@bongos/core 1.19.1073 → 1.19.1075

package/tests/cf_ruleset_preflight.mjs

@@ -1,142 +0,0 @@
-// tests/cf_ruleset_preflight.mjs — DB-free, network-free unit tests for the
-// Cloudflare RULESET scope preflight (scripts/gds/cf-tunnel.js
-// classifyRulesetScope + checkRulesetScope, task 1002511).
-//
-// WHY ITS OWN FILE: `cf_tunnel` is in run-unit-tests.js's INTEGRATION exclusion
-// set, so anything added only to tests/cf_tunnel.mjs never runs in the default
-// DB-free unit gate that /builder-ship smokes. This file is auto-discovered by
-// that gate, so the preflight's behaviour is actually enforced on every ship.
-//
-// Run:  node tests/cf_ruleset_preflight.mjs
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { createRequire } from 'node:module';
-const require = createRequire(import.meta.url);
-const cf = require('../scripts/gds/cf-tunnel.js');
-
-const PHASE = 'http_request_late_transform';
-
-// ── the constants the rule + the preflight share ────────────────────────────
-test('the cookie-strip rule constants are exported for callers + this test', () => {
-  assert.equal(cf.COOKIE_STRIP_PHASE, PHASE);
-  assert.match(cf.COOKIE_STRIP_RULE_DESC, /Cookie/);
-  assert.match(cf.COOKIE_STRIP_EXPRESSION, /term-/);
-  assert.match(cf.COOKIE_STRIP_EXPRESSION, /sandbox-/);
-});
-
-// ── classifyRulesetScope: PURE, and a NEGATIVE detector only ────────────────
-test('classifyRulesetScope: 403 → NOT readable + guidance naming the zone and Transform Rules', () => {
-  const r = cf.classifyRulesetScope({
-    status: 403,
-    body: { success: false, errors: [{ message: 'Actor does not have permission' }] },
-    phase: PHASE,
-    zone: 'cloudbongos.com',
-  });
-  assert.equal(r.readable, false);
-  assert.match(r.guidance, /Transform Rules/);
-  assert.match(r.guidance, /Cache Rules/);
-  assert.match(r.guidance, /cloudbongos\.com/);
-  assert.match(r.guidance, /API Tokens/i);
-});
-
-test('classifyRulesetScope: 401 → NOT readable (definitively no scope)', () => {
-  const r = cf.classifyRulesetScope({ status: 401, body: null, phase: PHASE, zone: 'cloudbongos.com' });
-  assert.equal(r.readable, false);
-  assert.match(r.reason, /401/);
-});
-
-test('classifyRulesetScope: 200 → readable, and NEVER claims edit scope is confirmed', () => {
-  const r = cf.classifyRulesetScope({
-    status: 200,
-    body: { success: true, result: { id: 'rs1', rules: [] } },
-    phase: PHASE,
-    zone: 'cloudbongos.com',
-  });
-  assert.equal(r.readable, true);
-  // HONESTY GATE: a GET proves READ, not EDIT. There must be no `editable` field,
-  // and the human-readable text must not read as a confirmed security control.
-  assert.equal('editable' in r, false, 'a read probe must never report an `editable` verdict');
-  assert.doesNotMatch(`${r.reason} ${r.guidance || ''}`, /scope confirmed|edit scope (is )?(confirmed|verified|present)/i);
-  assert.match(r.reason, /not proven|read/i, 'the reason must say edit scope is unproven');
-});
-
-test('classifyRulesetScope: 404 entrypoint → readable (an empty phase is legitimate)', () => {
-  const r = cf.classifyRulesetScope({
-    status: 404,
-    body: { success: false, errors: [{ message: 'ruleset not found' }] },
-    phase: PHASE,
-    zone: 'cloudbongos.com',
-  });
-  assert.equal(r.readable, true);
-});
-
-test('classifyRulesetScope: 500 → NOT readable, reported as inconclusive (never a pass)', () => {
-  const r = cf.classifyRulesetScope({ status: 500, body: null, phase: PHASE, zone: 'cloudbongos.com' });
-  assert.equal(r.readable, false);
-  assert.match(r.reason, /inconclusive|failed/i);
-});
-
-// ── checkRulesetScope: its OWN raw fetch, injectable, never a real call ─────
-test('checkRulesetScope: probes the phase entrypoint (NOT /user/tokens/verify) and reports readable', async () => {
-  const calls = [];
-  const fetchImpl = async (url, opts = {}) => {
-    calls.push({ url, auth: opts.headers.Authorization });
-    if (url.includes('/zones?name=')) return { status: 200, json: async () => ({ success: true, result: [{ id: 'zoneA', name: 'cloudbongos.com' }] }) };
-    return { status: 200, json: async () => ({ success: true, result: { id: 'rs1', rules: [] } }) };
-  };
-  const r = await cf.checkRulesetScope({ zone: 'cloudbongos.com', phase: PHASE, token: 'tok_1', fetchImpl });
-  assert.equal(r.readable, true);
-  assert.equal(r.zone, 'cloudbongos.com');
-  const probe = calls[calls.length - 1];
-  assert.match(probe.url, new RegExp(`/zones/zoneA/rulesets/phases/${PHASE}/entrypoint$`));
-  assert.equal(probe.auth, 'Bearer tok_1');
-  // An IP-locked token returns "Invalid API Token" from verify (builder-box-lifecycle
-  // learning) — the preflight must probe the real operation instead.
