@fuzdev/fuz_app 0.131.0 → 0.132.1

package/dist/http/simple_request.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Refusing CORS simple requests — the cross-origin POSTs a browser sends
+ * without asking first.
+ *
+ * A cross-origin `fetch` or form `POST` skips the CORS preflight when its
+ * `Content-Type` is absent or one of the three CORS-safelisted types
+ * (`text/plain`, `application/x-www-form-urlencoded`, `multipart/form-data`).
+ * The browser sends such a request as-is, with whatever cookies apply — only
+ * the response is withheld from the page. Any other content type makes the
+ * browser send an `OPTIONS` preflight first, and since fuz_app answers no
+ * preflight with CORS headers, the real request is never sent.
+ *
+ * The session cookie's `SameSite=Strict` doesn't close this on its own:
+ * same-site ignores the port, so a page on `http://localhost:8000` is
+ * same-site with a server on `http://localhost:4460` and its requests carry
+ * the cookie. The origin allowlist (`http/origin.ts`) refuses such a page
+ * unless a wildcard (`http://localhost:*`) admits it; this gate refuses it
+ * whatever the allowlist says.
+ *
+ * So every `POST` route carries a content-type check, run first by
+ * `apply_route_specs` (`is_post_content_type_refused`, 415
+ * `unsupported_content_type`): a JSON route takes only `application/json`,
+ * bodyless or not, and a `raw_body` route takes any type that isn't
+ * safelisted. Only `POST` needs it: `PUT`, `PATCH`, and `DELETE` are never
+ * simple methods, so the browser always preflights them.
+ *
+ * The check rests on the server answering no preflight. A consumer that adds
+ * CORS middleware granting cross-origin requests reopens what this closes.
+ *
+ * Twin of the Rust spine's `fuz_http::simple_request`: the same predicates,
+ * `is_json_content_type` checked in each spine JSON handler and
+ * `is_cors_simple_content_type` by the `simple_request_layer` consumers mount
+ * over routes with other bodies.
+ *
+ * @module
+ */
+/**
+ * True when a browser could have sent a `POST` with this `Content-Type`
+ * cross-origin without a preflight: none, or a CORS-safelisted one.
+ *
+ * Matches more than browsers do (a value they'd refuse to call safelisted —
+ * one with odd bytes, say — counts as safelisted here), so it only ever
+ * refuses too much, never too little.
+ *
+ * @param content_type - the request's `Content-Type` header, if any
+ */
+export declare const is_cors_simple_content_type: (content_type: string | undefined) => boolean;
+/**
+ * True when `Content-Type` is `application/json` (any parameters, such as
+ * `charset`, allowed).
+ *
+ * @param content_type - the request's `Content-Type` header, if any
+ */
+export declare const is_json_content_type: (content_type: string | undefined) => boolean;
+/**
+ * True when a `POST` route refuses this `Content-Type`: a JSON route anything
+ * but `application/json`, a `raw_body` route a CORS-safelisted type or none.
+ *
+ * @param content_type - the request's `Content-Type` header, if any
+ * @param raw_body - the route's `RouteSpec.raw_body`
+ */
+export declare const is_post_content_type_refused: (content_type: string | undefined, raw_body: boolean) => boolean;
+//# sourceMappingURL=simple_request.d.ts.map

package/dist/http/simple_request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"simple_request.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/simple_request.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAqBH;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,GAAI,cAAc,MAAM,GAAG,SAAS,KAAG,OAI9E,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,GAAI,cAAc,MAAM,GAAG,SAAS,KAAG,OACmB,CAAC;AAE5F;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,GACxC,cAAc,MAAM,GAAG,SAAS,EAChC,UAAU,OAAO,KACf,OACwF,CAAC"}

package/dist/http/simple_request.js

@@ -0,0 +1,84 @@
+/**
+ * Refusing CORS simple requests — the cross-origin POSTs a browser sends
+ * without asking first.
+ *
+ * A cross-origin `fetch` or form `POST` skips the CORS preflight when its
+ * `Content-Type` is absent or one of the three CORS-safelisted types
+ * (`text/plain`, `application/x-www-form-urlencoded`, `multipart/form-data`).
+ * The browser sends such a request as-is, with whatever cookies apply — only
+ * the response is withheld from the page. Any other content type makes the
+ * browser send an `OPTIONS` preflight first, and since fuz_app answers no
+ * preflight with CORS headers, the real request is never sent.
+ *
+ * The session cookie's `SameSite=Strict` doesn't close this on its own:
+ * same-site ignores the port, so a page on `http://localhost:8000` is
+ * same-site with a server on `http://localhost:4460` and its requests carry
+ * the cookie. The origin allowlist (`http/origin.ts`) refuses such a page
+ * unless a wildcard (`http://localhost:*`) admits it; this gate refuses it
+ * whatever the allowlist says.
+ *
+ * So every `POST` route carries a content-type check, run first by
+ * `apply_route_specs` (`is_post_content_type_refused`, 415
+ * `unsupported_content_type`): a JSON route takes only `application/json`,
+ * bodyless or not, and a `raw_body` route takes any type that isn't
+ * safelisted. Only `POST` needs it: `PUT`, `PATCH`, and `DELETE` are never
+ * simple methods, so the browser always preflights them.
+ *
+ * The check rests on the server answering no preflight. A consumer that adds
+ * CORS middleware granting cross-origin requests reopens what this closes.
+ *
+ * Twin of the Rust spine's `fuz_http::simple_request`: the same predicates,
+ * `is_json_content_type` checked in each spine JSON handler and
+ * `is_cors_simple_content_type` by the `simple_request_layer` consumers mount
+ * over routes with other bodies.
+ *
+ * @module
+ */
+/** The content types a browser sends cross-origin without a preflight. */
+const CORS_SAFELISTED_CONTENT_TYPES = new Set([
+    'text/plain',
+    'application/x-www-form-urlencoded',
+    'multipart/form-data'
+]);
+/** Any character outside visible ASCII and tab — what Rust's `HeaderValue::to_str` refuses. */
+const NON_VISIBLE_ASCII = /[^\t\x20-\x7e]/;
+/**
+ * The MIME essence (`type/subtype`, lowercased, parameters dropped) of a
+ * `Content-Type` value, or `null` when it holds anything but visible ASCII.
+ */
+const to_content_type_essence = (content_type) => {
+    if (NON_VISIBLE_ASCII.test(content_type))
+        return null;
+    return (content_type.split(';')[0] ?? '').trim().toLowerCase();
+};
+/**
+ * True when a browser could have sent a `POST` with this `Content-Type`
+ * cross-origin without a preflight: none, or a CORS-safelisted one.
+ *
+ * Matches more than browsers do (a value they'd refuse to call safelisted —
+ * one with odd bytes, say — counts as safelisted here), so it only ever
+ * refuses too much, never too little.
+ *
+ * @param content_type - the request's `Content-Type` header, if any
+ */
+export const is_cors_simple_content_type = (content_type) => {
+    if (content_type === undefined)
+        return true;
+    const essence = to_content_type_essence(content_type);
+    return essence === null || CORS_SAFELISTED_CONTENT_TYPES.has(essence);
+};
+/**
+ * True when `Content-Type` is `application/json` (any parameters, such as
+ * `charset`, allowed).
+ *
+ * @param content_type - the request's `Content-Type` header, if any
+ */
+export const is_json_content_type = (content_type) => content_type !== undefined && to_content_type_essence(content_type) === 'application/json';
+/**
+ * True when a `POST` route refuses this `Content-Type`: a JSON route anything
+ * but `application/json`, a `raw_body` route a CORS-safelisted type or none.
+ *
+ * @param content_type - the request's `Content-Type` header, if any
+ * @param raw_body - the route's `RouteSpec.raw_body`
+ */
+export const is_post_content_type_refused = (content_type, raw_body) => raw_body ? is_cors_simple_content_type(content_type) : !is_json_content_type(content_type);

