@copilotkit/aimock 1.14.6 → 1.14.8

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @copilotkit/aimock
 
+## 1.14.8
+
+### Fixed
+
+- `--proxy-only` mode now accepts URL-only `--fixtures` sources without requiring a local
+  filesystem path. Previously the first `--fixtures` value was always checked as a
+  record-destination base path, which rejected all-URL invocations even though proxy-only
+  mode doesn't write recordings to disk. The check now fires only for `--record` mode
+  where a writable destination is actually required. Same fix applied to the parallel
+  `--agui-proxy-only` CLI path. Unblocks the showcase-aimock Railway service which runs
+  aimock in proxy-only mode with remote GitHub raw fixture URLs and no local fallback.
+
+## 1.14.7
+
+### Added
+
+- `--fixtures` now accepts `https://` and `http://` URLs to JSON fixture files in addition to filesystem paths. Fetches at boot, parses, and registers the remote fixture as if loaded from disk. On-disk cache at `~/.cache/aimock/fixtures/<sha256-of-url>/` (honoring `$XDG_CACHE_HOME`) provides resilience against transient upstream failures: with `--validate-on-load`, a fetch failure with a valid cached copy logs a warning and continues; without a cache, the process exits non-zero. HTTP fetch has a hard-coded 10s timeout and a 50 MB body size cap (enforced incrementally so a lying `Content-Length` cannot bypass it). Only `https://` and `http://` schemes are accepted — `file://`, `ftp://`, etc. are rejected with a clear error. The flag is now repeatable; multiple sources are loaded and concatenated. Tarball (`.tar.gz`) and zip URL support intentionally deferred to a future release.
+- Private-address denylist for remote `--fixtures` URLs: fetches to loopback (`127.0.0.0/8`, `::1`), link-local (`169.254.0.0/16`, `fe80::/10`), RFC1918 (`10/8`, `172.16/12`, `192.168/16`), CGNAT (`100.64/10`), cloud-metadata (`169.254.169.254`), ULA (`fc00::/7`), multicast, and other reserved ranges are rejected with a clear fail-loud error. Hostnames are resolved and every returned address is checked. Set `AIMOCK_ALLOW_PRIVATE_URLS=1` to opt out (required for local dev / tests that target `127.0.0.1`).
+- HTTP redirects are rejected (fail-loud) for remote `--fixtures` URLs to prevent scheme-bypass (a 3xx `Location:` pointing at `file://` or `javascript:` would otherwise sidestep the scheme gate and SSRF denylist). Configure the upstream to serve the final URL directly — GitHub raw content URLs already do this.
+
 ## 1.14.6
 
 ### Changed

package/README.md

@@ -82,6 +82,11 @@ See the [GitHub Action docs](https://aimock.copilotkit.dev/github-action) for al
 # LLM mocking only
 npx -p @copilotkit/aimock llmock -p 4010 -f ./fixtures
 
+# Remote fixtures — load JSON from an HTTPS URL (repeatable)
+npx -p @copilotkit/aimock llmock -p 4010 \
+  -f https://raw.githubusercontent.com/acme/mocks/main/openai.json \
+  -f ./fixtures/local-overrides.json
+
 # Full suite from config
 npx @copilotkit/aimock --config aimock.json
 
@@ -98,6 +103,12 @@ docker run -d -p 4010:4010 -v "$(pwd)/fixtures:/fixtures" ghcr.io/copilotkit/aim
 
 > **Note on `llmock` vs `aimock` CLIs.** The `llmock` bin is retained as a compat alias for users of the pre-1.7.0 `@copilotkit/llmock` package. It runs a narrower flag-driven CLI without `--config` or the `convert` subcommand. New projects should use `aimock` (or `npx @copilotkit/aimock`) for full feature support.
 
+### Remote fixture URLs
+
+`--fixtures` accepts `https://` and `http://` URLs pointing at JSON fixture files in addition to filesystem paths, and the flag is repeatable so you can layer remote and local sources in argv order. Fetched fixtures are cached on disk at `~/.cache/aimock/fixtures/<sha256-of-url>/` (honors `$XDG_CACHE_HOME`); when paired with `--validate-on-load`, a fetch failure with a valid cached copy logs a warning and continues — without a cache, the process exits non-zero. HTTP fetches have a 10s timeout and a 50 MB body cap; redirects are rejected fail-loud, so configure your upstream to serve the final URL directly (GitHub raw content URLs already do).
+
+Private and link-local addresses (loopback, RFC1918, CGNAT, cloud metadata, ULA, multicast) are rejected by default to prevent SSRF. For local development or tests that need to hit `127.0.0.1`, opt out with `AIMOCK_ALLOW_PRIVATE_URLS=1`. Tarball and zip URL support is intentionally deferred.
