@fuzdev/fuz_app 0.132.0 → 0.132.1

package/dist/actions/action_dispatcher.js

@@ -6,6 +6,7 @@
  *
  * @module
  */
+import { JsonrpcMessageFromClientToServer, JsonrpcMessageFromServerToClient, JsonrpcNotification, JsonrpcRequest, JsonrpcResponseOrError, JsonrpcErrorResponse } from '../http/jsonrpc.js';
 import { create_jsonrpc_error_response, create_jsonrpc_error_response_from_thrown, to_jsonrpc_message_id, is_jsonrpc_request, is_jsonrpc_notification } from '../http/jsonrpc_helpers.js';
 import { jsonrpc_error_messages } from '../http/jsonrpc_errors.js';
 import { to_input_params } from '../http/schema_helpers.js';

package/dist/actions/action_event_data.d.ts

@@ -28,11 +28,11 @@ export declare const ActionEventData: z.ZodObject<{
         execute: "execute";
     }>;
     step: z.ZodEnum<{
-        failed: "failed";
-        parsed: "parsed";
         initial: "initial";
+        parsed: "parsed";
         handling: "handling";
         handled: "handled";
+        failed: "failed";
     }>;
     method: z.ZodString;
     executor: z.ZodEnum<{

package/dist/actions/action_event_types.d.ts

@@ -12,11 +12,11 @@ export declare const ActionExecutor: z.ZodEnum<{
 }>;
 export type ActionExecutor = z.infer<typeof ActionExecutor>;
 export declare const ActionEventStep: z.ZodEnum<{
-    failed: "failed";
-    parsed: "parsed";
     initial: "initial";
+    parsed: "parsed";
     handling: "handling";
     handled: "handled";
+    failed: "failed";
 }>;
 export type ActionEventStep = z.infer<typeof ActionEventStep>;
 export declare const action_event_step_transitions: Record<ActionEventStep, ReadonlyArray<ActionEventStep>>;

package/dist/actions/action_rpc.js

@@ -13,6 +13,7 @@
  */
 import { z } from 'zod';
 import { DEV } from 'esm-env';
+import {} from '../http/route_spec.js';
 import { get_client_ip } from '../http/client_ip.js';
 import { get_request_context } from '../auth/request_context.js';
 import { ACCOUNT_ID_KEY, CREDENTIAL_TYPE_KEY, TOKEN_SCOPE_KEY, TEST_CONTEXT_PRESET_KEY } from '../hono_context.js';

package/dist/actions/action_spec.d.ts

@@ -51,14 +51,14 @@ export declare const ActionSpec: z.ZodObject<{
      */
     auth: z.ZodNullable<z.ZodObject<{
         account: z.ZodEnum<{
-            required: "required";
-            none: "none";
             optional: "optional";
+            none: "none";
+            required: "required";
         }>;
         actor: z.ZodEnum<{
-            required: "required";
-            none: "none";
             optional: "optional";
+            none: "none";
+            required: "required";
         }>;
         roles: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
         credential_types: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
@@ -108,9 +108,9 @@ export declare const ActionSpec: z.ZodObject<{
      * dispatchers don't read it.
      */
     rate_limit: z.ZodOptional<z.ZodEnum<{
-        both: "both";
         account: "account";
         ip: "ip";
+        both: "both";
     }>>;
 }, z.core.$strict>;
 export type ActionSpec = z.infer<typeof ActionSpec>;
@@ -128,21 +128,21 @@ export declare const RequestResponseActionSpec: z.ZodObject<{
     streams: z.ZodOptional<z.ZodString>;
     error_reasons: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
     rate_limit: z.ZodOptional<z.ZodEnum<{
-        both: "both";
         account: "account";
         ip: "ip";
+        both: "both";
     }>>;
     kind: z.ZodDefault<z.ZodLiteral<"request_response">>;
     auth: z.ZodObject<{
         account: z.ZodEnum<{
-            required: "required";
-            none: "none";
             optional: "optional";
+            none: "none";
+            required: "required";
         }>;
         actor: z.ZodEnum<{
-            required: "required";
-            none: "none";
             optional: "optional";
+            none: "none";
+            required: "required";
         }>;
         roles: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
         credential_types: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
@@ -163,9 +163,9 @@ export declare const RemoteNotificationActionSpec: z.ZodObject<{
     streams: z.ZodOptional<z.ZodString>;
     error_reasons: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
     rate_limit: z.ZodOptional<z.ZodEnum<{
-        both: "both";
         account: "account";
         ip: "ip";
+        both: "both";
     }>>;
     kind: z.ZodDefault<z.ZodLiteral<"remote_notification">>;
     auth: z.ZodDefault<z.ZodNull>;
@@ -193,9 +193,9 @@ export declare const LocalCallActionSpec: z.ZodObject<{
     streams: z.ZodOptional<z.ZodString>;
     error_reasons: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
     rate_limit: z.ZodOptional<z.ZodEnum<{
-        both: "both";
         account: "account";
         ip: "ip";
+        both: "both";
     }>>;
     kind: z.ZodDefault<z.ZodLiteral<"local_call">>;
     auth: z.ZodDefault<z.ZodNull>;
@@ -215,21 +215,21 @@ export declare const ActionSpecUnion: z.ZodUnion<readonly [z.ZodObject<{
     streams: z.ZodOptional<z.ZodString>;
     error_reasons: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
     rate_limit: z.ZodOptional<z.ZodEnum<{
-        both: "both";
         account: "account";
         ip: "ip";
+        both: "both";
     }>>;
     kind: z.ZodDefault<z.ZodLiteral<"request_response">>;
     auth: z.ZodObject<{
         account: z.ZodEnum<{
-            required: "required";
-            none: "none";
             optional: "optional";
+            none: "none";
+            required: "required";
         }>;
         actor: z.ZodEnum<{
-            required: "required";
-            none: "none";
             optional: "optional";
+            none: "none";
+            required: "required";
         }>;
         roles: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
         credential_types: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
@@ -248,9 +248,9 @@ export declare const ActionSpecUnion: z.ZodUnion<readonly [z.ZodObject<{
     streams: z.ZodOptional<z.ZodString>;
     error_reasons: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
     rate_limit: z.ZodOptional<z.ZodEnum<{
-        both: "both";
         account: "account";
         ip: "ip";
+        both: "both";
     }>>;
     kind: z.ZodDefault<z.ZodLiteral<"remote_notification">>;
     auth: z.ZodDefault<z.ZodNull>;
@@ -272,9 +272,9 @@ export declare const ActionSpecUnion: z.ZodUnion<readonly [z.ZodObject<{
     streams: z.ZodOptional<z.ZodString>;
     error_reasons: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
     rate_limit: z.ZodOptional<z.ZodEnum<{
-        both: "both";
         account: "account";
         ip: "ip";
+        both: "both";
     }>>;
     kind: z.ZodDefault<z.ZodLiteral<"local_call">>;
     auth: z.ZodDefault<z.ZodNull>;

package/dist/actions/perform_action.js

@@ -56,6 +56,7 @@
  */
 import { DEV } from 'esm-env';
 import { apply_authorization_phase, has_any_scoped_role } from '../auth/request_context.js';
+import {} from '../hono_context.js';
 import { to_input_params } from '../http/schema_helpers.js';
 import { dispatch_with_post_commit_rollback } from '../http/pending_effects.js';
 import { JSONRPC_VERSION } from '../http/jsonrpc.js';

