diff --git a/tests/protect/engine.test.ts b/tests/protect/engine.test.ts
new file mode 100644
index 0000000..c416804
--- /dev/null
+++ b/tests/protect/engine.test.ts
@@ -0,0 +1,594 @@
+import { describe, it } from 'vitest';
+import assert from 'node:assert';
+import { readFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { RuleEngine, _testExports } from '../../src/protect/engine/engine.js';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const fixtureRules = JSON.parse(
+  await readFile(join(__dirname, 'fixtures', 'rules-response.json'), 'utf-8')
+);
+
+const { matchValue, safeRegExp } = _testExports;
+
+function createReq(overrides = {}) {
+  return {
+    method: 'GET',
+    url: '/test',
+    originalUrl: '/test',
+    query: {},
+    body: {},
+    headers: {},
+    ...overrides
+  };
+}
+
+describe('RuleEngine', () => {
+
+  describe('matchValue', () => {
+
+    it('should match equals (loose)', () => {
+      assert.strictEqual(matchValue('equals', '1', 1), true);
+      assert.strictEqual(matchValue('equals', 'hello', 'hello'), true);
+      assert.strictEqual(matchValue('equals', 'hello', 'world'), false);
+    });
+
+    it('should match equals_strict', () => {
+      assert.strictEqual(matchValue('equals_strict', '1', '1'), true);
+      assert.strictEqual(matchValue('equals_strict', '1', 1), false);
+    });
+
+    it('should match contains (case-insensitive)', () => {
+      assert.strictEqual(matchValue('contains', 'Hello World', 'hello'), true);
+      assert.strictEqual(matchValue('contains', 'test', 'xyz'), false);
+    });
+
+    it('should match not_contains', () => {
+      assert.strictEqual(matchValue('not_contains', 'hello', 'xyz'), true);
+      assert.strictEqual(matchValue('not_contains', 'hello', 'ell'), false);
+    });
+
+    it('should match regex', () => {
+      assert.strictEqual(matchValue('regex', 'UNION SELECT', '/union\\s+select/i'), true);
+      assert.strictEqual(matchValue('regex', 'normal query', '/union\\s+select/i'), false);
+    });
+
+    it('should match more_than', () => {
+      assert.strictEqual(matchValue('more_than', '10', 5), true);
+      assert.strictEqual(matchValue('more_than', '3', 5), false);
+    });
+
+    it('should match less_than', () => {
+      assert.strictEqual(matchValue('less_than', '3', 5), true);
+      assert.strictEqual(matchValue('less_than', '10', 5), false);
+    });
+
+    it('should match ctype_digit', () => {
+      assert.strictEqual(matchValue('ctype_digit', '12345', null), true);
+      assert.strictEqual(matchValue('ctype_digit', '123abc', null), false);
+    });
+
+    it('should honor the value inversion for ctype_* (value:false = flag when NOT of class)', () => {
+      // The canonical vPatch shape: `{ type: 'ctype_digit', value: false }` must FLAG a
+      // non-numeric value and PASS a numeric one — previously the matchVal was ignored,
+      // which inverted the rule (blocking legit numeric IDs, passing injection).
+      assert.strictEqual(matchValue('ctype_digit', '123abc', false), true, 'non-numeric should match value:false');
+      assert.strictEqual(matchValue('ctype_digit', '12345', false), false, 'numeric should not match value:false');
+      assert.strictEqual(matchValue('ctype_alnum', 'a b;drop', false), true, 'special chars match value:false');
+      assert.strictEqual(matchValue('ctype_alnum', 'abc123', false), false, 'alnum should not match value:false');
+    });
+
+    it('should not match ctype_*/is_numeric on empty or absent values', () => {
+      // engine-php skips empty (`$value != ''`); otherwise every missing param would
+      // false-positive a `value:false` rule.
+      assert.strictEqual(matchValue('ctype_digit', '', false), false);
+      assert.strictEqual(matchValue('ctype_alnum', '', false), false);
+      assert.strictEqual(matchValue('is_numeric', '', false), false);
+      assert.strictEqual(matchValue('ctype_digit', null, false), false);
+    });
+
+    it('should match is_numeric', () => {
+      assert.strictEqual(matchValue('is_numeric', '3.14', null), true);
+      assert.strictEqual(matchValue('is_numeric', 'abc', null), false);
+      assert.strictEqual(matchValue('is_numeric', '', null), false);
+    });
+
+    it('should match isset', () => {
+      assert.strictEqual(matchValue('isset', 'anything', null), true);
+      assert.strictEqual(matchValue('isset', null, null), false);
+    });
+
+    it('should match in_array', () => {
+      assert.strictEqual(matchValue('in_array', 'b', ['a', 'b', 'c']), true);
+      assert.strictEqual(matchValue('in_array', 'x', ['a', 'b', 'c']), false);
+    });
+
+    it('should match not_in_array', () => {
+      assert.strictEqual(matchValue('not_in_array', 'x', ['a', 'b']), true);
+      assert.strictEqual(matchValue('not_in_array', 'a', ['a', 'b']), false);
+    });
+
+    it('should match hostname', () => {
+      assert.strictEqual(matchValue('hostname', 'https://example.com/path', 'example.com'), true);
+      assert.strictEqual(matchValue('hostname', 'https://other.com/path', 'example.com'), false);
+    });
+
+    it('should match internal_host (SSRF egress ranges)', () => {
+      for (const host of ['127.0.0.1', '169.254.169.254', '10.0.0.5', '192.168.1.1', '172.16.0.1', 'localhost', 'metadata.google.internal', '::1']) {
+        assert.strictEqual(matchValue('internal_host', host, null), true, `${host} should be internal`);
+      }
+      for (const host of ['example.com', '8.8.8.8', '1.1.1.1', '172.32.0.1']) {
+        assert.strictEqual(matchValue('internal_host', host, null), false, `${host} should be external`);
+      }
+    });
+
+    it('should match quotes (and the inline_js_xss alias)', () => {
+      assert.strictEqual(matchValue('quotes', `x' OR 1=1`, null), true);
+      assert.strictEqual(matchValue('quotes', 'no quotes here', null), false);
+      assert.strictEqual(matchValue('inline_js_xss', 'say "hi"', null), true);
+    });
+
+    it('should match inline_xss (quote AND > or =)', () => {
+      assert.strictEqual(matchValue('inline_xss', `" onmouseover=alert(1)`, null), true);
+      assert.strictEqual(matchValue('inline_xss', `"><script>`, null), true);
+      assert.strictEqual(matchValue('inline_xss', `just "quoted" text`, null), false); // quote but no >/=
+    });
+
+    it('should match stripos as an alias of contains', () => {
+      assert.strictEqual(matchValue('stripos', 'Hello World', 'world'), true);
+      assert.strictEqual(matchValue('stripos', 'Hello World', 'xyz'), false);
+    });
+
+    it('should match ctype_special (strips space/_/-/, then alnum, honors value)', () => {
+      // legitimate column-ish name with separators is "clean" -> does NOT match value:false
+      assert.strictEqual(matchValue('ctype_special', 'date_created', false), false);
+      // SQL metacharacters survive stripping -> NOT clean -> matches value:false
+      assert.strictEqual(matchValue('ctype_special', '1) OR SLEEP(5', false), true);
+      assert.strictEqual(matchValue('ctype_special', '', false), false); // empty skipped
+    });
+
+    it('should match array_key_value (navigate key, run nested match)', () => {
+      const obj = { user: { role: 'administrator' }, id: '5' };
+      assert.strictEqual(
+        matchValue('array_key_value', obj, undefined, {
+          type: 'array_key_value',
+          key: 'user.role',
+          match: { type: 'equals', value: 'administrator' }
+        }),
+        true
+      );
+      assert.strictEqual(
+        matchValue('array_key_value', obj, undefined, {
+          type: 'array_key_value',
+          key: 'user.role',
+          match: { type: 'equals', value: 'subscriber' }
+        }),
+        false
+      );
+      // missing key -> no match
+      assert.strictEqual(
+        matchValue('array_key_value', obj, undefined, {
+          type: 'array_key_value',
+          key: 'user.missing',
+          match: { type: 'isset' }
+        }),
+        false
+      );
+    });
+
+    it('removed WordPress-only types never match and are reported (not silent)', () => {
+      const warnings = [];
+      const originalWarn = console.warn;
+      console.warn = (msg) => warnings.push(String(msg));
+      try {
+        assert.strictEqual(matchValue('current_user_cannot', 'val', 'val'), false);
+        assert.strictEqual(matchValue('general_xss', 'val', 'val'), false);
+        assert.strictEqual(matchValue('getShortcodeAtts', 'val', 'val'), false);
+        assert.strictEqual(matchValue('getBlockAtts', 'val', 'val'), false);
+      } finally {
+        console.warn = originalWarn;
+      }
+      assert.ok(
+        warnings.some((w) => w.includes('current_user_cannot')),
+        'a removed WP type should emit a warning rather than pass silently'
+      );
+    });
+
+    it('file_contains is unimplemented and returns false', () => {
+      assert.strictEqual(matchValue('file_contains', 'val', 'val'), false);
+    });
+
+    it('should return false for unknown match type', () => {
+      assert.strictEqual(matchValue('nonexistent', 'val', 'val'), false);
+    });
+
+    it('should return false for null value (except isset)', () => {
+      assert.strictEqual(matchValue('contains', null, 'test'), false);
+      assert.strictEqual(matchValue('equals', null, 'test'), false);
+    });
+
+  });
+
+  describe('safeRegExp', () => {
+
+    it('should parse valid regex', () => {
+      const re = safeRegExp('/test/i');
+      assert.ok(re instanceof RegExp);
+      assert.ok(re.test('TEST'));
+    });
+
+    it('should return null for dangerous patterns', () => {
+      assert.strictEqual(safeRegExp('/(a+)+/'), null);
+      assert.strictEqual(safeRegExp('/(a*)+/'), null);
+    });
+
+    it('should return null for invalid regex', () => {
+      assert.strictEqual(safeRegExp('/[invalid/'), null);
+    });
+
+    it('should return null for non-regex string', () => {
+      assert.strictEqual(safeRegExp('plain string'), null);
+    });
+
+    it('should return null for empty input', () => {
+      assert.strictEqual(safeRegExp(''), null);
+      assert.strictEqual(safeRegExp(null), null);
+    });
+
+  });
+
+  describe('evaluate()', () => {
+
+    it('should block SQL injection in query', () => {
+      const engine = new RuleEngine(fixtureRules);
+      const req = createReq({ query: { search: '1 UNION SELECT * FROM users' } });
+      const result = engine.evaluate(req);
+
+      assert.strictEqual(result.blocked, true);
+      assert.strictEqual(result.rule.id, 101);
+    });
+
+    it('should block XSS in body', () => {
+      const engine = new RuleEngine(fixtureRules);
+      const req = createReq({
+        method: 'POST',
+        body: { comment: '<script>alert(1)</script>' }
+      });
+      const result = engine.evaluate(req);
+
+      assert.strictEqual(result.blocked, true);
+      assert.strictEqual(result.rule.id, 102);
+    });
+
+    it('should block path traversal in URI', () => {
+      const engine = new RuleEngine(fixtureRules);
+      const req = createReq({
+        url: '/files/../../../etc/passwd',
+        originalUrl: '/files/../../../etc/passwd'
+      });
+      const result = engine.evaluate(req);
+
+      assert.strictEqual(result.blocked, true);
+      assert.strictEqual(result.rule.id, 104);
+    });
+
+    it('should block prototype pollution in raw body', () => {
+      const engine = new RuleEngine(fixtureRules);
+      const req = createReq({
+        body: '{"__proto__":{"admin":true}}'
+      });
+      const result = engine.evaluate(req);
+
+      assert.strictEqual(result.blocked, true);
+      assert.strictEqual(result.rule.id, 105);
+    });
+
+    it('should block SSRF to internal IPs', () => {
+      const engine = new RuleEngine(fixtureRules);
+      const req = createReq({
+        method: 'POST',
+        body: { url: 'http://127.0.0.1/admin' }
+      });
+      const result = engine.evaluate(req);
+
+      assert.strictEqual(result.blocked, true);
+      assert.strictEqual(result.rule.id, 106);
+    });
+
+    it('should block base64-encoded payloads with mutations', () => {
+      const engine = new RuleEngine(fixtureRules);
+      const encoded = Buffer.from('<script>alert(1)</script>').toString('base64');
+      const req = createReq({
+        method: 'POST',
+        body: { data: encoded }
+      });
+      const result = engine.evaluate(req);
+
+      assert.strictEqual(result.blocked, true);
+      assert.strictEqual(result.rule.id, 107);
+    });
+
+    it('should block malicious user-agent', () => {
+      const engine = new RuleEngine(fixtureRules);
+      const req = createReq({
+        headers: { 'user-agent': 'sqlmap/1.5' }
+      });
+      const result = engine.evaluate(req);
+
+      assert.strictEqual(result.blocked, true);
+      assert.strictEqual(result.rule.id, 108);
+    });
+
+    it('should allow clean requests', () => {
+      const engine = new RuleEngine(fixtureRules);
+      const req = createReq({ query: { search: 'normal search term' } });
+      const result = engine.evaluate(req);
+
+      assert.strictEqual(result.blocked, false);
+      assert.strictEqual(result.rule, null);
+    });
+
+    it('should handle empty rules', () => {
+      const engine = new RuleEngine({ firewall: [] });
+      const result = engine.evaluate(createReq());
+
+      assert.strictEqual(result.blocked, false);
+    });
+
+    it('resolves array parameters (["get.x","post.x"]) as OR across sources', () => {
+      const engine = new RuleEngine({
+        firewall: [{ id: 'a', rule_v2: [{ parameter: ['get.x', 'post.x'], match: { type: 'contains', value: 'bad' } }] }]
+      });
+      assert.strictEqual(engine.evaluate(createReq({ query: { x: 'bad' } })).blocked, true, 'matches via get');
+      assert.strictEqual(engine.evaluate(createReq({ query: {}, body: { x: 'bad' } })).blocked, true, 'matches via post');
+      assert.strictEqual(engine.evaluate(createReq({ query: { x: 'ok' } })).blocked, false, 'no match');
+    });
+
+  });
+
+  describe('fail open', () => {
+    // A rule whose evaluation throws (here: a getter that blows up).
