@fuzdev/fuz_app 0.141.0 → 0.143.0

package/dist/testing/cross_backend/spine_surface_constants.d.ts

@@ -1,26 +1,18 @@
 import '../assert_dev_env.js';
 /**
- * Pure spine-surface constants — wire paths, roles, the fixture URL, and the
- * env-var names the backend configs set for the spawned spine binaries. A
- * hono-free leaf split out of `default_spine_surface.ts`.
- *
- * Cross-process suite modules (which drive a separately-spawned backend binary
- * over HTTP) need only the wire path / role / fixture-URL, not the in-process
- * route handlers. Importing them from `default_spine_surface.ts` used to drag
- * its eager `account_routes.ts` / `signup_routes.ts` imports — and through them
- * `session_middleware` → `hono/cookie` — onto a backend-spawning consumer with
- * no `hono` peer installed (a Rust-only spine consumer). Keeping these constants
- * on this handler-free leaf lets such a consumer import the path without the
- * peer. `default_spine_surface.ts` imports the ones it uses from here.
- *
- * The env-var names live here so both sides of each contract share one
- * constant: the backend configs that set them (`default_backend_configs.ts`,
- * `ts_spine_backend_config.ts`, `rust_spine_stub_backend_config.ts`) and the
- * spawned TS spine binary that reads them, which imports this leaf rather than
- * the config builders.
- *
- * @module
+ * Shared `auth` axis for every `_testing_*` action: keeper-only via the
+ * daemon-token credential, no acting actor. This is the entire structural
+ * fence on the backdoor surface (these actions run direct DB writes the
+ * production wire never exposes), so every `_testing_*` spec references this
+ * one const rather than re-declaring it — a single source of truth the gate test
+ * (`testing_actions_auth.test.ts`) pins. Mirrors the Rust `DAEMON_TOKEN_ONLY`
+ * / shared `AuthSpec` in `fuz_testing`.
  */
+export declare const TESTING_ACTION_AUTH: {
+    readonly account: "required";
+    readonly actor: "none";
+    readonly credential_types: readonly ["daemon_token"];
+};
 /** RPC endpoint mount path — matches the binary's `/api/rpc`. */
 export declare const SPINE_RPC_PATH = "/api/rpc";
 /**
@@ -72,7 +64,7 @@ export declare const SPINE_ROLE_GATED_WS_PATH = "/api/gated/ws";
 export declare const SPINE_ROLE_GATED_WS_ROLES: ReadonlyArray<string>;
 /**
  * Committed expected-schema fixture for the spine `/ready` deploy gate — the
- * column map a fresh full spine bootstrap (auth + cell + cell_history + fact)
+ * column map a fresh full spine bootstrap (auth + cell + fact)
  * produces. Resolved relative to this module so the spawned TS binary (which
  * imports this source under its loader) reads it off disk via `node:fs`.
  * Regenerated + guarded by `src/test/cross_backend/spine_expected_schema.db.test.ts`.

package/dist/testing/cross_backend/spine_surface_constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spine_surface_constants.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/spine_surface_constants.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,iEAAiE;AACjE,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,4BAA4B,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,kBAAkB,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,EAAE,aAAa,CAAC,MAAM,CAG1D,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,EAAE,GAAwD,CAAC;AAEjG;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAE3E;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B,kCAAkC,CAAC;AAE7E;;;;;;GAMG;AACH,eAAO,MAAM,kCAAkC,uCAAuC,CAAC;AAEvF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,6BAA6B,CAAC"}
+{"version":3,"file":"spine_surface_constants.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/spine_surface_constants.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA4B9B;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB;;;;CAIF,CAAC;AAE/B,iEAAiE;AACjE,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,4BAA4B,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,kBAAkB,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,EAAE,aAAa,CAAC,MAAM,CAG1D,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,EAAE,GAAwD,CAAC;AAEjG;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAE3E;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B,kCAAkC,CAAC;AAE7E;;;;;;GAMG;AACH,eAAO,MAAM,kCAAkC,uCAAuC,CAAC;AAEvF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,6BAA6B,CAAC"}