package/dist/actions/register_action_ws.js

@@ -104,6 +104,7 @@ import { JsonrpcRequest } from '../http/jsonrpc.js';
 import { dev_only, jsonrpc_error_messages } from '../http/jsonrpc_errors.js';
 import { create_jsonrpc_error_response, create_jsonrpc_notification, to_jsonrpc_envelope_id, to_jsonrpc_message_id, to_jsonrpc_params, is_jsonrpc_object, is_jsonrpc_request, is_jsonrpc_request_id } from '../http/jsonrpc_helpers.js';
 import { TOKEN_SCOPE_KEY, TEST_CONTEXT_PRESET_KEY } from '../hono_context.js';
+import {} from './action_types.js';
 import { compile_action_registry } from './compile_action_registry.js';
 import { cancel_action_spec, CancelNotificationParams } from './cancel.js';
 import { DEFAULT_WS_MAX_MESSAGE_BYTES, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_MESSAGE_TOO_BIG, WS_CLOSE_POLICY_VIOLATION, WS_CLOSE_SERVER_HEARTBEAT_TIMEOUT, WS_CLOSE_SESSION_REVOKED, WS_CLOSE_SESSION_REVOKED_REASON, utf8_length, utf8_length_over } from './transports.js';

package/dist/auth/account_routes.js

@@ -22,7 +22,7 @@
  * @module
  */
 import { clear_session_cookie, create_session_and_set_cookie } from './session_middleware.js';
-import { to_session_account } from './account_schema.js';
+import { RoleGrantSummaryJson, to_session_account } from './account_schema.js';
 import { account_status_route_shape, create_account_route_shapes, DEFAULT_MAX_SESSIONS } from './account_route_schema.js';
 import { hash_session_token, query_session_revoke_all_for_account, query_session_revoke_by_hash_unscoped } from './session_queries.js';
 import { query_account_by_username_or_email, query_update_account_password } from './account_queries.js';

package/dist/auth/audit_log_schema.d.ts

@@ -141,16 +141,16 @@ export declare const audit_metadata_schemas: Readonly<{
             concurrent_change: "concurrent_change";
         }>>;
         credential_type: z.ZodOptional<z.ZodEnum<{
-            session: "session";
             daemon_token: "daemon_token";
+            session: "session";
             api_token: "api_token";
         }>>;
     }, z.core.$loose>>;
     session_revoke: z.ZodObject<{
         session_id: z.core.$ZodBranded<z.ZodString, "SessionId", "out">;
         credential_type: z.ZodOptional<z.ZodEnum<{
-            session: "session";
             daemon_token: "daemon_token";
+            session: "session";
             api_token: "api_token";
         }>>;
     }, z.core.$loose>;
@@ -159,8 +159,8 @@ export declare const audit_metadata_schemas: Readonly<{
         reason: z.ZodOptional<z.ZodString>;
         attempted_account_id: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
         credential_type: z.ZodOptional<z.ZodEnum<{
-            session: "session";
             daemon_token: "daemon_token";
+            session: "session";
             api_token: "api_token";
         }>>;
     }, z.core.$loose>;
@@ -168,16 +168,16 @@ export declare const audit_metadata_schemas: Readonly<{
         token_id: z.ZodString;
         name: z.ZodString;
         credential_type: z.ZodOptional<z.ZodEnum<{
-            session: "session";
             daemon_token: "daemon_token";
+            session: "session";
             api_token: "api_token";
         }>>;
     }, z.core.$loose>;
     token_revoke: z.ZodObject<{
         token_id: z.ZodString;
         credential_type: z.ZodOptional<z.ZodEnum<{
-            session: "session";
             daemon_token: "daemon_token";
+            session: "session";
             api_token: "api_token";
         }>>;
     }, z.core.$loose>;

package/dist/auth/cell_action_specs.d.ts

@@ -385,8 +385,8 @@ export declare const CellListInput: z.ZodDefault<z.ZodObject<{
         updated_at: "updated_at";
     }>>;
     order_direction: z.ZodOptional<z.ZodEnum<{
-        desc: "desc";
         asc: "asc";
+        desc: "desc";
     }>>;
     limit: z.ZodOptional<z.ZodNumber>;
     offset: z.ZodOptional<z.ZodNumber>;
@@ -737,8 +737,8 @@ export declare const cell_list_action_spec: {
             updated_at: "updated_at";
         }>>;
         order_direction: z.ZodOptional<z.ZodEnum<{
-            desc: "desc";
             asc: "asc";
+            desc: "desc";
         }>>;
         limit: z.ZodOptional<z.ZodNumber>;
         offset: z.ZodOptional<z.ZodNumber>;
@@ -1090,8 +1090,8 @@ export declare const all_cell_action_specs: readonly [{
             updated_at: "updated_at";
         }>>;
         order_direction: z.ZodOptional<z.ZodEnum<{
-            desc: "desc";
             asc: "asc";
+            desc: "desc";
         }>>;
         limit: z.ZodOptional<z.ZodNumber>;
         offset: z.ZodOptional<z.ZodNumber>;

package/dist/auth/credential_type_schema.d.ts

@@ -45,8 +45,8 @@ export declare const CREDENTIAL_TYPE_DAEMON_TOKEN = "daemon_token";
 export declare const BUILTIN_CREDENTIAL_TYPES: readonly ["session", "api_token", "daemon_token"];
 /** Zod enum for builtin credential types only. */
 export declare const BuiltinCredentialType: z.ZodEnum<{
-    session: "session";
     daemon_token: "daemon_token";
+    session: "session";
     api_token: "api_token";
 }>;
 export type BuiltinCredentialType = z.infer<typeof BuiltinCredentialType>;

package/dist/cli/daemon.js

@@ -8,6 +8,7 @@
  * @module
  */
 import { z } from 'zod';
+import {} from '../runtime/deps.js';
 import { write_file_atomic } from '../runtime/fs.js';
 import { get_app_dir } from './config.js';
 /**

package/dist/cli/logger.js

@@ -11,6 +11,7 @@
  *
  * @module
  */
+import { Logger } from '@fuzdev/fuz_util/log.ts';
 /**
  * Creates a CLI logger wrapping a Logger with semantic output methods.
  *

package/dist/env/load.js

@@ -6,6 +6,7 @@
  *
  * @module
  */
+import { z } from 'zod';
 /**
  * Error thrown when environment validation fails.
  *

package/dist/hono_context.d.ts

@@ -24,8 +24,8 @@ import type { RequestContext } from './auth/request_context.js';
 export declare const CREDENTIAL_TYPES: readonly ["session", "api_token", "daemon_token"];
 /** Credential type — how a request was authenticated. */
 export declare const CredentialType: z.ZodEnum<{
-    session: "session";
     daemon_token: "daemon_token";
+    session: "session";
     api_token: "api_token";
 }>;
 export type CredentialType = z.infer<typeof CredentialType>;

package/dist/http/CLAUDE.md

@@ -151,7 +151,7 @@ WS); see ../../../docs/architecture.md §DEV-only Output Validation.
 `http/error_schemas.ts` is the **declarative** error surface:
 
 - `ERROR_*` `snake_case` string constants — single source of truth; use `.literal(ERROR_*)` in Zod schemas and inline checks in handlers
-- `ApiError`, `ValidationError`, `PermissionError`, `CredentialTypeRequiredError`, `RateLimitError`, `PayloadTooLargeError`, `ForeignKeyError` — standard shapes
+- `ApiError`, `ValidationError`, `PermissionError`, `CredentialTypeRequiredError`, `RateLimitError`, `PayloadTooLargeError`, `UnsupportedContentTypeError`, `ForeignKeyError` — standard shapes
 - `RouteErrorSchemas = Partial<Record<number, z.ZodType>>`
 - `RateLimitKey = 'ip' | 'account' | 'both'`
 