+
 ## Framework Guides
 
 Test your AI agents with aimock — no API keys, no network calls: [LangChain](https://aimock.copilotkit.dev/integrate-langchain) · [CrewAI](https://aimock.copilotkit.dev/integrate-crewai) · [PydanticAI](https://aimock.copilotkit.dev/integrate-pydanticai) · [LlamaIndex](https://aimock.copilotkit.dev/integrate-llamaindex) · [Mastra](https://aimock.copilotkit.dev/integrate-mastra) · [Google ADK](https://aimock.copilotkit.dev/integrate-adk) · [Microsoft Agent Framework](https://aimock.copilotkit.dev/integrate-maf)

package/dist/cli.cjs

@@ -5,6 +5,7 @@ const require_logger = require('./logger.cjs');
 const require_server = require('./server.cjs');
 const require_agui_mock = require('./agui-mock.cjs');
 const require_watcher = require('./watcher.cjs');
+const require_fixtures_remote = require('./fixtures-remote.cjs');
 let node_util = require("node:util");
 let node_path = require("node:path");
 let node_fs = require("node:fs");
@@ -16,7 +17,9 @@ Usage: aimock [options]
 Options:
   -p, --port <number>       Port to listen on (default: 4010)
   -h, --host <string>       Host to bind to (default: 127.0.0.1)
-  -f, --fixtures <path>     Path to fixtures directory or file (default: ./fixtures)
+  -f, --fixtures <value>    Fixture source (repeatable). Accepts:
+                              - filesystem path to a directory or .json file (default: ./fixtures)
+                              - https:// or http:// URL to a .json fixture file
   -l, --latency <ms>        Latency in ms between SSE chunks (default: 0)
   -c, --chunk-size <chars>  Chunk size in characters (default: 20)
   -w, --watch               Watch fixture path for changes and reload
@@ -59,7 +62,7 @@ const { values } = (0, node_util.parseArgs)({
 		fixtures: {
 			type: "string",
 			short: "f",
-			default: "./fixtures"
+			multiple: true
 		},
 		latency: {
 			type: "string",
@@ -143,7 +146,7 @@ const port = Number(values.port);
 const host = values.host;
 const latency = Number(values.latency);
 const chunkSize = Number(values["chunk-size"]);
-const fixturePath = (0, node_path.resolve)(values.fixtures);
+const fixtureValues = values.fixtures && values.fixtures.length > 0 ? values.fixtures : ["./fixtures"];
 const watchMode = values.watch;
 const validateOnLoad = values["validate-on-load"];
 const logLevelStr = values["log-level"];
@@ -228,9 +231,15 @@ if (values.record || values["proxy-only"]) {
 		console.error(`Error: --${values["proxy-only"] ? "proxy-only" : "record"} requires at least one --provider-* flag`);
 		process.exit(1);
 	}
+	const recordBase = fixtureValues[0];
+	const recordBaseIsUrl = /^https?:\/\//i.test(recordBase);
+	if (values.record && recordBaseIsUrl) {
+		console.error(`Error: --record requires a local --fixtures path for the recording destination; got URL ${recordBase}`);
+		process.exit(1);
+	}
 	record = {
 		providers,
-		fixturePath: (0, node_path.resolve)(fixturePath, "recorded"),
+		fixturePath: recordBaseIsUrl ? void 0 : (0, node_path.resolve)(recordBase, "recorded"),
 		proxyOnly: values["proxy-only"]
 	};
 }
@@ -240,10 +249,16 @@ if (values["agui-record"] || values["agui-proxy-only"]) {
 		console.error("Error: --agui-record/--agui-proxy-only requires --agui-upstream");
 		process.exit(1);
 	}
+	const aguiBase = fixtureValues[0];
+	const aguiBaseIsUrl = /^https?:\/\//i.test(aguiBase);
+	if (values["agui-record"] && aguiBaseIsUrl) {
+		console.error(`Error: --agui-record requires a local --fixtures path for the recording destination; got URL ${aguiBase}`);
+		process.exit(1);
+	}
 	const agui = new require_agui_mock.AGUIMock();
 	agui.enableRecording({
 		upstream: values["agui-upstream"],
-		fixturePath: (0, node_path.resolve)(fixturePath, "agui-recorded"),
