@fuzdev/fuz_app 0.142.0 → 0.143.0

package/dist/http/CLAUDE.md

@@ -24,7 +24,7 @@ effects, see ../../../docs/architecture.md.
 - `http/surface_query.ts` — pure filters/groupings over `AppSurface`.
 - `http/proxy.ts` — trusted-proxy middleware, CIDR parsing, rightmost-first XFF resolution. Pulls `hono/utils/ipaddr` for CIDR matching.
 - `http/client_ip.ts` — `get_client_ip(c)` — reads the resolved IP off the context (set by `proxy.ts`'s middleware). Split out of `proxy.ts` so it's hono-free: dispatch + route modules that only _read_ the IP don't pull `hono/utils/ipaddr`, keeping cross-process test surfaces free of the optional `hono` peer.
-- `http/ip_canonical.ts` — RFC 5952 IPv6 canonicalization + IPv4-mapped collapse; `IP_LITERAL_CHARS` regex.
+- `http/ip_canonical.ts` — RFC 5952 IPv6 canonicalization + IPv4-mapped collapse, `rate_limit_ip_key` (an IPv6 client's `/64`), and its own `parse_ipv4_bits` / `parse_ipv6_bits` (the grammar of Rust's `IpAddr::from_str`); `IP_LITERAL_CHARS` regex. Imports nothing — the dispatcher keys its IP limiter through it, so it must stay hono-free (`src/test/hono_free_modules.test.ts` walks every `src/lib` module's graph).
 - `http/origin.ts` — origin allowlist: the strict pattern grammar shared with the Rust spine, typed refusals, and the Origin-only middleware.
 - `http/jsonrpc.ts` — JSON-RPC 2.0 envelope schemas (MCP superset), `JsonrpcErrorCode`, `_meta`.
 - `http/jsonrpc_errors.ts` — `ThrownJsonrpcError`, `jsonrpc_errors` throwers, HTTP-status mappings.

package/dist/http/ip_canonical.d.ts

@@ -18,7 +18,8 @@
  *    strings (`'unknown'`, `'attacker:controlled'`, `'::1\n'`) pass
  *    through unchanged so downstream strict validators can still
  *    reject them.
- * 2. Parses via Hono's `convertIPv*ToBinary` family.
+ * 2. Parses with `parse_ipv4_bits` / `parse_ipv6_bits` — the grammar of
+ *    Rust's `IpAddr::from_str`, which the spine parses with.
  * 3. Re-emits the canonical RFC 5952 string (lowercase hex,
  *    longest-zero-run compressed, IPv4-mapped emitted in the dotted
  *    form mandated by RFC 5952 §5).
@@ -37,8 +38,31 @@
  * the limiter call sites apply it — the client IP stays the full address
  * everywhere else (audit rows, token `last_used_ip`, `REMOTE_ADDR`).
  *
+ * The module imports nothing: the action dispatcher keys its IP limiter
+ * through it, so it must not pull the optional `hono` peer.
+ *
  * @module
  */
+/**
+ * Parse a dotted-quad IPv4 address to its 32-bit value.
+ *
+ * Four decimal octets, each 0–255 with no leading zeros (`01.2.3.4` is
+ * refused, as Rust's `Ipv4Addr::from_str` refuses it).
+ *
+ * @returns the address as an unsigned 32-bit number, or `null` when `ip` isn't one
+ */
+export declare const parse_ipv4_bits: (ip: string) => number | null;
+/**
+ * Parse an IPv6 address to its 128-bit value.
+ *
+ * The grammar of Rust's `Ipv6Addr::from_str`: eight groups of one to four
+ * hex digits (either case), or fewer around a single `::` standing for one or
+ * more zero groups, the last two groups optionally written as a dotted-quad
+ * IPv4 address. No zone (`%eth0`) — callers strip it first.
+ *
+ * @returns the address as a `bigint` in `[0, 2^128)`, or `null` when `ip` isn't one
+ */
+export declare const parse_ipv6_bits: (ip: string) => bigint | null;
 /**
  * Allowed character set for a bare IP literal.
  *
@@ -95,7 +119,7 @@ export declare const canonicalize_ip: (ip: string) => string;
  *
  * Pure helper exported for the test suite to exercise the
  * canonicalization invariants directly without a full
- * `convertIPv6ToBinary` round-trip.
+ * `parse_ipv6_bits` round-trip.
  *
  * @param bits - the 128-bit IPv6 value as `bigint`. Must satisfy `0n <= bits < 2n ** 128n`;
  *   throws `RangeError` otherwise. Silent truncation would mask caller bugs since the

package/dist/http/ip_canonical.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ip_canonical.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/ip_canonical.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAIH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,QAAqB,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,eAAe,GAAI,IAAI,MAAM,KAAG,MAmC5C,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,wBAAwB,GAAI,MAAM,MAAM,KAAG,MAgEvD,CAAC;AAKF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,iBAAiB,GAAI,IAAI,MAAM,KAAG,MAc9C,CAAC"}
+{"version":3,"file":"ip_canonical.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/ip_canonical.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AASH;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,GAAI,IAAI,MAAM,KAAG,MAAM,GAAG,IAKrD,CAAC;AA0BF;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,GAAI,IAAI,MAAM,KAAG,MAAM,GAAG,IAkBrD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,QAAqB,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,eAAe,GAAI,IAAI,MAAM,KAAG,MAsB5C,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,wBAAwB,GAAI,MAAM,MAAM,KAAG,MAgEvD,CAAC;AAKF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,iBAAiB,GAAI,IAAI,MAAM,KAAG,MAQ9C,CAAC"}

