@argentic/chest-sdk 0.1.1 → 0.3.0

package/dist/src/testing.js

@@ -0,0 +1,552 @@
+import { createHash, createHmac, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+import { groupIdPattern, memberIdPattern } from "./member.js";
+import { forget } from "./members.js";
+const encode = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
+// signAssertion is the Chest-Member value the Chest's front would send for
+// that member: HS256 under the key of the token, for the tool, valid 60
+// seconds from when it is issued.
+export function signAssertion(member, options = {}) {
+    const token = options.token ?? process.env["CHEST_TOKEN"];
+    const tool = options.tool ?? process.env["CHEST_TOOL"];
+    if (!token || !tool)
+        throw new Error("signAssertion needs a token and a tool: start a fakeChest, or name them");
+    if (!memberIdPattern.test(member.id) || !member.groups.every(g => groupIdPattern.test(g)))
+        throw new Error("signAssertion needs identifiers of the Chest's shape (mbr_…, grp_…)");
+    const iat = Math.floor((options.now ?? new Date()).getTime() / 1000);
+    const body = encode({ alg: "HS256", typ: "JWT" }) + "." + encode({
+        iss: `https://${tool}-chest.chest.test`, aud: tool, iat, exp: iat + 60, sub: member.id,
+        given_name: member.firstName, family_name: member.lastName, name: member.name, picture: member.photo ?? "", role: member.role ?? "",
+        admin: member.isAdmin, builder: member.isBuilder, groups: member.groups, time_zone: member.timeZone, ...(member.email === undefined ? {} : { email: member.email }),
+        language: member.language,
+    });
+    // The key as the Chest derives it, and member() reads it: HMAC-SHA256 of
+    // the label of the assertion's shape under the text of the token.
+    const key = createHmac("sha256", Buffer.from(token, "utf8")).update("Chest-Member v2").digest();
+    return body + "." + createHmac("sha256", key).update(body).digest("base64url");
+}
+// signEvent is the Chest-Event value the Chest would send with that body:
+// HS256 under the key the token derives for events, for the tool, naming the
+// event and the digest of the body, valid 60 seconds.
+function signEvent(id, body, options) {
+    const iat = Math.floor(Date.now() / 1000);
+    const signed = encode({ alg: "HS256", typ: "JWT" }) + "." + encode({ aud: options.tool, iat, exp: iat + 60, jti: id, digest: createHash("sha256").update(body).digest("base64url") });
+    const key = createHmac("sha256", Buffer.from(options.token, "utf8")).update("Chest-Event v1").digest();
+    return signed + "." + createHmac("sha256", key).update(signed).digest("base64url");
+}
+// withMember is the request carrying that member's assertion, signed with
+// the options of signAssertion: a new Web Request, or the same Node request
+// with its header set.
+export function withMember(request, member, options = {}) {
+    const assertion = signAssertion(member, options);
+    if (request instanceof Request) {
+        const headers = new Headers(request.headers);
+        headers.set("Chest-Member", assertion);
+        return new Request(request, { headers });
+    }
+    request.headers["chest-member"] = assertion;
+    return request;
+}
+// The bounds of a Chest (chest/toolmembers, chest/toolfiles).
+const maxLimit = 500, defaultLimit = 100, maxLookup = 200, callsPerMinute = 600;
+const maxObject = 32 << 20, maxObjects = 10000, maxTotal = 1 << 30;
+const namePattern = /^[A-Za-z0-9][A-Za-z0-9._-]{0,99}(\/[A-Za-z0-9][A-Za-z0-9._-]{0,99}){0,7}$/u;
+// Its notifications: recipients and badges a call, text, quotas.
+const maxRecipients = 500, maxTitle = 80, maxText = 280, maxPath = 512, maxCount = 9999;
+const recipientsPerHour = 1000, itemsPerDay = 100, badgesPerMinute = 600;
+const keyPattern = /^[a-z0-9._:-]{1,64}$/u;
+const reordering = /[\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/gu;
+const cleanTitle = (s) => s.replace(/[\t\r\n]/gu, " ").replace(/\p{Cc}/gu, "").replace(reordering, "").trim();
+const cleanText = (s) => s.replace(/\r\n?/gu, "\n").replace(/\t/gu, " ").replace(/[^\P{Cc}\n]/gu, "").replace(reordering, "").trim();
+const isPath = (p) => typeof p === "string" && p.length <= maxPath && /^\/chest([/?#][\x21-\x5b\x5d-\x7e]*)?$/u.test(p) && !p.includes("//") && !p.split(/[?#]/u)[0].split("/").some(x => /^(\.|%2e){1,2}$/iu.test(x));
+// Its AI: aliases in order, bounds of a request, requests a minute.