+		fixturePath: aguiBaseIsUrl ? void 0 : (0, node_path.resolve)(aguiBase, "agui-recorded"),
 		proxyOnly: values["agui-proxy-only"]
 	});
 	aguiMount = {
@@ -251,21 +266,46 @@ if (values["agui-record"] || values["agui-proxy-only"]) {
 		handler: agui
 	};
 }
-async function main() {
-	let isDir;
-	let fixtures;
-	try {
-		isDir = (0, node_fs.statSync)(fixturePath).isDirectory();
-		if (isDir) fixtures = require_fixture_loader.loadFixturesFromDir(fixturePath, logger);
-		else fixtures = require_fixture_loader.loadFixtureFile(fixturePath, logger);
-	} catch (err) {
-		if (err.code === "ENOENT") console.error(`Fixtures path not found: ${fixturePath}`);
-		else {
+async function resolveAllFixtureSources() {
+	const resolved = [];
+	for (const value of fixtureValues) {
+		let local;
+		try {
+			local = await require_fixtures_remote.resolveFixturesValue(value, {
+				validateOnLoad,
+				logger
+			});
+		} catch (err) {
 			const msg = err instanceof Error ? err.message : String(err);
-			console.error(`Failed to load fixtures from ${fixturePath}: ${msg}`);
+			console.error(`Failed to resolve --fixtures value "${value}": ${msg}`);
+			process.exit(1);
+		}
+		if (!local.path) continue;
+		try {
+			const stat = (0, node_fs.statSync)(local.path);
+			resolved.push({
+				source: local.source,
+				path: local.path,
+				isDir: stat.isDirectory()
+			});
+		} catch (err) {
+			if (err.code === "ENOENT") console.error(`Fixtures path not found: ${local.path}`);
+			else {
+				const msg = err instanceof Error ? err.message : String(err);
+				console.error(`Failed to load fixtures from ${local.path}: ${msg}`);
+			}
+			process.exit(1);
 		}
-		process.exit(1);
 	}
+	return resolved;
+}
+function loadSource(source) {
+	return source.isDir ? require_fixture_loader.loadFixturesFromDir(source.path, logger) : require_fixture_loader.loadFixtureFile(source.path, logger);
+}
+async function main() {
+	const sources = await resolveAllFixtureSources();
+	const fixtures = [];
+	for (const src of sources) fixtures.push(...loadSource(src));
 	if (fixtures.length === 0) {
 		if (validateOnLoad || values.strict) {
 			console.error("Error: No fixtures loaded and validation/strict mode is enabled — aborting.");
@@ -273,7 +313,8 @@ async function main() {
 		}
 		console.warn("Warning: No fixtures loaded. The server will return 404 for all requests.");
 	}
-	logger.info(`Loaded ${fixtures.length} fixture(s) from ${fixturePath}`);
+	const sourceLabel = sources.map((s) => s.source).join(", ") || "<none>";
+	logger.info(`Loaded ${fixtures.length} fixture(s) from ${sourceLabel}`);
 	if (validateOnLoad) {
 		const results = require_fixture_loader.validateFixtures(fixtures);
 		const errors = results.filter((r) => r.severity === "error");
@@ -302,12 +343,17 @@ async function main() {
 	logger.info(`aimock server listening on ${instance.url}`);
 	let watcher = null;
 	if (watchMode) {
-		watcher = require_watcher.watchFixtures(fixturePath, fixtures, isDir ? () => require_fixture_loader.loadFixturesFromDir(fixturePath, logger) : () => require_fixture_loader.loadFixtureFile(fixturePath, logger), {
-			logger,
-			validate: validateOnLoad,
-			validateFn: require_fixture_loader.validateFixtures
-		});
-		logger.info(`Watching ${fixturePath} for changes`);
+		const primary = sources[0];
+		if (!primary) logger.warn("--watch requested but no resolvable fixture sources; skipping watcher");
+		else {
+			const loadFn = () => loadSource(primary);
+			watcher = require_watcher.watchFixtures(primary.path, fixtures, loadFn, {
+				logger,
+				validate: validateOnLoad,
+				validateFn: require_fixture_loader.validateFixtures
+			});
+			logger.info(`Watching ${primary.path} for changes`);
+		}
 	}
 	function shutdown() {
 		logger.info("Shutting down...");