+    const throwingRule = {
+      id: 'bad',
+      get rule_v2() {
+        throw new Error('boom');
+      }
+    };
+
+    it('skips a throwing rule, allows the request, and reports the error', () => {
+      const errors = [];
+      const engine = new RuleEngine({ firewall: [throwingRule], onError: (e) => errors.push(e) });
+
+      const result = engine.evaluate(createReq({ query: { x: '1' } }));
+
+      assert.strictEqual(result.blocked, false); // fail open — never throws, never blocks
+      assert.strictEqual(errors.length, 1);
+      assert.match(errors[0].message, /boom/);
+    });
+
+    it('a throwing rule does not shadow a later rule that matches', () => {
+      const good = {
+        id: 'good',
+        title: 'x',
+        rule_v2: [{ parameter: 'get.x', match: { type: 'isset' } }]
+      };
+      const engine = new RuleEngine({ firewall: [throwingRule, good], onError: () => {} });
+
+      const result = engine.evaluate(createReq({ query: { x: '1' } }));
+
+      assert.strictEqual(result.blocked, true);
+      assert.strictEqual(result.rule.id, 'good');
+    });
+
+    it('evaluate() never throws even without an onError handler', () => {
+      const engine = new RuleEngine({ firewall: [throwingRule] });
+      // Suppress the default console.error for this assertion.
+      const originalError = console.error;
+      console.error = () => {};
+      try {
+        assert.doesNotThrow(() => engine.evaluate(createReq()));
+      } finally {
+        console.error = originalError;
+      }
+    });
+  });
+
+  describe('inclusive (AND) logic', () => {
+
+    it('should require ALL inclusive conditions to match', () => {
+      const engine = new RuleEngine(fixtureRules);
+
+      // Rule 103 requires BOTH: post.action=delete_all_users AND REQUEST_METHOD=POST
+      const req = createReq({
+        method: 'POST',
+        body: { action: 'delete_all_users' }
+      });
+      const result = engine.evaluate(req);
+
+      assert.strictEqual(result.blocked, true);
+      assert.strictEqual(result.rule.id, 103);
+    });
+
+    it('should not block when only one inclusive condition matches', () => {
+      const engine = new RuleEngine({
+        firewall: [{
+          id: 200,
+          title: 'Test AND rule',
+          rule_v2: [
+            { parameter: 'post.action', match: { type: 'equals', value: 'delete_all' }, inclusive: true },
+            { parameter: 'post.confirm', match: { type: 'equals', value: 'yes' }, inclusive: true }
+          ]
+        }]
+      });
+
+      // Only action matches, confirm is missing
+      const req = createReq({
+        method: 'POST',
+        body: { action: 'delete_all' }
+      });
+      const result = engine.evaluate(req);
+
+      assert.strictEqual(result.blocked, false);
+    });
+
+    it('should block when all inclusive conditions match', () => {
+      const engine = new RuleEngine({
+        firewall: [{
+          id: 200,
+          title: 'Test AND rule',
+          rule_v2: [
+            { parameter: 'post.action', match: { type: 'equals', value: 'delete_all' }, inclusive: true },
+            { parameter: 'post.confirm', match: { type: 'equals', value: 'yes' }, inclusive: true }
+          ]
+        }]
+      });
+
+      const req = createReq({
+        method: 'POST',
+        body: { action: 'delete_all', confirm: 'yes' }
+      });
+      const result = engine.evaluate(req);
+
+      assert.strictEqual(result.blocked, true);
+    });
+
+  });
+
+  describe('whitelists', () => {
+
+    it('should not block whitelisted requests', () => {
+      const engine = new RuleEngine(fixtureRules);
+
+      // Rule 101 blocks SQL injection in search, but whitelist allows IP 10.0.0.1
+      const req = createReq({
+        query: { search: '1 UNION SELECT * FROM users' },
+        ip: '10.0.0.1'
+      });
+      const result = engine.evaluate(req);
+
+      assert.strictEqual(result.blocked, false);
+    });
+
+    it('should block non-whitelisted requests', () => {
+      const engine = new RuleEngine(fixtureRules);
+
+      const req = createReq({
+        query: { search: '1 UNION SELECT * FROM users' },
+        ip: '192.168.1.1'
+      });
+      const result = engine.evaluate(req);
+
+      assert.strictEqual(result.blocked, true);
+    });
+
+  });
+
+  describe('nested rules', () => {
+
+    it('should evaluate nested rule conditions', () => {
+      const engine = new RuleEngine({
+        firewall: [{
+          id: 300,
+          title: 'Nested rule test',
+          rule_v2: [
+            {
+              parameter: 'rules',
+              match: { type: 'equals', value: '' },
+              inclusive: false,
+              rules: [
+                {
+                  parameter: 'post.action',
+                  match: { type: 'equals', value: 'exploit' },
+                  inclusive: true
+                },
+                {
+                  parameter: 'post.target',
+                  match: { type: 'contains', value: 'admin' },
+                  inclusive: true
+                }
+              ]
+            }
+          ]
+        }]
+      });
+
+      const req = createReq({
+        method: 'POST',
+        body: { action: 'exploit', target: 'admin_panel' }
+      });
+      const result = engine.evaluate(req);
+
+      assert.strictEqual(result.blocked, true);
+    });
+
+  });
+
+  describe('URL-encoded bypass regression tests', () => {
+
+    it('should block URL-encoded SQL injection (normalization enforced)', () => {
+      const engine = new RuleEngine(fixtureRules);
+      // Without normalization, %20UNION%20SELECT bypasses the /union\s+select/i regex
+      const req = createReq({ query: { search: '1%20UNION%20SELECT%20*%20FROM%20users' } });
+      const result = engine.evaluate(req);
+
+      assert.strictEqual(result.blocked, true, 'URL-encoded SQLi should be caught after normalization');
+      assert.strictEqual(result.rule.id, 101);
+    });
+
+    it('should block double-encoded SQL injection', () => {
+      const engine = new RuleEngine(fixtureRules);
+      const req = createReq({ query: { search: '1%2520UNION%2520SELECT' } });
+      const result = engine.evaluate(req);
+
+      assert.strictEqual(result.blocked, true, 'Double-encoded SQLi should be caught');
+      assert.strictEqual(result.rule.id, 101);
+    });
+
+    it('should block URL-encoded XSS in comment field', () => {
+      const engine = new RuleEngine(fixtureRules);
+      // %3Cscript%3E decodes to <script>
+      const req = createReq({
+        method: 'POST',
+        body: { comment: '%3Cscript%3Ealert(1)%3C%2Fscript%3E' }
+      });
+      const result = engine.evaluate(req);
+
+      assert.strictEqual(result.blocked, true, 'URL-encoded XSS should be caught after normalization');
+      assert.strictEqual(result.rule.id, 102);
+    });
+
+  });
+
+  describe('Prototype pollution regression tests', () => {
+
+    it('should block prototype pollution in raw string body (regression)', () => {
+      const engine = new RuleEngine(fixtureRules);
+      const req = createReq({
+        body: '{"__proto__":{"admin":true}}'
+      });
+      const result = engine.evaluate(req);
+
+      assert.strictEqual(result.blocked, true, 'String body __proto__ should be detected');
+      assert.strictEqual(result.rule.id, 105);
+    });
+
+    it('should block prototype pollution in parsed object body with __proto__ as own property', () => {
+      const engine = new RuleEngine(fixtureRules);
+      const body = Object.create(null);
+      Object.defineProperty(body, '__proto__', {
+        value: { admin: true },
+        enumerable: true,
+        configurable: true,
+        writable: true
+      });
+      const req = createReq({ body });
+      const result = engine.evaluate(req);
+
+      assert.strictEqual(result.blocked, true, 'Parsed object __proto__ own property should be detected');
+      assert.strictEqual(result.rule.id, 105);
+    });
+
+  });
+
+});
diff --git a/tests/protect/fetch.test.ts b/tests/protect/fetch.test.ts
new file mode 100644
index 0000000..42ff596
--- /dev/null
+++ b/tests/protect/fetch.test.ts
@@ -0,0 +1,98 @@
+import { describe, it } from 'vitest';
+import assert from 'node:assert';
+import { createFetchMiddleware, wrapFetchHandler, fromFetchRequest } from '../../src/protect/engine/fetch.js';
+
+const rules = {
+  firewall: [
+    {
+      id: 1,
+      title: 'block path traversal',
+      rule_v2: [
+        {
+          parameter: 'get.file',
+          mutations: ['urldecode'],
+          match: { type: 'contains', value: '..' }
+        }
+      ]
+    }
+  ],
+  whitelists: [],
+  whitelist_keys: {}
+};
+
+describe('fetch adapter', () => {
+  it('fromFetchRequest parses query (repeats), headers, JSON body, ip, and verbatim _rawBody', async () => {
+    const req = await fromFetchRequest(
+      new Request('https://app.dev/api?q=1&q=2', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', 'x-forwarded-for': '1.2.3.4, 5.6.7.8' },
+        body: JSON.stringify({ a: 1 })
+      })
+    );
+    assert.deepStrictEqual(req.query.q, ['1', '2']);
+    assert.strictEqual(req.body.a, 1);
+    assert.strictEqual(req.ip, '1.2.3.4');
+    assert.strictEqual(req.headers['content-type'], 'application/json');
+    assert.strictEqual(req._rawBody, JSON.stringify({ a: 1 }));
+    assert.strictEqual(req.originalUrl, '/api?q=1&q=2');
+  });
+
+  it('guard blocks a malicious request with a 403 Response', async () => {
+    const guard = createFetchMiddleware(rules);
+    const res = await guard(new Request('https://app.dev/read?file=..%2f..%2fetc%2fpasswd'));
+    assert.ok(res instanceof Response);
+    assert.strictEqual(res.status, 403);
+    const body = await res.json();
+    assert.strictEqual(body.error, 'Blocked by Patchstack WAF');
+  });
+
+  it('guard returns null (allow) for a benign request', async () => {
+    const guard = createFetchMiddleware(rules);
+    const res = await guard(new Request('https://app.dev/read?file=notes.txt'));
+    assert.strictEqual(res, null);
+  });
+
+  it('wrapFetchHandler calls through on allow and short-circuits on block', async () => {
+    const handler = async () => new Response('ok', { status: 200 });
+    const wrapped = wrapFetchHandler(handler, rules);
+
+    const allowed = await wrapped(new Request('https://app.dev/read?file=ok.txt'));
+    assert.strictEqual(allowed.status, 200);
+    assert.strictEqual(await allowed.text(), 'ok');
+
+    const blocked = await wrapped(new Request('https://app.dev/read?file=../secret'));
+    assert.strictEqual(blocked.status, 403);
+  });
+