+const aliasOrder = ["default", "fast", "smart", "embedding"];
+const chatKeys = ["model", "messages", "max_tokens", "stream", "temperature", "top_p", "stop", "tools", "tool_choice", "response_format", "parallel_tool_calls", "seed", "reasoning_effort", "member"];
+const maxAiBody = 10 << 20, maxAiOutput = 128000, maxInputs = 256, aiPerMinute = 60, fakeDimensions = 8;
+// A fake count of tokens: one per 4 characters.
+const tokensOf = (text) => Math.ceil(text.length / 4);
+// A vector of a text, the same for the same text: unit length.
+function vectorOf(text, dimensions) {
+    const values = [];
+    for (let block = 0; values.length < dimensions; block++) {
+        for (const b of createHash("sha256").update(block + ":" + text).digest())
+            values.push(b / 127.5 - 1);
+    }
+    const kept = values.slice(0, dimensions), norm = Math.hypot(...kept) || 1;
+    return kept.map(x => x / norm);
+}
+const fold = (s) => s.normalize("NFD").replace(/\p{Mn}/gu, "").toLowerCase();
+function send(response, status, value, headers = {}) {
+    if (value === undefined)
+        return void response.writeHead(status, headers).end();
+    const raw = JSON.stringify(value);
+    response.writeHead(status, { ...headers, "Content-Type": "application/json", "Content-Length": String(Buffer.byteLength(raw)) }).end(raw);
+}
+async function body(request, limit) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of request) {
+        size += chunk.length;
+        if (size > limit)
+            return null;
+        chunks.push(chunk);
+    }
+    return Buffer.concat(chunks);
+}
+// fakeChest starts a Chest's API on 127.0.0.1 and points the environment at
+// it: CHEST_API, CHEST_TOKEN (a new one) and CHEST_TOOL ("tool" unless the
+// environment names one), and what the Chest is (CHEST_ORGANIZATION,
+// CHEST_TIME_ZONE, CHEST_LANGUAGE, as options.chest says). What member(),
+// chest and the modules of the SDK read is then this Chest's.
+export async function fakeChest(options = {}) {
+    const capabilities = new Set(options.capabilities ?? ["members", "files", "notifications", "ai"]);
+    const email = capabilities.has("members.email");
+    const tool = process.env["CHEST_TOOL"] || "tool";
+    const token = randomBytes(32).toString("base64url");
+    const files = new Map();
+    for (const [name, file] of Object.entries(options.files ?? {})) {
+        files.set(name, { data: typeof file.data === "string" ? new TextEncoder().encode(file.data) : file.data, type: file.type ?? "application/octet-stream", updated: new Date().toISOString() });
+    }
+    const receives = options.receives ?? ["member.*"];
+    // The erasures the tool was told of, by emit: those it may acknowledge.
