@fuzdev/fuz_app 0.131.0 → 0.132.0

package/dist/actions/action_dispatcher.js

@@ -6,7 +6,6 @@
  *
  * @module
  */
-import { JsonrpcMessageFromClientToServer, JsonrpcMessageFromServerToClient, JsonrpcNotification, JsonrpcRequest, JsonrpcResponseOrError, JsonrpcErrorResponse } from '../http/jsonrpc.js';
 import { create_jsonrpc_error_response, create_jsonrpc_error_response_from_thrown, to_jsonrpc_message_id, is_jsonrpc_request, is_jsonrpc_notification } from '../http/jsonrpc_helpers.js';
 import { jsonrpc_error_messages } from '../http/jsonrpc_errors.js';
 import { to_input_params } from '../http/schema_helpers.js';

package/dist/actions/action_event_data.d.ts

@@ -28,11 +28,11 @@ export declare const ActionEventData: z.ZodObject<{
         execute: "execute";
     }>;
     step: z.ZodEnum<{
-        initial: "initial";
+        failed: "failed";
         parsed: "parsed";
+        initial: "initial";
         handling: "handling";
         handled: "handled";
-        failed: "failed";
     }>;
     method: z.ZodString;
     executor: z.ZodEnum<{

package/dist/actions/action_event_types.d.ts

@@ -12,11 +12,11 @@ export declare const ActionExecutor: z.ZodEnum<{
 }>;
 export type ActionExecutor = z.infer<typeof ActionExecutor>;
 export declare const ActionEventStep: z.ZodEnum<{
-    initial: "initial";
+    failed: "failed";
     parsed: "parsed";
+    initial: "initial";
     handling: "handling";
     handled: "handled";
-    failed: "failed";
 }>;
 export type ActionEventStep = z.infer<typeof ActionEventStep>;
 export declare const action_event_step_transitions: Record<ActionEventStep, ReadonlyArray<ActionEventStep>>;

package/dist/actions/action_rpc.js

@@ -13,7 +13,6 @@
  */
 import { z } from 'zod';
 import { DEV } from 'esm-env';
-import {} from '../http/route_spec.js';
 import { get_client_ip } from '../http/client_ip.js';
 import { get_request_context } from '../auth/request_context.js';
 import { ACCOUNT_ID_KEY, CREDENTIAL_TYPE_KEY, TOKEN_SCOPE_KEY, TEST_CONTEXT_PRESET_KEY } from '../hono_context.js';

package/dist/actions/action_spec.d.ts

@@ -51,14 +51,14 @@ export declare const ActionSpec: z.ZodObject<{
      */
     auth: z.ZodNullable<z.ZodObject<{
         account: z.ZodEnum<{
-            optional: "optional";
-            none: "none";
             required: "required";
+            none: "none";
+            optional: "optional";
         }>;
         actor: z.ZodEnum<{
-            optional: "optional";
-            none: "none";
             required: "required";
+            none: "none";
+            optional: "optional";
         }>;
         roles: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
         credential_types: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
@@ -108,9 +108,9 @@ export declare const ActionSpec: z.ZodObject<{
      * dispatchers don't read it.
      */
     rate_limit: z.ZodOptional<z.ZodEnum<{
+        both: "both";
         account: "account";
         ip: "ip";
-        both: "both";
     }>>;
 }, z.core.$strict>;
 export type ActionSpec = z.infer<typeof ActionSpec>;
@@ -128,21 +128,21 @@ export declare const RequestResponseActionSpec: z.ZodObject<{
     streams: z.ZodOptional<z.ZodString>;
     error_reasons: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
     rate_limit: z.ZodOptional<z.ZodEnum<{
+        both: "both";
         account: "account";
         ip: "ip";
-        both: "both";
     }>>;
     kind: z.ZodDefault<z.ZodLiteral<"request_response">>;
     auth: z.ZodObject<{
         account: z.ZodEnum<{
-            optional: "optional";
-            none: "none";
             required: "required";
+            none: "none";
+            optional: "optional";
         }>;
         actor: z.ZodEnum<{
-            optional: "optional";
-            none: "none";
             required: "required";
+            none: "none";
+            optional: "optional";
         }>;
         roles: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
         credential_types: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
@@ -163,9 +163,9 @@ export declare const RemoteNotificationActionSpec: z.ZodObject<{
     streams: z.ZodOptional<z.ZodString>;
     error_reasons: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
     rate_limit: z.ZodOptional<z.ZodEnum<{
+        both: "both";
         account: "account";
         ip: "ip";
-        both: "both";
     }>>;
     kind: z.ZodDefault<z.ZodLiteral<"remote_notification">>;
     auth: z.ZodDefault<z.ZodNull>;
@@ -193,9 +193,9 @@ export declare const LocalCallActionSpec: z.ZodObject<{
     streams: z.ZodOptional<z.ZodString>;
     error_reasons: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
     rate_limit: z.ZodOptional<z.ZodEnum<{
+        both: "both";
         account: "account";
         ip: "ip";
-        both: "both";
     }>>;
     kind: z.ZodDefault<z.ZodLiteral<"local_call">>;
     auth: z.ZodDefault<z.ZodNull>;
@@ -215,21 +215,21 @@ export declare const ActionSpecUnion: z.ZodUnion<readonly [z.ZodObject<{
     streams: z.ZodOptional<z.ZodString>;
     error_reasons: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
     rate_limit: z.ZodOptional<z.ZodEnum<{
+        both: "both";
         account: "account";
         ip: "ip";
-        both: "both";
     }>>;
     kind: z.ZodDefault<z.ZodLiteral<"request_response">>;
     auth: z.ZodObject<{
         account: z.ZodEnum<{
-            optional: "optional";
-            none: "none";
             required: "required";
+            none: "none";
+            optional: "optional";
         }>;
         actor: z.ZodEnum<{
-            optional: "optional";
-            none: "none";
             required: "required";
+            none: "none";
+            optional: "optional";
         }>;
         roles: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
         credential_types: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
@@ -248,9 +248,9 @@ export declare const ActionSpecUnion: z.ZodUnion<readonly [z.ZodObject<{
     streams: z.ZodOptional<z.ZodString>;
     error_reasons: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
     rate_limit: z.ZodOptional<z.ZodEnum<{
+        both: "both";
         account: "account";
         ip: "ip";
-        both: "both";
     }>>;
     kind: z.ZodDefault<z.ZodLiteral<"remote_notification">>;
     auth: z.ZodDefault<z.ZodNull>;
@@ -272,9 +272,9 @@ export declare const ActionSpecUnion: z.ZodUnion<readonly [z.ZodObject<{
     streams: z.ZodOptional<z.ZodString>;
     error_reasons: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
     rate_limit: z.ZodOptional<z.ZodEnum<{
+        both: "both";
         account: "account";
         ip: "ip";
-        both: "both";
     }>>;
     kind: z.ZodDefault<z.ZodLiteral<"local_call">>;
     auth: z.ZodDefault<z.ZodNull>;