package/dist/http/ip_canonical.js

@@ -18,7 +18,8 @@
  *    strings (`'unknown'`, `'attacker:controlled'`, `'::1\n'`) pass
  *    through unchanged so downstream strict validators can still
  *    reject them.
- * 2. Parses via Hono's `convertIPv*ToBinary` family.
+ * 2. Parses with `parse_ipv4_bits` / `parse_ipv6_bits` — the grammar of
+ *    Rust's `IpAddr::from_str`, which the spine parses with.
  * 3. Re-emits the canonical RFC 5952 string (lowercase hex,
  *    longest-zero-run compressed, IPv4-mapped emitted in the dotted
  *    form mandated by RFC 5952 §5).
@@ -37,9 +38,92 @@
  * the limiter call sites apply it — the client IP stays the full address
  * everywhere else (audit rows, token `last_used_ip`, `REMOTE_ADDR`).
  *
+ * The module imports nothing: the action dispatcher keys its IP limiter
+ * through it, so it must not pull the optional `hono` peer.
+ *
  * @module
  */
-import { convertIPv6ToBinary, distinctRemoteAddr } from 'hono/utils/ipaddr';
+/** A dotted-quad IPv4 address: four decimal octets, 0–255, no leading zeros. */
+const IPV4_REGEX = /^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])$/;
+/** One IPv6 group: one to four hex digits. */
+const IPV6_GROUP_REGEX = /^[0-9a-fA-F]{1,4}$/;
+/**
+ * Parse a dotted-quad IPv4 address to its 32-bit value.
+ *
+ * Four decimal octets, each 0–255 with no leading zeros (`01.2.3.4` is
+ * refused, as Rust's `Ipv4Addr::from_str` refuses it).
+ *
+ * @returns the address as an unsigned 32-bit number, or `null` when `ip` isn't one
+ */
+export const parse_ipv4_bits = (ip) => {
+    if (!IPV4_REGEX.test(ip))
+        return null;
+    let bits = 0;
+    for (const octet of ip.split('.'))
+        bits = bits * 256 + Number(octet);
+    return bits;
+};
+/**
+ * Parse the colon-separated groups on one side of a `::` (or the whole
+ * address when there is none), `null` on a malformed one. Only the last group
+ * of the address may be a dotted-quad IPv4 tail, which fills two groups.
+ */
+const parse_ipv6_groups = (part, allow_ipv4_tail) => {
+    if (part === '')
+        return [];
+    const pieces = part.split(':');
+    const groups = [];
+    for (let i = 0; i < pieces.length; i++) {
+        const piece = pieces[i];
+        if (allow_ipv4_tail && i === pieces.length - 1 && piece.includes('.')) {
+            const ipv4 = parse_ipv4_bits(piece);
+            if (ipv4 === null)
+                return null;
+            groups.push(Math.floor(ipv4 / 0x10000), ipv4 % 0x10000);
+        }
+        else if (IPV6_GROUP_REGEX.test(piece)) {
+            groups.push(parseInt(piece, 16));
+        }
+        else {
+            return null;
+        }
+    }
+    return groups;
+};
+/**
+ * Parse an IPv6 address to its 128-bit value.
+ *
+ * The grammar of Rust's `Ipv6Addr::from_str`: eight groups of one to four
+ * hex digits (either case), or fewer around a single `::` standing for one or
+ * more zero groups, the last two groups optionally written as a dotted-quad
+ * IPv4 address. No zone (`%eth0`) — callers strip it first.
+ *
+ * @returns the address as a `bigint` in `[0, 2^128)`, or `null` when `ip` isn't one
+ */
+export const parse_ipv6_bits = (ip) => {
+    const halves = ip.split('::');
+    let groups;
+    if (halves.length === 1) {
+        const all = parse_ipv6_groups(ip, true);
+        if (all === null || all.length !== 8)
+            return null;
+        groups = all;
+    }
+    else if (halves.length === 2) {
+        const head = parse_ipv6_groups(halves[0], false);
+        const tail = parse_ipv6_groups(halves[1], true);
+        if (head === null || tail === null || head.length + tail.length > 7)
+            return null;
+        groups = [...head, ...new Array(8 - head.length - tail.length).fill(0), ...tail];
+    }
+    else {
+        return null;
+    }
+    let bits = 0n;
+    for (const group of groups)
+        bits = (bits << 16n) | BigInt(group);
+    return bits;
+};
 /**
  * Allowed character set for a bare IP literal.
  *
@@ -86,39 +170,27 @@ export const IP_LITERAL_CHARS = /^[0-9a-fA-F.:]+$/;
 export const canonicalize_ip = (ip) => {
     const lowered = ip.toLowerCase();
     // Strict char-set filter — reject brackets, whitespace, control bytes,
-    // letters g-z before invoking the parser. Hono's `convertIPv6ToBinary`
-    // silently accepts `'::1\n'` and similar; canonicalizing those would
-    // erase the malformed form so downstream `validate_ip_strict` could no
-    // longer reject it. Pass-through preserves the original string.
+    // letters g-z, and `%` (so a zone) before invoking the parser, so a
+    // malformed form passes through for downstream `validate_ip_strict` to
+    // reject
     if (!IP_LITERAL_CHARS.test(lowered))
         return lowered;
-    const family = distinctRemoteAddr(lowered);
-    if (family === 'IPv4') {
-        // IPv4's dotted-decimal form is already canonical — no transform
-        // needed. Malformed forms (`999.999.999.999`) still pass through
-        // here; downstream `validate_ip_strict` rejects them via its own
-        // round-trip parse.
+    // IPv4's dotted-decimal form is already canonical — no transform needed.
+    // Malformed forms (`999.999.999.999`) fail both parsers and pass through.
+    if (parse_ipv4_bits(lowered) !== null)
         return lowered;
+    const bits = parse_ipv6_bits(lowered);
+    if (bits === null)
+        return lowered;
+    const canonical = ipv6_bigint_to_canonical(bits);
+    // Strip `::ffff:` only when the canonical form is dotted IPv4-mapped
+    // (`::ffff:X.X.X.X`). Pure IPv6 values that happen to start with
+    // `::ffff:` (e.g. `::ffff:1` → `0:0:0:0:0:0:ffff:1`, where group[5] is 0
+    // not 0xffff) emit without the dot and are preserved.
+    if (canonical.startsWith('::ffff:') && canonical.substring(7).includes('.')) {
+        return canonical.substring(7);
     }
-    if (family === 'IPv6') {
-        try {
-            const bits = convertIPv6ToBinary(lowered);
-            const canonical = ipv6_bigint_to_canonical(bits);
-            // Strip `::ffff:` only when the canonical form is dotted
-            // IPv4-mapped (`::ffff:X.X.X.X`). Pure IPv6 values that happen
-            // to start with `::ffff:` (e.g. `::ffff:1` → `0:0:0:0:0:0:ffff:1`,
-            // where group[5] is 0 not 0xffff) emit without the dot and
-            // are preserved.
-            if (canonical.startsWith('::ffff:') && canonical.substring(7).includes('.')) {
-                return canonical.substring(7);
-            }
-            return canonical;
-        }
-        catch {
-            return lowered;
-        }
-    }
-    return lowered;
+    return canonical;
 };
 /**
  * Convert a 128-bit IPv6 binary value into its RFC 5952 canonical string form.
@@ -132,7 +204,7 @@ export const canonicalize_ip = (ip) => {
  *
  * Pure helper exported for the test suite to exercise the
  * canonicalization invariants directly without a full
- * `convertIPv6ToBinary` round-trip.
+ * `parse_ipv6_bits` round-trip.
  *
  * @param bits - the 128-bit IPv6 value as `bigint`. Must satisfy `0n <= bits < 2n ** 128n`;
  *   throws `RangeError` otherwise. Silent truncation would mask caller bugs since the
@@ -226,17 +298,10 @@ export const rate_limit_ip_key = (ip) => {
     const canonical = canonicalize_ip(zone_at === -1 ? ip : ip.slice(0, zone_at));
     if (!IP_LITERAL_CHARS.test(canonical))
         return ip;
-    const family = distinctRemoteAddr(canonical);
-    if (family === 'IPv4')
+    if (parse_ipv4_bits(canonical) !== null)
         return canonical;
-    if (family !== 'IPv6')
+    const bits = parse_ipv6_bits(canonical);
+    if (bits === null)
         return ip;
-    let bits;
-    try {
-        bits = convertIPv6ToBinary(canonical);
-    }
-    catch {
-        return ip;
-    }
     return `${ipv6_bigint_to_canonical(bits & IPV6_PREFIX_64_MASK)}/64`;
 };

package/dist/testing/CLAUDE.md

@@ -1607,7 +1607,8 @@ are `src/test/auth/cell_crud_parity.db.test.ts`
   payload-expiry tests never reached. Daemon-token-gated like its siblings; the
   Rust mirror is `fuz_testing::create_testing_mint_session_action_spec`.
 