+    const erasures = new Set();
+    const chest = { api: "", token, tool, members: [...(options.members ?? [])], groups: [...(options.groups ?? [])], files, notifications: [], badges: new Map(), acknowledged: [], ai: [], emit: async () => 0, close: async () => { } };
+    const former = [...(options.former ?? [])];
+    let window = 0, calls = 0;
+    const shown = (m) => ({ id: m.id, first_name: m.firstName, last_name: m.lastName, name: m.name, photo: m.photo, role: m.role, admin: m.isAdmin, builder: m.isBuilder, groups: m.groups, language: m.language, time_zone: m.timeZone, ...(email && m.email !== undefined ? { email: m.email } : {}) });
+    const key = (m) => fold(m.name) + "\u0000" + m.id;
+    const described = (name, f) => ({ name, type: f.type, size: f.data.byteLength, updated: f.updated });
+    async function members(request, response, url) {
+        if (!capabilities.has("members"))
+            return send(response, 403, { error: "capability_not_granted" });
+        const now = Date.now();
+        if (now - window >= 60_000)
+            [window, calls] = [now, 0];
+        if (++calls > callsPerMinute)
+            return send(response, 429, { error: "rate_limited" }, { "Retry-After": "60" });
+        if (request.method === "GET" && url.pathname === "/members") {
+            const q = url.searchParams, keys = [...q.keys()];
+            const limit = q.has("limit") ? Number(q.get("limit")) : defaultLimit;
+            const after = q.has("after") ? Buffer.from(q.get("after"), "base64url").toString() : "";
+            if (q.has("after") && !memberIdPattern.test(after.split("\u0000")[1] ?? ""))
+                return send(response, 400, { error: "invalid_query" });
+            const group = q.get("group"), role = q.get("role"), search = fold(q.get("q") ?? "");
+            if (keys.some(k => !["after", "limit", "q", "role", "group"].includes(k) || q.getAll(k).length !== 1) || !Number.isInteger(limit) || limit < 1 || limit > maxLimit || String(limit) !== (q.get("limit") ?? String(defaultLimit)) || (group !== null && !groupIdPattern.test(group)) || search.length > 64)
+                return send(response, 400, { error: "invalid_query" });
+            const shownList = chest.members
+                .filter(m => (role === null || m.role === role) && (group === null || m.groups.includes(group)) && (search === "" || [m.firstName, m.lastName, m.name, ...(email && m.email ? [m.email] : [])].some(n => fold(n).startsWith(search))))
+                .filter(m => after === "" || key(m) > after)
+                .sort((a, b) => key(a) < key(b) ? -1 : key(a) > key(b) ? 1 : 0);
+            const page = shownList.slice(0, limit);
+            return send(response, 200, { members: page.map(shown), next: shownList.length > limit ? Buffer.from(key(page.at(-1))).toString("base64url") : null });
+        }
+        if (request.method === "POST" && url.pathname === "/members/lookup") {
+            const raw = await body(request, 64 << 10);
+            let ids;
+            try {
+                ids = JSON.parse(raw?.toString() ?? "").ids;
+            }
+            catch {
+                ids = undefined;
+            }
+            if (!Array.isArray(ids) || ids.length > maxLookup)
+                return send(response, 400, { error: "invalid_body" });
+            if (!ids.every(id => typeof id === "string" && memberIdPattern.test(id)))
+                return send(response, 400, { error: "invalid_id" });
+            const answer = { members: [], former: [], unknown: [] };
+            for (const id of new Set(ids)) {
+                const m = chest.members.find(x => x.id === id), f = former.find(x => x.id === id);
+                if (m)
+                    answer.members.push(shown(m));
+                else if (f?.erased)
+                    answer.former.push({ id, status: "erased" });
+                else if (f)
+                    answer.former.push({ id, ...(f.name ? { name: f.name } : {}), status: "former" });
+                else
+                    answer.unknown.push(id);
+            }
+            return send(response, 200, answer);
+        }
+        if (request.method === "GET" && url.pathname.startsWith("/members/")) {
+            const id = url.pathname.slice("/members/".length);
+            if (!memberIdPattern.test(id))
+                return send(response, 400, { error: "invalid_id" });
+            const m = chest.members.find(x => x.id === id);
+            return m ? send(response, 200, shown(m)) : send(response, 404, { error: "member_not_found" });
+        }
+        if (request.method === "GET" && url.pathname === "/groups")
+            return send(response, 200, { groups: chest.groups });
+        send(response, 404, { error: "not_found" });
+    }
+    async function filesRoute(request, response, url) {
+        if (!capabilities.has("files"))
+            return send(response, 403, { error: "capability_not_granted" });
+        if (request.method === "GET" && url.pathname === "/files") {
+            const prefix = url.searchParams.get("prefix") ?? "", after = url.searchParams.get("after") ?? "";
+            const names = [...files.keys()].filter(n => n.startsWith(prefix) && n > after).sort();
+            return send(response, 200, { files: names.slice(0, 1000).map(n => described(n, files.get(n))), next: names.length > 1000 ? names[999] : null });
+        }
+        if (request.method === "POST" && url.pathname === "/files/url") {
+            const raw = await body(request, 4096);
+            let name;
+            try {
+                name = JSON.parse(raw?.toString() ?? "").name;
+            }
+            catch {
+                name = undefined;
+            }
+            if (typeof name !== "string")
+                return send(response, 400, { error: "invalid_body" });
+            if (!files.has(name))
+                return send(response, 404, { error: "not_found" });
+            return send(response, 200, { url: `https://${tool}-chest.chest.test/_chest/files/${Buffer.from(name).toString("base64url")}.fake`, expires_in: 900 });
+        }
+        if (request.method === "POST" && (url.pathname === "/files/move" || url.pathname === "/files/upload-url")) {
+            const raw = await body(request, 4096);
+            let command = {};
+            try {
+                command = JSON.parse(raw?.toString() ?? "");
+            }
+            catch {
+                command = {};
+            }
+            if (url.pathname === "/files/upload-url") {
+                // The upload itself goes from a member's browser to the team host,
+                // which a fake Chest does not play: it only authorises it.
