":3453,"_473":474,"_496":480},{"_518":849,"_45":-5,"_501":3454,"_521":842,"_96":764},{"_506":480},{"_494":3456,"_473":474,"_496":480},{"_588":835,"_518":849,"_45":853,"_501":3457,"_187":776,"_558":-5,"_96":777},{"_506":480},{"_494":3459,"_473":474,"_496":480},{"_518":857,"_45":-5,"_501":3460,"_521":842,"_96":764},{"_506":480},{"_494":3462,"_473":474,"_496":480},{"_588":835,"_518":857,"_45":861,"_501":3463,"_187":776,"_558":-5,"_96":777},{"_506":480},{"_494":3465,"_473":474,"_496":480},{"_518":865,"_45":-5,"_501":3466,"_521":842,"_96":764},{"_506":480},{"_494":3468,"_473":474,"_496":480},{"_588":835,"_518":865,"_45":869,"_501":3469,"_187":776,"_558":-5,"_96":777},{"_506":480},{"_494":3471,"_473":474,"_496":480},{"_497":-5,"_562":873,"_45":874,"_501":3472,"_566":3473,"_96":568},{"_506":480},[],{"_512":878,"_494":3475,"_473":474,"_496":480},{"_497":3476,"_45":874,"_566":3477,"_96":568},[],[],{"_494":3479,"_473":474,"_496":480},{"_518":884,"_45":-5,"_501":3480,"_187":-5,"_521":886,"_96":523},{"_506":480},{"_494":3482,"_473":474,"_496":480},{"_518":884,"_45":889,"_554":890,"_501":3483,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":3485,"_473":474,"_496":480},{"_497":-5,"_562":894,"_45":895,"_501":3486,"_566":3487,"_96":568},{"_506":480},[3488],{"_49":899,"_96":635},{"_512":901,"_494":3490,"_473":474,"_496":480},{"_497":3491,"_45":895,"_566":3492,"_96":568},[],[899],{"_494":3494,"_473":474,"_496":480},{"_518":907,"_45":-5,"_501":3495,"_187":-5,"_521":3496,"_96":523},{"_506":480},{"_320":3497,"_525":-5},[3498,3499],{"_49":583,"_96":529},{"_49":710,"_96":529},{"_512":914,"_494":3501,"_473":474,"_496":480},{"_715":3502,"_45":917,"_487":117,"_96":718},[3503],{"_331":919,"_9":3504,"_166":921},{"_723":-5,"_96":724},{"_494":3506,"_473":474,"_496":480},{"_518":907,"_45":924,"_554":925,"_501":3507,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":3509,"_473":474,"_496":480},{"_497":-5,"_562":929,"_45":930,"_501":3510,"_566":3511,"_96":568},{"_506":480},[3512],{"_49":934,"_96":635},{"_512":936,"_494":3514,"_473":474,"_496":480},{"_497":3515,"_45":930,"_566":3516,"_96":568},[],[934],{"_512":941,"_494":3518,"_473":474,"_496":480},{"_534":943,"_535":944,"_537":3519,"_539":540,"_478":946,"_541":753,"_45":947,"_543":948,"_545":546,"_487":756,"_96":547},[3520],{"_535":950,"_96":550},{"_494":3522,"_473":474,"_496":480},{"_518":953,"_45":-5,"_501":3523,"_187":-5,"_521":3524,"_96":523},{"_506":480},{"_320":3525,"_525":-5},[3526,3527],{"_49":960,"_96":529},{"_49":959,"_96":529},{"_494":3529,"_473":474,"_496":480},{"_518":953,"_45":963,"_554":964,"_501":3530,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":3532,"_473":474,"_496":480},{"_497":-5,"_562":968,"_45":969,"_501":3533,"_566":3534,"_96":568},{"_506":480},[3535],{"_49":973,"_96":635},{"_512":975,"_494":3537,"_473":474,"_496":480},{"_497":3538,"_45":969,"_566":3539,"_96":568},[],[973],{"_494":3541,"_473":474,"_496":480},{"_518":981,"_45":-5,"_501":3542,"_187":-5,"_521":3543,"_96":523},{"_506":480},{"_320":3544,"_525":-5},[3545,3546],{"_49":711,"_96":529},{"_49":710,"_96":529},{"_512":988,"_494":3548,"_473":474,"_496":480},{"_715":3549,"_45":991,"_487":117,"_96":718},[3550],{"_331":993,"_9":3551,"_166":921},{"_723":-5,"_96":724},{"_494":3553,"_473":474,"_496":480},{"_518":981,"_45":997,"_554":998,"_501":3554,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":3556,"_473":474,"_496":480},{"_497":-5,"_562":1002,"_45":1003,"_501":3557,"_566":3558,"_96":568},{"_506":480},[3559,3560],{"_49":1009,"_96":635},{"_49":1008,"_96":635},{"_512":1011,"_494":3562,"_473":474,"_496":480},{"_497":3563,"_45":1003,"_566":3564,"_96":568},[],[1009,1008],{"_494":3566,"_473":474,"_496":480},{"_518":1017,"_45":-5,"_501":3567,"_187":-5,"_521":3568,"_96":523},{"_506":480},{"_320":3569,"_525":-5},[3570,3571],{"_49":711,"_96":529},{"_49":1023,"_96":529},{"_512":1025,"_494":3573,"_473":474,"_496":480},{"_534":1023,"_535":1027,"_537":3574,"_539":540,"_478":35,"_541":35,"_45":1029,"_543":1030,"_545":546,"_487":117,"_96":547},[3575,3576,3577],{"_535":1040,"_187":1041,"_166":921,"_96":1037},{"_535":1038,"_187":1035,"_166":1039,"_96":1037},{"_535":1034,"_187":1035,"_166":1036,"_96":1037},{"_494":3579,"_473":474,"_496":480},{"_518":1017,"_45":1044,"_554":1045,"_501":3580,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":3582,"_473":474,"_496":480},{"_497":-5,"_562":1049,"_45":1050,"_501":3583,"_566":3584,"_96":568},{"_506":480},[3585],{"_49":1054,"_96":635},{"_512":1056,"_494":3587,"_473":474,"_496":480},{"_497":3588,"_45":1050,"_566":3589,"_96":568},[],[1054],{"_494":3591,"_473":474,"_496":480},{"_518":1062,"_45":-5,"_501":3592,"_187":-5,"_521":3593,"_96":523},{"_506":480},{"_320":3594,"_525":-5},[3595,3596],{"_49":583,"_96":529},{"_49":710,"_96":529},{"_512":1069,"_494":3598,"_473":474,"_496":480},{"_715":3599,"_45":1072,"_487":117,"_96":718},[3600,3601,3602,3603],{"_331":1085,"_9":3607,"_166":1087},{"_331":1082,"_9":3606,"_166":1084},{"_331":1080,"_9":3605,"_166":722},{"_331":1077,"_9":3604,"_166":1079},{"_723":-5,"_96":724},{"_723":-5,"_96":724},{"_723":-5,"_96":724},{"_723":-5,"_96":724},{"_494":3609,"_473":474,"_496":480},{"_518":1062,"_45":1090,"_554":1091,"_501":3610,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":3612,"_473":474,"_496":480},{"_497":-5,"_562":1095,"_45":1096,"_501":3613,"_566":3614,"_96":568},{"_506":480},[3615],{"_49":1100,"_96":635},{"_512":1102,"_494":3617,"_473":474,"_496":480},{"_497":3618,"_45":1096,"_566":3619,"_96":568},[],[1100],{"_494":3621,"_473":474,"_496":480},{"_518":1108,"_45":-5,"_501":3622,"_187":-5,"_521":3623,"_96":523},{"_506":480},{"_320":3624,"_525":-5},[3625,3626],{"_49":530,"_96":529},{"_49":1114,"_96":529},{"_512":1116,"_494":3628,"_473":474,"_496":480},{"_534":1114,"_535":1118,"_537":3629,"_539":540,"_478":35,"_541":35,"_45":1120,"_543":1121,"_545":546,"_487":117,"_96":547},[3630,3631,3632],{"_535":1131,"_166":1130,"_1126":1132,"_96":1128},{"_535":1129,"_187":1130,"_166":1079,"_96":1037},{"_535":1125,"_166":1041,"_1126":1127,"_96":1128},{"_494":3634,"_473":474,"_496":480},{"_518":1108,"_45":1135,"_554":1136,"_501":3635,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":3637,"_473":474,"_496":480},{"_497":-5,"_562":1140,"_45":1141,"_501":3638,"_566":3639,"_96":568},{"_506":480},[],{"_512":1145,"_494":3641,"_473":474,"_496":480},{"_497":3642,"_45":1141,"_566":3643,"_96":568},[],[],{"_494":3645,"_473":474,"_496":480},{"_518":1151,"_45":-5,"_501":3646,"_187":-5,"_521":3647,"_96":523},{"_506":480},{"_320":3648,"_525":-5},[3649,3650],{"_49":530,"_96":529},{"_49":1157,"_96":529},{"_512":1159,"_494":3652,"_473":474,"_496":480},{"_534":1157,"_535":1161,"_537":3653,"_539":540,"_478":753,"_541":35,"_45":1163,"_543":1164,"_545":546,"_487":117,"_96":547},[3654,3655,3656,3657],{"_535":1174,"_187":1175,"_166":722,"_96":1037},{"_535":1172,"_187":1173,"_166":1084,"_96":1037},{"_535":1170,"_187":1171,"_166":1087,"_96":1037},{"_535":1169,"_187":1130,"_166":1079,"_96":1037},{"_494":3659,"_473":474,"_496":480},{"_518":1151,"_45":1178,"_554":1179,"_501":3660,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":3662,"_473":474,"_496":480},{"_497":-5,"_562":1183,"_45":1184,"_501":3663,"_566":3664,"_96":568},{"_506":480},[3665,3666],{"_49":1190,"_96":635},{"_49":1189,"_96":635},{"_512":1192,"_494":3668,"_473":474,"_496":480},{"_497":3669,"_45":1184,"_566":3670,"_96":568},[],[1190,1189],{"_494":3672,"_473":474,"_496":480},{"_518":1198,"_45":-5,"_501":3673,"_187":-5,"_521":3674,"_96":523},{"_506":480},{"_320":3675,"_525":-5},[3676,3677],{"_49":530,"_96":529},{"_49":1204,"_96":529},{"_512":1206,"_494":3679,"_473":474,"_496":480},{"_534":1204,"_535":1208,"_537":3680,"_539":540,"_478":35,"_541":1210,"_45":1211,"_543":1212,"_545":546,"_487":756,"_96":547},[3681],{"_535":1214,"_96":550},{"_494":3683,"_473":474,"_496":480},{"_518":1198,"_45":1217,"_554":1218,"_501":3684,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":3686,"_473":474,"_496":480},{"_497":-5,"_562":1222,"_45":1223,"_501":3687,"_566":3688,"_96":568},{"_506":480},[3689],{"_49":1227,"_96":635},{"_512":1229,"_494":3691,"_473":474,"_496":480},{"_497":3692,"_45":1223,"_566":3693,"_96":568},[],[1227],{"_494":3695,"_473":474,"_496":480},{"_518":1235,"_45":-5,"_501":3696,"_187":-5,"_521":3697,"_96":523},{"_506":480},{"_320":3698,"_525":-5},[3699,3700