mandrel-platform 0.13.0 → 0.14.2

package/scripts/check-pin-drift.test.mjs

@@ -22,12 +22,17 @@ import { test } from "node:test";
 import {
   buildReport,
   classifyNpmPin,
+  classifyStaleLiterals,
   combineDrift,
   compareSemver,
   detectSurfaceSkew,
   extractNpmPlatformVersion,
+  extractStaleLiterals,
   fetchConsumerPackageJson,
   hasDrift,
+  isHolding,
+  isWithinReleaseAgeWindow,
+  parseDurationMs,
   parseSemver,
   renderReport,
   runCli,
@@ -156,6 +161,82 @@ test("detectSurfaceSkew is false when either surface is not comparable", () => {
   assert.equal(detectSurfaceSkew("no-pins", "lagging"), false);
 });
 
+// ---------------------------------------------------------------------------
+// extractStaleLiterals / classifyStaleLiterals (Story #110)
+// ---------------------------------------------------------------------------
+
+const PLAT = "dsj1984/mandrel-platform";
+
+test("extractStaleLiterals finds platform refs in comments and run/echo strings", () => {
+  const text = [
+    "jobs:",
+    "  deploy:",
+    "    steps:",
+    `      # pinned via ${PLAT}/.github/workflows/deploy-cloudflare.yml@${"c".repeat(40)}`,
+    "      - name: summary",
+    "        run: |",
+    `          echo "deployed with ${PLAT}/.github/workflows/deploy-cloudflare.yml@v0.11.6"`,
+  ].join("\n");
+  const lits = extractStaleLiterals("ci.yml", text, PLAT);
+  assert.equal(lits.length, 2);
+  assert.equal(lits[0].kind, "comment");
+  assert.equal(lits[0].ref, "c".repeat(40));
+  assert.equal(lits[1].kind, "run");
+  assert.equal(lits[1].ref, "v0.11.6");
+});
+
+test("extractStaleLiterals ignores uses: lines (owned by extractPlatformPins)", () => {
+  const text = [
+    "jobs:",
+    "  q:",
+    `    uses: ${PLAT}/.github/workflows/pr-quality.yml@${"a".repeat(40)}`,
+    `    # uses: ${PLAT}/.github/workflows/pr-quality.yml@${"a".repeat(40)}`,
+  ].join("\n");
+  const lits = extractStaleLiterals("ci.yml", text, PLAT);
+  // The bare `uses:` line is skipped; the commented `# uses:` line is a comment
+  // literal (it is NOT a live uses directive), so it IS captured.
+  assert.equal(lits.length, 1);
+  assert.equal(lits[0].kind, "comment");
+});
+
+test("extractStaleLiterals returns nothing when no platform refs are present", () => {
+  const text = "jobs:\n  q:\n    run: echo hello\n    # owner/other-repo/x.yml@abc";
+  assert.deepEqual(extractStaleLiterals("ci.yml", text, PLAT), []);
+});
+
+test("classifyStaleLiterals flags a literal that drifts from the canonical pin", () => {
+  const canonicalSha = "a".repeat(40);
+  const staleSha = "c".repeat(40);
+  const literals = [
+    { file: "ci.yml", line: 9, target: PLAT, ref: staleSha, kind: "run" },
+    { file: "ci.yml", line: 4, target: PLAT, ref: canonicalSha, kind: "comment" },
+  ];
+  const out = classifyStaleLiterals(literals, [canonicalSha]);
+  assert.equal(out.hasStaleLiteral, true);
+  assert.equal(out.staleLiterals.length, 1);
+  assert.equal(out.staleLiterals[0].ref, staleSha);
+  assert.equal(out.staleLiterals[0].reason, "stale");
+});
+
+test("classifyStaleLiterals matches the canonical pin case-insensitively", () => {
+  const sha = "abc123" + "0".repeat(34);
+  const literals = [
+    { file: "ci.yml", line: 9, target: PLAT, ref: sha.toUpperCase(), kind: "run" },
+  ];
+  const out = classifyStaleLiterals(literals, [sha]);
+  assert.equal(out.hasStaleLiteral, false);
+  assert.equal(out.staleLiterals.length, 0);
+});
+
+test("classifyStaleLiterals reports an orphan literal when there is no canonical pin", () => {
+  const literals = [
+    { file: "ci.yml", line: 9, target: PLAT, ref: "v0.11.6", kind: "run" },
+  ];
+  const out = classifyStaleLiterals(literals, []);
+  assert.equal(out.hasStaleLiteral, true);
+  assert.equal(out.staleLiterals[0].reason, "orphan");
+});
+
 // ---------------------------------------------------------------------------
 // combineDrift
 // ---------------------------------------------------------------------------
@@ -170,6 +251,114 @@ test("combineDrift folds uses-drift, npm-lag, and surface-skew", () => {
   assert.equal(combineDrift({ drift: true }, { npmState: "current" }, false), true);
 });
 
+test("combineDrift suppresses lag/skew during the minimumReleaseAge hold", () => {
+  const lagging = { drift: true, splitPinned: false };
+  // Without the hold flag, lag is drift.