+  it('matches a __proto__ prototype-pollution payload via verbatim `raw` body', async () => {
+    const ppRules = {
+      firewall: [
+        {
+          id: 2,
+          title: 'prototype pollution',
+          rule_v2: [{ parameter: 'raw', match: { type: 'contains', value: '__proto__' } }]
+        }
+      ],
+      whitelists: [],
+      whitelist_keys: {}
+    };
+    const guard = createFetchMiddleware(ppRules);
+    const res = await guard(
+      new Request('https://app.dev/settings', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: '{"__proto__":{"polluted":"yes"}}'
+      })
+    );
+    assert.strictEqual(res?.status, 403, '__proto__ in the verbatim body should be caught');
+  });
+
+  it('fails open when a rule throws (never blocks on engine error)', async () => {
+    const badEngine = { evaluate() { throw new Error('boom'); } };
+    let captured = null;
+    const guard = createFetchMiddleware(badEngine, { onError: (e) => (captured = e) });
+    const res = await guard(new Request('https://app.dev/x'));
+    assert.strictEqual(res, null);
+    assert.ok(captured instanceof Error);
+  });
+});
diff --git a/tests/protect/fixtures/rules-response.json b/tests/protect/fixtures/rules-response.json
new file mode 100644
index 0000000..771107b
--- /dev/null
+++ b/tests/protect/fixtures/rules-response.json
@@ -0,0 +1,114 @@
+{
+  "firewall": [
+    {
+      "id": 101,
+      "title": "Block SQL Injection in search",
+      "rule_v2": [
+        {
+          "parameter": "get.search",
+          "match": { "type": "regex", "value": "/union\\s+select/i" },
+          "inclusive": false
+        }
+      ]
+    },
+    {
+      "id": 102,
+      "title": "Block XSS in comment field",
+      "rule_v2": [
+        {
+          "parameter": "post.comment",
+          "match": { "type": "regex", "value": "/<script[^>]*>/i" },
+          "inclusive": false
+        }
+      ]
+    },
+    {
+      "id": 103,
+      "title": "Block admin action exploitation",
+      "rule_v2": [
+        {
+          "parameter": "post.action",
+          "match": { "type": "equals", "value": "delete_all_users" },
+          "inclusive": true
+        },
+        {
+          "parameter": "server.REQUEST_METHOD",
+          "match": { "type": "equals", "value": "POST" },
+          "inclusive": true
+        }
+      ]
+    },
+    {
+      "id": 104,
+      "title": "Block path traversal",
+      "rule_v2": [
+        {
+          "parameter": "server.REQUEST_URI",
+          "match": { "type": "regex", "value": "/\\.\\.[\\/\\\\]/i" },
+          "inclusive": false
+        }
+      ]
+    },
+    {
+      "id": 105,
+      "title": "Block prototype pollution",
+      "rule_v2": [
+        {
+          "parameter": "raw",
+          "match": { "type": "contains", "value": "__proto__" },
+          "inclusive": false
+        }
+      ]
+    },
+    {
+      "id": 106,
+      "title": "Block SSRF to internal IPs",
+      "rule_v2": [
+        {
+          "parameter": "post.url",
+          "match": { "type": "regex", "value": "/(localhost|127\\.0\\.0\\.1|0\\.0\\.0\\.0|::1|10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)/i" },
+          "inclusive": false
+        }
+      ]
+    },
+    {
+      "id": 107,
+      "title": "Block base64-encoded payloads",
+      "rule_v2": [
+        {
+          "parameter": "post.data",
+          "match": { "type": "contains", "value": "<script>" },
+          "mutations": ["base64_decode"],
+          "inclusive": false
+        }
+      ]
+    },
+    {
+      "id": 108,
+      "title": "Block user agent bot",
+      "rule_v2": [
+        {
+          "parameter": "server.HTTP_USER_AGENT",
+          "match": { "type": "contains", "value": "sqlmap" },
+          "inclusive": false
+        }
+      ]
+    }
+  ],
+  "whitelists": [
+    {
+      "rule_id": 101,
+      "rule_v2": [
+        {
+          "parameter": "server.REMOTE_ADDR",
+          "match": { "type": "equals", "value": "10.0.0.1" },
+          "inclusive": false
+        }
+      ]
+    }
+  ],
+  "whitelist_keys": {
+    "POST": ["_token", "csrf"],
+    "GET": ["page", "limit"]
+  }
+}
diff --git a/tests/protect/middleware.test.ts b/tests/protect/middleware.test.ts
new file mode 100644
index 0000000..6e5123c
--- /dev/null
+++ b/tests/protect/middleware.test.ts
@@ -0,0 +1,297 @@
+import { describe, it, afterEach } from 'vitest';
+import assert from 'node:assert';
+import { readFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createMiddleware, createLogger, protect, protectSync } from '../../src/protect/engine/middleware.js';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const fixtureRules = JSON.parse(
+  await readFile(join(__dirname, 'fixtures', 'rules-response.json'), 'utf-8')
+);
+
+let originalFetch;
+
+function mockFetch(handler) {
+  originalFetch = globalThis.fetch;
+  globalThis.fetch = handler;
+}
+
+function restoreFetch() {
+  if (originalFetch) {
+    globalThis.fetch = originalFetch;
+    originalFetch = null;
+  }
+}
+
+function createReq(overrides = {}) {
+  return {
+    method: 'GET',
+    url: '/test',
+    originalUrl: '/test',
+    query: {},
+    body: {},
+    headers: {},
+    ...overrides
+  };
+}
+
+function createRes() {
+  let statusCode = 200;
+  let body = null;
+  let ended = false;
+  const res = {
+    get statusCode() { return statusCode; },
+    set statusCode(v) { statusCode = v; },
+    status(code) { statusCode = code; return res; },
+    json(data) { body = data; return res; },
+    end(...args) { ended = true; },
+    _getBody() { return body; },
+    _isEnded() { return ended; }
+  };
+  return res;
+}
+
+describe('Middleware', () => {
+
+  afterEach(() => {
+    restoreFetch();
+  });
+
+  describe('createMiddleware()', () => {
+
+    it('should pass clean requests through', () => {
+      const mw = createMiddleware(fixtureRules);
+      const req = createReq({ query: { search: 'hello' } });
+      const res = createRes();
+      let nextCalled = false;
+
+      mw(req, res, () => { nextCalled = true; });
+
+      assert.ok(nextCalled);
+    });
+
+    it('should block malicious requests', () => {
+      const mw = createMiddleware(fixtureRules);
+      const req = createReq({ query: { search: '1 UNION SELECT *' } });
+      const res = createRes();
+      let nextCalled = false;
+
+      mw(req, res, () => { nextCalled = true; });
+
+      assert.ok(!nextCalled);
+      assert.strictEqual(res.statusCode, 403);
+    });
+
+    it('should call onBlock callback', () => {
+      let blockEvent = null;
+      const mw = createMiddleware(fixtureRules, {
+        onBlock: (event) => { blockEvent = event; }
+      });
+      const req = createReq({ query: { search: '1 UNION SELECT *' } });
+      const res = createRes();
+
+      mw(req, res, () => {});
+
+      assert.ok(blockEvent);
+      assert.ok(blockEvent.rule);
+      assert.ok(blockEvent.request);
+    });
+
+    it('should expose engine on middleware', () => {
+      const mw = createMiddleware(fixtureRules);
+      assert.ok(mw.engine);
+    });
+
+  });
+
+  describe('createLogger()', () => {
+
+    it('should track request events', () => {
+      const logger = createLogger();
+      const req = createReq();
+      const res = createRes();
+
+      logger.middleware(req, res, () => {});
+      res.end();
+
+      const events = logger.getEvents();
+      assert.strictEqual(events.length, 1);
+      assert.strictEqual(events[0].method, 'GET');
+      assert.strictEqual(events[0].blocked, false);
+    });
+
+    it('should track blocked requests', () => {
+      const logger = createLogger();
+      const req = createReq();
+      const res = createRes();
+
+      logger.middleware(req, res, () => {});
+      res.statusCode = 403;
+      res.end();
+
+      const stats = logger.getStats();
+      assert.strictEqual(stats.total, 1);
+      assert.strictEqual(stats.blocked, 1);
+      assert.strictEqual(stats.allowed, 0);
+    });
+
+    it('should track stats correctly', () => {
+      const logger = createLogger();
+
+      for (let i = 0; i < 3; i++) {
+        const req = createReq();
+        const res = createRes();
+        logger.middleware(req, res, () => {});
+        res.end();
+      }
+
+      const stats = logger.getStats();
+      assert.strictEqual(stats.total, 3);
+      assert.strictEqual(stats.allowed, 3);
+    });
+
+  });
+
+  describe('protect()', () => {
+
+    it('should return pass-through middleware when no token', async () => {
+      const origToken = process.env.PATCHSTACK_WAF_TOKEN;
+      delete process.env.PATCHSTACK_WAF_TOKEN;
+
+      try {
+        const mw = await protect();
+        const req = createReq();
+        const res = createRes();
+        let nextCalled = false;
+
+        mw(req, res, () => { nextCalled = true; });
+        assert.ok(nextCalled, 'Should pass through when no token');
+      } finally {
+        if (origToken) {
+          process.env.PATCHSTACK_WAF_TOKEN = origToken;
+        }
+      }
+    });
+
+    it('should fetch rules and create middleware', async () => {
+      mockFetch(async () => ({
+        ok: true,
+        json: async () => fixtureRules
+      }));
+
+      const mw = await protect({ token: 'test-token' });
+
+      assert.ok(mw.rules, 'Should have rules attached');
+      assert.ok(mw.getStats, 'Should have getStats (logging enabled by default)');
+      assert.ok(mw.getEvents, 'Should have getEvents');
+    });
+
+    it('should block requests with fetched rules', async () => {
+      mockFetch(async () => ({
+        ok: true,
+        json: async () => fixtureRules
+      }));
+
+      const mw = await protect({ token: 'test-token', logging: false });
+      const req = createReq({ query: { search: '1 UNION SELECT *' } });
+      const res = createRes();
+      let nextCalled = false;
+
+      mw(req, res, () => { nextCalled = true; });
+
+      assert.ok(!nextCalled);
+      assert.strictEqual(res.statusCode, 403);
+    });
+
+    it('should fail open on API error', async () => {
+      mockFetch(async () => ({
+        ok: false,
+        status: 500,
+        statusText: 'Internal Server Error'
+      }));
+
+      const mw = await protect({ token: 'test-token' });
+      const req = createReq({ query: { search: '1 UNION SELECT *' } });
+      const res = createRes();
+      let nextCalled = false;
+
+      mw(req, res, () => { nextCalled = true; });
+
+      assert.ok(nextCalled, 'Should pass through on API failure (fail-open)');
+    });
+
+    it('should fail open on network error', async () => {
+      mockFetch(async () => {
+        throw new Error('Network unreachable');
+      });
+