package/dist/testing/cross_backend/spine_surface_constants.js

@@ -1,26 +1,18 @@
 import '../assert_dev_env.js';
 /**
- * Pure spine-surface constants — wire paths, roles, the fixture URL, and the
- * env-var names the backend configs set for the spawned spine binaries. A
- * hono-free leaf split out of `default_spine_surface.ts`.
- *
- * Cross-process suite modules (which drive a separately-spawned backend binary
- * over HTTP) need only the wire path / role / fixture-URL, not the in-process
- * route handlers. Importing them from `default_spine_surface.ts` used to drag
- * its eager `account_routes.ts` / `signup_routes.ts` imports — and through them
- * `session_middleware` → `hono/cookie` — onto a backend-spawning consumer with
- * no `hono` peer installed (a Rust-only spine consumer). Keeping these constants
- * on this handler-free leaf lets such a consumer import the path without the
- * peer. `default_spine_surface.ts` imports the ones it uses from here.
- *
- * The env-var names live here so both sides of each contract share one
- * constant: the backend configs that set them (`default_backend_configs.ts`,
- * `ts_spine_backend_config.ts`, `rust_spine_stub_backend_config.ts`) and the
- * spawned TS spine binary that reads them, which imports this leaf rather than
- * the config builders.
- *
- * @module
+ * Shared `auth` axis for every `_testing_*` action: keeper-only via the
+ * daemon-token credential, no acting actor. This is the entire structural
+ * fence on the backdoor surface (these actions run direct DB writes the
+ * production wire never exposes), so every `_testing_*` spec references this
+ * one const rather than re-declaring it — a single source of truth the gate test
+ * (`testing_actions_auth.test.ts`) pins. Mirrors the Rust `DAEMON_TOKEN_ONLY`
+ * / shared `AuthSpec` in `fuz_testing`.
  */
+export const TESTING_ACTION_AUTH = {
+    account: 'required',
+    actor: 'none',
+    credential_types: ['daemon_token']
+};
 /** RPC endpoint mount path — matches the binary's `/api/rpc`. */
 export const SPINE_RPC_PATH = '/api/rpc';
 /**
@@ -75,7 +67,7 @@ export const SPINE_ROLE_GATED_WS_ROLES = Object.freeze([
 ]);
 /**
  * Committed expected-schema fixture for the spine `/ready` deploy gate — the
- * column map a fresh full spine bootstrap (auth + cell + cell_history + fact)
+ * column map a fresh full spine bootstrap (auth + cell + fact)
  * produces. Resolved relative to this module so the spawned TS binary (which
  * imports this source under its loader) reads it off disk via `node:fs`.
  * Regenerated + guarded by `src/test/cross_backend/spine_expected_schema.db.test.ts`.

