Updates to lightspark-sdk, origin, oauth, core, ui (#521)

* Update from public js-sdk main branch (#25478)

Update public `js` sources with the latest code from the [public
repository](https://github.com/lightsparkdev/js-sdk) main branch.

This typically happens when new versions of the SDK are released and
version updates need to be synced. The PR should be merged as soon as
possible to avoid updates to webdev overwriting the changes in the
js-sdk develop branch.

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Corey Martin <coreyn.martin@gmail.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Lightspark Eng <engineering@lightspark.com>
GitOrigin-RevId: e763d6e6bed19b342e4c7b58a3d91a1a2cc8a71c

* [js] Pin axios to exact 1.7.7 across all workspaces (#25560)

## Summary
- Adds a root-level `resolutions` field in `js/package.json` to force
all axios consumers (direct and transitive) to resolve to exactly
`1.7.7`
- Pins direct deps in ops, site, and uma-bridge from `^1.7.4` to exact
`1.7.7`
- Eliminates three separate axios versions (1.6.7, 1.6.8, 1.7.7) that
were being installed due to transitive deps from `@slack/webhook`,
`plaid`, and `wait-on`

## Why
Multiple axios versions cause unpredictable hoisting in the
`node-modules` linker — different workspaces could end up with different
axios versions at runtime depending on install order. Pinning guarantees
a single copy.

## Test plan
- [x] `yarn why axios` confirms all 6 consumers resolve to `1.7.7`
- [x] `yarn deps:check` (manypkg) passes
- [x] `yarn install` succeeds
- [x] `yarn format` passes

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
GitOrigin-RevId: fbcfeb70e0b84be5b50e9b383ce04acd7e5af635

* Add Payouts Overview tab with status tables and trend charts (#25589)

## Summary
- Adds a new **Overview** tab as the first tab on the Payouts page,
showing a dashboard of payout metrics for the last 7 days
- **Status tables**: two side-by-side cards showing payout counts by
status (Completed, Processing, Pending, Rejected, Failed) split by
platform vs customer payouts
- **Stat + chart cards**: three cards combining headline numbers with
Origin `LineChart` trend graphs — total payouts sent, total volume
(grouped by sending currency), and completion rate
- **Backend**: new `grid_payout_overview_stats` GraphQL query with
SQLAlchemy aggregation, 10-second memcache TTL
- **Refactored** `sla_metrics_cache` into a generic
`grid_dashboard_cache` with configurable namespace and TTL, so both SLA
metrics and payout overview share the same caching infrastructure

## Test plan
- [ ] Navigate to `/grid/payouts` and verify it redirects to the
Overview tab
- [ ] Verify status tables show correct counts for platform and customer
payouts
- [ ] Create new payouts and verify they appear in status tables within
~10 seconds
- [ ] Verify line charts show 7-day trends including today's data
- [ ] Verify volume card shows per-currency breakdown when multiple
currencies are used
- [ ] Verify loading spinner shows while data is fetching
- [ ] Verify completion rate shows 100% on days with no payouts
- [ ] Run backend tests: `env -u QUART_CONFIG uv run pytest
sparkcore/graphql/objects/grid_dashboard/tests/test_grid_payout_overview_stats.py
-v`

<img width="1366" height="753" alt="Screenshot 2026-03-31 at 2 23 05 PM"
src="https://github.com/user-attachments/assets/783120df-3576-4d88-91fd-5f5987a6263d"
/>

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
GitOrigin-RevId: 72a966c68f12e3c24ed270626abc9b4b1bc80bcc

* [js] Enable npmMinimalAgeGate for supply chain security (#25688)

## Summary

- Upgrade Yarn 4.5.0 → 4.13.0 (feature introduced in 4.10.0)
- Enable `npmMinimalAgeGate: 720` (12 hours) to block resolution of
recently-published npm packages, mitigating typosquatting, account
takeover, and dependency confusion attacks
- Preapprove `@lightsparkdev/*` packages via `npmPreapprovedPackages` so
internal workspace dependencies are unaffected

Mirrors lightsparkdev/spark#5955 for the webdev JS monorepo.