package/dist/server/app_server.d.ts

@@ -63,13 +63,13 @@ export interface BootstrapDisabledOptions {
 }
 export interface BootstrapSurfaceOnlyOptions {
     mode: 'surface_only';
-    /** Route prefix for surface generation. Default `'/api/account'`. */
+    /** Route prefix for surface generation. Default `'/api/account'`; must sit under `/api/`. */
     route_prefix?: string;
 }
 export interface BootstrapLiveOptions {
     mode: 'live';
     token_path: string;
-    /** Route prefix for bootstrap routes. Default `'/api/account'`. */
+    /** Route prefix for bootstrap routes. Default `'/api/account'`; must sit under `/api/`. */
     route_prefix?: string;
     /**
      * Called after successful bootstrap (account + session created).

package/dist/server/app_server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app_server.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/app_server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,IAAI,EAAE,KAAK,OAAO,EAAE,MAAM,MAAM,CAAC;AAG1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAEN,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAIN,KAAK,WAAW,EAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACN,WAAW,EAMX,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAGhE,OAAO,oBAAoB,CAAC;AAE5B,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEhF,OAAO,EAEN,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAIN,KAAK,SAAS,EACd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAGN,KAAK,eAAe,EACpB,MAAM,6BAA6B,CAAC;AAarC,OAAO,EAGN,KAAK,cAAc,EACnB,MAAM,gCAAgC,CAAC;AAExC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EAAsB,KAAK,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAEzF;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAClC,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,sBAAsB,GACjC,wBAAwB,GAAG,2BAA2B,GAAG,oBAAoB,CAAC;AAE/E,MAAM,WAAW,wBAAwB;IACxC,IAAI,EAAE,UAAU,CAAC;CACjB;AAED,MAAM,WAAW,2BAA2B;IAC3C,IAAI,EAAE,cAAc,CAAC;IACrB,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,uBAAuB,EAAE,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9E;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAChC,2DAA2D;IAC3D,OAAO,EAAE,UAAU,CAAC;IACpB,6CAA6C;IAC7C,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,sCAAsC;IACtC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAE/B,6BAA6B;IAC7B,KAAK,EAAE;QACN,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,iBAAiB,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,CAAC;KACtD,CAAC;IAEF;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,eAAe,CAAC;IAChC;;;;;;;;;;;;;OAaG;IACH,qBAAqB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3C;;;;;;;OAOG;IACH,sBAAsB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5C;;;;;;;OAOG;IACH,yBAAyB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C;;;;;OAKG;IACH,0BAA0B,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAChD;;;;;OAKG;IACH,2BAA2B,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjD;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5C;;;;;;;;;;OAUG;IACH,2BAA2B,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjD;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,2DAA2D;IAC3D,kBAAkB,CAAC,EAAE,gBAAgB,CAAC;IAEtC,yEAAyE;IACzE,SAAS,CAAC,EAAE,sBAAsB,CAAC;IAEnC;;;;;;;;;;;;OAYG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB;;;OAGG;IACH,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAEpE;;;;;;;;;;;;;;;OAeG;IACH,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK,KAAK,CAAC,cAAc,CAAC,CAAC;IAE/E;;;;;;;;;;;;;;;OAeG;IACH,aAAa,CAAC,EAAE,IAAI,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAEzC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,YAAY,CAAC,EAAE,OAAO,GAAG,0BAA0B,CAAC;IAEpD,gFAAgF;IAChF,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAE/B;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IAEjG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,wBAAwB,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,KAAK,gBAAgB,CAAC;IAE3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0CG;IACH,YAAY,CAAC,EACZ,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,gBAAgB,KAAK,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC;IAEhG;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IAEzB,mFAAmF;IACnF,qBAAqB,CAAC,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IAE9C,6DAA6D;IAC7D,cAAc,CAAC,EAAE;QAChB,YAAY,EAAE,kBAAkB,CAAC;QACjC,4DAA4D;QAC5D,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,gEAAgE;QAChE,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB;;;;WAIG;QACH,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;KACzC,CAAC;IAEF;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAEhC;;;;OAIG;IACH,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,kBAAkB,KAAK,IAAI,CAAC;IAExE,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,uCAAuC;AACvC,MAAM,WAAW,SAAS;IACzB,GAAG,EAAE,IAAI,CAAC;IACV,wEAAwE;IACxE,YAAY,EAAE,cAAc,CAAC;IAC7B,gBAAgB,EAAE,eAAe,CAAC;IAClC,oGAAoG;IACpG,iBAAiB,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAClD;;;;OAIG;IACH,SAAS,EAAE,WAAW,GAAG,IAAI,CAAC;IAC9B;;;;;;;;;;;OAWG;IACH,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAClE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,iBAAiB,GAAI,QAAQ;IAAE,SAAS,EAAE,WAAW,GAAG,IAAI,CAAA;CAAE,KAAG,WAO7E,CAAC;AAEF,gDAAgD;AAChD,eAAO,MAAM,qBAAqB,QAAc,CAAC;AAEjD;;;;;GAKG;AACH,QAAA,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiB4D,CAAC;AAErF;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG,MAAM,OAAO,kBAAkB,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,EAEpC,aAAa,CAAC,uBAAuB,CAAC,CAAC;AAE5C;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACpC,2DAA2D;IAC3D,IAAI,EAAE,eAAe,CAAC;IACtB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAC,uBAAuB,EAAE,WAAW,GAAG,IAAI,CAAC,CAAC;IAC9D;;;OAGG;IACH,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;CAC1B;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,IAAI,CAAC,gBAAgB,EAAE,uBAAuB,GAAG,eAAe,CAAC,KACxE,oBAkBF,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACtC,6EAA6E;IAC7E,cAAc,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,SAAS,CAAC;IAC1D,2CAA2C;IAC3C,iBAAiB,EAAE,eAAe,CAAC;IACnC,2DAA2D;IAC3D,aAAa,EAAE,MAAM,CAAC,uBAAuB,EAAE,WAAW,GAAG,IAAI,CAAC,CAAC;CACnE;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,GACtC,OAAO,sBAAsB,KAC3B,KAAK,CAAC,oBAAoB,CAiD5B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,eAAO,MAAM,iBAAiB,GAAU,SAAS,gBAAgB,KAAG,OAAO,CAAC,SAAS,CAQpF,CAAC"}