package/dist/actions/perform_action.js

@@ -56,7 +56,6 @@
  */
 import { DEV } from 'esm-env';
 import { apply_authorization_phase, has_any_scoped_role } from '../auth/request_context.js';
-import {} from '../hono_context.js';
 import { to_input_params } from '../http/schema_helpers.js';
 import { dispatch_with_post_commit_rollback } from '../http/pending_effects.js';
 import { JSONRPC_VERSION } from '../http/jsonrpc.js';

package/dist/actions/register_action_ws.js

@@ -104,7 +104,6 @@ import { JsonrpcRequest } from '../http/jsonrpc.js';
 import { dev_only, jsonrpc_error_messages } from '../http/jsonrpc_errors.js';
 import { create_jsonrpc_error_response, create_jsonrpc_notification, to_jsonrpc_envelope_id, to_jsonrpc_message_id, to_jsonrpc_params, is_jsonrpc_object, is_jsonrpc_request, is_jsonrpc_request_id } from '../http/jsonrpc_helpers.js';
 import { TOKEN_SCOPE_KEY, TEST_CONTEXT_PRESET_KEY } from '../hono_context.js';
-import {} from './action_types.js';
 import { compile_action_registry } from './compile_action_registry.js';
 import { cancel_action_spec, CancelNotificationParams } from './cancel.js';
 import { DEFAULT_WS_MAX_MESSAGE_BYTES, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_MESSAGE_TOO_BIG, WS_CLOSE_POLICY_VIOLATION, WS_CLOSE_SERVER_HEARTBEAT_TIMEOUT, WS_CLOSE_SESSION_REVOKED, WS_CLOSE_SESSION_REVOKED_REASON, utf8_length, utf8_length_over } from './transports.js';

package/dist/actions/transports_http.d.ts

@@ -22,6 +22,13 @@ import type { Transport, TransportSendOptions } from './transports.js';
 export declare class FrontendHttpTransport implements Transport {
     #private;
     readonly transport_name: "frontend_http_rpc";
+    /**
+     * @param url - the JSON-RPC endpoint
+     * @param headers - extra headers, merged over the JSON `content-type` and
+     *   `accept` defaults case-insensitively — a POST without
+     *   `application/json` is refused (415)
+     * @param has_side_effects - when it returns `false` for a method, the call is a GET
+     */
     constructor(url: string, headers?: Record<string, string>, has_side_effects?: (method: string) => boolean);
     send(message: JsonrpcRequest, options?: TransportSendOptions): Promise<JsonrpcResponseOrError>;
     send(message: JsonrpcNotification, options?: TransportSendOptions): Promise<JsonrpcErrorResponse | null>;

package/dist/actions/transports_http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transports_http.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/transports_http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAiBH,OAAO,EACN,oBAAoB,EAGpB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EAEnB,KAAK,sBAAsB,EAC3B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEvE;;;;;;;;;;;;;GAaG;AACH,qBAAa,qBAAsB,YAAW,SAAS;;IACtD,QAAQ,CAAC,cAAc,EAAG,mBAAmB,CAAU;gBAOtD,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAChC,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO;IAOzC,IAAI,CACT,OAAO,EAAE,cAAc,EACvB,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IAC5B,IAAI,CACT,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IA+FvC,QAAQ,IAAI,OAAO;CAGnB"}
+{"version":3,"file":"transports_http.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/transports_http.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAiBH,OAAO,EACN,oBAAoB,EAGpB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EAEnB,KAAK,sBAAsB,EAC3B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAQvE;;;;;;;;;;;;;GAaG;AACH,qBAAa,qBAAsB,YAAW,SAAS;;IACtD,QAAQ,CAAC,cAAc,EAAG,mBAAmB,CAAU;IAMvD;;;;;;OAMG;gBAEF,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAChC,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO;IAYzC,IAAI,CACT,OAAO,EAAE,cAAc,EACvB,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IAC5B,IAAI,CACT,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IA+FvC,QAAQ,IAAI,OAAO;CAGnB"}

