From f8037ab21f728df75a8603dbb3c4f44ad5e02cc9 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 30 Oct 2026 07:54:44 +0000 Subject: [PATCH] chore(scripts): route-envelope ledger note names the enveloped-refusal relay The actions.ts ledger note said the api forward's non-2xx relay spreads deps.error. Since the enveloped refusal is built by apiErrorResponse, the note and its comment name both builders. handBuilt stays 3. Co-authored-by: Claude Claude-Session: https://claude.ai/code/session_016WV4d1Np3hU7RQnA13YZcL --- scripts/check-route-envelope.mjs | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/scripts/check-route-envelope.mjs b/scripts/check-route-envelope.mjs index 2b8c46d8493..a1038278a45 100644 --- a/scripts/check-route-envelope.mjs +++ b/scripts/check-route-envelope.mjs @@ -975,10 +975,11 @@ const DISPATCHER_DOMAINS = { // carry the TARGET's credential-rotation headers (`Set-Cookie` lines, // `set-auth-token`, `set-admin-session-token`) — neither `deps.success` nor // `deps.error` takes headers, so each spreads the helper's own envelope and - // adds `headers`. + // adds `headers` (since #27738 an enveloped non-2xx refusal is built by + // `apiErrorResponse`, which takes none either, and is spread the same way). 'actions.ts': { handBuilt: 3, - note: 'one 405 for every verb but POST, which must carry an `Allow:` header (`deps.error` takes none); and the two answers of the same-origin api forward — the 2xx relay (`deps.success` spread) and the non-2xx relay (`deps.error` spread) — which must carry the target\'s Set-Cookie / set-auth-token / set-admin-session-token headers (neither helper takes any); every body is the helper\'s own declared envelope', + note: 'one 405 for every verb but POST, which must carry an `Allow:` header (`deps.error` takes none); and the two answers of the same-origin api forward — the 2xx relay (`deps.success` spread) and the non-2xx relay (`apiErrorResponse` for an enveloped refusal, else `deps.error`, spread) — which must carry the target\'s Set-Cookie / set-auth-token / set-admin-session-token headers (neither helper takes any); every body is the helper\'s own declared envelope', }, // [#12160] Not a domain either — the ADR-0126 §5 activation write-authority // gates, shared by the `/automation` toggle door, the `/actions` activation