+                if (typeof command["name"] !== "string")
+                    return send(response, 400, { error: "invalid_body" });
+                return send(response, 200, { url: `https://${tool}-chest.chest.test/_chest/files/upload/${Buffer.from(command["name"]).toString("base64url")}.fake`, method: "PUT", expires_in: typeof command["expires_in"] === "number" ? command["expires_in"] : 900 });
+            }
+            const from = command["from"], to = command["to"];
+            if (typeof from !== "string" || typeof to !== "string" || !namePattern.test(from) || !namePattern.test(to))
+                return send(response, 400, { error: "invalid_name" });
+            const moving = files.get(from);
+            if (!moving)
+                return send(response, 404, { error: "not_found" });
+            files.delete(from);
+            files.set(to, moving);
+            return send(response, 200, described(to, moving));
+        }
+        const name = decodeURIComponent(url.pathname.slice("/files/".length));
+        if (!namePattern.test(name))
+            return send(response, 400, { error: "invalid_name" });
+        const object = files.get(name);
+        if (request.method === "PUT") {
+            const data = await body(request, maxObject);
+            if (data === null)
+                return send(response, 413, { error: "too_large" });
+            const total = [...files.entries()].reduce((sum, [n, f]) => n === name ? sum : sum + f.data.byteLength, 0);
+            if (total + data.length > maxTotal || (!object && files.size >= maxObjects))
+                return send(response, 429, { error: "quota_exceeded" });
+            const kept = { data: new Uint8Array(data), type: request.headers["content-type"] ?? "application/octet-stream", updated: new Date().toISOString() };
+            files.set(name, kept);
+            return send(response, 201, described(name, kept));
+        }
+        if (!object)
+            return send(response, 404, { error: "not_found" });
+        if (request.method === "GET" && url.searchParams.has("stat"))
+            return send(response, 200, described(name, object));
+        if (request.method === "GET")
+            return void response.writeHead(200, { "Content-Type": object.type, "Content-Length": String(object.data.byteLength) }).end(object.data);
+        if (request.method === "DELETE") {
+            files.delete(name);
+            return send(response, 204);
+        }
+        send(response, 404, { error: "not_found" });
+    }
+    const hour = { start: 0, count: 0 }, minute = { start: 0, count: 0 }, days = new Map();
+    const live = (w, span, now) => w !== undefined && w.count > 0 && now - w.start < span;
+    const wait = (w, span, now) => ({ "Retry-After": String(Math.max(1, Math.ceil((w.start + span - now) / 1000))) });
+    const count = (w, span, now, n) => {
+        if (!live(w, span, now))
+            [w.start, w.count] = [now, 0];
+        w.count += n;
+    };
+    const access = (id) => chest.members.some(m => m.id === id);
+    // drop removes kept notifications in place: a test may hold the list.
+    const drop = (gone) => {
+        for (let i = chest.notifications.length - 1; i >= 0; i--)
+            if (gone(chest.notifications[i]))
+                chest.notifications.splice(i, 1);
+    };
+    // recipients reads 1 to 500 member identifiers, each once.