+      const mw = await protect({ token: 'test-token' });
+      let nextCalled = false;
+
+      mw(createReq(), createRes(), () => { nextCalled = true; });
+
+      assert.ok(nextCalled, 'Should pass through on network error');
+    });
+
+    it('should call onScan callback', async () => {
+      mockFetch(async () => ({
+        ok: true,
+        json: async () => fixtureRules
+      }));
+
+      let scanData = null;
+      await protect({
+        token: 'test-token',
+        onScan: (data) => { scanData = data; }
+      });
+
+      assert.ok(scanData, 'onScan should have been called');
+      assert.ok(Array.isArray(scanData.firewall));
+    });
+
+  });
+
+  describe('protectSync()', () => {
+
+    it('should return middleware immediately', () => {
+      const mw = protectSync({ token: 'test-token' });
+      assert.strictEqual(typeof mw, 'function');
+    });
+
+    it('should lazy-initialize on first request', async () => {
+      mockFetch(async () => ({
+        ok: true,
+        json: async () => fixtureRules
+      }));
+
+      const mw = protectSync({ token: 'test-token' });
+      const req = createReq();
+      const res = createRes();
+
+      await new Promise((resolve) => {
+        mw(req, res, resolve);
+      });
+    });
+
+    it('should fail open on init error', async () => {
+      mockFetch(async () => {
+        throw new Error('Connection refused');
+      });
+
+      const mw = protectSync({ token: 'test-token' });
+      let nextCalled = false;
+
+      await new Promise((resolve) => {
+        mw(createReq(), createRes(), () => {
+          nextCalled = true;
+          resolve();
+        });
+      });
+
+      assert.ok(nextCalled, 'Should pass through on init failure');
+    });
+
+  });
+
+});
diff --git a/tests/protect/node.test.ts b/tests/protect/node.test.ts
new file mode 100644
index 0000000..a779279
--- /dev/null
+++ b/tests/protect/node.test.ts
@@ -0,0 +1,118 @@
+import { describe, it } from 'vitest';
+import assert from 'node:assert';
+import { Readable } from 'node:stream';
+import { createNodeMiddleware, fromNodeRequest } from '../../src/protect/engine/node.js';
+
+const rules = {
+  firewall: [
+    {
+      id: 1,
+      title: 'block path traversal',
+      rule_v2: [
+        {
+          parameter: 'get.file',
+          mutations: ['urldecode'],
+          match: { type: 'contains', value: '..' }
+        }
+      ]
+    }
+  ],
+  whitelists: [],
+  whitelist_keys: {}
+};
+
+// Minimal IncomingMessage-like stream + a mock ServerResponse.
+function mockReq({ method = 'GET', url = '/', headers = {}, body = '' }) {
+  const req = Readable.from(body ? [Buffer.from(body)] : []);
+  req.method = method;
+  req.url = url;
+  req.headers = headers;
+  req.socket = { remoteAddress: '9.9.9.9' };
+  return req;
+}
+
+function mockRes() {
+  return {
+    statusCode: 200,
+    headers: {},
+    body: '',
+    ended: false,
+    setHeader(k, v) {
+      this.headers[k.toLowerCase()] = v;
+    },
+    end(chunk) {
+      this.body = chunk || '';
+      this.ended = true;
+    }
+  };
+}
+
+// Run the middleware and resolve with { res, nextCalled, nextErr }.
+function run(mw, req, res) {
+  return new Promise((resolve) => {
+    const originalEnd = res.end.bind(res);
+    res.end = (chunk) => {
+      originalEnd(chunk);
+      resolve({ res, nextCalled: false });
+    };
+    mw(req, res, (err) => resolve({ res, nextCalled: true, nextErr: err }));
+  });
+}
+
+describe('node adapter', () => {
+  it('fromNodeRequest parses query, JSON body, ip, and verbatim _rawBody', () => {
+    const shaped = fromNodeRequest(
+      { method: 'POST', url: '/api?q=1&q=2', headers: { 'content-type': 'application/json', host: 'x' }, socket: {} },
+      JSON.stringify({ a: 1 })
+    );
+    assert.deepStrictEqual(shaped.query.q, ['1', '2']);
+    assert.strictEqual(shaped.body.a, 1);
+    assert.strictEqual(shaped._rawBody, JSON.stringify({ a: 1 }));
+    assert.strictEqual(shaped.originalUrl, '/api?q=1&q=2');
+  });
+
+  it('blocks a malicious request with a 403', async () => {
+    const mw = createNodeMiddleware(rules);
+    const { res, nextCalled } = await run(mw, mockReq({ url: '/read?file=..%2f..%2fetc' }), mockRes());
+    assert.strictEqual(nextCalled, false);
+    assert.strictEqual(res.statusCode, 403);
+    assert.strictEqual(JSON.parse(res.body).error, 'Blocked by Patchstack WAF');
+  });
+
+  it('calls next() and sets req.body for a benign request', async () => {
+    const mw = createNodeMiddleware(rules);
+    const req = mockReq({
+      method: 'POST',
+      url: '/save',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ title: 'hi' })
+    });
+    const { nextCalled, nextErr } = await run(mw, req, mockRes());
+    assert.strictEqual(nextCalled, true);
+    assert.strictEqual(nextErr, undefined);
+    assert.deepStrictEqual(req.body, { title: 'hi' });
+  });
+
+  it('fails open (calls next) when the engine throws', async () => {
+    let captured = null;
+    const mw = createNodeMiddleware(
+      { evaluate() { throw new Error('boom'); } },
+      { onError: (e) => (captured = e) }
+    );
+    const { nextCalled } = await run(mw, mockReq({ url: '/x' }), mockRes());
+    assert.strictEqual(nextCalled, true);
+    assert.ok(captured instanceof Error);
+  });
+
+  it('skips inspecting an oversized body (fail open) rather than buffering unbounded', async () => {
+    const mw = createNodeMiddleware(rules, { maxBodyBytes: 8 });
+    const req = mockReq({
+      method: 'POST',
+      url: '/save',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ big: 'x'.repeat(1000) })
+    });
+    const { nextCalled } = await run(mw, req, mockRes());
+    assert.strictEqual(nextCalled, true); // not blocked; body skipped
+  });
+});
diff --git a/tests/protect/normalizer.test.ts b/tests/protect/normalizer.test.ts
new file mode 100644
index 0000000..446404f
--- /dev/null
+++ b/tests/protect/normalizer.test.ts
@@ -0,0 +1,469 @@
+import { describe, it } from 'vitest';
+import assert from 'node:assert';
+import {
+    normalize,
+    urlDecode,
+    htmlEntityDecode,
+    removeSqlComments,
+    removeNullBytes,
+    normalizeWhitespace,
+    normalizeRequest,
+    normalizeObject,
+    createMatchVariants,
+    _testExports
+} from '../../src/protect/engine/normalizer.js';
+
+describe('Normalizer Module', () => {
+
+    describe('urlDecode', () => {
+
+        it('should decode basic URL-encoded characters', () => {
+            const result = urlDecode('hello%20world');
+            assert.strictEqual(result, 'hello world');
+        });
+
+        it('should decode SQL injection payloads', () => {
+            const result = urlDecode('1%20UNION%20SELECT%20*%20FROM%20users');
+            assert.strictEqual(result, '1 UNION SELECT * FROM users');
+        });
+
+        it('should handle double encoding', () => {
+            const result = urlDecode('%2520');
+            assert.strictEqual(result, ' ');
+        });
+
+        it('should decode special characters', () => {
+            const result = urlDecode('%3C%3E%22%27');
+            assert.strictEqual(result, '<>"\'');
+        });
+
+        it('should handle already decoded strings', () => {
+            const result = urlDecode('hello world');
+            assert.strictEqual(result, 'hello world');
+        });
+
+        it('should handle malformed sequences gracefully', () => {
+            const result = urlDecode('hello%GGworld%20test');
+            assert.ok(result.includes('hello'));
+            assert.ok(result.includes('test'));
+        });
+
+        it('should limit decode iterations to prevent infinite loops', () => {
+            const result = urlDecode('%252525252520');
+            assert.ok(typeof result === 'string');
+        });
+
+        it('should return non-strings unchanged', () => {
+            assert.strictEqual(urlDecode(123), 123);
+            assert.strictEqual(urlDecode(null), null);
+            assert.deepStrictEqual(urlDecode({ a: 1 }), { a: 1 });
+        });
+
+    });
+
+    describe('htmlEntityDecode', () => {
+
+        it('should decode named HTML entities', () => {
+            assert.strictEqual(htmlEntityDecode('&lt;script&gt;'), '<script>');
+            assert.strictEqual(htmlEntityDecode('&amp;'), '&');
+            assert.strictEqual(htmlEntityDecode('&quot;'), '"');
+        });
+
+        it('should decode decimal numeric entities', () => {
+            assert.strictEqual(htmlEntityDecode('&#60;'), '<');
+            assert.strictEqual(htmlEntityDecode('&#62;'), '>');
+            assert.strictEqual(htmlEntityDecode('&#38;'), '&');
+        });
+
+        it('should decode hexadecimal numeric entities', () => {
+            assert.strictEqual(htmlEntityDecode('&#x3C;'), '<');
+            assert.strictEqual(htmlEntityDecode('&#x3E;'), '>');
+            assert.strictEqual(htmlEntityDecode('&#x27;'), "'");
+        });
+
+        it('should handle mixed content', () => {
+            const result = htmlEntityDecode('&lt;img src=&quot;x&quot; onerror=&quot;alert(1)&quot;&gt;');
+            assert.strictEqual(result, '<img src="x" onerror="alert(1)">');
+        });
+
+        it('should return non-strings unchanged', () => {
+            assert.strictEqual(htmlEntityDecode(123), 123);
+            assert.strictEqual(htmlEntityDecode(null), null);
+        });
+
+    });
+
+    describe('removeSqlComments', () => {
+
+        it('should remove /* */ style comments', () => {
+            const result = removeSqlComments('SELECT/*comment*/FROM users');
+            assert.strictEqual(result, 'SELECT FROM users');
+        });
+
+        it('should remove /**/ style comments used for bypass', () => {
+            const result = removeSqlComments('1/**/UNION/**/SELECT');
+            assert.strictEqual(result, '1 UNION SELECT');
+        });
+
+        it('should remove -- style comments', () => {
+            const result = removeSqlComments("SELECT * FROM users--comment\nWHERE id=1");
+            assert.ok(result.includes('SELECT * FROM users'));
+            assert.ok(!result.includes('comment'));
+        });
+
+        it('should remove # style comments (MySQL)', () => {
+            const result = removeSqlComments("SELECT * FROM users#comment\nWHERE id=1");
+            assert.ok(result.includes('SELECT * FROM users'));
+            assert.ok(!result.includes('comment'));
+        });
+
+        it('should handle MySQL /*!...*/ comments', () => {
+            const result = removeSqlComments('SELECT /*!50000 1*/');
+            assert.strictEqual(result.trim(), 'SELECT');
+        });
+