+{"version":3,"file":"app_server.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/app_server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,IAAI,EAAE,KAAK,OAAO,EAAE,MAAM,MAAM,CAAC;AAG1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAEN,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAIN,KAAK,WAAW,EAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACN,WAAW,EAMX,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAGhE,OAAO,oBAAoB,CAAC;AAE5B,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEhF,OAAO,EAEN,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAIN,KAAK,SAAS,EACd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAGN,KAAK,eAAe,EACpB,MAAM,6BAA6B,CAAC;AAarC,OAAO,EAGN,KAAK,cAAc,EACnB,MAAM,gCAAgC,CAAC;AAExC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EAAsB,KAAK,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAEzF;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAClC,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,sBAAsB,GACjC,wBAAwB,GAAG,2BAA2B,GAAG,oBAAoB,CAAC;AAE/E,MAAM,WAAW,wBAAwB;IACxC,IAAI,EAAE,UAAU,CAAC;CACjB;AAED,MAAM,WAAW,2BAA2B;IAC3C,IAAI,EAAE,cAAc,CAAC;IACrB,6FAA6F;IAC7F,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,2FAA2F;IAC3F,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,uBAAuB,EAAE,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9E;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAChC,2DAA2D;IAC3D,OAAO,EAAE,UAAU,CAAC;IACpB,6CAA6C;IAC7C,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,sCAAsC;IACtC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAE/B,6BAA6B;IAC7B,KAAK,EAAE;QACN,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,iBAAiB,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,CAAC;KACtD,CAAC;IAEF;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,eAAe,CAAC;IAChC;;;;;;;;;;;;;OAaG;IACH,qBAAqB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3C;;;;;;;OAOG;IACH,sBAAsB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5C;;;;;;;OAOG;IACH,yBAAyB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C;;;;;OAKG;IACH,0BAA0B,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAChD;;;;;OAKG;IACH,2BAA2B,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjD;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5C;;;;;;;;;;OAUG;IACH,2BAA2B,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjD;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,2DAA2D;IAC3D,kBAAkB,CAAC,EAAE,gBAAgB,CAAC;IAEtC,yEAAyE;IACzE,SAAS,CAAC,EAAE,sBAAsB,CAAC;IAEnC;;;;;;;;;;;;OAYG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB;;;OAGG;IACH,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAEpE;;;;;;;;;;;;;;;OAeG;IACH,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK,KAAK,CAAC,cAAc,CAAC,CAAC;IAE/E;;;;;;;;;;;;;;;OAeG;IACH,aAAa,CAAC,EAAE,IAAI,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAEzC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,YAAY,CAAC,EAAE,OAAO,GAAG,0BAA0B,CAAC;IAEpD,gFAAgF;IAChF,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAE/B;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IAEjG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,wBAAwB,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,KAAK,gBAAgB,CAAC;IAE3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0CG;IACH,YAAY,CAAC,EACZ,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,gBAAgB,KAAK,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC;IAEhG;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IAEzB,mFAAmF;IACnF,qBAAqB,CAAC,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IAE9C,6DAA6D;IAC7D,cAAc,CAAC,EAAE;QAChB,YAAY,EAAE,kBAAkB,CAAC;QACjC,4DAA4D;QAC5D,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,gEAAgE;QAChE,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB;;;;WAIG;QACH,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;KACzC,CAAC;IAEF;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAEhC;;;;OAIG;IACH,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,kBAAkB,KAAK,IAAI,CAAC;IAExE,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,uCAAuC;AACvC,MAAM,WAAW,SAAS;IACzB,GAAG,EAAE,IAAI,CAAC;IACV,wEAAwE;IACxE,YAAY,EAAE,cAAc,CAAC;IAC7B,gBAAgB,EAAE,eAAe,CAAC;IAClC,oGAAoG;IACpG,iBAAiB,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAClD;;;;OAIG;IACH,SAAS,EAAE,WAAW,GAAG,IAAI,CAAC;IAC9B;;;;;;;;;;;OAWG;IACH,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAClE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,iBAAiB,GAAI,QAAQ;IAAE,SAAS,EAAE,WAAW,GAAG,IAAI,CAAA;CAAE,KAAG,WAO7E,CAAC;AAEF,gDAAgD;AAChD,eAAO,MAAM,qBAAqB,QAAc,CAAC;AAEjD;;;;;GAKG;AACH,QAAA,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiB4D,CAAC;AAErF;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG,MAAM,OAAO,kBAAkB,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,EAEpC,aAAa,CAAC,uBAAuB,CAAC,CAAC;AAE5C;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACpC,2DAA2D;IAC3D,IAAI,EAAE,eAAe,CAAC;IACtB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAC,uBAAuB,EAAE,WAAW,GAAG,IAAI,CAAC,CAAC;IAC9D;;;OAGG;IACH,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;CAC1B;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,IAAI,CAAC,gBAAgB,EAAE,uBAAuB,GAAG,eAAe,CAAC,KACxE,oBAkBF,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACtC,6EAA6E;IAC7E,cAAc,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,SAAS,CAAC;IAC1D,2CAA2C;IAC3C,iBAAiB,EAAE,eAAe,CAAC;IACnC,2DAA2D;IAC3D,aAAa,EAAE,MAAM,CAAC,uBAAuB,EAAE,WAAW,GAAG,IAAI,CAAC,CAAC;CACnE;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,GACtC,OAAO,sBAAsB,KAC3B,KAAK,CAAC,oBAAoB,CAiD5B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,eAAO,MAAM,iBAAiB,GAAU,SAAS,gBAAgB,KAAG,OAAO,CAAC,SAAS,CAQpF,CAAC"}

