npm - @blamejs/blamejs-shop - Versions diffs - 0.5.12 → 0.5.13 - Mend

@blamejs/blamejs-shop 0.5.12 → 0.5.13

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (521) hide show

package/lib/vendor/blamejs/test/layer-0-primitives/middleware-bot-disclose.test.js ADDED Viewed

@@ -0,0 +1,123 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * b.middleware.botDisclose — California SB 1001 bot-disclosure.
+ *
+ * Drives the load-bearing disclosure surfaces: the X-Bot-Disclosure
+ * header on every in-scope request, banner injection into text/html
+ * responses, res.locals for JSON handlers, and mountPaths scoping.
+ *
+ * Run standalone: `node test/layer-0-primitives/middleware-bot-disclose.test.js`
+ * Or via smoke:   `node test/smoke.js`
+ */
+var helpers   = require("../helpers");
+var b         = helpers.b;
+var check     = helpers.check;
+var _mockReq  = helpers._mockReq;
+var _mockRes  = helpers._mockRes;
+function testHeaderSetOnEveryRequest() {
+  var mw = b.middleware.botDisclose({ mountPaths: ["/chat"] });
+  var req = _mockReq({ method: "GET", url: "/chat" });
+  var res = _mockRes();
+  var nextCalled = false;
+  mw(req, res, function () { nextCalled = true; });
+  res.end("{}");
+  check("botDisclose: X-Bot-Disclosure header set for API consumers",
+    res._captured().headers["x-bot-disclosure"] === "automated-assistant");
+  check("botDisclose: delegates to the handler via next()", nextCalled === true);
+}
+function testBannerInjectedIntoHtml() {
+  var mw = b.middleware.botDisclose({
+    mountPaths: ["/chat"],
+    bannerHtml: '<div id="BOT-BANNER">automated</div>',
+  });
+  var req = _mockReq({ method: "GET", url: "/chat" });
+  var res = _mockRes();
+  mw(req, res, function () {});
+  // Operator handler renders HTML — the middleware patched res.end.
+  res.setHeader("content-type", "text/html; charset=utf-8");
+  res.end("<html><body><h1>hi</h1></body></html>");
+  var body = res._captured().body;
+  check("botDisclose: banner injected into the HTML response",
+    body.indexOf('<div id="BOT-BANNER">automated</div>') !== -1);
+  check("botDisclose: banner injected AFTER the <body> open tag",
+    body.indexOf("<body>") < body.indexOf("BOT-BANNER") &&
+    body.indexOf("BOT-BANNER") < body.indexOf("<h1>"));
+}
+function testNonHtmlResponseNotRewritten() {
+  var mw = b.middleware.botDisclose({ mountPaths: ["/api/chat"] });
+  var req = _mockReq({ method: "POST", url: "/api/chat" });
+  var res = _mockRes();
+  mw(req, res, function () {});
+  res.setHeader("content-type", "application/json");
+  res.end('{"reply":"hi"}');
+  check("botDisclose: JSON body left byte-for-byte intact (header carries the disclosure)",
+    res._captured().body === '{"reply":"hi"}');
+}
+function testJsonDisclosureOnLocals() {
+  var mw = b.middleware.botDisclose({
+    mountPaths: ["/chat"],
+    bannerJson: { _bot: true, disclosure: "automated-assistant" },
+  });
+  var req = _mockReq({ method: "GET", url: "/chat" });
+  var res = _mockRes();
+  res.locals = {};
+  mw(req, res, function () {});
+  check("botDisclose: bannerJson exposed on res.locals for JSON handlers",
+    res.locals.botDisclosure && res.locals.botDisclosure._bot === true);
+}
+function testMountPathScoping() {
+  var mw = b.middleware.botDisclose({ mountPaths: ["/chat"] });
+  var req = _mockReq({ method: "GET", url: "/dashboard" });
+  var res = _mockRes();
+  var nextCalled = false;
+  mw(req, res, function () { nextCalled = true; });
+  check("botDisclose: request outside mountPaths passes through untouched", nextCalled === true);
+  check("botDisclose: no header on out-of-scope route",
+    res._captured().headers["x-bot-disclosure"] === undefined);
+}
+function testNullMountPathsAppliesEverywhere() {
+  // null mountPaths = apply to every route.