],{"_49":530,"_96":529},{"_49":1241,"_96":529},{"_512":1243,"_494":3702,"_473":474,"_496":480},{"_534":1241,"_535":1245,"_537":3703,"_539":540,"_478":35,"_541":35,"_45":1247,"_543":1248,"_545":546,"_487":117,"_96":547},[3704,3705,3706,3707],{"_535":1260,"_187":1261,"_166":1262,"_96":1037},{"_535":1258,"_166":1254,"_96":1259},{"_535":1256,"_166":-5,"_1126":1257,"_96":1128},{"_535":1253,"_166":1254,"_1126":1255,"_96":1128},{"_494":3709,"_473":474,"_496":480},{"_518":1235,"_45":1265,"_554":1266,"_501":3710,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":3712,"_473":474,"_496":480},{"_518":1270,"_45":-5,"_501":3713,"_187":-5,"_521":3714,"_96":523},{"_506":480},{"_320":3715,"_525":-5},[3716,3717],{"_49":711,"_96":529},{"_49":1276,"_96":529},{"_512":1278,"_494":3719,"_473":474,"_496":480},{"_534":1276,"_535":1280,"_537":3720,"_539":540,"_478":35,"_541":35,"_45":1282,"_543":1283,"_545":546,"_487":117,"_96":547},[3721,3722,3723],{"_535":1290,"_166":1254,"_1126":1291,"_96":1128},{"_535":1289,"_166":1254,"_96":1259},{"_535":1287,"_166":-5,"_1126":1288,"_96":1128},{"_494":3725,"_473":474,"_496":480},{"_518":1270,"_45":1294,"_554":1295,"_501":3726,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":3728,"_473":474,"_496":480},{"_497":-5,"_562":1299,"_45":1300,"_501":3729,"_566":3730,"_96":568},{"_506":480},[3731],{"_49":1304,"_96":635},{"_512":1306,"_494":3733,"_473":474,"_496":480},{"_497":3734,"_45":1300,"_566":3735,"_96":568},[],[1304],{"_494":3737,"_473":474,"_496":480},{"_518":1312,"_45":-5,"_501":3738,"_187":-5,"_521":3739,"_96":523},{"_506":480},{"_320":3740,"_525":-5},[3741,3742],{"_49":530,"_96":529},{"_49":205,"_96":529},{"_512":1319,"_494":3744,"_473":474,"_496":480},{"_534":-5,"_535":1321,"_537":3745,"_539":540,"_478":35,"_541":35,"_45":1323,"_543":1324,"_545":546,"_487":117,"_96":547},[3746],{"_535":1326,"_96":550},{"_494":3748,"_473":474,"_496":480},{"_518":1312,"_45":1329,"_554":1330,"_501":3749,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":3751,"_473":474,"_496":480},{"_497":-5,"_562":1334,"_45":1335,"_501":3752,"_566":3753,"_96":568},{"_506":480},[],{"_512":1339,"_494":3755,"_473":474,"_496":480},{"_497":3756,"_45":1335,"_566":3757,"_96":568},[],[],{"_494":3759,"_473":474,"_496":480},{"_518":1345,"_45":-5,"_501":3760,"_187":-5,"_521":3761,"_96":523},{"_506":480},{"_320":3762,"_525":-5},[3763,3764],{"_49":530,"_96":529},{"_49":1351,"_96":529},{"_512":1353,"_494":3766,"_473":474,"_496":480},{"_534":1355,"_535":1356,"_537":3767,"_539":540,"_478":753,"_541":35,"_45":1358,"_543":1359,"_545":546,"_487":117,"_96":547},[3768],{"_535":1361,"_96":550},{"_494":3770,"_473":474,"_496":480},{"_518":1345,"_45":1364,"_554":1365,"_501":3771,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":3773,"_473":474,"_496":480},{"_497":-5,"_562":1369,"_45":1370,"_501":3774,"_566":3775,"_96":568},{"_506":480},[3776],{"_49":1374,"_96":635},{"_512":1376,"_494":3778,"_473":474,"_496":480},{"_497":3779,"_45":1370,"_566":3780,"_96":568},[],[1374],{"_494":3782,"_473":474,"_496":480},{"_518":1382,"_45":-5,"_501":3783,"_187":-5,"_521":3784,"_96":523},{"_506":480},{"_320":3785,"_525":-5},[3786,3787],{"_49":1389,"_96":529},{"_49":1388,"_96":529},{"_512":1391,"_494":3789,"_473":474,"_496":480},{"_534":1388,"_535":1393,"_537":3790,"_539":540,"_478":35,"_541":35,"_45":1395,"_543":1396,"_545":546,"_487":117,"_96":547},[3791],{"_535":1398,"_96":550},{"_494":3793,"_473":474,"_496":480},{"_518":1382,"_45":1401,"_554":1402,"_501":3794,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":3796,"_473":474,"_496":480},{"_497":-5,"_562":1406,"_45":1407,"_501":3797,"_566":3798,"_96":568},{"_506":480},[3799],{"_49":1411,"_96":635},{"_512":1413,"_494":3801,"_473":474,"_496":480},{"_497":3802,"_45":1407,"_566":3803,"_96":568},[],[1411],{"_512":1418,"_494":3805,"_473":474,"_496":480},{"_1420":-5,"_497":3806,"_45":1422,"_96":1423},[3807],{"_49":1425,"_1426":3808,"_96":49},[],{"_494":3810,"_473":474,"_496":480},{"_497":3811,"_499":-5,"_45":-5,"_501":3812,"_503":-5,"_100":332,"_96":505},[3813],{"_506":480},{"_49":1425,"_96":529},{"_494":3815,"_473":474,"_496":480},{"_497":3816,"_499":-5,"_45":-5,"_501":3817,"_503":-5,"_100":332,"_96":505},[3818,3819],{"_506":480},{"_49":1440,"_96":529},{"_49":1439,"_96":529},{"_494":3821,"_473":474,"_496":480},{"_497":3822,"_499":-5,"_45":-5,"_501":3823,"_503":-5,"_100":1445,"_96":505},[3824],{"_506":480},{"_49":1447,"_96":529},{"_494":3826,"_473":474,"_496":480},{"_497":3827,"_499":-5,"_45":-5,"_501":3828,"_503":-5,"_100":1445,"_96":505},[3829],{"_506":480},{"_49":1453,"_96":529},{"_494":3831,"_473":474,"_496":480},{"_497":3832,"_499":-5,"_45":-5,"_501":3833,"_503":-5,"_100":1445,"_96":505},[3834,3835],{"_506":480},{"_49":1461,"_96":529},{"_49":1460,"_96":529},{"_473":474,"_91":3837},{"_107":-5,"_45":480,"_481":3838,"_483":484,"_485":486,"_487":1466},[],{"_487":3840,"_473":474},{"_1469":3841,"_96":1471},[],{"_1474":3843},{"_1476":-5,"_1477":-5,"_1478":1479,"_1480":486,"_539":540,"_1481":18,"_1482":-5,"_1483":-5,"_1484":-5,"_1485":1486,"_45":474,"_1487":1488,"_187":-5,"_1489":-5,"_166":1490,"_1491":205,"_1492":486,"_1493":474,"_545":1494,"_487":3844,"_1496":-5,"_81":3845,"_1498":486},{"_96":491},[],[],[3848],{"_45":1503,"_1504":3849,"_1506":1507,"_1508":1507,"_497":3850,"_487":1510,"_499":-5,"_1511":35,"_1512":3851,"_1514":1515,"_1516":-5},{"_100":332,"_187":-5,"_1512":3855},{"_1521":49,"_1522":3854},{"_1517":3852},{"_1519":3853},[],[1524],{},{"_96":505,"_100":97,"_497":3883},{"_96":1557,"_1558":3862},{"_96":1534,"_1535":605,"_1536":1537,"_1538":3859,"_1540":-5},{"_96":1538,"_1541":202,"_132":133,"_1542":-5,"_331":1543,"_1544":3860,"_1546":1547,"_1548":1549,"_1550":753,"_1551":605,"_1552":3861},{"_1554":1555,"_1556":-5},[],[3863,3864,3865,3866,3867],{"_166":2602,"_1566":-5,"_1567":3880,"_1569":-5},{"_166":1918,"_1566":-5,"_1567":3877,"_1569":-5},{"_166":1807,"_1566":-5,"_1567":3874,"_1569":-5},{"_166":1699,"_1566":-5,"_1567":3871,"_1569":-5},{"_166":1565,"_1566":-5,"_1567":3868,"_1569":-5},[3869],{"_1571":753,"_1572":1573,"_497":3870,"_1575":62},[1576,1577,1578,1577,1579,1580,1581,1582,1583,1577,1584,1585,1586,1577,1587,1577,1588,1589,205,1590,1591,1592,205,1593,1594,1595,1596,1597,1598,1599,1600,1601,1602,1603,1604,1605,205,1593,1606,1607,1608,1609,1602,1610,205,1611,205,1612,1613,1614,1615,1616,1617,1618,1619,1620,1621,1622,1623,1624,1625,1626,1627,1628,1629,1630,205,1631,1632,1633,1634,1635,1636,1637,1638,1639,1640,1641,205,1642,205,1643,1644,1645,1646,1647,1648,1649,205,1650,1651,1652,1653,1654,1655,1656,205,1657,1658,1659,1660,1661,1662,1663,1664,1665,1666,205,1667,1668,1669,1670,1671,205,1672,1673,1674,1675,1671,1662,1663,1665,205,1676,1677,1678,1679,1680,1681,1662,1682,1683,1684,1665,1685,1686,205,1687,1688,1689,1690,1691,1692,205,1693,1694,1695,1696,1697,1629,1630,1698],[3872],{"_1571":753,"_1572":1702,"_497":3873,"_1575":62},[1704,1577,1705,1577,1706,1577,1707,1577,1708,1709,1710,1711,1577,1712,1713,1714,1715,1716,1717,1718,1577,1719,1720,205,1721,1722,1723,1724,205,1725,1726,1727,1728,205,1729,205,1730,1731,1688,1689,1732,1733,1734,205,1735,1736,205,1737,1738,1739,1740,1741,1742,1743,1744,1745,1746,1747,1748,1749,1750,1685,205,1751,1752,205,1753,1754,1755,1756,1757,1758,1759,1760,1761,1762,1763,205,1764,1765,1766,1767,1768,1769,1770,1771,1772,1773,1774,205,1775,1776,1777,1778,1779,205,1780,1781,205,1782,1783,1784,1785,1786,1787,1788,1789,1790,1791,1792,1793,1794,1795,1685,1796,1630,205,1797,1734,205,1735,1798,1799,1800,205,1751,1762,1763,205,1801,1802,1770,1771,1803,1804,205,1805,1806,1630,1698],[3875],{"_1571":753,"_1572":1810,"_497":3876,"_1575":62},[1812,1577,1813,1814,1815,1816,1817,1577,1818,1577,1819,1820,1821,1822,1823,1577,1824,1577,1825,1826,1827,1828,1829,205,1721,1830,1724,205,1831,1832,205,1833,1834,1688,1689,1835,1690,1734,205,1836,1837,1838,1839,1685,205,1840,1841,1842,1843,1844,1845,1846,1847,1641,1848,1849,1850,1851,1852,1750,1685,205,1853,1854,1855,1856,205,1857,1858,1859,205,1860,1861,205,1862,1863,1864,1756,1865,1859,1866,1867,205,1868,1869,1870,1871,1872,1873,1874,1875,205,1876,1877,1878,1770,1879,1880,1881,1630,205,1882,1688,1689,1835,1690,1883,1884,1885,1734,205,1837,1838,1839,1685,205,1886,1887,1888,1889,1856,205,1890,1891,1892,1893,1894,1895,1896,1897,205,1866,1898,205,1899,1861,205,1900,1901,1902,1903,1770,1904,1905,1773,