@swissjs/swite 0.4.1 → 0.4.2

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.4.2
+
+### Patch Changes
+
+- fix(security): update @swissjs/\* deps to 1.2.1/1.2.3, add pnpm security overrides, fix build script to use standalone tsc (no project references), eliminate as-any casts in middleware
+
 ## 0.4.1
 
 ### Patch Changes
@@ -15,6 +21,7 @@
 - fix(S-03): Python service health check timeout corrected from 15s → 30s per DIRECTIVE spec. Python services with slow startup (e.g. model loading, DB connection pool warmup) were being killed before they became healthy.
 
 - fix(css-modules): CSS import handling in the compile pipeline now distinguishes three cases:
+
   - Named/default imports (`import styles from "./x.module.css"`) → `const styles = {}` — no more `undefined` at runtime
   - Side-effect imports (`import "./x.css"`) → silently stripped
   - Dynamic imports (`import("./x.css")`) → `({})` instead of `undefined`

package/__tests__/import-rewriter-bug.test.ts

@@ -1,122 +1,122 @@
-import { describe, it, before } from 'node:test';
-import assert from 'node:assert';
-import { rewriteImports } from '../src/resolution/rewriting/import-rewriter.js';
-import { ModuleResolver } from '../src/resolution/resolver.js';
-import { resetPackageRegistry } from '../src/kernel/package-registry.js';
-
-// Reset the registry singleton before every describe block so tests don't
-// inherit a workspace scan from a prior test run. This prevents the
-// ModuleResolver from scanning the full filesystem (which can take 30+ minutes
-// when the fake root resolves to /).
-function makeResolver(): ModuleResolver {
-  resetPackageRegistry();
-  // Use the swite repo root so findWorkspaceRoot terminates quickly
-  // (pnpm-workspace.yaml is in the parent dir, not the swite root itself,
-  //  but the resolver gracefully handles a root without a workspace file).
-  return new ModuleResolver(new URL('../', import.meta.url).pathname);
-}
-
-describe('Import Rewriter — bare imports', () => {
-  before(() => resetPackageRegistry());
-
-  it('rewrites unknown bare import to /node_modules/ path', async () => {
-    const resolver = makeResolver();
-    const code = `import { something } from '@unknown-org/nonexistent-pkg'`;
-    const result = await rewriteImports(code, '/fake/src/index.uix', resolver);
-
-    // Package not in workspace → falls back to /node_modules/ URL
-    assert(
-      result.includes('/node_modules/@unknown-org/nonexistent-pkg') ||
-      result.includes('cdn.jsdelivr.net'),
-      `Expected /node_modules/ or CDN fallback, got: ${result}`,
-    );
-    // Original bare specifier is gone
-    assert(!result.includes("'@unknown-org/nonexistent-pkg'"), 'Bare specifier should be rewritten');
-  });
-
-  it('does not create malformed imports when rewriting multiple bare imports', async () => {
-    const resolver = makeResolver();
-    const code = [
-      `import { SwissApp } from '@swissjs/core'`,
-      `import { App } from './App.uix'`,
-      `import { PosAgent } from '@swiss-enterprise/ai-agents'`,
-      `import { registerBusinessModules } from './modules/index.ui'`,
-    ].join('\n');
-
-    const result = await rewriteImports(code, '/fake/src/index.ui', resolver);
-
-    // No malformed patterns — quote/import collision
-    assert(!result.includes('@"'), `Malformed @" pattern found in: ${result}`);
-    // Use [ \t]* (not \s*) — \s* would match newlines and falsely fire on consecutive
-    // import statements on separate lines, which is perfectly valid.