package/dist/testing/cross_backend/testing_origin_check.d.ts

@@ -0,0 +1,128 @@
+import '../assert_dev_env.js';
+/**
+ * `_testing_origin_check` — the testing seam behind the cross-impl origin
+ * conformance table (`origin_conformance.json`): its input and output schemas,
+ * the pure check it answers with, its spec, and the action builder.
+ *
+ * Split from `testing_reset_actions.ts`, whose other seams reach the
+ * in-process app server and through it the optional `hono` peer. This leaf is
+ * hono-free, so a consumer whose backend is a spawned Rust binary can run the
+ * conformance table without installing `hono`.
+ *
+ * @module
+ */
+import { z } from 'zod';
+import { type RpcAction } from '../../actions/action_rpc.js';
+/** Input of `_testing_origin_check`. */
+export declare const TestingOriginCheckInput: z.ZodObject<{
+    patterns: z.ZodString;
+    origin: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type TestingOriginCheckInput = z.infer<typeof TestingOriginCheckInput>;
+/**
+ * Output of `_testing_origin_check`: the request-level answer when the list
+ * parses, else every refusal — `index` the 1-based entry position, absent for
+ * a list-level refusal.
+ */
+export declare const TestingOriginCheckOutput: z.ZodUnion<readonly [z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    allowed: z.ZodBoolean;
+}, z.core.$strict>, z.ZodObject<{
+    ok: z.ZodLiteral<false>;
+    errors: z.ZodArray<z.ZodObject<{
+        index: z.ZodOptional<z.ZodNumber>;
+        kind: z.ZodEnum<{
+            empty_entry: "empty_entry";
+            not_printable_ascii: "not_printable_ascii";
+            missing_scheme: "missing_scheme";
+            unsupported_scheme: "unsupported_scheme";
+            has_path: "has_path";
+            has_userinfo: "has_userinfo";
+            missing_host: "missing_host";
+            invalid_host_char: "invalid_host_char";
+            unbracketed_ipv6: "unbracketed_ipv6";
+            partial_wildcard: "partial_wildcard";
+            non_canonical_ipv4: "non_canonical_ipv4";
+            unclosed_ipv6: "unclosed_ipv6";
+            invalid_ipv6: "invalid_ipv6";
+            invalid_after_ipv6: "invalid_after_ipv6";
+            invalid_port: "invalid_port";
+            default_port: "default_port";
+            no_origins: "no_origins";
+        }>;
+    }, z.core.$strict>>;
+}, z.core.$strict>]>;
+export type TestingOriginCheckOutput = z.infer<typeof TestingOriginCheckOutput>;
+/**
+ * Answer one `_testing_origin_check` input: parse `patterns` with
+ * `parse_allowed_origins`, then run the request-level check for one `Origin`
+ * carrying `origin` (`null` — no `Origin` — passes). The action handler and
+ * the conformance table's unit test both call this, so the table checks the
+ * same function the wire serves.
+ *
+ * @param input - the allowlist value and the `Origin` value
+ * @returns the answer the Rust twin returns for the same input
+ */
+export declare const run_testing_origin_check: (input: TestingOriginCheckInput) => TestingOriginCheckOutput;
+/**
+ * `_testing_origin_check` — run the origin allowlist's parse and request
+ * check for one `{patterns, origin}` pair, so the shared conformance table
+ * (`origin_conformance.json`) checks each backend's grammar and matcher over
+ * the wire, row by row. Pure: no database, no state. The Rust mirror is
+ * `fuz_testing::create_testing_origin_check_action_spec`.
+ *
+ * Like `_testing_action_manifest`, it is **not** bundled by
+ * `create_testing_actions`: a consumer whose Rust binary doesn't mount the
+ * mirror would fail its action-manifest parity gate. The spine test binary
+ * appends it at the full-mount layer (`build_full_spine_rpc_actions`).
+ *
+ * `auth` gates on the daemon-token credential, matching `_testing_reset`.
+ */
+export declare const testing_origin_check_action_spec: {
+    readonly method: "_testing_origin_check";
+    readonly kind: "request_response";
+    readonly initiator: "frontend";
+    readonly auth: {
+        readonly account: "required";
+        readonly actor: "none";
+        readonly credential_types: readonly ["daemon_token"];
+    };
+    readonly side_effects: false;
+    readonly input: z.ZodObject<{
+        patterns: z.ZodString;
+        origin: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>;
+    readonly output: z.ZodUnion<readonly [z.ZodObject<{
+        ok: z.ZodLiteral<true>;
+        allowed: z.ZodBoolean;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        errors: z.ZodArray<z.ZodObject<{
+            index: z.ZodOptional<z.ZodNumber>;
+            kind: z.ZodEnum<{
+                empty_entry: "empty_entry";
+                not_printable_ascii: "not_printable_ascii";
+                missing_scheme: "missing_scheme";
+                unsupported_scheme: "unsupported_scheme";
+                has_path: "has_path";
+                has_userinfo: "has_userinfo";
+                missing_host: "missing_host";
+                invalid_host_char: "invalid_host_char";
+                unbracketed_ipv6: "unbracketed_ipv6";
+                partial_wildcard: "partial_wildcard";
+                non_canonical_ipv4: "non_canonical_ipv4";
+                unclosed_ipv6: "unclosed_ipv6";
+                invalid_ipv6: "invalid_ipv6";
+                invalid_after_ipv6: "invalid_after_ipv6";
+                invalid_port: "invalid_port";
+                default_port: "default_port";
+                no_origins: "no_origins";
+            }>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>]>;
+    readonly async: true;
+    readonly description: string;
+};
+/** Build the standalone `_testing_origin_check` action (see the spec doc). */
+export declare const create_testing_origin_check_action: () => RpcAction;
+//# sourceMappingURL=testing_origin_check.d.ts.map

package/dist/testing/cross_backend/testing_origin_check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing_origin_check.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_origin_check.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AASzE,wCAAwC;AACxC,eAAO,MAAM,uBAAuB;;;kBAKlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAQnC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,GACpC,OAAO,uBAAuB,KAC5B,wBAcF,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYC,CAAC;AAE/C,8EAA8E;AAC9E,eAAO,MAAM,kCAAkC,QAAO,SACyC,CAAC"}