-  assert.ok(!calls.some((c) => /tokens\/verify/.test(c.url)), 'must not use /user/tokens/verify');
-});
-
-test('checkRulesetScope: 403 on the entrypoint → NOT readable + actionable guidance', async () => {
-  const fetchImpl = async (url) => {
-    if (url.includes('/zones?name=')) return { status: 200, json: async () => ({ success: true, result: [{ id: 'zoneA', name: 'cloudbongos.com' }] }) };
-    return { status: 403, json: async () => ({ success: false, errors: [{ message: 'Actor does not have permission' }] }) };
-  };
-  const r = await cf.checkRulesetScope({ zone: 'cloudbongos.com', phase: PHASE, token: 'tok_1', fetchImpl });
-  assert.equal(r.readable, false);
-  assert.match(r.guidance, /Transform Rules/);
-  assert.match(r.guidance, /cloudbongos\.com/);
-});
-
-test('checkRulesetScope: a known zoneId skips the zone lookup (one call only)', async () => {
-  const calls = [];
-  const fetchImpl = async (url) => {
-    calls.push(url);
-    return { status: 200, json: async () => ({ success: true, result: { id: 'rs1', rules: [] } }) };
-  };
-  const r = await cf.checkRulesetScope({ zone: 'cloudbongos.com', phase: PHASE, token: 'tok_1', zoneId: 'zoneGiven', fetchImpl });
-  assert.equal(r.readable, true);
-  assert.equal(calls.length, 1);
-  assert.match(calls[0], /\/zones\/zoneGiven\/rulesets\//);
-});
-
-test('checkRulesetScope: no token → NOT readable, and ZERO network calls', async () => {
-  let called = false;
-  const fetchImpl = async () => { called = true; return { status: 200, json: async () => ({}) }; };
-  const r = await cf.checkRulesetScope({ zone: 'cloudbongos.com', phase: PHASE, token: '', fetchImpl });
-  assert.equal(r.readable, false);
-  assert.match(r.reason, /no CLOUDFLARE_API_TOKEN/);
-  assert.equal(called, false);
-});
-
-test('checkRulesetScope: a thrown fetch is caught → NOT readable, never throws', async () => {
-  const fetchImpl = async () => { throw new Error('ENETUNREACH'); };
-  const r = await cf.checkRulesetScope({ zone: 'cloudbongos.com', phase: PHASE, token: 'tok', fetchImpl });
-  assert.equal(r.readable, false);
-  assert.match(r.reason, /failed/i);
-});
-
-test('checkRulesetScope: the zone lookup rejecting the token → NOT readable', async () => {
-  const fetchImpl = async () => ({ status: 403, json: async () => ({ success: false, errors: [{ message: 'Invalid API Token' }] }) });
-  const r = await cf.checkRulesetScope({ zone: 'cloudbongos.com', phase: PHASE, token: 'tok', fetchImpl });
-  assert.equal(r.readable, false);
-  assert.match(r.guidance, /CLOUDFLARE_API_TOKEN/);
-});

package/tests/cf_tunnel.mjs

@@ -1,496 +0,0 @@
-// tests/cf_tunnel.mjs
-//
-// Hermetic unit smoke for modules/dev-box/cf-tunnel.js — the control-plane Cloudflare
-// client behind the box terminal's NAMED tunnel (#771, ADR 0038 Part B). Mirrors
-// tests/boxes.mjs's coverage of do-api.js: the dry-run/live contract + every
-// request SHAPE asserted against a fake fetch, plus the high-level
-// ensure/teardown composition. NO network, NO account, NO real clock.
-//
-// Run:  node tests/cf_tunnel.mjs
-
-import { strict as assert } from 'node:assert';
-import { createRequire } from 'node:module';
-
-const require = createRequire(import.meta.url);
-const { CfTunnelApi, CfApiError, tunnelName, terminalHostname, previewHostname, GAME_SERVICE, CACHE_BYPASS_RULE_DESC } = require('../scripts/gds/cf-tunnel.js');
-
-let passed = 0, failed = 0;
-async function ta(name, fn) {
-  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
-  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.stack || e.message}`); }
-}
-function t(name, fn) {
-  try { fn(); passed++; console.log(`  PASS  ${name}`); }
-  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.stack || e.message}`); }
-}
-
-const ACCT = 'acct123';
-const TOKEN = 'cf-token';
-
-// A fake fetch driven by a routing table keyed on `${METHOD} ${pathWithoutQuery}`.