-    assert(!/from[ \t]+"[^"]*"[ \t]*import/.test(result), 'Double-quote before import keyword on same line');
-
-    // Relative imports are left intact (they start with ./)
-    assert(result.includes('./App.uix'), 'Relative .uix import should be preserved');
-    assert(result.includes('./modules/index.ui'), 'Relative .ui import should be preserved');
-  });
-});
-
-describe('Import Rewriter — relative extension fixes', () => {
-  before(() => resetPackageRegistry());
-
-  it('converts .js extension to .uix when importing from a .uix file', async () => {
-    const resolver = makeResolver();
-    const code = `import { updatePageTitle } from './utils/seo.js'`;
-    const result = await rewriteImports(code, '/fake/src/App.uix', resolver);
-
-    // .js imports from .uix files are rewritten to .uix (or .ui if only .ui exists)
-    assert(
-      result.includes('./utils/seo.uix') || result.includes('./utils/seo.ui') || result.includes('./utils/seo.ts'),
-      `Expected extension rewrite, got: ${result}`,
-    );
-    assert(!result.includes('./utils/seo.js'), '.js extension should be replaced');
-  });
-
-  it('converts .js extension to .ui when importing from a .ui file', async () => {
-    const resolver = makeResolver();
-    const code = `import { helper } from './helpers/dom.js'`;
-    const result = await rewriteImports(code, '/fake/src/App.ui', resolver);
-
-    // .js imports from .ui files are rewritten to .ui
-    assert(
-      result.includes('./helpers/dom.ui') || result.includes('./helpers/dom.uix') || result.includes('./helpers/dom.ts'),
-      `Expected extension rewrite, got: ${result}`,
-    );
-    assert(!result.includes('./helpers/dom.js'), '.js extension should be replaced');
-  });
-});
-
-describe('Import Rewriter — CSS imports are skipped', () => {
-  before(() => resetPackageRegistry());
-
-  it('passes through CSS imports unchanged (stripping is done in base-handler)', async () => {
-    const resolver = makeResolver();
-    // Note: CSS stripping is done in base-handler.ts BEFORE rewriteImports is called.
-    // rewriteImports itself skips CSS imports (does not attempt to resolve them).
-    // This test verifies the skip-not-crash behaviour.
-    const code = [
-      `import { App } from './App.uix'`,
-      `import './styles/globals.css'`,
-      `import './styles/theme.css'`,
-      `export default App`,
-    ].join('\n');
-
-    const result = await rewriteImports(code, '/fake/src/index.uix', resolver);
-
-    // rewriteImports skips CSS — they remain in output (base-handler strips them)
-    assert(result.includes('./App.uix'), 'Non-CSS import should still be present');
-    // No crash — CSS present or absent, but no exception thrown
-  });
-});
-
-describe('Import Rewriter — code with no imports is returned as-is', () => {
-  before(() => resetPackageRegistry());
-
-  it('returns code unchanged when there are no imports', async () => {
-    const resolver = makeResolver();
-    const code = `const x = 42;\nexport default x;`;
-    const result = await rewriteImports(code, '/fake/src/mod.ts', resolver);
-    assert.strictEqual(result, code);
-  });
-});
+import { describe, it, before } from 'node:test';
+import assert from 'node:assert';
+import { rewriteImports } from '../src/resolution/rewriting/import-rewriter.js';
+import { ModuleResolver } from '../src/resolution/resolver.js';
+import { resetPackageRegistry } from '../src/kernel/package-registry.js';
+
+// Reset the registry singleton before every describe block so tests don't
+// inherit a workspace scan from a prior test run. This prevents the
+// ModuleResolver from scanning the full filesystem (which can take 30+ minutes
+// when the fake root resolves to /).
+function makeResolver(): ModuleResolver {
+  resetPackageRegistry();
+  // Use the swite repo root so findWorkspaceRoot terminates quickly
+  // (pnpm-workspace.yaml is in the parent dir, not the swite root itself,
+  //  but the resolver gracefully handles a root without a workspace file).
+  return new ModuleResolver(new URL('../', import.meta.url).pathname);
+}
+
+describe('Import Rewriter — bare imports', () => {
+  before(() => resetPackageRegistry());
+
+  it('rewrites unknown bare import to /node_modules/ path', async () => {
+    const resolver = makeResolver();
+    const code = `import { something } from '@unknown-org/nonexistent-pkg'`;
+    const result = await rewriteImports(code, '/fake/src/index.uix', resolver);
+
+    // Package not in workspace → falls back to /node_modules/ URL
+    assert(
+      result.includes('/node_modules/@unknown-org/nonexistent-pkg') ||
+      result.includes('cdn.jsdelivr.net'),
+      `Expected /node_modules/ or CDN fallback, got: ${result}`,
+    );
+    // Original bare specifier is gone
+    assert(!result.includes("'@unknown-org/nonexistent-pkg'"), 'Bare specifier should be rewritten');
+  });
+
+  it('does not create malformed imports when rewriting multiple bare imports', async () => {
+    const resolver = makeResolver();
+    const code = [
+      `import { SwissApp } from '@swissjs/core'`,
+      `import { App } from './App.uix'`,
+      `import { PosAgent } from '@swiss-enterprise/ai-agents'`,
+      `import { registerBusinessModules } from './modules/index.ui'`,
+    ].join('\n');
+
+    const result = await rewriteImports(code, '/fake/src/index.ui', resolver);
+
+    // No malformed patterns — quote/import collision
+    assert(!result.includes('@"'), `Malformed @" pattern found in: ${result}`);
+    // Use [ \t]* (not \s*) — \s* would match newlines and falsely fire on consecutive
+    // import statements on separate lines, which is perfectly valid.
