@fuzdev/fuz_app 0.131.0 → 0.132.0

package/dist/testing/attack_surface.js

@@ -91,13 +91,17 @@ export const describe_adversarial_auth = (options) => {
     const spec_lookup = build_route_spec_lookup(route_specs);
     const test_path = (route) => resolve_valid_path(route.path, spec_lookup.get(`${route.method} ${route.path}`)?.params);
     const apps = create_auth_test_apps(route_specs, roles);
+    // every route's request carries the JSON content type a real client sends, so
+    // the per-route content-type check (415) never answers ahead of the auth gate
+    const probe_init = (route) => ({
+        method: route.method,
+        headers: { 'content-type': 'application/json' }
+    });
     describe('adversarial HTTP auth enforcement', () => {
         describe('unauthenticated → 401', () => {
             for (const route of protected_routes) {
                 test(`${route.method} ${route.path}`, async () => {
-                    const res = await apps.public.request(test_path(route), {
-                        method: route.method
-                    });
+                    const res = await apps.public.request(test_path(route), probe_init(route));
                     assert.strictEqual(res.status, 401, `${route.method} ${route.path}`);
                     const body = await res.json();
                     assert.strictEqual(body.error, ERROR_AUTHENTICATION_REQUIRED);
@@ -126,9 +130,7 @@ export const describe_adversarial_auth = (options) => {
                             const app = apps.by_role.get(wrong_role);
                             if (!app)
                                 throw new Error(`No test app for role '${wrong_role}'`);
-                            const res = await app.request(test_path(route), {
-                                method: route.method
-                            });
+                            const res = await app.request(test_path(route), probe_init(route));
                             assert.strictEqual(res.status, 403, `${route.method} ${route.path}`);
                             const body = await res.json();
                             assert.strictEqual(body.error, ERROR_INSUFFICIENT_PERMISSIONS);
@@ -141,9 +143,7 @@ export const describe_adversarial_auth = (options) => {
             describe('authenticated without role → 403', () => {
                 for (const route of role_only_routes) {
                     test(`${route.method} ${route.path}`, async () => {
-                        const res = await apps.authed.request(test_path(route), {
-                            method: route.method
-                        });
+                        const res = await apps.authed.request(test_path(route), probe_init(route));
                         assert.strictEqual(res.status, 403, `${route.method} ${route.path}`);
                         const body = await res.json();
                         assert.strictEqual(body.error, ERROR_INSUFFICIENT_PERMISSIONS);
@@ -175,9 +175,9 @@ export const describe_adversarial_auth = (options) => {
                         continue;
                     }
                     test(`${route.method} ${route.path} (${refused})`, async () => {
-                        const res = await apps.by_credential_type.get(refused).request(test_path(route), {
-                            method: route.method
-                        });
+                        const res = await apps.by_credential_type
+                            .get(refused)
+                            .request(test_path(route), probe_init(route));
                         assert.strictEqual(res.status, 403, `${route.method} ${route.path}`);
                         const body = await res.json();
                         assert.strictEqual(body.error, ERROR_CREDENTIAL_TYPE_REQUIRED);
@@ -190,12 +190,11 @@ export const describe_adversarial_auth = (options) => {
         describe('correct auth passes guard', () => {
             for (const route of protected_routes) {
                 test(`${route.method} ${route.path}`, async () => {
-                    const res = await select_auth_app(apps, route.auth).request(test_path(route), {
-                        method: route.method
-                    });
+                    const res = await select_auth_app(apps, route.auth).request(test_path(route), probe_init(route));
                     // handler may error (500) or return 404 (stub deps) — that's fine, we only verify auth passed
                     assert.notStrictEqual(res.status, 401, 'should not be 401 (auth rejected)');
                     assert.notStrictEqual(res.status, 403, 'should not be 403 (role rejected)');
+                    assert.notStrictEqual(res.status, 415, 'should not be 415 (content type refused)');
                     // handler-level 404 (resource not found with stub deps) is fine —
                     // only reject router-level 404 (route not registered)
                     if (res.status === 404) {

package/dist/testing/audit_completeness.js

@@ -155,7 +155,7 @@ export const describe_audit_completeness_tests = (options) => {
                 assert.ok(logout_route, 'Expected POST /logout route');
                 const res = await fixture.transport(logout_route.path, {
                     method: 'POST',
-                    headers: fixture.create_session_headers()
+                    headers: fixture.create_session_headers({ 'content-type': 'application/json' })
                 });
                 assert.strictEqual(res.status, 200);
                 const events = await list_audit_events({ request: fixture.transport }, rpc_path, observer);