## Test plan

- [x] `yarn config get npmMinimalAgeGate` returns `720`
- [x] `yarn config get npmPreapprovedPackages` returns
`["@lightsparkdev/*"]`
- [x] `yarn install` succeeds with all current lockfile packages (all
>12h old)
- [x] `yarn --version` returns `4.13.0`
- [x] Pre-commit hooks pass (install + format)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
GitOrigin-RevId: ab033a03d7899b8c962e396f9e175b3f08f2fded

* Parallelize gql-codegen with other checks tasks (#25485)

## Summary
Merges the `gql-codegen` turbo invocation into the main checks turbo
run, allowing it to execute in parallel with `format`, `circular-deps`,
`package:checks`, and the `^build` dependencies that `lint`/`test` need.
Also adds explicit `gql-codegen` as a `dependsOn` for `lint`, `test`,
`types`, and `circular-deps` in turbo.json to ensure correctness — these
tasks need the generated files from codegen.

**Before:**
```
yarn deps:check && turbo gql-codegen && turbo run lint format test circular-deps package:checks
```
gql-codegen (~56s) blocks everything — format, circular-deps,
package:checks all wait.

**After:**
```
yarn deps:check && turbo run gql-codegen lint format test circular-deps package:checks
```
Turbo schedules all tasks optimally. Tasks that need codegen (lint,
test, types, circular-deps) explicitly depend on it in turbo.json. Tasks
that don't (format, package:checks) start immediately.

## Local benchmarks (interleaved, 10 pairs)

Fair A/B comparison — each pair runs sequential then parallel
back-to-back under identical cache conditions:

| Pair | Sequential | Parallel | Saved |
|------|-----------|----------|-------|
| 1 | 3m 58s | 3m 31s | 26s |
| 2 | 3m 57s | 3m 15s | 42s |
| 3 | 4m 28s | 3m 36s | 51s |
| 4 | 3m 58s | 2m 51s | 1m 07s |
| 5 | 3m 41s | 3m 01s | 40s |
| 6 | 3m 36s | 2m 36s | 59s |
| 7 | 3m 28s | 2m 35s | 52s |
| 8 | 4m 06s | 3m 08s | 58s |
| 9 | 3m 50s | 3m 03s | 47s |
| 10 | 3m 44s | 2m 59s | 44s |
| **mean** | **3m 52s** | **3m 03s** | **49s (21%)** |
| **median** | **3m 57s** | **3m 03s** | **51s** |

**Parallel wins 10/10 pairs.** Also more consistent (1m range vs 1m
33s).

## CI validation (2 runs on 8-core ARM)

| Metric | Sequential baseline | Parallel |
|--------|-------------------|----------|
| yarn checks | 3m 35s | 2m 43s |
| check job | 5m 25s | 4m 21s |

## Test plan
- [x] `yarn checks` passes in CI
- [x] gql generated code check still passes
- [x] Verified via `--dry` that lint/test/types/circular-deps depend on
gql-codegen in correct workspaces
- [x] Verified via verbose build that ops:gql-codegen completes before
ops:lint starts
- [x] Local interleaved benchmark: 10/10 pairs faster, mean 49s saved

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
GitOrigin-RevId: 311c089549739aea21310be574d328069eef79ae

* Add gql codegen dependency before format checks (#25711)

GitOrigin-RevId: 956a78dde007ff4fd85723fd55b7a9e6d39546ee

* [js] Increase npmMinimalAgeGate to 24 hours (#25709)

## Summary
- Increases `npmMinimalAgeGate` in `.yarnrc.yml` from 720 minutes (12
hours) to 1440 minutes (24 hours)
- This raises the minimum time-since-publish safety gate for npm
packages to 24 hours

## Test plan
- [x] `yarn install` succeeds with the new config value
- [x] Formatting checks pass

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
GitOrigin-RevId: 7df42c1fcc23f73b5a31f8cf6ae892740e9f34d2

* [js] replace tsup with tsdown (#25829)

## Reason

The JS workspace was still using `tsup` in several packages. This change
standardizes those packages on `tsdown` and fixes the runtime export
mismatches that `tsup` had been tolerating so the built packages
continue to work correctly under the new bundler.