package/dist/server/app_server.js

@@ -333,7 +333,11 @@ const assemble_app_server = async (options, releases) => {
             bootstrap_ip_rate_limiter
         });
         const prefix = options.bootstrap.route_prefix ?? '/api/account';
-        factory_routes.push(...prefix_route_specs(prefix, bootstrap_routes));
+        const prefixed = prefix_route_specs(prefix, bootstrap_routes);
+        for (const route of prefixed) {
+            assert_endpoint_in_auth_scope('bootstrap.route_prefix', route.path);
+        }
+        factory_routes.push(...prefixed);
     }
     // RPC endpoint auto-mount — resolve specs then append their routes so
     // surface generation and live dispatch share one source of truth.

package/dist/testing/CLAUDE.md

@@ -383,6 +383,7 @@ Walks Zod schemas to generate valid values for adversarial/round-trip tests.
 - `detect_format(field_schema)` — reads `format` / `pattern` from the JSON Schema representation.
 - `generate_valid_value(field, field_schema)` — base-type switch producing a valid sample (UUIDs → nil UUID, strings → `'xxxxxxxxxx'`, numbers → `1`, objects → recurse, enums → first entry, etc.). For branded-string refinements, walks a fallback chain synthesized from the `pattern` string the JSON Schema representation exposes: fixed-length hex (`^[0-9a-f]{N}$` — blake3 / sha256 / md5 digests; `0`.repeat(N)), prefix-lengthed slug (`^<prefix>_[A-Za-z0-9_-]{N}$` — `ApiTokenId`-style ids; `<prefix>_` + `x`.repeat(N)), absolute path prefix, URL prefix. First candidate that `safeParse` accepts is used.
 - `resolve_valid_path(path, params_schema?)` — swaps `:param` for a value the params schema accepts. Prefers `test_<name>` wherever the field schema admits it (the param name keeps failure messages readable); otherwise a UUID param takes the nil UUID and anything else is synthesized from the schema, percent-encoded. A synthesized value containing `/` is refused (it would route elsewhere) and falls back to `test_<name>`.
+- `to_route_content_type(route)` — the `Content-Type` a well-formed request to the route sends: `application/json`, or `application/octet-stream` for a `raw_body` route. Every `POST` route refuses anything else with 415 before its other gates, so every probe in the harnesses (auth, params and query fuzz, 404, data exposure, round trip) sends it, body or not.
 - `generate_valid_body(input_schema) => Record<string, unknown> | undefined` — builds a body satisfying the input schema. Throws with Zod `issues` if the generated body fails validation — surfaces broken generation logic with a descriptive error rather than a confusing 400 downstream.
 
 ### `integration_helpers.ts` — route lookup + body checks
@@ -1564,6 +1565,22 @@ in-process `auth/origin_parity.db.test.ts` + the cross-process
 Rust spine returned a plain-text body — now converged to the canonical TS
 `{error: "forbidden_origin"}` via `fuz_http::forbidden_origin_response()`.
 
+### CORS simple-request parity — `cross_backend/simple_request.ts`
+
+`describe_simple_request_cross_tests({setup_test, rpc_path?, login_path?, logout_path?})`
+— a JSON route refuses any `POST` that isn't `application/json` with a flat
+415 `{error: 'unsupported_content_type'}` before reading a credential or the
+body: the CORS-safelisted types in any spelling (`text/plain`, `Text/Plain`,
+form-encoded, multipart) on RPC with a session, untyped RPC (a byte body, so
+`fetch` adds no type), `application/octet-stream` / `+json` / empty-typed RPC
+and login, form-encoded login, a forged `text/plain` logout with a session
+(which must leave the session valid), and an untyped logout with no session
+(415, not 401); a bodyless JSON logout reaches the auth check (401), and
+`application/json` with a charset is dispatched. The TS spine checks per route
+(`apply_route_specs`), the Rust spine in each JSON handler. Runs both legs:
+the in-process `auth/simple_request_parity.db.test.ts` and the cross-process
+`simple_request.cross.test.ts`.
+
 ### Query-string shape parity — `cross_backend/query_shape.ts`
 
 `describe_query_shape_cross_tests({setup_test, capabilities, rpc_path?})` —

package/dist/testing/admin_integration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin_integration.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/admin_integration.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAgC7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAc,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAW3E,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAmB1B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,0BAA0B,CAAC;AAYvE;;GAEG;AACH,MAAM,WAAW,mCAAmC;IACnD;;;;OAIG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;;OAIG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,uFAAuF;IACvF,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,4GAA4G;IAC5G,KAAK,EAAE,gBAAgB,CAAC;IACxB;;;OAGG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAiBD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yCAAyC,GACrD,SAAS,mCAAmC,KAC1C,IAk5BF,CAAC"}
+{"version":3,"file":"admin_integration.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/admin_integration.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAgC7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAc,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAW3E,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAmB1B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,0BAA0B,CAAC;AAavE;;GAEG;AACH,MAAM,WAAW,mCAAmC;IACnD;;;;OAIG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;;OAIG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,uFAAuF;IACvF,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,4GAA4G;IAC5G,KAAK,EAAE,gBAAgB,CAAC;IACxB;;;OAGG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAiBD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yCAAyC,GACrD,SAAS,mCAAmC,KAC1C,IAm5BF,CAAC"}