+    function recipients(value) {
+        if (!Array.isArray(value) || value.length < 1 || value.length > maxRecipients)
+            return { error: "invalid_body" };
+        if (!value.every(v => typeof v === "string" && memberIdPattern.test(v)))
+            return { error: "invalid_id" };
+        return [...new Set(value)];
+    }
+    async function notificationsRoute(request, response, url) {
+        if (!capabilities.has("notifications"))
+            return send(response, 403, { error: "capability_not_granted" });
+        const badge = request.method === "PUT" && url.pathname.startsWith("/badges/");
+        if (!badge && !(request.method === "PUT" && url.pathname === "/badges") && !(request.method === "POST" && (url.pathname === "/notifications" || url.pathname === "/notifications/withdraw")))
+            return send(response, 404, { error: "not_found" });
+        const raw = await body(request, 64 << 10);
+        let command = null;
+        try {
+            const value = JSON.parse(raw?.toString() ?? "");
+            if (value !== null && typeof value === "object" && !Array.isArray(value))
+                command = value;
+        }
+        catch {
+            command = null;
+        }
+        const keys = (...allowed) => command !== null && Object.keys(command).every(k => allowed.includes(k));
+        const now = Date.now();
+        if (badge || url.pathname === "/badges") {
+            let writes;
+            if (badge) {
+                const id = url.pathname.slice("/badges/".length);
+                if (!memberIdPattern.test(id))
+                    return send(response, 400, { error: "invalid_id" });
+                if (!keys("count") || !("count" in command))
+                    return send(response, 400, { error: "invalid_body" });
+                writes = [{ member: id, count: command["count"] }];
+            }
+            else {
+                const list = command?.["badges"];
+                if (!keys("badges") || !Array.isArray(list) || list.length < 1 || list.length > maxRecipients || !list.every(b => b !== null && typeof b === "object" && !Array.isArray(b) && Object.keys(b).every(k => k === "member" || k === "count")))
+                    return send(response, 400, { error: "invalid_body" });
+                writes = list;
+                if (!writes.every(b => typeof b.member === "string" && memberIdPattern.test(b.member)))
+                    return send(response, 400, { error: "invalid_id" });
+            }
+            if (!writes.every(b => typeof b.count === "number" && Number.isInteger(b.count) && b.count >= 0 && b.count <= maxCount))
+                return send(response, 400, { error: "invalid_count" });
+            if (new Set(writes.map(b => b.member)).size !== writes.length)
+                return send(response, 400, { error: "invalid_body" });
+            if (live(minute, 60_000, now) && minute.count + writes.length > badgesPerMinute)
+                return send(response, 429, { error: "quota_exceeded" }, wait(minute, 60_000, now));
+            count(minute, 60_000, now, writes.length);
+            const answer = { set: [], skipped: [] };
+            for (const b of writes) {
+                if (!access(b.member)) {
+                    answer.skipped.push(b.member);
+                    continue;
+                }
+                if (b.count === 0)
+                    chest.badges.delete(b.member);
+                else
+                    chest.badges.set(b.member, b.count);
+                answer.set.push(b.member);
+            }
+            return send(response, 200, answer);
+        }
+        if (url.pathname === "/notifications/withdraw") {
+            if (!keys("key", "members"))
+                return send(response, 400, { error: "invalid_body" });
+            const key = command["key"];
+            if (typeof key !== "string" || !keyPattern.test(key))
+                return send(response, 400, { error: "invalid_key" });
+            const named = command["members"] === undefined ? null : recipients(command["members"]);
+            if (named !== null && !Array.isArray(named))
+                return send(response, 400, named);
+            drop(n => n.key === key && (named === null || named.includes(n.member)));
+            return send(response, 204);
+        }
+        if (!keys("members", "title", "body", "path", "key"))
+            return send(response, 400, { error: "invalid_body" });
+        const { title, body: text, path, key } = command;
+        const ids = recipients(command["members"]);
+        if (!Array.isArray(ids))
+            return send(response, 400, ids);
+        if (typeof title !== "string" || [...title].length < 1 || [...title].length > maxTitle || cleanTitle(title) === "")
+            return send(response, 400, { error: "invalid_title" });
+        if (text !== undefined && (typeof text !== "string" || [...text].length > maxText))
