feat: close application architecture gaps

packages/csr/test/api-call.test.ts

@@ -64,6 +64,21 @@ test("POST sends a JSON body", async () => {
   );
 });
 
+test("useFetch is the public dynamic-path transport", async () => {
+  const { calls, win } = harness({ status: 200, payload: { ok: true } });
+  const useFetch = (
+    win as unknown as {
+      useFetch: (path: string, options: { method: string; body: unknown }) => Promise<unknown>;
+    }
+  ).useFetch;
+
+  await expect(
+    useFetch("/api/users/42/test", { method: "POST", body: { dryRun: true } }),
+  ).resolves.toEqual({ ok: true });
+  expect(calls[0]!.url).toBe("/api/users/42/test");
+  expect(calls[0]!.init.body).toBe(JSON.stringify({ dryRun: true }));
+});
+
 test("a non-GET request carries the CSRF token from the cookie", async () => {
   const { callApi, calls, win } = harness({ status: 200, payload: {} });
   win.document.cookie = "wrn-csrf=token-123";