package/dist/testing/cross_backend/action_manifest.d.ts

@@ -49,15 +49,15 @@ export declare const ActionManifestEntry: z.ZodObject<{
     side_effects: z.ZodBoolean;
     /** The `account` auth axis. */
     account: z.ZodEnum<{
-        optional: "optional";
-        none: "none";
         required: "required";
+        none: "none";
+        optional: "optional";
     }>;
     /** The `actor` auth axis. */
     actor: z.ZodEnum<{
-        optional: "optional";
-        none: "none";
         required: "required";
+        none: "none";
+        optional: "optional";
     }>;
     /** Required roles (any-of), sorted; `[]` when the action declares no role gate. */
     roles: z.ZodArray<z.ZodString>;
@@ -65,9 +65,9 @@ export declare const ActionManifestEntry: z.ZodObject<{
     credential_types: z.ZodArray<z.ZodString>;
     /** Per-action rate-limit class, or `null` when the action declares none. */
     rate_limit: z.ZodNullable<z.ZodEnum<{
+        both: "both";
         account: "account";
         ip: "ip";
-        both: "both";
     }>>;
 }, z.core.$strict>;
 export type ActionManifestEntry = z.infer<typeof ActionManifestEntry>;
@@ -80,15 +80,15 @@ export declare const ActionManifest: z.ZodObject<{
         side_effects: z.ZodBoolean;
         /** The `account` auth axis. */
         account: z.ZodEnum<{
-            optional: "optional";
-            none: "none";
             required: "required";
+            none: "none";
+            optional: "optional";
         }>;
         /** The `actor` auth axis. */
         actor: z.ZodEnum<{
-            optional: "optional";
-            none: "none";
             required: "required";
+            none: "none";
+            optional: "optional";
         }>;
         /** Required roles (any-of), sorted; `[]` when the action declares no role gate. */
         roles: z.ZodArray<z.ZodString>;
@@ -96,9 +96,9 @@ export declare const ActionManifest: z.ZodObject<{
         credential_types: z.ZodArray<z.ZodString>;
         /** Per-action rate-limit class, or `null` when the action declares none. */
         rate_limit: z.ZodNullable<z.ZodEnum<{
+            both: "both";
             account: "account";
             ip: "ip";
-            both: "both";
         }>>;
     }, z.core.$strict>>;
 }, z.core.$strict>;

package/dist/testing/cross_backend/simple_request.d.ts

@@ -0,0 +1,11 @@
+import '../assert_dev_env.js';
+import type { RpcPathCrossSuiteOptions } from './setup.js';
+/** Options for the simple-request parity suite. */
+export interface SimpleRequestCrossTestOptions extends RpcPathCrossSuiteOptions {
+    /** REST login route path. Default `/api/account/login` (the spine convention). */
+    readonly login_path?: string;
+    /** REST logout route path. Default `/api/account/logout` (the spine convention). */
+    readonly logout_path?: string;
+}
+export declare const describe_simple_request_cross_tests: (options: SimpleRequestCrossTestOptions) => void;
+//# sourceMappingURL=simple_request.d.ts.map

package/dist/testing/cross_backend/simple_request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"simple_request.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/simple_request.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA6B9B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AAGxE,mDAAmD;AACnD,MAAM,WAAW,6BAA8B,SAAQ,wBAAwB;IAC9E,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,oFAAoF;IACpF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAaD,eAAO,MAAM,mCAAmC,GAC/C,SAAS,6BAA6B,KACpC,IAuHF,CAAC"}