+  var mw = b.middleware.botDisclose({});
+  var req = _mockReq({ method: "GET", url: "/anything/at/all" });
+  var res = _mockRes();
+  mw(req, res, function () {});
+  check("botDisclose: null mountPaths applies the header to every route",
+    res._captured().headers["x-bot-disclosure"] === "automated-assistant");
+}
+function testCustomHeaderName() {
+  var mw = b.middleware.botDisclose({ headerName: "X-Automated-Agent" });
+  var req = _mockReq({ method: "GET", url: "/x" });
+  var res = _mockRes();
+  mw(req, res, function () {});
+  check("botDisclose: custom headerName honored",
+    res._captured().headers["x-automated-agent"] === "automated-assistant");
+}
+function run() {
+  testHeaderSetOnEveryRequest();
+  testBannerInjectedIntoHtml();
+  testNonHtmlResponseNotRewritten();
+  testJsonDisclosureOnLocals();
+  testMountPathScoping();
+  testNullMountPathsAppliesEverywhere();
+  testCustomHeaderName();
+}
+module.exports = { run: run };
+if (require.main === module) {
+  Promise.resolve().then(run).then(
+    function () { console.log("OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e && e.message); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/middleware-cookies.test.js ADDED Viewed

@@ -0,0 +1,108 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * b.middleware.cookies — inbound Cookie-header threat detection.
+ *
+ * Drives the request-lifecycle wrapper around b.cookies.parseSafe:
+ * populates req.cookieJar, refuses on a HIGH-severity issue in enforce
+ * mode, passes through (but still parses) in audit-only mode, and is
+ * idempotent when a jar is already present.
+ *
+ * Run standalone: `node test/layer-0-primitives/middleware-cookies.test.js`
+ * Or via smoke:   `node test/smoke.js`
+ */
+var helpers   = require("../helpers");
+var b         = helpers.b;
+var check     = helpers.check;
+var _mockReq  = helpers._mockReq;
+var _mockRes  = helpers._mockRes;
+function testCleanCookiePopulatesJar() {
+  var mw = b.middleware.cookies({ mode: "enforce" });
+  var req = _mockReq({ headers: { cookie: "sid=abc; theme=dark" } });
+  var res = _mockRes();
+  var nextCalled = false;
+  mw(req, res, function () { nextCalled = true; });
+  check("cookies: clean header delegates via next()", nextCalled === true);
+  check("cookies: req.cookieJar populated with parsed pairs",
+    req.cookieJar.sid === "abc" && req.cookieJar.theme === "dark");
+}
+function testEnforceRefusesDuplicateName() {
+  // Cookie-tossing: a duplicate name is a HIGH issue; enforce mode
+  // refuses with HTTP 400 + JSON body and does NOT call next().
+  var mw = b.middleware.cookies({ mode: "enforce" });
+  var req = _mockReq({ headers: { cookie: "session=abc; session=evil" } });
+  var res = _mockRes();
+  var nextCalled = false;
+  mw(req, res, function () { nextCalled = true; });
+  check("cookies: enforce refuses HIGH-severity issue with 400", res.statusCode === 400);
+  check("cookies: refusal does not delegate to the handler", nextCalled === false);
+  var body = JSON.parse(res._captured().body);
+  check("cookies: refusal body names the threat",
+    body.error === "cookie-threat-detected" &&
+    body.issues.some(function (i) { return i.kind === "duplicate-name" && i.severity === "high"; }));
+}
+function testAuditOnlyPassesThroughButParses() {
+  var mw = b.middleware.cookies({ mode: "audit-only" });
+  var req = _mockReq({ headers: { cookie: "session=abc; session=evil" } });
+  var res = _mockRes();
+  var nextCalled = false;
+  mw(req, res, function () { nextCalled = true; });
+  check("cookies: audit-only passes the request through", nextCalled === true);
+  check("cookies: audit-only still populates the jar (last-write-wins)",
+    req.cookieJar.session === "evil");
+  check("cookies: audit-only writes no refusal status", res.statusCode === null);
+}
+function testAuditSinkReceivesThreat() {
+  var audit = b.testing.captureAudit();
+  var mw = b.middleware.cookies({ mode: "enforce", audit: audit });
+  var req = _mockReq({ headers: { cookie: "session=abc; session=evil" } });
+  mw(req, _mockRes(), function () {});
+  check("cookies: threat routed to the audit sink",
+    audit.captured.some(function (e) { return e.action === "middleware.cookies.threat-detected"; }));
+}
+function testIdempotentWhenJarPresent() {
+  var mw = b.middleware.cookies({ mode: "enforce" });
+  var req = _mockReq({ headers: { cookie: "session=abc; session=evil" } });
+  // A prior cookies middleware already parsed the jar this request.