package/dist/testing/admin_integration.js

@@ -36,6 +36,7 @@ import { rpc_call_for_spec, require_rpc_endpoint_path, resolve_rpc_endpoints_for
 import { role_grant_offer_create_action_spec, role_grant_revoke_action_spec } from '../auth/role_grant_offer_action_specs.js';
 import { admin_account_list_action_spec, ADMIN_ACCOUNT_LIST_LIMIT_MAX, admin_session_list_action_spec, admin_session_revoke_all_action_spec, admin_token_revoke_all_action_spec, audit_log_list_action_spec, audit_log_role_grant_history_action_spec } from '../auth/admin_action_specs.js';
 import { account_token_create_action_spec, account_verify_action_spec } from '../auth/account_action_specs.js';
+import { to_route_content_type } from './schema_generators.js';
 /**
  * How long a failure-audit read waits for the pool-routed row to land.
  */
@@ -595,7 +596,8 @@ export const describe_standard_admin_integration_tests = (options) => {
                         headers: {
                             host: 'localhost',
                             origin: 'http://localhost:5173',
-                            cookie: `${cookie_name}=${user_two_cookie}`
+                            cookie: `${cookie_name}=${user_two_cookie}`,
+                            'content-type': 'application/json'
                         }
                     });
                 }
@@ -804,7 +806,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                 for (const route of admin_routes) {
                     const res = await fixture.transport(route.path, {
                         method: route.method,
-                        headers: { host: 'localhost' }
+                        headers: { host: 'localhost', 'content-type': to_route_content_type(route) }
                     });
                     if (res.status === 401 || res.status === 403) {
                         error_collector.record(route_specs, route.method, route.path, res.status);

package/dist/testing/adversarial_404.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adversarial_404.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/adversarial_404.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAoB7B,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAyBlE;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,GAAI,SAAS,sBAAsB,KAAG,IA6E1E,CAAC"}
+{"version":3,"file":"adversarial_404.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/adversarial_404.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAoB7B,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AA6BlE;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,GAAI,SAAS,sBAAsB,KAAG,IA+E1E,CAAC"}

package/dist/testing/adversarial_404.js

@@ -14,7 +14,7 @@ import { test, assert, describe } from 'vitest';
 import { z } from 'zod';
 import { is_null_schema } from '../http/schema_helpers.js';
 import { create_auth_test_apps, create_route_skip_filter, select_auth_app } from './auth_apps.js';
-import { resolve_valid_path, generate_valid_body } from './schema_generators.js';
+import { resolve_valid_path, generate_valid_body, to_route_content_type } from './schema_generators.js';
 /**
  * Extract the error code from a 404 Zod schema for use in the stub handler.
  *
@@ -98,12 +98,14 @@ export const describe_adversarial_404 = (options) => {
                 const route = surface.routes.find((r) => `${r.method} ${r.path}` === key);
                 const app = select_auth_app(apps, route.auth);
                 const url = resolve_valid_path(route.path, spec.params);
-                const request_init = { method: route.method };
+                const request_init = {
+                    method: route.method,
+                    headers: { 'content-type': to_route_content_type(spec) }
+                };
                 // Send valid body for routes with input
                 if (!is_null_schema(spec.input)) {
                     const body = generate_valid_body(spec.input);
                     if (body !== undefined) {
-                        request_init.headers = { 'Content-Type': 'application/json' };
                         request_init.body = JSON.stringify(body);
                     }
                 }

package/dist/testing/adversarial_input.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adversarial_input.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/adversarial_input.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAiB7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB,OAAO,EAEN,0BAA0B,EAC1B,uBAAuB,EAGvB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AA8ClE,UAAU,aAAa;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,cAAc,EAAE,OAAO,0BAA0B,GAAG,OAAO,uBAAuB,CAAC;CACnF;AAED,UAAU,cAAc;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,UAAU,aAAa;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAID;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yBAAyB,GAAI,cAAc,CAAC,CAAC,OAAO,KAAG,KAAK,CAAC,aAAa,CAsMtF,CAAC;AAIF;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,GAAI,eAAe,CAAC,CAAC,SAAS,KAAG,KAAK,CAAC,cAAc,CA+B3F,CAAC;AAIF;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,GAAI,cAAc,CAAC,CAAC,SAAS,KAAG,KAAK,CAAC,aAAa,CA4CxF,CAAC;AAqBF;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,GAAI,SAAS,sBAAsB,KAAG,IAmN5E,CAAC"}
+{"version":3,"file":"adversarial_input.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/adversarial_input.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAiB7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB,OAAO,EAEN,0BAA0B,EAC1B,uBAAuB,EAGvB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAmDlE,UAAU,aAAa;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,cAAc,EAAE,OAAO,0BAA0B,GAAG,OAAO,uBAAuB,CAAC;CACnF;AAED,UAAU,cAAc;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,UAAU,aAAa;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAID;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yBAAyB,GAAI,cAAc,CAAC,CAAC,OAAO,KAAG,KAAK,CAAC,aAAa,CAsMtF,CAAC;AAIF;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,GAAI,eAAe,CAAC,CAAC,SAAS,KAAG,KAAK,CAAC,cAAc,CA+B3F,CAAC;AAIF;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,GAAI,cAAc,CAAC,CAAC,SAAS,KAAG,KAAK,CAAC,aAAa,CA4CxF,CAAC;AAqBF;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,GAAI,SAAS,sBAAsB,KAAG,IAyN5E,CAAC"}