package/dist/testing/cross_backend/testing_origin_check.js

@@ -0,0 +1,87 @@
+import '../assert_dev_env.js';
+/**
+ * `_testing_origin_check` — the testing seam behind the cross-impl origin
+ * conformance table (`origin_conformance.json`): its input and output schemas,
+ * the pure check it answers with, its spec, and the action builder.
+ *
+ * Split from `testing_reset_actions.ts`, whose other seams reach the
+ * in-process app server and through it the optional `hono` peer. This leaf is
+ * hono-free, so a consumer whose backend is a spawned Rust binary can run the
+ * conformance table without installing `hono`.
+ *
+ * @module
+ */
+import { z } from 'zod';
+import { rpc_action } from '../../actions/action_rpc.js';
+import { AllowedOriginsErrorKind, parse_allowed_origins, should_allow_origin } from '../../http/origin.js';
+import { TESTING_ACTION_AUTH } from './spine_surface_constants.js';
+/** Input of `_testing_origin_check`. */
+export const TestingOriginCheckInput = z.strictObject({
+    /** An allowlist value, as `FUZ_ALLOWED_ORIGINS` would carry it. */
+    patterns: z.string(),
+    /** One `Origin` header's value, or `null` for a request without one. */
+    origin: z.string().nullable()
+});
+/**
+ * Output of `_testing_origin_check`: the request-level answer when the list
+ * parses, else every refusal — `index` the 1-based entry position, absent for
+ * a list-level refusal.
+ */
+export const TestingOriginCheckOutput = z.union([
+    z.strictObject({ ok: z.literal(true), allowed: z.boolean() }),
+    z.strictObject({
+        ok: z.literal(false),
+        errors: z.array(z.strictObject({ index: z.number().int().min(1).optional(), kind: AllowedOriginsErrorKind }))
+    })
+]);
+/**
+ * Answer one `_testing_origin_check` input: parse `patterns` with
+ * `parse_allowed_origins`, then run the request-level check for one `Origin`
+ * carrying `origin` (`null` — no `Origin` — passes). The action handler and
+ * the conformance table's unit test both call this, so the table checks the
+ * same function the wire serves.
+ *
+ * @param input - the allowlist value and the `Origin` value
+ * @returns the answer the Rust twin returns for the same input
+ */
+export const run_testing_origin_check = (input) => {
+    const parsed = parse_allowed_origins(input.patterns);
+    if (!parsed.ok) {
+        return {
+            ok: false,
+            errors: parsed.errors.map(({ index, kind }) => index === undefined ? { kind } : { index, kind })
+        };
+    }
+    return {
+        ok: true,
+        allowed: input.origin === null || should_allow_origin(input.origin, parsed.origins)
+    };
+};
+/**
+ * `_testing_origin_check` — run the origin allowlist's parse and request
+ * check for one `{patterns, origin}` pair, so the shared conformance table
+ * (`origin_conformance.json`) checks each backend's grammar and matcher over
+ * the wire, row by row. Pure: no database, no state. The Rust mirror is
+ * `fuz_testing::create_testing_origin_check_action_spec`.
+ *
+ * Like `_testing_action_manifest`, it is **not** bundled by
+ * `create_testing_actions`: a consumer whose Rust binary doesn't mount the
+ * mirror would fail its action-manifest parity gate. The spine test binary
+ * appends it at the full-mount layer (`build_full_spine_rpc_actions`).
+ *
+ * `auth` gates on the daemon-token credential, matching `_testing_reset`.
+ */
+export const testing_origin_check_action_spec = {
+    method: '_testing_origin_check',
+    kind: 'request_response',
+    initiator: 'frontend',
+    auth: TESTING_ACTION_AUTH,
+    side_effects: false,
+    input: TestingOriginCheckInput,
+    output: TestingOriginCheckOutput,
+    async: true,
+    description: "Test-binary only — answer the origin allowlist's parse and request check for one " +
+        '{patterns, origin} pair, for the cross-impl origin conformance table.'
+};
+/** Build the standalone `_testing_origin_check` action (see the spec doc). */
+export const create_testing_origin_check_action = () => rpc_action(testing_origin_check_action_spec, async (input) => run_testing_origin_check(input));