+  req.cookieJar = { session: "trusted" };
+  var res = _mockRes();
+  var nextCalled = false;
+  mw(req, res, function () { nextCalled = true; });
+  check("cookies: idempotent — pre-existing jar is not re-parsed or refused",
+    nextCalled === true && req.cookieJar.session === "trusted" && res.statusCode === null);
+}
+function testControlByteRefused() {
+  var mw = b.middleware.cookies({ mode: "enforce" });
+  var req = _mockReq({ headers: { cookie: "a=1\r\nSet-Cookie: evil=1" } });
+  var res = _mockRes();
+  var nextCalled = false;
+  mw(req, res, function () { nextCalled = true; });
+  check("cookies: CR/LF control-byte header refused with 400",
+    res.statusCode === 400 && nextCalled === false);
+}
+function run() {
+  testCleanCookiePopulatesJar();
+  testEnforceRefusesDuplicateName();
+  testAuditOnlyPassesThroughButParses();
+  testAuditSinkReceivesThreat();
+  testIdempotentWhenJarPresent();
+  testControlByteRefused();
+}
+module.exports = { run: run };
+if (require.main === module) {
+  Promise.resolve().then(run).then(
+    function () { console.log("OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e && e.message); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/middleware-gpc.test.js ADDED Viewed

@@ -0,0 +1,121 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * b.middleware.gpc — Sec-GPC (Global Privacy Control) handler.
+ *
+ * Drives the advertised contract: reads Sec-GPC: 1, sets
+ * req.gpcOptOut, echoes Sec-GPC-Status, records purpose withdrawal
+ * through an optional b.consent integration, and always calls next().
+ *
+ * Run standalone: `node test/layer-0-primitives/middleware-gpc.test.js`
+ * Or via smoke:   `node test/smoke.js`
+ */
+var helpers   = require("../helpers");
+var b         = helpers.b;
+var check     = helpers.check;
+var _mockReq  = helpers._mockReq;
+var _mockRes  = helpers._mockRes;
+function testOptOutHonored() {
+  var mw = b.middleware.gpc({ mode: "enforce" });
+  var req = _mockReq({ headers: { "sec-gpc": "1" } });
+  var res = _mockRes();
+  var nextCalled = false;
+  mw(req, res, function () { nextCalled = true; });
+  check("gpc: Sec-GPC:1 sets req.gpcOptOut = true", req.gpcOptOut === true);
+  check("gpc: honored acknowledgement header echoed",
+    res._captured().headers["sec-gpc-status"] === "honored");
+  check("gpc: middleware always delegates via next()", nextCalled === true);
+}
+function testNoSignalIsNotOptOut() {
+  var mw = b.middleware.gpc({ mode: "enforce" });
+  var req = _mockReq({ headers: {} });
+  var res = _mockRes();
+  var nextCalled = false;
+  mw(req, res, function () { nextCalled = true; });
+  check("gpc: absent Sec-GPC leaves req.gpcOptOut = false", req.gpcOptOut === false);
+  check("gpc: no acknowledgement header without the signal",
+    res._captured().headers["sec-gpc-status"] === undefined);
+  check("gpc: passes through", nextCalled === true);
+}
+function testNonOneValueIsNotOptOut() {
+  // Only the exact "1" token is the opt-out per the IETF draft.