+  assert.equal(combineDrift(lagging, { npmState: "lagging" }, false, false), true);
+  // Within the hold window, the same lag/skew is suppressed.
+  assert.equal(combineDrift(lagging, { npmState: "lagging" }, false, true), false);
+  assert.equal(
+    combineDrift({ drift: false, splitPinned: false }, { npmState: "current" }, true, true),
+    false,
+  );
+});
+
+test("combineDrift never suppresses a split pin, even within the hold window", () => {
+  const split = { drift: true, splitPinned: true };
+  assert.equal(combineDrift(split, { npmState: "current" }, false, true), true);
+});
+
+test("combineDrift flags a stale literal even inside the hold window (Story #110)", () => {
+  const clean = { drift: false, splitPinned: false };
+  // No other deviation, but a stale literal is present → drift, hold or not.
+  assert.equal(
+    combineDrift(clean, { npmState: "current" }, false, true, true),
+    true,
+  );
+  // No stale literal and otherwise clean → not drift.
+  assert.equal(
+    combineDrift(clean, { npmState: "current" }, false, true, false),
+    false,
+  );
+});
+
+// ---------------------------------------------------------------------------
+// parseDurationMs — Renovate-style minimumReleaseAge strings (Story #107)
+// ---------------------------------------------------------------------------
+
+const DAY_MS = 24 * 60 * 60 * 1000;
+
+test("parseDurationMs parses days / hours / weeks / minutes", () => {
+  assert.equal(parseDurationMs("3 days"), 3 * DAY_MS);
+  assert.equal(parseDurationMs("1 day"), DAY_MS);
+  assert.equal(parseDurationMs("36 hours"), 36 * 60 * 60 * 1000);
+  assert.equal(parseDurationMs("1 week"), 7 * DAY_MS);
+  assert.equal(parseDurationMs("90 minutes"), 90 * 60 * 1000);
+});
+
+test("parseDurationMs treats a bare number as days and rejects junk", () => {
+  assert.equal(parseDurationMs(3), 3 * DAY_MS);
+  assert.equal(parseDurationMs("0 days"), null);
+  assert.equal(parseDurationMs("-2 days"), null);
+  assert.equal(parseDurationMs("soon"), null);
+  assert.equal(parseDurationMs(""), null);
+  assert.equal(parseDurationMs(null), null);
+  assert.equal(parseDurationMs("5 fortnights"), null);
+});
+
+// ---------------------------------------------------------------------------
+// isWithinReleaseAgeWindow
+// ---------------------------------------------------------------------------
+
+test("isWithinReleaseAgeWindow is true for a release younger than the window", () => {
+  const now = Date.parse("2026-06-30T00:00:00Z");
+  const oneDayAgo = "2026-06-29T00:00:00Z";
+  assert.equal(isWithinReleaseAgeWindow(oneDayAgo, 3 * DAY_MS, now), true);
+});
+
+test("isWithinReleaseAgeWindow is false once the release ages past the window", () => {
+  const now = Date.parse("2026-06-30T00:00:00Z");
+  const fourDaysAgo = "2026-06-26T00:00:00Z";
+  assert.equal(isWithinReleaseAgeWindow(fourDaysAgo, 3 * DAY_MS, now), false);
+});
+
+test("isWithinReleaseAgeWindow fails safe (false) on missing inputs", () => {
+  const now = Date.parse("2026-06-30T00:00:00Z");
+  assert.equal(isWithinReleaseAgeWindow(null, 3 * DAY_MS, now), false);
+  assert.equal(isWithinReleaseAgeWindow("2026-06-29T00:00:00Z", null, now), false);
+  assert.equal(isWithinReleaseAgeWindow("not-a-date", 3 * DAY_MS, now), false);
+  assert.equal(isWithinReleaseAgeWindow("2026-06-29T00:00:00Z", 0, now), false);
+});
+
+// ---------------------------------------------------------------------------
+// isHolding
+// ---------------------------------------------------------------------------
