(1) internal/jmap/client.go

• New(endpoint, auth) allows auth to be nil which is a footgun that could cause a panic if the consumer of the client forgets to check if auth is nil before calling auth.Authorize(). A better design is to detect a nil Authenticator in new and populate it with a no-op authenticator so that a consumer can always call client.Auth.Authorize(req) without nil checks.

(2) internal/jmap/request.go

• NewRequest defaults to including the CoreCapability if not provided a variadic list of capabilities. Is there a scenario where the core capability would not be included? If not, then the passed variadic arguments should be in addition to the core capability to ensure that the core capability cannot be inadvertently forgotten.

(3) lint errors related to error checking

--- output: lint ---
internal/jmap/client_test.go:21:17: Error return value of `io.WriteString` is not checked (errcheck)
                io.WriteString(w, `{"methodResponses":[["Core/echo",{},"c0"]],"sessionState":"s1"}`)
                              ^
internal/jmap/send.go:85:27: Error return value of `httpResp.Body.Close` is not checked (errcheck)
        defer httpResp.Body.Close()
                                 ^
internal/jmap/send_test.go:25:17: Error return value of `io.WriteString` is not checked (errcheck)
                io.WriteString(w, `{"methodResponses":[["Core/echo",{"ok":true},"c0"]],"sessionState":"s1"}`)
                              ^
internal/jmap/send_test.go:77:17: Error return value of `io.WriteString` is not checked (errcheck)
                io.WriteString(w, `{"methodResponses":[["A/get",{"v":1},"c0"],["B/echo",{"v":2},"c1"]],"sessionState":"s"}`)
                              ^
4 issues:
* errcheck: 4
--- end output ---