1906,1907,1908,205,1909,1910,1911,1912,205,1913,1914,1915,1916,1911,1917,1630,1698],[3878],{"_1571":753,"_1572":1921,"_497":3879,"_1575":62},[1923,1924,1925,1926,1927,1928,1929,1930,1931,1932,1933,1934,1935,1936,1937,1938,1939,1940,1941,1942,1943,205,1944,1945,1946,1947,1948,205,1949,1950,205,1951,1952,1953,1954,1630,1605,205,1955,1956,1957,1605,205,1958,205,1959,1960,1605,205,1961,1962,1605,205,1963,1964,1605,205,1965,1966,1967,1968,1969,1970,1605,205,1971,1972,1973,205,1974,1975,1976,205,1977,1978,1979,1980,1981,1982,1983,1984,1698,205,1985,1986,1987,1988,1989,1698,205,1990,1991,1992,1993,1994,1995,1996,1997,1998,1630,205,1999,2000,2001,1630,1698,205,2002,2003,2004,2005,2006,2007,2008,2009,2010,1630,205,2011,2004,2012,2013,2014,2015,2016,2017,1630,1698,205,2018,2019,2020,2021,2022,205,2023,2024,2025,2026,1630,205,2027,2028,2029,2030,2031,2032,2026,1630,205,2033,2012,2034,2035,2025,2036,2037,2038,205,2039,2040,1630,205,2041,2042,2043,2044,2045,1630,1698,205,2046,2047,2048,2049,2050,1630,205,2051,2052,2053,2054,2055,2056,2057,2058,1630,205,2059,2060,2061,1630,205,2062,2063,2064,2052,2065,2066,2067,2068,2069,2070,2071,2072,2054,2055,2056,2073,2074,2075,2076,2077,2054,1630,205,2078,2052,2065,2066,2079,2080,2070,2071,2072,2054,2055,2056,2081,2082,1630,205,2083,2084,2052,2085,2054,2055,2056,2058,1630,1698,205,2086,2087,2012,2088,2089,2090,205,2015,2016,2091,205,2092,2093,2094,2095,2096,2097,2098,2099,2100,2101,2102,2103,2104,1630,205,2105,2012,2106,2089,2107,205,2108,2092,2109,2110,2111,2112,2113,2114,2115,2116,2117,1630,205,2118,2119,2120,2121,2122,2123,2124,2125,2126,1641,2127,2128,1685,205,2129,2130,2131,2132,205,2133,2134,2135,2103,1630,205,2136,2012,2137,2138,2139,2140,2141,2142,205,2143,2144,2145,2146,1630,1698,205,2147,2148,2012,2149,2150,205,2055,2056,2151,2152,2153,2007,2154,1630,205,2155,2012,2088,2156,2157,205,2055,2151,2158,2159,2009,2007,2154,1630,205,2160,2012,2088,2161,205,2055,2056,2151,2007,2154,1630,205,2162,2163,2164,2165,2012,2149,2166,205,2055,2056,2167,2168,2169,1630,205,2170,2012,2171,2172,2173,205,2174,2175,2176,2012,2177,2156,2178,2179,2180,1630,1698,205,2181,2182,2183,2184,2185,1630,205,2186,2187,2188,2189,2190,2191,2192,2193,2194,1630,205,2195,2183,2196,2197,1630,205,2198,2000,2199,1995,2200,2201,2202,1630,205,2203,2000,2199,2204,1630,205,2205,2206,2207,2208,2183,2209,2210,1630,205,2211,2183,2184,2212,1630,205,2213,2000,2214,2215,1630,205,2216,2217,2218,205,2219,205,1995,2220,2201,2221,2222,2223,2224,2225,2226,1630,205,2227,2217,2228,2185,1630,205,2229,2230,2231,2012,2232,2233,2234,205,2219,205,2235,2236,2237,2238,2239,2240,2241,1630,205,2242,2000,2243,1995,2244,2245,2246,1630,1698,205,2247,2248,2052,2249,2250,2251,2252,2054,2253,2254,2255,2256,1630,205,2257,2031,2258,2259,1630,205,2260,2012,2261,2089,2262,205,2263,2264,2091,2265,1630,205,2266,2004,2267,2268,2007,2009,2269,1630,1698,205,2270,2271,2004,2272,2273,2274,2275,2103,1995,2276,2277,1630,205,2278,2279,2000,2280,2281,1995,2282,2283,2284,2285,2154,1630,205,2286,2287,2288,2289,2290,2291,2292,2293,2294,2000,205,2280,205,2295,2154,1630,205,2296,2297,2298,2299,2004,2000,205,2280,205,2281,2300,1630,205,2301,2302,2303,2154,1630,205,2304,2004,2000,2305,2281,2306,1630,205,2307,2308,2309,2310,2311,205,2312,2313,2154,205,2314,2315,1630,205,2316,2317,2318,2311,2319,2305,2154,1630,205,2320,2321,2322,2323,2324,2325,2326,2293,2294,2319,205,2305,205,2154,2327,2328,2329,2330,1630,1698,205,2331,2332,2333,2334,2335,2336,2337,2338,2339,2340,205,2341,205,2342,2343,2344,2345,2346,2347,2348,2349,205,2350,2351,2352,2353,1630,205,2354,2355,205,2356,2357,1630,1698,205,2358,2359,2360,2361,2362,2363,2364,205,2365,205,2342,2366,2367,2368,2369,2370,1630,205,2371,2052,2372,205,2373,2056,2374,1630,205,2375,2376,2377,2378,2379,2380,2381,2382,2372,205,2383,205,2281,2384,2385,2386,2387,2388,2389,1630,205,2390,2391,2392,2393,2012,2394,2138,2395,205,2396,205,2370,2397,2009,1630,205,2398,2363,2399,2357,2389,1630,1698,205,2400,2401,2402,2403,2404,2405,2406,2407,2408,2409,2410,2411,2412,1685,2413,1686,205,2414,2415,2416,2417,1686,205,2418,2419,2420,205,2421,2422,2423,205,2424,2425,2426,2054,205,2427,2428,205,2429,2385,205,2430,2431,205,2133,2432,2009,2433,2434,2435,2104,1630,205,2436,2419,2420,205,2437,2438,2439,205,2004,2425,2426,2054,205,2440,2441,205,2133,2009,1630,205,2442,2443,2444,2445,2012,2446,2447,205,2448,2449,205,2450,2180,2104,1630,205,2451,2452,1619,2453,2454,2455,2456,2457,2458,2459,2460,2461,2462,1654,205,2463,2464,205,2465,2466,2467,2468,2469,2470,1629,1630,205,2471,2472,2004,2425,2426,2054,205,2473,205,2133,2474,2104,1630,1698,205,2475,2476,2477,2478,2479,2004,2480,205,2449,205,2481,2103,1630,205,2482,2004,2483,2484,2485,2486,2487,1685,205,2488,2428,2009,205,2489,205,2490,2491,205,2492,2493,2494,2495,2496,2497,2498,2499,1630,205,2500,2004,2501,205,2273,205,2502,2103,1630,205,2503,2004,2483,2484,2485,2504,2487,1685,205,2505,2428,205,2506,2507,2508,2509,2103,205,2510,2511,205,2512,2513,1630,205,2514,2515,2516,2517,2004,2483,2484,2485,2518,2519,2487,1685,205,2520,2521,2522,2428,205,2523,2524,205,2525,2526,205,2527,2528,2529,2530,2531,2532,2533,1630,205,2534,2535,2536,2537,2538,2539,2540,2484,2541,2542,2487,1685,205,2543,2544,2428,205,2280,2154,205,2545,2546,205,2547,1630,205,2548,2540,2333,205,2549,205,2352,1630,205,2550,2004,2551,2484,2552,2486,2487,1685,205,2553,2428,205,2554,205,2555,2556,2557,205,2154,2389,2558,2559,2499,1630,205,2560,2561,2562,2563,2564,2004,2483,2484,2485,2486,2487,1685,205,2565,2428,205,2280,2566,205,2526,2567,2568,1630,205,2569,2570,2571,2572,2483,2484,2573,2574,2575,2485,2504,2487,1685,205,2576,2428,205,2273,2577,205,2578,1630,205,2579,2483,2484,2575,2485,2486,2487,1685,205,2565,2428,205,2280,2566,205,2526,2567,2568,1630,205,2580,2581,2582,2483,2484,2583,2584,2585,2485,2504,2487,1685,205,2586,2428,205,2587,2577,205,2588,2589,1630,205,2590,2483,2484,2585,2485,2486,2487,1685,205,2591,2428,205,2280,2566,205,2592,2567,2568,1630,205,2593,2594,2595,2596,2004,2483,2484,2485,2504,2486,2487,1685,205,2597,2428,205,2587,2598,2599,205,2600,2601,1630,1698],[3881],{"_1571":753,"_1572":2605,"_497":3882,"_1575":62},[2607,2608,2609,2610,2611,205,2612,205,2613,2614,2615,2616,205,2617,2618,2619,2620,205,2621,2622,2623,2624,2625,2626,2627,2628,1686,1605,205,2629,2630,2631,2632,2633,1605,205,2634,2635,2636,2637,2638,2639,1605,205,2640,2641,2642,2643,2644,2645,2646,2647,2648,2649,2650,2651,2652,2653,2654,2655,2656,2657,2658,2659,2660,2661,2662,2663,2664,2665,2666,2667,2668,1641,2669,2670,2671,1629,2672,2673,1686,2674,1605,205,2675,2676,2677,2678,2679,2680,1605,205,2681,2682,2683,2684,2685,2686,2687,1605,205,2688,2689,2690,2691,2692,2693,2694,2695,2696,2697,2698,205,2699,2700,2701,2702,1605,205,2703,205,2704,2705,2706,2707,2708,2709,2710,2711,2712,2713,2714,205,2715,2716,2717,2718,1686,1605,205,2719,2720,2721,2722,2723,2724,1577,2725,2726,2727,2728,2729,2730,2643,2731,2732,2733,2734,2735,1686,1605,205,2736,2737,2738,2739,2740,2741,2742,2743,2744,2745,2746,2747,2748,2749,2750,1630,2751,2752,2753,2754,2755,2756,1686,2757,2758,1605,205,2759,2760,2761,2762,1577,2763,2764,2765,2766,2767,2768,2769,2770,2771,2772,2773,2774,2775,2776,2777,2778,2779,2780,2754,2755,2756,1686,2757,2758,1605,205,2781,2782,2783,2784,2785,2786,2787,2788,1577,2789,2790,2791,2792,2793,2794,2795,2796,2797,2798,1605,205,2799,2800,2801,2802,2803,2804,2805,2806,2807,2808,2809,2810,2745,2811,2812,2813,2814,1989,2643,2815,2816,2817,2818,1756,2819,2820,2821,2822,2823,2824,2825,2826,2827,2828,2829,2830,2831,2054,2732,2832,2833,2834,2835,2836,1686,1605,205,2837,2838,2839,2840,2841,2842,2843,2844,2845,1577,2846,2847,2848,2849,2850,2851,205,2852,2853,2854,2855,2856,205,2857,2858,2859,2860,205,2861,2862,2863,2864,2865,2866,2867,2868,1685,2869,2870,2871,1605,205,2872,2873,2874,2875,2876,205,2877,2878,205,2879,2880,2881,2777,205,2882,2883,2884,2885,2886,2887,2888,2889,2890,2891,2892,2893,2894,2895,2896,2897,2898,2899,2900,2901,2902,2903,2904,2905,2906,2900,2907,2908,2909,1685,205,2910,1605,205,2911,2912,2913,2914,2643,2915,2916,2672,2917,1686,1605,205,2918,205,2919,2920,1605,205,2921,2922,2923,2924,1577,2925,2926,2927,2928,2689,2929,2930,2931,2692,2932,2749,2933,2934,1630,1605,205,2935,2689,2936,2930,2931,2692,2932,2937,2933,2750,1630,1605,205,2938,2939,2940,2941,2942,2943,2689,2944,2945,2930,2692,2932,2937,2946,2947,2948,2949,2950,1630,1605,205,2951,