+
+test("isHolding is true when lag would drift but the release is inside the window", () => {
+  assert.equal(
+    isHolding({ drift: true, splitPinned: false }, { npmState: "lagging" }, true, true),
+    true,
+  );
+});
+
+test("isHolding is false outside the window, for a clean consumer, or a split pin", () => {
+  // Outside the window — the lag is real drift, not a hold.
+  assert.equal(
+    isHolding({ drift: true, splitPinned: false }, { npmState: "lagging" }, false, false),
+    false,
+  );
+  // No deviation to suppress.
+  assert.equal(
+    isHolding({ drift: false, splitPinned: false }, { npmState: "current" }, false, true),
+    false,
+  );
+  // A split pin is a real error regardless of the hold.
+  assert.equal(
+    isHolding({ drift: true, splitPinned: true }, { npmState: "current" }, false, true),
+    false,
+  );
+});
+
 // ---------------------------------------------------------------------------
 // Integration: buildReport + renderReport with an injected gh runner
 // ---------------------------------------------------------------------------
@@ -203,7 +392,10 @@ function makeRunGh(fixtures) {
   return (args) => {
     const path = args[1];
     if (path === `repos/${PLATFORM}/releases/latest`) {
-      return JSON.stringify({ tag_name: TAG });
+      // `publishedAt` is opt-in: existing fixtures omit it (so the
+      // minimumReleaseAge window resolves to "not within", preserving legacy
+      // behaviour); the hold-window tests pass it explicitly.
+      return JSON.stringify({ tag_name: TAG, published_at: fixtures.__publishedAt });
     }
     if (path === `repos/${PLATFORM}/git/ref/tags/${TAG}`) {
       return JSON.stringify({ object: { sha: LATEST_SHA, type: "commit" } });
@@ -307,6 +499,55 @@ test("renderReport surfaces the npm columns and drift lines", () => {
   assert.match(text, /`1\.4\.0`/);
 });
 
+test("buildReport: a stale pin literal beyond uses: is drift (Story #110)", () => {
+  const canonical = "a".repeat(40); // == LATEST_SHA, so uses: is current
+  const stale = "c".repeat(40);
+  const yaml = [
+    "jobs:",
+    "  deploy:",
+    `    uses: ${PLATFORM}/.github/workflows/deploy-cloudflare.yml@${canonical}`,
+    "  summary:",
+    "    steps:",
+    `      # legacy pin note: ${PLATFORM}/.github/workflows/deploy-cloudflare.yml@${stale}`,
+    "      - run: |",
+    `          echo "deployed ${PLATFORM}/.github/workflows/deploy-cloudflare.yml@${stale}"`,
+  ].join("\n");
+  const runGh = (args) => {
+    const path = args[1];
+    if (path === `repos/${PLATFORM}/releases/latest`) {
+      return JSON.stringify({ tag_name: TAG });
+    }
+    if (path === `repos/${PLATFORM}/git/ref/tags/${TAG}`) {
+      return JSON.stringify({ object: { sha: LATEST_SHA, type: "commit" } });
+    }
+    if (path === "repos/o/lit/contents/.github/workflows?ref=main") {
+      return JSON.stringify([
+        { type: "file", name: "ci.yml", encoding: "base64", content: b64(yaml) },
+      ]);
+    }
+    if (path === "repos/o/lit/contents/package.json?ref=main") {
+      return JSON.stringify({ encoding: "base64", content: b64(pkgJson("1.4.0")) });
+    }
+    throw new Error(`unexpected gh api path: ${path}`);
+  };
+  const report = buildReport(
+    { platformRepo: PLATFORM, consumers: [{ name: "lit", repo: "o/lit", branch: "main" }] },
+    runGh,
+  );
+  const r = byName(report, "lit");
+  // The uses: pin and npm dep are both current — the ONLY deviation is the
+  // stale echoed literal, which the uses:-only check would have missed.