package/dist/actions/transports_http.js

@@ -7,6 +7,11 @@ import { DEV } from 'esm-env';
 import { ThrownJsonrpcError, jsonrpc_error_messages, http_status_to_jsonrpc_error_code, jsonrpc_error_code_to_http_status, UNKNOWN_ERROR_MESSAGE } from '../http/jsonrpc_errors.js';
 import { create_jsonrpc_error_response, to_jsonrpc_message_id, is_jsonrpc_error_response, is_jsonrpc_response } from '../http/jsonrpc_helpers.js';
 import { JsonrpcErrorResponse } from '../http/jsonrpc.js';
+/** Headers every request carries unless the caller's replace them. */
+const DEFAULT_HEADERS = {
+    'content-type': 'application/json',
+    accept: 'application/json'
+};
 /**
  * Thin `fetch` adapter for the JSON-RPC endpoint. POST by default; GET when
  * the optional `has_side_effects(method)` callback returns `false` for the
@@ -26,9 +31,21 @@ export class FrontendHttpTransport {
     #url;
     #headers;
     #has_side_effects;
+    /**
+     * @param url - the JSON-RPC endpoint
+     * @param headers - extra headers, merged over the JSON `content-type` and
+     *   `accept` defaults case-insensitively — a POST without
+     *   `application/json` is refused (415)
+     * @param has_side_effects - when it returns `false` for a method, the call is a GET
+     */
     constructor(url, headers, has_side_effects) {
         this.#url = url;
-        this.#headers = headers ?? { 'content-type': 'application/json', accept: 'application/json' };
+        this.#headers = { ...DEFAULT_HEADERS };
+        if (headers) {
+            for (const [name, value] of Object.entries(headers)) {
+                this.#headers[name.toLowerCase()] = value;
+            }
+        }
         this.#has_side_effects = has_side_effects;
     }
     async send(message, options) {

package/dist/auth/CLAUDE.md

@@ -215,7 +215,7 @@ Everything else listed under §RPC action surfaces.
 
 ### Middleware
 
-- `auth/middleware.ts` — `create_auth_middleware_specs(deps, options)` assembles `[origin, session, request_context, bearer_auth]` + optional `daemon_token`. `AUTH_MIDDLEWARE_PATH` (`'/api/*'`) is where `create_app_server` mounts the stack; two assembly asserts lean on it: `assert_endpoint_in_auth_scope` (an `rpc_endpoints` / `ws_endpoints` path must sit inside it) and `assert_middleware_stack_mounted(stack_specs, middleware_specs)`, run on a `transform_middleware` result against the pre-transform stack (`[proxy, ...auth]`) — each stack spec, matched by its `handler` closure (not its spoofable `name`), mounted exactly once at its original path (`'*'` for the trusted proxy, `AUTH_MIDDLEWARE_PATH` for auth), in its original order; other specs may sit anywhere, including before the proxy and between the auth layers. The proxy is in the stack because dropping it turns every `get_client_ip` into `'unknown'`, one shared bucket for every IP-keyed limiter. The transform receives shallow copies in a fresh array, so an in-place mutation can't rewrite the originals the check reads. The check pins where those layers sit, not what added layers do — a layer you add runs with full context access. Both run in `create_test_app_surface_spec` too.
+- `auth/middleware.ts` — `create_auth_middleware_specs(deps, options)` assembles `[origin, session, request_context, bearer_auth]` + optional `daemon_token` (the content-type refusal isn't a middleware: `apply_route_specs` checks every `POST` route, see `http/simple_request.ts`). `AUTH_MIDDLEWARE_PATH` (`'/api/*'`) is where `create_app_server` mounts the stack; two assembly asserts lean on it: `assert_endpoint_in_auth_scope` (an `rpc_endpoints` / `ws_endpoints` path, or the bootstrap route under `bootstrap.route_prefix`, must sit inside it) and `assert_middleware_stack_mounted(stack_specs, middleware_specs)`, run on a `transform_middleware` result against the pre-transform stack (`[proxy, ...auth]`) — each stack spec, matched by its `handler` closure (not its spoofable `name`), mounted exactly once at its original path (`'*'` for the trusted proxy, `AUTH_MIDDLEWARE_PATH` for auth), in its original order; other specs may sit anywhere, including before the proxy and between the auth layers. The proxy is in the stack because dropping it turns every `get_client_ip` into `'unknown'`, one shared bucket for every IP-keyed limiter. The transform receives shallow copies in a fresh array, so an in-place mutation can't rewrite the originals the check reads. The check pins where those layers sit, not what added layers do — a layer you add runs with full context access. Both run in `create_test_app_surface_spec` too.
 - `auth/request_context.ts` — `RequestContext`, `resolve_acting_actor`, `build_request_context`, predicates (`has_role`, `has_scoped_role`, `has_any_scoped_role` — the dispatcher's role gate and every builtin-role check read the **global** grant via `has_scoped_role(_, role, null)` / `has_any_scoped_role(_, roles, null)`; scope-blind `has_role` is never the gate for a builtin role), guards (`require_auth`, `require_role`, `require_credential_types`, `require_token_scope`), `token_scope_surface_denial` (the direct-call form, for surfaces that aren't route specs), `refresh_role_grants`.
 - `auth/session_middleware.ts` — `process_session_cookie` integration, `create_session_and_set_cookie` (shared by login / signup / bootstrap; returns the token hashes of the sessions the cap evicted, which the caller closes after its commit — only login passes a cap).
 - `auth/resolved_auth.ts` — `ResolvedAuth` (the resolved credential as one value: `account_id`, `credential_type`, `token_hash`, `api_token_id`), `get_resolved_auth(c)` (gathers it from the context keys the auth middleware set), and `revalidate_resolved_auth(deps, resolved)`, the no-touch re-read a long-lived connection runs once it is registered: session row / token row (by id) still live and still on the account, account not soft-deleted; a daemon token re-reads its account only. Reuses the middleware's own queries and predicates. Called by the WS upgrade (`actions/register_action_ws.ts`) and the audit SSE route between registering a connection pending and admitting it. Twin of the Rust `revalidate_resolved_auth`.