+            return send(response, 400, { error: "invalid_text" });
+        if (path !== undefined && !isPath(path))
+            return send(response, 400, { error: "invalid_path" });
+        if (key !== undefined && (typeof key !== "string" || !keyPattern.test(key)))
+            return send(response, 400, { error: "invalid_key" });
+        const kept = ids.filter(access);
+        if (live(hour, 3_600_000, now) && hour.count + kept.length > recipientsPerHour)
+            return send(response, 429, { error: "quota_exceeded" }, wait(hour, 3_600_000, now));
+        const full = kept.map(id => days.get(id)).filter((w) => live(w, 86_400_000, now) && w.count >= itemsPerDay);
+        if (full.length > 0)
+            return send(response, 429, { error: "quota_exceeded" }, wait(full.reduce((a, b) => a.start > b.start ? a : b), 86_400_000, now));
+        count(hour, 3_600_000, now, kept.length);
+        const cleaned = typeof text === "string" ? cleanText(text) : "";
+        for (const id of kept) {
+            if (!days.has(id))
+                days.set(id, { start: 0, count: 0 });
+            count(days.get(id), 86_400_000, now, 1);
+            if (key !== undefined)
+                drop(n => n.member === id && n.key === key);
+            chest.notifications.push({ member: id, title: cleanTitle(title), ...(cleaned ? { body: cleaned } : {}), path: path ?? "/chest", ...(key !== undefined ? { key: key } : {}) });
+        }
+        send(response, 200, { delivered: kept, skipped: ids.filter(id => !access(id)) });
+    }
+    // Its AI: the declared aliases, the spending this month, the requests this
+    // minute.
+    const mapped = (options.ai?.models ?? aliasOrder.map((alias) => ({ alias, model: "fake-" + alias }))).map(m => ({ alias: m.alias, model: m.model, provider: m.provider ?? "openrouter", input: m.input ?? 1, output: m.output ?? 2 }));
+    const cap = options.ai?.cap ?? 5;
+    const aiMinute = { start: 0, count: 0 };
+    let spent = 0;
+    const month = () => new Date().toISOString().slice(0, 7);
+    const resets = () => {
+        const now = new Date();
+        return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth() + 1, 1)).toISOString().replace(".000Z", "Z");
+    };
+    const spend = (m, input, output) => {
+        const cost = Math.round((input * m.input + output * m.output) / 1e6 * 1e6) / 1e6;
+        spent = Math.round((spent + cost) * 1e6) / 1e6;
+        return cost;
+    };
+    // echo is the text of the last user message: its text, or its text parts.
+    const echo = (request) => {
+        const last = [...request["messages"]].reverse().find(m => m?.role === "user")?.content;
+        return typeof last === "string" ? last : Array.isArray(last) ? last.map(p => p?.text).filter(t => typeof t === "string").join("") : "";
+    };
+    async function aiRoute(request, response, url) {
+        const raw = request.method === "POST" ? await body(request, maxAiBody) : null;
+        let command = null;
+        try {
+            const value = JSON.parse(raw?.toString() ?? "");
+            if (value !== null && typeof value === "object" && !Array.isArray(value))
+                command = value;
+        }
+        catch {
+            command = null;
+        }
+        chest.ai.push({ path: url.pathname, body: command });
+        if (!capabilities.has("ai"))
+            return send(response, 403, { error: "capability_not_granted" });
+        if (request.method === "GET" && url.pathname === "/ai/models")
+            return send(response, 200, { models: [...mapped].sort((a, b) => aliasOrder.indexOf(a.alias) - aliasOrder.indexOf(b.alias)) });
+        if (request.method === "GET" && url.pathname === "/ai/usage")
+            return send(response, 200, { month: month(), spent, cap, resets: resets() });
+        if (request.method !== "POST" || (url.pathname !== "/ai/chat" && url.pathname !== "/ai/embeddings"))
+            return send(response, 404, { error: "not_found" });
+        if (raw === null)
+            return send(response, 413, { error: "too_large" });
+        const chat = url.pathname === "/ai/chat";
+        if (!command || !Object.keys(command).every(k => chat ? chatKeys.includes(k) : ["model", "input", "dimensions", "member"].includes(k)))
+            return send(response, 400, { error: "invalid_body" });
+        const model = mapped.find(m => m.alias === command["model"]);
+        if (!model)
+            return send(response, 403, { error: "model_not_allowed" });
+        const member = command["member"];
+        if (member !== undefined && (typeof member !== "string" || !memberIdPattern.test(member)))
+            return send(response, 400, { error: "invalid_body" });
+        const now = Date.now();
+        // refused says the refusal of a valid request, if any: the rate, the
+        // provider, the cap.
