# TESTS — F-003 HTTP foundation and request context

## Unit — src/shared/tests/http-input.test.ts
1. parseJson returns parsed value for valid input
2. parseJson throws AppError 400 VALIDATION_ERROR with field issues for invalid input
3. parseJson rejects non-object input when schema expects object

## Composition — src/app/tests/http-foundation.test.ts
(app built with logger writing to an in-memory stream)

1. GET /health responds 200 with x-request-id header (UUID shape)
2. Valid incoming x-request-id is propagated: same value in response header and in the request log line
3. Malicious x-request-id (bad charset / >128 chars) is replaced by generated UUID; log line carries the generated id
4. Unknown route -> 404 envelope { error: { statusCode: 404, code: NOT_FOUND, message }, requestId } + x-request-id header
5. Invalid JSON body on test route -> 400, envelope shape stable, requestId present
6. Schema-invalid body on test route -> 400 code VALIDATION_ERROR, issues mention field path only
7. Handler throwing Error('secret internal detail') -> 500 generic message, response body contains neither the message nor a stack; error log line contains requestId and stack
8. Every request produces exactly one 'request completed' log line carrying the requestId

## Manual / QA
- verify.sh green; live curl shows x-request-id header and JSON envelope on unknown route.