package/dist/auth/account_routes.js

@@ -22,7 +22,7 @@
  * @module
  */
 import { clear_session_cookie, create_session_and_set_cookie } from './session_middleware.js';
-import { RoleGrantSummaryJson, to_session_account } from './account_schema.js';
+import { to_session_account } from './account_schema.js';
 import { account_status_route_shape, create_account_route_shapes, DEFAULT_MAX_SESSIONS } from './account_route_schema.js';
 import { hash_session_token, query_session_revoke_all_for_account, query_session_revoke_by_hash_unscoped } from './session_queries.js';
 import { query_account_by_username_or_email, query_update_account_password } from './account_queries.js';

package/dist/auth/audit_log_schema.d.ts

@@ -141,16 +141,16 @@ export declare const audit_metadata_schemas: Readonly<{
             concurrent_change: "concurrent_change";
         }>>;
         credential_type: z.ZodOptional<z.ZodEnum<{
-            daemon_token: "daemon_token";
             session: "session";
+            daemon_token: "daemon_token";
             api_token: "api_token";
         }>>;
     }, z.core.$loose>>;
     session_revoke: z.ZodObject<{
         session_id: z.core.$ZodBranded<z.ZodString, "SessionId", "out">;
         credential_type: z.ZodOptional<z.ZodEnum<{
-            daemon_token: "daemon_token";
             session: "session";
+            daemon_token: "daemon_token";
             api_token: "api_token";
         }>>;
     }, z.core.$loose>;
@@ -159,8 +159,8 @@ export declare const audit_metadata_schemas: Readonly<{
         reason: z.ZodOptional<z.ZodString>;
         attempted_account_id: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
         credential_type: z.ZodOptional<z.ZodEnum<{
-            daemon_token: "daemon_token";
             session: "session";
+            daemon_token: "daemon_token";
             api_token: "api_token";
         }>>;
     }, z.core.$loose>;
@@ -168,16 +168,16 @@ export declare const audit_metadata_schemas: Readonly<{
         token_id: z.ZodString;
         name: z.ZodString;
         credential_type: z.ZodOptional<z.ZodEnum<{
-            daemon_token: "daemon_token";
             session: "session";
+            daemon_token: "daemon_token";
             api_token: "api_token";
         }>>;
     }, z.core.$loose>;
     token_revoke: z.ZodObject<{
         token_id: z.ZodString;
         credential_type: z.ZodOptional<z.ZodEnum<{
-            daemon_token: "daemon_token";
             session: "session";
+            daemon_token: "daemon_token";
             api_token: "api_token";
         }>>;
     }, z.core.$loose>;

package/dist/auth/cell_action_specs.d.ts

@@ -385,8 +385,8 @@ export declare const CellListInput: z.ZodDefault<z.ZodObject<{
         updated_at: "updated_at";
     }>>;
     order_direction: z.ZodOptional<z.ZodEnum<{
-        asc: "asc";
         desc: "desc";
+        asc: "asc";
     }>>;
     limit: z.ZodOptional<z.ZodNumber>;
     offset: z.ZodOptional<z.ZodNumber>;
@@ -737,8 +737,8 @@ export declare const cell_list_action_spec: {
             updated_at: "updated_at";
         }>>;
         order_direction: z.ZodOptional<z.ZodEnum<{
-            asc: "asc";
             desc: "desc";
+            asc: "asc";
         }>>;
         limit: z.ZodOptional<z.ZodNumber>;
         offset: z.ZodOptional<z.ZodNumber>;
@@ -1090,8 +1090,8 @@ export declare const all_cell_action_specs: readonly [{
             updated_at: "updated_at";
         }>>;
         order_direction: z.ZodOptional<z.ZodEnum<{
-            asc: "asc";
             desc: "desc";
+            asc: "asc";
         }>>;
         limit: z.ZodOptional<z.ZodNumber>;
         offset: z.ZodOptional<z.ZodNumber>;

package/dist/auth/credential_type_schema.d.ts

@@ -45,8 +45,8 @@ export declare const CREDENTIAL_TYPE_DAEMON_TOKEN = "daemon_token";
 export declare const BUILTIN_CREDENTIAL_TYPES: readonly ["session", "api_token", "daemon_token"];
 /** Zod enum for builtin credential types only. */
 export declare const BuiltinCredentialType: z.ZodEnum<{
-    daemon_token: "daemon_token";
     session: "session";
+    daemon_token: "daemon_token";
     api_token: "api_token";
 }>;
 export type BuiltinCredentialType = z.infer<typeof BuiltinCredentialType>;