+    assert(!/from[ \t]+"[^"]*"[ \t]*import/.test(result), 'Double-quote before import keyword on same line');
+
+    // Relative imports are left intact (they start with ./)
+    assert(result.includes('./App.uix'), 'Relative .uix import should be preserved');
+    assert(result.includes('./modules/index.ui'), 'Relative .ui import should be preserved');
+  });
+});
+
+describe('Import Rewriter — relative extension fixes', () => {
+  before(() => resetPackageRegistry());
+
+  it('converts .js extension to .uix when importing from a .uix file', async () => {
+    const resolver = makeResolver();
+    const code = `import { updatePageTitle } from './utils/seo.js'`;
+    const result = await rewriteImports(code, '/fake/src/App.uix', resolver);
+
+    // .js imports from .uix files are rewritten to .uix (or .ui if only .ui exists)
+    assert(
+      result.includes('./utils/seo.uix') || result.includes('./utils/seo.ui') || result.includes('./utils/seo.ts'),
+      `Expected extension rewrite, got: ${result}`,
+    );
+    assert(!result.includes('./utils/seo.js'), '.js extension should be replaced');
+  });
+
+  it('converts .js extension to .ui when importing from a .ui file', async () => {
+    const resolver = makeResolver();
+    const code = `import { helper } from './helpers/dom.js'`;
+    const result = await rewriteImports(code, '/fake/src/App.ui', resolver);
+
+    // .js imports from .ui files are rewritten to .ui
+    assert(
+      result.includes('./helpers/dom.ui') || result.includes('./helpers/dom.uix') || result.includes('./helpers/dom.ts'),
+      `Expected extension rewrite, got: ${result}`,
+    );
+    assert(!result.includes('./helpers/dom.js'), '.js extension should be replaced');
+  });
+});
+
+describe('Import Rewriter — CSS imports are skipped', () => {
+  before(() => resetPackageRegistry());
+
+  it('passes through CSS imports unchanged (stripping is done in base-handler)', async () => {
+    const resolver = makeResolver();
+    // Note: CSS stripping is done in base-handler.ts BEFORE rewriteImports is called.
+    // rewriteImports itself skips CSS imports (does not attempt to resolve them).
+    // This test verifies the skip-not-crash behaviour.
+    const code = [
+      `import { App } from './App.uix'`,
+      `import './styles/globals.css'`,
+      `import './styles/theme.css'`,
+      `export default App`,
+    ].join('\n');
+
+    const result = await rewriteImports(code, '/fake/src/index.uix', resolver);
+
+    // rewriteImports skips CSS — they remain in output (base-handler strips them)
+    assert(result.includes('./App.uix'), 'Non-CSS import should still be present');
+    // No crash — CSS present or absent, but no exception thrown
+  });
+});
+
+describe('Import Rewriter — code with no imports is returned as-is', () => {
+  before(() => resetPackageRegistry());
+
+  it('returns code unchanged when there are no imports', async () => {
+    const resolver = makeResolver();
+    const code = `const x = 42;\nexport default x;`;
+    const result = await rewriteImports(code, '/fake/src/mod.ts', resolver);
+    assert.strictEqual(result, code);
+  });
+});

package/__tests__/security-r001-r002.test.ts

@@ -1,190 +1,190 @@
-/**
- * Regression tests for security fixes R-001 and R-002.
- *
- * R-001: Dev server must bind to the literal requested host; "localhost" must
- *        NOT be silently rewritten to "0.0.0.0".
- *
- * R-002: HMR WebSocket server must reject connections from disallowed origins.
- *
- * Both tests use only the public constructor/method surface — no internal
- * mocking required — and are runnable with:
- *
- *   node --import tsx --test __tests__/security-r001-r002.test.ts
- */
-
-import { describe, it } from "node:test";
-import assert from "node:assert/strict";
-
-// ---------------------------------------------------------------------------
-// R-001 — host binding logic
-// ---------------------------------------------------------------------------
-// We test the decision logic extracted from SwiteServer.  The full server
-// cannot be started in a unit test (requires filesystem, network, Express,
-// etc.) so we replicate the binding expression from server.ts:171 directly.