package/dist/testing/cross_backend/testing_reset_actions.d.ts

@@ -15,17 +15,17 @@ import '../assert_dev_env.js';
  * of notifications onto the caller's own WebSocket connection, to push its
  * outbound queue past its byte budget).
  *
- * Three further daemon-token actions live here but are **not** bundled by
+ * Two further daemon-token actions live here but are **not** bundled by
  * `create_testing_actions`, and are appended at the full-mount layer
  * (`build_full_spine_rpc_actions`) instead: **`_testing_action_manifest`**
  * (dump the live RPC registry for cross-impl method-set + auth-shape parity —
  * it must enumerate *every* mounted method, so it goes where the complete list
- * exists), **`_testing_origin_check`** (answer the origin allowlist's parse
- * and request check for the cross-impl origin conformance table), and
- * **`_testing_shorten_credential_expiry`** (pull an account's credential
- * expiries in to seconds from now, shorten-only, for the credential-deadline
- * cases) — the last two kept out of the bundle so a consumer whose Rust binary
- * doesn't mount their mirrors keeps a green manifest gate.
+ * exists) and **`_testing_shorten_credential_expiry`** (pull an account's
+ * credential expiries in to seconds from now, shorten-only, for the
+ * credential-deadline cases) — the latter kept out of the bundle so a consumer
+ * whose Rust binary doesn't mount its mirror keeps a green manifest gate.
+ * `_testing_origin_check`, mounted the same way, lives in the hono-free
+ * `testing_origin_check.ts`.
  *
  * `_testing_reset` — full DB wipe + keeper re-seed + optional
  * secondary-account seeding. The
@@ -472,118 +472,6 @@ export declare const testing_migration_tracker_action_spec: {
  * `create_testing_actions`; mount directly for in-process use.
  */
 export declare const create_testing_migration_tracker_action: () => RpcAction;
-/** Input of `_testing_origin_check`. */
-export declare const TestingOriginCheckInput: z.ZodObject<{
-    patterns: z.ZodString;
-    origin: z.ZodNullable<z.ZodString>;
-}, z.core.$strict>;
-export type TestingOriginCheckInput = z.infer<typeof TestingOriginCheckInput>;
-/**
- * Output of `_testing_origin_check`: the request-level answer when the list
- * parses, else every refusal — `index` the 1-based entry position, absent for
- * a list-level refusal.
- */
-export declare const TestingOriginCheckOutput: z.ZodUnion<readonly [z.ZodObject<{
-    ok: z.ZodLiteral<true>;
-    allowed: z.ZodBoolean;
-}, z.core.$strict>, z.ZodObject<{
-    ok: z.ZodLiteral<false>;
-    errors: z.ZodArray<z.ZodObject<{
-        index: z.ZodOptional<z.ZodNumber>;
-        kind: z.ZodEnum<{
-            empty_entry: "empty_entry";
-            not_printable_ascii: "not_printable_ascii";
-            missing_scheme: "missing_scheme";
-            unsupported_scheme: "unsupported_scheme";
-            has_path: "has_path";
-            has_userinfo: "has_userinfo";
-            missing_host: "missing_host";
-            invalid_host_char: "invalid_host_char";
-            unbracketed_ipv6: "unbracketed_ipv6";
-            partial_wildcard: "partial_wildcard";
-            non_canonical_ipv4: "non_canonical_ipv4";
-            unclosed_ipv6: "unclosed_ipv6";
-            invalid_ipv6: "invalid_ipv6";
-            invalid_after_ipv6: "invalid_after_ipv6";
-            invalid_port: "invalid_port";
-            default_port: "default_port";
-            no_origins: "no_origins";
-        }>;
-    }, z.core.$strict>>;
-}, z.core.$strict>]>;
-export type TestingOriginCheckOutput = z.infer<typeof TestingOriginCheckOutput>;
-/**
- * Answer one `_testing_origin_check` input: parse `patterns` with
- * `parse_allowed_origins`, then run the request-level check for one `Origin`
- * carrying `origin` (`null` — no `Origin` — passes). The action handler and
- * the conformance table's unit test both call this, so the table checks the
- * same function the wire serves.
- *
- * @param input - the allowlist value and the `Origin` value
- * @returns the answer the Rust twin returns for the same input
- */
-export declare const run_testing_origin_check: (input: TestingOriginCheckInput) => TestingOriginCheckOutput;
-/**
- * `_testing_origin_check` — run the origin allowlist's parse and request
- * check for one `{patterns, origin}` pair, so the shared conformance table
- * (`origin_conformance.json`) checks each backend's grammar and matcher over
- * the wire, row by row. Pure: no database, no state. The Rust mirror is
- * `fuz_testing::create_testing_origin_check_action_spec`.
- *
- * Like `_testing_action_manifest`, it is **not** bundled by
- * `create_testing_actions`: a consumer whose Rust binary doesn't mount the
- * mirror would fail its action-manifest parity gate. The spine test binary
- * appends it at the full-mount layer (`build_full_spine_rpc_actions`).
- *
- * `auth` gates on the daemon-token credential, matching `_testing_reset`.
- */
-export declare const testing_origin_check_action_spec: {
-    readonly method: "_testing_origin_check";
-    readonly kind: "request_response";
-    readonly initiator: "frontend";
-    readonly auth: {
-        readonly account: "required";
-        readonly actor: "none";
-        readonly credential_types: readonly ["daemon_token"];
-    };
-    readonly side_effects: false;
-    readonly input: z.ZodObject<{
-        patterns: z.ZodString;
-        origin: z.ZodNullable<z.ZodString>;
-    }, z.core.$strict>;
-    readonly output: z.ZodUnion<readonly [z.ZodObject<{
-        ok: z.ZodLiteral<true>;
-        allowed: z.ZodBoolean;
-    }, z.core.$strict>, z.ZodObject<{
-        ok: z.ZodLiteral<false>;
-        errors: z.ZodArray<z.ZodObject<{
-            index: z.ZodOptional<z.ZodNumber>;
-            kind: z.ZodEnum<{
-                empty_entry: "empty_entry";
-                not_printable_ascii: "not_printable_ascii";
-                missing_scheme: "missing_scheme";
-                unsupported_scheme: "unsupported_scheme";
-                has_path: "has_path";
-                has_userinfo: "has_userinfo";
-                missing_host: "missing_host";
-                invalid_host_char: "invalid_host_char";
-                unbracketed_ipv6: "unbracketed_ipv6";
-                partial_wildcard: "partial_wildcard";
-                non_canonical_ipv4: "non_canonical_ipv4";
-                unclosed_ipv6: "unclosed_ipv6";
-                invalid_ipv6: "invalid_ipv6";
-                invalid_after_ipv6: "invalid_after_ipv6";
-                invalid_port: "invalid_port";
-                default_port: "default_port";
-                no_origins: "no_origins";
-            }>;
-        }, z.core.$strict>>;
-    }, z.core.$strict>]>;
-    readonly async: true;
-    readonly description: string;
-};
-/** Build the standalone `_testing_origin_check` action (see the spec doc). */
-export declare const create_testing_origin_check_action: () => RpcAction;
 /** The shortest expiry `_testing_shorten_credential_expiry` sets, in seconds from now. */
 export declare const TESTING_SHORTEN_CREDENTIAL_EXPIRY_MIN_SECONDS = 1;
 /**