2932,2952,2953,1630,1605,205,2954,2955,2956,2689,2957,2958,2643,2959,2732,2960,1619,2961,2962,2963,2964,2965,2966,2967,2968,1641,2969,2970,2971,2972,1629,1686,1605,205,2973,2689,2974,2957,2975,2698,2976,2700,2977,2978,2979,2980,2981,2869,1605,205,2982,2958,2643,2983,2732,2960,1619,2961,2984,2963,2985,2986,2987,2965,2966,2988,2968,1641,2969,2970,2971,2972,1629,1686,1605,205,2989,2990,2991,2992,2993,2994,2643,2995,2732,2996,2997,2998,2999,3000,3001,3002,1686,1605,205,3003,3004,3005,3006,3007,3008,3009,3010,3011,3012,3013,3014,1605,205,3015,3016,3017,3018,3019,3020,3021,3022,3023,3024,3025,3026,1605],[3884,3885,3886,3887,3888,3889,3890,3891,3892,3893],{"_1521":49,"_49":3053},{"_1521":3039,"_166":2602,"_1571":3051,"_1572":3052},{"_1521":3039,"_166":1918,"_1571":3049,"_1572":3050},{"_1521":49,"_49":3048},{"_1521":3039,"_166":1807,"_1571":3046,"_1572":3047},{"_1521":49,"_49":3045},{"_1521":3039,"_166":1699,"_1571":3043,"_1572":3044},{"_1521":49,"_49":3042},{"_1521":3039,"_166":1565,"_1571":3040,"_1572":3041},{"_1521":49,"_49":3038},[4649,4650,4651],[],{"_1526":1527,"_49":1528,"_1529":1530},{"_1500":4640},{"_342":4639},{"_342":3930},{"_310":311,"_301":312,"_313":314,"_315":62,"_316":18,"_317":18,"_318":319,"_320":321,"_322":273,"_323":131,"_324":325,"_326":327,"_328":329,"_330":-5,"_331":-5,"_332":3929,"_334":335,"_336":337,"_338":339,"_340":35},{"_45":127,"_199":200,"_201":202,"_203":18,"_204":205,"_206":207,"_208":3918,"_210":-5,"_211":212,"_213":18,"_214":3919,"_216":205,"_217":205,"_218":3920,"_220":3921,"_222":3922,"_224":-5,"_225":226,"_227":228,"_229":230,"_231":3923,"_58":-5,"_123":233,"_234":3924,"_236":3925,"_238":239,"_240":18,"_241":18},{"_137":3911},[3904,3905,3906,3907,3908,3909,3910],{"_153":178,"_155":156,"_157":158,"_159":160,"_161":162,"_163":164,"_165":35,"_166":-5},{"_153":177,"_155":156,"_157":158,"_159":160,"_161":174,"_163":164,"_165":35,"_166":-5},{"_153":175,"_155":156,"_157":158,"_159":160,"_161":176,"_163":164,"_165":35,"_166":-5},{"_153":173,"_155":156,"_157":158,"_159":160,"_161":174,"_163":164,"_165":35,"_166":-5},{"_153":172,"_155":168,"_157":169,"_159":160,"_161":171,"_163":164,"_165":35,"_166":-5},{"_153":167,"_155":168,"_157":169,"_159":170,"_161":171,"_163":164,"_165":35,"_166":-5},{"_153":154,"_155":156,"_157":158,"_159":160,"_161":162,"_163":164,"_165":35,"_166":-5},[3912,3913,3914],{"_183":3917,"_185":196},{"_183":3916,"_185":192},{"_183":3915,"_185":186},{"_187":188,"_96":189,"_123":190},{"_187":193,"_96":189,"_123":194},{"_187":197,"_96":189,"_123":198},{"_303":304,"_305":-5,"_306":-5,"_307":-5,"_308":-5,"_309":-5},[263],{"_263":3926},{"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":256,"_257":258,"_259":260,"_261":262},{},[],{"_244":62},{"_242":62,"_243":205},{"_45":265,"_187":266,"_267":3927,"_269":202,"_270":271,"_272":273,"_274":275,"_276":277,"_278":279,"_280":67,"_281":18,"_282":-5,"_283":-5,"_284":-5,"_285":-5,"_286":-5,"_287":-5,"_165":288,"_289":-5,"_58":3928},{"_295":296,"_45":297,"_96":298,"_299":300,"_301":302},{"_291":18,"_292":18,"_293":18,"_294":18},{"_295":296,"_187":296,"_341":-5,"_299":300,"_45":297},[3931,3932,3933,3934,3935,3936,3937,3938,3939,3940,3941,3942,3943,3944,3945,3946,3947,3948,3949,3950,3951,3952,3953,3954,3955,3956,3957,3958,3959,3960,3961,3962,3963,3964,3965,3966,3967,3968,3969,3970,3971,3972,3973,3974,3975,3976,3977,3978,3979,3980,3981,3982,3983,3984,3985,3986,3987,3988,3989,3990,3991,3992,3993,3994,3995,3996,3997,3998,3999,4000,4001,4002,4003,4004,4005,4006,4007,4008,4009,4010,4011,4012,4013,4014,4015,4016,4017,4018,4019,4020,4021,4022,4023,4024,4025,4026,4027,4028,4029,4030,4031,4032,4033,4034,4035,4036,4037,4038,4039,4040,4041,4042,4043,4044,4045,4046,4047,4048,4049,4050,4051,4052,4053,4054,4055,4056],{"_159":1472,"_471":4635},{"_159":488,"_471":4632},{"_159":1462,"_471":4629},{"_159":492,"_471":4623},{"_159":492,"_471":4618},{"_159":492,"_471":4613},{"_159":492,"_471":4607},{"_159":492,"_471":4602},{"_159":510,"_471":4597},{"_159":510,"_471":4593},{"_159":492,"_471":4588},{"_159":492,"_471":4585},{"_159":510,"_471":4581},{"_159":492,"_471":4574},{"_159":510,"_471":4570},{"_159":492,"_471":4565},{"_159":492,"_471":4562},{"_159":510,"_471":4558},{"_159":492,"_471":4551},{"_159":510,"_471":4547},{"_159":492,"_471":4543},{"_159":492,"_471":4540},{"_159":510,"_471":4536},{"_159":492,"_471":4529},{"_159":510,"_471":4525},{"_159":492,"_471":4520},{"_159":492,"_471":4517},{"_159":510,"_471":4511},{"_159":492,"_471":4504},{"_159":492,"_471":4501},{"_159":510,"_471":4494},{"_159":492,"_471":4487},{"_159":510,"_471":4483},{"_159":492,"_471":4478},{"_159":492,"_471":4475},{"_159":510,"_471":4471},{"_159":492,"_471":4464},{"_159":510,"_471":4460},{"_159":492,"_471":4454},{"_159":492,"_471":4451},{"_159":510,"_471":4444},{"_159":492,"_471":4437},{"_159":510,"_471":4433},{"_159":492,"_471":4429},{"_159":492,"_471":4426},{"_159":510,"_471":4420},{"_159":492,"_471":4413},{"_159":510,"_471":4409},{"_159":492,"_471":4404},{"_159":492,"_471":4401},{"_159":510,"_471":4390},{"_159":492,"_471":4383},{"_159":510,"_471":4379},{"_159":492,"_471":4374},{"_159":492,"_471":4371},{"_159":510,"_471":4365},{"_159":492,"_471":4358},{"_159":510,"_471":4354},{"_159":492,"_471":4348},{"_159":492,"_471":4345},{"_159":510,"_471":4340},{"_159":492,"_471":4333},{"_159":510,"_471":4329},{"_159":492,"_471":4324},{"_159":492,"_471":4321},{"_159":492,"_471":4314},{"_159":510,"_471":4310},{"_159":510,"_471":4306},{"_159":492,"_471":4301},{"_159":492,"_471":4298},{"_159":510,"_471":4293},{"_159":492,"_471":4286},{"_159":510,"_471":4282},{"_159":492,"_471":4277},{"_159":492,"_471":4274},{"_159":492,"_471":4271},{"_159":510,"_471":4267},{"_159":492,"_471":4263},{"_159":492,"_471":4260},{"_159":492,"_471":4257},{"_159":492,"_471":4254},{"_159":492,"_471":4251},{"_159":492,"_471":4248},{"_159":492,"_471":4245},{"_159":492,"_471":4242},{"_159":492,"_471":4239},{"_159":492,"_471":4236},{"_159":492,"_471":4228},{"_159":510,"_471":4224},{"_159":492,"_471":4219},{"_159":492,"_471":4216},{"_159":510,"_471":4212},{"_159":492,"_471":4209},{"_159":510,"_471":4205},{"_159":492,"_471":4202},{"_159":492,"_471":4194},{"_159":510,"_471":4190},{"_159":510,"_471":4186},{"_159":492,"_471":4180},{"_159":492,"_471":4177},{"_159":510,"_471":4172},{"_159":492,"_471":4165},{"_159":492,"_471":4162},{"_159":510,"_471":4158},{"_159":492,"_471":4151},{"_159":510,"_471":4147},{"_159":492,"_471":4142},{"_159":492,"_471":4139},{"_159":510,"_471":4135},{"_159":492,"_471":4127},{"_159":510,"_471":4123},{"_159":492,"_471":4118},{"_159":492,"_471":4115},{"_159":492,"_471":4108},{"_159":492,"_471":4105},{"_159":510,"_471":4098},{"_159":492,"_471":4091},{"_159":510,"_471":4087},{"_159":492,"_471":4083},{"_159":492,"_471":4080},{"_159":510,"_471":4076},{"_159":492,"_471":4069},{"_159":510,"_471":4067},{"_159":492,"_471":4062},{"_159":488,"_471":4060},{"_159":470,"_471":4057},{"_473":474,"_91":4058},{"_476":477,"_478":479,"_107":-5,"_45":480,"_481":4059,"_483":484,"_485":486,"_487":117},[],{"_487":4061,"_473":474},{"_96":491},{"_494":4063,"_473":474,"_496":480},{"_497":4064,"_499":-5,"_45":500,"_501":4065,"_503":504,"_100":97,"_96":505},[4066],{"_506":480},{"_49":508,"_96":509},{"_512":513,"_494":4068,"_473":474,"_496":480},{"_45":500,"_503":504,"_49":508,"_96":515},{"_494":4070,"_473":474,"_496":480},{"_518":519,"_45":-5,"_501":4071,"_187":-5,"_521":4072,"_96":523},{"_506":480},{"_320":4073,"_525":-5},[4074,4075],{"_49":530,"_96":529},{"_49":528,"_96":529},{"_512":532,"_494":4077,"_473":474,"_496":480},{"_534":528,"_535":536,"_537":4078,"_539":540,"_478":35,"_541":35,"_45":542,"_543":544,"_545":546,"_487":117,"_96":547},[4079],{"_535":549,"_96":550},{"_494":4081,"_473":474,"_496":480},{"_518":519,"_45":553,"_554":555,"_501":4082,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":4084,"_473":474,"_496":480},{"_497":-5,"_562":563,"_45":564,"_501":4085,"_566":4086,"_96":568},{"_506":480},[],{"_512":570,"_494":4088,"_473":474,"_496":480},{"_497":4089,"_45":564,"_566":4090,"_96":568},[],[],{"_494":4092,"_473":474,"_496":480},{"_518":576,"_45":-5,"_501":4093,"_187":-5,"_521":4094,"_96":523},{"_506":480},{"_320":4095,"_525":-5},[4096,4097],{"_49":583,"_96":529},{"_49":582,"_96":529},{"_512":585,"_494":4099,"_473":474,"_496":480},{"_587":-5,"_588":4100,"_478":590,"_107":-