-  Also in the module and **not** bundled: `_testing_origin_check`
+  In the hono-free sibling `testing/cross_backend/testing_origin_check.ts`,
+  **not** bundled: `_testing_origin_check`
   (`create_testing_origin_check_action()`, `run_testing_origin_check(input)`,
   `TestingOriginCheckInput` / `TestingOriginCheckOutput`) — answers the origin
   allowlist's parse and request check for one `{patterns, origin}` pair:
@@ -1617,7 +1618,8 @@ are `src/test/auth/cell_crud_parity.db.test.ts`
   keeps an exact action-manifest gate; the spine binary appends it in
   `build_full_spine_rpc_actions`.
 
-  Also **not** bundled: `_testing_shorten_credential_expiry`
+  Back in `testing_reset_actions.ts`, also **not** bundled:
+  `_testing_shorten_credential_expiry`
   (`create_testing_shorten_credential_expiry_action()`) — pulls an account's
   `auth_session` and `api_token` expiries in to `seconds` (1–60) from now,
   shorten-only (`LEAST`, an eternal token gaining one), answering
@@ -1628,8 +1630,8 @@ are `src/test/auth/cell_crud_parity.db.test.ts`
   `_testing_origin_check`. The Rust mirror is
   `fuz_testing::create_testing_shorten_credential_expiry_action_spec`.
 
-  Also in the module — but **not** bundled by `create_testing_actions` —
-  `_testing_action_manifest` (+ `create_testing_action_manifest_action(mounted)`):
+  Also in `testing_reset_actions.ts` — but **not** bundled by
+  `create_testing_actions` — `_testing_action_manifest` (+ `create_testing_action_manifest_action(mounted)`):
   dumps the live RPC registry as a normalized `ActionManifest` for the
   cross-impl manifest-parity gate (see §Cross-impl RPC-manifest parity). It must
   enumerate _every_ mounted method, which `create_testing_actions` (one

package/dist/testing/cross_backend/full_spine_mount.js

@@ -5,7 +5,8 @@ import { create_standard_rpc_actions } from '../../auth/standard_rpc_actions.js'
 import { create_all_cell_actions } from '../../auth/all_cell_actions.js';
 import { create_actor_lookup_actions } from '../../auth/actor_lookup_actions.js';
 import { create_actor_search_actions } from '../../auth/actor_search_actions.js';
-import { create_testing_action_manifest_action, create_testing_actions, create_testing_origin_check_action, create_testing_shorten_credential_expiry_action } from './testing_reset_actions.js';
+import { create_testing_action_manifest_action, create_testing_actions, create_testing_shorten_credential_expiry_action } from './testing_reset_actions.js';
+import { create_testing_origin_check_action } from './testing_origin_check.js';
 import { test_cell_gated_create_authorize } from './test_cell_gated_create_authorize.js';
 import { spine_roles, spine_session_options } from './default_spine_surface.js';
 /**

package/dist/testing/cross_backend/origin_conformance.d.ts

@@ -1,7 +1,7 @@
 import '../assert_dev_env.js';
 import { z } from 'zod';
 import type { RpcPathCrossSuiteOptions } from './setup.js';
-import { TestingOriginCheckOutput, type TestingOriginCheckInput } from './testing_reset_actions.js';
+import { TestingOriginCheckOutput, type TestingOriginCheckInput } from './testing_origin_check.js';
 /** One expected refusal of a parse row. */
 export declare const OriginConformanceError: z.ZodObject<{
     index: z.ZodOptional<z.ZodNumber>;

package/dist/testing/cross_backend/origin_conformance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"origin_conformance.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/origin_conformance.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA0B9B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE3D,OAAO,EACN,wBAAwB,EAExB,KAAK,uBAAuB,EAC5B,MAAM,4BAA4B,CAAC;AAEpC,2CAA2C;AAC3C,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;kBAGjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,+EAA+E;AAC/E,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAOpC,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAElF,oFAAoF;AACpF,eAAO,MAAM,yBAAyB;;;;;kBAKpC,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAElF,6BAA6B;AAC7B,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAG5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,6DAA6D;AAC7D,eAAO,MAAM,sBAAsB,EAAE,GAA2D,CAAC;AAEjG;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,QAAO,iBACuC,CAAC;AAEnF,wDAAwD;AACxD,MAAM,WAAW,sBAAsB;IACtC,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,wBAAwB,CAAC;CAC5C;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,GACxC,OAAO,iBAAiB,KACtB,KAAK,CAAC,sBAAsB,CAc9B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,GACrC,QAAQ,aAAa,CAAC,sBAAsB,CAAC,EAC7C,QAAQ,aAAa,CAAC,OAAO,CAAC,EAC9B,SAAS,MAAM,KACb,IAiBF,CAAC;AAEF,6DAA6D;AAC7D,MAAM,MAAM,iCAAiC,GAAG,wBAAwB,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,uCAAuC,GACnD,SAAS,iCAAiC,KACxC,IA4BF,CAAC"}
+{"version":3,"file":"origin_conformance.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/origin_conformance.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA0B9B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE3D,OAAO,EACN,wBAAwB,EAExB,KAAK,uBAAuB,EAC5B,MAAM,2BAA2B,CAAC;AAEnC,2CAA2C;AAC3C,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;kBAGjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,+EAA+E;AAC/E,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAOpC,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAElF,oFAAoF;AACpF,eAAO,MAAM,yBAAyB;;;;;kBAKpC,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAElF,6BAA6B;AAC7B,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAG5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,6DAA6D;AAC7D,eAAO,MAAM,sBAAsB,EAAE,GAA2D,CAAC;AAEjG;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,QAAO,iBACuC,CAAC;AAEnF,wDAAwD;AACxD,MAAM,WAAW,sBAAsB;IACtC,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,wBAAwB,CAAC;CAC5C;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,GACxC,OAAO,iBAAiB,KACtB,KAAK,CAAC,sBAAsB,CAc9B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,GACrC,QAAQ,aAAa,CAAC,sBAAsB,CAAC,EAC7C,QAAQ,aAAa,CAAC,OAAO,CAAC,EAC9B,SAAS,MAAM,KACb,IAiBF,CAAC;AAEF,6DAA6D;AAC7D,MAAM,MAAM,iCAAiC,GAAG,wBAAwB,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,uCAAuC,GACnD,SAAS,iCAAiC,KACxC,IA4BF,CAAC"}