+  assert.equal(r.verdict.lagState, "current");
+  assert.equal(r.npm.npmState, "current");
+  assert.equal(r.hasStaleLiteral, true);
+  assert.equal(r.staleLiterals.length, 2); // comment + echo, same stale SHA
+  assert.equal(r.staleLiterals.every((l) => l.reason === "stale"), true);
+  assert.equal(r.drift, true);
+  const text = renderReport(report);
+  assert.match(text, /stale pin literal/);
+  assert.match(text, /STALE PIN LITERAL/);
+});
+
 test("fetchConsumerPackageJson returns null when the file is missing", () => {
   const runGh = () => {
     throw new Error("404");
@@ -368,3 +609,105 @@ test("runCli --strict exits 1 when drift is present", () => {
     rmSync(cfgDir, { recursive: true, force: true });
   }
 });
+
+// ---------------------------------------------------------------------------
+// minimumReleaseAge hold window — the false-positive guard (Story #107)
+// ---------------------------------------------------------------------------
+
+// A fresh release: the `skew` and `both-lag` consumers lag it, but the release
+// is younger than the 3-day hold window, so Renovate has not bumped them yet.
+const FRESH_RELEASE_AT = "2026-06-29T00:00:00Z"; // 1 day before NOW
+const AGED_RELEASE_AT = "2026-06-25T00:00:00Z"; // 5 days before NOW
+const NOW = Date.parse("2026-06-30T00:00:00Z");
+
+const HOLD_CONFIG = { ...CONFIG, minimumReleaseAge: "3 days" };
+
+test("buildReport: lag against a release inside the hold window is holding, not drift", () => {
+  const runGh = makeRunGh({ ...FIXTURES, __publishedAt: FRESH_RELEASE_AT });
+  const report = buildReport(HOLD_CONFIG, runGh, NOW);
+  assert.equal(report.releaseAge.withinWindow, true);
+
+  // npm lags but workflows are current → would be a surface skew, suppressed.
+  const skew = byName(report, "skew");
+  assert.equal(skew.surfaceSkew, true);
+  assert.equal(skew.holding, true);
+  assert.equal(skew.drift, false);
+
+  // Both surfaces lag → would be drift, suppressed during the hold.
+  const both = byName(report, "both-lag");
+  assert.equal(both.holding, true);
+  assert.equal(both.drift, false);
+
+  // The aligned consumer is genuinely current — not holding.
+  const aligned = byName(report, "aligned");
+  assert.equal(aligned.holding, false);
+  assert.equal(aligned.drift, false);
+
+  // No consumer drifts during the hold → the dashboard does not page.