5,"_45":591,"_592":-5,"_593":-5,"_594":-5,"_595":4101,"_597":598,"_487":117,"_599":598,"_96":600},{"_318":605,"_320":606},{"_601":-5,"_497":4102,"_603":4103},[4104],{"_318":605,"_320":606},{"_96":49,"_49":582},{"_494":4106,"_473":474,"_496":480},{"_518":576,"_45":610,"_554":611,"_501":4107,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":4109,"_473":474,"_496":480},{"_518":615,"_45":-5,"_501":4110,"_187":-5,"_521":4111,"_96":523},{"_506":480},{"_320":4112,"_525":-5},[4113,4114],{"_49":583,"_96":529},{"_49":621,"_96":529},{"_494":4116,"_473":474,"_496":480},{"_518":615,"_45":624,"_554":625,"_501":4117,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":4119,"_473":474,"_496":480},{"_497":-5,"_562":629,"_45":630,"_501":4120,"_566":4121,"_96":568},{"_506":480},[4122],{"_49":634,"_96":635},{"_512":637,"_494":4124,"_473":474,"_496":480},{"_497":4125,"_45":630,"_566":4126,"_96":568},[],[634],{"_494":4128,"_473":474,"_496":480},{"_518":643,"_45":-5,"_501":4129,"_187":-5,"_521":4130,"_96":523},{"_506":480},{"_320":4131,"_525":-5},[4132,4133,4134],{"_49":530,"_96":529},{"_49":651,"_96":529},{"_49":650,"_96":529},{"_512":653,"_494":4136,"_473":474,"_496":480},{"_534":651,"_535":655,"_537":4137,"_539":540,"_478":35,"_541":35,"_45":657,"_543":658,"_545":546,"_487":117,"_96":547},[4138],{"_535":660,"_96":550},{"_494":4140,"_473":474,"_496":480},{"_518":643,"_45":663,"_554":664,"_501":4141,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":4143,"_473":474,"_496":480},{"_497":-5,"_562":668,"_45":669,"_501":4144,"_566":4145,"_96":568},{"_506":480},[4146],{"_49":673,"_96":635},{"_512":675,"_494":4148,"_473":474,"_496":480},{"_497":4149,"_45":669,"_566":4150,"_96":568},[],[673],{"_494":4152,"_473":474,"_496":480},{"_518":681,"_45":-5,"_501":4153,"_187":-5,"_521":4154,"_96":523},{"_506":480},{"_320":4155,"_525":-5},[4156,4157],{"_49":530,"_96":529},{"_49":687,"_96":529},{"_512":689,"_494":4159,"_473":474,"_496":480},{"_534":687,"_535":691,"_537":4160,"_539":540,"_478":35,"_541":35,"_45":693,"_543":694,"_545":546,"_487":117,"_96":547},[4161],{"_535":696,"_96":550},{"_494":4163,"_473":474,"_496":480},{"_518":681,"_45":699,"_554":700,"_501":4164,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":4166,"_473":474,"_496":480},{"_518":704,"_45":-5,"_501":4167,"_187":-5,"_521":4168,"_96":523},{"_506":480},{"_320":4169,"_525":-5},[4170,4171],{"_49":711,"_96":529},{"_49":710,"_96":529},{"_512":713,"_494":4173,"_473":474,"_496":480},{"_715":4174,"_45":717,"_487":117,"_96":718},[4175],{"_331":720,"_9":4176,"_166":722},{"_723":-5,"_96":724},{"_494":4178,"_473":474,"_496":480},{"_518":704,"_45":727,"_554":728,"_501":4179,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":4181,"_473":474,"_496":480},{"_497":-5,"_562":732,"_45":733,"_501":4182,"_566":4183,"_96":568},{"_506":480},[4184,4185],{"_49":739,"_96":635},{"_49":738,"_96":635},{"_512":741,"_494":4187,"_473":474,"_496":480},{"_497":4188,"_45":733,"_566":4189,"_96":568},[],[739,738],{"_512":746,"_494":4191,"_473":474,"_496":480},{"_534":748,"_535":749,"_537":4192,"_539":751,"_478":752,"_541":753,"_45":754,"_543":755,"_545":546,"_487":756,"_96":547},[4193],{"_535":758,"_96":550},{"_494":4195,"_473":474,"_496":480},{"_518":761,"_45":-5,"_501":4196,"_521":4197,"_96":764},{"_506":480},{"_320":4198,"_525":-5},[4199,4200,4201],{"_49":583,"_96":529},{"_49":770,"_96":529},{"_49":769,"_96":529},{"_494":4203,"_473":474,"_496":480},{"_588":773,"_518":761,"_45":774,"_501":4204,"_187":776,"_558":-5,"_96":777},{"_506":480},{"_512":779,"_494":4206,"_473":474,"_496":480},{"_534":781,"_535":782,"_537":4207,"_539":751,"_478":784,"_541":35,"_45":785,"_543":786,"_545":546,"_487":117,"_96":547},[4208],{"_535":788,"_96":550},{"_494":4210,"_473":474,"_496":480},{"_518":791,"_45":-5,"_501":4211,"_187":-5,"_521":793,"_96":523},{"_506":480},{"_512":795,"_494":4213,"_473":474,"_496":480},{"_534":797,"_535":782,"_537":4214,"_539":799,"_478":800,"_541":801,"_45":802,"_543":803,"_545":546,"_487":756,"_96":547},[4215],{"_535":788,"_96":550},{"_494":4217,"_473":474,"_496":480},{"_518":791,"_45":807,"_554":808,"_501":4218,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":4220,"_473":474,"_496":480},{"_497":-5,"_562":812,"_45":813,"_501":4221,"_566":4222,"_96":568},{"_506":480},[4223],{"_49":817,"_96":635},{"_512":819,"_494":4225,"_473":474,"_496":480},{"_497":4226,"_45":813,"_566":4227,"_96":568},[],[817],{"_494":4229,"_473":474,"_496":480},{"_518":825,"_45":-5,"_501":4230,"_521":4231,"_96":764},{"_506":480},{"_320":4232,"_525":-5},[4233,4234,4235],{"_49":583,"_96":529},{"_49":748,"_96":529},{"_49":832,"_96":529},{"_494":4237,"_473":474,"_496":480},{"_588":835,"_518":825,"_45":836,"_501":4238,"_187":776,"_558":-5,"_96":777},{"_506":480},{"_494":4240,"_473":474,"_496":480},{"_518":840,"_45":-5,"_501":4241,"_521":842,"_96":764},{"_506":480},{"_494":4243,"_473":474,"_496":480},{"_588":835,"_518":840,"_45":845,"_501":4244,"_187":776,"_558":-5,"_96":777},{"_506":480},{"_494":4246,"_473":474,"_496":480},{"_518":849,"_45":-5,"_501":4247,"_521":842,"_96":764},{"_506":480},{"_494":4249,"_473":474,"_496":480},{"_588":835,"_518":849,"_45":853,"_501":4250,"_187":776,"_558":-5,"_96":777},{"_506":480},{"_494":4252,"_473":474,"_496":480},{"_518":857,"_45":-5,"_501":4253,"_521":842,"_96":764},{"_506":480},{"_494":4255,"_473":474,"_496":480},{"_588":835,"_518":857,"_45":861,"_501":4256,"_187":776,"_558":-5,"_96":777},{"_506":480},{"_494":4258,"_473":474,"_496":480},{"_518":865,"_45":-5,"_501":4259,"_521":842,"_96":764},{"_506":480},{"_494":4261,"_473":474,"_496":480},{"_588":835,"_518":865,"_45":869,"_501":4262,"_187":776,"_558":-5,"_96":777},{"_506":480},{"_494":4264,"_473":474,"_496":480},{"_497":-5,"_562":873,"_45":874,"_501":4265,"_566":4266,"_96":568},{"_506":480},[],{"_512":878,"_494":4268,"_473":474,"_496":480},{"_497":4269,"_45":874,"_566":4270,"_96":568},[],[],{"_494":4272,"_473":474,"_496":480},{"_518":884,"_45":-5,"_501":4273,"_187":-5,"_521":886,"_96":523},{"_506":480},{"_494":4275,"_473":474,"_496":480},{"_518":884,"_45":889,"_554":890,"_501":4276,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":4278,"_473":474,"_496":480},{"_497":-5,"_562":894,"_45":895,"_501":4279,"_566":4280,"_96":568},{"_506":480},[4281],{"_49":899,"_96":635},{"_512":901,"_494":4283,"_473":474,"_496":480},{"_497":4284,"_45":895,"_566":4285,"_96":568},[],[899],{"_494":4287,"_473":474,"_496":480},{"_518":907,"_45":-5,"_501":4288,"_187":-5,"_521":4289,"_96":523},{"_506":480},{"_320":4290,"_525":-5},[4291,4292],{"_49":583,"_96":529},{"_49":710,"_96":529},{"_512":914,"_494":4294,"_473":474,"_496":480},{"_715":4295,"_45":917,"_487":117,"_96":718},[4296],{"_331":919,"_9":4297,"_166":921},{"_723":-5,"_96":724},{"_494":4299,"_473":474,"_496":480},{"_518":907,"_45":924,"_554":925,"_501":4300,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":4302,"_473":474,"_496":480},{"_497":-5,"_562":929,"_45":930,"_501":4303,"_566":4304,"_96":568},{"_506":480},[4305],{"_49":934,"_96":635},{"_512":936,"_494":4307,"_473":474,"_496":480},{"_497":4308,"_45":930,"_566":4309,"_96":568},[],[934],{"_512":941,"_494":4311,"_473":474,"_496":480},{"_534":943,"_535":944,"_537":4312,"_539":540,"_478":946,"_541":753,"_45":947,"_543":948,"_545":546,"_487":756,"_96":547},[4313],{"_535":950,"_96":550},{"_494":4315,"_473":474,"_496":480},{"_518":953,"_45":-5,"_501":4316,"_187":-5,"_521":4317,"_96":523},{"_506":480},{"_320":4318,"_525":-5},[4319,4320],{"_49":960,"_96":529},{"_49":959,"_96":529},{"_494":4322,"_473":474,"_496":480},{"_518":953,"_45":963,"_554":964,"_501":4323,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":4325,"_473":474,"_496":480},{"_497":-5,"_562":968,"_45":969,"_501":4326,"_566":4327,"_96":568},{"_506":480},[4328],{"_49":973,"_96":635},{"_512":975,"_494":4330,"_473":474,"_496":480},{"_497":4331,"_45":969,"_566":4332,"_96":568},[],[973],{"_494":4334,"_473":474,"_496":480},{"_518":981,"_45":-5,"_501":4335,"_187":-5,"_521":4336,"_96":523},{"_506":480},{"_320":4337,"_525":-5},[4338,4339],{"_49":711,"_96":529},{"_49":710,"_96":529},{"_512":988,"_494":4341,"_473":474,"_496":480},{"_715":4342,"_45":991,"_487":117,"_96":718},[4343],{"_331":993,"_9":4344,"_166":921},{"_723":-5,"_96":724},{"_494":4346,"_473":474,"_496":480},{"_518":981,"_45":997,"_554":998,"_501":4347,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