+  var mw = b.middleware.gpc({});
+  var req = _mockReq({ headers: { "sec-gpc": "0" } });
+  mw(req, _mockRes(), function () {});
+  check("gpc: Sec-GPC:0 is not an opt-out", req.gpcOptOut === false);
+}
+function testAuditOnlyModeStatus() {
+  var mw = b.middleware.gpc({ mode: "audit-only" });
+  var req = _mockReq({ headers: { "sec-gpc": "1" } });
+  var res = _mockRes();
+  mw(req, res, function () {});
+  check("gpc: audit-only still records the opt-out", req.gpcOptOut === true);
+  check("gpc: audit-only acknowledgement header reflects the mode",
+    res._captured().headers["sec-gpc-status"] === "audit-only");
+}
+function testStatusHeaderSuppressible() {
+  var mw = b.middleware.gpc({ statusHeader: false });
+  var req = _mockReq({ headers: { "sec-gpc": "1" } });
+  var res = _mockRes();
+  mw(req, res, function () {});
+  check("gpc: statusHeader:false suppresses the acknowledgement header",
+    res._captured().headers["sec-gpc-status"] === undefined);
+  check("gpc: opt-out still recorded even with the header suppressed",
+    req.gpcOptOut === true);
+}
+function testConsentIntegrationRecordsPurposes() {
+  var recorded = null;
+  var fakeConsent = {
+    recordOptOut: function (o) { recorded = o; },
+  };
+  var mw = b.middleware.gpc({ consent: fakeConsent });
+  var req = _mockReq({ headers: { "sec-gpc": "1" } });
+  mw(req, _mockRes(), function () {});
+  check("gpc: consent integration invoked with source sec-gpc",
+    recorded !== null && recorded.source === "sec-gpc");
+  check("gpc: the CCPA/CPRA opt-out purposes are withdrawn",
+    recorded.purposes.indexOf("sale") !== -1 &&
+    recorded.purposes.indexOf("share") !== -1 &&
+    recorded.purposes.indexOf("targeted-ads") !== -1 &&
+    recorded.purposes.indexOf("profiling") !== -1);
+}
+function testConsentErrorDoesNotCrashRequest() {
+  // A throwing consent integration must be swallowed (drop-silent) so
+  // the request that carried the GPC signal still completes.
+  var mw = b.middleware.gpc({
+    consent: { recordOptOut: function () { throw new Error("consent store down"); } },
+  });
+  var req = _mockReq({ headers: { "sec-gpc": "1" } });
+  var nextCalled = false;
+  mw(req, _mockRes(), function () { nextCalled = true; });
+  check("gpc: a throwing consent store does not crash the request",
+    nextCalled === true && req.gpcOptOut === true);
+}
+function run() {
+  testOptOutHonored();
+  testNoSignalIsNotOptOut();
+  testNonOneValueIsNotOptOut();
+  testAuditOnlyModeStatus();
+  testStatusHeaderSuppressible();
+  testConsentIntegrationRecordsPurposes();
+  testConsentErrorDoesNotCrashRequest();
+}
+module.exports = { run: run };
+if (require.main === module) {
+  Promise.resolve().then(run).then(
+    function () { console.log("OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e && e.message); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/middleware-headers.test.js ADDED Viewed

@@ -0,0 +1,163 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * b.middleware.headers — inbound HTTP header threat detection.
+ *
+ * Drives the RFC 9110 §5.1 token grammar check, RFC 9112 §6.1
+ * request-smuggling shapes (CL+TE, multi-CL, multi-TE), oversize
+ * count / value caps, deprecated X-Forwarded-* warning, and the
+ * enforce-vs-audit-only disposition.
