GeezerVison

Summary

• isVendorJsonForbidden lowercases Content-Type before matching, because media types are case-insensitive. Before, a vendor 403 sent as Application/JSON was treated as a firewall page, so a live key that only lacked a scope was rejected. This covers HubSpot and every forbiddenMeansScoped token check.
• requestZoomInfoToken now requires access_token to be a non-blank string. A blank or non-string token used to be cached and sent as a Bearer token. The saved-credential minter and the legacy inline ZoomInfo path both call this function, so both are covered. The expires_in fallback is unchanged.

Type of Change

• Bug fix

Testing

• New cases: a mixed-case JSON 403 in hubspot.test.ts, and blank and non-string access_token in zoominfo/client.test.ts. All of them fail on the pre-fix code and pass after.
• 24 test files and 253 tests pass across token-service-accounts, lib/internal/zoominfo and the ZoomInfo minter.
• bun run lint, check:test-patterns, check:comment-hygiene, check:utils and check:explicit-any pass, and so does the type-check in the pre-push hook.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)