package/dist/testing/cross_backend/simple_request.js

@@ -0,0 +1,142 @@
+import '../assert_dev_env.js';
+/**
+ * Cross-backend parity suite for refusing CORS simple requests.
+ *
+ * A `POST` with no `Content-Type`, or a `text/plain` / form / multipart one,
+ * is what a browser sends cross-origin without a preflight — carrying the
+ * session cookie when the page is same-site, which any other `localhost`
+ * port is. Every spine's JSON routes require `application/json` and refuse
+ * anything else with a flat `415` `{error: 'unsupported_content_type'}`
+ * before reading a credential or the body: the TS spine per route
+ * (`apply_route_specs`, every `POST` that isn't `raw_body`), the Rust spine
+ * in each JSON handler. The cases carry an allowed `Origin` and, where it
+ * matters, the keeper's session — the exact shape of a same-site page's
+ * forged request, which the origin allowlist alone admits when it's a
+ * wildcard — and a refused request must leave that session untouched.
+ *
+ * Runs both legs via the shared `setup_test` protocol: in-process
+ * (`auth/simple_request_parity.db.test.ts`) and cross-process
+ * (`cross_backend/simple_request.cross.test.ts`). Every spine has the gate,
+ * so the suite is ungated.
+ *
+ * @module
+ */
+import { describe, test, assert } from 'vitest';
+import { account_verify_action_spec } from '../../auth/account_action_specs.js';
+import { ERROR_UNSUPPORTED_CONTENT_TYPE } from '../../http/error_schemas.js';
+import { SPINE_RPC_PATH } from './spine_surface_constants.js';
+/** Build the JSON-RPC envelope body for a nullary `account_verify` call. */
+const verify_envelope = (id) => JSON.stringify({ jsonrpc: '2.0', method: account_verify_action_spec.method, id });
+/** Assert a flat `415` content-type refusal. */
+const assert_refused = async (res, label) => {
+    assert.strictEqual(res.status, 415, `${label} must be refused with 415`);
+    const body = (await res.json().catch(() => undefined));
+    assert.strictEqual(body?.error, ERROR_UNSUPPORTED_CONTENT_TYPE, label);
+};
+export const describe_simple_request_cross_tests = (options) => {
+    const { setup_test } = options;
+    const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
+    const login_path = options.login_path ?? '/api/account/login';
+    const logout_path = options.logout_path ?? '/api/account/logout';
+    /** POST a JSON `account_verify` with the fixture's session — 200 while it's valid. */
+    const verify_session = async (fixture, id) => {
+        const res = await fixture.transport(rpc_path, {
+            method: 'POST',
+            headers: { ...fixture.create_session_headers(), 'content-type': 'application/json' },
+            body: verify_envelope(id)
+        });
+        return res.status;
+    };
+    describe('CORS simple-request refusal parity', () => {
+        test('a CORS-safelisted RPC POST with a session → 415, in any spelling', async () => {
+            const fixture = await setup_test();
+            for (const content_type of [
+                'text/plain;charset=UTF-8',
+                'Text/Plain',
+                'application/x-www-form-urlencoded',
+                'multipart/form-data; boundary=x'
+            ]) {
+                const res = await fixture.transport(rpc_path, {
+                    method: 'POST',
+                    headers: { ...fixture.create_session_headers(), 'content-type': content_type },
+                    body: verify_envelope('simple-safelisted')
+                });
+                await assert_refused(res, `a ${content_type} RPC POST`);
+            }
+        });
+        test('RPC POST with no Content-Type → 415', async () => {
+            const fixture = await setup_test();
+            // a byte body, so `fetch` adds no `Content-Type` of its own (a string
+            // body would get `text/plain;charset=UTF-8`)
+            const res = await fixture.transport(rpc_path, {
+                method: 'POST',
+                headers: fixture.create_session_headers(),
+                body: new TextEncoder().encode(verify_envelope('simple-untyped'))
+            });
+            await assert_refused(res, 'an untyped RPC POST');
+        });
+        test('a JSON route refuses any type but application/json', async () => {
+            const fixture = await setup_test();
+            for (const content_type of ['application/octet-stream', 'application/vnd.api+json', '']) {
+                const res = await fixture.transport(rpc_path, {
+                    method: 'POST',
+                    headers: { ...fixture.create_session_headers(), 'content-type': content_type },
+                    body: verify_envelope('simple-not-json')
+                });
+                await assert_refused(res, `an RPC POST typed '${content_type}'`);
+                const login = await fixture.fresh_transport()(login_path, {
+                    method: 'POST',
+                    headers: { 'content-type': content_type },
+                    body: JSON.stringify({ username: 'keeper', password: 'whatever' })
+                });
+                await assert_refused(login, `a login typed '${content_type}'`);
+            }
+        });
+        test('form-encoded login → 415', async () => {
+            const fixture = await setup_test();
+            const res = await fixture.fresh_transport()(login_path, {
+                method: 'POST',
+                headers: { 'content-type': 'application/x-www-form-urlencoded' },
+                body: 'username=keeper&password=whatever'
+            });
+            await assert_refused(res, 'a form-encoded login');
+        });
+        test('a forged text/plain logout with a session → 415, and the session survives', async () => {
+            const fixture = await setup_test();
+            const res = await fixture.transport(logout_path, {
+                method: 'POST',
+                headers: { ...fixture.create_session_headers(), 'content-type': 'text/plain' }
+            });
+            await assert_refused(res, 'a text/plain logout');
+            assert.strictEqual(await verify_session(fixture, 'after-forged-logout'), 200, 'the refused logout must not end the session');
+        });
+        test('an untyped logout with no session → 415, before the auth check', async () => {
+            const fixture = await setup_test();
+            const res = await fixture.fresh_transport()(logout_path, {
+                method: 'POST',
+                headers: { 'content-type': 'application/octet-stream' }
+            });
+            await assert_refused(res, 'an octet-stream logout');
+        });
+        test('JSON logout with no body and no session → 401, not 415', async () => {
+            const fixture = await setup_test();
+            const res = await fixture.fresh_transport()(logout_path, {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' }
+            });
+            assert.strictEqual(res.status, 401, 'a bodyless JSON logout must reach the auth check');
+        });
+        test('application/json with a charset → dispatched', async () => {
+            const fixture = await setup_test();
+            const res = await fixture.transport(rpc_path, {
+                method: 'POST',
+                headers: {
+                    ...fixture.create_session_headers(),
+                    'content-type': 'application/json; charset=utf-8'
+                },
+                body: verify_envelope('json-charset')
+            });
+            assert.strictEqual(res.status, 200, 'a JSON RPC POST must be dispatched');
+        });
+    });
+};