package/dist/cli.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"cli.cjs","names":["Logger","AGUIMock","loadFixturesFromDir","loadFixtureFile","validateFixtures","createServer","watchFixtures"],"sources":["../src/cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { parseArgs } from \"node:util\";\nimport { statSync } from \"node:fs\";\nimport { resolve } from \"node:path\";\nimport { createServer } from \"./server.js\";\nimport { loadFixtureFile, loadFixturesFromDir, validateFixtures } from \"./fixture-loader.js\";\nimport { Logger, type LogLevel } from \"./logger.js\";\nimport { watchFixtures } from \"./watcher.js\";\nimport { AGUIMock } from \"./agui-mock.js\";\nimport type { ChaosConfig, RecordConfig } from \"./types.js\";\n\nconst HELP = `\nUsage: aimock [options]\n\nOptions:\n  -p, --port <number>       Port to listen on (default: 4010)\n  -h, --host <string>       Host to bind to (default: 127.0.0.1)\n  -f, --fixtures <path>     Path to fixtures directory or file (default: ./fixtures)\n  -l, --latency <ms>        Latency in ms between SSE chunks (default: 0)\n  -c, --chunk-size <chars>  Chunk size in characters (default: 20)\n  -w, --watch               Watch fixture path for changes and reload\n      --log-level <level>   Log verbosity: silent, info, debug (default: info)\n      --validate-on-load    Validate fixture schemas at startup\n      --metrics             Enable Prometheus metrics at GET /metrics\n      --record              Record mode: proxy unmatched requests and save fixtures\n      --proxy-only          Proxy mode: forward unmatched requests without saving\n      --strict              Strict mode: fail on unmatched requests\n      --journal-max <n>     Max request entries retained in memory (default: 1000, 0 = unbounded)\n      --fixture-counts-max <n>  Max unique testIds retained in fixture match-count map (default: 500, 0 = unbounded)\n      --provider-openai <url>     Upstream URL for OpenAI (used with --record)\n      --provider-anthropic <url>  Upstream URL for Anthropic\n      --provider-gemini <url>     Upstream URL for Gemini\n      --provider-vertexai <url>   Upstream URL for Vertex AI\n      --provider-bedrock <url>    Upstream URL for Bedrock\n      --provider-azure <url>      Upstream URL for Azure OpenAI\n      --provider-ollama <url>     Upstream URL for Ollama\n      --provider-cohere <url>     Upstream URL for Cohere\n      --agui-record              Enable AG-UI recording (proxy unmatched AG-UI requests)\n      --agui-upstream <url>      Upstream AG-UI agent URL (used with --agui-record)\n      --agui-proxy-only          AG-UI proxy mode: forward without saving\n      --chaos-drop <rate>   Probability (0-1) of dropping requests with 500\n      --chaos-malformed <rate>  Probability (0-1) of returning malformed JSON\n      --chaos-disconnect <rate> Probability (0-1) of destroying connection\n      --help                Show this help message\n`.trim();\n\nconst { values } = parseArgs({\n  options: {\n    port: { type: \"string\", short: \"p\", default: \"4010\" },\n    host: { type: \"string\", short: \"h\", default: \"127.0.0.1\" },\n    fixtures: { type: \"string\", short: \"f\", default: \"./fixtures\" },\n    latency: { type: \"string\", short: \"l\", default: \"0\" },\n    \"chunk-size\": { type: \"string\", short: \"c\", default: \"20\" },\n    watch: { type: \"boolean\", short: \"w\", default: false },\n    \"log-level\": { type: \"string\", default: \"info\" },\n    \"validate-on-load\": { type: \"boolean\", default: false },\n    metrics: { type: \"boolean\", default: false },\n    record: { type: \"boolean\", default: false },\n    \"proxy-only\": { type: \"boolean\", default: false },\n    strict: { type: \"boolean\", default: false },\n    \"provider-openai\": { type: \"string\" },\n    \"provider-anthropic\": { type: \"string\" },\n    \"provider-gemini\": { type: \"string\" },\n    \"provider-vertexai\": { type: \"string\" },\n    \"provider-bedrock\": { type: \"string\" },\n    \"provider-azure\": { type: \"string\" },\n    \"provider-ollama\": { type: \"string\" },\n    \"provider-cohere\": { type: \"string\" },\n    \"agui-record\": { type: \"boolean\", default: false },\n    \"agui-upstream\": { type: \"string\" },\n    \"agui-proxy-only\": { type: \"boolean\", default: false },\n    \"chaos-drop\": { type: \"string\" },\n    \"chaos-malformed\": { type: \"string\" },\n    \"chaos-disconnect\": { type: \"string\" },\n    \"journal-max\": { type: \"string\", default: \"1000\" },\n    \"fixture-counts-max\": { type: \"string\", default: \"500\" },\n    help: { type: \"boolean\", default: false },\n  },\n  strict: true,\n});\n\nif (values.help) {\n  console.log(HELP);\n  process.exit(0);\n}\n\nconst port = Number(values.port);\nconst host = values.host!;\nconst latency = Number(values.latency);\nconst chunkSize = Number(values[\"chunk-size\"]);\nconst fixturePath = resolve(values.fixtures!);\nconst watchMode = values.watch!;\nconst validateOnLoad = values[\"validate-on-load\"]!;\nconst logLevelStr = values[\"log-level\"]!;\n\nif (![\"silent\", \"info\", \"debug\"].includes(logLevelStr)) {\n  console.error(`Invalid log-level: ${logLevelStr} (must be silent, info, or debug)`);\n  process.exit(1);\n}\nconst logLevel = logLevelStr as LogLevel;\n\nif (Number.isNaN(port) || port < 0 || port > 65535) {\n  console.error(`Invalid port: ${values.port}`);\n  process.exit(1);\n}\n\nif (Number.isNaN(latency) || latency < 0) {\n  console.error(`Invalid latency: ${values.latency}`);\n  process.exit(1);\n}\n\nif (Number.isNaN(chunkSize) || chunkSize < 1) {\n  console.error(`Invalid chunk-size: ${values[\"chunk-size\"]}`);\n  process.exit(1);\n}\n\nconst journalMax = Number(values[\"journal-max\"]);\nif (Number.isNaN(journalMax) || !Number.isInteger(journalMax) || journalMax < 0) {\n  console.error(\n    `Invalid journal-max: ${values[\"journal-max\"]} (must be a non-negative integer; 0 or omitted = unbounded)`,\n  );\n  process.exit(1);\n}\n\nconst fixtureCountsMaxStr = values[\"fixture-counts-max\"];\nconst fixtureCountsMax = Number(fixtureCountsMaxStr);\nif (Number.isNaN(fixtureCountsMax) || !Number.isInteger(fixtureCountsMax) || fixtureCountsMax < 0) {\n  console.error(\n    `Invalid fixture-counts-max: ${fixtureCountsMaxStr} (must be a non-negative integer; 0 = unbounded)`,\n  );\n  process.exit(1);\n}\n\nconst logger = new Logger(logLevel);\n\n// Parse chaos config from CLI flags\nlet chaos: ChaosConfig | undefined;\n{\n  const dropStr = values[\"chaos-drop\"];\n  const malformedStr = values[\"chaos-malformed\"];\n  const disconnectStr = values[\"chaos-disconnect\"];\n\n  if (dropStr !== undefined || malformedStr !== undefined || disconnectStr !== undefined) {\n    chaos = {};\n    if (dropStr !== undefined) {\n      const val = parseFloat(dropStr);\n      if (isNaN(val) || val < 0 || val > 1) {\n        console.error(`Invalid chaos-drop: ${dropStr} (must be 0-1)`);\n        process.exit(1);\n      }\n      chaos.dropRate = val;\n    }\n    if (malformedStr !== undefined) {\n      const val = parseFloat(malformedStr);\n      if (isNaN(val) || val < 0 || val > 1) {\n        console.error(`Invalid chaos-malformed: ${malformedStr} (must be 0-1)`);\n        process.exit(1);\n      }\n      chaos.malformedRate = val;\n    }\n    if (disconnectStr !