+        it('should handle multiple comments', () => {
+            const result = removeSqlComments('/*a*/SELECT/*b*/FROM/*c*/');
+            assert.strictEqual(result.trim(), 'SELECT FROM');
+        });
+
+        it('should return non-strings unchanged', () => {
+            assert.strictEqual(removeSqlComments(123), 123);
+            assert.strictEqual(removeSqlComments(null), null);
+        });
+
+    });
+
+    describe('removeNullBytes', () => {
+
+        it('should remove null bytes', () => {
+            const result = removeNullBytes('hello\x00world');
+            assert.strictEqual(result, 'helloworld');
+        });
+
+        it('should remove other control characters', () => {
+            const result = removeNullBytes('hello\x01\x02world');
+            assert.strictEqual(result, 'helloworld');
+        });
+
+        it('should preserve tabs and newlines', () => {
+            const result = removeNullBytes('hello\tworld\n');
+            assert.strictEqual(result, 'hello\tworld\n');
+        });
+
+        it('should return non-strings unchanged', () => {
+            assert.strictEqual(removeNullBytes(123), 123);
+            assert.strictEqual(removeNullBytes(null), null);
+        });
+
+    });
+
+    describe('normalizeWhitespace', () => {
+
+        it('should collapse multiple spaces', () => {
+            const result = normalizeWhitespace('hello    world');
+            assert.strictEqual(result, 'hello world');
+        });
+
+        it('should replace tabs with spaces', () => {
+            const result = normalizeWhitespace('hello\tworld');
+            assert.strictEqual(result, 'hello world');
+        });
+
+        it('should replace newlines with spaces', () => {
+            const result = normalizeWhitespace('hello\nworld');
+            assert.strictEqual(result, 'hello world');
+        });
+
+        it('should handle mixed whitespace', () => {
+            const result = normalizeWhitespace('hello\t\n\r  world');
+            assert.strictEqual(result, 'hello world');
+        });
+
+        it('should return non-strings unchanged', () => {
+            assert.strictEqual(normalizeWhitespace(123), 123);
+            assert.strictEqual(normalizeWhitespace(null), null);
+        });
+
+    });
+
+    describe('normalize (full pipeline)', () => {
+
+        it('should apply all normalizations by default', () => {
+            const input = 'hello%20world\x00/*comment*/';
+            const result = normalize(input);
+            assert.ok(!result.includes('%20'));
+            assert.ok(!result.includes('\x00'));
+            assert.ok(!result.includes('comment'));
+        });
+
+        it('should decode URL-encoded SQL injection', () => {
+            const result = normalize('1%20UNION%20SELECT%20*%20FROM%20users');
+            assert.strictEqual(result, '1 UNION SELECT * FROM users');
+        });
+
+        it('should handle combined encoding bypass attempts', () => {
+            const result = normalize('1%2F%2A%2A%2FUNION%2F%2A%2A%2FSELECT');
+            assert.ok(result.includes('UNION'));
+            assert.ok(result.includes('SELECT'));
+        });
+
+        it('should allow selective normalization', () => {
+            const input = 'hello%20world/*comment*/';
+
+            const withoutSql = normalize(input, { sqlComments: false });
+            assert.ok(withoutSql.includes('/*comment*/'));
+
+            const withoutUrl = normalize(input, { urlDecode: false });
+            assert.ok(withoutUrl.includes('%20'));
+        });
+
+        it('should handle XSS payload normalization', () => {
+            const result = normalize('&lt;script&gt;alert%28%27xss%27%29&lt;/script&gt;');
+            assert.ok(result.includes('<script>'));
+            assert.ok(result.includes('alert'));
+        });
+
+    });
+
+    describe('normalizeObject', () => {
+
+        it('should normalize string values', () => {
+            const result = normalizeObject('hello%20world');
+            assert.strictEqual(result, 'hello world');
+        });
+
+        it('should recursively normalize object properties', () => {
+            const result = normalizeObject({
+                name: 'hello%20world',
+                nested: { value: '%3Cscript%3E' }
+            });
+            assert.strictEqual(result.name, 'hello world');
+            assert.strictEqual(result.nested.value, '<script>');
+        });
+
+        it('should normalize arrays', () => {
+            const result = normalizeObject(['hello%20', 'world%21']);
+            assert.deepStrictEqual(result, ['hello ', 'world!']);
+        });
+
+        it('should pass through non-string primitives', () => {
+            const result = normalizeObject({ num: 123, bool: true, nil: null });
+            assert.strictEqual(result.num, 123);
+            assert.strictEqual(result.bool, true);
+            assert.strictEqual(result.nil, null);
+        });
+
+    });
+
+    describe('normalizeRequest', () => {
+
+        it('should normalize all request components', () => {
+            const req = {
+                query: { search: 'hello%20world' },
+                body: { data: '%3Cscript%3E' },
+                headers: { 'x-custom': 'test%20header' },
+                url: '/api?q=hello%20world'
+            };
+
+            const result = normalizeRequest(req);
+            assert.strictEqual(result.query.search, 'hello world');
+            assert.strictEqual(result.body.data, '<script>');
+            assert.strictEqual(result.headers['x-custom'], 'test header');
+            assert.ok(result.url.includes('hello world'));
+        });
+
+        it('should handle missing request properties', () => {
+            const result = normalizeRequest({});
+            assert.deepStrictEqual(result.query, {});
+            assert.deepStrictEqual(result.body, {});
+            assert.deepStrictEqual(result.headers, {});
+        });
+
+        it('should set _rawBody to original string body before normalization', () => {
+            const req = {
+                body: '{"__proto__":{"admin":true}}'
+            };
+            const result = normalizeRequest(req);
+            assert.strictEqual(result._rawBody, '{"__proto__":{"admin":true}}');
+        });
+
+        it('should set _rawBody from object body using getOwnPropertyNames serialization', () => {
+            const obj = {};
+            Object.defineProperty(obj, '__proto__', {
+                value: { admin: true },
+                enumerable: true,
+                configurable: true,
+                writable: true
+            });
+            const result = normalizeRequest({ body: obj });
+            assert.ok(typeof result._rawBody === 'string');
+            assert.ok(result._rawBody.includes('__proto__'), `Expected __proto__ in _rawBody: ${result._rawBody}`);
+        });
+
+        it('should set _rawBody to empty string when body is missing', () => {
+            const result = normalizeRequest({});
+            assert.strictEqual(result._rawBody, '');
+        });
+
+        it('should still normalize query, body, headers, url, originalUrl', () => {
+            const req = {
+                query: { q: 'hello%20world' },
+                body: '{"data":"%3Cscript%3E"}',
+                headers: { 'x-test': 'val%21' },
+                url: '/path?q=hello%20world'
+            };
+            const result = normalizeRequest(req);
+            assert.strictEqual(result.query.q, 'hello world');
+            assert.ok(result.body.includes('<script>'), 'normalized body should contain decoded <script>');
+            assert.ok(!result.body.includes('%3C'), 'normalized body should not contain URL-encoded %3C');
+            assert.strictEqual(result.headers['x-test'], 'val!');
+            assert.ok(result.url.includes('hello world'));
+        });
+
+        it('should preserve original URL-encoded string in _rawBody (not normalized)', () => {
+            // URL-encoded {"__proto__":{"admin":true}} — _rawBody should keep the raw form
+            const raw = '%7B%22__proto__%22%3A%7B%22admin%22%3Atrue%7D%7D';
+            const result = normalizeRequest({ body: raw });
+            // _rawBody must be the original (un-decoded) string, not the normalized version
+            assert.strictEqual(result._rawBody, raw, '_rawBody should preserve original encoded string');
+            // body itself gets normalized (URL-decoded)
+            assert.ok(result.body.includes('__proto__'), 'normalized body should contain __proto__');
+            assert.ok(!result.body.includes('%7B'), 'normalized body should be URL-decoded');
+        });
+
+    });
+
+    describe('createMatchVariants', () => {
+
+        it('should return original value', () => {
+            const variants = createMatchVariants('hello');
+            assert.ok(variants.includes('hello'));
+        });
+
+        it('should include URL decoded variant', () => {
+            const variants = createMatchVariants('hello%20world');
+            assert.ok(variants.includes('hello world'));
+        });
+
+        it('should include lowercase variants', () => {
+            const variants = createMatchVariants('HELLO');
+            assert.ok(variants.includes('hello'));
+        });
+
+        it('should not create duplicates', () => {
+            const variants = createMatchVariants('hello');
+            const unique = new Set(variants);
+            assert.strictEqual(variants.length, unique.size);
+        });
+
+        it('should return single-element array for non-strings', () => {
+            const variants = createMatchVariants(123);
+            assert.deepStrictEqual(variants, [123]);
+        });
+
+    });
+
+    describe('Bypass Prevention Tests', () => {
+
+        it('should detect URL-encoded SQL injection', () => {
+            const payload = '1%20UNION%20SELECT%20*%20FROM%20users';
+            const normalized = normalize(payload);
+            assert.ok(/UNION\s+SELECT/i.test(normalized));
+        });
+
+        it('should detect double-encoded SQL injection', () => {
+            const payload = '1%2520UNION%2520SELECT';
+            const normalized = normalize(payload);
+            assert.ok(normalized.includes('UNION'));
+        });
+
+        it('should detect SQL injection with comments', () => {
+            const payload = '1/**/UNION/**/SELECT';
+            const normalized = normalize(payload);
+            assert.ok(/UNION\s+SELECT/i.test(normalized));
+        });
+
+        it('should detect XSS with HTML entities', () => {
+            const payload = '&lt;script&gt;alert(1)&lt;/script&gt;';