package/dist/testing/cross_backend/testing_reset_actions.d.ts

@@ -427,21 +427,21 @@ export declare const testing_action_manifest_action_spec: {
             method: z.ZodString;
             side_effects: z.ZodBoolean;
             account: z.ZodEnum<{
-                optional: "optional";
-                none: "none";
                 required: "required";
+                none: "none";
+                optional: "optional";
             }>;
             actor: z.ZodEnum<{
-                optional: "optional";
-                none: "none";
                 required: "required";
+                none: "none";
+                optional: "optional";
             }>;
             roles: z.ZodArray<z.ZodString>;
             credential_types: z.ZodArray<z.ZodString>;
             rate_limit: z.ZodNullable<z.ZodEnum<{
+                both: "both";
                 account: "account";
                 ip: "ip";
-                both: "both";
             }>>;
         }, z.core.$strict>>;
     }, z.core.$strict>;

package/dist/testing/integration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"integration.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/integration.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAsB7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAMhE,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAkB1B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAW,KAAK,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAKpF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAG1D;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC9C;;;;OAIG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;;;;;;;OASG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,kEAAkE;IAClE,YAAY,EAAE,mBAAmB,CAAC;IAClC;;;;OAIG;IACH,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;;;;;;;;OAYG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,mCAAmC,GAC/C,SAAS,8BAA8B,KACrC,IAs8CF,CAAC"}
+{"version":3,"file":"integration.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/integration.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAsB7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAMhE,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAkB1B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EAAW,KAAK,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAKpF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAG1D;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC9C;;;;OAIG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;;;;;;;OASG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,kEAAkE;IAClE,YAAY,EAAE,mBAAmB,CAAC;IAClC;;;;OAIG;IACH,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;;;;;;;;OAYG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,mCAAmC,GAC/C,SAAS,8BAA8B,KACrC,IAw+CF,CAAC"}

package/dist/testing/integration.js

@@ -72,6 +72,17 @@ export const describe_standard_integration_tests = (options) => {
         const { cookie_name } = options.session_options;
         // Error coverage tracking across test groups
         const error_collector = new ErrorCoverageCollector();
+        // the auth routes this suite drives: login / logout / password, signup
+        // (when wired), and the shared RPC endpoint — admin-role routes belong to
+        // the admin suite
+        const is_suite_auth_route = (s) => {
+            if (s.auth.roles?.includes('admin') ?? false)
+                return false;
+            const rest_suffixes = ['/login', '/logout', '/password', '/signup'];
+            if (rest_suffixes.some((suffix) => s.path.endsWith(suffix)))
+                return true;
+            return s.path === rpc_path;
+        };
         afterAll(() => {
             // Scope coverage to auth routes this suite actually exercises:
             // login / logout / password drivers + signup invite edge cases
@@ -83,14 +94,7 @@ export const describe_standard_integration_tests = (options) => {
             // `create_test_app_for_bootstrap`. Consumer-specific
             // routes would dilute the ratio; admin-role routes are scoped to
             // the admin suite instead.
-            const auth_routes = route_specs.filter((s) => {
-                if (s.auth.roles?.includes('admin') ?? false)
-                    return false;
-                const rest_suffixes = ['/login', '/logout', '/password', '/signup'];
-                if (rest_suffixes.some((suffix) => s.path.endsWith(suffix)))
-                    return true;
-                return s.path === rpc_path;
-            });
+            const auth_routes = route_specs.filter(is_suite_auth_route);
             assert_error_coverage(error_collector, auth_routes.length > 0 ? auth_routes : route_specs, {
                 min_coverage: options.error_coverage_min ?? DEFAULT_INTEGRATION_ERROR_COVERAGE,
                 // Authorization denials (403) on these scoped auth routes — the
@@ -233,7 +237,7 @@ export const describe_standard_integration_tests = (options) => {
                 // Logout
                 const logout_res = await fixture.transport(logout_route.path, {
                     method: 'POST',
-                    headers: create_headers()
+                    headers: { ...create_headers(), 'content-type': 'application/json' }
                 });
                 assert.strictEqual(logout_res.status, 200);
                 const logout_body = await logout_res.json();
@@ -633,7 +637,11 @@ export const describe_standard_integration_tests = (options) => {
                     path: rpc_path,
                     spec: account_verify_action_spec,
                     params: undefined,
-                    headers: { ...bearer_headers, origin: 'http://localhost:5173' }
+                    headers: {
+                        ...bearer_headers,
+                        origin: 'http://localhost:5173',
+                        'content-type': 'application/json'
+                    }
                 });
                 assert.strictEqual(res.status, 401);
             });
@@ -1029,7 +1037,11 @@ export const describe_standard_integration_tests = (options) => {
                 });
                 const res = await fixture.fresh_transport()(logout_route.path, {
                     method: 'POST',
-                    headers: { ...bearer_headers, origin: 'http://localhost:5173' }
+                    headers: {
+                        ...bearer_headers,
+                        origin: 'http://localhost:5173',
+                        'content-type': 'application/json'
+                    }
                 });
                 assert.strictEqual(res.status, 401, 'Bearer with Origin should be discarded → unauthenticated');
                 error_collector.record(route_specs, 'POST', logout_route.path, 401);
@@ -1049,6 +1061,23 @@ export const describe_standard_integration_tests = (options) => {
                 error_collector.record(route_specs, 'POST', password_route.path, 401);
             });
         });
+        // --- 12b. Content type: every JSON POST route refuses an untyped body ---
+        describe('JSON routes refuse an untyped POST', () => {
+            test('each scoped JSON POST route answers an untyped POST with 415', async () => {
+                const fixture = await options.setup_test();
+                const json_post_routes = route_specs.filter((s) => s.method === 'POST' && !s.raw_body && is_suite_auth_route(s));
+                assert.ok(json_post_routes.length > 0, 'Expected JSON POST routes');
+                for (const route of json_post_routes) {
+                    // a byte body, so `fetch` adds no `Content-Type` of its own
+                    const res = await fixture.fresh_transport()(route.path, {
+                        method: 'POST',
+                        body: new TextEncoder().encode('{}')
+                    });
+                    assert.strictEqual(res.status, 415, `untyped POST ${route.path}`);
+                    await error_collector.assert_and_record(route_specs, 'POST', route.path, res);
+                }
+            });
+        });
         // --- 13. Password change revokes API tokens ---
         describe('password change revokes API tokens', () => {
             test('API tokens are invalidated after password change', async () => {