@@ -173,7 +173,7 @@ merges three layers, later overrides earlier at the same status code:
    - `auth.roles?.length` → 403 `PermissionError` (carries `required_roles`)
    - `auth.credential_types?.length` → 403 `CredentialTypeRequiredError` (carries `required_credential_types`; both gates set yields `z.union([PermissionError, CredentialTypeRequiredError])`)
    - `rate_limit` → 429 `RateLimitError`
-   - `checks_content_type` (every `POST`) → 415 `ApiError` (`unsupported_content_type`)
+   - `checks_content_type` (every `POST`) → 415 `UnsupportedContentTypeError`
    - `auth.actor !== 'none'` → widens 400 to a union with `ActorRequiredError` / `ActorNotOnAccountError` and adds 500 union of `NoActorsOnAccountError` / `AccountVanishedError`. Mirrors what the dispatcher's authorization phase actually emits on routes whose input declares `acting?: ActingActor` (per registry-time invariant 2) — so DEV-mode error-schema validation doesn't reject the auth phase's body.
 2. **Middleware** — from `MiddlewareSpec.errors` that apply to the route's path (via `middleware_applies`)
 3. **Explicit** — `RouteSpec.errors` — always wins

package/dist/http/auth_shape.d.ts

@@ -91,9 +91,9 @@ export declare const parse_acting: (value: unknown) => string | undefined;
  *   without an actor binding).
  */
 export declare const AuthAxisState: z.ZodEnum<{
-    required: "required";
-    none: "none";
     optional: "optional";
+    none: "none";
+    required: "required";
 }>;
 export type AuthAxisState = z.infer<typeof AuthAxisState>;
 /**
@@ -123,14 +123,14 @@ export type AuthAxisState = z.infer<typeof AuthAxisState>;
  */
 export declare const RouteAuth: z.ZodObject<{
     account: z.ZodEnum<{
-        required: "required";
-        none: "none";
         optional: "optional";
+        none: "none";
+        required: "required";
     }>;
     actor: z.ZodEnum<{
-        required: "required";
-        none: "none";
         optional: "optional";
+        none: "none";
+        required: "required";
     }>;
     roles: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
     credential_types: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;

package/dist/http/error_schemas.d.ts

@@ -236,6 +236,11 @@ export declare const PayloadTooLargeError: z.ZodObject<{
     error: z.ZodLiteral<"payload_too_large">;
 }, z.core.$loose>;
 export type PayloadTooLargeError = z.infer<typeof PayloadTooLargeError>;
+/** Unsupported content type error — returned when a `POST` route refuses the request's `Content-Type`. */
+export declare const UnsupportedContentTypeError: z.ZodObject<{
+    error: z.ZodLiteral<"unsupported_content_type">;
+}, z.core.$loose>;
+export type UnsupportedContentTypeError = z.infer<typeof UnsupportedContentTypeError>;
 /** Foreign key violation error — returned when a delete is blocked by references. */
 export declare const ForeignKeyError: z.ZodObject<{
     error: z.ZodLiteral<"foreign_key_violation">;
@@ -296,9 +301,9 @@ export type RouteErrorSchemas = Partial<Record<number, z.ZodType>>;
  * - `'both'` — both keys.
  */
 export declare const RateLimitKey: z.ZodEnum<{
-    both: "both";
     account: "account";
     ip: "ip";
+    both: "both";
 }>;
 export type RateLimitKey = z.infer<typeof RateLimitKey>;
 /**
@@ -326,7 +331,7 @@ export type RateLimitKey = z.infer<typeof RateLimitKey>;
  *   of `NoActorsOnAccountError` / `AccountVanishedError`. The dispatcher's
  *   authorization phase emits these whenever it tries to resolve an actor.
  * - **rate_limit**: 429 (`RateLimitError` with `retry_after`).
- * - **checks_content_type**: 415 (`ApiError`, `unsupported_content_type`) —
+ * - **checks_content_type**: 415 (`UnsupportedContentTypeError`) —
  *   every `POST` route (see `is_post_content_type_refused` in
  *   `http/simple_request.ts`).
  */