package/dist/testing/cross_backend/origin_conformance.js

@@ -26,7 +26,7 @@ import { z } from 'zod';
 import { AllowedOriginsErrorKind } from '../../http/origin.js';
 import { cross_rpc_call } from './cell_cross_helpers.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
-import { TestingOriginCheckOutput, testing_origin_check_action_spec } from './testing_reset_actions.js';
+import { TestingOriginCheckOutput, testing_origin_check_action_spec } from './testing_origin_check.js';
 /** One expected refusal of a parse row. */
 export const OriginConformanceError = z.strictObject({
     index: z.number().int().min(1).optional(),

package/dist/testing/cross_backend/spine_surface_constants.d.ts

@@ -1,26 +1,18 @@
 import '../assert_dev_env.js';
 /**
- * Pure spine-surface constants — wire paths, roles, the fixture URL, and the
- * env-var names the backend configs set for the spawned spine binaries. A
- * hono-free leaf split out of `default_spine_surface.ts`.
- *
- * Cross-process suite modules (which drive a separately-spawned backend binary
- * over HTTP) need only the wire path / role / fixture-URL, not the in-process
- * route handlers. Importing them from `default_spine_surface.ts` used to drag
- * its eager `account_routes.ts` / `signup_routes.ts` imports — and through them
- * `session_middleware` → `hono/cookie` — onto a backend-spawning consumer with
- * no `hono` peer installed (a Rust-only spine consumer). Keeping these constants
- * on this handler-free leaf lets such a consumer import the path without the
- * peer. `default_spine_surface.ts` imports the ones it uses from here.
- *
- * The env-var names live here so both sides of each contract share one
- * constant: the backend configs that set them (`default_backend_configs.ts`,
- * `ts_spine_backend_config.ts`, `rust_spine_stub_backend_config.ts`) and the
- * spawned TS spine binary that reads them, which imports this leaf rather than
- * the config builders.
- *
- * @module
+ * Shared `auth` axis for every `_testing_*` action: keeper-only via the
+ * daemon-token credential, no acting actor. This is the entire structural
+ * fence on the backdoor surface (these actions run direct DB writes the
+ * production wire never exposes), so every `_testing_*` spec references this
+ * one const rather than re-declaring it — a single source of truth the gate test
+ * (`testing_actions_auth.test.ts`) pins. Mirrors the Rust `DAEMON_TOKEN_ONLY`
+ * / shared `AuthSpec` in `fuz_testing`.
  */
+export declare const TESTING_ACTION_AUTH: {
+    readonly account: "required";
+    readonly actor: "none";
+    readonly credential_types: readonly ["daemon_token"];
+};
 /** RPC endpoint mount path — matches the binary's `/api/rpc`. */
 export declare const SPINE_RPC_PATH = "/api/rpc";
 /**

package/dist/testing/cross_backend/spine_surface_constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spine_surface_constants.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/spine_surface_constants.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,iEAAiE;AACjE,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,4BAA4B,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,kBAAkB,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,EAAE,aAAa,CAAC,MAAM,CAG1D,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,EAAE,GAAwD,CAAC;AAEjG;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAE3E;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B,kCAAkC,CAAC;AAE7E;;;;;;GAMG;AACH,eAAO,MAAM,kCAAkC,uCAAuC,CAAC;AAEvF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,6BAA6B,CAAC"}
+{"version":3,"file":"spine_surface_constants.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/spine_surface_constants.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA4B9B;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB;;;;CAIF,CAAC;AAE/B,iEAAiE;AACjE,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,4BAA4B,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,kBAAkB,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,EAAE,aAAa,CAAC,MAAM,CAG1D,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,EAAE,GAAwD,CAAC;AAEjG;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAE3E;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B,kCAAkC,CAAC;AAE7E;;;;;;GAMG;AACH,eAAO,MAAM,kCAAkC,uCAAuC,CAAC;AAEvF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,6BAA6B,CAAC"}

package/dist/testing/cross_backend/spine_surface_constants.js

@@ -1,26 +1,18 @@
 import '../assert_dev_env.js';
 /**
- * Pure spine-surface constants — wire paths, roles, the fixture URL, and the
- * env-var names the backend configs set for the spawned spine binaries. A
- * hono-free leaf split out of `default_spine_surface.ts`.
- *
- * Cross-process suite modules (which drive a separately-spawned backend binary
- * over HTTP) need only the wire path / role / fixture-URL, not the in-process
- * route handlers. Importing them from `default_spine_surface.ts` used to drag
- * its eager `account_routes.ts` / `signup_routes.ts` imports — and through them
- * `session_middleware` → `hono/cookie` — onto a backend-spawning consumer with
- * no `hono` peer installed (a Rust-only spine consumer). Keeping these constants
- * on this handler-free leaf lets such a consumer import the path without the
- * peer. `default_spine_surface.ts` imports the ones it uses from here.
- *
- * The env-var names live here so both sides of each contract share one
- * constant: the backend configs that set them (`default_backend_configs.ts`,
- * `ts_spine_backend_config.ts`, `rust_spine_stub_backend_config.ts`) and the
- * spawned TS spine binary that reads them, which imports this leaf rather than
- * the config builders.
- *
- * @module
+ * Shared `auth` axis for every `_testing_*` action: keeper-only via the
+ * daemon-token credential, no acting actor. This is the entire structural
+ * fence on the backdoor surface (these actions run direct DB writes the
+ * production wire never exposes), so every `_testing_*` spec references this
+ * one const rather than re-declaring it — a single source of truth the gate test
+ * (`testing_actions_auth.test.ts`) pins. Mirrors the Rust `DAEMON_TOKEN_ONLY`
+ * / shared `AuthSpec` in `fuz_testing`.
  */
+export const TESTING_ACTION_AUTH = {
+    account: 'required',
+    actor: 'none',
+    credential_types: ['daemon_token']
+};
 /** RPC endpoint mount path — matches the binary's `/api/rpc`. */
 export const SPINE_RPC_PATH = '/api/rpc';
 /**