+        const refused = () => {
+            const busy = live(aiMinute, 60_000, now) && aiMinute.count >= aiPerMinute;
+            if (busy)
+                send(response, 429, { error: "rate_limited" }, wait(aiMinute, 60_000, now));
+            else {
+                count(aiMinute, 60_000, now, 1);
+                if (options.ai?.unavailable)
+                    send(response, options.ai.unavailable === "provider_key_invalid" ? 502 : 503, { error: options.ai.unavailable });
+                else if (spent >= cap)
+                    send(response, 402, { error: "cap_reached", scope: "tool", resets: resets() });
+            }
+            return response.headersSent;
+        };
+        if (!chat) {
+            const input = command["input"], texts = typeof input === "string" ? [input] : input, dimensions = command["dimensions"] ?? fakeDimensions;
+            if (!Array.isArray(texts) || texts.length < 1 || texts.length > maxInputs || !texts.every(t => typeof t === "string") || typeof dimensions !== "number" || !Number.isInteger(dimensions) || dimensions < 1 || dimensions > 4096)
+                return send(response, 400, { error: "invalid_body" });
+            if (refused())
+                return;
+            const used = texts.reduce((sum, t) => sum + tokensOf(t), 0);
+            const cost = spend(model, used, 0);
+            return send(response, 200, { object: "list", data: texts.map((t, index) => ({ object: "embedding", index, embedding: vectorOf(t, dimensions) })), model: model.model, usage: { prompt_tokens: used, total_tokens: used, cost } });
+        }
+        const messages = command["messages"], limit = command["max_tokens"] ?? 4096;
+        if (!Array.isArray(messages) || messages.length < 1 || !messages.every(m => m !== null && typeof m === "object" && typeof m.role === "string") || typeof limit !== "number" || !Number.isInteger(limit) || limit < 1 || limit > maxAiOutput || !(command["stream"] === undefined || typeof command["stream"] === "boolean"))
+            return send(response, 400, { error: "invalid_body" });
+        if (refused())
+            return;
+        const given = options.ai?.reply ? options.ai.reply(command) : echo(command);
+        const text = typeof given === "string" ? given : given.text ?? "";
+        const calls = (typeof given === "string" ? [] : given.toolCalls ?? []).map((c, i) => ({ id: c.id ?? `call_${i + 1}`, type: "function", function: { name: c.name, arguments: c.arguments } }));
+        const input = tokensOf(JSON.stringify(messages)), output = tokensOf(text + calls.map(c => c.function.name + c.function.arguments).join(""));
+        const usage = { prompt_tokens: input, completion_tokens: output, total_tokens: input + output, prompt_tokens_details: { cached_tokens: 0 }, cost: spend(model, input, output) };
+        const finish = calls.length ? "tool_calls" : "stop";
+        const head = { id: "chatcmpl-fake", created: Math.floor(now / 1000), model: model.model };
+        if (command["stream"] !== true) {
+            return send(response, 200, { ...head, object: "chat.completion", choices: [{ index: 0, message: { role: "assistant", content: calls.length && !text ? null : text, ...(calls.length ? { tool_calls: calls } : {}) }, finish_reason: finish }], usage });
+        }
+        // Streamed: the role, the text word by word, each call's name then its
+        // arguments in two halves, the finish reason, the usage, [DONE].
+        const chunk = (choices, extra = {}) => `data: ${JSON.stringify({ ...head, object: "chat.completion.chunk", choices, ...extra })}\n\n`;
+        const delta = (d, finishReason = null) => chunk([{ index: 0, delta: d, finish_reason: finishReason }]);
+        const parts = [delta({ role: "assistant", content: "" })];
+        for (const word of text.match(/\S+\s*|\s+/gu) ?? [])
+            parts.push(delta({ content: word }));
+        calls.forEach((c, index) => {
+            const half = Math.ceil(c.function.arguments.length / 2);
+            parts.push(delta({ tool_calls: [{ index, id: c.id, type: "function", function: { name: c.function.name, arguments: "" } }] }));
+            for (const piece of [c.function.arguments.slice(0, half), c.function.arguments.slice(half)])
+                if (piece)
+                    parts.push(delta({ tool_calls: [{ index, function: { arguments: piece } }] }));
+        });
+        parts.push(delta({}, finish), chunk([], { usage }), "data: [DONE]\n\n");
+        response.writeHead(200, { "Content-Type": "text/event-stream", "Cache-Control": "no-cache" });
+        for (const part of parts)
+            response.write(part);
+        response.end();
+    }
+    // The acknowledgment of an erasure the tool was told of (emit).