package/dist/auth/middleware.d.ts

@@ -17,27 +17,30 @@ import type { MiddlewareSpec } from '../http/middleware_spec.js';
  *
  * `create_app_server` mounts the stack here, and refuses at assembly (via
  * `assert_endpoint_in_auth_scope`, which `create_test_app_surface_spec` also
- * runs) an `rpc_endpoints` or `ws_endpoints` path the pattern does not match (tested
- * with `middleware_applies`, which follows Hono: `'/api/*'` matches `/api`
- * and everything under `/api/`): an endpoint outside it would get no
- * session parsing, so every call or upgrade would be unauthenticated.
+ * runs) an `rpc_endpoints`, `ws_endpoints`, or bootstrap path the pattern does
+ * not match (tested with `middleware_applies`, which follows Hono: `'/api/*'`
+ * matches `/api` and everything under `/api/`): an endpoint outside it would
+ * get no origin check or session parsing, so every call or upgrade would be
+ * unauthenticated and any page could send it.
  */
 export declare const AUTH_MIDDLEWARE_PATH = "/api/*";
 /**
  * Throw when an endpoint path sits outside the auth middleware's scope
- * (`AUTH_MIDDLEWARE_PATH`) — there it would get no session or bearer
- * parsing, so every call or upgrade would be unauthenticated.
+ * (`AUTH_MIDDLEWARE_PATH`) — there it would get no origin check and no
+ * session or bearer parsing, so every call or upgrade would be
+ * unauthenticated and any page could send it.
  * `middleware_applies` matches the way Hono matches the middleware's pattern.
  *
  * `create_app_server` calls it for every `rpc_endpoints` and `ws_endpoints`
- * path at assembly, and `create_test_app_surface_spec` does the same, so a
- * surface snapshot never records an endpoint the real server refuses.
+ * path and the bootstrap route at assembly, and `create_test_app_surface_spec`
+ * does the same, so a surface snapshot never records an endpoint the real
+ * server refuses.
  *
  * @param option - the option the path came from, named in the error
  * @param path - the endpoint path to check
  * @throws Error when `path` is outside `AUTH_MIDDLEWARE_PATH`
  */
-export declare const assert_endpoint_in_auth_scope: (option: "rpc_endpoints" | "ws_endpoints", path: string) => void;
+export declare const assert_endpoint_in_auth_scope: (option: "rpc_endpoints" | "ws_endpoints" | "bootstrap.route_prefix", path: string) => void;
 /**
  * Throw unless a middleware list still mounts every spec of the stack it was
  * built from — the trusted-proxy spec and the auth middleware — exactly once,
@@ -84,7 +87,7 @@ export interface AuthMiddlewareOptions {
  *
  * Returns `[origin, session, request_context, bearer_auth]` middleware specs
  * for the given path pattern. When `daemon_token_state` is provided, appends
- * a 5th `daemon_token` layer. Apps can append extra entries for non-standard
+ * a `daemon_token` layer. Apps can append extra entries for non-standard
  * paths (e.g., tx's `/tx` binary endpoint).
  *
  * @param deps - stateless capabilities (keyring, db)

package/dist/auth/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAIjE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,6BAA6B,GACzC,QAAQ,eAAe,GAAG,cAAc,EACxC,MAAM,MAAM,KACV,IAOF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,+BAA+B,GAC3C,aAAa,aAAa,CAAC,cAAc,CAAC,EAC1C,kBAAkB,aAAa,CAAC,cAAc,CAAC,KAC7C,IA+BF,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACrC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,kBAAkB,CAAC,EAAE,gBAAgB,CAAC;CACtC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CA4E/B,CAAC"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAIjE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAE7C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,6BAA6B,GACzC,QAAQ,eAAe,GAAG,cAAc,GAAG,wBAAwB,EACnE,MAAM,MAAM,KACV,IAQF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,+BAA+B,GAC3C,aAAa,aAAa,CAAC,cAAc,CAAC,EAC1C,kBAAkB,aAAa,CAAC,cAAc,CAAC,KAC7C,IA+BF,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACrC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,kBAAkB,CAAC,EAAE,gBAAgB,CAAC;CACtC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CA4E/B,CAAC"}

package/dist/auth/middleware.js

@@ -15,21 +15,24 @@ import { middleware_applies } from '../http/schema_helpers.js';
  *
  * `create_app_server` mounts the stack here, and refuses at assembly (via
  * `assert_endpoint_in_auth_scope`, which `create_test_app_surface_spec` also
- * runs) an `rpc_endpoints` or `ws_endpoints` path the pattern does not match (tested
- * with `middleware_applies`, which follows Hono: `'/api/*'` matches `/api`
- * and everything under `/api/`): an endpoint outside it would get no
- * session parsing, so every call or upgrade would be unauthenticated.
+ * runs) an `rpc_endpoints`, `ws_endpoints`, or bootstrap path the pattern does
+ * not match (tested with `middleware_applies`, which follows Hono: `'/api/*'`
+ * matches `/api` and everything under `/api/`): an endpoint outside it would
+ * get no origin check or session parsing, so every call or upgrade would be
+ * unauthenticated and any page could send it.
  */
 export const AUTH_MIDDLEWARE_PATH = '/api/*';
 /**
  * Throw when an endpoint path sits outside the auth middleware's scope
- * (`AUTH_MIDDLEWARE_PATH`) — there it would get no session or bearer
- * parsing, so every call or upgrade would be unauthenticated.
+ * (`AUTH_MIDDLEWARE_PATH`) — there it would get no origin check and no
+ * session or bearer parsing, so every call or upgrade would be
+ * unauthenticated and any page could send it.
  * `middleware_applies` matches the way Hono matches the middleware's pattern.
  *
  * `create_app_server` calls it for every `rpc_endpoints` and `ws_endpoints`
- * path at assembly, and `create_test_app_surface_spec` does the same, so a
- * surface snapshot never records an endpoint the real server refuses.
+ * path and the bootstrap route at assembly, and `create_test_app_surface_spec`
+ * does the same, so a surface snapshot never records an endpoint the real
+ * server refuses.
  *
  * @param option - the option the path came from, named in the error
  * @param path - the endpoint path to check
@@ -38,7 +41,8 @@ export const AUTH_MIDDLEWARE_PATH = '/api/*';
 export const assert_endpoint_in_auth_scope = (option, path) => {
     if (!middleware_applies(AUTH_MIDDLEWARE_PATH, path)) {
         throw new Error(`${option} path ${path} is outside the auth middleware's scope ` +
-            `(${AUTH_MIDDLEWARE_PATH}) — it would see every caller as unauthenticated — mount it under /api/`);
+            `(${AUTH_MIDDLEWARE_PATH}) — it would skip the origin check and see every caller ` +
+            `as unauthenticated — mount it under /api/`);
     }
 };
 /**
@@ -105,7 +109,7 @@ export const assert_middleware_stack_mounted = (stack_specs, middleware_specs) =
  *
  * Returns `[origin, session, request_context, bearer_auth]` middleware specs
  * for the given path pattern. When `daemon_token_state` is provided, appends
- * a 5th `daemon_token` layer. Apps can append extra entries for non-standard
+ * a `daemon_token` layer. Apps can append extra entries for non-standard
  * paths (e.g., tx's `/tx` binary endpoint).
  *
  * @param deps - stateless capabilities (keyring, db)