package/dist/testing/cross_backend/testing_origin_check.d.ts

@@ -0,0 +1,128 @@
+import '../assert_dev_env.js';
+/**
+ * `_testing_origin_check` — the testing seam behind the cross-impl origin
+ * conformance table (`origin_conformance.json`): its input and output schemas,
+ * the pure check it answers with, its spec, and the action builder.
+ *
+ * Split from `testing_reset_actions.ts`, whose other seams reach the
+ * in-process app server and through it the optional `hono` peer. This leaf is
+ * hono-free, so a consumer whose backend is a spawned Rust binary can run the
+ * conformance table without installing `hono`.
+ *
+ * @module
+ */
+import { z } from 'zod';
+import { type RpcAction } from '../../actions/action_rpc.js';
+/** Input of `_testing_origin_check`. */
+export declare const TestingOriginCheckInput: z.ZodObject<{
+    patterns: z.ZodString;
+    origin: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type TestingOriginCheckInput = z.infer<typeof TestingOriginCheckInput>;
+/**
+ * Output of `_testing_origin_check`: the request-level answer when the list
+ * parses, else every refusal — `index` the 1-based entry position, absent for
+ * a list-level refusal.
+ */
+export declare const TestingOriginCheckOutput: z.ZodUnion<readonly [z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    allowed: z.ZodBoolean;
+}, z.core.$strict>, z.ZodObject<{
+    ok: z.ZodLiteral<false>;
+    errors: z.ZodArray<z.ZodObject<{
+        index: z.ZodOptional<z.ZodNumber>;
+        kind: z.ZodEnum<{
+            empty_entry: "empty_entry";
+            not_printable_ascii: "not_printable_ascii";
+            missing_scheme: "missing_scheme";
+            unsupported_scheme: "unsupported_scheme";
+            has_path: "has_path";
+            has_userinfo: "has_userinfo";
+            missing_host: "missing_host";
+            invalid_host_char: "invalid_host_char";
+            unbracketed_ipv6: "unbracketed_ipv6";
+            partial_wildcard: "partial_wildcard";
+            non_canonical_ipv4: "non_canonical_ipv4";
+            unclosed_ipv6: "unclosed_ipv6";
+            invalid_ipv6: "invalid_ipv6";
+            invalid_after_ipv6: "invalid_after_ipv6";
+            invalid_port: "invalid_port";
+            default_port: "default_port";
+            no_origins: "no_origins";
+        }>;
+    }, z.core.$strict>>;
+}, z.core.$strict>]>;
+export type TestingOriginCheckOutput = z.infer<typeof TestingOriginCheckOutput>;
+/**
+ * Answer one `_testing_origin_check` input: parse `patterns` with
+ * `parse_allowed_origins`, then run the request-level check for one `Origin`
+ * carrying `origin` (`null` — no `Origin` — passes). The action handler and
+ * the conformance table's unit test both call this, so the table checks the
+ * same function the wire serves.
+ *
+ * @param input - the allowlist value and the `Origin` value
+ * @returns the answer the Rust twin returns for the same input
+ */
+export declare const run_testing_origin_check: (input: TestingOriginCheckInput) => TestingOriginCheckOutput;
+/**
+ * `_testing_origin_check` — run the origin allowlist's parse and request
+ * check for one `{patterns, origin}` pair, so the shared conformance table
+ * (`origin_conformance.json`) checks each backend's grammar and matcher over
+ * the wire, row by row. Pure: no database, no state. The Rust mirror is
+ * `fuz_testing::create_testing_origin_check_action_spec`.
+ *
+ * Like `_testing_action_manifest`, it is **not** bundled by
+ * `create_testing_actions`: a consumer whose Rust binary doesn't mount the
+ * mirror would fail its action-manifest parity gate. The spine test binary
+ * appends it at the full-mount layer (`build_full_spine_rpc_actions`).
+ *
+ * `auth` gates on the daemon-token credential, matching `_testing_reset`.
+ */
+export declare const testing_origin_check_action_spec: {
+    readonly method: "_testing_origin_check";
+    readonly kind: "request_response";
+    readonly initiator: "frontend";
+    readonly auth: {
+        readonly account: "required";
+        readonly actor: "none";
+        readonly credential_types: readonly ["daemon_token"];
+    };
+    readonly side_effects: false;
+    readonly input: z.ZodObject<{
+        patterns: z.ZodString;
+        origin: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>;
+    readonly output: z.ZodUnion<readonly [z.ZodObject<{
+        ok: z.ZodLiteral<true>;
+        allowed: z.ZodBoolean;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        errors: z.ZodArray<z.ZodObject<{
+            index: z.ZodOptional<z.ZodNumber>;
+            kind: z.ZodEnum<{
+                empty_entry: "empty_entry";
+                not_printable_ascii: "not_printable_ascii";
+                missing_scheme: "missing_scheme";
+                unsupported_scheme: "unsupported_scheme";
+                has_path: "has_path";
+                has_userinfo: "has_userinfo";
+                missing_host: "missing_host";
+                invalid_host_char: "invalid_host_char";
+                unbracketed_ipv6: "unbracketed_ipv6";
+                partial_wildcard: "partial_wildcard";
+                non_canonical_ipv4: "non_canonical_ipv4";
+                unclosed_ipv6: "unclosed_ipv6";
+                invalid_ipv6: "invalid_ipv6";
+                invalid_after_ipv6: "invalid_after_ipv6";
+                invalid_port: "invalid_port";
+                default_port: "default_port";
+                no_origins: "no_origins";
+            }>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>]>;
+    readonly async: true;
+    readonly description: string;
+};
+/** Build the standalone `_testing_origin_check` action (see the spec doc). */
+export declare const create_testing_origin_check_action: () => RpcAction;
+//# sourceMappingURL=testing_origin_check.d.ts.map

package/dist/testing/cross_backend/testing_origin_check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing_origin_check.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_origin_check.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AASzE,wCAAwC;AACxC,eAAO,MAAM,uBAAuB;;;kBAKlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAQnC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,GACpC,OAAO,uBAAuB,KAC5B,wBAcF,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYC,CAAC;AAE/C,8EAA8E;AAC9E,eAAO,MAAM,kCAAkC,QAAO,SACyC,CAAC"}