-// Any future regression (reintroducing the localhost→0.0.0.0 rewrite) will
-// break these assertions before it reaches production.
-
-function resolveBind(configHost: string): string {
-  // This is the expression that lives in server.ts after the R-001 fix:
-  //   const bindHost = this.config.host;
-  // i.e. the host is used literally with NO rewriting.
-  return configHost;
-}
-
-// We also test the WRONG old behaviour to confirm the test would catch it.
-function resolveBindOLD(configHost: string): string {
-  // This was the pre-fix expression (the bug):
-  //   const bindHost = host === "localhost" ? "0.0.0.0" : host;
-  return configHost === "localhost" ? "0.0.0.0" : configHost;
-}
-
-describe("R-001 — dev server bind host", () => {
-  it("default (localhost) stays as localhost — not rewritten to 0.0.0.0", () => {
-    const result = resolveBind("localhost");
-    assert.strictEqual(result, "localhost", "localhost must not be rewritten to 0.0.0.0");
-    assert.notStrictEqual(result, "0.0.0.0", "loopback request must stay loopback");
-  });
-
-  it("127.0.0.1 stays as 127.0.0.1", () => {
-    assert.strictEqual(resolveBind("127.0.0.1"), "127.0.0.1");
-  });
-
-  it("::1 (IPv6 loopback) stays as ::1", () => {
-    assert.strictEqual(resolveBind("::1"), "::1");
-  });
-
-  it("explicit 0.0.0.0 opt-in is honoured (all-interfaces bind)", () => {
-    // This is the ONLY case where 0.0.0.0 should appear.
-    assert.strictEqual(resolveBind("0.0.0.0"), "0.0.0.0");
-  });
-
-  it("explicit non-loopback host (e.g. 192.168.1.5) is honoured", () => {
-    assert.strictEqual(resolveBind("192.168.1.5"), "192.168.1.5");
-  });
-
-  // -------------------------------------------------------------------------
-  // Regression guard: prove the old (buggy) implementation would FAIL above.
-  // If someone accidentally re-introduces the old logic these assertions flip.
-  // -------------------------------------------------------------------------
-  it("[old-behaviour guard] OLD code wrongly rewrites localhost → 0.0.0.0", () => {
-    // The old code produced 0.0.0.0 for localhost — that is the bug.
-    assert.strictEqual(
-      resolveBindOLD("localhost"),
-      "0.0.0.0",
-      "Confirm the old buggy expression for documentation purposes",
-    );
-  });
-
-  it("[old-behaviour guard] OLD code would NOT produce localhost for localhost", () => {
-    assert.notStrictEqual(
-      resolveBindOLD("localhost"),
-      "localhost",
-      "Under the old code, localhost was never kept as localhost",
-    );
-  });
-});
-
-// ---------------------------------------------------------------------------
-// R-002 — HMR WebSocket Origin validation
-// ---------------------------------------------------------------------------
-// We test `isOriginAllowed` by extracting its logic into a standalone
-// function that mirrors the implementation in hmr.ts exactly.  The actual
-// HMREngine class is not instantiated (it tries to bind a network port in
-// the constructor area which is inappropriate for unit tests).
-
-function buildAllowedOriginsSet(allowedOrigins: string[]): Set<string> {
-  return new Set(allowedOrigins);
-}
-
-function isOriginAllowed(allowedOrigins: Set<string>, origin: string | undefined): boolean {
-  if (!origin) return false;
-  const normalise = (o: string) => o.replace(/\/$/, "").toLowerCase();
-  const candidate = normalise(origin);
-  for (const allowed of allowedOrigins) {
-    if (normalise(allowed) === candidate) return true;
-  }
-  return false;
-}
-
-/** Mirrors SwiteServer.buildHmrAllowedOrigins() from server.ts */
-function buildHmrAllowedOrigins(host: string, port: number): string[] {
-  const origins: string[] = [];
-  const add = (h: string) => origins.push(`http://${h}:${port}`);
-  add(host);
-  if (host === "localhost") add("127.0.0.1");
-  else if (host === "127.0.0.1") add("localhost");
-  return origins;
-}
-
-describe("R-002 — HMR WebSocket origin validation", () => {
-  // -------------------------------------------------------------------------
-  // Default dev setup: host=localhost, port=3000
-  // -------------------------------------------------------------------------
-  it("allows same-origin connection from http://localhost:3000", () => {
-    const origins = buildAllowedOriginsSet(buildHmrAllowedOrigins("localhost", 3000));
-    assert.ok(isOriginAllowed(origins, "http://localhost:3000"), "same-origin must be allowed");
-  });
-
-  it("also allows http://127.0.0.1:3000 when configured host is localhost", () => {
-    // Browser may send the numeric form depending on what user typed.