package/dist/cli/daemon.js

@@ -8,7 +8,6 @@
  * @module
  */
 import { z } from 'zod';
-import {} from '../runtime/deps.js';
 import { write_file_atomic } from '../runtime/fs.js';
 import { get_app_dir } from './config.js';
 /**

package/dist/cli/logger.js

@@ -11,7 +11,6 @@
  *
  * @module
  */
-import { Logger } from '@fuzdev/fuz_util/log.ts';
 /**
  * Creates a CLI logger wrapping a Logger with semantic output methods.
  *

package/dist/env/load.js

@@ -6,7 +6,6 @@
  *
  * @module
  */
-import { z } from 'zod';
 /**
  * Error thrown when environment validation fails.
  *

package/dist/hono_context.d.ts

@@ -24,8 +24,8 @@ import type { RequestContext } from './auth/request_context.js';
 export declare const CREDENTIAL_TYPES: readonly ["session", "api_token", "daemon_token"];
 /** Credential type — how a request was authenticated. */
 export declare const CredentialType: z.ZodEnum<{
-    daemon_token: "daemon_token";
     session: "session";
+    daemon_token: "daemon_token";
     api_token: "api_token";
 }>;
 export type CredentialType = z.infer<typeof CredentialType>;

package/dist/http/CLAUDE.md

@@ -167,12 +167,13 @@ Pair every schema with the `z.infer` type export.
 `merge_error_schemas(spec, middleware_errors?)` (in `http/schema_helpers.ts`)
 merges three layers, later overrides earlier at the same status code:
 
-1. **Derived** — from `derive_error_schemas({auth, has_input?, has_params?, has_query?, rate_limit?})`:
+1. **Derived** — from `derive_error_schemas({auth, has_input?, has_params?, has_query?, rate_limit?, checks_content_type?})`:
    - `has_input || has_params || has_query` → 400 `ValidationError`
    - `auth.account === 'required'` or `auth.actor === 'required'` → 401 `ApiError`
    - `auth.roles?.length` → 403 `PermissionError` (carries `required_roles`)
    - `auth.credential_types?.length` → 403 `CredentialTypeRequiredError` (carries `required_credential_types`; both gates set yields `z.union([PermissionError, CredentialTypeRequiredError])`)
    - `rate_limit` → 429 `RateLimitError`
+   - `checks_content_type` (every `POST`) → 415 `ApiError` (`unsupported_content_type`)
    - `auth.actor !== 'none'` → widens 400 to a union with `ActorRequiredError` / `ActorNotOnAccountError` and adds 500 union of `NoActorsOnAccountError` / `AccountVanishedError`. Mirrors what the dispatcher's authorization phase actually emits on routes whose input declares `acting?: ActingActor` (per registry-time invariant 2) — so DEV-mode error-schema validation doesn't reject the auth phase's body.
 2. **Middleware** — from `MiddlewareSpec.errors` that apply to the route's path (via `middleware_applies`)
 3. **Explicit** — `RouteSpec.errors` — always wins

package/dist/http/auth_shape.d.ts

@@ -91,9 +91,9 @@ export declare const parse_acting: (value: unknown) => string | undefined;
  *   without an actor binding).
  */
 export declare const AuthAxisState: z.ZodEnum<{
-    optional: "optional";
-    none: "none";
     required: "required";
+    none: "none";
+    optional: "optional";
 }>;
 export type AuthAxisState = z.infer<typeof AuthAxisState>;
 /**
@@ -123,14 +123,14 @@ export type AuthAxisState = z.infer<typeof AuthAxisState>;
  */
 export declare const RouteAuth: z.ZodObject<{
     account: z.ZodEnum<{
-        optional: "optional";
-        none: "none";
         required: "required";
+        none: "none";
+        optional: "optional";
     }>;
     actor: z.ZodEnum<{
-        optional: "optional";
-        none: "none";
         required: "required";
+        none: "none";
+        optional: "optional";
     }>;
     roles: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
     credential_types: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;