-// Each handler gets ({ method, url, path, query, body }) and returns either a
-// plain object (wrapped in a 200 CF envelope) or { status, json }. Records calls.
-function makeFetch(routes) {
-  const calls = [];
-  const fetchImpl = async (url, opts = {}) => {
-    const method = opts.method || 'GET';
-    const u = new URL(url);
-    const path = u.pathname.replace('/client/v4', '');
-    const query = Object.fromEntries(u.searchParams.entries());
-    const body = opts.body ? JSON.parse(opts.body) : null;
-    calls.push({ method, url, path, query, body });
-    const key = `${method} ${path}`;
-    const handler = routes[key];
-    if (!handler) return resp(404, { success: false, errors: [{ message: `no route ${key}` }] });
-    const out = handler({ method, url, path, query, body });
-    if (out && typeof out.status === 'number') return resp(out.status, out.json);
-    return resp(200, { success: true, result: out, errors: [] });
-  };
-  return { fetchImpl, calls };
-}
-function resp(status, json) {
-  return { ok: status >= 200 && status < 300, status, text: async () => JSON.stringify(json) };
-}
-
-console.log('constructor / dry-run contract:');
-
-t('constructor throws live without token', () => {
-  assert.throws(() => new CfTunnelApi({ dryRun: false, accountId: ACCT }), CfApiError);
-});
-t('constructor throws live without accountId', () => {
-  assert.throws(() => new CfTunnelApi({ dryRun: false, token: TOKEN }), CfApiError);
-});
-t('dry-run is the default (no token needed)', () => {
-  const cf = new CfTunnelApi({});
-  assert.equal(cf.dryRun, true);
-});
-
-await ta('live requests pass the IPv4 dispatcher through (token is IP-locked, #771)', async () => {
-  let sawDispatcher;
-  const fetchImpl = async (_url, opts) => { sawDispatcher = opts.dispatcher; return resp(200, { success: true, result: [] }); };
-  const sentinel = { iam: 'ipv4-agent' };
-  const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl, dispatcher: sentinel });
-  await cf.findTunnelByName('x');
-  assert.equal(sawDispatcher, sentinel, 'the configured dispatcher must reach fetch');
-});
-
-await ta('dry-run never touches the network and returns synthetic results', async () => {
-  let hit = false;
-  const cf = new CfTunnelApi({ accountId: ACCT, fetchImpl: () => { hit = true; throw new Error('should not fetch'); } });
-  const r = await cf.ensureNamedTunnel({ login: 'alice', zone: 'example.com', terminalZone: 'dev.example.com' });
-  assert.equal(hit, false, 'fetch must not be called in dry-run');
-  assert.equal(r.hostname, 'term-alice.dev.example.com');
-  assert.ok(String(r.token).startsWith('dryrun-token-'));
-  assert.ok(String(r.tunnelId).startsWith('dryrun-tunnel-'));
-});
-
-console.log('tunnel lifecycle (live, fake fetch):');
-
-await ta('ensureTunnel reuses an existing tunnel (no POST)', async () => {
-  const { fetchImpl, calls } = makeFetch({
-    'GET /accounts/acct123/cfd_tunnel': () => [{ id: 'tun-existing', name: 'otb-term-alice' }],
-  });
-  const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  const { tunnel, created } = await cf.ensureTunnel('otb-term-alice');
-  assert.equal(tunnel.id, 'tun-existing');
-  assert.equal(created, false);
-  assert.ok(!calls.some((c) => c.method === 'POST'), 'must not create when one exists');
-});
-
-await ta('ensureTunnel creates when none exists (config_src=cloudflare)', async () => {
-  const { fetchImpl, calls } = makeFetch({
-    'GET /accounts/acct123/cfd_tunnel': () => [],
-    'POST /accounts/acct123/cfd_tunnel': ({ body }) => ({ id: 'tun-new', name: body.name }),
-  });
-  const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  const { tunnel, created } = await cf.ensureTunnel('otb-term-bob');
-  assert.equal(tunnel.id, 'tun-new');
-  assert.equal(created, true);
-  const post = calls.find((c) => c.method === 'POST');
-  assert.equal(post.body.name, 'otb-term-bob');
-  assert.equal(post.body.config_src, 'cloudflare');
-});
-
-await ta('putConfiguration sends ttyd ingress + 404 catch-all', async () => {
-  let seen = null;
-  const { fetchImpl } = makeFetch({
-    'PUT /accounts/acct123/cfd_tunnel/tun1/configurations': ({ body }) => { seen = body; return { config: body.config }; },
-  });
-  const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  await cf.putConfiguration('tun1', { hostname: 'term-alice.dev.example.com' });
-  assert.deepEqual(seen.config.ingress[0], { hostname: 'term-alice.dev.example.com', service: 'http://127.0.0.1:7681' });