package/dist/http/error_schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error_schemas.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/error_schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAI9D,0CAA0C;AAC1C,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E,uDAAuD;AACvD,eAAO,MAAM,uBAAuB,EAAG,mBAA4B,CAAC;AAEpE,6CAA6C;AAC7C,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E,8CAA8C;AAC9C,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAI1E,wCAAwC;AACxC,eAAO,MAAM,6BAA6B,EAAG,yBAAkC,CAAC;AAEhF,+CAA+C;AAC/C,eAAO,MAAM,8BAA8B,EAAG,0BAAmC,CAAC;AAElF;;;;;;;;GAQG;AACH,eAAO,MAAM,8BAA8B,EAAG,0BAAmC,CAAC;AAElF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E,yCAAyC;AACzC,eAAO,MAAM,yBAAyB,EAAG,qBAA8B,CAAC;AAExE,sFAAsF;AACtF,eAAO,MAAM,yBAAyB,EAAG,qBAA8B,CAAC;AAExE,qDAAqD;AACrD,eAAO,MAAM,uBAAuB,EAAG,mBAA4B,CAAC;AAIpE,uCAAuC;AACvC,eAAO,MAAM,sBAAsB,EAAG,kBAA2B,CAAC;AAElE;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,EAAG,0BAAmC,CAAC;AAElF,uEAAuE;AACvE,eAAO,MAAM,mBAAmB,EAAG,eAAwB,CAAC;AAE5D,0CAA0C;AAC1C,eAAO,MAAM,uBAAuB,EAAG,mBAA4B,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAG,gBAAyB,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,EAAG,kBAA2B,CAAC;AAIlE,uDAAuD;AACvD,eAAO,MAAM,8BAA8B,EAAG,0BAAmC,CAAC;AAIlF,qEAAqE;AACrE,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E,8CAA8C;AAC9C,eAAO,MAAM,wBAAwB,EAAG,oBAA6B,CAAC;AAItE,0DAA0D;AAC1D,eAAO,MAAM,wBAAwB,EAAG,oBAA6B,CAAC;AAEtE,0GAA0G;AAC1G,eAAO,MAAM,qBAAqB,EAAG,iBAA0B,CAAC;AAEhE,gDAAgD;AAChD,eAAO,MAAM,sBAAsB,EAAG,kBAA2B,CAAC;AAElE,qEAAqE;AACrE,eAAO,MAAM,sBAAsB,EAAG,kBAA2B,CAAC;AAElE,6DAA6D;AAC7D,eAAO,MAAM,oCAAoC,EAAG,gCAAyC,CAAC;AAE9F,0DAA0D;AAC1D,eAAO,MAAM,iCAAiC,EAAG,6BAAsC,CAAC;AAIxF,6DAA6D;AAC7D,eAAO,MAAM,4BAA4B,EAAG,wBAAiC,CAAC;AAE9E,gEAAgE;AAChE,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E,oEAAoE;AACpE,eAAO,MAAM,wBAAwB,EAAG,oBAA6B,CAAC;AAItE,kDAAkD;AAClD,eAAO,MAAM,2BAA2B,EAAG,uBAAgC,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,qBAAqB,EAAG,iBAA0B,CAAC;AAEhE;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAG,qBAA8B,CAAC;AAExE,6CAA6C;AAC7C,eAAO,MAAM,mBAAmB,EAAG,eAAwB,CAAC;AAE5D,wEAAwE;AACxE,eAAO,MAAM,gCAAgC,EAAG,4BAAqC,CAAC;AAKtF,iFAAiF;AACjF,eAAO,MAAM,QAAQ;;iBAAuC,CAAC;AAC7D,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;iBAgB1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe;;;iBAG1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2BAA2B;;;iBAGtC,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEtF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,uBAAuB;;;iBAGlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E,2EAA2E;AAC3E,eAAO,MAAM,cAAc;;;iBAGzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,uFAAuF;AACvF,eAAO,MAAM,oBAAoB;;iBAE/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,qFAAqF;AACrF,eAAO,MAAM,eAAe;;iBAE1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,kBAAkB;;;;;;iBAG7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,eAAO,MAAM,sBAAsB;;iBAEjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,eAAO,MAAM,sBAAsB;;iBAEjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,eAAO,MAAM,oBAAoB;;iBAE/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AAEnE;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY;;;;EAAoC,CAAC;AAC9D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,WAAW,yBAAyB;IACzC,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,eAAO,MAAM,oBAAoB,GAAI,6EAOlC,yBAAyB,KAAG,iBA8C9B,CAAC"}
+{"version":3,"file":"error_schemas.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/error_schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAI9D,0CAA0C;AAC1C,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E,uDAAuD;AACvD,eAAO,MAAM,uBAAuB,EAAG,mBAA4B,CAAC;AAEpE,6CAA6C;AAC7C,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E,8CAA8C;AAC9C,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAI1E,wCAAwC;AACxC,eAAO,MAAM,6BAA6B,EAAG,yBAAkC,CAAC;AAEhF,+CAA+C;AAC/C,eAAO,MAAM,8BAA8B,EAAG,0BAAmC,CAAC;AAElF;;;;;;;;GAQG;AACH,eAAO,MAAM,8BAA8B,EAAG,0BAAmC,CAAC;AAElF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E,yCAAyC;AACzC,eAAO,MAAM,yBAAyB,EAAG,qBAA8B,CAAC;AAExE,sFAAsF;AACtF,eAAO,MAAM,yBAAyB,EAAG,qBAA8B,CAAC;AAExE,qDAAqD;AACrD,eAAO,MAAM,uBAAuB,EAAG,mBAA4B,CAAC;AAIpE,uCAAuC;AACvC,eAAO,MAAM,sBAAsB,EAAG,kBAA2B,CAAC;AAElE;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,EAAG,0BAAmC,CAAC;AAElF,uEAAuE;AACvE,eAAO,MAAM,mBAAmB,EAAG,eAAwB,CAAC;AAE5D,0CAA0C;AAC1C,eAAO,MAAM,uBAAuB,EAAG,mBAA4B,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAG,gBAAyB,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,EAAG,kBAA2B,CAAC;AAIlE,uDAAuD;AACvD,eAAO,MAAM,8BAA8B,EAAG,0BAAmC,CAAC;AAIlF,qEAAqE;AACrE,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E,8CAA8C;AAC9C,eAAO,MAAM,wBAAwB,EAAG,oBAA6B,CAAC;AAItE,0DAA0D;AAC1D,eAAO,MAAM,wBAAwB,EAAG,oBAA6B,CAAC;AAEtE,0GAA0G;AAC1G,eAAO,MAAM,qBAAqB,EAAG,iBAA0B,CAAC;AAEhE,gDAAgD;AAChD,eAAO,MAAM,sBAAsB,EAAG,kBAA2B,CAAC;AAElE,qEAAqE;AACrE,eAAO,MAAM,sBAAsB,EAAG,kBAA2B,CAAC;AAElE,6DAA6D;AAC7D,eAAO,MAAM,oCAAoC,EAAG,gCAAyC,CAAC;AAE9F,0DAA0D;AAC1D,eAAO,MAAM,iCAAiC,EAAG,6BAAsC,CAAC;AAIxF,6DAA6D;AAC7D,eAAO,MAAM,4BAA4B,EAAG,wBAAiC,CAAC;AAE9E,gEAAgE;AAChE,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E,oEAAoE;AACpE,eAAO,MAAM,wBAAwB,EAAG,oBAA6B,CAAC;AAItE,kDAAkD;AAClD,eAAO,MAAM,2BAA2B,EAAG,uBAAgC,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,qBAAqB,EAAG,iBAA0B,CAAC;AAEhE;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAG,qBAA8B,CAAC;AAExE,6CAA6C;AAC7C,eAAO,MAAM,mBAAmB,EAAG,eAAwB,CAAC;AAE5D,wEAAwE;AACxE,eAAO,MAAM,gCAAgC,EAAG,4BAAqC,CAAC;AAKtF,iFAAiF;AACjF,eAAO,MAAM,QAAQ;;iBAAuC,CAAC;AAC7D,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;iBAgB1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe;;;iBAG1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2BAA2B;;;iBAGtC,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEtF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,uBAAuB;;;iBAGlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E,2EAA2E;AAC3E,eAAO,MAAM,cAAc;;;iBAGzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,uFAAuF;AACvF,eAAO,MAAM,oBAAoB;;iBAE/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,0GAA0G;AAC1G,eAAO,MAAM,2BAA2B;;iBAEtC,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEtF,qFAAqF;AACrF,eAAO,MAAM,eAAe;;iBAE1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,kBAAkB;;;;;;iBAG7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,eAAO,MAAM,sBAAsB;;iBAEjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,eAAO,MAAM,sBAAsB;;iBAEjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,eAAO,MAAM,oBAAoB;;iBAE/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AAEnE;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY;;;;EAAoC,CAAC;AAC9D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,WAAW,yBAAyB;IACzC,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,eAAO,MAAM,oBAAoB,GAAI,6EAOlC,yBAAyB,KAAG,iBA8C9B,CAAC"}

package/dist/http/error_schemas.js

@@ -239,6 +239,10 @@ export const RateLimitError = z.looseObject({
 export const PayloadTooLargeError = z.looseObject({
     error: z.literal(ERROR_PAYLOAD_TOO_LARGE)
 });
+/** Unsupported content type error — returned when a `POST` route refuses the request's `Content-Type`. */
+export const UnsupportedContentTypeError = z.looseObject({
+    error: z.literal(ERROR_UNSUPPORTED_CONTENT_TYPE)
+});
 /** Foreign key violation error — returned when a delete is blocked by references. */
 export const ForeignKeyError = z.looseObject({
     error: z.literal(ERROR_FOREIGN_KEY_VIOLATION)
@@ -327,7 +331,7 @@ export const derive_error_schemas = ({ auth, has_input = false, has_params = fal
         errors[429] = RateLimitError;
     }
     if (checks_content_type) {
-        errors[415] = ApiError;
+        errors[415] = UnsupportedContentTypeError;
     }
     return errors;
 };

package/dist/http/surface.js

@@ -6,6 +6,7 @@
  *
  * @module
  */
+import { z } from 'zod';
 import { schema_to_surface, middleware_applies, merge_error_schemas, is_null_schema, is_strict_object_schema } from './schema_helpers.js';
 // --- Surface generation ---
 /**

package/dist/realtime/sse.js

@@ -7,6 +7,7 @@
  * @module
  */
 import { streamSSE } from 'hono/streaming';
+import { z } from 'zod';
 import { DEV } from 'esm-env';
 import { SSE_CONNECTED_COMMENT } from './sse_constants.js';
 const is_node_connection_stream = (value) => {

package/dist/server/app_server.js

@@ -10,6 +10,7 @@
 import { Hono } from 'hono';
 import { logger } from 'hono/logger';
 import { bodyLimit } from 'hono/body-limit';
+import { z } from 'zod';
 import { session_cookie_options } from '../auth/session_cookie.js';
 import { create_audit_log_sse, create_sse_connection_closer, audit_log_event_specs } from '../realtime/sse_auth_guard.js';
 import { BaseServerEnv } from './env.js';