package/dist/testing/cross_backend/testing_origin_check.js

@@ -0,0 +1,87 @@
+import '../assert_dev_env.js';
+/**
+ * `_testing_origin_check` — the testing seam behind the cross-impl origin
+ * conformance table (`origin_conformance.json`): its input and output schemas,
+ * the pure check it answers with, its spec, and the action builder.
+ *
+ * Split from `testing_reset_actions.ts`, whose other seams reach the
+ * in-process app server and through it the optional `hono` peer. This leaf is
+ * hono-free, so a consumer whose backend is a spawned Rust binary can run the
+ * conformance table without installing `hono`.
+ *
+ * @module
+ */
+import { z } from 'zod';
+import { rpc_action } from '../../actions/action_rpc.js';
+import { AllowedOriginsErrorKind, parse_allowed_origins, should_allow_origin } from '../../http/origin.js';
+import { TESTING_ACTION_AUTH } from './spine_surface_constants.js';
+/** Input of `_testing_origin_check`. */
+export const TestingOriginCheckInput = z.strictObject({
+    /** An allowlist value, as `FUZ_ALLOWED_ORIGINS` would carry it. */
+    patterns: z.string(),
+    /** One `Origin` header's value, or `null` for a request without one. */
+    origin: z.string().nullable()
+});
+/**
+ * Output of `_testing_origin_check`: the request-level answer when the list
+ * parses, else every refusal — `index` the 1-based entry position, absent for
+ * a list-level refusal.
+ */
+export const TestingOriginCheckOutput = z.union([
+    z.strictObject({ ok: z.literal(true), allowed: z.boolean() }),
+    z.strictObject({
+        ok: z.literal(false),
+        errors: z.array(z.strictObject({ index: z.number().int().min(1).optional(), kind: AllowedOriginsErrorKind }))
+    })
+]);
+/**
+ * Answer one `_testing_origin_check` input: parse `patterns` with
+ * `parse_allowed_origins`, then run the request-level check for one `Origin`
+ * carrying `origin` (`null` — no `Origin` — passes). The action handler and
+ * the conformance table's unit test both call this, so the table checks the
+ * same function the wire serves.
+ *
+ * @param input - the allowlist value and the `Origin` value
+ * @returns the answer the Rust twin returns for the same input
+ */
+export const run_testing_origin_check = (input) => {
+    const parsed = parse_allowed_origins(input.patterns);
+    if (!parsed.ok) {
+        return {
+            ok: false,
+            errors: parsed.errors.map(({ index, kind }) => index === undefined ? { kind } : { index, kind })
+        };
+    }
+    return {
+        ok: true,
+        allowed: input.origin === null || should_allow_origin(input.origin, parsed.origins)
+    };
+};
+/**
+ * `_testing_origin_check` — run the origin allowlist's parse and request
+ * check for one `{patterns, origin}` pair, so the shared conformance table
+ * (`origin_conformance.json`) checks each backend's grammar and matcher over
+ * the wire, row by row. Pure: no database, no state. The Rust mirror is
+ * `fuz_testing::create_testing_origin_check_action_spec`.
+ *
+ * Like `_testing_action_manifest`, it is **not** bundled by
+ * `create_testing_actions`: a consumer whose Rust binary doesn't mount the
+ * mirror would fail its action-manifest parity gate. The spine test binary
+ * appends it at the full-mount layer (`build_full_spine_rpc_actions`).
+ *
+ * `auth` gates on the daemon-token credential, matching `_testing_reset`.
+ */
+export const testing_origin_check_action_spec = {
+    method: '_testing_origin_check',
+    kind: 'request_response',
+    initiator: 'frontend',
+    auth: TESTING_ACTION_AUTH,
+    side_effects: false,
+    input: TestingOriginCheckInput,
+    output: TestingOriginCheckOutput,
+    async: true,
+    description: "Test-binary only — answer the origin allowlist's parse and request check for one " +
+        '{patterns, origin} pair, for the cross-impl origin conformance table.'
+};
+/** Build the standalone `_testing_origin_check` action (see the spec doc). */
+export const create_testing_origin_check_action = () => rpc_action(testing_origin_check_action_spec, async (input) => run_testing_origin_check(input));

package/dist/testing/cross_backend/testing_reset_actions.d.ts

@@ -15,17 +15,17 @@ import '../assert_dev_env.js';
  * of notifications onto the caller's own WebSocket connection, to push its
  * outbound queue past its byte budget).
  *
- * Three further daemon-token actions live here but are **not** bundled by
+ * Two further daemon-token actions live here but are **not** bundled by
  * `create_testing_actions`, and are appended at the full-mount layer
  * (`build_full_spine_rpc_actions`) instead: **`_testing_action_manifest`**
  * (dump the live RPC registry for cross-impl method-set + auth-shape parity —
  * it must enumerate *every* mounted method, so it goes where the complete list
- * exists), **`_testing_origin_check`** (answer the origin allowlist's parse
- * and request check for the cross-impl origin conformance table), and
- * **`_testing_shorten_credential_expiry`** (pull an account's credential
- * expiries in to seconds from now, shorten-only, for the credential-deadline
- * cases) — the last two kept out of the bundle so a consumer whose Rust binary
- * doesn't mount their mirrors keeps a green manifest gate.
+ * exists) and **`_testing_shorten_credential_expiry`** (pull an account's
+ * credential expiries in to seconds from now, shorten-only, for the
+ * credential-deadline cases) — the latter kept out of the bundle so a consumer
+ * whose Rust binary doesn't mount its mirror keeps a green manifest gate.
+ * `_testing_origin_check`, mounted the same way, lives in the hono-free
+ * `testing_origin_check.ts`.
  *
  * `_testing_reset` — full DB wipe + keeper re-seed + optional
  * secondary-account seeding. The
@@ -472,118 +472,6 @@ export declare const testing_migration_tracker_action_spec: {
  * `create_testing_actions`; mount directly for in-process use.
  */
 export declare const create_testing_migration_tracker_action: () => RpcAction;
-/** Input of `_testing_origin_check`. */
-export declare const TestingOriginCheckInput: z.ZodObject<{
-    patterns: z.ZodString;
-    origin: z.ZodNullable<z.ZodString>;
-}, z.core.$strict>;
-export type TestingOriginCheckInput = z.infer<typeof TestingOriginCheckInput>;
-/**
- * Output of `_testing_origin_check`: the request-level answer when the list
- * parses, else every refusal — `index` the 1-based entry position, absent for
- * a list-level refusal.
- */
-export declare const TestingOriginCheckOutput: z.ZodUnion<readonly [z.ZodObject<{
-    ok: z.ZodLiteral<true>;
-    allowed: z.ZodBoolean;
-}, z.core.$strict>, z.ZodObject<{
-    ok: z.ZodLiteral<false>;
-    errors: z.ZodArray<z.ZodObject<{
-        index: z.ZodOptional<z.ZodNumber>;
-        kind: z.ZodEnum<{
-            empty_entry: "empty_entry";
-            not_printable_ascii: "not_printable_ascii";
-            missing_scheme: "missing_scheme";
-            unsupported_scheme: "unsupported_scheme";
-            has_path: "has_path";
-            has_userinfo: "has_userinfo";
-            missing_host: "missing_host";
-            invalid_host_char: "invalid_host_char";
-            unbracketed_ipv6: "unbracketed_ipv6";
-            partial_wildcard: "partial_wildcard";
-            non_canonical_ipv4: "non_canonical_ipv4";
-            unclosed_ipv6: "unclosed_ipv6";
-            invalid_ipv6: "invalid_ipv6";
-            invalid_after_ipv6: "invalid_after_ipv6";
-            invalid_port: "invalid_port";
-            default_port: "default_port";
-            no_origins: "no_origins";
-        }>;
-    }, z.core.$strict>>;
-}, z.core.$strict>]>;
-export type TestingOriginCheckOutput = z.infer<typeof TestingOriginCheckOutput>;
-/**
- * Answer one `_testing_origin_check` input: parse `patterns` with
- * `parse_allowed_origins`, then run the request-level check for one `Origin`
- * carrying `origin` (`null` — no `Origin` — passes). The action handler and
- * the conformance table's unit test both call this, so the table checks the
- * same function the wire serves.
- *
- * @param input - the allowlist value and the `Origin` value
- * @returns the answer the Rust twin returns for the same input
- */
-export declare const run_testing_origin_check: (input: TestingOriginCheckInput) => TestingOriginCheckOutput;
-/**
- * `_testing_origin_check` — run the origin allowlist's parse and request
- * check for one `{patterns, origin}` pair, so the shared conformance table
- * (`origin_conformance.json`) checks each backend's grammar and matcher over
- * the wire, row by row. Pure: no database, no state. The Rust mirror is
- * `fuz_testing::create_testing_origin_check_action_spec`.
- *
- * Like `_testing_action_manifest`, it is **not** bundled by
- * `create_testing_actions`: a consumer whose Rust binary doesn't mount the
- * mirror would fail its action-manifest parity gate. The spine test binary
- * appends it at the full-mount layer (`build_full_spine_rpc_actions`).
- *
- * `auth` gates on the daemon-token credential, matching `_testing_reset`.
- */
-export declare const testing_origin_check_action_spec: {
-    readonly method: "_testing_origin_check";
-    readonly kind: "request_response";
-    readonly initiator: "frontend";
-    readonly auth: {
-        readonly account: "required";
-        readonly actor: "none";
-        readonly credential_types: readonly ["daemon_token"];
-    };
-    readonly side_effects: false;
-    readonly input: z.ZodObject<{
-        patterns: z.ZodString;
-        origin: z.ZodNullable<z.ZodString>;
-    }, z.core.$strict>;
-    readonly output: z.ZodUnion<readonly [z.ZodObject<{
-        ok: z.ZodLiteral<true>;
-        allowed: z.ZodBoolean;
-    }, z.core.$strict>, z.ZodObject<{
-        ok: z.ZodLiteral<false>;
-        errors: z.ZodArray<z.ZodObject<{
-            index: z.ZodOptional<z.ZodNumber>;
-            kind: z.ZodEnum<{
-                empty_entry: "empty_entry";
-                not_printable_ascii: "not_printable_ascii";
-                missing_scheme: "missing_scheme";
-                unsupported_scheme: "unsupported_scheme";
-                has_path: "has_path";
-                has_userinfo: "has_userinfo";
-                missing_host: "missing_host";
-                invalid_host_char: "invalid_host_char";
-                unbracketed_ipv6: "unbracketed_ipv6";
-                partial_wildcard: "partial_wildcard";
-                non_canonical_ipv4: "non_canonical_ipv4";
-                unclosed_ipv6: "unclosed_ipv6";
-                invalid_ipv6: "invalid_ipv6";
-                invalid_after_ipv6: "invalid_after_ipv6";
-                invalid_port: "invalid_port";
-                default_port: "default_port";
-                no_origins: "no_origins";
-            }>;
-        }, z.core.$strict>>;
-    }, z.core.$strict>]>;
-    readonly async: true;
-    readonly description: string;
-};
-/** Build the standalone `_testing_origin_check` action (see the spec doc). */
-export declare const create_testing_origin_check_action: () => RpcAction;
 /** The shortest expiry `_testing_shorten_credential_expiry` sets, in seconds from now. */
 export declare const TESTING_SHORTEN_CREDENTIAL_EXPIRY_MIN_SECONDS = 1;
 /**