package/dist/testing/cross_backend/testing_reset_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing_reset_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_reset_actions.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2EG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAOzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAyCzC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoCQ,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;CAWA,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;CAwBC,CAAC;AAE/C;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC,GAAI,OAAO,YAAY,KAAG,SAIvE,CAAC;AAEJ;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;CAeK,CAAC;AAE/C,kFAAkF;AAClF,eAAO,MAAM,iCAAiC,mBAAmB,CAAC;AAElE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,sFAAsF;AACtF,eAAO,MAAM,sBAAsB,QAAmB,CAAC;AAEvD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAAmB,CAAC;AAE9D,8FAA8F;AAC9F,eAAO,MAAM,iCAAiC,kBAAkB,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;CAwBN,CAAC;AAE/C;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC,QAAO,SAmB1D,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWF,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,QAAO,SAGvD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;CAYJ,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,QAAO,SAGzD,CAAC;AAEH,wCAAwC;AACxC,eAAO,MAAM,uBAAuB;;;kBAKlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAQnC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,GACpC,OAAO,uBAAuB,KAC5B,wBAcF,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYC,CAAC;AAE/C,8EAA8E;AAC9E,eAAO,MAAM,kCAAkC,QAAO,SACyC,CAAC;AAEhG,0FAA0F;AAC1F,eAAO,MAAM,6CAA6C,IAAI,CAAC;AAE/D;;;;GAIG;AACH,eAAO,MAAM,6CAA6C,KAAK,CAAC;AAShE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,6CAA6C;;;;;;;;;;;;;;;;;;;;CA2BZ,CAAC;AAE/C,2FAA2F;AAC3F,eAAO,MAAM,+CAA+C,QAAO,SAYhE,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAaF,CAAC;AAkB/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,GACjD,SAAS,aAAa,CAAC,SAAS,CAAC,KAC/B,SAMF,CAAC;AAEF,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,2BAA2B,KAClC,KAAK,CAAC,SAAS,CA6IjB,CAAC"}
+{"version":3,"file":"testing_reset_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_reset_actions.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2EG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAMzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAsBzC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoCQ,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;CAWA,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;CAwBC,CAAC;AAE/C;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC,GAAI,OAAO,YAAY,KAAG,SAIvE,CAAC;AAEJ;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;CAeK,CAAC;AAE/C,kFAAkF;AAClF,eAAO,MAAM,iCAAiC,mBAAmB,CAAC;AAElE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,sFAAsF;AACtF,eAAO,MAAM,sBAAsB,QAAmB,CAAC;AAEvD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAAmB,CAAC;AAE9D,8FAA8F;AAC9F,eAAO,MAAM,iCAAiC,kBAAkB,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;CAwBN,CAAC;AAE/C;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC,QAAO,SAmB1D,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWF,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,QAAO,SAGvD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;CAYJ,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,QAAO,SAGzD,CAAC;AAEH,0FAA0F;AAC1F,eAAO,MAAM,6CAA6C,IAAI,CAAC;AAE/D;;;;GAIG;AACH,eAAO,MAAM,6CAA6C,KAAK,CAAC;AAShE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,6CAA6C;;;;;;;;;;;;;;;;;;;;CA2BZ,CAAC;AAE/C,2FAA2F;AAC3F,eAAO,MAAM,+CAA+C,QAAO,SAYhE,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAaF,CAAC;AAkB/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,GACjD,SAAS,aAAa,CAAC,SAAS,CAAC,KAC/B,SAMF,CAAC;AAEF,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,2BAA2B,KAClC,KAAK,CAAC,SAAS,CA6IjB,CAAC"}