-  assert.deepEqual(seen.config.ingress[1], { service: 'http_status:404' });
-});
-
-await ta('getTunnelToken unwraps the CF envelope to the raw token string', async () => {
-  const { fetchImpl } = makeFetch({
-    'GET /accounts/acct123/cfd_tunnel/tun1/token': () => 'the-connector-token',
-  });
-  const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  assert.equal(await cf.getTunnelToken('tun1'), 'the-connector-token');
-});
-
-console.log('DNS routing (live, fake fetch):');
-
-await ta('upsertDnsRoute POSTs a proxied CNAME to cfargotunnel when absent', async () => {
-  let posted = null;
-  const { fetchImpl } = makeFetch({
-    'GET /zones/zone1/dns_records': () => [],
-    'POST /zones/zone1/dns_records': ({ body }) => { posted = body; return { id: 'rec1', ...body }; },
-  });
-  const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  await cf.upsertDnsRoute({ zoneId: 'zone1', name: 'term-alice.dev.example.com', tunnelId: 'tun1' });
-  assert.equal(posted.type, 'CNAME');
-  assert.equal(posted.content, 'tun1.cfargotunnel.com');
-  assert.equal(posted.proxied, true);
-});
-
-await ta('upsertDnsRoute PUTs (updates) when the record already exists', async () => {
-  let method = null;
-  const { fetchImpl } = makeFetch({
-    'GET /zones/zone1/dns_records': () => [{ id: 'rec-existing', name: 'term-alice.dev.example.com' }],
-    'PUT /zones/zone1/dns_records/rec-existing': ({ body }) => { method = 'PUT'; return { id: 'rec-existing', ...body }; },
-  });
-  const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  await cf.upsertDnsRoute({ zoneId: 'zone1', name: 'term-alice.dev.example.com', tunnelId: 'tun1' });
-  assert.equal(method, 'PUT');
-});
-
-await ta('getZoneId throws a clear error when the zone is not found', async () => {
-  const { fetchImpl } = makeFetch({ 'GET /zones': () => [] });
-  const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  await assert.rejects(() => cf.getZoneId('nope.com'), /not found/);
-});
-
-await ta('CF envelope success:false throws CfApiError with the message', async () => {
-  const { fetchImpl } = makeFetch({
-    'GET /accounts/acct123/cfd_tunnel': () => ({ status: 200, json: { success: false, errors: [{ message: 'bad scope' }] } }),
-  });
-  const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  await assert.rejects(() => cf.findTunnelByName('x'), /bad scope/);
-});
-
-console.log('high-level compose:');
-
-await ta('ensureNamedTunnel composes create→configure→token→zone→dns and returns bake values', async () => {
-  const { fetchImpl, calls } = makeFetch({
-    'GET /accounts/acct123/cfd_tunnel': () => [],
-    'POST /accounts/acct123/cfd_tunnel': ({ body }) => ({ id: 'tunZ', name: body.name }),
-    'PUT /accounts/acct123/cfd_tunnel/tunZ/configurations': ({ body }) => ({ config: body.config }),
-    'GET /accounts/acct123/cfd_tunnel/tunZ/token': () => 'tokZ',
-    'GET /zones': () => [{ id: 'zoneZ' }],
-    'GET /zones/zoneZ/dns_records': () => [],
-    'POST /zones/zoneZ/dns_records': ({ body }) => ({ id: 'recZ', ...body }),
-  });
-  const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  const r = await cf.ensureNamedTunnel({ login: 'carol', zone: 'example.com', terminalZone: 'dev.example.com' });
-  assert.equal(r.tunnelId, 'tunZ');
-  assert.equal(r.token, 'tokZ');
-  assert.equal(r.hostname, 'term-carol.dev.example.com');
-  // the create used the deterministic per-builder name
-  assert.ok(calls.some((c) => c.method === 'POST' && c.path.endsWith('/cfd_tunnel') && c.body.name === 'otb-term-carol'));
-});
-
-await ta('teardownNamedTunnel deletes DNS + tunnel and never throws', async () => {
-  const { fetchImpl, calls } = makeFetch({
-    'GET /zones': () => [{ id: 'zoneZ' }],
-    'GET /zones/zoneZ/dns_records': () => [{ id: 'recZ', name: 'term-dan.dev.example.com' }],
-    'DELETE /zones/zoneZ/dns_records/recZ': () => ({ id: 'recZ' }),
-    'GET /accounts/acct123/cfd_tunnel': () => [{ id: 'tunZ', name: 'otb-term-dan' }],
-    'DELETE /accounts/acct123/cfd_tunnel/tunZ/connections': () => ({}),
-    'DELETE /accounts/acct123/cfd_tunnel/tunZ': () => ({ id: 'tunZ' }),
-  });
-  const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  const out = await cf.teardownNamedTunnel({ login: 'dan', zone: 'example.com', terminalZone: 'dev.example.com' });
-  assert.equal(out.dnsDeleted, true);
-  assert.equal(out.tunnelDeleted, true);