+  assert.equal(hasDrift(report), false);
+});
+
+test("buildReport: the same lag against an aged release is real drift again", () => {
+  const runGh = makeRunGh({ ...FIXTURES, __publishedAt: AGED_RELEASE_AT });
+  const report = buildReport(HOLD_CONFIG, runGh, NOW);
+  assert.equal(report.releaseAge.withinWindow, false);
+
+  const skew = byName(report, "skew");
+  assert.equal(skew.holding, false);
+  assert.equal(skew.drift, true);
+
+  const both = byName(report, "both-lag");
+  assert.equal(both.holding, false);
+  assert.equal(both.drift, true);
+
+  assert.equal(hasDrift(report), true);
+});
+
+test("renderReport surfaces the holding banner + section during the hold", () => {
+  const runGh = makeRunGh({ ...FIXTURES, __publishedAt: FRESH_RELEASE_AT });
+  const report = buildReport(HOLD_CONFIG, runGh, NOW);
+  const text = renderReport(report);
+  assert.match(text, /minimumReleaseAge` hold active/);
+  assert.match(text, /⏳ holding/);
+  assert.match(text, /Holding \(minimumReleaseAge\)/);
+  // Held consumers must NOT appear in a "Drift detected" section.
+  assert.doesNotMatch(text, /Drift detected/);
+});
+
+test("runCli --strict does NOT exit 1 when the only deviation is a hold", () => {
+  cfgDir = mkdtempSync(join(tmpdir(), "pin-drift-hold-"));
+  const p = join(cfgDir, "consumers.json");
+  writeFileSync(p, JSON.stringify(HOLD_CONFIG));
+  try {
+    const code = runCli({
+      argv: ["--config", p, "--strict"],
+      runGh: makeRunGh({ ...FIXTURES, __publishedAt: FRESH_RELEASE_AT }),
+      stdout: capture(),
+      stderr: capture(),
+      summaryPath: undefined,
+      nowMs: NOW, // release is 1 day old → inside the 3-day hold window.
+    });
+    assert.equal(code, 0);
+  } finally {
+    rmSync(cfgDir, { recursive: true, force: true });
+  }
+});
+
+test("runCli --strict DOES exit 1 once the held release ages out", () => {
+  cfgDir = mkdtempSync(join(tmpdir(), "pin-drift-aged-"));
+  const p = join(cfgDir, "consumers.json");
+  writeFileSync(p, JSON.stringify(HOLD_CONFIG));
+  try {
+    const code = runCli({
+      argv: ["--config", p, "--strict"],
+      runGh: makeRunGh({ ...FIXTURES, __publishedAt: AGED_RELEASE_AT }),
+      stdout: capture(),
+      stderr: capture(),
+      summaryPath: undefined,
+      nowMs: NOW, // release is 5 days old → past the 3-day hold window.
+    });
+    assert.equal(code, 1);
+  } finally {
+    rmSync(cfgDir, { recursive: true, force: true });
+  }
+});

package/scripts/edge-security.test.mjs

@@ -0,0 +1,300 @@
+#!/usr/bin/env node
+/**
+ * edge-security.test.mjs — node:test suite for the reusable edge-security
+ * middleware units (Story #116): CORS (Astro + hono variants), security
+ * headers, and app-layer rate limiting.
+ *
+ * The units live under `config/edge-security/` (the npm package-export channel)
+ * and are imported here by relative path. Run: `node --test scripts/` or
+ * `npm test`.