":4349,"_473":474,"_496":480},{"_497":-5,"_562":1002,"_45":1003,"_501":4350,"_566":4351,"_96":568},{"_506":480},[4352,4353],{"_49":1009,"_96":635},{"_49":1008,"_96":635},{"_512":1011,"_494":4355,"_473":474,"_496":480},{"_497":4356,"_45":1003,"_566":4357,"_96":568},[],[1009,1008],{"_494":4359,"_473":474,"_496":480},{"_518":1017,"_45":-5,"_501":4360,"_187":-5,"_521":4361,"_96":523},{"_506":480},{"_320":4362,"_525":-5},[4363,4364],{"_49":711,"_96":529},{"_49":1023,"_96":529},{"_512":1025,"_494":4366,"_473":474,"_496":480},{"_534":1023,"_535":1027,"_537":4367,"_539":540,"_478":35,"_541":35,"_45":1029,"_543":1030,"_545":546,"_487":117,"_96":547},[4368,4369,4370],{"_535":1040,"_187":1041,"_166":921,"_96":1037},{"_535":1038,"_187":1035,"_166":1039,"_96":1037},{"_535":1034,"_187":1035,"_166":1036,"_96":1037},{"_494":4372,"_473":474,"_496":480},{"_518":1017,"_45":1044,"_554":1045,"_501":4373,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":4375,"_473":474,"_496":480},{"_497":-5,"_562":1049,"_45":1050,"_501":4376,"_566":4377,"_96":568},{"_506":480},[4378],{"_49":1054,"_96":635},{"_512":1056,"_494":4380,"_473":474,"_496":480},{"_497":4381,"_45":1050,"_566":4382,"_96":568},[],[1054],{"_494":4384,"_473":474,"_496":480},{"_518":1062,"_45":-5,"_501":4385,"_187":-5,"_521":4386,"_96":523},{"_506":480},{"_320":4387,"_525":-5},[4388,4389],{"_49":583,"_96":529},{"_49":710,"_96":529},{"_512":1069,"_494":4391,"_473":474,"_496":480},{"_715":4392,"_45":1072,"_487":117,"_96":718},[4393,4394,4395,4396],{"_331":1085,"_9":4400,"_166":1087},{"_331":1082,"_9":4399,"_166":1084},{"_331":1080,"_9":4398,"_166":722},{"_331":1077,"_9":4397,"_166":1079},{"_723":-5,"_96":724},{"_723":-5,"_96":724},{"_723":-5,"_96":724},{"_723":-5,"_96":724},{"_494":4402,"_473":474,"_496":480},{"_518":1062,"_45":1090,"_554":1091,"_501":4403,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":4405,"_473":474,"_496":480},{"_497":-5,"_562":1095,"_45":1096,"_501":4406,"_566":4407,"_96":568},{"_506":480},[4408],{"_49":1100,"_96":635},{"_512":1102,"_494":4410,"_473":474,"_496":480},{"_497":4411,"_45":1096,"_566":4412,"_96":568},[],[1100],{"_494":4414,"_473":474,"_496":480},{"_518":1108,"_45":-5,"_501":4415,"_187":-5,"_521":4416,"_96":523},{"_506":480},{"_320":4417,"_525":-5},[4418,4419],{"_49":530,"_96":529},{"_49":1114,"_96":529},{"_512":1116,"_494":4421,"_473":474,"_496":480},{"_534":1114,"_535":1118,"_537":4422,"_539":540,"_478":35,"_541":35,"_45":1120,"_543":1121,"_545":546,"_487":117,"_96":547},[4423,4424,4425],{"_535":1131,"_166":1130,"_1126":1132,"_96":1128},{"_535":1129,"_187":1130,"_166":1079,"_96":1037},{"_535":1125,"_166":1041,"_1126":1127,"_96":1128},{"_494":4427,"_473":474,"_496":480},{"_518":1108,"_45":1135,"_554":1136,"_501":4428,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":4430,"_473":474,"_496":480},{"_497":-5,"_562":1140,"_45":1141,"_501":4431,"_566":4432,"_96":568},{"_506":480},[],{"_512":1145,"_494":4434,"_473":474,"_496":480},{"_497":4435,"_45":1141,"_566":4436,"_96":568},[],[],{"_494":4438,"_473":474,"_496":480},{"_518":1151,"_45":-5,"_501":4439,"_187":-5,"_521":4440,"_96":523},{"_506":480},{"_320":4441,"_525":-5},[4442,4443],{"_49":530,"_96":529},{"_49":1157,"_96":529},{"_512":1159,"_494":4445,"_473":474,"_496":480},{"_534":1157,"_535":1161,"_537":4446,"_539":540,"_478":753,"_541":35,"_45":1163,"_543":1164,"_545":546,"_487":117,"_96":547},[4447,4448,4449,4450],{"_535":1174,"_187":1175,"_166":722,"_96":1037},{"_535":1172,"_187":1173,"_166":1084,"_96":1037},{"_535":1170,"_187":1171,"_166":1087,"_96":1037},{"_535":1169,"_187":1130,"_166":1079,"_96":1037},{"_494":4452,"_473":474,"_496":480},{"_518":1151,"_45":1178,"_554":1179,"_501":4453,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":4455,"_473":474,"_496":480},{"_497":-5,"_562":1183,"_45":1184,"_501":4456,"_566":4457,"_96":568},{"_506":480},[4458,4459],{"_49":1190,"_96":635},{"_49":1189,"_96":635},{"_512":1192,"_494":4461,"_473":474,"_496":480},{"_497":4462,"_45":1184,"_566":4463,"_96":568},[],[1190,1189],{"_494":4465,"_473":474,"_496":480},{"_518":1198,"_45":-5,"_501":4466,"_187":-5,"_521":4467,"_96":523},{"_506":480},{"_320":4468,"_525":-5},[4469,4470],{"_49":530,"_96":529},{"_49":1204,"_96":529},{"_512":1206,"_494":4472,"_473":474,"_496":480},{"_534":1204,"_535":1208,"_537":4473,"_539":540,"_478":35,"_541":1210,"_45":1211,"_543":1212,"_545":546,"_487":756,"_96":547},[4474],{"_535":1214,"_96":550},{"_494":4476,"_473":474,"_496":480},{"_518":1198,"_45":1217,"_554":1218,"_501":4477,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":4479,"_473":474,"_496":480},{"_497":-5,"_562":1222,"_45":1223,"_501":4480,"_566":4481,"_96":568},{"_506":480},[4482],{"_49":1227,"_96":635},{"_512":1229,"_494":4484,"_473":474,"_496":480},{"_497":4485,"_45":1223,"_566":4486,"_96":568},[],[1227],{"_494":4488,"_473":474,"_496":480},{"_518":1235,"_45":-5,"_501":4489,"_187":-5,"_521":4490,"_96":523},{"_506":480},{"_320":4491,"_525":-5},[4492,4493],{"_49":530,"_96":529},{"_49":1241,"_96":529},{"_512":1243,"_494":4495,"_473":474,"_496":480},{"_534":1241,"_535":1245,"_537":4496,"_539":540,"_478":35,"_541":35,"_45":1247,"_543":1248,"_545":546,"_487":117,"_96":547},[4497,4498,4499,4500],{"_535":1260,"_187":1261,"_166":1262,"_96":1037},{"_535":1258,"_166":1254,"_96":1259},{"_535":1256,"_166":-5,"_1126":1257,"_96":1128},{"_535":1253,"_166":1254,"_1126":1255,"_96":1128},{"_494":4502,"_473":474,"_496":480},{"_518":1235,"_45":1265,"_554":1266,"_501":4503,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":4505,"_473":474,"_496":480},{"_518":1270,"_45":-5,"_501":4506,"_187":-5,"_521":4507,"_96":523},{"_506":480},{"_320":4508,"_525":-5},[4509,4510],{"_49":711,"_96":529},{"_49":1276,"_96":529},{"_512":1278,"_494":4512,"_473":474,"_496":480},{"_534":1276,"_535":1280,"_537":4513,"_539":540,"_478":35,"_541":35,"_45":1282,"_543":1283,"_545":546,"_487":117,"_96":547},[4514,4515,4516],{"_535":1290,"_166":1254,"_1126":1291,"_96":1128},{"_535":1289,"_166":1254,"_96":1259},{"_535":1287,"_166":-5,"_1126":1288,"_96":1128},{"_494":4518,"_473":474,"_496":480},{"_518":1270,"_45":1294,"_554":1295,"_501":4519,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":4521,"_473":474,"_496":480},{"_497":-5,"_562":1299,"_45":1300,"_501":4522,"_566":4523,"_96":568},{"_506":480},[4524],{"_49":1304,"_96":635},{"_512":1306,"_494":4526,"_473":474,"_496":480},{"_497":4527,"_45":1300,"_566":4528,"_96":568},[],[1304],{"_494":4530,"_473":474,"_496":480},{"_518":1312,"_45":-5,"_501":4531,"_187":-5,"_521":4532,"_96":523},{"_506":480},{"_320":4533,"_525":-5},[4534,4535],{"_49":530,"_96":529},{"_49":205,"_96":529},{"_512":1319,"_494":4537,"_473":474,"_496":480},{"_534":-5,"_535":1321,"_537":4538,"_539":540,"_478":35,"_541":35,"_45":1323,"_543":1324,"_545":546,"_487":117,"_96":547},[4539],{"_535":1326,"_96":550},{"_494":4541,"_473":474,"_496":480},{"_518":1312,"_45":1329,"_554":1330,"_501":4542,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":4544,"_473":474,"_496":480},{"_497":-5,"_562":1334,"_45":1335,"_501":4545,"_566":4546,"_96":568},{"_506":480},[],{"_512":1339,"_494":4548,"_473":474,"_496":480},{"_497":4549,"_45":1335,"_566":4550,"_96":568},[],[],{"_494":4552,"_473":474,"_496":480},{"_518":1345,"_45":-5,"_501":4553,"_187":-5,"_521":4554,"_96":523},{"_506":480},{"_320":4555,"_525":-5},[4556,4557],{"_49":530,"_96":529},{"_49":1351,"_96":529},{"_512":1353,"_494":4559,"_473":474,"_496":480},{"_534":1355,"_535":1356,"_537":4560,"_539":540,"_478":753,"_541":35,"_45":1358,"_543":1359,"_545":546,"_487":117,"_96":547},[4561],{"_535":1361,"_96":550},{"_494":4563,"_473":474,"_496":480},{"_518":1345,"_45":1364,"_554":1365,"_501":4564,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":4566,"_473":474,"_496":480},{"_497":-5,"_562":1369,"_45":1370,"_501":4567,"_566":4568,"_96":568},{"_506":480},[4569],{"_49":1374,"_96":635},{"_512":1376,"_494":4571,"_473":474,"_496":480},{"_497":4572,"_45":1370,"_566":4573,"_96":568},[],[1374],{"_494":4575,"_473":474,"_496":480},{"_518":1382,"_45":-5,"_501":4576,"_187":-5,"_521":4577,"_96":523},{"_506":480},{"_320":4578,"_525":-5},[4579,4580],{"_49":1389,"_96":529},{"_49":1388,"_96":529},{"_512":1391,"_494":4582,"_473":474,"_496":480},{"_534":1388,"_535":1393,"_537":4583,"_539":540,"_478":35,"_541":35,"_45":1395,"_543":1396,"_545":546,"