## Overview

- replace `tsup` with `tsdown` in `@lightsparkdev/core`,
`@lightsparkdev/lightspark-sdk`, `@lightsparkdev/oauth`, and
`@lightsparkdev/ui`
- add `tsdown` config and script updates for build/watch workflows
- migrate the `ui` SVG handling to a `tsdown`-compatible plugin and add
CSS bundling support
- remove the leftover unused `tsup` dependency from `private/ui`
- convert type-shaped barrel exports in `core` and `lightspark-sdk` to
type-only exports where needed so downstream runtime imports stay valid

## Test Plan

- `cd js && yarn checks`
- `cd js && yarn test`

GitOrigin-RevId: f732e95176144ec33101eb4a4363efb6591c0dc2

* SP-2735: Replace currency config ents with dataclasses + token fund-in enum additions (#25988)

## Summary
- Replace `CurrencyConfig`, `CurrencyConversionConfig`, and `NetworkCurrencyConfig` ent entities with frozen Python `@dataclass` types in `sparklib/money/currency_config_types.py`
- Configs are backed by Quart `current_app.config` via a centralized `_app_config()` helper (single `current_app` import point)
- Classmethod API: `CurrencyConfig.get(unit)`, `CurrencyConversionConfig.get(from, to)`, `CurrencyConversionConfig.is_supported(from, to)`
- Synchronous `currency_service.py` wrapper in paycore accepts `CurrencyUnit | str` and implements config-then-fallback pattern (check CurrencyConfig first, fall back to CurrencyUnit enum methods)
- `quote_utils.py` exchange rate logic now uses `CurrencyUnit.X.value` enum constants instead of raw strings
- Fold non-ent-schema changes from #25494: USDB currency, SPARK_TESTNET → SPARK_REGTEST rename, new flow/settlement types

## Test plan
- [x] 16 unit tests in `test_currency_config_types.py` covering all dataclass helpers
- [x] Updated `test_create_send_quote_v2.py` for new currency code handling
- [x] Full paycore test suite passes

Fixes SP-2735

---
🤖 *bonded-keystone-2* | [Dashboard](https://zeus.dev.dev.sparkinfra.net/#/instance?id=bonded-keystone-2) | [Feedback](https://zeus.dev.dev.sparkinfra.net/feedback)

GitOrigin-RevId: 3a71bc7c836e1190b7a41fb5459afa7db4698818

* [Payins] Add ARS as currency unit and add sandbox payment instructions (#26191)

Adds ARS as a currency unit and creates mock payment links for sandbox REAL_TIME_FUNDED quotes for COL and ARS.

GitOrigin-RevId: dfee12693d78433772b2f7da22b86d7a557d3529

* nage: add chain icons to network selector dropdown (AT-4792) (#26628)

## Reason

Closes [AT-4792](https://lightspark.atlassian.net/browse/AT-4792). The
network selector in the payout flow showed text-only options (Solana,
Ethereum, Base, Polygon), which made the dropdown harder to scan and
felt visually thin next to the rest of the form. Adding brand-mark chain
icons gives the field the same instant-recognition affordance our peer
products use.

## Overview

- New shared primitive at `packages/ui/src/icons/chains/`:
- One brand-mark SVG component per supported network (`Solana`,
`Ethereum`, `Base`, `Polygon`) — the "branded" web3icons variant: each
chain's native mark with no full-bleed background tile.
- `ChainIcon` dispatcher renders the chain's native silhouette directly.
No circular wrapper — the marks read better as themselves (Base in
particular is a rounded blue square; wrapping it added visual noise).
- `EnterAmountPanel` network selector now uses `formatOptionLabel` to
render `ChainIcon + label`:
  - **24px** in the open menu — comfortable browse size.
- **16px** in the trigger (selected state) — keeps the field height
aligned with sibling Currency/Amount inputs and avoids a size jump when
the menu closes.
  - Trigger gap tightens from `sm` → `xs` to match the smaller tile.
- `NetworkOption` gains a typed `chain` field so the option → icon
mapping is enforced at construction.
- Network options now sort alphabetically (Base → Ethereum → Polygon →
Solana). Predictable, future-proof, no implicit "default by position"
bias.

### Intentionally out of scope

- **Mainnet vs testnet visual differentiation.** The four icons cover
all eight `cryptoNetwork` values; testnet variants render the same brand
mark today (matches web3icons behavior). If we want a "T" badge or muted
treatment later, the right move is to flip `ChainIcon`'s prop from a
brand-level `Chain` to a network-level `CryptoNetwork` and switch on it
in the dispatcher — captured for a follow-up.
- **Sensible default network.** Considered, deferred. Auto-selecting
carries real downside in crypto (irreversibility), and picking *which*
default ("most-used", "recipient-derived", "last-used",
"currency-driven") needs product input. Ticket stays narrowly scoped.
- **`uma-nage` `Select` polish.** A few places this PR uses inline
`formatOptionLabel`/styled wrappers could move into the wrapper later;
out of scope here.
- **OpenAPI `cryptoNetwork` is typed as a free-form string** despite
being a closed enum in `sparkcore`. Filed as
[AT-4989](https://lightspark.atlassian.net/browse/AT-4989).