package/dist/testing/CLAUDE.md

@@ -383,6 +383,7 @@ Walks Zod schemas to generate valid values for adversarial/round-trip tests.
 - `detect_format(field_schema)` — reads `format` / `pattern` from the JSON Schema representation.
 - `generate_valid_value(field, field_schema)` — base-type switch producing a valid sample (UUIDs → nil UUID, strings → `'xxxxxxxxxx'`, numbers → `1`, objects → recurse, enums → first entry, etc.). For branded-string refinements, walks a fallback chain synthesized from the `pattern` string the JSON Schema representation exposes: fixed-length hex (`^[0-9a-f]{N}$` — blake3 / sha256 / md5 digests; `0`.repeat(N)), prefix-lengthed slug (`^<prefix>_[A-Za-z0-9_-]{N}$` — `ApiTokenId`-style ids; `<prefix>_` + `x`.repeat(N)), absolute path prefix, URL prefix. First candidate that `safeParse` accepts is used.
 - `resolve_valid_path(path, params_schema?)` — swaps `:param` for a value the params schema accepts. Prefers `test_<name>` wherever the field schema admits it (the param name keeps failure messages readable); otherwise a UUID param takes the nil UUID and anything else is synthesized from the schema, percent-encoded. A synthesized value containing `/` is refused (it would route elsewhere) and falls back to `test_<name>`.
+- `to_route_content_type(route)` — the `Content-Type` a well-formed request to the route sends: `application/json`, or `application/octet-stream` for a `raw_body` route. Every `POST` route refuses anything else with 415 before its other gates, so every probe in the harnesses (auth, params and query fuzz, 404, data exposure, round trip) sends it, body or not.
 - `generate_valid_body(input_schema) => Record<string, unknown> | undefined` — builds a body satisfying the input schema. Throws with Zod `issues` if the generated body fails validation — surfaces broken generation logic with a descriptive error rather than a confusing 400 downstream.
 
 ### `integration_helpers.ts` — route lookup + body checks

package/dist/testing/admin_integration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin_integration.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/admin_integration.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAgC7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAc,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAW3E,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAmB1B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,0BAA0B,CAAC;AAYvE;;GAEG;AACH,MAAM,WAAW,mCAAmC;IACnD;;;;OAIG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;;OAIG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,uFAAuF;IACvF,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,4GAA4G;IAC5G,KAAK,EAAE,gBAAgB,CAAC;IACxB;;;OAGG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAiBD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yCAAyC,GACrD,SAAS,mCAAmC,KAC1C,IAm5BF,CAAC"}
+{"version":3,"file":"admin_integration.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/admin_integration.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAgC7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAc,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAW3E,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAmB1B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,0BAA0B,CAAC;AAavE;;GAEG;AACH,MAAM,WAAW,mCAAmC;IACnD;;;;OAIG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;;OAIG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,uFAAuF;IACvF,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,4GAA4G;IAC5G,KAAK,EAAE,gBAAgB,CAAC;IACxB;;;OAGG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAiBD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yCAAyC,GACrD,SAAS,mCAAmC,KAC1C,IAm5BF,CAAC"}

package/dist/testing/admin_integration.js

@@ -36,6 +36,7 @@ import { rpc_call_for_spec, require_rpc_endpoint_path, resolve_rpc_endpoints_for
 import { role_grant_offer_create_action_spec, role_grant_revoke_action_spec } from '../auth/role_grant_offer_action_specs.js';
 import { admin_account_list_action_spec, ADMIN_ACCOUNT_LIST_LIMIT_MAX, admin_session_list_action_spec, admin_session_revoke_all_action_spec, admin_token_revoke_all_action_spec, audit_log_list_action_spec, audit_log_role_grant_history_action_spec } from '../auth/admin_action_specs.js';
 import { account_token_create_action_spec, account_verify_action_spec } from '../auth/account_action_specs.js';
+import { to_route_content_type } from './schema_generators.js';
 /**
  * How long a failure-audit read waits for the pool-routed row to land.
  */
@@ -805,7 +806,7 @@ export const describe_standard_admin_integration_tests = (options) => {
                 for (const route of admin_routes) {
                     const res = await fixture.transport(route.path, {
                         method: route.method,
-                        headers: { host: 'localhost' }
+                        headers: { host: 'localhost', 'content-type': to_route_content_type(route) }
                     });
                     if (res.status === 401 || res.status === 403) {
                         error_collector.record(route_specs, route.method, route.path, res.status);

package/dist/testing/adversarial_404.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adversarial_404.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/adversarial_404.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAoB7B,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAyBlE;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,GAAI,SAAS,sBAAsB,KAAG,IA6E1E,CAAC"}
+{"version":3,"file":"adversarial_404.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/adversarial_404.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAoB7B,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AA6BlE;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,GAAI,SAAS,sBAAsB,KAAG,IA+E1E,CAAC"}

package/dist/testing/adversarial_404.js

@@ -14,7 +14,7 @@ import { test, assert, describe } from 'vitest';
 import { z } from 'zod';
 import { is_null_schema } from '../http/schema_helpers.js';
 import { create_auth_test_apps, create_route_skip_filter, select_auth_app } from './auth_apps.js';
-import { resolve_valid_path, generate_valid_body } from './schema_generators.js';
+import { resolve_valid_path, generate_valid_body, to_route_content_type } from './schema_generators.js';
 /**
  * Extract the error code from a 404 Zod schema for use in the stub handler.
  *
@@ -98,12 +98,14 @@ export const describe_adversarial_404 = (options) => {
                 const route = surface.routes.find((r) => `${r.method} ${r.path}` === key);
                 const app = select_auth_app(apps, route.auth);
                 const url = resolve_valid_path(route.path, spec.params);
-                const request_init = { method: route.method };
+                const request_init = {
+                    method: route.method,
+                    headers: { 'content-type': to_route_content_type(spec) }
+                };
                 // Send valid body for routes with input
                 if (!is_null_schema(spec.input)) {
                     const body = generate_valid_body(spec.input);
                     if (body !== undefined) {
-                        request_init.headers = { 'Content-Type': 'application/json' };
                         request_init.body = JSON.stringify(body);
                     }
                 }

package/dist/testing/adversarial_input.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adversarial_input.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/adversarial_input.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAiB7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB,OAAO,EAEN,0BAA0B,EAC1B,uBAAuB,EAGvB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AA8ClE,UAAU,aAAa;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,cAAc,EAAE,OAAO,0BAA0B,GAAG,OAAO,uBAAuB,CAAC;CACnF;AAED,UAAU,cAAc;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,UAAU,aAAa;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAID;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yBAAyB,GAAI,cAAc,CAAC,CAAC,OAAO,KAAG,KAAK,CAAC,aAAa,CAsMtF,CAAC;AAIF;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,GAAI,eAAe,CAAC,CAAC,SAAS,KAAG,KAAK,CAAC,cAAc,CA+B3F,CAAC;AAIF;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,GAAI,cAAc,CAAC,CAAC,SAAS,KAAG,KAAK,CAAC,aAAa,CA4CxF,CAAC;AAqBF;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,GAAI,SAAS,sBAAsB,KAAG,IAmN5E,CAAC"}
+{"version":3,"file":"adversarial_input.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/adversarial_input.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAiB7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB,OAAO,EAEN,0BAA0B,EAC1B,uBAAuB,EAGvB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAmDlE,UAAU,aAAa;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,cAAc,EAAE,OAAO,0BAA0B,GAAG,OAAO,uBAAuB,CAAC;CACnF;AAED,UAAU,cAAc;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,UAAU,aAAa;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAID;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yBAAyB,GAAI,cAAc,CAAC,CAAC,OAAO,KAAG,KAAK,CAAC,aAAa,CAsMtF,CAAC;AAIF;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,GAAI,eAAe,CAAC,CAAC,SAAS,KAAG,KAAK,CAAC,cAAc,CA+B3F,CAAC;AAIF;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,GAAI,cAAc,CAAC,CAAC,SAAS,KAAG,KAAK,CAAC,aAAa,CA4CxF,CAAC;AAqBF;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,GAAI,SAAS,sBAAsB,KAAG,IAyN5E,CAAC"}