_487":117,"_96":547},[4584],{"_535":1398,"_96":550},{"_494":4586,"_473":474,"_496":480},{"_518":1382,"_45":1401,"_554":1402,"_501":4587,"_187":557,"_558":-5,"_487":117,"_96":559},{"_506":480},{"_494":4589,"_473":474,"_496":480},{"_497":-5,"_562":1406,"_45":1407,"_501":4590,"_566":4591,"_96":568},{"_506":480},[4592],{"_49":1411,"_96":635},{"_512":1413,"_494":4594,"_473":474,"_496":480},{"_497":4595,"_45":1407,"_566":4596,"_96":568},[],[1411],{"_512":1418,"_494":4598,"_473":474,"_496":480},{"_1420":-5,"_497":4599,"_45":1422,"_96":1423},[4600],{"_49":1425,"_1426":4601,"_96":49},[],{"_494":4603,"_473":474,"_496":480},{"_497":4604,"_499":-5,"_45":-5,"_501":4605,"_503":-5,"_100":332,"_96":505},[4606],{"_506":480},{"_49":1425,"_96":529},{"_494":4608,"_473":474,"_496":480},{"_497":4609,"_499":-5,"_45":-5,"_501":4610,"_503":-5,"_100":332,"_96":505},[4611,4612],{"_506":480},{"_49":1440,"_96":529},{"_49":1439,"_96":529},{"_494":4614,"_473":474,"_496":480},{"_497":4615,"_499":-5,"_45":-5,"_501":4616,"_503":-5,"_100":1445,"_96":505},[4617],{"_506":480},{"_49":1447,"_96":529},{"_494":4619,"_473":474,"_496":480},{"_497":4620,"_499":-5,"_45":-5,"_501":4621,"_503":-5,"_100":1445,"_96":505},[4622],{"_506":480},{"_49":1453,"_96":529},{"_494":4624,"_473":474,"_496":480},{"_497":4625,"_499":-5,"_45":-5,"_501":4626,"_503":-5,"_100":1445,"_96":505},[4627,4628],{"_506":480},{"_49":1461,"_96":529},{"_49":1460,"_96":529},{"_473":474,"_91":4630},{"_107":-5,"_45":480,"_481":4631,"_483":484,"_485":486,"_487":1466},[],{"_487":4633,"_473":474},{"_1469":4634,"_96":1471},[],{"_1474":4636},{"_1476":-5,"_1477":-5,"_1478":1479,"_1480":486,"_539":540,"_1481":18,"_1482":-5,"_1483":-5,"_1484":-5,"_1485":1486,"_45":474,"_1487":1488,"_187":-5,"_1489":-5,"_166":1490,"_1491":205,"_1492":486,"_1493":474,"_545":1494,"_487":4637,"_1496":-5,"_81":4638,"_1498":486},{"_96":491},[],[],[4641],{"_45":1503,"_1504":4642,"_1506":1507,"_1508":1507,"_497":4643,"_487":1510,"_499":-5,"_1511":35,"_1512":4644,"_1514":1515,"_1516":-5},{"_100":332,"_187":-5,"_1512":4648},{"_1521":49,"_1522":4647},{"_1517":4645},{"_1519":4646},[],[1524],{},{"_96":505,"_100":97,"_497":4676},{"_96":1557,"_1558":4655},{"_96":1534,"_1535":605,"_1536":1537,"_1538":4652,"_1540":-5},{"_96":1538,"_1541":202,"_132":133,"_1542":-5,"_331":1543,"_1544":4653,"_1546":1547,"_1548":1549,"_1550":753,"_1551":605,"_1552":4654},{"_1554":1555,"_1556":-5},[],[4656,4657,4658,4659,4660],{"_166":2602,"_1566":-5,"_1567":4673,"_1569":-5},{"_166":1918,"_1566":-5,"_1567":4670,"_1569":-5},{"_166":1807,"_1566":-5,"_1567":4667,"_1569":-5},{"_166":1699,"_1566":-5,"_1567":4664,"_1569":-5},{"_166":1565,"_1566":-5,"_1567":4661,"_1569":-5},[4662],{"_1571":753,"_1572":1573,"_497":4663,"_1575":62},[1576,1577,1578,1577,1579,1580,1581,1582,1583,1577,1584,1585,1586,1577,1587,1577,1588,1589,205,1590,1591,1592,205,1593,1594,1595,1596,1597,1598,1599,1600,1601,1602,1603,1604,1605,205,1593,1606,1607,1608,1609,1602,1610,205,1611,205,1612,1613,1614,1615,1616,1617,1618,1619,1620,1621,1622,1623,1624,1625,1626,1627,1628,1629,1630,205,1631,1632,1633,1634,1635,1636,1637,1638,1639,1640,1641,205,1642,205,1643,1644,1645,1646,1647,1648,1649,205,1650,1651,1652,1653,1654,1655,1656,205,1657,1658,1659,1660,1661,1662,1663,1664,1665,1666,205,1667,1668,1669,1670,1671,205,1672,1673,1674,1675,1671,1662,1663,1665,205,1676,1677,1678,1679,1680,1681,1662,1682,1683,1684,1665,1685,1686,205,1687,1688,1689,1690,1691,1692,205,1693,1694,1695,1696,1697,1629,1630,1698],[4665],{"_1571":753,"_1572":1702,"_497":4666,"_1575":62},[1704,1577,1705,1577,1706,1577,1707,1577,1708,1709,1710,1711,1577,1712,1713,1714,1715,1716,1717,1718,1577,1719,1720,205,1721,1722,1723,1724,205,1725,1726,1727,1728,205,1729,205,1730,1731,1688,1689,1732,1733,1734,205,1735,1736,205,1737,1738,1739,1740,1741,1742,1743,1744,1745,1746,1747,1748,1749,1750,1685,205,1751,1752,205,1753,1754,1755,1756,1757,1758,1759,1760,1761,1762,1763,205,1764,1765,1766,1767,1768,1769,1770,1771,1772,1773,1774,205,1775,1776,1777,1778,1779,205,1780,1781,205,1782,1783,1784,1785,1786,1787,1788,1789,1790,1791,1792,1793,1794,1795,1685,1796,1630,205,1797,1734,205,1735,1798,1799,1800,205,1751,1762,1763,205,1801,1802,1770,1771,1803,1804,205,1805,1806,1630,1698],[4668],{"_1571":753,"_1572":1810,"_497":4669,"_1575":62},[1812,1577,1813,1814,1815,1816,1817,1577,1818,1577,1819,1820,1821,1822,1823,1577,1824,1577,1825,1826,1827,1828,1829,205,1721,1830,1724,205,1831,1832,205,1833,1834,1688,1689,1835,1690,1734,205,1836,1837,1838,1839,1685,205,1840,1841,1842,1843,1844,1845,1846,1847,1641,1848,1849,1850,1851,1852,1750,1685,205,1853,1854,1855,1856,205,1857,1858,1859,205,1860,1861,205,1862,1863,1864,1756,1865,1859,1866,1867,205,1868,1869,1870,1871,1872,1873,1874,1875,205,1876,1877,1878,1770,1879,1880,1881,1630,205,1882,1688,1689,1835,1690,1883,1884,1885,1734,205,1837,1838,1839,1685,205,1886,1887,1888,1889,1856,205,1890,1891,1892,1893,1894,1895,1896,1897,205,1866,1898,205,1899,1861,205,1900,1901,1902,1903,1770,1904,1905,1773,1906,1907,1908,205,1909,1910,1911,1912,205,1913,1914,1915,1916,1911,1917,1630,1698],[4671],{"_1571":753,"_1572":1921,"_497":4672,"_1575":62},[1923,1924,1925,1926,1927,1928,1929,1930,1931,1932,1933,1934,1935,1936,1937,1938,1939,1940,1941,1942,1943,205,1944,1945,1946,1947,1948,205,1949,1950,205,1951,1952,1953,1954,1630,1605,205,1955,1956,1957,1605,205,1958,205,1959,1960,1605,205,1961,1962,1605,205,1963,1964,1605,205,1965,1966,1967,1968,1969,1970,1605,205,1971,1972,1973,205,1974,1975,1976,205,1977,1978,1979,1980,1981,1982,1983,1984,1698,205,1985,1986,1987,1988,1989,1698,205,1990,1991,1992,1993,1994,1995,1996,1997,1998,1630,205,1999,2000,2001,1630,1698,205,2002,2003,2004,2005,2006,2007,2008,2009,2010,1630,205,2011,2004,2012,2013,2014,2015,2016,2017,1630,1698,205,2018,2019,2020,2021,2022,205,2023,2024,2025,2026,1630,205,2027,2028,2029,2030,2031,2032,2026,1630,205,2033,2012,2034,2035,2025,2036,2037,2038,205,2039,2040,1630,205,2041,2042,2043,2044,2045,1630,1698,205,2046,2047,2048,2049,2050,1630,205,2051,2052,2053,2054,2055,2056,2057,2058,1630,205,2059,2060,2061,1630,205,2062,2063,2064,2052,2065,2066,2067,2068,2069,2070,2071,2072,2054,2055,2056,2073,2074,2075,2076,2077,2054,1630,205,2078,2052,2065,2066,2079,2080,2070,2071,2072,2054,2055,2056,2081,2082,1630,205,2083,2084,2052,2085,2054,2055,2056,2058,1630,1698,205,2086,2087,2012,2088,2089,2090,205,2015,2016,2091,205,2092,2093,2094,2095,2096,2097,2098,2099,2100,2101,2102,2103,2104,1630,205,2105,2012,2106,2089,2107,205,2108,2092,2109,2110,2111,2112,2113,2114,2115,2116,2117,1630,205,2118,2119,2120,2121,2122,2123,2124,2125,2126,1641,2127,2128,1685,205,2129,2130,2131,2132,205,2133,2134,2135,2103,1630,205,2136,2012,2137,2138,2139,2140,2141,2142,205,2143,2144,2145,2146,1630,1698,205,2147,2148,2012,2149,2150,205,2055,2056,2151,2152,2153,2007,2154,1630,205,2155,2012,2088,2156,2157,205,2055,2151,2158,2159,2009,2007,2154,1630,205,2160,2012,2088,2161,205,2055,2056,2151,2007,2154,1630,205,2162,2163,2164,2165,2012,2149,2166,205,2055,2056,2167,2168,2169,1630,205,2170,2012,2171,2172,2173,205,2174,2175,2176,2012,2177,2156,2178,2179,2180,1630,1698,205,2181,2182,2183,2184,2185,1630,205,2186,2187,2188,2189,2190,2191,2192,2193,2194,1630,205,2195,2183,2196,2197,1630,205,2198,2000,2199,1995,2200,2201,2202,1630,205,2203,2000,2199,2204,1630,205,2205,2206,2207,2208,2183,2209,2210,1630,205,2211,2183,2184,2212,1630,205,2213,2000,2214,2215,1630,205,2216,2217,2218,205,2219,205,1995,2220,2201,2221,2222,2223,2224,2225,2226,1630,205,2227,2217,2228,2185,1630,205,2229,2230,2231,2012,2232,2233,2234,205,2219,205,2235,2236,2237,2238,2239,2240,2241,1630,205,2242,2000,2243,1995,2244,2245,2246,1630,1698,205,2247,2248,2052,2249,2250,2251,2252,2054,2253,2254,2255,2256,1630,205,2257,2031,2258,2259,1630,205,2260,2012,2261,2089,2262,205,2263,2264,2091,2265,1630,205,2266,2004,2267,2268,2007,2009,2269,1630,1698,205,2270,2271,2004,2272,2273,2274,2275,2103,1995,2276,2277,1630,205,2278,2279,2000,2280,2281,1995,2282,2283,2284,2285,2154,1630,205,2286,2287,2288,2289,2290,2291,2292,2293,2294,2000,205,2280,205,2295,2154,1630,205,2296,2297,2298,2299,2004,2000,205,2280,205,2281,2300,1630,205,2301,2302,2303,2154,1630,205,2304,2004,2000,2305,2281,2306,1630,205,2307,2308,2309,2310,2311,205,2312,2313,2154,205,2314,2315,1630,205,2316,2317,2318,2311,2319,2305,2154,1630,205,2320,2321,2322,2323,2324