-    const origins = buildAllowedOriginsSet(buildHmrAllowedOrigins("localhost", 3000));
-    assert.ok(isOriginAllowed(origins, "http://127.0.0.1:3000"), "loopback alias must be allowed");
-  });
-
-  it("allows http://localhost:3000 when configured host is 127.0.0.1", () => {
-    const origins = buildAllowedOriginsSet(buildHmrAllowedOrigins("127.0.0.1", 3000));
-    assert.ok(isOriginAllowed(origins, "http://localhost:3000"));
-  });
-
-  it("rejects a foreign origin (cross-site WebSocket hijack attempt)", () => {
-    const origins = buildAllowedOriginsSet(buildHmrAllowedOrigins("localhost", 3000));
-    assert.ok(
-      !isOriginAllowed(origins, "http://evil.example.com"),
-      "foreign origin must be rejected",
-    );
-  });
-
-  it("rejects a subdomain of localhost (not the same origin)", () => {
-    const origins = buildAllowedOriginsSet(buildHmrAllowedOrigins("localhost", 3000));
-    assert.ok(!isOriginAllowed(origins, "http://sub.localhost:3000"), "subdomain must be rejected");
-  });
-
-  it("rejects a connection on the correct host but wrong port", () => {
-    const origins = buildAllowedOriginsSet(buildHmrAllowedOrigins("localhost", 3000));
-    assert.ok(
-      !isOriginAllowed(origins, "http://localhost:9000"),
-      "different port must be rejected",
-    );
-  });
-
-  it("rejects a connection with no Origin header (non-browser WebSocket client)", () => {
-    const origins = buildAllowedOriginsSet(buildHmrAllowedOrigins("localhost", 3000));
-    assert.ok(!isOriginAllowed(origins, undefined), "absent Origin must be rejected");
-  });
-
-  it("rejects an empty-string Origin", () => {
-    const origins = buildAllowedOriginsSet(buildHmrAllowedOrigins("localhost", 3000));
-    assert.ok(!isOriginAllowed(origins, ""), "empty Origin must be rejected");
-  });
-
-  it("origin check is case-insensitive on scheme and host", () => {
-    const origins = buildAllowedOriginsSet(buildHmrAllowedOrigins("localhost", 3000));
-    // RFC 6454 §6.1: scheme+host are case-insensitive
-    assert.ok(isOriginAllowed(origins, "HTTP://LOCALHOST:3000"), "case-insensitive match must work");
-  });
-
-  it("explicit 0.0.0.0 dev server only adds 0.0.0.0 as allowed origin (not localhost)", () => {
-    // When the dev explicitly opted in to 0.0.0.0 binding, only that literal
-    // host is in the origin allowlist — "localhost" is NOT auto-added.
-    const origins = buildHmrAllowedOrigins("0.0.0.0", 3000);
-    assert.ok(origins.includes("http://0.0.0.0:3000"), "0.0.0.0 origin present");
-    assert.ok(!origins.includes("http://localhost:3000"), "localhost not auto-added for 0.0.0.0 config");
-  });
-
-  it("custom non-loopback host only allows that host origin", () => {
-    const origins = buildAllowedOriginsSet(buildHmrAllowedOrigins("192.168.1.5", 4000));
-    assert.ok(isOriginAllowed(origins, "http://192.168.1.5:4000"));
-    assert.ok(!isOriginAllowed(origins, "http://localhost:4000"));
-    assert.ok(!isOriginAllowed(origins, "http://192.168.1.5:3000"), "different port rejected");
-  });
-});
+/**
+ * Regression tests for security fixes R-001 and R-002.
+ *
+ * R-001: Dev server must bind to the literal requested host; "localhost" must
+ *        NOT be silently rewritten to "0.0.0.0".
+ *
+ * R-002: HMR WebSocket server must reject connections from disallowed origins.
