Problem
parseAllowedHosts keeps scheme/port, so a documented-style entry like https://seller.example.com never equals the request hostname and all legit traffic fail-closes with a bare allowlist error.
Where
src/guard.ts (trim + lowercase only, no URL parsing).
Acceptance
Add a failing test first asserting parseAllowedHosts("https://seller.example.com:443/") equals ["seller.example.com"]. Then fix.
Problem
parseAllowedHostskeeps scheme/port, so a documented-style entry likehttps://seller.example.comnever equals the request hostname and all legit traffic fail-closes with a bare allowlist error.Where
src/guard.ts(trim + lowercase only, no URL parsing).Acceptance
Add a failing test first asserting
parseAllowedHosts("https://seller.example.com:443/")equals["seller.example.com"]. Then fix.