+    async function erasuresRoute(request, response, url) {
+        if (!receives.includes("member.*"))
+            return send(response, 403, { error: "capability_not_granted" });
+        const done = /^\/erasures\/([^/]+)\/done$/u.exec(url.pathname);
+        if (request.method !== "POST" || !done || url.search)
+            return send(response, 404, { error: "not_found" });
+        const id = done[1];
+        if (!/^era_[a-z2-7]{26}$/u.test(id))
+            return send(response, 400, { error: "invalid_id" });
+        if (!erasures.has(id))
+            return send(response, 404, { error: "erasure_not_found" });
+        if (!chest.acknowledged.includes(id))
+            chest.acknowledged.push(id);
+        send(response, 204);
+    }
+    const server = createServer((request, response) => {
+        const url = new URL(request.url ?? "/", "http://127.0.0.1");
+        const route = url.pathname.startsWith("/erasures/") ? erasuresRoute
+            : url.pathname.startsWith("/ai/") ? aiRoute
+                : url.pathname === "/members" || url.pathname.startsWith("/members/") || url.pathname === "/groups" ? members
+                    : url.pathname === "/files" || url.pathname.startsWith("/files/") ? filesRoute
+                        : url.pathname === "/badges" || url.pathname.startsWith("/badges/") || url.pathname.startsWith("/notifications") ? notificationsRoute : null;
+        if (!route)
+            return send(response, 404, { error: "not_found" });
+        route(request, response, url).catch(() => { if (!response.headersSent)
+            send(response, 503, { error: "unavailable" });
+        else
+            response.destroy(); });
+    });
+    await new Promise(resolve => server.listen(0, "127.0.0.1", resolve));
+    const saved = Object.fromEntries(["CHEST_API", "CHEST_TOKEN", "CHEST_TOOL", "CHEST_ORGANIZATION", "CHEST_TIME_ZONE", "CHEST_LANGUAGE"].map(name => [name, process.env[name]]));
+    chest.api = "http://127.0.0.1:" + server.address().port;
+    Object.assign(process.env, { CHEST_API: chest.api, CHEST_TOKEN: token, CHEST_TOOL: tool, CHEST_ORGANIZATION: options.chest?.organization ?? "Test organization", CHEST_TIME_ZONE: options.chest?.timeZone ?? "UTC", CHEST_LANGUAGE: options.chest?.language ?? "en" });
+    forget();
+    chest.emit = async (event, to) => {
+        const id = event.id ?? "evt_" + Array.from(randomBytes(26), b => "abcdefghijklmnopqrstuvwxyz234567"[b & 31]).join("");
+        const body = JSON.stringify({ id, type: event.type, occurredAt: event.occurredAt ?? new Date().toISOString(), data: event.data });
+        if (event.type === "member.erased")
+            erasures.add(event.data.erasure);
+        const request = new Request(typeof to === "string" ? to.replace(/\/$/u, "") + "/chest-events" : "http://tool.test/chest-events", { method: "POST", headers: { "Content-Type": "application/json", "Chest-Event": signEvent(id, body, { token, tool }) }, body });
+        const answer = typeof to === "string" ? await fetch(request, { redirect: "manual" }) : await to(request);
+        await answer.body?.cancel();
+        return answer.status;
+    };
+    chest.close = async () => {
+        server.closeAllConnections();
+        await new Promise(resolve => server.close(() => resolve()));
+        for (const [name, value] of Object.entries(saved)) {
+            if (value === undefined)
+                delete process.env[name];
+            else
+                process.env[name] = value;
+        }
+        forget();
+    };
+    return chest;
+}
+//# sourceMappingURL=testing.js.map