package/dist/testing/cross_backend/testing_reset_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing_reset_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_reset_actions.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2EG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAOzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAyCzC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoCQ,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;CAWA,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;CAwBC,CAAC;AAE/C;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC,GAAI,OAAO,YAAY,KAAG,SAIvE,CAAC;AAEJ;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;CAeK,CAAC;AAE/C,kFAAkF;AAClF,eAAO,MAAM,iCAAiC,mBAAmB,CAAC;AAElE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,sFAAsF;AACtF,eAAO,MAAM,sBAAsB,QAAmB,CAAC;AAEvD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAAmB,CAAC;AAE9D,8FAA8F;AAC9F,eAAO,MAAM,iCAAiC,kBAAkB,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;CAwBN,CAAC;AAE/C;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC,QAAO,SAmB1D,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWF,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,QAAO,SAGvD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;CAYJ,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,QAAO,SAGzD,CAAC;AAEH,wCAAwC;AACxC,eAAO,MAAM,uBAAuB;;;kBAKlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAQnC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,GACpC,OAAO,uBAAuB,KAC5B,wBAcF,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYC,CAAC;AAE/C,8EAA8E;AAC9E,eAAO,MAAM,kCAAkC,QAAO,SACyC,CAAC;AAEhG,0FAA0F;AAC1F,eAAO,MAAM,6CAA6C,IAAI,CAAC;AAE/D;;;;GAIG;AACH,eAAO,MAAM,6CAA6C,KAAK,CAAC;AAShE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,6CAA6C;;;;;;;;;;;;;;;;;;;;CA2BZ,CAAC;AAE/C,2FAA2F;AAC3F,eAAO,MAAM,+CAA+C,QAAO,SAYhE,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAaF,CAAC;AAkB/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,GACjD,SAAS,aAAa,CAAC,SAAS,CAAC,KAC/B,SAMF,CAAC;AAEF,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,2BAA2B,KAClC,KAAK,CAAC,SAAS,CA6IjB,CAAC"}
+{"version":3,"file":"testing_reset_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_reset_actions.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2EG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAMzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAsBzC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoCQ,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;CAWA,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;CAwBC,CAAC;AAE/C;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC,GAAI,OAAO,YAAY,KAAG,SAIvE,CAAC;AAEJ;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;CAeK,CAAC;AAE/C,kFAAkF;AAClF,eAAO,MAAM,iCAAiC,mBAAmB,CAAC;AAElE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,sFAAsF;AACtF,eAAO,MAAM,sBAAsB,QAAmB,CAAC;AAEvD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAAmB,CAAC;AAE9D,8FAA8F;AAC9F,eAAO,MAAM,iCAAiC,kBAAkB,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;CAwBN,CAAC;AAE/C;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC,QAAO,SAmB1D,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWF,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,QAAO,SAGvD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;CAYJ,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,QAAO,SAGzD,CAAC;AAEH,0FAA0F;AAC1F,eAAO,MAAM,6CAA6C,IAAI,CAAC;AAE/D;;;;GAIG;AACH,eAAO,MAAM,6CAA6C,KAAK,CAAC;AAShE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,6CAA6C;;;;;;;;;;;;;;;;;;;;CA2BZ,CAAC;AAE/C,2FAA2F;AAC3F,eAAO,MAAM,+CAA+C,QAAO,SAYhE,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAaF,CAAC;AAkB/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,GACjD,SAAS,aAAa,CAAC,SAAS,CAAC,KAC/B,SAMF,CAAC;AAEF,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,2BAA2B,KAClC,KAAK,CAAC,SAAS,CA6IjB,CAAC"}