## Test Plan

- `yarn typecheck` and lint pass on `@lightsparkdev/ui` and
`@lightsparkdev/site`.
- Visual verification (pending dev server restart): network dropdown
shows correct brand icon for each option in both prod and sandbox modes;
trigger height matches sibling Currency input; icons stay vertically
centered; selecting a network from the menu transitions cleanly to the
16px trigger state; options appear in alphabetical order.

[AT-4792]:
https://lightspark.atlassian.net/browse/AT-4792?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ
[AT-4989]:
https://lightspark.atlassian.net/browse/AT-4989?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ

GitOrigin-RevId: e1e973389c3b306c9feb728121033a2a562c4383

* Revert "Use a bigint for nonces, so we don't accidentally truncate bytes" (#26826)

Reverts lightsparkdev/webdev#24885

GitOrigin-RevId: 8594e690deedb1719fd6a89960dbddfffc0dc3bb

* DES-19: Add explicit background to form elements (Input, Textarea, Select.Trigger, Autocomplete) (#26829)

## Summary

- Add `background: transparent` to four form element rules that quietly
relied on `tokens/_reset.scss` for their background normalization
- Brings these into line with `Combobox`, `PhoneInput`,
`Select.triggerGhost`, and `Select.triggerHybrid`, which already
self-style

## Sequencing

This PR ships **before** the upcoming `foundation.css` work and the Grid
foundation/Add Customer stack:

1. **This PR (DES-19)** — first. Makes the four form components
self-sufficient so they render correctly without the reset.
2. **Origin foundation entry point** — coming in #26785 (`[origin] add
foundation stylesheet + widen Button props`). Adds `foundation.css`
(variables + effects only, no reset) as a documented incremental
adoption path.
3. **Grid foundation wiring** — #26786 onwards (`[grid] wire Origin
foundation into site shell`, NageButton wrapper, Add Customer Origin
migration). First real consumer of `foundation.css`.

Landing in this order means consumers of the new `foundation.css` path
get a clean visual result on day one — no UA-default tint on `<input>`,
`<textarea>`, or default `<Select.Trigger>` from skipping the reset.

## Motivation

Origin currently ships one stylesheet entry point — `styles.css` (via
`public.scss`) — which includes a CSS reset that normalizes form element
backgrounds:

```scss
input, textarea, select { background: transparent; }
button { background: transparent; cursor: pointer; }
```

Four components quietly depended on this reset for their `background`.
They render correctly inside Origin's own app (which loads the full
bundle), but if a future consumer pulls in only variables and effects
(the upcoming `foundation.css` entry point), they'd see the browser's UA
element fill — a tinted blue-gray on `<input>`, `<textarea>`, and
`<button>`-based triggers — making fields look heavier than neighboring
components.

Adding the explicit declaration to each component keeps the reset truly
optional and makes the foundation-only adoption pattern viable on day
one.

Resolves [DES-19](https://lightspark.atlassian.net/browse/DES-19).

## Files changed

- `Input.module.scss` — `.input`
- `Textarea.module.scss` — `.textarea`
- `Select.module.scss` — `.trigger` (default variant only; ghost/hybrid
already had it)
- `Autocomplete.module.scss` — `.input`

## Test plan

- [x] No visual regression in Origin's own Storybook/test app (still
loads `_reset.scss` via `public.scss`)
- [ ] After #26785 + #26786 land, verify Grid Site Add Customer fields
render without UA tint when consuming only `foundation.css`
- [ ] Sanity check Input, Textarea, Autocomplete, and default
Select.Trigger in light mode side-by-side

Made with [Cursor](https://cursor.com)

[DES-19]:
https://lightspark.atlassian.net/browse/DES-19?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ

GitOrigin-RevId: a60eab47b1d43ba9c3d294b96378fd14b1c493b9

* DES-18: Fix four Combobox multi-select bugs (JSDoc, dead :has selector, gaps) (#26842)

## Summary

Fixes four related bugs in the multi-select Combobox pattern that were
all visible in Grid `AddCustomerPanel.tsx`:

1. **JSDoc showed a structure that produces a broken layout.**
Documented `Combobox.Input` as a sibling of `Combobox.Chips`, which
makes both `flex: 1` from a 0 basis and splits the row 50/50. Empty
chips reserves half the wrapper; populated chips wrap independently of
the input. Rewritten to put `Combobox.Input` inside `Combobox.Value`'s
render function — the working pattern that the standalone Origin demo
and the existing `valueWithChildren { display: contents }` style were
designed for.
2. **`:has(.chip)` was silently dead code.** `.chip` was not defined in
`Combobox.module.scss`, so CSS Modules hashed the selector to a class
that nothing in the DOM had. The wrapper's left padding never collapsed
when chips were present, so chip text edges drifted out of alignment
with input text. Added an empty `.chip` marker class and applied it
alongside the Chip component's classes in `parts.tsx`, so the `:has()`
selector actually matches.
3. **Cursor was flush against the chip's right edge.** Split the `gap`
shorthand into a tight `column-gap` (chip→chip packing) and added `.chip
+ .input { margin-inline-start }` so the breathing room only applies
after a chip — empty state still anchors at the wrapper's left padding.
4. **Row-gap was ~2px when input wrapped to a new row.** Set `row-gap:
var(--spacing-2xs)` so the wrapped input has visible vertical breathing
room.

JSDoc also now documents explicitly: no `ActionButtons` / `Trigger` for
multi-select, and prefer a persistent action-oriented placeholder (\"Add
fruits\") since it's the only affordance for adding more values when
there's no chevron.

Resolves [DES-18](https://lightspark.atlassian.net/browse/DES-18).

## Files changed

- `Combobox/parts.tsx` — `Chips` + `Value` (multi-select) JSDoc
rewrites; apply `styles.chip` marker
- `Combobox/Combobox.module.scss` — `.chip` marker class; split `gap`
into `column-gap` + `row-gap`; `.chip + .input` margin
- `Combobox/Combobox.stories.tsx` — new `MultipleWithChips` story
covering empty / one chip / many-chip overflow

## Why \"marker class\" instead of `:has([class*='dismiss'])`

The ticket suggested two ways to fix bug 2. The marker class approach
was chosen because it doesn't depend on the internal class names of
`Chip.module.scss` — if anything in the Chip module is renamed, this
won't silently break again.

## Story / regression coverage

The existing `Multiple` story didn't use `Combobox.Chips` at all, which
is why none of these four bugs were caught upstream. The new
`MultipleWithChips` story renders three labeled instances side-by-side
(empty / one chip / many chips overflow) so all four states have visible
coverage.

## Test plan

- [x] `yarn test:unit` — 421 tests pass
- [x] `yarn lint` — clean (only pre-existing unrelated warnings)
- [x] `yarn format` — clean
- [ ] Visual: empty Combobox.Chips placeholder anchors left
- [ ] Visual: one chip — chip text aligns with input baseline, cursor
has breathing room
- [ ] Visual: many chips — chips wrap inside `.chips`; input wraps to
new row with vertical gap
- [ ] Verify in Grid `AddCustomerPanel.tsx` Business Details once this
lands

## Note

This replaces closed PR #26832, which had taken the wrong fix path
(removed `flex: 1` from `.chips`, which would actually break the working
pattern documented here).

Made with [Cursor](https://cursor.com)

[DES-18]:
https://lightspark.atlassian.net/browse/DES-18?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ

GitOrigin-RevId: 08866ac042a5af5ddeb9291d5728131beafd882b

* Update from public js-sdk main branch (#25559)

Update public `js` sources with the latest code from the [public
repository](https://github.com/lightsparkdev/js-sdk) main branch.

This typically happens when new versions of the SDK are released and
version updates need to be synced. The PR should be merged as soon as
possible to avoid updates to webdev overwriting the changes in the
js-sdk develop branch.

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Jay Mantri <amantri08@gmail.com>
Co-authored-by: Corey Martin <coreyn.martin@gmail.com>
Co-authored-by: Lightspark Eng <engineering@lightspark.com>
GitOrigin-RevId: 1dffded1d24db5e1b633e4b411d425e40e2e8c2a

* CI update lock file for PR

* Fix release sync CI for tsdown

* Add changeset for UI tsdown fix

* Expand changesets for release sync

---------

Co-authored-by: lightspark-copybara[bot] <257630510+lightspark-copybara[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Corey Martin <coreyn.martin@gmail.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Lightspark Eng <engineering@lightspark.com>
Co-authored-by: Brian Siao Tick Chong <bsiaotickchong@gmail.com>
Co-authored-by: Jason Wang <jason@lightspark.com>
Co-authored-by: Aaron Kanter <alkanter@gmail.com>
Co-authored-by: Jay Mantri <amantri08@gmail.com>

Author: 9 people

.changeset/add-core-currencies.md

@@ -0,0 +1,6 @@
+---
+"@lightsparkdev/core": patch
+---
+
+- Add ARS and USDB support to currency conversion and formatting utilities.
+- Keep request signing nonces as numbers for compatibility with existing signing request payloads.