package/dist/testing/adversarial_input.js

@@ -19,7 +19,7 @@ import { is_null_schema } from '../http/schema_helpers.js';
 import { filter_routes_with_input, filter_routes_with_params, filter_routes_with_query } from '../http/surface_query.js';
 import { ValidationError, ERROR_INVALID_REQUEST_BODY, ERROR_INVALID_JSON_BODY, ERROR_INVALID_ROUTE_PARAMS, ERROR_INVALID_QUERY_PARAMS } from '../http/error_schemas.js';
 import { create_auth_test_apps, create_route_skip_filter, select_auth_app } from './auth_apps.js';
-import { detect_format, generate_valid_value, resolve_valid_path } from './schema_generators.js';
+import { detect_format, generate_valid_value, resolve_valid_path, to_route_content_type } from './schema_generators.js';
 // --- Payload generation ---
 /** One wrong-type value per base type — one representative is sufficient. */
 const wrong_type_for = (base_type) => {
@@ -466,7 +466,10 @@ export const describe_adversarial_input = (options) => {
                         for (const tc of test_cases) {
                             test(tc.label, async () => {
                                 const url = build_fuzz_url(route.path, tc.params);
-                                const res = await app.request(url, { method: route.method });
+                                const res = await app.request(url, {
+                                    method: route.method,
+                                    headers: { 'content-type': to_route_content_type(route) }
+                                });
                                 assert.strictEqual(res.status, 400, `Expected 400 for ${key} [${tc.label}], got ${res.status}`);
                                 const body = await res.json();
                                 assert.strictEqual(body.error, ERROR_INVALID_ROUTE_PARAMS, `Expected ${ERROR_INVALID_ROUTE_PARAMS} for ${key} [${tc.label}], got: ${body.error}`);
@@ -504,7 +507,10 @@ export const describe_adversarial_input = (options) => {
                         for (const tc of test_cases) {
                             test(tc.label, async () => {
                                 const url = build_query_url(base_url, tc.query);
-                                const res = await app.request(url, { method: route.method });
+                                const res = await app.request(url, {
+                                    method: route.method,
+                                    headers: { 'content-type': to_route_content_type(route) }
+                                });
                                 assert.strictEqual(res.status, 400, `Expected 400 for ${key} [${tc.label}], got ${res.status}`);
                                 const body = await res.json();
                                 assert.strictEqual(body.error, ERROR_INVALID_QUERY_PARAMS, `Expected ${ERROR_INVALID_QUERY_PARAMS} for ${key} [${tc.label}], got: ${body.error}`);

package/dist/testing/attack_surface.js

@@ -19,7 +19,7 @@ import { assert_surface_invariants, assert_rpc_ws_surface_invariants, assert_sur
 import { describe_adversarial_input } from './adversarial_input.js';
 import { describe_adversarial_404 } from './adversarial_404.js';
 import { create_auth_test_apps, create_route_skip_filter, select_auth_app } from './auth_apps.js';
-import { resolve_valid_path } from './schema_generators.js';
+import { resolve_valid_path, to_route_content_type } from './schema_generators.js';
 import { assert_surface_matches_snapshot, assert_surface_deterministic, assert_only_expected_public_routes, assert_full_middleware_stack, assert_error_schema_valid } from './assertions.js';
 import { merge_error_schemas } from '../http/schema_helpers.js';
 import { collect_middleware_errors } from '../http/surface.js';
@@ -91,11 +91,11 @@ export const describe_adversarial_auth = (options) => {
     const spec_lookup = build_route_spec_lookup(route_specs);
     const test_path = (route) => resolve_valid_path(route.path, spec_lookup.get(`${route.method} ${route.path}`)?.params);
     const apps = create_auth_test_apps(route_specs, roles);
-    // every route's request carries the JSON content type a real client sends, so
-    // the per-route content-type check (415) never answers ahead of the auth gate
+    // every probe carries the content type a real client sends, so the
+    // per-route content-type check (415) never answers ahead of the auth gate
     const probe_init = (route) => ({
         method: route.method,
-        headers: { 'content-type': 'application/json' }
+        headers: { 'content-type': to_route_content_type(route) }
     });
     describe('adversarial HTTP auth enforcement', () => {
         describe('unauthenticated → 401', () => {

package/dist/testing/cross_backend/action_manifest.d.ts

@@ -49,15 +49,15 @@ export declare const ActionManifestEntry: z.ZodObject<{
     side_effects: z.ZodBoolean;
     /** The `account` auth axis. */
     account: z.ZodEnum<{
-        required: "required";
-        none: "none";
         optional: "optional";
+        none: "none";
+        required: "required";
     }>;
     /** The `actor` auth axis. */
     actor: z.ZodEnum<{
-        required: "required";
-        none: "none";
         optional: "optional";
+        none: "none";
+        required: "required";
     }>;
     /** Required roles (any-of), sorted; `[]` when the action declares no role gate. */
     roles: z.ZodArray<z.ZodString>;
@@ -65,9 +65,9 @@ export declare const ActionManifestEntry: z.ZodObject<{
     credential_types: z.ZodArray<z.ZodString>;
     /** Per-action rate-limit class, or `null` when the action declares none. */
     rate_limit: z.ZodNullable<z.ZodEnum<{
-        both: "both";
         account: "account";
         ip: "ip";
+        both: "both";
     }>>;
 }, z.core.$strict>;
 export type ActionManifestEntry = z.infer<typeof ActionManifestEntry>;
@@ -80,15 +80,15 @@ export declare const ActionManifest: z.ZodObject<{
         side_effects: z.ZodBoolean;
         /** The `account` auth axis. */
         account: z.ZodEnum<{
-            required: "required";
-            none: "none";
             optional: "optional";
+            none: "none";
+            required: "required";
         }>;
         /** The `actor` auth axis. */
         actor: z.ZodEnum<{
-            required: "required";
-            none: "none";
             optional: "optional";
+            none: "none";
+            required: "required";
         }>;
         /** Required roles (any-of), sorted; `[]` when the action declares no role gate. */
         roles: z.ZodArray<z.ZodString>;
@@ -96,9 +96,9 @@ export declare const ActionManifest: z.ZodObject<{
         credential_types: z.ZodArray<z.ZodString>;
         /** Per-action rate-limit class, or `null` when the action declares none. */
         rate_limit: z.ZodNullable<z.ZodEnum<{
-            both: "both";
             account: "account";
             ip: "ip";
+            both: "both";
         }>>;
     }, z.core.$strict>>;
 }, z.core.$strict>;

package/dist/testing/cross_backend/standard.d.ts

@@ -98,6 +98,12 @@ export interface StandardCrossProcessTestOptions {
      * / `info/refs`) which stream git protocol bytes.
      */
     round_trip_skip_routes?: Array<string>;
+    /**
+     * Forwarded to `describe_data_exposure_tests` as `skip_routes`
+     * (`'METHOD /path'` keys), as the in-process bundle's consumers pass it
+     * directly.
+     */
+    data_exposure_skip_routes?: Array<string>;
     /**
      * Forwarded to `describe_rpc_round_trip_tests` as `success_fixtures`
      * (method name → async params factory). Drives a populated **success**

