@owlmeans/server-api 0.1.18-rc.45 → 0.1.18-rc.47

package/README.md

@@ -10,7 +10,7 @@ only when composing a context without that package. WebSocket routes belong to
 ## Installation
 
 ```bash
-bun add @owlmeans/server-api@^0.1.18-rc.45
+bun add @owlmeans/server-api@^0.1.18-rc.47
 ```
 
 ## Concepts
@@ -240,7 +240,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills@^0.1.18-rc.42
+npx @owlmeans/agent-skills@^0.1.18-rc.45
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/server-api",
-  "version": "0.1.18-rc.45",
-  "generatedAt": "2026-09-29T08:01:58.109Z",
+  "version": "0.1.18-rc.47",
+  "generatedAt": "2026-10-01T23:27:48.718Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/server-api/SKILL.md

@@ -7,7 +7,7 @@ user-invocable: false
 
 # @owlmeans/server-api
 
-**Install:** `bun add @owlmeans/server-api@^0.1.18-rc.45`
+**Install:** `bun add @owlmeans/server-api@^0.1.18-rc.47`
 
 Make handlers from the protocol declaration so input and output types stay coupled to the shared
 contract:
@@ -38,6 +38,12 @@ export const serverBindings = [
 any protocol and receives all its typed sections plus request metadata. A successful callback
 return resolves the entrypoint with `EntrypointOutcome.Ok`; a thrown error rejects it.
 
+A body contract may be a scalar (`schema<string>({ type: 'string' })`, a number, a boolean): the
+server's JSON parser takes any JSON value, so `"abc"`, `42` or `false` reach the handler as that
+value. An unquoted string or an empty body under `application/json` is invalid JSON and answers
+400 before the handler runs — `@owlmeans/api` never sends either (it quotes a scalar body).
+`tests/json-body.spec.ts` runs it through `appendApiServer`.
+
 ## Wrap exactly once
 
 A handler is wrapped by `handlers<Context>()` exactly once — either shape above (create the bound

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/server-api",
-  "version": "0.1.18-rc.45",
+  "version": "0.1.18-rc.47",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -33,15 +33,15 @@
     "@fastify/helmet": "^13.1.0",
     "@fastify/middie": "^9.0.2",
     "@fastify/multipart": "^9.0.1",
-    "@owlmeans/api": "^0.1.18-rc.41",
-    "@owlmeans/auth": "^0.1.18-rc.36",
-    "@owlmeans/auth-common": "^0.1.18-rc.41",
+    "@owlmeans/api": "^0.1.18-rc.43",
+    "@owlmeans/auth": "^0.1.18-rc.37",
+    "@owlmeans/auth-common": "^0.1.18-rc.43",
     "@owlmeans/context": "^0.1.18-rc.32",
     "@owlmeans/error": "^0.1.18-rc.36",
-    "@owlmeans/entrypoint": "^0.1.18-rc.37",
+    "@owlmeans/entrypoint": "^0.1.18-rc.38",
     "@owlmeans/route": "^0.1.18-rc.33",
-    "@owlmeans/server-context": "^0.1.18-rc.38",
-    "@owlmeans/server-entrypoint": "^0.1.18-rc.36",
+    "@owlmeans/server-context": "^0.1.18-rc.39",
+    "@owlmeans/server-entrypoint": "^0.1.18-rc.37",
     "ajv-errors": "^3.0.0",
     "fastify": "^5.0.0",
     "fastify-raw-body": "^5.0.0",

package/tests/error-status.spec.ts

@@ -1,7 +1,7 @@
 import { afterAll, beforeAll, describe, expect, test } from 'bun:test'
 import Fastify from 'fastify'
 import type { FastifyInstance } from 'fastify'
-import { AuthForbidden, AuthorizationError } from '@owlmeans/auth'
+import { AuthForbidden, AuthorizationError, AuthUnknown } from '@owlmeans/auth'
 import { ResilientError, SEPARATOR } from '@owlmeans/error'
 import { provideResponse } from '@owlmeans/entrypoint'
 import { errorExposure, errorStatus, handleError, INCIDENT_ID_HEADER } from '../src/utils/error.js'
@@ -254,6 +254,12 @@ describe('@owlmeans/server-api — handleError status', () => {
     }
   })
 