+ *
+ * Both tests use only the public constructor/method surface — no internal
+ * mocking required — and are runnable with:
+ *
+ *   node --import tsx --test __tests__/security-r001-r002.test.ts
+ */
+
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+
+// ---------------------------------------------------------------------------
+// R-001 — host binding logic
+// ---------------------------------------------------------------------------
+// We test the decision logic extracted from SwiteServer.  The full server
+// cannot be started in a unit test (requires filesystem, network, Express,
+// etc.) so we replicate the binding expression from server.ts:171 directly.
+// Any future regression (reintroducing the localhost→0.0.0.0 rewrite) will
+// break these assertions before it reaches production.
+
+function resolveBind(configHost: string): string {
+  // This is the expression that lives in server.ts after the R-001 fix:
+  //   const bindHost = this.config.host;
+  // i.e. the host is used literally with NO rewriting.
+  return configHost;
+}
+
+// We also test the WRONG old behaviour to confirm the test would catch it.
+function resolveBindOLD(configHost: string): string {
+  // This was the pre-fix expression (the bug):
+  //   const bindHost = host === "localhost" ? "0.0.0.0" : host;
+  return configHost === "localhost" ? "0.0.0.0" : configHost;
+}
+
+describe("R-001 — dev server bind host", () => {
+  it("default (localhost) stays as localhost — not rewritten to 0.0.0.0", () => {
+    const result = resolveBind("localhost");
+    assert.strictEqual(result, "localhost", "localhost must not be rewritten to 0.0.0.0");
+    assert.notStrictEqual(result, "0.0.0.0", "loopback request must stay loopback");
+  });
+
+  it("127.0.0.1 stays as 127.0.0.1", () => {
+    assert.strictEqual(resolveBind("127.0.0.1"), "127.0.0.1");
+  });
+
+  it("::1 (IPv6 loopback) stays as ::1", () => {
+    assert.strictEqual(resolveBind("::1"), "::1");
+  });
+
+  it("explicit 0.0.0.0 opt-in is honoured (all-interfaces bind)", () => {
+    // This is the ONLY case where 0.0.0.0 should appear.
+    assert.strictEqual(resolveBind("0.0.0.0"), "0.0.0.0");
+  });
+
+  it("explicit non-loopback host (e.g. 192.168.1.5) is honoured", () => {
+    assert.strictEqual(resolveBind("192.168.1.5"), "192.168.1.5");
+  });
+
+  // -------------------------------------------------------------------------
+  // Regression guard: prove the old (buggy) implementation would FAIL above.
+  // If someone accidentally re-introduces the old logic these assertions flip.
+  // -------------------------------------------------------------------------
+  it("[old-behaviour guard] OLD code wrongly rewrites localhost → 0.0.0.0", () => {
+    // The old code produced 0.0.0.0 for localhost — that is the bug.
+    assert.strictEqual(
+      resolveBindOLD("localhost"),
+      "0.0.0.0",
+      "Confirm the old buggy expression for documentation purposes",
+    );
+  });
+
+  it("[old-behaviour guard] OLD code would NOT produce localhost for localhost", () => {
+    assert.notStrictEqual(
+      resolveBindOLD("localhost"),
+      "localhost",
+      "Under the old code, localhost was never kept as localhost",
+    );
+  });
+});
+
+// ---------------------------------------------------------------------------
+// R-002 — HMR WebSocket Origin validation
+// ---------------------------------------------------------------------------
+// We test `isOriginAllowed` by extracting its logic into a standalone
+// function that mirrors the implementation in hmr.ts exactly.  The actual
+// HMREngine class is not instantiated (it tries to bind a network port in
+// the constructor area which is inappropriate for unit tests).