package/dist/http/error_schemas.d.ts

@@ -55,6 +55,12 @@ export declare const ERROR_INVALID_CREDENTIALS: "invalid_credentials";
 export declare const ERROR_PAYLOAD_TOO_LARGE: "payload_too_large";
 /** Request origin not in allowlist. */
 export declare const ERROR_FORBIDDEN_ORIGIN: "forbidden_origin";
+/**
+ * A `POST` whose `Content-Type` the route refuses: anything but
+ * `application/json` on a JSON route, a CORS-safelisted type or none on a
+ * `raw_body` one. See `http/simple_request.ts`.
+ */
+export declare const ERROR_UNSUPPORTED_CONTENT_TYPE: "unsupported_content_type";
 /** Bearer token failed validation (missing, malformed, or revoked). */
 export declare const ERROR_INVALID_TOKEN: "invalid_token";
 /** Token references a deleted account. */
@@ -290,9 +296,9 @@ export type RouteErrorSchemas = Partial<Record<number, z.ZodType>>;
  * - `'both'` — both keys.
  */
 export declare const RateLimitKey: z.ZodEnum<{
+    both: "both";
     account: "account";
     ip: "ip";
-    both: "both";
 }>;
 export type RateLimitKey = z.infer<typeof RateLimitKey>;
 /**
@@ -320,6 +326,9 @@ export type RateLimitKey = z.infer<typeof RateLimitKey>;
  *   of `NoActorsOnAccountError` / `AccountVanishedError`. The dispatcher's
  *   authorization phase emits these whenever it tries to resolve an actor.
  * - **rate_limit**: 429 (`RateLimitError` with `retry_after`).
+ * - **checks_content_type**: 415 (`ApiError`, `unsupported_content_type`) —
+ *   every `POST` route (see `is_post_content_type_refused` in
+ *   `http/simple_request.ts`).
  */
 export interface DeriveErrorSchemasOptions {
     auth: RouteAuth;
@@ -327,6 +336,7 @@ export interface DeriveErrorSchemasOptions {
     has_params?: boolean;
     has_query?: boolean;
     rate_limit?: RateLimitKey;
+    checks_content_type?: boolean;
 }
-export declare const derive_error_schemas: ({ auth, has_input, has_params, has_query, rate_limit }: DeriveErrorSchemasOptions) => RouteErrorSchemas;
+export declare const derive_error_schemas: ({ auth, has_input, has_params, has_query, rate_limit, checks_content_type }: DeriveErrorSchemasOptions) => RouteErrorSchemas;
 //# sourceMappingURL=error_schemas.d.ts.map