package/dist/testing/rpc_helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rpc_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/rpc_helpers.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAa7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAIN,KAAK,gBAAgB,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EACX,qBAAqB,EACrB,mBAAmB,EACnB,eAAe,EACf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAGhE;;;;;;;;;GASG;AACH,MAAM,MAAM,uBAAuB,GAClC,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;AAE9E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,+BAA+B,GAC3C,eAAe,uBAAuB,EACtC,iBAAiB,cAAc,CAAC,MAAM,CAAC,KACrC,KAAK,CAAC,eAAe,CAuBvB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,GAChC,QAAQ,MAAM,EACd,SAAS,OAAO,EAChB,KAAI,MAAM,GAAG,MAAe,KAC1B,WAQF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,GAC9B,eAAe,MAAM,EACrB,QAAQ,MAAM,EACd,SAAS,OAAO,EAChB,KAAI,MAAM,GAAG,MAAe,KAC1B,MAMF,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,OAAO,EACb,gBAAgB,gBAAgB,KAC9B,IAUF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,+BAA+B,GAAI,MAAM,OAAO,EAAE,gBAAgB,CAAC,CAAC,OAAO,KAAG,IAa1F,CAAC;AAIF;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAErF,2DAA2D;AAC3D,eAAO,MAAM,cAAc,GACzB,KAAK;IACL,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;CAC5E,KAAG,gBAEmB,CAAC;AAEzB;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,GAAI,SAAS,OAAO,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAMzE,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,aAAa,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAC9E;IACA,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CACxD,CAAC;AAEL;;;;GAIG;AACH,MAAM,MAAM,UAAU,GACnB;IAAE,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAA;CAAE,GAC/E,gBAAgB,CAAC;AAEpB,gCAAgC;AAChC,MAAM,WAAW,WAAW;IAC3B,yDAAyD;IACzD,GAAG,EAAE,UAAU,CAAC;IAChB,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,wCAAwC;IACxC,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,mFAAmF;IACnF,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACtB;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAClC;AAcD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,QAAQ,GAAU,MAAM,WAAW,KAAG,OAAO,CAAC,aAAa,CA8DvE,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,KAChD,OAAO,CAAC,aAAa,CAAyD,CAAC;AAElF;;;;;GAKG;AACH,MAAM,MAAM,oBAAoB,CAAC,KAAK,SAAS,yBAAyB,IACrE;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAA;CAAE,GAC/F;IACA,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CACxD,CAAC;AAEL,mFAAmF;AACnF,MAAM,MAAM,kBAAkB,CAAC,KAAK,SAAS,yBAAyB,IAAI,IAAI,CAC7E,WAAW,EACX,QAAQ,GAAG,QAAQ,CACnB,GAAG;IACH,2GAA2G;IAC3G,IAAI,EAAE,KAAK,CAAC;IACZ,0CAA0C;IAC1C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;CAChC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,GAAU,KAAK,SAAS,yBAAyB,EAC9E,MAAM,kBAAkB,CAAC,KAAK,CAAC,KAC7B,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAoBrC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GAAU,CAAC,EACrC,MAAM,WAAW,EACjB,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KACzB,OAAO,CAAC,CAAC,CAkBX,CAAC;AAIF;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAC3B,eAAe,aAAa,CAAC,eAAe,CAAC,EAC7C,QAAQ,MAAM,KACZ;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAE,GAAG,SAOxC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAC3B,eAAe,aAAa,CAAC,qBAAqB,CAAC,EACnD,QAAQ,MAAM,KACZ;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,mBAAmB,CAAA;CAAE,GAAG,SAOvD,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yBAAyB,GACrC,eAAe,aAAa,CAAC,eAAe,CAAC,KAC3C,MAcF,CAAC"}