+            const normalized = normalize(payload);
+            assert.ok(/<script>/i.test(normalized));
+        });
+
+        it('should detect null byte injection attempts', () => {
+            const payload = 'test\x00.jpg';
+            const normalized = normalize(payload);
+            assert.strictEqual(normalized, 'test.jpg');
+        });
+
+        it('should handle combined obfuscation techniques', () => {
+            const payload = '%3Cscript%3E/*comment*/alert%28%27xss%27%29%3C/script%3E';
+            const normalized = normalize(payload);
+            assert.ok(normalized.includes('<script>'));
+            assert.ok(normalized.includes('alert'));
+            assert.ok(!normalized.includes('%3C'));
+        });
+
+    });
+
+    describe('serializeForRawDetection', () => {
+
+        it('should return string bodies unchanged', () => {
+            const { serializeForRawDetection } = _testExports;
+            assert.strictEqual(serializeForRawDetection('{"__proto__":{"admin":true}}'), '{"__proto__":{"admin":true}}');
+        });
+
+        it('should return empty string for null/undefined', () => {
+            const { serializeForRawDetection } = _testExports;
+            assert.strictEqual(serializeForRawDetection(null), '');
+            assert.strictEqual(serializeForRawDetection(undefined), '');
+        });
+
+        it('should serialize plain objects including own properties', () => {
+            const { serializeForRawDetection } = _testExports;
+            const obj = { a: 1, b: 'hello' };
+            const result = serializeForRawDetection(obj);
+            assert.ok(result.includes('"a"'));
+            assert.ok(result.includes('"b"'));
+        });
+
+        it('should detect __proto__ defined as own property via Object.defineProperty', () => {
+            const { serializeForRawDetection } = _testExports;
+            const obj = Object.create(null);
+            Object.defineProperty(obj, '__proto__', {
+                value: { admin: true },
+                enumerable: true,
+                configurable: true,
+                writable: true
+            });
+            const result = serializeForRawDetection(obj);
+            assert.ok(result.includes('__proto__'), `Expected __proto__ in: ${result}`);
+        });
+
+        it('should handle nested objects', () => {
+            const { serializeForRawDetection } = _testExports;
+            const obj = { outer: { inner: 'value' } };
+            const result = serializeForRawDetection(obj);
+            assert.ok(result.includes('"inner"'));
+            assert.ok(result.includes('"value"'));
+        });
+
+        it('should handle arrays', () => {
+            const { serializeForRawDetection } = _testExports;
+            const result = serializeForRawDetection([1, 'two', { three: 3 }]);
+            assert.ok(result.includes('"three"'));
+        });
+
+        it('should handle circular references without throwing', () => {
+            const { serializeForRawDetection } = _testExports;
+            const obj = { a: 1 };
+            obj.self = obj;
+            let result;
+            assert.doesNotThrow(() => { result = serializeForRawDetection(obj); });
+            assert.ok(typeof result === 'string', 'result should be a string');
+            assert.ok(result.includes('Circular'), `Expected Circular marker in: ${result}`);
+        });
+
+    });
+
+});
diff --git a/tests/protect/request.test.ts b/tests/protect/request.test.ts
new file mode 100644
index 0000000..03c343a
--- /dev/null
+++ b/tests/protect/request.test.ts
@@ -0,0 +1,327 @@
+import { describe, it } from 'vitest';
+import assert from 'node:assert';
+import { RequestResolver } from '../../src/protect/engine/request.js';
+
+function createReq(overrides = {}) {
+  return {
+    method: 'GET',
+    url: '/test?q=hello',
+    originalUrl: '/test?q=hello',
+    query: { q: 'hello' },
+    body: {},
+    headers: { 'user-agent': 'TestBot/1.0', cookie: 'session=abc123; lang=en' },
+    ...overrides
+  };
+}
+
+describe('RequestResolver', () => {
+
+  describe('resolve get.*', () => {
+
+    it('should resolve query parameters', () => {
+      const resolver = new RequestResolver(createReq({ query: { name: 'test' } }));
+      assert.deepStrictEqual(resolver.resolve('get.name'), ['test']);
+    });
+
+    it('should return empty for missing query params', () => {
+      const resolver = new RequestResolver(createReq());
+      assert.deepStrictEqual(resolver.resolve('get.missing'), []);
+    });
+
+    it('should resolve wildcard query params', () => {
+      const resolver = new RequestResolver(createReq({
+        query: { field_name: 'a', field_email: 'b', other: 'c' }
+      }));
+      const values = resolver.resolve('get.field_*');
+      assert.strictEqual(values.length, 2);
+      assert.ok(values.includes('a'));
+      assert.ok(values.includes('b'));
+    });
+
+  });
+
+  describe('resolve post.*', () => {
+
+    it('should resolve body parameters', () => {
+      const resolver = new RequestResolver(createReq({ body: { action: 'save' } }));
+      assert.deepStrictEqual(resolver.resolve('post.action'), ['save']);
+    });
+
+    it('should resolve nested body values', () => {
+      const resolver = new RequestResolver(createReq({
+        body: { user: { name: 'test' } }
+      }));
+      assert.deepStrictEqual(resolver.resolve('post.user.name'), ['test']);
+    });
+
+    it('should return empty for missing body params', () => {
+      const resolver = new RequestResolver(createReq());
+      assert.deepStrictEqual(resolver.resolve('post.missing'), []);
+    });
+
+  });
+
+  describe('resolve request.*', () => {
+
+    it('should check query first', () => {
+      const resolver = new RequestResolver(createReq({
+        query: { key: 'from-query' },
+        body: { key: 'from-body' }
+      }));
+      assert.deepStrictEqual(resolver.resolve('request.key'), ['from-query']);
+    });
+
+    it('should fall back to body', () => {
+      const resolver = new RequestResolver(createReq({
+        query: {},
+        body: { key: 'from-body' }
+      }));
+      assert.deepStrictEqual(resolver.resolve('request.key'), ['from-body']);
+    });
+
+    it('should fall back to cookies', () => {
+      const resolver = new RequestResolver(createReq({
+        query: {},
+        body: {},
+        headers: { cookie: 'key=from-cookie' }
+      }));
+      assert.deepStrictEqual(resolver.resolve('request.key'), ['from-cookie']);
+    });
+
+  });
+
+  describe('resolve cookie.*', () => {
+
+    it('should parse cookies from header', () => {
+      const resolver = new RequestResolver(createReq());
+      assert.deepStrictEqual(resolver.resolve('cookie.session'), ['abc123']);
+      assert.deepStrictEqual(resolver.resolve('cookie.lang'), ['en']);
+    });
+
+    it('should use req.cookies if available', () => {
+      const resolver = new RequestResolver(createReq({
+        cookies: { session: 'pre-parsed' },
+        headers: {}
+      }));
+      assert.deepStrictEqual(resolver.resolve('cookie.session'), ['pre-parsed']);
+    });
+
+    it('should return empty for missing cookies', () => {
+      const resolver = new RequestResolver(createReq({ headers: {} }));
+      assert.deepStrictEqual(resolver.resolve('cookie.missing'), []);
+    });
+
+  });
+
+  describe('resolve server.*', () => {
+
+    it('should resolve REQUEST_URI', () => {
+      const resolver = new RequestResolver(createReq());
+      assert.deepStrictEqual(resolver.resolve('server.REQUEST_URI'), ['/test?q=hello']);
+    });
+
+    it('should resolve REQUEST_METHOD', () => {
+      const resolver = new RequestResolver(createReq({ method: 'POST' }));
+      assert.deepStrictEqual(resolver.resolve('server.REQUEST_METHOD'), ['POST']);
+    });
+
+    it('should resolve HTTP_USER_AGENT', () => {
+      const resolver = new RequestResolver(createReq());
+      assert.deepStrictEqual(resolver.resolve('server.HTTP_USER_AGENT'), ['TestBot/1.0']);
+    });
+
+    it('should resolve arbitrary HTTP_ headers', () => {
+      const resolver = new RequestResolver(createReq({
+        headers: { 'x-forwarded-for': '1.2.3.4' }
+      }));
+      assert.deepStrictEqual(resolver.resolve('server.HTTP_X_FORWARDED_FOR'), ['1.2.3.4']);
+    });
+
+    it('should resolve REMOTE_ADDR from ip', () => {
+      const resolver = new RequestResolver(createReq({ ip: '10.0.0.1' }));
+      assert.deepStrictEqual(resolver.resolve('server.REMOTE_ADDR'), ['10.0.0.1']);
+    });
+
+  });
+
+  describe('resolve raw', () => {
+
+    it('should return string body as-is', () => {
+      const resolver = new RequestResolver(createReq({ body: '{"key":"value"}' }));
+      assert.deepStrictEqual(resolver.resolve('raw'), ['{"key":"value"}']);
+    });
+
+    it('should JSON-stringify object body', () => {
+      const resolver = new RequestResolver(createReq({ body: { key: 'value' } }));
+      const values = resolver.resolve('raw');
+      assert.strictEqual(values.length, 1);
+      assert.strictEqual(JSON.parse(values[0]).key, 'value');
+    });
+
+    it('should return empty for null body', () => {
+      const resolver = new RequestResolver(createReq({ body: null }));
+      assert.deepStrictEqual(resolver.resolve('raw'), []);
+    });
+
+  });
+
+  describe('resolve all', () => {
+
+    it('should combine url, query, body, headers, and cookies', () => {
+      const resolver = new RequestResolver(createReq({
+        body: { payload: 'test' },
+        headers: { 'user-agent': 'TestBot', cookie: 'session=abc' }
+      }));
+      const values = resolver.resolve('all');
+      assert.strictEqual(values.length, 1);
+      assert.ok(values[0].includes('/test?q=hello'));
+      assert.ok(values[0].includes('payload'));
+      assert.ok(values[0].includes('user-agent'));
+      assert.ok(values[0].includes('session=abc'));
+    });
+
+  });
+
+  describe('resolve special', () => {
+
+    it('should return [null] for rules parameter', () => {
+      const resolver = new RequestResolver(createReq());
+      assert.deepStrictEqual(resolver.resolve('rules'), [null]);
+    });
+
+    it('should return [null] for false parameter', () => {
+      const resolver = new RequestResolver(createReq());
+      assert.deepStrictEqual(resolver.resolve('false'), [null]);
+    });
+
+    it('should return empty for unknown source', () => {
+      const resolver = new RequestResolver(createReq());
+      assert.deepStrictEqual(resolver.resolve('unknown.key'), []);
+    });
+
+  });
+
+  describe('applyMutations', () => {
+
+    it('should apply base64_decode', () => {