package/dist/testing/cross_backend/standard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"standard.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/standard.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAM5D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,WAAW,+BAA+B;IAC/C,2CAA2C;IAC3C,UAAU,EAAE,SAAS,CAAC;IACtB;;;OAGG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B;;;;OAIG;IACH,YAAY,EAAE,mBAAmB,CAAC;IAClC,uFAAuF;IACvF,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;OAKG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC;;;OAGG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACvC;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/F;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,GAAG,CAC1B,MAAM,EACN,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CACnF,CAAC;CACF;AAED;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,GACjD,SAAS,+BAA+B,KACtC,IAoCF,CAAC"}
+{"version":3,"file":"standard.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/standard.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAM5D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,WAAW,+BAA+B;IAC/C,2CAA2C;IAC3C,UAAU,EAAE,SAAS,CAAC;IACtB;;;OAGG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B;;;;OAIG;IACH,YAAY,EAAE,mBAAmB,CAAC;IAClC,uFAAuF;IACvF,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;OAKG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC;;;OAGG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACvC;;;;OAIG;IACH,yBAAyB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1C;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/F;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,GAAG,CAC1B,MAAM,EACN,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CACnF,CAAC;CACF;AAED;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,GACjD,SAAS,+BAA+B,KACtC,IAqCF,CAAC"}

package/dist/testing/cross_backend/standard.js

@@ -33,7 +33,8 @@ export const describe_standard_cross_process_tests = (options) => {
     });
     describe_data_exposure_tests({
         setup_test: options.setup_test,
-        surface_source: options.surface_source
+        surface_source: options.surface_source,
+        skip_routes: options.data_exposure_skip_routes
     });
     if (options.roles) {
         describe_standard_admin_integration_tests({

package/dist/testing/cross_backend/testing_reset_actions.d.ts

@@ -427,21 +427,21 @@ export declare const testing_action_manifest_action_spec: {
             method: z.ZodString;
             side_effects: z.ZodBoolean;
             account: z.ZodEnum<{
-                required: "required";
-                none: "none";
                 optional: "optional";
+                none: "none";
+                required: "required";
             }>;
             actor: z.ZodEnum<{
-                required: "required";
-                none: "none";
                 optional: "optional";
+                none: "none";
+                required: "required";
             }>;
             roles: z.ZodArray<z.ZodString>;
             credential_types: z.ZodArray<z.ZodString>;
             rate_limit: z.ZodNullable<z.ZodEnum<{
-                both: "both";
                 account: "account";
                 ip: "ip";
+                both: "both";
             }>>;
         }, z.core.$strict>>;
     }, z.core.$strict>;

package/dist/testing/data_exposure.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"data_exposure.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/data_exposure.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAqB7B,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAYrE,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,0BAA0B,CAAC;AAIvE;;;;;GAKG;AACH,eAAO,MAAM,kCAAkC,GAAI,QAAQ,OAAO,KAAG,GAAG,CAAC,MAAM,CAuB9E,CAAC;AAIF;;GAEG;AACH,eAAO,MAAM,yCAAyC,GACrD,SAAS,UAAU,EACnB,mBAAkB,aAAa,CAAC,MAAM,CAA6B,KACjE,IAWF,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,wCAAwC,GACpD,SAAS,UAAU,EACnB,oBAAmB,aAAa,CAAC,MAAM,CAA8B,KACnE,IAgBF,CAAC;AAIF,kDAAkD;AAClD,MAAM,WAAW,uBAAuB;IACvC,kEAAkE;IAClE,UAAU,EAAE,SAAS,CAAC;IACtB;;;OAGG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,2FAA2F;IAC3F,gBAAgB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACzC,iGAAiG;IACjG,iBAAiB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1C,kDAAkD;IAClD,WAAW,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,GAAI,SAAS,uBAAuB,KAAG,IA0L/E,CAAC"}
+{"version":3,"file":"data_exposure.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/data_exposure.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAqB7B,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAgBrE,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,0BAA0B,CAAC;AAIvE;;;;;GAKG;AACH,eAAO,MAAM,kCAAkC,GAAI,QAAQ,OAAO,KAAG,GAAG,CAAC,MAAM,CAuB9E,CAAC;AAIF;;GAEG;AACH,eAAO,MAAM,yCAAyC,GACrD,SAAS,UAAU,EACnB,mBAAkB,aAAa,CAAC,MAAM,CAA6B,KACjE,IAWF,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,wCAAwC,GACpD,SAAS,UAAU,EACnB,oBAAmB,aAAa,CAAC,MAAM,CAA8B,KACnE,IAgBF,CAAC;AAIF,kDAAkD;AAClD,MAAM,WAAW,uBAAuB;IACvC,kEAAkE;IAClE,UAAU,EAAE,SAAS,CAAC;IACtB;;;OAGG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,2FAA2F;IAC3F,gBAAgB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACzC,iGAAiG;IACjG,iBAAiB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1C,kDAAkD;IAClD,WAAW,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,GAAI,SAAS,uBAAuB,KAAG,IA4L/E,CAAC"}

package/dist/testing/data_exposure.js

@@ -17,7 +17,7 @@ import './assert_dev_env.js';
  */
 import { describe, test, beforeAll, assert } from 'vitest';
 import { ROLE_ADMIN } from '../auth/role_schema.js';
-import { resolve_valid_path, generate_valid_body } from './schema_generators.js';
+import { resolve_valid_path, generate_valid_body, to_route_content_type } from './schema_generators.js';
 import { is_null_schema, is_strict_object_schema } from '../http/schema_helpers.js';
 import { is_keeper_auth, is_public_auth } from '../http/auth_shape.js';
 import { sensitive_field_blocklist, admin_only_field_blocklist, assert_no_sensitive_fields_in_json, pick_auth_headers } from './integration_helpers.js';
@@ -142,7 +142,11 @@ export const describe_data_exposure_tests = (options) => {
                 const url = resolve_valid_path(spec.path, spec.params);
                 const res = await fixture.transport(url, {
                     method: spec.method,
-                    headers: { host: 'localhost', origin: 'http://localhost:5173' }
+                    headers: {
+                        host: 'localhost',
+                        origin: 'http://localhost:5173',
+                        'content-type': to_route_content_type(spec)
+                    }
                 });
                 if (res.headers.get('Content-Type')?.includes('text/event-stream')) {
                     await res.body?.cancel();
@@ -167,10 +171,12 @@ export const describe_data_exposure_tests = (options) => {
                 if (skip_set.has(route_key))
                     continue;
                 const url = resolve_valid_path(spec.path, spec.params);
-                const headers = authed_account.create_session_headers();
                 const res = await fixture.transport(url, {
                     method: spec.method,
-                    headers
+                    headers: {
+                        ...authed_account.create_session_headers(),
+                        'content-type': to_route_content_type(spec)
+                    }
                 });
                 assert.strictEqual(res.status, 403, `${route_key} should return 403 for non-admin user`);
                 let error_body;
@@ -207,10 +213,7 @@ export const describe_data_exposure_tests = (options) => {
                 const headers = pick_auth_headers(spec, fixture, authed_account, admin_account);
                 const request_init = {
                     method: spec.method,
-                    headers: {
-                        ...headers,
-                        ...(body ? { 'content-type': 'application/json' } : {})
-                    },
+                    headers: { ...headers, 'content-type': to_route_content_type(spec) },
                     ...(body ? { body: JSON.stringify(body) } : {})
                 };
                 const res = await fixture.transport(url, request_init);