+
+function buildAllowedOriginsSet(allowedOrigins: string[]): Set<string> {
+  return new Set(allowedOrigins);
+}
+
+function isOriginAllowed(allowedOrigins: Set<string>, origin: string | undefined): boolean {
+  if (!origin) return false;
+  const normalise = (o: string) => o.replace(/\/$/, "").toLowerCase();
+  const candidate = normalise(origin);
+  for (const allowed of allowedOrigins) {
+    if (normalise(allowed) === candidate) return true;
+  }
+  return false;
+}
+
+/** Mirrors SwiteServer.buildHmrAllowedOrigins() from server.ts */
+function buildHmrAllowedOrigins(host: string, port: number): string[] {
+  const origins: string[] = [];
+  const add = (h: string) => origins.push(`http://${h}:${port}`);
+  add(host);
+  if (host === "localhost") add("127.0.0.1");
+  else if (host === "127.0.0.1") add("localhost");
+  return origins;
+}
+
+describe("R-002 — HMR WebSocket origin validation", () => {
+  // -------------------------------------------------------------------------
+  // Default dev setup: host=localhost, port=3000
+  // -------------------------------------------------------------------------
+  it("allows same-origin connection from http://localhost:3000", () => {
+    const origins = buildAllowedOriginsSet(buildHmrAllowedOrigins("localhost", 3000));
+    assert.ok(isOriginAllowed(origins, "http://localhost:3000"), "same-origin must be allowed");
+  });
+
+  it("also allows http://127.0.0.1:3000 when configured host is localhost", () => {
+    // Browser may send the numeric form depending on what user typed.
+    const origins = buildAllowedOriginsSet(buildHmrAllowedOrigins("localhost", 3000));
+    assert.ok(isOriginAllowed(origins, "http://127.0.0.1:3000"), "loopback alias must be allowed");
+  });
+
+  it("allows http://localhost:3000 when configured host is 127.0.0.1", () => {
+    const origins = buildAllowedOriginsSet(buildHmrAllowedOrigins("127.0.0.1", 3000));
+    assert.ok(isOriginAllowed(origins, "http://localhost:3000"));
+  });
+
+  it("rejects a foreign origin (cross-site WebSocket hijack attempt)", () => {
+    const origins = buildAllowedOriginsSet(buildHmrAllowedOrigins("localhost", 3000));
+    assert.ok(
+      !isOriginAllowed(origins, "http://evil.example.com"),
+      "foreign origin must be rejected",
+    );
+  });
+
+  it("rejects a subdomain of localhost (not the same origin)", () => {
+    const origins = buildAllowedOriginsSet(buildHmrAllowedOrigins("localhost", 3000));
+    assert.ok(!isOriginAllowed(origins, "http://sub.localhost:3000"), "subdomain must be rejected");
+  });
+
+  it("rejects a connection on the correct host but wrong port", () => {
+    const origins = buildAllowedOriginsSet(buildHmrAllowedOrigins("localhost", 3000));
+    assert.ok(
+      !isOriginAllowed(origins, "http://localhost:9000"),
+      "different port must be rejected",
+    );
+  });
+
+  it("rejects a connection with no Origin header (non-browser WebSocket client)", () => {
+    const origins = buildAllowedOriginsSet(buildHmrAllowedOrigins("localhost", 3000));
+    assert.ok(!isOriginAllowed(origins, undefined), "absent Origin must be rejected");
+  });
+
+  it("rejects an empty-string Origin", () => {
+    const origins = buildAllowedOriginsSet(buildHmrAllowedOrigins("localhost", 3000));
+    assert.ok(!isOriginAllowed(origins, ""), "empty Origin must be rejected");
+  });
+
+  it("origin check is case-insensitive on scheme and host", () => {
+    const origins = buildAllowedOriginsSet(buildHmrAllowedOrigins("localhost", 3000));
+    // RFC 6454 §6.1: scheme+host are case-insensitive
+    assert.ok(isOriginAllowed(origins, "HTTP://LOCALHOST:3000"), "case-insensitive match must work");
+  });
+
+  it("explicit 0.0.0.0 dev server only adds 0.0.0.0 as allowed origin (not localhost)", () => {
+    // When the dev explicitly opted in to 0.0.0.0 binding, only that literal
+    // host is in the origin allowlist — "localhost" is NOT auto-added.
+    const origins = buildHmrAllowedOrigins("0.0.0.0", 3000);
+    assert.ok(origins.includes("http://0.0.0.0:3000"), "0.0.0.0 origin present");
+    assert.ok(!origins.includes("http://localhost:3000"), "localhost not auto-added for 0.0.0.0 config");
+  });
+
+  it("custom non-loopback host only allows that host origin", () => {
+    const origins = buildAllowedOriginsSet(buildHmrAllowedOrigins("192.168.1.5", 4000));
+    assert.ok(isOriginAllowed(origins, "http://192.168.1.5:4000"));
+    assert.ok(!isOriginAllowed(origins, "http://localhost:4000"));
+    assert.ok(!isOriginAllowed(origins, "http://192.168.1.5:3000"), "different port rejected");
+  });
+});