package/dist/testing/cross_backend/testing_reset_actions.js

@@ -15,17 +15,17 @@ import '../assert_dev_env.js';
  * of notifications onto the caller's own WebSocket connection, to push its
  * outbound queue past its byte budget).
  *
- * Three further daemon-token actions live here but are **not** bundled by
+ * Two further daemon-token actions live here but are **not** bundled by
  * `create_testing_actions`, and are appended at the full-mount layer
  * (`build_full_spine_rpc_actions`) instead: **`_testing_action_manifest`**
  * (dump the live RPC registry for cross-impl method-set + auth-shape parity —
  * it must enumerate *every* mounted method, so it goes where the complete list
- * exists), **`_testing_origin_check`** (answer the origin allowlist's parse
- * and request check for the cross-impl origin conformance table), and
- * **`_testing_shorten_credential_expiry`** (pull an account's credential
- * expiries in to seconds from now, shorten-only, for the credential-deadline
- * cases) — the last two kept out of the bundle so a consumer whose Rust binary
- * doesn't mount their mirrors keeps a green manifest gate.
+ * exists) and **`_testing_shorten_credential_expiry`** (pull an account's
+ * credential expiries in to seconds from now, shorten-only, for the
+ * credential-deadline cases) — the latter kept out of the bundle so a consumer
+ * whose Rust binary doesn't mount its mirror keeps a green manifest gate.
+ * `_testing_origin_check`, mounted the same way, lives in the hono-free
+ * `testing_origin_check.ts`.
  *
  * `_testing_reset` — full DB wipe + keeper re-seed + optional
  * secondary-account seeding. The
@@ -89,21 +89,7 @@ import { ActionManifest, build_action_manifest } from './action_manifest.js';
 import { query_create_actor } from '../../auth/account_queries.js';
 import { create_test_account_with_credentials, mint_test_session } from '../app_server.js';
 import { DEFAULT_TEST_PASSWORD } from '../test_credentials.js';
-import { AllowedOriginsErrorKind, parse_allowed_origins, should_allow_origin } from '../../http/origin.js';
-/**
- * Shared `auth` axis for every `_testing_*` action: keeper-only via the
- * daemon-token credential, no acting actor. This is the entire structural
- * fence on the backdoor surface (these actions run direct DB writes the
- * production wire never exposes), so every `_testing_*` spec references this
- * one const rather than re-declaring it — a single source of truth the gate test
- * (`testing_actions_auth.test.ts`) pins. Mirrors the Rust `DAEMON_TOKEN_ONLY`
- * / shared `AuthSpec` in `fuz_testing`.
- */
-const TESTING_ACTION_AUTH = {
-    account: 'required',
-    actor: 'none',
-    credential_types: ['daemon_token']
-};
+import { TESTING_ACTION_AUTH } from './spine_surface_constants.js';
 /** Output shape for an individual seeded account (keeper or extra). */
 const SeededAccountShape = z.strictObject({
     account: z.strictObject({ id: Uuid, username: z.string() }),
@@ -459,76 +445,6 @@ export const testing_migration_tracker_action_spec = {
  * `create_testing_actions`; mount directly for in-process use.
  */
 export const create_testing_migration_tracker_action = () => rpc_action(testing_migration_tracker_action_spec, async (_input, ctx) => query_migration_tracker(ctx.db));
-/** Input of `_testing_origin_check`. */
-export const TestingOriginCheckInput = z.strictObject({
-    /** An allowlist value, as `FUZ_ALLOWED_ORIGINS` would carry it. */
-    patterns: z.string(),
-    /** One `Origin` header's value, or `null` for a request without one. */
-    origin: z.string().nullable()
-});
-/**
- * Output of `_testing_origin_check`: the request-level answer when the list
- * parses, else every refusal — `index` the 1-based entry position, absent for
- * a list-level refusal.
- */
-export const TestingOriginCheckOutput = z.union([