+  test('an unknown authentication method or identity answers 400, as thrown and after a marshal hop', async () => {
+    expect((await answer(new AuthUnknown('email-otp'))).status).toBe(400)
+    expect((await answer(ResilientError.marshal(new AuthUnknown('entity')))).status).toBe(400)
+    expect((await answer(new AuthUnknown(), '/execute')).status).toBe(400)
+  })
+
   test('honours an explicitly exposed 5xx without opening arbitrary server statuses', async () => {
     expect((await answer(new TemporarilyUnavailable())).status).toBe(503)
     const Unexposed = declaring('ServerApiSpecUnexposed503', 503)

package/tests/json-body.spec.ts

@@ -0,0 +1,72 @@
+import { afterAll, beforeAll, describe, expect, test } from 'bun:test'
+import { AppType } from '@owlmeans/context'
+import { contract, protocol, schema, typed } from '@owlmeans/entrypoint'
+import { backend, route, RouteMethod } from '@owlmeans/route'
+import { config, makeServerContext } from '@owlmeans/server-context'
+import type { ServerConfig, ServerContext } from '@owlmeans/server-context'
+import { bind } from '@owlmeans/server-entrypoint'
+import type { FastifyInstance } from 'fastify'
+import { handlers } from '../src/protocol.js'
+import { appendApiServer } from '../src/server.js'
+
+interface Echo { value: unknown, type: string }
+
+const echoOf = <T>(alias: string, body: ReturnType<typeof schema<T>>) => protocol(
+  route(`server-api-test:${alias}`, `/echo/${alias}`, backend(null, RouteMethod.POST)),
+  contract(body, typed<Echo>()),
+)
+
+const text = echoOf('text', schema<string>({ type: 'string' }))
+const count = echoOf('count', schema<number>({ type: 'number' }))
+const flag = echoOf('flag', schema<boolean>({ type: 'boolean' }))
+const record = echoOf('record', schema<{ a: number }>({ type: 'object', properties: { a: { type: 'number' } }, required: ['a'] }))
+
+/**
+ * A scalar JSON body through the package's own server — `appendApiServer`, its Fastify instance,
+ * its body validation and a protocol-bound handler — exactly as `@owlmeans/api` now sends it:
+ * JSON text. The client half of the round trip is `@owlmeans/api`'s `body.spec.ts`.
+ */
+describe('@owlmeans/server-api — a scalar JSON body', () => {
+  let server: FastifyInstance
+  let context: ServerContext<ServerConfig>
+
+  beforeAll(async () => {
+    const service = 'server-api-tests'
+    context = makeServerContext(config<ServerConfig>(service, {
+      services: { [service]: { service, type: AppType.Backend, host: '127.0.0.1', default: true } },
+    } as Partial<ServerConfig>)) as ServerContext<ServerConfig>
+    const served = appendApiServer(context)
+    const api = handlers<ServerContext<ServerConfig>>()
+    for (const echo of [text, count, flag, record]) {
+      context.registerEntrypoint(bind(echo, api.request(echo, async request => ({ value: request.body, type: typeof request.body }))))
+    }
+    context.configure()
+    await context.init()
+    server = served.getApiServer().server
+    await server.ready()
+  })
+
+  afterAll(async () => { await server?.close() })
+
+  const post = async (alias: string, payload: string, type: string = 'application/json') =>
+    await server.inject({ method: 'POST', url: `/echo/${alias}`, headers: { 'content-type': type }, payload })
+
+  const echoed = async (alias: string, payload: string): Promise<Echo> => (await post(alias, payload)).json<Echo>()
+
+  test('a JSON string, number or boolean reaches the handler as that value', async () => {
+    expect(await echoed('text', '"abc"')).toEqual({ value: 'abc', type: 'string' })
+    expect(await echoed('text', '""')).toEqual({ value: '', type: 'string' })
+    expect(await echoed('text', '"123"')).toEqual({ value: '123', type: 'string' })
+    expect(await echoed('count', '42')).toEqual({ value: 42, type: 'number' })
+    expect(await echoed('flag', 'false')).toEqual({ value: false, type: 'boolean' })
+  })
+
+  test('an object body is unchanged', async () => {
+    expect(await echoed('record', '{"a":1}')).toEqual({ value: { a: 1 }, type: 'object' })
+  })
+
+  test('an unquoted string or an empty JSON body is refused with 400 — what the client no longer sends', async () => {
+    expect((await post('text', 'abc')).statusCode).toBe(400)
+    expect((await post('text', '')).statusCode).toBe(400)
+  })
+})