package/dist/http/error_schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error_schemas.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/error_schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAI9D,0CAA0C;AAC1C,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E,uDAAuD;AACvD,eAAO,MAAM,uBAAuB,EAAG,mBAA4B,CAAC;AAEpE,6CAA6C;AAC7C,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E,8CAA8C;AAC9C,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAI1E,wCAAwC;AACxC,eAAO,MAAM,6BAA6B,EAAG,yBAAkC,CAAC;AAEhF,+CAA+C;AAC/C,eAAO,MAAM,8BAA8B,EAAG,0BAAmC,CAAC;AAElF;;;;;;;;GAQG;AACH,eAAO,MAAM,8BAA8B,EAAG,0BAAmC,CAAC;AAElF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E,yCAAyC;AACzC,eAAO,MAAM,yBAAyB,EAAG,qBAA8B,CAAC;AAExE,sFAAsF;AACtF,eAAO,MAAM,yBAAyB,EAAG,qBAA8B,CAAC;AAExE,qDAAqD;AACrD,eAAO,MAAM,uBAAuB,EAAG,mBAA4B,CAAC;AAIpE,uCAAuC;AACvC,eAAO,MAAM,sBAAsB,EAAG,kBAA2B,CAAC;AAElE,uEAAuE;AACvE,eAAO,MAAM,mBAAmB,EAAG,eAAwB,CAAC;AAE5D,0CAA0C;AAC1C,eAAO,MAAM,uBAAuB,EAAG,mBAA4B,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAG,gBAAyB,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,EAAG,kBAA2B,CAAC;AAIlE,uDAAuD;AACvD,eAAO,MAAM,8BAA8B,EAAG,0BAAmC,CAAC;AAIlF,qEAAqE;AACrE,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E,8CAA8C;AAC9C,eAAO,MAAM,wBAAwB,EAAG,oBAA6B,CAAC;AAItE,0DAA0D;AAC1D,eAAO,MAAM,wBAAwB,EAAG,oBAA6B,CAAC;AAEtE,0GAA0G;AAC1G,eAAO,MAAM,qBAAqB,EAAG,iBAA0B,CAAC;AAEhE,gDAAgD;AAChD,eAAO,MAAM,sBAAsB,EAAG,kBAA2B,CAAC;AAElE,qEAAqE;AACrE,eAAO,MAAM,sBAAsB,EAAG,kBAA2B,CAAC;AAElE,6DAA6D;AAC7D,eAAO,MAAM,oCAAoC,EAAG,gCAAyC,CAAC;AAE9F,0DAA0D;AAC1D,eAAO,MAAM,iCAAiC,EAAG,6BAAsC,CAAC;AAIxF,6DAA6D;AAC7D,eAAO,MAAM,4BAA4B,EAAG,wBAAiC,CAAC;AAE9E,gEAAgE;AAChE,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E,oEAAoE;AACpE,eAAO,MAAM,wBAAwB,EAAG,oBAA6B,CAAC;AAItE,kDAAkD;AAClD,eAAO,MAAM,2BAA2B,EAAG,uBAAgC,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,qBAAqB,EAAG,iBAA0B,CAAC;AAEhE;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAG,qBAA8B,CAAC;AAExE,6CAA6C;AAC7C,eAAO,MAAM,mBAAmB,EAAG,eAAwB,CAAC;AAE5D,wEAAwE;AACxE,eAAO,MAAM,gCAAgC,EAAG,4BAAqC,CAAC;AAKtF,iFAAiF;AACjF,eAAO,MAAM,QAAQ;;iBAAuC,CAAC;AAC7D,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;iBAgB1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe;;;iBAG1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2BAA2B;;;iBAGtC,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEtF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,uBAAuB;;;iBAGlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E,2EAA2E;AAC3E,eAAO,MAAM,cAAc;;;iBAGzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,uFAAuF;AACvF,eAAO,MAAM,oBAAoB;;iBAE/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,qFAAqF;AACrF,eAAO,MAAM,eAAe;;iBAE1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,kBAAkB;;;;;;iBAG7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,eAAO,MAAM,sBAAsB;;iBAEjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,eAAO,MAAM,sBAAsB;;iBAEjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,eAAO,MAAM,oBAAoB;;iBAE/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AAEnE;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY;;;;EAAoC,CAAC;AAC9D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,yBAAyB;IACzC,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,YAAY,CAAC;CAC1B;AAED,eAAO,MAAM,oBAAoB,GAAI,wDAMlC,yBAAyB,KAAG,iBA0C9B,CAAC"}
+{"version":3,"file":"error_schemas.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/error_schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAI9D,0CAA0C;AAC1C,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E,uDAAuD;AACvD,eAAO,MAAM,uBAAuB,EAAG,mBAA4B,CAAC;AAEpE,6CAA6C;AAC7C,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E,8CAA8C;AAC9C,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAI1E,wCAAwC;AACxC,eAAO,MAAM,6BAA6B,EAAG,yBAAkC,CAAC;AAEhF,+CAA+C;AAC/C,eAAO,MAAM,8BAA8B,EAAG,0BAAmC,CAAC;AAElF;;;;;;;;GAQG;AACH,eAAO,MAAM,8BAA8B,EAAG,0BAAmC,CAAC;AAElF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E,yCAAyC;AACzC,eAAO,MAAM,yBAAyB,EAAG,qBAA8B,CAAC;AAExE,sFAAsF;AACtF,eAAO,MAAM,yBAAyB,EAAG,qBAA8B,CAAC;AAExE,qDAAqD;AACrD,eAAO,MAAM,uBAAuB,EAAG,mBAA4B,CAAC;AAIpE,uCAAuC;AACvC,eAAO,MAAM,sBAAsB,EAAG,kBAA2B,CAAC;AAElE;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,EAAG,0BAAmC,CAAC;AAElF,uEAAuE;AACvE,eAAO,MAAM,mBAAmB,EAAG,eAAwB,CAAC;AAE5D,0CAA0C;AAC1C,eAAO,MAAM,uBAAuB,EAAG,mBAA4B,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAG,gBAAyB,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,EAAG,kBAA2B,CAAC;AAIlE,uDAAuD;AACvD,eAAO,MAAM,8BAA8B,EAAG,0BAAmC,CAAC;AAIlF,qEAAqE;AACrE,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E,8CAA8C;AAC9C,eAAO,MAAM,wBAAwB,EAAG,oBAA6B,CAAC;AAItE,0DAA0D;AAC1D,eAAO,MAAM,wBAAwB,EAAG,oBAA6B,CAAC;AAEtE,0GAA0G;AAC1G,eAAO,MAAM,qBAAqB,EAAG,iBAA0B,CAAC;AAEhE,gDAAgD;AAChD,eAAO,MAAM,sBAAsB,EAAG,kBAA2B,CAAC;AAElE,qEAAqE;AACrE,eAAO,MAAM,sBAAsB,EAAG,kBAA2B,CAAC;AAElE,6DAA6D;AAC7D,eAAO,MAAM,oCAAoC,EAAG,gCAAyC,CAAC;AAE9F,0DAA0D;AAC1D,eAAO,MAAM,iCAAiC,EAAG,6BAAsC,CAAC;AAIxF,6DAA6D;AAC7D,eAAO,MAAM,4BAA4B,EAAG,wBAAiC,CAAC;AAE9E,gEAAgE;AAChE,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E,oEAAoE;AACpE,eAAO,MAAM,wBAAwB,EAAG,oBAA6B,CAAC;AAItE,kDAAkD;AAClD,eAAO,MAAM,2BAA2B,EAAG,uBAAgC,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,qBAAqB,EAAG,iBAA0B,CAAC;AAEhE;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAG,qBAA8B,CAAC;AAExE,6CAA6C;AAC7C,eAAO,MAAM,mBAAmB,EAAG,eAAwB,CAAC;AAE5D,wEAAwE;AACxE,eAAO,MAAM,gCAAgC,EAAG,4BAAqC,CAAC;AAKtF,iFAAiF;AACjF,eAAO,MAAM,QAAQ;;iBAAuC,CAAC;AAC7D,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;iBAgB1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe;;;iBAG1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2BAA2B;;;iBAGtC,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEtF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,uBAAuB;;;iBAGlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E,2EAA2E;AAC3E,eAAO,MAAM,cAAc;;;iBAGzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,uFAAuF;AACvF,eAAO,MAAM,oBAAoB;;iBAE/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,qFAAqF;AACrF,eAAO,MAAM,eAAe;;iBAE1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,kBAAkB;;;;;;iBAG7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,eAAO,MAAM,sBAAsB;;iBAEjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,eAAO,MAAM,sBAAsB;;iBAEjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,eAAO,MAAM,oBAAoB;;iBAE/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AAEnE;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY;;;;EAAoC,CAAC;AAC9D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,WAAW,yBAAyB;IACzC,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,eAAO,MAAM,oBAAoB,GAAI,6EAOlC,yBAAyB,KAAG,iBA8C9B,CAAC"}