-    z.strictObject({ ok: z.literal(true), allowed: z.boolean() }),
-    z.strictObject({
-        ok: z.literal(false),
-        errors: z.array(z.strictObject({ index: z.number().int().min(1).optional(), kind: AllowedOriginsErrorKind }))
-    })
-]);
-/**
- * Answer one `_testing_origin_check` input: parse `patterns` with
- * `parse_allowed_origins`, then run the request-level check for one `Origin`
- * carrying `origin` (`null` — no `Origin` — passes). The action handler and
- * the conformance table's unit test both call this, so the table checks the
- * same function the wire serves.
- *
- * @param input - the allowlist value and the `Origin` value
- * @returns the answer the Rust twin returns for the same input
- */
-export const run_testing_origin_check = (input) => {
-    const parsed = parse_allowed_origins(input.patterns);
-    if (!parsed.ok) {
-        return {
-            ok: false,
-            errors: parsed.errors.map(({ index, kind }) => index === undefined ? { kind } : { index, kind })
-        };
-    }
-    return {
-        ok: true,
-        allowed: input.origin === null || should_allow_origin(input.origin, parsed.origins)
-    };
-};
-/**
- * `_testing_origin_check` — run the origin allowlist's parse and request
- * check for one `{patterns, origin}` pair, so the shared conformance table
- * (`origin_conformance.json`) checks each backend's grammar and matcher over
- * the wire, row by row. Pure: no database, no state. The Rust mirror is
- * `fuz_testing::create_testing_origin_check_action_spec`.
- *
- * Like `_testing_action_manifest`, it is **not** bundled by
- * `create_testing_actions`: a consumer whose Rust binary doesn't mount the
- * mirror would fail its action-manifest parity gate. The spine test binary
- * appends it at the full-mount layer (`build_full_spine_rpc_actions`).
- *
- * `auth` gates on the daemon-token credential, matching `_testing_reset`.
- */
-export const testing_origin_check_action_spec = {
-    method: '_testing_origin_check',
-    kind: 'request_response',
-    initiator: 'frontend',
-    auth: TESTING_ACTION_AUTH,
-    side_effects: false,
-    input: TestingOriginCheckInput,
-    output: TestingOriginCheckOutput,
-    async: true,
-    description: "Test-binary only — answer the origin allowlist's parse and request check for one " +
-        '{patterns, origin} pair, for the cross-impl origin conformance table.'
-};
-/** Build the standalone `_testing_origin_check` action (see the spec doc). */
-export const create_testing_origin_check_action = () => rpc_action(testing_origin_check_action_spec, async (input) => run_testing_origin_check(input));
 /** The shortest expiry `_testing_shorten_credential_expiry` sets, in seconds from now. */
 export const TESTING_SHORTEN_CREDENTIAL_EXPIRY_MIN_SECONDS = 1;
 /**

package/dist/testing/cross_backend/ws_action_rate_limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ws_action_rate_limit.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ws_action_rate_limit.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAgE9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAyC5C,+DAA+D;AAC/D,MAAM,WAAW,iCAAiC;IACjD,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,gDAAgD;IAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC9B;AAkBD;;;;GAIG;AACH,eAAO,MAAM,yCAAyC,GACrD,SAAS,iCAAiC,KACxC,IAqRF,CAAC"}
+{"version":3,"file":"ws_action_rate_limit.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/ws_action_rate_limit.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAkE9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAgD5C,+DAA+D;AAC/D,MAAM,WAAW,iCAAiC;IACjD,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,gDAAgD;IAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC9B;AAkBD;;;;GAIG;AACH,eAAO,MAAM,yCAAyC,GACrD,SAAS,iCAAiC,KACxC,IAwSF,CAAC"}