+ */
+
+import assert from "node:assert/strict";
+import { test } from "node:test";
+
+import {
+  createAllowlist,
+  normalizeOrigin,
+} from "../config/edge-security/allowlist.mjs";
+import { createAstroCors } from "../config/edge-security/cors-astro.mjs";
+import { createHonoCorsOptions } from "../config/edge-security/cors-hono.mjs";
+import {
+  applySecurityHeaders,
+  buildSecurityHeaders,
+} from "../config/edge-security/security-headers.mjs";
+import {
+  createAstroRateLimit,
+  createMemoryStore,
+  createRateLimiter,
+  rateLimitHeaders,
+} from "../config/edge-security/rate-limit.mjs";
+import * as barrel from "../config/edge-security/index.mjs";
+
+// ---------------------------------------------------------------------------
+// allowlist — the no-wildcard-with-credentials invariant
+// ---------------------------------------------------------------------------
+
+test("normalizeOrigin strips trailing slash / path to scheme+host+port", () => {
+  assert.equal(normalizeOrigin("https://app.example.com/"), "https://app.example.com");
+  assert.equal(normalizeOrigin("https://app.example.com:8443/x"), "https://app.example.com:8443");
+  assert.equal(normalizeOrigin("*"), "*");
+});
+
+test("normalizeOrigin rejects a non-absolute / bare-host entry", () => {
+  assert.throws(() => normalizeOrigin("app.example.com"), /not a valid absolute origin/);
+});
+
+test("createAllowlist THROWS on wildcard + credentials (invariant by construction)", () => {
+  assert.throws(
+    () => createAllowlist(["*"], { credentials: true }),
+    /wildcard origin .* AND credentials/i,
+  );
+});
+
+test("createAllowlist allows wildcard when credentials are off", () => {
+  const al = createAllowlist(["*"], { credentials: false });
+  assert.equal(al.isWildcard, true);
+  assert.equal(al.credentials, false);
+  assert.equal(al.resolve("https://anything.example.com"), "*");
+});
+
+test("createAllowlist rejects wildcard mixed with explicit origins", () => {
+  assert.throws(
+    () => createAllowlist(["*", "https://a.example.com"]),
+    /cannot be combined with explicit origins/,
+  );
+});
+
+test("closed allowlist echoes only trusted origins, null otherwise", () => {
+  const al = createAllowlist(["https://app.example.com"], { credentials: true });
+  assert.equal(al.resolve("https://app.example.com"), "https://app.example.com");
+  assert.equal(al.resolve("https://app.example.com/"), "https://app.example.com"); // normalized
+  assert.equal(al.resolve("https://evil.example.com"), null);
+  assert.equal(al.resolve(null), null);
+  assert.equal(al.resolve("not a url"), null);
+});
+
+// ---------------------------------------------------------------------------
+// cors-astro
+// ---------------------------------------------------------------------------
+
+test("createAstroCors throws on wildcard + credentials at construction", () => {
+  assert.throws(
+    () => createAstroCors({ allowedOrigins: ["*"], credentials: true }),
+    /wildcard origin .* AND credentials/i,
+  );
+});
+
+test("createAstroCors requires allowedOrigins", () => {
+  assert.throws(() => createAstroCors({}), /allowedOrigins/);
+});
+
+test("astro CORS preflight: trusted origin gets full CORS headers", async () => {
+  const cors = createAstroCors({
+    allowedOrigins: ["https://godomio.com"],
+    credentials: true,
+    methods: ["GET", "POST"],
+  });
+  const req = new Request("https://godomio.com/api", {
+    method: "OPTIONS",
+    headers: { Origin: "https://godomio.com" },
+  });
+  const res = await cors({ request: req }, async () => new Response("unused"));
+  assert.equal(res.status, 204);
+  assert.equal(res.headers.get("Access-Control-Allow-Origin"), "https://godomio.com");
+  assert.equal(res.headers.get("Access-Control-Allow-Credentials"), "true");