package/dist/testing/adversarial_input.js

@@ -19,7 +19,7 @@ import { is_null_schema } from '../http/schema_helpers.js';
 import { filter_routes_with_input, filter_routes_with_params, filter_routes_with_query } from '../http/surface_query.js';
 import { ValidationError, ERROR_INVALID_REQUEST_BODY, ERROR_INVALID_JSON_BODY, ERROR_INVALID_ROUTE_PARAMS, ERROR_INVALID_QUERY_PARAMS } from '../http/error_schemas.js';
 import { create_auth_test_apps, create_route_skip_filter, select_auth_app } from './auth_apps.js';
-import { detect_format, generate_valid_value, resolve_valid_path } from './schema_generators.js';
+import { detect_format, generate_valid_value, resolve_valid_path, to_route_content_type } from './schema_generators.js';
 // --- Payload generation ---
 /** One wrong-type value per base type — one representative is sufficient. */
 const wrong_type_for = (base_type) => {
@@ -466,7 +466,10 @@ export const describe_adversarial_input = (options) => {
                         for (const tc of test_cases) {
                             test(tc.label, async () => {
                                 const url = build_fuzz_url(route.path, tc.params);
-                                const res = await app.request(url, { method: route.method });
+                                const res = await app.request(url, {
+                                    method: route.method,
+                                    headers: { 'content-type': to_route_content_type(route) }
+                                });
                                 assert.strictEqual(res.status, 400, `Expected 400 for ${key} [${tc.label}], got ${res.status}`);
                                 const body = await res.json();
                                 assert.strictEqual(body.error, ERROR_INVALID_ROUTE_PARAMS, `Expected ${ERROR_INVALID_ROUTE_PARAMS} for ${key} [${tc.label}], got: ${body.error}`);
@@ -504,7 +507,10 @@ export const describe_adversarial_input = (options) => {
                         for (const tc of test_cases) {
                             test(tc.label, async () => {
                                 const url = build_query_url(base_url, tc.query);
-                                const res = await app.request(url, { method: route.method });
+                                const res = await app.request(url, {
+                                    method: route.method,
+                                    headers: { 'content-type': to_route_content_type(route) }
+                                });
                                 assert.strictEqual(res.status, 400, `Expected 400 for ${key} [${tc.label}], got ${res.status}`);
                                 const body = await res.json();
                                 assert.strictEqual(body.error, ERROR_INVALID_QUERY_PARAMS, `Expected ${ERROR_INVALID_QUERY_PARAMS} for ${key} [${tc.label}], got: ${body.error}`);

package/dist/testing/attack_surface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attack_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/attack_surface.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAoB7B,OAAO,EAQN,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,MAAM,yBAAyB,CAAC;AAejC,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAsDpF,oFAAoF;AACpF,MAAM,WAAW,sBAAsB;IACtC,+EAA+E;IAC/E,KAAK,EAAE,MAAM,cAAc,CAAC;IAC5B,yDAAyD;IACzD,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yBAAyB,GAAI,SAAS,sBAAsB,KAAG,IA2J3E,CAAC;AAIF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,uCAAuC,GACnD,UAAU,2BAA2B,GAAG,IAAI,GAAG,SAAS,KACtD,2BAA2B,GAAG,IAWhC,CAAC;AAEF,0DAA0D;AAC1D,MAAM,WAAW,4BAA4B;IAC5C,+EAA+E;IAC/E,KAAK,EAAE,MAAM,cAAc,CAAC;IAC5B,yDAAyD;IACzD,aAAa,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,sBAAsB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtC,iIAAiI;IACjI,uBAAuB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACvC,yDAAyD;IACzD,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrB,qEAAqE;IACrE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iEAAiE;IACjE,eAAe,CAAC,EAAE,4BAA4B,CAAC;IAC/C;;;;;;;;;;;OAWG;IACH,sBAAsB,CAAC,EAAE,2BAA2B,GAAG,IAAI,CAAC;IAC5D;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,sCAAsC,GAClD,SAAS,4BAA4B,KACnC,IA4EF,CAAC"}
+{"version":3,"file":"attack_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/attack_surface.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAoB7B,OAAO,EAQN,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,MAAM,yBAAyB,CAAC;AAejC,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAsDpF,oFAAoF;AACpF,MAAM,WAAW,sBAAsB;IACtC,+EAA+E;IAC/E,KAAK,EAAE,MAAM,cAAc,CAAC;IAC5B,yDAAyD;IACzD,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yBAAyB,GAAI,SAAS,sBAAsB,KAAG,IA6J3E,CAAC;AAIF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,uCAAuC,GACnD,UAAU,2BAA2B,GAAG,IAAI,GAAG,SAAS,KACtD,2BAA2B,GAAG,IAWhC,CAAC;AAEF,0DAA0D;AAC1D,MAAM,WAAW,4BAA4B;IAC5C,+EAA+E;IAC/E,KAAK,EAAE,MAAM,cAAc,CAAC;IAC5B,yDAAyD;IACzD,aAAa,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,sBAAsB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtC,iIAAiI;IACjI,uBAAuB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACvC,yDAAyD;IACzD,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrB,qEAAqE;IACrE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iEAAiE;IACjE,eAAe,CAAC,EAAE,4BAA4B,CAAC;IAC/C;;;;;;;;;;;OAWG;IACH,sBAAsB,CAAC,EAAE,2BAA2B,GAAG,IAAI,CAAC;IAC5D;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,sCAAsC,GAClD,SAAS,4BAA4B,KACnC,IA4EF,CAAC"}