-  assert.deepEqual(out.errors, []);
-  assert.ok(calls.some((c) => c.method === 'DELETE' && c.path === '/accounts/acct123/cfd_tunnel/tunZ'));
-});
-
-await ta('teardownNamedTunnel on a missing tunnel/record is graceful (no throw, flags false)', async () => {
-  const { fetchImpl } = makeFetch({
-    'GET /zones': () => [{ id: 'zoneZ' }],
-    'GET /zones/zoneZ/dns_records': () => [],
-    'GET /accounts/acct123/cfd_tunnel': () => [],
-  });
-  const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  const out = await cf.teardownNamedTunnel({ login: 'ghost', zone: 'example.com', terminalZone: 'dev.example.com' });
-  assert.equal(out.dnsDeleted, false);
-  assert.equal(out.tunnelDeleted, false);
-  assert.deepEqual(out.errors, []);
-});
-
-await ta('teardown collects errors per-leg without throwing', async () => {
-  const { fetchImpl } = makeFetch({
-    'GET /zones': () => ({ status: 403, json: { success: false, errors: [{ message: 'no dns scope' }] } }),
-    'GET /accounts/acct123/cfd_tunnel': () => [{ id: 'tunZ', name: 'otb-term- err' }],
-  });
-  const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  const out = await cf.teardownNamedTunnel({ login: 'err', zone: 'example.com', terminalZone: 'dev.example.com' });
-  assert.ok(out.errors.some((e) => /dns/.test(e)), 'dns failure recorded');
-});
-
-console.log('game preview ingress (ADR 0044):');
-
-await ta('putConfiguration inserts extraRoutes between the primary host and the 404 catch-all', async () => {
-  let seen = null;
-  const { fetchImpl } = makeFetch({
-    'PUT /accounts/acct123/cfd_tunnel/tun1/configurations': ({ body }) => { seen = body; return { config: body.config }; },
-  });
-  const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  await cf.putConfiguration('tun1', {
-    hostname: 'term-alice.dev.example.com',
-    extraRoutes: [{ hostname: 'sandbox-alice.dev.example.com', service: GAME_SERVICE }],
-  });
-  assert.equal(seen.config.ingress.length, 3, 'ttyd + game + catch-all');
-  assert.deepEqual(seen.config.ingress[0], { hostname: 'term-alice.dev.example.com', service: 'http://127.0.0.1:7681' });
-  assert.deepEqual(seen.config.ingress[1], { hostname: 'sandbox-alice.dev.example.com', service: 'http://127.0.0.1:3000' });
-  assert.deepEqual(seen.config.ingress[2], { service: 'http_status:404' }, 'catch-all stays last');
-});
-
-await ta('ensureNamedTunnel adds the game preview route + its own CNAME and returns previewHostname', async () => {
-  let putBody = null;
-  const dnsPosts = [];
-  const { fetchImpl } = makeFetch({
-    'GET /accounts/acct123/cfd_tunnel': () => [],
-    'POST /accounts/acct123/cfd_tunnel': ({ body }) => ({ id: 'tunZ', name: body.name }),
-    'PUT /accounts/acct123/cfd_tunnel/tunZ/configurations': ({ body }) => { putBody = body; return { config: body.config }; },
-    'GET /accounts/acct123/cfd_tunnel/tunZ/token': () => 'tokZ',
-    'GET /zones': () => [{ id: 'zoneZ' }],
-    'GET /zones/zoneZ/dns_records': () => [],
-    'POST /zones/zoneZ/dns_records': ({ body }) => { dnsPosts.push(body.name); return { id: `rec-${body.name}`, ...body }; },
-  });
-  const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  const r = await cf.ensureNamedTunnel({ login: 'carol', zone: 'example.com', terminalZone: 'dev.example.com' });
-  // returns the deterministic preview host alongside the terminal host
-  assert.equal(r.previewHostname, 'sandbox-carol.dev.example.com');
-  assert.equal(r.hostname, 'term-carol.dev.example.com');
-  // the ingress now carries the game route at 127.0.0.1:3000
-  assert.deepEqual(putBody.config.ingress[1], { hostname: 'sandbox-carol.dev.example.com', service: GAME_SERVICE });
-  // BOTH hostnames get a proxied CNAME
-  assert.ok(dnsPosts.includes('term-carol.dev.example.com'), 'terminal CNAME upserted');
-  assert.ok(dnsPosts.includes('sandbox-carol.dev.example.com'), 'preview CNAME upserted');
-});
-
-await ta('teardownNamedTunnel also deletes the preview CNAME', async () => {
-  const deletedDns = [];
-  const { fetchImpl } = makeFetch({
-    'GET /zones': () => [{ id: 'zoneZ' }],
-    'GET /zones/zoneZ/dns_records': ({ query }) => {
-      const n = query.name;
-      if (n === 'term-dan.dev.example.com') return [{ id: 'recTerm', name: n }];
-      if (n === 'sandbox-dan.dev.example.com') return [{ id: 'recGame', name: n }];
-      return [];
-    },
-    'DELETE /zones/zoneZ/dns_records/recTerm': () => { deletedDns.push('term'); return { id: 'recTerm' }; },