+ *
+ * Run standalone: `node test/layer-0-primitives/middleware-headers.test.js`
+ * Or via smoke:   `node test/smoke.js`
+ */
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+function _req(headers) {
+  return { method: "GET", url: "/x", headers: headers || {} };
+}
+function _res() {
+  return b.testing.mockRes();
+}
+function testCleanHeadersPass() {
+  var mw = b.middleware.headers({});
+  var req = _req({ host: "app.example.com", accept: "*/*" });
+  var res = _res();
+  var nextCalled = false;
+  mw(req, res, function () { nextCalled = true; });
+  check("headers: clean request passes through", nextCalled === true);
+  check("headers: clean request writes no refusal", res.statusCode === null);
+}
+function testCrlfInValueRefused() {
+  var mw = b.middleware.headers({ mode: "enforce" });
+  var req = _req({ host: "x", "x-note": "line1\r\nline2" });
+  var res = _res();
+  var nextCalled = false;
+  mw(req, res, function () { nextCalled = true; });
+  check("headers: CR/LF in a header value refused with 400",
+    res.statusCode === 400 && nextCalled === false);
+  var body = JSON.parse(res._captured().body);
+  check("headers: refusal names header-value-control-byte",
+    body.error === "header-threat-detected" &&
+    body.issues.some(function (i) { return i.kind === "header-value-control-byte"; }));
+}
+function testClTeSmugglingRefused() {
+  var mw = b.middleware.headers({ mode: "enforce" });
+  var req = _req({ host: "x", "content-length": "5", "transfer-encoding": "chunked" });
+  var res = _res();
+  var nextCalled = false;
+  mw(req, res, function () { nextCalled = true; });
+  check("headers: CL+TE request-smuggling shape refused with 400",
+    res.statusCode === 400 && nextCalled === false);
+  var body = JSON.parse(res._captured().body);
+  check("headers: refusal names smuggling-cl-te",
+    body.issues.some(function (i) { return i.kind === "smuggling-cl-te"; }));
+}
+function testMultiValueSmugglingRefused() {
+  var mw = b.middleware.headers({ mode: "enforce" });
+  // Node surfaces repeated headers as an array — the proxy-desync class.
+  var reqCl = _req({ host: "x", "content-length": ["5", "6"] });
+  var resCl = _res();
+  mw(reqCl, resCl, function () {});
+  check("headers: multiple Content-Length values refused", resCl.statusCode === 400);
+  var reqTe = _req({ host: "x", "transfer-encoding": ["chunked", "gzip"] });
+  var resTe = _res();
+  mw(reqTe, resTe, function () {});
+  check("headers: multiple Transfer-Encoding values refused", resTe.statusCode === 400);
+}
+function testHeaderCountCapRefused() {
+  var mw = b.middleware.headers({ mode: "enforce", maxHeaderCount: 3 });
+  var req = _req({ host: "x", a: "1", b: "2", c: "3", d: "4" });
+  var res = _res();
+  var nextCalled = false;
+  mw(req, res, function () { nextCalled = true; });
+  check("headers: header count over the cap refused",
+    res.statusCode === 400 && nextCalled === false);
+}
+function testValueByteCapRefused() {
+  var mw = b.middleware.headers({ mode: "enforce", maxValueBytes: 16 });
+  var req = _req({ host: "x", "x-big": "A".repeat(64) });
+  var res = _res();
+  mw(req, res, function () {});
+  check("headers: header value over the byte cap refused", res.statusCode === 400);
+}
+function testInvalidHeaderNameShapeRefused() {
+  var mw = b.middleware.headers({ mode: "enforce" });
+  var req = _req({ host: "x", "bad header name": "v" });
+  var res = _res();
+  mw(req, res, function () {});
+  check("headers: non-RFC9110-token header name refused", res.statusCode === 400);