== undefined) {\n      const val = parseFloat(disconnectStr);\n      if (isNaN(val) || val < 0 || val > 1) {\n        console.error(`Invalid chaos-disconnect: ${disconnectStr} (must be 0-1)`);\n        process.exit(1);\n      }\n      chaos.disconnectRate = val;\n    }\n  }\n}\n\n// Parse record/proxy config from CLI flags\nlet record: RecordConfig | undefined;\nif (values.record || values[\"proxy-only\"]) {\n  const providers: RecordConfig[\"providers\"] = {};\n  if (values[\"provider-openai\"]) providers.openai = values[\"provider-openai\"];\n  if (values[\"provider-anthropic\"]) providers.anthropic = values[\"provider-anthropic\"];\n  if (values[\"provider-gemini\"]) providers.gemini = values[\"provider-gemini\"];\n  if (values[\"provider-vertexai\"]) providers.vertexai = values[\"provider-vertexai\"];\n  if (values[\"provider-bedrock\"]) providers.bedrock = values[\"provider-bedrock\"];\n  if (values[\"provider-azure\"]) providers.azure = values[\"provider-azure\"];\n  if (values[\"provider-ollama\"]) providers.ollama = values[\"provider-ollama\"];\n  if (values[\"provider-cohere\"]) providers.cohere = values[\"provider-cohere\"];\n\n  if (Object.keys(providers).length === 0) {\n    console.error(\n      `Error: --${values[\"proxy-only\"] ? \"proxy-only\" : \"record\"} requires at least one --provider-* flag`,\n    );\n    process.exit(1);\n  }\n\n  record = {\n    providers,\n    fixturePath: resolve(fixturePath, \"recorded\"),\n    proxyOnly: values[\"proxy-only\"],\n  };\n}\n\n// Parse AG-UI record/proxy config from CLI flags\nlet aguiMount: { path: string; handler: AGUIMock } | undefined;\nif (values[\"agui-record\"] || values[\"agui-proxy-only\"]) {\n  if (!values[\"agui-upstream\"]) {\n    console.error(\"Error: --agui-record/--agui-proxy-only requires --agui-upstream\");\n    process.exit(1);\n  }\n  const agui = new AGUIMock();\n  agui.enableRecording({\n    upstream: values[\"agui-upstream\"],\n    fixturePath: resolve(fixturePath, \"agui-recorded\"),\n    proxyOnly: values[\"agui-proxy-only\"],\n  });\n  aguiMount = { path: \"/agui\", handler: agui };\n}\n\nasync function main() {\n  // Load fixtures from path (detect file vs directory)\n  let isDir: boolean;\n  let fixtures;\n  try {\n    const stat = statSync(fixturePath);\n    isDir = stat.isDirectory();\n    if (isDir) {\n      fixtures = loadFixturesFromDir(fixturePath, logger);\n    } else {\n      fixtures = loadFixtureFile(fixturePath, logger);\n    }\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") {\n      console.error(`Fixtures path not found: ${fixturePath}`);\n    } else {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.error(`Failed to load fixtures from ${fixturePath}: ${msg}`);\n    }\n    process.exit(1);\n  }\n\n  if (fixtures.length === 0) {\n    if (validateOnLoad || values.strict) {\n      console.error(\"Error: No fixtures loaded and validation/strict mode is enabled — aborting.\");\n      process.exit(1);\n    }\n    console.warn(\"Warning: No fixtures loaded. The server will return 404 for all requests.\");\n  }\n\n  logger.info(`Loaded ${fixtures.length} fixture(s) from ${fixturePath}`);\n\n  // Validate fixtures if requested\n  if (validateOnLoad) {\n    const results = validateFixtures(fixtures);\n    const errors = results.filter((r) => r.severity === \"error\");\n    const warnings = results.filter((r) => r.severity === \"warning\");\n\n    for (const w of warnings) {\n      logger.warn(`Fixture ${w.fixtureIndex}: ${w.message}`);\n    }\n    for (const e of errors) {\n      logger.error(`Fixture ${e.fixtureIndex}: ${e.message}`);\n    }\n\n    if (errors.length > 0) {\n      console.error(`Validation failed: ${errors.length} error(s), ${warnings.length} warning(s)`);\n      process.exit(1);\n    }\n  }\n\n  const mounts = aguiMount ? [aguiMount] : undefined;\n\n  const instance = await createServer(\n    fixtures,\n    {\n      port,\n      host,\n      latency,\n      chunkSize,\n      logLevel,\n      chaos,\n      metrics: values.metrics,\n      record,\n      strict: values.strict,\n      journalMaxEntries: journalMax,\n      fixtureCountsMaxTestIds: fixtureCountsMax,\n    },\n    mounts,\n  );\n\n  logger.info(`aimock server listening on ${instance.url}`);\n\n  // Start file watcher if requested\n  let watcher: { close: () => void } | null = null;\n  if (watchMode) {\n    const loadFn = isDir!