-    'DELETE /zones/zoneZ/dns_records/recGame': () => { deletedDns.push('game'); return { id: 'recGame' }; },
-    'GET /accounts/acct123/cfd_tunnel': () => [{ id: 'tunZ', name: 'otb-term-dan' }],
-    'DELETE /accounts/acct123/cfd_tunnel/tunZ/connections': () => ({}),
-    'DELETE /accounts/acct123/cfd_tunnel/tunZ': () => ({ id: 'tunZ' }),
-  });
-  const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  const out = await cf.teardownNamedTunnel({ login: 'dan', zone: 'example.com', terminalZone: 'dev.example.com' });
-  assert.equal(out.dnsDeleted, true);
-  assert.equal(out.previewDnsDeleted, true, 'preview CNAME removed');
-  assert.equal(out.tunnelDeleted, true);
-  assert.deepEqual(out.errors, []);
-  assert.deepEqual(deletedDns.sort(), ['game', 'term']);
-});
-
-console.log('edge cookie strip (#919 / SR#11):');
-
-const RULESET_PATH = '/zones/zoneZ/rulesets/phases/http_request_late_transform/entrypoint';
-
-await ta('ensureCookieStripRule PUTs a remove-Cookie rule scoped to term-*/sandbox-*', async () => {
-  let put = null;
-  const { fetchImpl } = makeFetch({
-    'GET /zones': () => [{ id: 'zoneZ' }],
-    [`GET ${RULESET_PATH}`]: () => ({ id: 'rs1', rules: [] }),
-    [`PUT ${RULESET_PATH}`]: ({ body }) => { put = body; return { id: 'rs1', rules: body.rules }; },
-  });
-  const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  await cf.ensureCookieStripRule({ zone: 'example.com' });
-  assert.equal(put.rules.length, 1, 'one rule on a previously-empty phase');
-  const rule = put.rules[0];
-  assert.equal(rule.action, 'rewrite');
-  assert.deepEqual(rule.action_parameters.headers.Cookie, { operation: 'remove' });
-  assert.match(rule.expression, /term-/);
-  assert.match(rule.expression, /sandbox-/);
-  assert.equal(rule.enabled, true);
-});
-
-await ta('ensureCookieStripRule preserves OTHER transform rules and is idempotent on ours', async () => {
-  let put = null;
-  const otherRule = { id: 'keepme', version: '3', last_updated: 'x', action: 'rewrite', action_parameters: { headers: { 'X-Foo': { operation: 'set', value: 'bar' } } }, expression: 'true', description: 'someone-elses-rule', enabled: true };
-  const ourStale = { id: 'oldours', action: 'rewrite', action_parameters: { headers: { Cookie: { operation: 'remove' } } }, expression: 'starts_with(http.host, "term-")', description: 'otb-919 strip Cookie on box subdomains (term-*/sandbox-*) — SR#11', enabled: true };
-  const { fetchImpl } = makeFetch({
-    'GET /zones': () => [{ id: 'zoneZ' }],
-    [`GET ${RULESET_PATH}`]: () => ({ id: 'rs1', rules: [otherRule, ourStale] }),
-    [`PUT ${RULESET_PATH}`]: ({ body }) => { put = body; return { id: 'rs1', rules: body.rules }; },
-  });
-  const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  await cf.ensureCookieStripRule({ zone: 'example.com' });
-  // exactly two rules: the foreign one (kept) + ONE fresh copy of ours (no dupes)
-  assert.equal(put.rules.length, 2);
-  const ours = put.rules.filter((r) => /otb-919/.test(r.description));
-  assert.equal(ours.length, 1, 'our rule is de-duplicated, not appended twice');
-  const kept = put.rules.find((r) => r.description === 'someone-elses-rule');
-  assert.ok(kept, 'a foreign transform rule must be preserved');
-  // read-only CF fields must be stripped from the preserved rule (a PUT rejects them)
-  assert.equal(kept.id, undefined);
-  assert.equal(kept.version, undefined);
-  assert.equal(kept.last_updated, undefined);
-});
-
-await ta('ensureCookieStripRule creates the phase entrypoint when none exists (404 → PUT)', async () => {
-  let put = null;
-  const { fetchImpl } = makeFetch({
-    'GET /zones': () => [{ id: 'zoneZ' }],
-    [`GET ${RULESET_PATH}`]: () => ({ status: 404, json: { success: false, errors: [{ message: 'ruleset not found' }] } }),
-    [`PUT ${RULESET_PATH}`]: ({ body }) => { put = body; return { id: 'rs-new', rules: body.rules }; },
-  });
-  const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  await cf.ensureCookieStripRule({ zone: 'example.com' });
-  assert.equal(put.rules.length, 1, 'a 404 entrypoint is treated as empty, our rule is created');
-});
-
-await ta('ensureCookieStripRule failure does NOT block ensureNamedTunnel (best-effort)', async () => {
-  // No rulesets routes → the cookie-strip PUT 404s and throws, but ensureNamedTunnel
-  // swallows it. The tunnel + DNS still complete and bake values come back.