+      const resolver = new RequestResolver(createReq());
+      const result = resolver.applyMutations(['base64_decode'], Buffer.from('hello').toString('base64'));
+      assert.strictEqual(result, 'hello');
+    });
+
+    it('should apply json_decode', () => {
+      const resolver = new RequestResolver(createReq());
+      const result = resolver.applyMutations(['json_decode'], '{"key":"value"}');
+      assert.deepStrictEqual(result, { key: 'value' });
+    });
+
+    it('should apply urldecode', () => {
+      const resolver = new RequestResolver(createReq());
+      const result = resolver.applyMutations(['urldecode'], 'hello%20world');
+      assert.strictEqual(result, 'hello world');
+    });
+
+    it('should apply intval', () => {
+      const resolver = new RequestResolver(createReq());
+      assert.strictEqual(resolver.applyMutations(['intval'], '42abc'), 42);
+    });
+
+    it('should chain mutations', () => {
+      const resolver = new RequestResolver(createReq());
+      const encoded = Buffer.from('{"key":"value"}').toString('base64');
+      const result = resolver.applyMutations(['base64_decode', 'json_decode'], encoded);
+      assert.deepStrictEqual(result, { key: 'value' });
+    });
+
+    it('should handle null mutations array', () => {
+      const resolver = new RequestResolver(createReq());
+      assert.strictEqual(resolver.applyMutations(null, 'test'), 'test');
+    });
+
+  });
+
+});
+
+describe('resolveRaw with _rawBody (prototype pollution)', () => {
+
+    it('should use _rawBody when set by normalizeRequest', () => {
+        const req = {
+            body: {},
+            _rawBody: '{"__proto__":{"admin":true}}'
+        };
+        const resolver = new RequestResolver(req);
+        const values = resolver.resolve('raw');
+        assert.strictEqual(values.length, 1);
+        assert.strictEqual(values[0], '{"__proto__":{"admin":true}}');
+    });
+
+    it('should fall back to body string when _rawBody is absent', () => {
+        const req = {
+            body: '{"test":"value"}'
+        };
+        const resolver = new RequestResolver(req);
+        const values = resolver.resolve('raw');
+        assert.strictEqual(values.length, 1);
+        assert.ok(values[0].includes('test'));
+    });
+
+    it('should fall back to JSON.stringify when _rawBody is absent and body is object', () => {
+        const req = {
+            body: { key: 'value' }
+        };
+        const resolver = new RequestResolver(req);
+        const values = resolver.resolve('raw');
+        assert.strictEqual(values.length, 1);
+        assert.ok(values[0].includes('key'));
+    });
+
+    it('should return empty array when _rawBody is empty string', () => {
+        const req = {
+            body: null,
+            _rawBody: ''
+        };
+        const resolver = new RequestResolver(req);
+        const values = resolver.resolve('raw');
+        assert.deepStrictEqual(values, []);
+    });
+
+    it('should ignore body entirely when _rawBody is set (even to empty string)', () => {
+        const req = {
+            body: '{"sensitive":"data"}',
+            _rawBody: ''
+        };
+        const resolver = new RequestResolver(req);
+        const values = resolver.resolve('raw');
+        // _rawBody takes priority — body is ignored, empty _rawBody means "no body"
+        assert.deepStrictEqual(values, []);
+    });
+
+    describe('resolve response.* (response phase)', () => {
+        const resolver = () => new RequestResolver({
+            _response: { status: 200, headers: { 'content-type': 'application/json' }, body: '{"key":"secret"}' }
+        });
+
+        it('resolves response.body / status / header.*', () => {
+            assert.deepStrictEqual(resolver().resolve('response.body'), ['{"key":"secret"}']);
+            assert.deepStrictEqual(resolver().resolve('response.status'), ['200']);
+            assert.deepStrictEqual(resolver().resolve('response.header.content-type'), ['application/json']);
+        });
+
+        it('returns [] when no response context', () => {
+            assert.deepStrictEqual(new RequestResolver({}).resolve('response.body'), []);
+        });
+    });
+
+    describe('resolve egress.* (egress phase)', () => {
+        const resolver = () => new RequestResolver({
+            _egress: { url: 'http://169.254.169.254/latest/meta-data/', host: '169.254.169.254', method: 'GET' }
+        });
+
+        it('resolves egress.host / url / method', () => {
+            assert.deepStrictEqual(resolver().resolve('egress.host'), ['169.254.169.254']);
+            assert.deepStrictEqual(resolver().resolve('egress.url'), ['http://169.254.169.254/latest/meta-data/']);
+            assert.deepStrictEqual(resolver().resolve('egress.method'), ['GET']);
+        });
+    });
+
+});
diff --git a/tests/protect/runtime-guards.test.ts b/tests/protect/runtime-guards.test.ts
new file mode 100644
index 0000000..c08ea47
--- /dev/null
+++ b/tests/protect/runtime-guards.test.ts
@@ -0,0 +1,115 @@
+import { describe, expect, it } from 'vitest';
+import { Readable } from 'node:stream';
+import { mkdtempSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createProtection } from '../../src/protect/runtime.js';
+
+// The runtime's own middleware guards (.node() / .express()), the rule-source token +
+// last-known-good cache path, and egressRules override — surfaces not otherwise exercised.
+
+const blockRules = {
+  firewall: [{ id: 'b', rule_v2: [{ parameter: ['post.title', 'get.q'], match: { type: 'contains', value: 'evil' } }] }],
+  whitelists: [],
+  whitelist_keys: {},
+};
+
+function mockReq({ method = 'POST', url = '/', headers = {}, body = '' }: any) {
+  const r: any = Readable.from(body ? [Buffer.from(body)] : []);
+  r.method = method;
+  r.url = url;
+  r.headers = headers;
+  r.socket = { remoteAddress: '1.1.1.1' };
+  return r;
+}
+function mockRes(): any {
+  return { statusCode: 200, ended: false, setHeader() {}, end() { this.ended = true; } };
+}
+function runNode(mw: any, req: any, res: any): Promise<{ res: any; nexted: boolean }> {
+  return new Promise((resolve) => {
+    const origEnd = res.end.bind(res);
+    res.end = (c: any) => { origEnd(c); resolve({ res, nexted: false }); };
+    mw(req, res, () => resolve({ res, nexted: true }));
+  });
+}
+
+describe('runtime guards — node()', () => {
+  it('buffers the body, blocks a match, passes benign (and sets req.body)', async () => {
+    const p = await createProtection({ rules: blockRules, mode: 'block' });
+    const mw = p.node();
+
+    const blocked = await runNode(mw, mockReq({ headers: { 'content-type': 'application/json' }, body: JSON.stringify({ title: 'evil' }) }), mockRes());
+    expect(blocked.res.statusCode).toBe(403);
+    expect(blocked.nexted).toBe(false);
+
+    const req = mockReq({ headers: { 'content-type': 'application/json' }, body: JSON.stringify({ title: 'ok' }) });
+    const allowed = await runNode(mw, req, mockRes());
+    expect(allowed.nexted).toBe(true);
+    expect((req as any).body).toEqual({ title: 'ok' }); // guard re-exposes the parsed body downstream
+  });
+});
+
+describe('runtime guards — express()', () => {
+  it('blocks a match (403 json) and calls next() otherwise', async () => {
+    const p = await createProtection({ rules: blockRules, mode: 'block' });
+    const mw = p.express();
+    const mk = (q: string) => ({
+      req: { method: 'GET', url: `/?q=${q}`, originalUrl: `/?q=${q}`, query: { q }, body: {}, headers: {} },
+      res: { statusCode: 200, body: null as any, status(c: number) { this.statusCode = c; return this; }, json(b: any) { this.body = b; } },
+    });
+
+    const bad = mk('evil');
+    let nexted = false;
+    mw(bad.req, bad.res, () => (nexted = true));
+    expect(bad.res.statusCode).toBe(403);
+    expect(nexted).toBe(false);
+
+    const good = mk('ok');
+    let nexted2 = false;
+    mw(good.req, good.res, () => (nexted2 = true));
+    expect(nexted2).toBe(true);
+  });
+});
+
+describe('rule source — token + last-known-good cache', () => {
+  it('caches fetched rules, then falls back to the cache when the API fails', async () => {
+    const orig = globalThis.fetch;
+    const bundle = { firewall: [{ id: 't1', rule_v2: [{ parameter: 'get.x', match: { type: 'contains', value: 'evil' } }] }], whitelists: [], whitelist_keys: {} };
+    const cacheDir = mkdtempSync(join(tmpdir(), 'ps-cache-'));
+    try {
+      globalThis.fetch = (async () => new Response(JSON.stringify(bundle), { status: 200, headers: { 'content-type': 'application/json' } })) as any;
+      const p1 = await createProtection({ token: 't', cacheDir, mode: 'block' });
+      expect((await p1.fetchGuard()(new Request('https://a/?x=evil')))?.status).toBe(403); // live
+
+      globalThis.fetch = (async () => new Response('down', { status: 500 })) as any;
+      const p2 = await createProtection({ token: 't', cacheDir, mode: 'block' });
+      expect((await p2.fetchGuard()(new Request('https://a/?x=evil')))?.status).toBe(403); // from cache
+    } finally {
+      globalThis.fetch = orig;
+    }
+  });
+
+  it('no token and no cache → empty request ruleset (allows)', async () => {
+    const p = await createProtection({ mode: 'block' }); // defaults only (response/egress), no request rules
+    expect(await p.fetchGuard()(new Request('https://a/?x=evil'))).toBeNull();
+  });
+});
+
+describe('egress — egressRules override', () => {
+  it('replaces the default SSRF rule (internal now allowed, custom host blocked)', async () => {
+    const orig = globalThis.fetch;
+    globalThis.fetch = (async () => ({ marker: 'stub' })) as any;
+    const p = await createProtection({
+      egress: true,
+      mode: 'block',
+      egressRules: [{ phase: 'egress', category: 'x', rule_v2: [{ parameter: 'egress.host', match: { type: 'contains', value: 'evil.com' } }] }],
+    });
+    try {
+      await expect(globalThis.fetch('https://api.evil.com/')).rejects.toThrow(); // custom rule
+      expect((await (globalThis.fetch as any)('http://169.254.169.254/')).marker).toBe('stub'); // default replaced → allowed
+    } finally {
+      p.uninstallEgress?.();
+      globalThis.fetch = orig;
+    }
+  });
+});
diff --git a/tests/protect.test.ts b/tests/protect/runtime.test.ts
similarity index 99%
rename from tests/protect.test.ts
rename to tests/protect/runtime.test.ts
index 01763ce..cbd6028 100644
--- a/tests/protect.test.ts
+++ b/tests/protect/runtime.test.ts
@@ -1,7 +1,7 @@
 import { describe, expect, it } from 'vitest';
 // The vendored runtime (node-waf engine + createProtection + Supabase guard),
 // exported as @patchstack/connect/protect.