package/dist/testing/round_trip.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AA2B7B,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGzD,oDAAoD;AACpD,MAAM,WAAW,oBAAoB;IACpC;;;;;OAKG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;OAGG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,kDAAkD;IAClD,WAAW,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,+EAA+E;IAC/E,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD;;;;;;;;;;;;;OAaG;IACH,gBAAgB,CAAC,EAAE,GAAG,CACrB,MAAM,EACN,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CACnF,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,8BAA8B,GAAI,SAAS,oBAAoB,KAAG,IAyI9E,CAAC"}
+{"version":3,"file":"round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AA+B7B,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGzD,oDAAoD;AACpD,MAAM,WAAW,oBAAoB;IACpC;;;;;OAKG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;OAGG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,kDAAkD;IAClD,WAAW,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,+EAA+E;IAC/E,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD;;;;;;;;;;;;;OAaG;IACH,gBAAgB,CAAC,EAAE,GAAG,CACrB,MAAM,EACN,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CACnF,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,8BAA8B,GAAI,SAAS,oBAAoB,KAAG,IAmI9E,CAAC"}

package/dist/testing/round_trip.js

@@ -20,7 +20,7 @@ import { describe, test, beforeAll, assert } from 'vitest';
 import { ROLE_ADMIN } from '../auth/role_schema.js';
 import { is_public_auth, needs_actor, input_schema_declares_acting } from '../http/auth_shape.js';
 import { assert_response_matches_spec, pick_auth_headers } from './integration_helpers.js';
-import { resolve_valid_path, generate_valid_body } from './schema_generators.js';
+import { resolve_valid_path, generate_valid_body, to_route_content_type } from './schema_generators.js';
 /**
  * Run schema-driven round-trip validation tests.
  *
@@ -98,10 +98,7 @@ export const describe_round_trip_validation = (options) => {
             }
             const request_init = {
                 method: spec.method,
-                headers: {
-                    ...headers,
-                    ...(body ? { 'content-type': 'application/json' } : {})
-                },
+                headers: { ...headers, 'content-type': to_route_content_type(spec) },
                 ...(body ? { body: JSON.stringify(body) } : {})
             };
             const res = await fixture.transport(request_url, request_init);
@@ -132,10 +129,7 @@ export const describe_round_trip_validation = (options) => {
                 const headers = pick_auth_headers(spec, fixture, authed_account, admin_account);
                 const res = await fixture.transport(url, {
                     method: spec.method,
-                    headers: {
-                        ...headers,
-                        ...(body ? { 'content-type': 'application/json' } : {})
-                    },
+                    headers: { ...headers, 'content-type': to_route_content_type(spec) },
                     ...(body ? { body: JSON.stringify(body) } : {})
                 });
                 try {

package/dist/testing/rpc_helpers.js

@@ -9,6 +9,7 @@ import './assert_dev_env.js';
  * @module
  */
 import { assert } from 'vitest';
+import { z } from 'zod';
 import { JSONRPC_VERSION, JsonrpcErrorResponse, JsonrpcResponse } from '../http/jsonrpc.js';
 import { create_stub_app_server_context } from './stubs.js';
 /**

package/dist/testing/schema_generators.d.ts

@@ -17,6 +17,18 @@ import { type ZodFieldInfo } from '@fuzdev/fuz_util/zod.ts';
 export declare const detect_format: (field_schema: z.ZodType) => string | null;
 /** Generate a valid-ish value for a field based on its base type. */
 export declare const generate_valid_value: (field: ZodFieldInfo, field_schema: z.ZodType) => unknown;
+/**
+ * The `Content-Type` a well-formed request to a route sends: `application/json`,
+ * or `application/octet-stream` for a `raw_body` route. Every `POST` route
+ * refuses anything else with 415 before its other gates run (see
+ * `http/simple_request.ts`), so a probe of those gates must send it, body or
+ * not. Other methods don't check it, so sending it there is harmless.
+ *
+ * @param route - the route spec or surface route (reads `raw_body`)
+ */
+export declare const to_route_content_type: (route: {
+    raw_body?: boolean;
+}) => string;
 /**
  * Resolve a route path with valid-ish param values so params validation passes.
  * Used when testing input on routes that also have params.

package/dist/testing/schema_generators.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema_generators.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/schema_generators.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAKN,KAAK,YAAY,EACjB,MAAM,yBAAyB,CAAC;AAIjC;;;GAGG;AACH,eAAO,MAAM,aAAa,GAAI,cAAc,CAAC,CAAC,OAAO,KAAG,MAAM,GAAG,IAkBhE,CAAC;AAmHF,qEAAqE;AACrE,eAAO,MAAM,oBAAoB,GAAI,OAAO,YAAY,EAAE,cAAc,CAAC,CAAC,OAAO,KAAG,OAgGnF,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,EAAE,gBAAgB,CAAC,CAAC,SAAS,KAAG,MAiB9E,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAC/B,cAAc,CAAC,CAAC,OAAO,KACrB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SA+B5B,CAAC"}
+{"version":3,"file":"schema_generators.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/schema_generators.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAKN,KAAK,YAAY,EACjB,MAAM,yBAAyB,CAAC;AAIjC;;;GAGG;AACH,eAAO,MAAM,aAAa,GAAI,cAAc,CAAC,CAAC,OAAO,KAAG,MAAM,GAAG,IAkBhE,CAAC;AAmHF,qEAAqE;AACrE,eAAO,MAAM,oBAAoB,GAAI,OAAO,YAAY,EAAE,cAAc,CAAC,CAAC,OAAO,KAAG,OAgGnF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,GAAI,OAAO;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,KAAG,MACL,CAAC;AAElE;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,EAAE,gBAAgB,CAAC,CAAC,SAAS,KAAG,MAiB9E,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAC/B,cAAc,CAAC,CAAC,OAAO,KACrB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SA+B5B,CAAC"}

package/dist/testing/schema_generators.js

@@ -264,6 +264,16 @@ export const generate_valid_value = (field, field_schema) => {
             return 'test_value';
     }
 };
+/**
+ * The `Content-Type` a well-formed request to a route sends: `application/json`,
+ * or `application/octet-stream` for a `raw_body` route. Every `POST` route
+ * refuses anything else with 415 before its other gates run (see
+ * `http/simple_request.ts`), so a probe of those gates must send it, body or
+ * not. Other methods don't check it, so sending it there is harmless.
+ *
+ * @param route - the route spec or surface route (reads `raw_body`)
+ */
+export const to_route_content_type = (route) => route.raw_body ? 'application/octet-stream' : 'application/json';
 /**
  * Resolve a route path with valid-ish param values so params validation passes.
  * Used when testing input on routes that also have params.

package/dist/testing/transports/ws_client.js

@@ -19,6 +19,7 @@ import '../assert_dev_env.js';
  * @module
  */
 import { create_jsonrpc_error_response, create_jsonrpc_response, is_jsonrpc_error_response, is_jsonrpc_notification, is_jsonrpc_request, is_jsonrpc_response } from '../../http/jsonrpc_helpers.js';
+import { JSONRPC_VERSION } from '../../http/jsonrpc.js';
 // ---------------------------------------------------------------------
 // Predicates — compose with `WsClient.wait_for` and
 // `messages.filter(...)`. Both in-process and cross-process tests use

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fuzdev/fuz_app",
-  "version": "0.132.0",
+  "version": "0.132.1",
   "description": "fullstack app library",
   "glyph": "🗝",
   "logo": "logo.svg",
@@ -90,7 +90,7 @@
     "@fuzdev/fuz_css": "^0.66.1",
     "@fuzdev/fuz_ui": "^0.213.0",
     "@fuzdev/fuz_util": "^0.72.0",
-    "@fuzdev/gro": "^0.214.0",
+    "@fuzdev/gro": "^0.216.0",
     "@fuzdev/mdz": "^0.4.0",
     "@hono/bun": "^1.0.1",
     "@hono/deno": "^1.0.3",