+{"version":3,"file":"rpc_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/rpc_helpers.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAa7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAIN,KAAK,gBAAgB,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EACX,qBAAqB,EACrB,mBAAmB,EACnB,eAAe,EACf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAGhE;;;;;;;;;GASG;AACH,MAAM,MAAM,uBAAuB,GAClC,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;AAE9E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,+BAA+B,GAC3C,eAAe,uBAAuB,EACtC,iBAAiB,cAAc,CAAC,MAAM,CAAC,KACrC,KAAK,CAAC,eAAe,CAuBvB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,GAChC,QAAQ,MAAM,EACd,SAAS,OAAO,EAChB,KAAI,MAAM,GAAG,MAAe,KAC1B,WAQF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,GAC9B,eAAe,MAAM,EACrB,QAAQ,MAAM,EACd,SAAS,OAAO,EAChB,KAAI,MAAM,GAAG,MAAe,KAC1B,MAMF,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,OAAO,EACb,gBAAgB,gBAAgB,KAC9B,IAUF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,+BAA+B,GAAI,MAAM,OAAO,EAAE,gBAAgB,CAAC,CAAC,OAAO,KAAG,IAa1F,CAAC;AAIF;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAErF,2DAA2D;AAC3D,eAAO,MAAM,cAAc,GACzB,KAAK;IACL,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;CAC5E,KAAG,gBAEmB,CAAC;AAEzB;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,GAAI,SAAS,OAAO,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAMzE,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,aAAa,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAC9E;IACA,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CACxD,CAAC;AAEL;;;;GAIG;AACH,MAAM,MAAM,UAAU,GACnB;IAAE,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAA;CAAE,GAC/E,gBAAgB,CAAC;AAEpB,gCAAgC;AAChC,MAAM,WAAW,WAAW;IAC3B,yDAAyD;IACzD,GAAG,EAAE,UAAU,CAAC;IAChB,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,wCAAwC;IACxC,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,mFAAmF;IACnF,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACtB;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAClC;AAgCD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,QAAQ,GAAU,MAAM,WAAW,KAAG,OAAO,CAAC,aAAa,CA0DvE,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,KAChD,OAAO,CAAC,aAAa,CAAyD,CAAC;AAElF;;;;;GAKG;AACH,MAAM,MAAM,oBAAoB,CAAC,KAAK,SAAS,yBAAyB,IACrE;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAA;CAAE,GAC/F;IACA,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CACxD,CAAC;AAEL,mFAAmF;AACnF,MAAM,MAAM,kBAAkB,CAAC,KAAK,SAAS,yBAAyB,IAAI,IAAI,CAC7E,WAAW,EACX,QAAQ,GAAG,QAAQ,CACnB,GAAG;IACH,2GAA2G;IAC3G,IAAI,EAAE,KAAK,CAAC;IACZ,0CAA0C;IAC1C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;CAChC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,GAAU,KAAK,SAAS,yBAAyB,EAC9E,MAAM,kBAAkB,CAAC,KAAK,CAAC,KAC7B,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAoBrC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GAAU,CAAC,EACrC,MAAM,WAAW,EACjB,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KACzB,OAAO,CAAC,CAAC,CAkBX,CAAC;AAIF;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAC3B,eAAe,aAAa,CAAC,eAAe,CAAC,EAC7C,QAAQ,MAAM,KACZ;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAE,GAAG,SAOxC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAC3B,eAAe,aAAa,CAAC,qBAAqB,CAAC,EACnD,QAAQ,MAAM,KACZ;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,mBAAmB,CAAA;CAAE,GAAG,SAOvD,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yBAAyB,GACrC,eAAe,aAAa,CAAC,eAAe,CAAC,KAC3C,MAcF,CAAC"}