.changeset/add-ui-chain-icons.md

@@ -0,0 +1,6 @@
+---
+"@lightsparkdev/ui": patch
+---
+
+- Add Base, Ethereum, Polygon, and Solana chain icon components, plus a `ChainIcon` helper.
+- Improve package build output for CSS and SVG assets.

.changeset/fix-type-only-exports.md

@@ -0,0 +1,6 @@
+---
+"@lightsparkdev/core": patch
+"@lightsparkdev/lightspark-sdk": patch
+---
+
+- Mark generated types as type-only exports while preserving query helper runtime exports.

.changeset/update-origin-controls.md

@@ -0,0 +1,6 @@
+---
+"@lightsparkdev/origin": patch
+---
+
+- Fix form control backgrounds so inputs, textareas, selects, and autocompletes inherit the surrounding surface.
+- Fix Combobox multi-select chip layout so selected chips and the input wrap together with consistent spacing.

.github/workflows/test-release-sync.yaml

@@ -110,14 +110,15 @@ jobs:
           }
           EOF
 
-  # Unit tests run on the full Node matrix to verify runtime compatibility.
+  # Unit tests run on active Node LTS/current lines. The build toolchain used by
+  # test dependencies requires Node >= 20.19.
   test:
     needs: "update-lock-file"
     if: "!failure() && !cancelled()"
     runs-on: "ubuntu-22.04"
     strategy:
       matrix:
-        node-version: ["18.x", "22.x"]
+        node-version: ["20.x", "22.x"]
     steps:
       - name: "Checkout"
         uses: "actions/checkout@v3"
@@ -151,13 +152,7 @@ jobs:
           echo 'export LIGHTSPARK_BASE_URL="https://api.dev.dev.sparkinfra.net"' >> ~/.lightsparkapienv
 
       - name: "Run tests"
-        run: |
-          if [[ "${{ matrix.node-version }}" == "18.x" ]]; then
-            # Origin's vitest config requires Node >= 20 (styleText from node:util)
-            yarn test-cmd --filter='!@lightsparkdev/origin'
-          else
-            yarn test-cmd
-          fi
+        run: "yarn test-cmd"
 
       - name: "Notify failure on Slack"
         if: "failure() && github.event_name == 'push'"

.yarn/releases/yarn-4.13.0.cjs

@@ -4,4 +4,9 @@ enableGlobalCache: false
 
 nodeLinker: node-modules
 
-yarnPath: .yarn/releases/yarn-4.5.0.cjs
+npmMinimalAgeGate: 1440
+
+npmPreapprovedPackages:
+  - "@lightsparkdev/*"
+
+yarnPath: .yarn/releases/yarn-4.13.0.cjs

.yarn/releases/yarn-4.5.0.cjs

@@ -26,5 +26,3 @@ yarn start remote-signing-server
 ```
 
 Please see the README files in the [examples directory](./apps/examples) for instructions on running the examples. Please note that some packages such as @lightsparkdev/ui are for building the examples only and not necessary for your implementation of our [published SDK packages](https://www.npmjs.com/search?q=%40lightsparkdev).
-
-<!-- webdev-sync-refresh-test: 2026-04-29 -->

.yarnrc.yml

@@ -10,7 +10,7 @@
     "build-sb": "turbo run build-sb",
     "build": "turbo run build",
     "build:watch": "turbo run build:watch",
-    "checks": "yarn deps:check && turbo gql-codegen && turbo run lint format circular-deps package:checks",
+    "checks": "yarn deps:check && turbo run gql-codegen lint format circular-deps package:checks",
     "test-cmd": "turbo run test",
     "circular-deps": "turbo run circular-deps",
     "clean": "turbo run clean",
@@ -65,8 +65,11 @@
       "built": false
     }
   },
+  "resolutions": {
+    "axios": "1.7.7"
+  },
   "engines": {
     "node": ">=18"
   },
-  "packageManager": "yarn@4.5.0"
+  "packageManager": "yarn@4.13.0"
 }