-import { createProtection, createSupabaseGuard, createServerFnGuard } from '../src/protect/runtime.js';
+import { createProtection, createSupabaseGuard, createServerFnGuard } from '../../src/protect/runtime.js';
 
 const rules = {
   firewall: [
diff --git a/tests/protect/tier3.test.ts b/tests/protect/tier3.test.ts
new file mode 100644
index 0000000..87e08e6
--- /dev/null
+++ b/tests/protect/tier3.test.ts
@@ -0,0 +1,190 @@
+import { describe, expect, it } from 'vitest';
+import { createProtection } from '../../src/protect/runtime.js';
+
+// Deep coverage for the Tier-3 protect-layer features (response redaction / egress SSRF /
+// phases / options / invalid rules) — complements engine.test.ts (engine unit coverage)
+// and runtime.test.ts (Supabase / server-fn integration).
+
+const req = () => new Request('https://app.example.com/x');
+const resp = (body: string, contentType = 'application/json', headers: Record<string, string> = {}) =>
+  () => new Response(body, { status: 200, headers: { 'content-type': contentType, ...headers } });
+
+async function bodyOf(r: any): Promise<string> {
+  return typeof r?.text === 'function' ? await r.text() : '';
+}
+
+// --- shared egress harness: stub global fetch, run, always restore ---
+async function withEgress(opts: any, fn: (p: any) => Promise<void>) {
+  const orig = globalThis.fetch;
+  const stub = (async (u: any) => ({ marker: 'stub', url: String(u) })) as any;
+  globalThis.fetch = stub;
+  const p = await createProtection({ egress: true, ...opts });
+  try {
+    await fn(p);
+  } finally {
+    p.uninstallEgress?.();
+    globalThis.fetch = orig;
+  }
+  return stub;
+}
+
+describe('response phase — redaction depth', () => {
+  it('redacts every default secret type, still serving the page', async () => {
+    const p = await createProtection({ mode: 'block' });
+    const cases: Array<[string, string]> = [
+      ['private-key', '-----BEGIN RSA PRIVATE KEY-----\nMIIabc'],
+      ['aws', 'key=AKIAIOSFODNN7EXAMPLE'],
+      ['gcp', 'k=AIzaSyD1234567890abcdefghij1234567890xy'],
+      ['jwt', 'eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N'],
+      ['db', 'mongodb://user:secret@db.host:27017/app'],
+      ['stack', 'oops\n    at handler (/srv/app/index.js:42:13)'],
+    ];
+    for (const [label, secret] of cases) {
+      const r: any = await p.fetch(resp(`{"x":"${secret}"}`, 'text/plain'))(req());
+      const body = await bodyOf(r);
+      expect(r.status, label).toBe(200);
+      expect(body.includes('[REDACTED]'), `${label} masked`).toBe(true);
+    }
+  });
+
+  it('masks MULTIPLE leaked spans in one body', async () => {
+    const p = await createProtection({ mode: 'block' });
+    const r: any = await p.fetch(resp('a AKIAIOSFODNN7EXAMPLE b AKIAXXXXXXXXXXXXXXXX c', 'text/plain'))(req());
+    const body = await bodyOf(r);
+    expect(body.includes('AKIA')).toBe(false);
+    expect(body.match(/\[REDACTED\]/g)?.length).toBe(2);
+  });
+
+  it('honors maskWith (string and per-category function)', async () => {
+    const s: any = await createProtection({ mode: 'block', maskWith: '###' });
+    expect(await bodyOf(await s.fetch(resp('AKIAIOSFODNN7EXAMPLE', 'text/plain'))(req()))).toContain('###');
+
+    const f: any = await createProtection({ mode: 'block', maskWith: (c: string) => `<${c}>` });
+    expect(await bodyOf(await f.fetch(resp('AKIAIOSFODNN7EXAMPLE', 'text/plain'))(req()))).toContain('<secret-exposure>');
+  });
+
+  it('redacts a contains-literal rule', async () => {
+    const p = await createProtection({
+      mode: 'block',
+      responseRules: [{ phase: 'response', category: 'x', action: 'redact', rule_v2: [{ parameter: 'response.body', match: { type: 'contains', value: 'SEKRET' } }] }],
+    });
+    expect(await bodyOf(await p.fetch(resp('a SEKRET b', 'text/plain'))(req()))).toBe('a [REDACTED] b');
+  });
+
+  it('a redact rule with no maskable pattern falls back to withholding', async () => {
+    const p = await createProtection({
+      mode: 'block',
+      responseRules: [{ phase: 'response', category: 'x', action: 'redact', rule_v2: [{ parameter: 'response.body', match: { type: 'isset' } }] }],
+    });
+    const r: any = await p.fetch(resp('anything', 'text/plain'))(req());
+    expect(r.status).toBe(500);
+  });
+
+  it('screens response.header.* rules', async () => {
+    const p = await createProtection({
+      mode: 'block',
+      responseRules: [{ phase: 'response', category: 'x', action: 'block', rule_v2: [{ parameter: 'response.header.x-secret', match: { type: 'isset' } }] }],
+    });
+    const r: any = await p.fetch(resp('ok', 'text/plain', { 'x-secret': '1' }))(req());
+    expect(r.status).toBe(500);
+  });
+});
+
+describe('response phase — gating & robustness', () => {
+  it('does NOT scan non-text responses (content-type gate)', async () => {
+    const p = await createProtection({ mode: 'block' });
+    const r: any = await p.fetch(resp('AKIAIOSFODNN7EXAMPLE', 'image/png'))(req());
+    expect(r.status).toBe(200);
+    expect(await bodyOf(r)).toContain('AKIAIOSFODNN7EXAMPLE'); // untouched
+  });
+
+  it('does NOT scan oversized responses (content-length cap)', async () => {
+    const p = await createProtection({ mode: 'block' });
+    const r: any = await p.fetch(resp('AKIAIOSFODNN7EXAMPLE', 'text/plain', { 'content-length': '600000' }))(req());
+    expect(await bodyOf(r)).toContain('AKIAIOSFODNN7EXAMPLE'); // skipped, untouched
+  });
+
+  it('a malformed response rule (no rule_v2 array) is skipped, response served', async () => {
+    const p = await createProtection({ mode: 'block', responseRules: [{ id: 'bad', phase: 'response', rule_v2: null } as any] });
+    const r: any = await p.fetch(resp('AKIAIOSFODNN7EXAMPLE', 'text/plain'))(req());
+    expect(r.status).toBe(200);
+    expect(await bodyOf(r)).toContain('AKIAIOSFODNN7EXAMPLE');
+  });
+
+  it('an invalid regex in a response rule never matches (no crash)', async () => {
+    const p = await createProtection({
+      mode: 'block',
+      responseRules: [{ phase: 'response', action: 'redact', category: 'x', rule_v2: [{ parameter: 'response.body', match: { type: 'regex', value: '(unclosed' } }] }],
+    });
+    const r: any = await p.fetch(resp('hello (unclosed world', 'text/plain'))(req());
+    expect(r.status).toBe(200);
+    expect(await bodyOf(r)).toContain('(unclosed');
+  });
+});
+
+describe('egress phase — depth', () => {
+  it('blocks every internal range via the guard, allows external', async () => {
+    await withEgress({ mode: 'block' }, async () => {
+      for (const host of ['127.0.0.1', '10.0.0.5', '192.168.1.1', '172.16.0.9', 'localhost', '[::1]', 'metadata.google.internal']) {
+        await expect(globalThis.fetch(`http://${host}/`), host).rejects.toThrow();
+      }
+      expect((await (globalThis.fetch as any)('https://8.8.8.8/')).marker).toBe('stub');
+      expect((await (globalThis.fetch as any)('https://api.example.com/')).marker).toBe('stub');
+    });
+  });
+
+  it('allowHosts exempts a host', async () => {
+    await withEgress({ mode: 'block', allowHosts: ['169.254.169.254'] }, async () => {
+      expect((await (globalThis.fetch as any)('http://169.254.169.254/latest/')).marker).toBe('stub');
+    });
+  });
+
+  it('onEgressBlock receives url/host/method', async () => {
+    const seen: any[] = [];
+    await withEgress({ mode: 'block', onEgressBlock: (i: any) => seen.push(i) }, async () => {
+      await expect(globalThis.fetch('http://127.0.0.1:9000/admin')).rejects.toThrow();
+    });
+    expect(seen[0]?.host).toBe('127.0.0.1');
+    expect(seen[0]?.url).toContain('127.0.0.1');
+  });
+
+  it('uninstallEgress restores the original fetch', async () => {
+    const orig = globalThis.fetch;
+    const stub = (async () => ({ marker: 'stub' })) as any;
+    globalThis.fetch = stub;
+    const p = await createProtection({ egress: true, mode: 'block' });
+    expect(globalThis.fetch).not.toBe(stub); // wrapped
+    p.uninstallEgress?.();
+    expect(globalThis.fetch).toBe(stub); // restored
+    globalThis.fetch = orig;
+  });
+});
+
+describe('createProtection — options & phase isolation', () => {
+  it('defaults to dry-run', async () => {
+    expect((await createProtection({})).mode).toBe('dry-run');
+  });
+
+  it('responseRules REPLACES the defaults (AWS default no longer active)', async () => {
+    const p = await createProtection({
+      mode: 'block',
+      responseRules: [{ phase: 'response', category: 'x', action: 'redact', rule_v2: [{ parameter: 'response.body', match: { type: 'contains', value: 'FOO' } }] }],
+    });
+    const body = await bodyOf(await p.fetch(resp('AKIAIOSFODNN7EXAMPLE and FOO', 'text/plain'))(req()));
+    expect(body).toContain('AKIAIOSFODNN7EXAMPLE'); // default rule replaced → not masked
+    expect(body).toContain('[REDACTED]'); // FOO masked
+  });
+
+  it('splits rules by phase — a phase:response rule screens responses, NOT requests', async () => {
+    const p = await createProtection({
+      mode: 'block',
+      rules: { firewall: [{ id: 'r', phase: 'response', action: 'block', category: 'x', rule_v2: [{ parameter: 'response.body', match: { type: 'contains', value: 'LEAK' } }] }], whitelists: [], whitelist_keys: {} },
+    });
+    // request carrying "LEAK" is NOT blocked (rule is response-phase → request engine empty)
+    const reqWithLeak = new Request('https://app/x', { method: 'POST', headers: { 'content-type': 'application/json' }, body: '{"q":"LEAK"}' });
+    expect(await p.fetchGuard()(reqWithLeak)).toBeNull();
+    // but a response containing "LEAK" IS withheld
+    const r: any = await p.fetch(resp('LEAK', 'text/plain'))(req());
+    expect(r.status).toBe(500);
+  });
+});