+}
+function testDeprecatedTrustHeaderWarnsButPasses() {
+  var audit = b.testing.captureAudit();
+  var mw = b.middleware.headers({ audit: audit });
+  var req = _req({ host: "x", "x-forwarded-for": "1.2.3.4" });
+  var res = _res();
+  var nextCalled = false;
+  mw(req, res, function () { nextCalled = true; });
+  check("headers: deprecated X-Forwarded-* is WARN-only — request passes",
+    nextCalled === true && res.statusCode === null);
+  check("headers: the deprecated-trust-header warning is audited",
+    audit.captured.some(function (e) {
+      return e.action === "middleware.headers.threat-detected" &&
+             e.metadata && e.metadata.kind === "deprecated-trust-header";
+    }));
+}
+function testTrustProxySuppressesWarning() {
+  var mw = b.middleware.headers({ trustProxy: true });
+  var req = _req({ host: "x", "x-forwarded-for": "1.2.3.4" });
+  var res = _res();
+  var nextCalled = false;
+  mw(req, res, function () { nextCalled = true; });
+  check("headers: trustProxy opt-in suppresses the X-Forwarded-* warning",
+    nextCalled === true && res.statusCode === null);
+}
+function testAuditOnlyPassesHighSeverity() {
+  var audit = b.testing.captureAudit();
+  var mw = b.middleware.headers({ mode: "audit-only", audit: audit });
+  var req = _req({ host: "x", "x-note": "a\r\nb" });
+  var res = _res();
+  var nextCalled = false;
+  mw(req, res, function () { nextCalled = true; });
+  check("headers: audit-only passes a HIGH-severity request through",
+    nextCalled === true && res.statusCode === null);
+  check("headers: audit-only still emits the threat audit",
+    audit.captured.some(function (e) { return e.action === "middleware.headers.threat-detected"; }));
+}
+function run() {
+  testCleanHeadersPass();
+  testCrlfInValueRefused();
+  testClTeSmugglingRefused();
+  testMultiValueSmugglingRefused();
+  testHeaderCountCapRefused();
+  testValueByteCapRefused();
+  testInvalidHeaderNameShapeRefused();
+  testDeprecatedTrustHeaderWarnsButPasses();
+  testTrustProxySuppressesWarning();
+  testAuditOnlyPassesHighSeverity();
+}
+module.exports = { run: run };
+if (require.main === module) {
+  Promise.resolve().then(run).then(
+    function () { console.log("OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e && e.message); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/middleware-host-allowlist.test.js ADDED Viewed

@@ -0,0 +1,154 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * b.middleware.hostAllowlist — DNS-rebinding defense.
+ *
+ * Drives the Host-header allowlist: exact + wildcard-single-label
+ * matching, port-agnostic entries, refusal of an off-allowlist or
+ * missing Host with HTTP 421, the onDeny hook, and create-time
+ * validation.
+ *
+ * Run standalone: `node test/layer-0-primitives/middleware-host-allowlist.test.js`
+ * Or via smoke:   `node test/smoke.js`
+ */
+var helpers   = require("../helpers");
+var b         = helpers.b;
+var check     = helpers.check;
+var _mockReq  = helpers._mockReq;
+var _mockRes  = helpers._mockRes;
+function _drive(mw, host) {
+  var headers = (host === null || host === undefined) ? {} : { host: host };
+  var req = _mockReq({ method: "GET", url: "/", headers: headers });
+  var res = _mockRes();
+  var nextCalled = false;
+  mw(req, res, function () { nextCalled = true; });
+  var cap = res._captured();
+  cap.nextCalled = nextCalled;
+  // The problem+json path sets res.statusCode directly (not via
+  // writeHead), so surface that property alongside the writeHead status.