+  assert.equal(res.headers.get("Access-Control-Allow-Methods"), "GET, POST");
+  assert.match(res.headers.get("Vary") ?? "", /Origin/);
+});
+
+test("astro CORS preflight: untrusted origin gets 204 with NO cors headers", async () => {
+  const cors = createAstroCors({ allowedOrigins: ["https://godomio.com"] });
+  const req = new Request("https://godomio.com/api", {
+    method: "OPTIONS",
+    headers: { Origin: "https://evil.example.com" },
+  });
+  const res = await cors({ request: req }, async () => new Response("unused"));
+  assert.equal(res.status, 204);
+  assert.equal(res.headers.get("Access-Control-Allow-Origin"), null);
+});
+
+test("astro CORS actual request: annotates downstream response for trusted origin", async () => {
+  const cors = createAstroCors({ allowedOrigins: ["https://godomio.com"] });
+  const req = new Request("https://godomio.com/api", {
+    method: "GET",
+    headers: { Origin: "https://godomio.com" },
+  });
+  const res = await cors({ request: req }, async () => new Response("ok"));
+  assert.equal(await res.text(), "ok");
+  assert.equal(res.headers.get("Access-Control-Allow-Origin"), "https://godomio.com");
+});
+
+test("astro CORS actual request: untrusted origin response carries no ACAO", async () => {
+  const cors = createAstroCors({ allowedOrigins: ["https://godomio.com"] });
+  const req = new Request("https://godomio.com/api", {
+    method: "GET",
+    headers: { Origin: "https://evil.example.com" },
+  });
+  const res = await cors({ request: req }, async () => new Response("ok"));
+  assert.equal(res.headers.get("Access-Control-Allow-Origin"), null);
+});
+
+// ---------------------------------------------------------------------------
+// cors-hono
+// ---------------------------------------------------------------------------
+
+test("createHonoCorsOptions throws on wildcard + credentials at construction", () => {
+  assert.throws(
+    () => createHonoCorsOptions({ allowedOrigins: ["*"], credentials: true }),
+    /wildcard origin .* AND credentials/i,
+  );
+});
+
+test("hono CORS options origin callback enforces the closed allowlist", () => {
+  const opts = createHonoCorsOptions({
+    allowedOrigins: ["https://athportal.com"],
+    credentials: true,
+  });
+  assert.equal(opts.credentials, true);
+  assert.equal(opts.origin("https://athportal.com"), "https://athportal.com");
+  assert.equal(opts.origin("https://evil.example.com"), null);
+  assert.deepEqual(opts.allowMethods.includes("GET"), true);
+});
+
+test("hono CORS wildcard env returns * via origin callback (no credentials)", () => {
+  const opts = createHonoCorsOptions({ allowedOrigins: ["*"] });
+  assert.equal(opts.credentials, false);
+  assert.equal(opts.origin("https://anything.example.com"), "*");
+});
+
+// ---------------------------------------------------------------------------
+// security-headers
+// ---------------------------------------------------------------------------
+
+test("buildSecurityHeaders ships the hardened default set", () => {
+  const h = buildSecurityHeaders();
+  assert.match(h["Content-Security-Policy"], /default-src 'self'/);
+  assert.match(h["Strict-Transport-Security"], /max-age=63072000/);
+  assert.match(h["Strict-Transport-Security"], /includeSubDomains/);
+  assert.equal(h["X-Frame-Options"], "DENY");
+  assert.equal(h["X-Content-Type-Options"], "nosniff");
+  assert.equal(h["Referrer-Policy"], "strict-origin-when-cross-origin");
+});
+
+test("buildSecurityHeaders omits headers set to false", () => {
+  const h = buildSecurityHeaders({
+    contentSecurityPolicy: false,
+    hsts: false,
+    frameOptions: false,
+  });
+  assert.equal("Content-Security-Policy" in h, false);
+  assert.equal("Strict-Transport-Security" in h, false);
+  assert.equal("X-Frame-Options" in h, false);
+  // The remaining defaults are still present.