-  const { fetchImpl } = makeFetch({
-    'GET /accounts/acct123/cfd_tunnel': () => [],
-    'POST /accounts/acct123/cfd_tunnel': ({ body }) => ({ id: 'tunZ', name: body.name }),
-    'PUT /accounts/acct123/cfd_tunnel/tunZ/configurations': ({ body }) => ({ config: body.config }),
-    'GET /accounts/acct123/cfd_tunnel/tunZ/token': () => 'tokZ',
-    'GET /zones': () => [{ id: 'zoneZ' }],
-    'GET /zones/zoneZ/dns_records': () => [],
-    'POST /zones/zoneZ/dns_records': ({ body }) => ({ id: `rec-${body.name}`, ...body }),
-    // GET ruleset returns 404 (no route) → swallowed; PUT ruleset 404 → bubbles to
-    // ensureNamedTunnel's try/catch and is logged, not thrown.
-  });
-  const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  const r = await cf.ensureNamedTunnel({ login: 'carol', zone: 'example.com', terminalZone: 'example.com' });
-  assert.equal(r.token, 'tokZ', 'provisioning completes despite the cookie-strip rule failing');
-  assert.equal(r.hostname, 'term-carol.example.com');
-  // task 1002511: the failure is reported STRUCTURALLY, not only logged, so box.js
-  // can surface it in the provision summary instead of burying it mid-run.
-  assert.equal(r.edgeRules.cookieStrip.applied, false, 'a failed cookie-strip PUT must never report applied');
-  assert.ok(r.edgeRules.cookieStrip.error, 'the failure reason is captured');
-});
-
-console.log('edge cache bypass (#1065):');
-
-const CACHE_PATH = '/zones/zoneZ/rulesets/phases/http_request_cache_settings/entrypoint';
-
-await ta('ensureCacheBypassRule PUTs a cache:false rule scoped to sandbox-* (not the apex)', async () => {
-  let put = null;
-  const { fetchImpl } = makeFetch({
-    'GET /zones': () => [{ id: 'zoneZ' }],
-    [`GET ${CACHE_PATH}`]: () => ({ id: 'rs1', rules: [] }),
-    [`PUT ${CACHE_PATH}`]: ({ body }) => { put = body; return { id: 'rs1', rules: body.rules }; },
-  });
-  const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  await cf.ensureCacheBypassRule({ zone: 'example.com' });
-  assert.equal(put.rules.length, 1);
-  const rule = put.rules[0];
-  assert.equal(rule.action, 'set_cache_settings');
-  assert.equal(rule.action_parameters.cache, false);
-  assert.match(rule.expression, /sandbox-/);
-  assert.doesNotMatch(rule.expression, /term-/, 'ttyd hosts are not cache-ruled');
-  // prod-safety: the apex must NOT satisfy the expression
-  assert.ok(!'example.com'.startsWith('sandbox-'), 'apex never matches sandbox-*');
-  assert.equal(rule.enabled, true);
-});
-
-await ta('ensureCacheBypassRule preserves OTHER cache rules and is idempotent on ours', async () => {
-  let put = null;
-  const otherRule = { id: 'keepme', version: '2', last_updated: 'x', action: 'set_cache_settings', action_parameters: { cache: true }, expression: 'starts_with(http.host, "img-")', description: 'someone-elses-cache-rule', enabled: true };
-  const ourStale = { id: 'oldours', action: 'set_cache_settings', action_parameters: { cache: false }, expression: 'starts_with(http.host, "sandbox-")', description: CACHE_BYPASS_RULE_DESC, enabled: true };
-  const { fetchImpl } = makeFetch({
-    'GET /zones': () => [{ id: 'zoneZ' }],
-    [`GET ${CACHE_PATH}`]: () => ({ id: 'rs1', rules: [otherRule, ourStale] }),
-    [`PUT ${CACHE_PATH}`]: ({ body }) => { put = body; return { id: 'rs1', rules: body.rules }; },
-  });
-  const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  await cf.ensureCacheBypassRule({ zone: 'example.com' });
-  assert.equal(put.rules.length, 2);
-  assert.equal(put.rules.filter((r) => r.description === CACHE_BYPASS_RULE_DESC).length, 1, 'our rule de-duplicated');
-  const kept = put.rules.find((r) => r.description === 'someone-elses-cache-rule');
-  assert.ok(kept, 'a foreign cache rule must be preserved');
-  assert.equal(kept.id, undefined);
-  assert.equal(kept.version, undefined);
-  assert.equal(kept.last_updated, undefined);
-});
-
-await ta('ensureCacheBypassRule creates the cache phase entrypoint when none exists (404 → PUT)', async () => {
-  let put = null;
-  const { fetchImpl } = makeFetch({
-    'GET /zones': () => [{ id: 'zoneZ' }],
-    [`GET ${CACHE_PATH}`]: () => ({ status: 404, json: { success: false, errors: [{ message: 'ruleset not found' }] } }),
-    [`PUT ${CACHE_PATH}`]: ({ body }) => { put = body; return { id: 'rs-new', rules: body.rules }; },
-  });
-  const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  await cf.ensureCacheBypassRule({ zone: 'example.com' });
-  assert.equal(put.rules.length, 1);
-});
-
-await ta('ensureCacheBypassRule failure does NOT block ensureNamedTunnel (best-effort)', async () => {
-  // tunnel + DNS routes succeed; both ruleset PUTs 404 (no route) → swallowed by
-  // ensureNamedTunnel's try/catch. Provisioning still returns the bake values.