package/dist/testing/attack_surface.js

@@ -19,7 +19,7 @@ import { assert_surface_invariants, assert_rpc_ws_surface_invariants, assert_sur
 import { describe_adversarial_input } from './adversarial_input.js';
 import { describe_adversarial_404 } from './adversarial_404.js';
 import { create_auth_test_apps, create_route_skip_filter, select_auth_app } from './auth_apps.js';
-import { resolve_valid_path } from './schema_generators.js';
+import { resolve_valid_path, to_route_content_type } from './schema_generators.js';
 import { assert_surface_matches_snapshot, assert_surface_deterministic, assert_only_expected_public_routes, assert_full_middleware_stack, assert_error_schema_valid } from './assertions.js';
 import { merge_error_schemas } from '../http/schema_helpers.js';
 import { collect_middleware_errors } from '../http/surface.js';
@@ -91,13 +91,17 @@ export const describe_adversarial_auth = (options) => {
     const spec_lookup = build_route_spec_lookup(route_specs);
     const test_path = (route) => resolve_valid_path(route.path, spec_lookup.get(`${route.method} ${route.path}`)?.params);
     const apps = create_auth_test_apps(route_specs, roles);
+    // every probe carries the content type a real client sends, so the
+    // per-route content-type check (415) never answers ahead of the auth gate
+    const probe_init = (route) => ({
+        method: route.method,
+        headers: { 'content-type': to_route_content_type(route) }
+    });
     describe('adversarial HTTP auth enforcement', () => {
         describe('unauthenticated → 401', () => {
             for (const route of protected_routes) {
                 test(`${route.method} ${route.path}`, async () => {
-                    const res = await apps.public.request(test_path(route), {
-                        method: route.method
-                    });
+                    const res = await apps.public.request(test_path(route), probe_init(route));
                     assert.strictEqual(res.status, 401, `${route.method} ${route.path}`);
                     const body = await res.json();
                     assert.strictEqual(body.error, ERROR_AUTHENTICATION_REQUIRED);
@@ -126,9 +130,7 @@ export const describe_adversarial_auth = (options) => {
                             const app = apps.by_role.get(wrong_role);
                             if (!app)
                                 throw new Error(`No test app for role '${wrong_role}'`);
-                            const res = await app.request(test_path(route), {
-                                method: route.method
-                            });
+                            const res = await app.request(test_path(route), probe_init(route));
                             assert.strictEqual(res.status, 403, `${route.method} ${route.path}`);
                             const body = await res.json();
                             assert.strictEqual(body.error, ERROR_INSUFFICIENT_PERMISSIONS);
@@ -141,9 +143,7 @@ export const describe_adversarial_auth = (options) => {
             describe('authenticated without role → 403', () => {
                 for (const route of role_only_routes) {
                     test(`${route.method} ${route.path}`, async () => {
-                        const res = await apps.authed.request(test_path(route), {
-                            method: route.method
-                        });
+                        const res = await apps.authed.request(test_path(route), probe_init(route));
                         assert.strictEqual(res.status, 403, `${route.method} ${route.path}`);
                         const body = await res.json();
                         assert.strictEqual(body.error, ERROR_INSUFFICIENT_PERMISSIONS);
@@ -175,9 +175,9 @@ export const describe_adversarial_auth = (options) => {
                         continue;
                     }
                     test(`${route.method} ${route.path} (${refused})`, async () => {
-                        const res = await apps.by_credential_type.get(refused).request(test_path(route), {
-                            method: route.method
-                        });
+                        const res = await apps.by_credential_type
+                            .get(refused)
+                            .request(test_path(route), probe_init(route));
                         assert.strictEqual(res.status, 403, `${route.method} ${route.path}`);
                         const body = await res.json();
                         assert.strictEqual(body.error, ERROR_CREDENTIAL_TYPE_REQUIRED);
@@ -190,12 +190,11 @@ export const describe_adversarial_auth = (options) => {
         describe('correct auth passes guard', () => {
             for (const route of protected_routes) {
                 test(`${route.method} ${route.path}`, async () => {
-                    const res = await select_auth_app(apps, route.auth).request(test_path(route), {
-                        method: route.method
-                    });
+                    const res = await select_auth_app(apps, route.auth).request(test_path(route), probe_init(route));
                     // handler may error (500) or return 404 (stub deps) — that's fine, we only verify auth passed
                     assert.notStrictEqual(res.status, 401, 'should not be 401 (auth rejected)');
                     assert.notStrictEqual(res.status, 403, 'should not be 403 (role rejected)');
+                    assert.notStrictEqual(res.status, 415, 'should not be 415 (content type refused)');
                     // handler-level 404 (resource not found with stub deps) is fine —
                     // only reject router-level 404 (route not registered)
                     if (res.status === 404) {

package/dist/testing/audit_completeness.js

@@ -155,7 +155,7 @@ export const describe_audit_completeness_tests = (options) => {
                 assert.ok(logout_route, 'Expected POST /logout route');
                 const res = await fixture.transport(logout_route.path, {
                     method: 'POST',
-                    headers: fixture.create_session_headers()
+                    headers: fixture.create_session_headers({ 'content-type': 'application/json' })
                 });
                 assert.strictEqual(res.status, 200);
                 const events = await list_audit_events({ request: fixture.transport }, rpc_path, observer);

package/dist/testing/cross_backend/simple_request.d.ts

@@ -0,0 +1,11 @@
+import '../assert_dev_env.js';
+import type { RpcPathCrossSuiteOptions } from './setup.js';
+/** Options for the simple-request parity suite. */
+export interface SimpleRequestCrossTestOptions extends RpcPathCrossSuiteOptions {
+    /** REST login route path. Default `/api/account/login` (the spine convention). */
+    readonly login_path?: string;
+    /** REST logout route path. Default `/api/account/logout` (the spine convention). */
+    readonly logout_path?: string;
+}
+export declare const describe_simple_request_cross_tests: (options: SimpleRequestCrossTestOptions) => void;
+//# sourceMappingURL=simple_request.d.ts.map

package/dist/testing/cross_backend/simple_request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"simple_request.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/simple_request.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA6B9B,OAAO,KAAK,EAAE,wBAAwB,EAAe,MAAM,YAAY,CAAC;AAGxE,mDAAmD;AACnD,MAAM,WAAW,6BAA8B,SAAQ,wBAAwB;IAC9E,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,oFAAoF;IACpF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAaD,eAAO,MAAM,mCAAmC,GAC/C,SAAS,6BAA6B,KACpC,IAuHF,CAAC"}