+  cap.statusCode = res.statusCode;
+  return cap;
+}
+function testExactHostAllowed() {
+  var mw = b.middleware.hostAllowlist({ hosts: ["app.example.com"] });
+  var cap = _drive(mw, "app.example.com");
+  check("hostAllowlist: exact Host match passes through", cap.nextCalled === true);
+  check("hostAllowlist: allowed request writes no refusal", cap.status === null);
+}
+function testCaseInsensitiveMatch() {
+  var mw = b.middleware.hostAllowlist({ hosts: ["app.example.com"] });
+  var cap = _drive(mw, "APP.Example.COM");
+  check("hostAllowlist: Host match is case-insensitive (RFC 7230 §5.4)",
+    cap.nextCalled === true);
+}
+function testWrongHostRefused() {
+  var mw = b.middleware.hostAllowlist({ hosts: ["app.example.com"] });
+  var cap = _drive(mw, "attacker.evil.com");
+  check("hostAllowlist: off-allowlist Host refused with 421", cap.status === 421);
+  check("hostAllowlist: refusal does not delegate", cap.nextCalled === false);
+  check("hostAllowlist: default refusal body is Misdirected Request",
+    cap.body === "Misdirected Request");
+}
+function testMissingHostRefused() {
+  var mw = b.middleware.hostAllowlist({ hosts: ["app.example.com"] });
+  var cap = _drive(mw, null);
+  check("hostAllowlist: missing Host header refused with 421", cap.status === 421);
+  check("hostAllowlist: missing Host does not delegate", cap.nextCalled === false);
+}
+function testWildcardSingleLabel() {
+  var mw = b.middleware.hostAllowlist({ hosts: ["*.example.com"] });
+  var single = _drive(mw, "app.example.com");
+  check("hostAllowlist: wildcard matches a single label", single.nextCalled === true);
+  var multi = _drive(mw, "deep.app.example.com");
+  check("hostAllowlist: wildcard does NOT match multiple labels", multi.status === 421);
+  var apex = _drive(mw, "example.com");
+  check("hostAllowlist: wildcard does NOT match the bare apex", apex.status === 421);
+}
+function testPortAgnosticEntry() {
+  var mw = b.middleware.hostAllowlist({ hosts: ["app.example.com"] });
+  var cap = _drive(mw, "app.example.com:8443");
+  check("hostAllowlist: entry without a port matches any port", cap.nextCalled === true);
+}
+function testCustomDenyStatusAndBody() {
+  var mw = b.middleware.hostAllowlist({
+    hosts:      ["app.example.com"],
+    denyStatus: 403,
+    denyBody:   "Nope",
+  });
+  var cap = _drive(mw, "evil.com");
+  check("hostAllowlist: custom denyStatus honored", cap.status === 403);
+  check("hostAllowlist: custom denyBody honored", cap.body === "Nope");
+}
+function testOnDenyHookOwnsRefusal() {
+  var seen = null;
+  var mw = b.middleware.hostAllowlist({
+    hosts:  ["app.example.com"],
+    onDeny: function (req, res, info) {
+      seen = info;
+      res.writeHead(499, { "Content-Type": "text/plain" });
+      res.end("blocked-by-hook");
+    },
+  });
+  var cap = _drive(mw, "evil.com");
+  check("hostAllowlist: onDeny hook owns the refusal response",
+    cap.status === 499 && cap.body === "blocked-by-hook");
+  check("hostAllowlist: onDeny info carries the reason + host",
+    seen && seen.reason === "host-not-in-allowlist" && seen.host === "evil.com");
+}
+function testProblemDetailsMode() {
+  var mw = b.middleware.hostAllowlist({
+    hosts:          ["app.example.com"],
+    problemDetails: true,
+  });
+  var cap = _drive(mw, "evil.com");
+  check("hostAllowlist: problemDetails emits application/problem+json",
+    /application\/problem\+json/.test(cap.headers["content-type"] || ""));
+  check("hostAllowlist: problem document carries the 421 status",
+    cap.statusCode === 421);
+}
+function testCreateValidationThrows() {
+  function code(fn) {
+    try { fn(); return null; } catch (e) { return e.code || e.message; }
+  }
+  check("hostAllowlist: non-object opts throws",
+    code(function () { b.middleware.hostAllowlist(null); }) !== null);
+  check("hostAllowlist: empty hosts array throws",
+    /no-hosts/.test(code(function () { b.middleware.hostAllowlist({ hosts: [] }); })));
+  check("hostAllowlist: non-string host entry throws",
+    /bad-host/.test(code(function () { b.middleware.hostAllowlist({ hosts: [42] }); })));
+}
+function run() {
+  testExactHostAllowed();
+  testCaseInsensitiveMatch();
+  testWrongHostRefused();
+  testMissingHostRefused();
+  testWildcardSingleLabel();
+  testPortAgnosticEntry();
+  testCustomDenyStatusAndBody();
+  testOnDenyHookOwnsRefusal();
+  testProblemDetailsMode();
+  testCreateValidationThrows();
+}
+module.exports = { run: run };
+if (require.main === module) {
+  Promise.resolve().then(run).then(
+    function () { console.log("OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e && e.message); process.exit(1); }
+  );
+}