-  const { fetchImpl } = makeFetch({
-    'GET /accounts/acct123/cfd_tunnel': () => [],
-    'POST /accounts/acct123/cfd_tunnel': ({ body }) => ({ id: 'tunZ', name: body.name }),
-    'PUT /accounts/acct123/cfd_tunnel/tunZ/configurations': ({ body }) => ({ config: body.config }),
-    'GET /accounts/acct123/cfd_tunnel/tunZ/token': () => 'tokZ',
-    'GET /zones': () => [{ id: 'zoneZ' }],
-    'GET /zones/zoneZ/dns_records': () => [],
-    'POST /zones/zoneZ/dns_records': ({ body }) => ({ id: `rec-${body.name}`, ...body }),
-  });
-  const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  const r = await cf.ensureNamedTunnel({ login: 'carol', zone: 'example.com', terminalZone: 'example.com' });
-  assert.equal(r.token, 'tokZ', 'provisioning completes despite the cache rule failing');
-  assert.equal(r.edgeRules.cacheBypass.applied, false);
-  assert.ok(r.edgeRules.cacheBypass.error, 'the cache-rule failure reason is captured');
-});
-
-await ta('ensureNamedTunnel reports edgeRules.applied on the success path (both legs land)', async () => {
-  const RS = '/zones/zoneZ/rulesets/phases/http_request_late_transform/entrypoint';
-  const CS = '/zones/zoneZ/rulesets/phases/http_request_cache_settings/entrypoint';
-  const { fetchImpl } = makeFetch({
-    'GET /accounts/acct123/cfd_tunnel': () => [],
-    'POST /accounts/acct123/cfd_tunnel': ({ body }) => ({ id: 'tunZ', name: body.name }),
-    'PUT /accounts/acct123/cfd_tunnel/tunZ/configurations': ({ body }) => ({ config: body.config }),
-    'GET /accounts/acct123/cfd_tunnel/tunZ/token': () => 'tokZ',
-    'GET /zones': () => [{ id: 'zoneZ' }],
-    'GET /zones/zoneZ/dns_records': () => [],
-    'POST /zones/zoneZ/dns_records': ({ body }) => ({ id: `rec-${body.name}`, ...body }),
-    [`GET ${RS}`]: () => ({ id: 'rs1', rules: [] }),
-    [`PUT ${RS}`]: ({ body }) => ({ id: 'rs1', rules: body.rules }),
-    [`GET ${CS}`]: () => ({ id: 'rs2', rules: [] }),
-    [`PUT ${CS}`]: ({ body }) => ({ id: 'rs2', rules: body.rules }),
-  });
-  const cf = new CfTunnelApi({ dryRun: false, token: TOKEN, accountId: ACCT, fetchImpl });
-  const r = await cf.ensureNamedTunnel({ login: 'carol', zone: 'example.com', terminalZone: 'example.com' });
-  assert.equal(r.edgeRules.cookieStrip.applied, true);
-  assert.equal(r.edgeRules.cookieStrip.error, null);
-  assert.equal(r.edgeRules.cacheBypass.applied, true);
-  assert.equal(r.token, 'tokZ', 'the bake values still come back');
-});
-
-await ta('ensureNamedTunnel in DRY-RUN reports applied:false (a plan never applied anything)', async () => {
-  const cf = new CfTunnelApi({ accountId: ACCT, fetchImpl: () => { throw new Error('should not fetch'); } });
-  const r = await cf.ensureNamedTunnel({ login: 'alice', zone: 'example.com', terminalZone: 'example.com' });
-  assert.equal(r.edgeRules.cookieStrip.applied, false, 'dry-run must not read as "the security rule is in place"');
-  assert.equal(r.edgeRules.cacheBypass.applied, false);
-});
-
-console.log('name helpers:');
-t('tunnelName / terminalHostname / previewHostname are deterministic', () => {
-  assert.equal(tunnelName('alice'), 'otb-term-alice');
-  assert.equal(terminalHostname('alice', 'dev.example.com'), 'term-alice.dev.example.com');
-  assert.equal(previewHostname('alice', 'example.com'), 'sandbox-alice.example.com');
-});
-
-console.log(`\ncf-tunnel: ${passed} passed, ${failed} failed`);
-process.exit(failed === 0 ? 0 : 1);