package/dist/testing/rpc_helpers.js

@@ -9,7 +9,6 @@ import './assert_dev_env.js';
  * @module
  */
 import { assert } from 'vitest';
-import { z } from 'zod';
 import { JSONRPC_VERSION, JsonrpcErrorResponse, JsonrpcResponse } from '../http/jsonrpc.js';
 import { create_stub_app_server_context } from './stubs.js';
 /**
@@ -146,6 +145,23 @@ const RPC_CALL_DEFAULT_HEADERS_BASE = {
     host: 'localhost',
     'Content-Type': 'application/json'
 };
+/**
+ * Merge header records case-insensitively, later sources replacing earlier
+ * ones — a plain spread would keep `Content-Type` and `content-type` as two
+ * keys, which `fetch` joins into one comma-separated value. Names come out
+ * lowercased; values pass through unvalidated, so a test can still send a
+ * malformed header to the server.
+ */
+const merge_header_records = (...sources) => {
+    const merged = {};
+    for (const source of sources) {
+        if (!source)
+            continue;
+        for (const [name, value] of Object.entries(source))
+            merged[name.toLowerCase()] = value;
+    }
+    return merged;
+};
 /** Default headers merged into every `rpc_call` request. Includes `origin`. */
 const RPC_CALL_DEFAULT_HEADERS = {
     ...RPC_CALL_DEFAULT_HEADERS_BASE,
@@ -172,18 +188,14 @@ export const rpc_call = async (args) => {
     let init;
     if (verb === 'GET') {
         url = create_rpc_get_url(path, method, params, id);
-        init = { method: 'GET', headers: { ...defaults, ...headers } };
+        init = { method: 'GET', headers: merge_header_records(defaults, headers) };
     }
     else {
         url = path;
         const post = create_rpc_post_init(method, params, id);
         init = {
             method: 'POST',
-            headers: {
-                ...defaults,
-                ...post.headers,
-                ...headers
-            },
+            headers: merge_header_records(defaults, post.headers, headers),
             body: post.body
         };
     }

package/dist/testing/stubs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stubs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/stubs.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAa7B,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAsB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAI3E,OAAO,EAEN,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAGN,KAAK,cAAc,EACnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,SAAS,EAAmB,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAA+B,KAAK,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAS9F;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,GAAG,GAAG,EAAE,OAAO,MAAM,KAAG,CAqBtD,CAAC;AAET;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,GAAG,GAAG,EAAE,QAAQ,MAAM,EAAE,YAAY,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,CAOxF,CAAC;AAET,iEAAiE;AACjE,eAAO,MAAM,IAAI,EAAE,GAAkC,CAAC;AAEtD;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,QAAO,EAI/B,CAAC;AAEJ,gDAAgD;AAChD,eAAO,MAAM,YAAY,QAAO,QAAgC,CAAC;AAEjE,2CAA2C;AAC3C,eAAO,MAAM,OAAO,GAAU,IAAI,GAAG,EAAE,MAAM,GAAG,KAAG,OAAO,CAAC,IAAI,CAAW,CAAC;AAI3E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yBAAyB,QAAO,YAY3C,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,QAAO,WASxC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,QAAO,OAWtC,CAAC;AAEH,6CAA6C;AAC7C,MAAM,WAAW,2BAA2B;IAC3C,oEAAoE;IACpE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,4DAA4D;IAC5D,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,GAAI,UAAU,2BAA2B,KAAG,UAM9E,CAAC;AAKH;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,GAAI,UAAU;IACpD,iDAAiD;IACjD,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAC/B,KAAG,KAAK,CAAC,cAAc,CA0BvB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B,GAC1C,iBAAiB,cAAc,CAAC,MAAM,CAAC,KACrC,gBAgBF,CAAC;AAEF,kDAAkD;AAClD,MAAM,WAAW,+BAA+B;IAC/C,6DAA6D;IAC7D,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,qFAAqF;IACrF,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,oEAAoE;IACpE,UAAU,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACzB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IAC7F;;;;;;;;OAQG;IACH,YAAY,CAAC,EACZ,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC;IAC5F;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK,KAAK,CAAC,cAAc,CAAC,CAAC;IAC/E;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACvB;AAoBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,cA4FF,CAAC"}
+{"version":3,"file":"stubs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/stubs.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAa7B,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAsB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAI3E,OAAO,EAEN,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAGN,KAAK,cAAc,EACnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,SAAS,EAAmB,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAA+B,KAAK,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAS9F;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,GAAG,GAAG,EAAE,OAAO,MAAM,KAAG,CAqBtD,CAAC;AAET;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,GAAG,GAAG,EAAE,QAAQ,MAAM,EAAE,YAAY,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,CAOxF,CAAC;AAET,iEAAiE;AACjE,eAAO,MAAM,IAAI,EAAE,GAAkC,CAAC;AAEtD;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,QAAO,EAI/B,CAAC;AAEJ,gDAAgD;AAChD,eAAO,MAAM,YAAY,QAAO,QAAgC,CAAC;AAEjE,2CAA2C;AAC3C,eAAO,MAAM,OAAO,GAAU,IAAI,GAAG,EAAE,MAAM,GAAG,KAAG,OAAO,CAAC,IAAI,CAAW,CAAC;AAI3E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yBAAyB,QAAO,YAY3C,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,QAAO,WASxC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,QAAO,OAWtC,CAAC;AAEH,6CAA6C;AAC7C,MAAM,WAAW,2BAA2B;IAC3C,oEAAoE;IACpE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,4DAA4D;IAC5D,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,GAAI,UAAU,2BAA2B,KAAG,UAM9E,CAAC;AAKH;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,GAAI,UAAU;IACpD,iDAAiD;IACjD,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAC/B,KAAG,KAAK,CAAC,cAAc,CA0BvB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B,GAC1C,iBAAiB,cAAc,CAAC,MAAM,CAAC,KACrC,gBAgBF,CAAC;AAEF,kDAAkD;AAClD,MAAM,WAAW,+BAA+B;IAC/C,6DAA6D;IAC7D,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,qFAAqF;IACrF,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,oEAAoE;IACpE,UAAU,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACzB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IAC7F;;;;;;;;OAQG;IACH,YAAY,CAAC,EACZ,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC;IAC5F;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK,KAAK,CAAC,cAAc,CAAC,CAAC;IAC/E;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACvB;AAoBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,cA+FF,CAAC"}