+  assert.equal(h["X-Content-Type-Options"], "nosniff");
+});
+
+test("buildSecurityHeaders honours custom CSP + HSTS preload", () => {
+  const h = buildSecurityHeaders({
+    contentSecurityPolicy: "default-src 'none'",
+    hsts: { maxAge: 100, preload: true, includeSubDomains: false },
+  });
+  assert.equal(h["Content-Security-Policy"], "default-src 'none'");
+  assert.equal(h["Strict-Transport-Security"], "max-age=100; preload");
+});
+
+test("applySecurityHeaders mutates a Headers instance in place", () => {
+  const headers = new Headers();
+  applySecurityHeaders(headers);
+  assert.equal(headers.get("X-Content-Type-Options"), "nosniff");
+  assert.throws(() => applySecurityHeaders({}), /must be a Headers instance/);
+});
+
+// ---------------------------------------------------------------------------
+// rate-limit
+// ---------------------------------------------------------------------------
+
+function ipReq(ip) {
+  return new Request("https://api.example.com/", {
+    headers: { "CF-Connecting-IP": ip },
+  });
+}
+
+test("createRateLimiter validates its options", () => {
+  assert.throws(() => createRateLimiter({}), /limit.*windowMs/);
+  assert.throws(() => createRateLimiter({ limit: 0, windowMs: 1000 }), />= 1/);
+});
+
+test("fixed-window limiter allows up to limit then denies", async () => {
+  const limiter = createRateLimiter({ limit: 2, windowMs: 60_000 });
+  const a = await limiter.check(ipReq("1.1.1.1"));
+  assert.equal(a.allowed, true);
+  assert.equal(a.remaining, 1);
+  const b = await limiter.check(ipReq("1.1.1.1"));
+  assert.equal(b.allowed, true);
+  assert.equal(b.remaining, 0);
+  const c = await limiter.check(ipReq("1.1.1.1"));
+  assert.equal(c.allowed, false);
+  assert.ok(c.retryAfter > 0);
+});
+
+test("rate limiter buckets are per-key (per-IP)", async () => {
+  const limiter = createRateLimiter({ limit: 1, windowMs: 60_000 });
+  assert.equal((await limiter.check(ipReq("1.1.1.1"))).allowed, true);
+  assert.equal((await limiter.check(ipReq("2.2.2.2"))).allowed, true);
+  assert.equal((await limiter.check(ipReq("1.1.1.1"))).allowed, false);
+});
+
+test("default key extractor fails closed to a shared bucket when no IP", async () => {
+  const limiter = createRateLimiter({ limit: 1, windowMs: 60_000 });
+  const bare = () => new Request("https://api.example.com/");
+  assert.equal((await limiter.check(bare())).allowed, true);
+  assert.equal((await limiter.check(bare())).allowed, false); // same "anonymous" bucket
+});
+
+test("memory store self-prunes expired buckets", async () => {
+  const store = createMemoryStore();
+  store.set("k", { count: 5, resetAt: Date.now() - 1 });
+  assert.equal(store.get("k"), null);
+});
+
+test("rateLimitHeaders includes Retry-After only when denied", () => {
+  const allowed = rateLimitHeaders({ allowed: true, limit: 10, remaining: 9, resetAt: Date.now() + 1000, retryAfter: 0 });
+  assert.equal("Retry-After" in allowed, false);
+  assert.equal(allowed["RateLimit-Limit"], "10");
+  const denied = rateLimitHeaders({ allowed: false, limit: 10, remaining: 0, resetAt: Date.now() + 1000, retryAfter: 1, });
+  assert.equal(denied["Retry-After"], "1");
+});
+
+test("createAstroRateLimit short-circuits with 429 when denied", async () => {
+  const mw = createAstroRateLimit({ limit: 1, windowMs: 60_000 });
+  const ok = await mw({ request: ipReq("9.9.9.9") }, async () => new Response("body"));
+  assert.equal(ok.status, 200);
+  assert.equal(ok.headers.get("RateLimit-Limit"), "1");
+  const denied = await mw({ request: ipReq("9.9.9.9") }, async () => new Response("body"));
+  assert.equal(denied.status, 429);
+  assert.equal(denied.headers.get("Retry-After") !== null, true);
+});
+
+// ---------------------------------------------------------------------------
+// barrel
+// ---------------------------------------------------------------------------
+
+test("index barrel re-exports every public unit", () => {
+  for (const name of [
+    "createAllowlist",
+    "normalizeOrigin",
+    "WILDCARD",
+    "createAstroCors",
+    "createHonoCorsOptions",
+    "buildSecurityHeaders",
+    "applySecurityHeaders",
+    "createRateLimiter",
+    "createMemoryStore",
+    "createAstroRateLimit",
+    "createHonoRateLimit",
+    "rateLimitHeaders",
+  ]) {
+    assert.equal(typeof barrel[name] !== "undefined", true, `barrel missing ${name}`);
+  }
+});