,2325,2326,2293,2294,2319,205,2305,205,2154,2327,2328,2329,2330,1630,1698,205,2331,2332,2333,2334,2335,2336,2337,2338,2339,2340,205,2341,205,2342,2343,2344,2345,2346,2347,2348,2349,205,2350,2351,2352,2353,1630,205,2354,2355,205,2356,2357,1630,1698,205,2358,2359,2360,2361,2362,2363,2364,205,2365,205,2342,2366,2367,2368,2369,2370,1630,205,2371,2052,2372,205,2373,2056,2374,1630,205,2375,2376,2377,2378,2379,2380,2381,2382,2372,205,2383,205,2281,2384,2385,2386,2387,2388,2389,1630,205,2390,2391,2392,2393,2012,2394,2138,2395,205,2396,205,2370,2397,2009,1630,205,2398,2363,2399,2357,2389,1630,1698,205,2400,2401,2402,2403,2404,2405,2406,2407,2408,2409,2410,2411,2412,1685,2413,1686,205,2414,2415,2416,2417,1686,205,2418,2419,2420,205,2421,2422,2423,205,2424,2425,2426,2054,205,2427,2428,205,2429,2385,205,2430,2431,205,2133,2432,2009,2433,2434,2435,2104,1630,205,2436,2419,2420,205,2437,2438,2439,205,2004,2425,2426,2054,205,2440,2441,205,2133,2009,1630,205,2442,2443,2444,2445,2012,2446,2447,205,2448,2449,205,2450,2180,2104,1630,205,2451,2452,1619,2453,2454,2455,2456,2457,2458,2459,2460,2461,2462,1654,205,2463,2464,205,2465,2466,2467,2468,2469,2470,1629,1630,205,2471,2472,2004,2425,2426,2054,205,2473,205,2133,2474,2104,1630,1698,205,2475,2476,2477,2478,2479,2004,2480,205,2449,205,2481,2103,1630,205,2482,2004,2483,2484,2485,2486,2487,1685,205,2488,2428,2009,205,2489,205,2490,2491,205,2492,2493,2494,2495,2496,2497,2498,2499,1630,205,2500,2004,2501,205,2273,205,2502,2103,1630,205,2503,2004,2483,2484,2485,2504,2487,1685,205,2505,2428,205,2506,2507,2508,2509,2103,205,2510,2511,205,2512,2513,1630,205,2514,2515,2516,2517,2004,2483,2484,2485,2518,2519,2487,1685,205,2520,2521,2522,2428,205,2523,2524,205,2525,2526,205,2527,2528,2529,2530,2531,2532,2533,1630,205,2534,2535,2536,2537,2538,2539,2540,2484,2541,2542,2487,1685,205,2543,2544,2428,205,2280,2154,205,2545,2546,205,2547,1630,205,2548,2540,2333,205,2549,205,2352,1630,205,2550,2004,2551,2484,2552,2486,2487,1685,205,2553,2428,205,2554,205,2555,2556,2557,205,2154,2389,2558,2559,2499,1630,205,2560,2561,2562,2563,2564,2004,2483,2484,2485,2486,2487,1685,205,2565,2428,205,2280,2566,205,2526,2567,2568,1630,205,2569,2570,2571,2572,2483,2484,2573,2574,2575,2485,2504,2487,1685,205,2576,2428,205,2273,2577,205,2578,1630,205,2579,2483,2484,2575,2485,2486,2487,1685,205,2565,2428,205,2280,2566,205,2526,2567,2568,1630,205,2580,2581,2582,2483,2484,2583,2584,2585,2485,2504,2487,1685,205,2586,2428,205,2587,2577,205,2588,2589,1630,205,2590,2483,2484,2585,2485,2486,2487,1685,205,2591,2428,205,2280,2566,205,2592,2567,2568,1630,205,2593,2594,2595,2596,2004,2483,2484,2485,2504,2486,2487,1685,205,2597,2428,205,2587,2598,2599,205,2600,2601,1630,1698],[4674],{"_1571":753,"_1572":2605,"_497":4675,"_1575":62},[2607,2608,2609,2610,2611,205,2612,205,2613,2614,2615,2616,205,2617,2618,2619,2620,205,2621,2622,2623,2624,2625,2626,2627,2628,1686,1605,205,2629,2630,2631,2632,2633,1605,205,2634,2635,2636,2637,2638,2639,1605,205,2640,2641,2642,2643,2644,2645,2646,2647,2648,2649,2650,2651,2652,2653,2654,2655,2656,2657,2658,2659,2660,2661,2662,2663,2664,2665,2666,2667,2668,1641,2669,2670,2671,1629,2672,2673,1686,2674,1605,205,2675,2676,2677,2678,2679,2680,1605,205,2681,2682,2683,2684,2685,2686,2687,1605,205,2688,2689,2690,2691,2692,2693,2694,2695,2696,2697,2698,205,2699,2700,2701,2702,1605,205,2703,205,2704,2705,2706,2707,2708,2709,2710,2711,2712,2713,2714,205,2715,2716,2717,2718,1686,1605,205,2719,2720,2721,2722,2723,2724,1577,2725,2726,2727,2728,2729,2730,2643,2731,2732,2733,2734,2735,1686,1605,205,2736,2737,2738,2739,2740,2741,2742,2743,2744,2745,2746,2747,2748,2749,2750,1630,2751,2752,2753,2754,2755,2756,1686,2757,2758,1605,205,2759,2760,2761,2762,1577,2763,2764,2765,2766,2767,2768,2769,2770,2771,2772,2773,2774,2775,2776,2777,2778,2779,2780,2754,2755,2756,1686,2757,2758,1605,205,2781,2782,2783,2784,2785,2786,2787,2788,1577,2789,2790,2791,2792,2793,2794,2795,2796,2797,2798,1605,205,2799,2800,2801,2802,2803,2804,2805,2806,2807,2808,2809,2810,2745,2811,2812,2813,2814,1989,2643,2815,2816,2817,2818,1756,2819,2820,2821,2822,2823,2824,2825,2826,2827,2828,2829,2830,2831,2054,2732,2832,2833,2834,2835,2836,1686,1605,205,2837,2838,2839,2840,2841,2842,2843,2844,2845,1577,2846,2847,2848,2849,2850,2851,205,2852,2853,2854,2855,2856,205,2857,2858,2859,2860,205,2861,2862,2863,2864,2865,2866,2867,2868,1685,2869,2870,2871,1605,205,2872,2873,2874,2875,2876,205,2877,2878,205,2879,2880,2881,2777,205,2882,2883,2884,2885,2886,2887,2888,2889,2890,2891,2892,2893,2894,2895,2896,2897,2898,2899,2900,2901,2902,2903,2904,2905,2906,2900,2907,2908,2909,1685,205,2910,1605,205,2911,2912,2913,2914,2643,2915,2916,2672,2917,1686,1605,205,2918,205,2919,2920,1605,205,2921,2922,2923,2924,1577,2925,2926,2927,2928,2689,2929,2930,2931,2692,2932,2749,2933,2934,1630,1605,205,2935,2689,2936,2930,2931,2692,2932,2937,2933,2750,1630,1605,205,2938,2939,2940,2941,2942,2943,2689,2944,2945,2930,2692,2932,2937,2946,2947,2948,2949,2950,1630,1605,205,2951,2932,2952,2953,1630,1605,205,2954,2955,2956,2689,2957,2958,2643,2959,2732,2960,1619,2961,2962,2963,2964,2965,2966,2967,2968,1641,2969,2970,2971,2972,1629,1686,1605,205,2973,2689,2974,2957,2975,2698,2976,2700,2977,2978,2979,2980,2981,2869,1605,205,2982,2958,2643,2983,2732,2960,1619,2961,2984,2963,2985,2986,2987,2965,2966,2988,2968,1641,2969,2970,2971,2972,1629,1686,1605,205,2989,2990,2991,2992,2993,2994,2643,2995,2732,2996,2997,2998,2999,3000,3001,3002,1686,1605,205,3003,3004,3005,3006,3007,3008,3009,3010,3011,3012,3013,3014,1605,205,3015,3016,3017,3018,3019,3020,3021,3022,3023,3024,3025,3026,1605],[4677,4678,4679,4680,4681,4682,4683,4684,4685,4686],{"_1521":49,"_49":3053},{"_1521":3039,"_166":2602,"_1571":3051,"_1572":3052},{"_1521":3039,"_166":1918,"_1571":3049,"_1572":3050},{"_1521":49,"_49":3048},{"_1521":3039,"_166":1807,"_1571":3046,"_1572":3047},{"_1521":49,"_49":3045},{"_1521":3039,"_166":1699,"_1571":3043,"_1572":3044},{"_1521":49,"_49":3042},{"_1521":3039,"_166":1565,"_1571":3040,"_1572":3041},{"_1521":49,"_49":3038},[4689,4690,4691,4692,4693],{"_3063":3064,"_269":202,"_3065":311,"_280":-5,"_1541":263,"_3066":-5,"_3067":-5,"_3068":3069,"_3070":3071,"_3072":-5,"_3073":-5,"_3074":3075,"_3076":18,"_3077":62,"_3078":57,"_3079":18,"_3080":-5},{"_96":505,"_100":332,"_497":4694},{"_318":319,"_320":321,"_3095":325,"_3096":133,"_328":-5,"_96":3097},{"_96":3086,"_320":3091,"_166":3092,"_3088":3093,"_3089":3094},{"_96":3086,"_320":3090,"_166":-5,"_3088":-5,"_3089":-5},{"_96":3086,"_320":3087,"_166":-5,"_3088":-5,"_3089":-5},[4695],{"_1521":49,"_49":3100},"task_e_6a6ef6e81b4083288e32635561c7f015",1785657064.106603,"GitHub Mention: test(e2e): Playwright smoke suite for the SPA over the #243 simulation fixture","has_generated_title","has_unread_turn","denormalized_metadata",{"_4727":35,"_4728":4729,"_4730":-5,"_4731":-5,"_4721":4732,"_4733":-5,"_4734":-5,"_4735":-5,"_4736":-5},"task_status_display",{"_4716":4717,"_4718":202,"_134":131,"_4719":-5,"_4720":1534},"creator_workspace","external_pull_requests",[4708],{"_45":4709,"_4710":87,"_4711":4712,"_4713":4714},"github-1301193065-390","assistant_turn_id","pull_request",{"_310":311,"_301":312,"_313":314,"_315":62,"_316":18,"_317":18,"_318":319,"_320":321,"_322":273,"_323":131,"_324":325,"_326":327,"_328":329,"_330":-5,"_331":-5,"_332":4715,"_334":335,"_336":337,"_338":339,"_340":35},"codex_updated_sha","b7556c436c1101a18f3cf2f8e11ebb7389d25528",{"_295":296,"_187":296,"_341":-5,"_299":300,"_45":297},"latest_turn_status_display",{"_506":87,"_116":117,"_4721":4722,"_98":4723,"_4724":-5,"_4725":-5,"_4726":1534,"_118":-5},"environment_label","fix_task_id","initial_intent","diff_stats",{"_1546":1547,"_1548":1549,"_1550":753},[],"image_asset_pointer_citations","issue_counts","intent","num_follow_ups","repo_name_map",{},"last_user_turn_created_at","last_turn_status",{"_1546":-5,"_1548":-5,"_1550":-5},"last_pushed_turn_id","start_branch_name","pushed_branch_name","cached_pull_request_data","dd",{"_4751":4752,"_4753":4754},"disablePrefetch","shouldPrefetchAccount","shouldPrefetchUser","shouldPrefetchSystemHints","manageRootRouteStylesheet","mobileWebHandoffEnabled","promoteCss","disableSSR","stripModulepreloadImports","paidCampaignAppRedirect","statsigGateEvaluationsPromise",["P",4750],"traceId","3070884097262516368","traceTime",1787329689404]