package/dist/testing/cross_backend/simple_request.js

@@ -0,0 +1,142 @@
+import '../assert_dev_env.js';
+/**
+ * Cross-backend parity suite for refusing CORS simple requests.
+ *
+ * A `POST` with no `Content-Type`, or a `text/plain` / form / multipart one,
+ * is what a browser sends cross-origin without a preflight — carrying the
+ * session cookie when the page is same-site, which any other `localhost`
+ * port is. Every spine's JSON routes require `application/json` and refuse
+ * anything else with a flat `415` `{error: 'unsupported_content_type'}`
+ * before reading a credential or the body: the TS spine per route
+ * (`apply_route_specs`, every `POST` that isn't `raw_body`), the Rust spine
+ * in each JSON handler. The cases carry an allowed `Origin` and, where it
+ * matters, the keeper's session — the exact shape of a same-site page's
+ * forged request, which the origin allowlist alone admits when it's a
+ * wildcard — and a refused request must leave that session untouched.
+ *
+ * Runs both legs via the shared `setup_test` protocol: in-process
+ * (`auth/simple_request_parity.db.test.ts`) and cross-process
+ * (`cross_backend/simple_request.cross.test.ts`). Every spine has the gate,
+ * so the suite is ungated.
+ *
+ * @module
+ */
+import { describe, test, assert } from 'vitest';
+import { account_verify_action_spec } from '../../auth/account_action_specs.js';
+import { ERROR_UNSUPPORTED_CONTENT_TYPE } from '../../http/error_schemas.js';
+import { SPINE_RPC_PATH } from './spine_surface_constants.js';
+/** Build the JSON-RPC envelope body for a nullary `account_verify` call. */
+const verify_envelope = (id) => JSON.stringify({ jsonrpc: '2.0', method: account_verify_action_spec.method, id });
+/** Assert a flat `415` content-type refusal. */
+const assert_refused = async (res, label) => {
+    assert.strictEqual(res.status, 415, `${label} must be refused with 415`);
+    const body = (await res.json().catch(() => undefined));
+    assert.strictEqual(body?.error, ERROR_UNSUPPORTED_CONTENT_TYPE, label);
+};
+export const describe_simple_request_cross_tests = (options) => {
+    const { setup_test } = options;
+    const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
+    const login_path = options.login_path ?? '/api/account/login';
+    const logout_path = options.logout_path ?? '/api/account/logout';
+    /** POST a JSON `account_verify` with the fixture's session — 200 while it's valid. */
+    const verify_session = async (fixture, id) => {
+        const res = await fixture.transport(rpc_path, {
+            method: 'POST',
+            headers: { ...fixture.create_session_headers(), 'content-type': 'application/json' },
+            body: verify_envelope(id)
+        });
+        return res.status;
+    };
+    describe('CORS simple-request refusal parity', () => {
+        test('a CORS-safelisted RPC POST with a session → 415, in any spelling', async () => {
+            const fixture = await setup_test();
+            for (const content_type of [
+                'text/plain;charset=UTF-8',
+                'Text/Plain',
+                'application/x-www-form-urlencoded',
+                'multipart/form-data; boundary=x'
+            ]) {
+                const res = await fixture.transport(rpc_path, {
+                    method: 'POST',
+                    headers: { ...fixture.create_session_headers(), 'content-type': content_type },
+                    body: verify_envelope('simple-safelisted')
+                });
+                await assert_refused(res, `a ${content_type} RPC POST`);
+            }
+        });
+        test('RPC POST with no Content-Type → 415', async () => {
+            const fixture = await setup_test();
+            // a byte body, so `fetch` adds no `Content-Type` of its own (a string
+            // body would get `text/plain;charset=UTF-8`)
+            const res = await fixture.transport(rpc_path, {
+                method: 'POST',
+                headers: fixture.create_session_headers(),
+                body: new TextEncoder().encode(verify_envelope('simple-untyped'))
+            });
+            await assert_refused(res, 'an untyped RPC POST');
+        });
+        test('a JSON route refuses any type but application/json', async () => {
+            const fixture = await setup_test();
+            for (const content_type of ['application/octet-stream', 'application/vnd.api+json', '']) {
+                const res = await fixture.transport(rpc_path, {
+                    method: 'POST',
+                    headers: { ...fixture.create_session_headers(), 'content-type': content_type },
+                    body: verify_envelope('simple-not-json')
+                });
+                await assert_refused(res, `an RPC POST typed '${content_type}'`);
+                const login = await fixture.fresh_transport()(login_path, {
+                    method: 'POST',
+                    headers: { 'content-type': content_type },
+                    body: JSON.stringify({ username: 'keeper', password: 'whatever' })
+                });
+                await assert_refused(login, `a login typed '${content_type}'`);
+            }
+        });
+        test('form-encoded login → 415', async () => {
+            const fixture = await setup_test();
+            const res = await fixture.fresh_transport()(login_path, {
+                method: 'POST',
+                headers: { 'content-type': 'application/x-www-form-urlencoded' },
+                body: 'username=keeper&password=whatever'
+            });
+            await assert_refused(res, 'a form-encoded login');
+        });
+        test('a forged text/plain logout with a session → 415, and the session survives', async () => {
+            const fixture = await setup_test();
+            const res = await fixture.transport(logout_path, {
+                method: 'POST',
+                headers: { ...fixture.create_session_headers(), 'content-type': 'text/plain' }
+            });
+            await assert_refused(res, 'a text/plain logout');
+            assert.strictEqual(await verify_session(fixture, 'after-forged-logout'), 200, 'the refused logout must not end the session');
+        });
+        test('an untyped logout with no session → 415, before the auth check', async () => {
+            const fixture = await setup_test();
+            const res = await fixture.fresh_transport()(logout_path, {
+                method: 'POST',
+                headers: { 'content-type': 'application/octet-stream' }
+            });
+            await assert_refused(res, 'an octet-stream logout');
+        });
+        test('JSON logout with no body and no session → 401, not 415', async () => {
+            const fixture = await setup_test();
+            const res = await fixture.fresh_transport()(logout_path, {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' }
+            });
+            assert.strictEqual(res.status, 401, 'a bodyless JSON logout must reach the auth check');
+        });
+        test('application/json with a charset → dispatched', async () => {
+            const fixture = await setup_test();
+            const res = await fixture.transport(rpc_path, {
+                method: 'POST',
+                headers: {
+                    ...fixture.create_session_headers(),
+                    'content-type': 'application/json; charset=utf-8'
+                },
+                body: verify_envelope('json-charset')
+            });
+            assert.strictEqual(res.status, 200, 'a JSON RPC POST must be dispatched');
+        });
+    });
+};

package/dist/testing/cross_backend/standard.d.ts

@@ -98,6 +98,12 @@ export interface StandardCrossProcessTestOptions {
      * / `info/refs`) which stream git protocol bytes.
      */
     round_trip_skip_routes?: Array<string>;
+    /**
+     * Forwarded to `describe_data_exposure_tests` as `skip_routes`
+     * (`'METHOD /path'` keys), as the in-process bundle's consumers pass it
+     * directly.
+     */
+    data_exposure_skip_routes?: Array<string>;
     /**
      * Forwarded to `describe_rpc_round_trip_tests` as `success_fixtures`
      * (method name → async params factory). Drives a populated **success**