package/dist/testing/cross_backend/testing_reset_actions.js

@@ -15,17 +15,17 @@ import '../assert_dev_env.js';
  * of notifications onto the caller's own WebSocket connection, to push its
  * outbound queue past its byte budget).
  *
- * Three further daemon-token actions live here but are **not** bundled by
+ * Two further daemon-token actions live here but are **not** bundled by
  * `create_testing_actions`, and are appended at the full-mount layer
  * (`build_full_spine_rpc_actions`) instead: **`_testing_action_manifest`**
  * (dump the live RPC registry for cross-impl method-set + auth-shape parity —
  * it must enumerate *every* mounted method, so it goes where the complete list
- * exists), **`_testing_origin_check`** (answer the origin allowlist's parse
- * and request check for the cross-impl origin conformance table), and
- * **`_testing_shorten_credential_expiry`** (pull an account's credential
- * expiries in to seconds from now, shorten-only, for the credential-deadline
- * cases) — the last two kept out of the bundle so a consumer whose Rust binary
- * doesn't mount their mirrors keeps a green manifest gate.
+ * exists) and **`_testing_shorten_credential_expiry`** (pull an account's
+ * credential expiries in to seconds from now, shorten-only, for the
+ * credential-deadline cases) — the latter kept out of the bundle so a consumer
+ * whose Rust binary doesn't mount its mirror keeps a green manifest gate.
+ * `_testing_origin_check`, mounted the same way, lives in the hono-free
+ * `testing_origin_check.ts`.
  *
  * `_testing_reset` — full DB wipe + keeper re-seed + optional
  * secondary-account seeding. The
@@ -89,21 +89,7 @@ import { ActionManifest, build_action_manifest } from './action_manifest.js';
 import { query_create_actor } from '../../auth/account_queries.js';
 import { create_test_account_with_credentials, mint_test_session } from '../app_server.js';
 import { DEFAULT_TEST_PASSWORD } from '../test_credentials.js';
-import { AllowedOriginsErrorKind, parse_allowed_origins, should_allow_origin } from '../../http/origin.js';
-/**
- * Shared `auth` axis for every `_testing_*` action: keeper-only via the
- * daemon-token credential, no acting actor. This is the entire structural
- * fence on the backdoor surface (these actions run direct DB writes the
- * production wire never exposes), so every `_testing_*` spec references this
- * one const rather than re-declaring it — a single source of truth the gate test
- * (`testing_actions_auth.test.ts`) pins. Mirrors the Rust `DAEMON_TOKEN_ONLY`
- * / shared `AuthSpec` in `fuz_testing`.
- */
-const TESTING_ACTION_AUTH = {
-    account: 'required',
-    actor: 'none',
-    credential_types: ['daemon_token']
-};
+import { TESTING_ACTION_AUTH } from './spine_surface_constants.js';
 /** Output shape for an individual seeded account (keeper or extra). */
 const SeededAccountShape = z.strictObject({
     account: z.strictObject({ id: Uuid, username: z.string() }),
@@ -459,76 +445,6 @@ export const testing_migration_tracker_action_spec = {
  * `create_testing_actions`; mount directly for in-process use.
  */
 export const create_testing_migration_tracker_action = () => rpc_action(testing_migration_tracker_action_spec, async (_input, ctx) => query_migration_tracker(ctx.db));
-/** Input of `_testing_origin_check`. */
-export const TestingOriginCheckInput = z.strictObject({
-    /** An allowlist value, as `FUZ_ALLOWED_ORIGINS` would carry it. */
-    patterns: z.string(),
-    /** One `Origin` header's value, or `null` for a request without one. */
-    origin: z.string().nullable()
-});
-/**
- * Output of `_testing_origin_check`: the request-level answer when the list
- * parses, else every refusal — `index` the 1-based entry position, absent for
- * a list-level refusal.
- */
-export const TestingOriginCheckOutput = z.union([
-    z.strictObject({ ok: z.literal(true), allowed: z.boolean() }),
-    z.strictObject({
-        ok: z.literal(false),
-        errors: z.array(z.strictObject({ index: z.number().int().min(1).optional(), kind: AllowedOriginsErrorKind }))
-    })
-]);
-/**
- * Answer one `_testing_origin_check` input: parse `patterns` with
- * `parse_allowed_origins`, then run the request-level check for one `Origin`
- * carrying `origin` (`null` — no `Origin` — passes). The action handler and
- * the conformance table's unit test both call this, so the table checks the
- * same function the wire serves.
- *
- * @param input - the allowlist value and the `Origin` value
- * @returns the answer the Rust twin returns for the same input
- */
-export const run_testing_origin_check = (input) => {
-    const parsed = parse_allowed_origins(input.patterns);
-    if (!parsed.ok) {
-        return {
-            ok: false,
-            errors: parsed.errors.map(({ index, kind }) => index === undefined ? { kind } : { index, kind })
-        };
-    }
-    return {
-        ok: true,
-        allowed: input.origin === null || should_allow_origin(input.origin, parsed.origins)
-    };
-};
-/**
- * `_testing_origin_check` — run the origin allowlist's parse and request
- * check for one `{patterns, origin}` pair, so the shared conformance table
- * (`origin_conformance.json`) checks each backend's grammar and matcher over
- * the wire, row by row. Pure: no database, no state. The Rust mirror is
- * `fuz_testing::create_testing_origin_check_action_spec`.
- *
- * Like `_testing_action_manifest`, it is **not** bundled by
- * `create_testing_actions`: a consumer whose Rust binary doesn't mount the
- * mirror would fail its action-manifest parity gate. The spine test binary
- * appends it at the full-mount layer (`build_full_spine_rpc_actions`).
- *
- * `auth` gates on the daemon-token credential, matching `_testing_reset`.
- */
-export const testing_origin_check_action_spec = {
-    method: '_testing_origin_check',
-    kind: 'request_response',
-    initiator: 'frontend',
-    auth: TESTING_ACTION_AUTH,
-    side_effects: false,
-    input: TestingOriginCheckInput,
-    output: TestingOriginCheckOutput,
-    async: true,
-    description: "Test-binary only — answer the origin allowlist's parse and request check for one " +
-        '{patterns, origin} pair, for the cross-impl origin conformance table.'
-};
-/** Build the standalone `_testing_origin_check` action (see the spec doc). */
-export const create_testing_origin_check_action = () => rpc_action(testing_origin_check_action_spec, async (input) => run_testing_origin_check(input));
 /** The shortest expiry `_testing_shorten_credential_expiry` sets, in seconds from now. */
 export const TESTING_SHORTEN_CREDENTIAL_EXPIRY_MIN_SECONDS = 1;
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fuzdev/fuz_app",
-  "version": "0.142.0",
+  "version": "0.143.0",
   "description": "fullstack app library",
   "glyph": "🗝",
   "logo": "logo.svg",