package/dist/testing/stubs.js

@@ -313,6 +313,9 @@ export const create_test_app_surface_spec = (options) => {
             { ...bootstrap_route_shape, handler: stub_handler }
         ])
         : [];
+    for (const route of bootstrap_route_specs) {
+        assert_endpoint_in_auth_scope('bootstrap.route_prefix', route.path);
+    }
     // the surface route mirrors `create_app_server`'s opt-in mount — its handler
     // serves the surface generated below, backfilled into the same ref
     const surface_ref = {

package/dist/testing/transports/ws_client.js

@@ -19,7 +19,6 @@ import '../assert_dev_env.js';
  * @module
  */
 import { create_jsonrpc_error_response, create_jsonrpc_response, is_jsonrpc_error_response, is_jsonrpc_notification, is_jsonrpc_request, is_jsonrpc_response } from '../../http/jsonrpc_helpers.js';
-import { JSONRPC_VERSION } from '../../http/jsonrpc.js';
 // ---------------------------------------------------------------------
 // Predicates — compose with `WsClient.wait_for` and
 // `messages.filter(...)`. Both in-process and cross-process tests use

package/dist/ui/auth_state.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/auth_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAMH,OAAO,EACN,KAAK,gBAAgB,EAErB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,MAAM,2BAA2B,CAAC;AAGnC;;;GAGG;AACH,eAAO,MAAM,kBAAkB;;;;CAA8B,CAAC;AAE9D,qBAAa,SAAS;IACrB,SAAS,UAAqB;IAC9B,QAAQ,UAAqB;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAoB;IAC/C,OAAO,EAAE,cAAc,GAAG,IAAI,CAAoB;IAClD,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAAoB;IAClD,WAAW,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAkB;IAC1D;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAEtD;IACF;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAExC;IACF,wFAAwF;IACxF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAA+C;IAEzE,gEAAgE;IAChE,eAAe,UAAqB;IAEpC;;;;;;OAMG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAItC;;;;;;;;OAQG;IACG,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IA6BpC;;;;;;;OAOG;IACG,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA0CjE;;;;;OAKG;IACG,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiCpF;;;;;;;OAOG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA8ClF;;;;;OAKG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CAW7B"}
+{"version":3,"file":"auth_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/auth_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAMH,OAAO,EACN,KAAK,gBAAgB,EAErB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,MAAM,2BAA2B,CAAC;AAGnC;;;GAGG;AACH,eAAO,MAAM,kBAAkB;;;;CAA8B,CAAC;AAE9D,qBAAa,SAAS;IACrB,SAAS,UAAqB;IAC9B,QAAQ,UAAqB;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAoB;IAC/C,OAAO,EAAE,cAAc,GAAG,IAAI,CAAoB;IAClD,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAAoB;IAClD,WAAW,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAkB;IAC1D;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAEtD;IACF;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAExC;IACF,wFAAwF;IACxF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAA+C;IAEzE,gEAAgE;IAChE,eAAe,UAAqB;IAEpC;;;;;;OAMG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAItC;;;;;;;;OAQG;IACG,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IA6BpC;;;;;;;OAOG;IACG,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA0CjE;;;;;OAKG;IACG,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiCpF;;;;;;;OAOG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA8ClF;;;;;OAKG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CAe7B"}

package/dist/ui/auth_state.svelte.js

@@ -268,7 +268,11 @@ export class AuthState {
      */
     async logout() {
         try {
-            await ui_fetch('/api/account/logout', { method: 'POST' });
+            // the content type is required of every API POST, body or not
+            await ui_fetch('/api/account/logout', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' }
+            });
         }
         catch {
             // Best-effort — clear local state regardless

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fuzdev/fuz_app",
-  "version": "0.131.0",
+  "version": "0.132.0",
   "description": "fullstack app library",
   "glyph": "🗝",
   "logo": "logo.svg",
@@ -97,7 +97,7 @@
     "@hono/node-server": "^1.19.14",
     "@hono/node-ws": "^1.3.1",
     "@node-rs/argon2": "^2.0.2",
-    "@ryanatkn/eslint-config": "^0.12.3",
+    "@ryanatkn/eslint-config": "^0.13.0",
     "@sveltejs/acorn-typescript": "^1.0.9",
     "@sveltejs/adapter-static": "^4.0.0",
     "@sveltejs/kit": "^3.0.1",