\n      ? () => loadFixturesFromDir(fixturePath, logger)\n      : () => loadFixtureFile(fixturePath, logger);\n\n    watcher = watchFixtures(fixturePath, fixtures, loadFn, {\n      logger,\n      validate: validateOnLoad,\n      validateFn: validateFixtures,\n    });\n    logger.info(`Watching ${fixturePath} for changes`);\n  }\n\n  function shutdown() {\n    logger.info(\"Shutting down...\");\n    if (watcher) watcher.close();\n    instance.server.close(() => {\n      process.exit(0);\n    });\n  }\n\n  process.on(\"SIGINT\", shutdown);\n  process.on(\"SIGTERM\", shutdown);\n}\n\nmain().catch((err) => {\n  console.error(err);\n  process.exit(1);\n});\n"],"mappings":";;;;;;;;;;;;AAWA,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiCX,MAAM;AAER,MAAM,EAAE,oCAAqB;CAC3B,SAAS;EACP,MAAM;GAAE,MAAM;GAAU,OAAO;GAAK,SAAS;GAAQ;EACrD,MAAM;GAAE,MAAM;GAAU,OAAO;GAAK,SAAS;GAAa;EAC1D,UAAU;GAAE,MAAM;GAAU,OAAO;GAAK,SAAS;GAAc;EAC/D,SAAS;GAAE,MAAM;GAAU,OAAO;GAAK,SAAS;GAAK;EACrD,cAAc;GAAE,MAAM;GAAU,OAAO;GAAK,SAAS;GAAM;EAC3D,OAAO;GAAE,MAAM;GAAW,OAAO;GAAK,SAAS;GAAO;EACtD,aAAa;GAAE,MAAM;GAAU,SAAS;GAAQ;EAChD,oBAAoB;GAAE,MAAM;GAAW,SAAS;GAAO;EACvD,SAAS;GAAE,MAAM;GAAW,SAAS;GAAO;EAC5C,QAAQ;GAAE,MAAM;GAAW,SAAS;GAAO;EAC3C,cAAc;GAAE,MAAM;GAAW,SAAS;GAAO;EACjD,QAAQ;GAAE,MAAM;GAAW,SAAS;GAAO;EAC3C,mBAAmB,EAAE,MAAM,UAAU;EACrC,sBAAsB,EAAE,MAAM,UAAU;EACxC,mBAAmB,EAAE,MAAM,UAAU;EACrC,qBAAqB,EAAE,MAAM,UAAU;EACvC,oBAAoB,EAAE,MAAM,UAAU;EACtC,kBAAkB,EAAE,MAAM,UAAU;EACpC,mBAAmB,EAAE,MAAM,UAAU;EACrC,mBAAmB,EAAE,MAAM,UAAU;EACrC,eAAe;GAAE,MAAM;GAAW,SAAS;GAAO;EAClD,iBAAiB,EAAE,MAAM,UAAU;EACnC,mBAAmB;GAAE,MAAM;GAAW,SAAS;GAAO;EACtD,cAAc,EAAE,MAAM,UAAU;EAChC,mBAAmB,EAAE,MAAM,UAAU;EACrC,oBAAoB,EAAE,MAAM,UAAU;EACtC,eAAe;GAAE,MAAM;GAAU,SAAS;GAAQ;EAClD,sBAAsB;GAAE,MAAM;GAAU,SAAS;GAAO;EACxD,MAAM;GAAE,MAAM;GAAW,SAAS;GAAO;EAC1C;CACD,QAAQ;CACT,CAAC;AAEF,IAAI,OAAO,MAAM;AACf,SAAQ,IAAI,KAAK;AACjB,SAAQ,KAAK,EAAE;;AAGjB,MAAM,OAAO,OAAO,OAAO,KAAK;AAChC,MAAM,OAAO,OAAO;AACpB,MAAM,UAAU,OAAO,OAAO,QAAQ;AACtC,MAAM,YAAY,OAAO,OAAO,cAAc;AAC9C,MAAM,qCAAsB,OAAO,SAAU;AAC7C,MAAM,YAAY,OAAO;AACzB,MAAM,iBAAiB,OAAO;AAC9B,MAAM,cAAc,OAAO;AAE3B,IAAI,CAAC;CAAC;CAAU;CAAQ;CAAQ,CAAC,SAAS,YAAY,EAAE;AACtD,SAAQ,MAAM,sBAAsB,YAAY,mCAAmC;AACnF,SAAQ,KAAK,EAAE;;AAEjB,MAAM,WAAW;AAEjB,IAAI,OAAO,MAAM,KAAK,IAAI,OAAO,KAAK,OAAO,OAAO;AAClD,SAAQ,MAAM,iBAAiB,OAAO,OAAO;AAC7C,SAAQ,KAAK,EAAE;;AAGjB,IAAI,OAAO,MAAM,QAAQ,IAAI,UAAU,GAAG;AACxC,SAAQ,MAAM,oBAAoB,OAAO,UAAU;AACnD,SAAQ,KAAK,EAAE;;AAGjB,IAAI,OAAO,MAAM,UAAU,IAAI,YAAY,GAAG;AAC5C,SAAQ,MAAM,uBAAuB,OAAO,gBAAgB;AAC5D,SAAQ,KAAK,EAAE;;AAGjB,MAAM,aAAa,OAAO,OAAO,eAAe;AAChD,IAAI,OAAO,MAAM,WAAW,IAAI,CAAC,OAAO,UAAU,WAAW,IAAI,aAAa,GAAG;AAC/E,SAAQ,MACN,wBAAwB,OAAO,eAAe,6DAC/C;AACD,SAAQ,KAAK,EAAE;;AAGjB,MAAM,sBAAsB,OAAO;AACnC,MAAM,mBAAmB,OAAO,oBAAoB;AACpD,IAAI,OAAO,MAAM,iBAAiB,IAAI,CAAC,OAAO,UAAU,iBAAiB,IAAI,mBAAmB,GAAG;AACjG,SAAQ,MACN,+BAA+B,oBAAoB,kDACpD;AACD,SAAQ,KAAK,EAAE;;AAGjB,MAAM,SAAS,IAAIA,sBAAO,SAAS;AAGnC,IAAI;AACJ;CACE,MAAM,UAAU,OAAO;CACvB,MAAM,eAAe,OAAO;CAC5B,MAAM,gBAAgB,OAAO;AAE7B,KAAI,YAAY,UAAa,iBAAiB,UAAa,kBAAkB,QAAW;AACtF,UAAQ,EAAE;AACV,MAAI,YAAY,QAAW;GACzB,MAAM,MAAM,WAAW,QAAQ;AAC/B,OAAI,MAAM,IAAI,IAAI,MAAM,KAAK,MAAM,GAAG;AACpC,YAAQ,MAAM,uBAAuB,QAAQ,gBAAgB;AAC7D,YAAQ,KAAK,EAAE;;AAEjB,SAAM,WAAW;;AAEnB,MAAI,iBAAiB,QAAW;GAC9B,MAAM,MAAM,WAAW,aAAa;AACpC,OAAI,MAAM,IAAI,IAAI,MAAM,KAAK,MAAM,GAAG;AACpC,YAAQ,MAAM,4BAA4B,aAAa,gBAAgB;AACvE,YAAQ,KAAK,EAAE;;AAEjB,SAAM,gBAAgB;;AAExB,MAAI,kBAAkB,QAAW;GAC/B,MAAM,MAAM,WAAW,cAAc;AACrC,OAAI,MAAM,IAAI,IAAI,MAAM,KAAK,MAAM,GAAG;AACpC,YAAQ,MAAM,6BAA6B,cAAc,gBAAgB;AACzE,YAAQ,KAAK,EAAE;;AAEjB,SAAM,iBAAiB;;;;AAM7B,IAAI;AACJ,IAAI,OAAO,UAAU,OAAO,eAAe;CACzC,MAAM,YAAuC,EAAE;AAC/C,KAAI,OAAO,mBAAoB,WAAU,SAAS,OAAO;AACzD,KAAI,OAAO,sBAAuB,WAAU,YAAY,OAAO;AAC/D,KAAI,OAAO,mBAAoB,WAAU,SAAS,OAAO;AACzD,KAAI,OAAO,qBAAsB,WAAU,WAAW,OAAO;AAC7D,KAAI,OAAO,oBAAqB,WAAU,UAAU,OAAO;AAC3D,KAAI,OAAO,kBAAmB,WAAU,QAAQ,OAAO;AACvD,KAAI,OAAO,mBAAoB,WAAU,SAAS,OAAO;AACzD,KAAI,OAAO,mBAAoB,WAAU,SAAS,OAAO;AAEzD,KAAI,OAAO,KAAK,UAAU,CAAC,WAAW,GAAG;AACvC,UAAQ,MACN,YAAY,OAAO,gBAAgB,eAAe,SAAS,0CAC5D;AACD,UAAQ,KAAK,EAAE;;AAGjB,UAAS;EACP;EACA,oCAAqB,aAAa,WAAW;EAC7C,WAAW,OAAO;EACnB;;AAIH,IAAI;AACJ,IAAI,OAAO,kBAAkB,OAAO,oBAAoB;AACtD,KAAI,CAAC,OAAO,kBAAkB;AAC5B,UAAQ,MAAM,kEAAkE;AAChF,UAAQ,KAAK,EAAE;;CAEjB,MAAM,OAAO,IAAIC,4BAAU;AAC3B,MAAK,gBAAgB;EACnB,UAAU,OAAO;EACjB,oCAAqB,aAAa,gBAAgB;EAClD,WAAW,OAAO;EACnB,CAAC;AACF,aAAY;EAAE,MAAM;EAAS,SAAS;EAAM;;AAG9C,eAAe,OAAO;CAEpB,IAAI;CACJ,IAAI;AACJ,KAAI;AAEF,gCADsB,YAAY,CACrB,aAAa;AAC1B,MAAI,MACF,YAAWC,2CAAoB,aAAa,OAAO;MAEnD,YAAWC,uCAAgB,aAAa,OAAO;UAE1C,KAAK;AACZ,MAAK,IAA8B,SAAS,SAC1C,SAAQ,MAAM,4BAA4B,cAAc;OACnD;GACL,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,WAAQ,MAAM,gCAAgC,YAAY,IAAI,MAAM;;AAEtE,UAAQ,KAAK,EAAE;;AAGjB,KAAI,SAAS,WAAW,GAAG;AACzB,MAAI,kBAAkB,OAAO,QAAQ;AACnC,WAAQ,MAAM,8EAA8E;AAC5F,WAAQ,KAAK,EAAE;;AAEjB,UAAQ,KAAK,4EAA4E;;AAG3F,QAAO,KAAK,UAAU,SAAS,OAAO,mBAAmB,cAAc;AAGvE,KAAI,gBAAgB;EAClB,MAAM,UAAUC,wCAAiB,SAAS;EAC1C,MAAM,SAAS,QAAQ,QAAQ,MAAM,EAAE,aAAa,QAAQ;EAC5D,MAAM,WAAW,QAAQ,QAAQ,MAAM,EAAE,aAAa,UAAU;AAEhE,OAAK,MAAM,KAAK,SACd,QAAO,KAAK,WAAW,EAAE,aAAa,IAAI,EAAE,UAAU;AAExD,OAAK,MAAM,KAAK,OACd,QAAO,MAAM,WAAW,EAAE,aAAa,IAAI,EAAE,UAAU;AAGzD,MAAI,OAAO,SAAS,GAAG;AACrB,WAAQ,MAAM,sBAAsB,OAAO,OAAO,aAAa,SAAS,OAAO,aAAa;AAC5F,WAAQ,KAAK,EAAE;;;CAInB,MAAM,SAAS,YAAY,CAAC,UAAU,GAAG;CAEzC,MAAM,WAAW,MAAMC,4BACrB,UACA;EACE;EACA;EACA;EACA;EACA;EACA;EACA,SAAS,OAAO;EAChB;EACA,QAAQ,OAAO;EACf,mBAAmB;EACnB,yBAAyB;EAC1B,EACD,OACD;AAED,QAAO,KAAK,8BAA8B,SAAS,MAAM;CAGzD,IAAI,UAAwC;AAC5C,KAAI,WAAW;AAKb,YAAUC,8BAAc,aAAa,UAJtB,cACLJ,2CAAoB,aAAa,OAAO,SACxCC,uCAAgB,aAAa,OAAO,EAES;GACrD;GACA,UAAU;GACV,YAAYC;GACb,CAAC;AACF,SAAO,KAAK,YAAY,YAAY,cAAc;;CAGpD,SAAS,WAAW;AAClB,SAAO,KAAK,mBAAmB;AAC/B,MAAI,QAAS,SAAQ,OAAO;AAC5B,WAAS,OAAO,YAAY;AAC1B,WAAQ,KAAK,EAAE;IACf;;AAGJ,SAAQ,GAAG,UAAU,SAAS;AAC9B,SAAQ,GAAG,WAAW,SAAS;;AAGjC,MAAM,CAAC,OAAO,QAAQ;AACpB,SAAQ,MAAM,IAAI;AAClB,SAAQ,KAAK,EAAE;EACf"}
+{"version":3,"file":"cli.cjs","names":["Logger","AGUIMock","resolveFixturesValue","loadFixturesFromDir","loadFixtureFile","validateFixtures","createServer","watchFixtures"],"sources":["../src/cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { parseArgs } from \"node:util\";\nimport { statSync } from \"node:fs\";\nimport { resolve } from \"node:path\";\nimport { createServer } from \"./server.js\";\nimport { loadFixtureFile, loadFixturesFromDir, validateFixtures } from \"./fixture-loader.js\";\nimport { Logger, type LogLevel } from \"./logger.js\";\nimport { watchFixtures } from \"./watcher.js\";\nimport { AGUIMock } from \"./agui-mock.js\";\nimport { resolveFixturesValue } from \"./fixtures-remote.js\";\nimport type { Fixture, ChaosConfig, RecordConfig } from \"./types.js\";\n\nconst HELP = `\nUsage: aimock [options]\n\nOptions:\n  -p, --port <number>       Port to listen on (default: 4010)\n  -h, --host <string>       Host to bind to (default: 127.0.0.1)\n  -f, --fixtures <value>    Fixture source (repeatable). Accepts:\n                              - filesystem path to a directory or .json file (default: ./fixtures)\n                              - https:// or http:// URL to a .json fixture file\n  -l, --latency <ms>        Latency in ms between SSE chunks (default: 0)\n  -c, --chunk-size <chars>  Chunk size in characters (default: 20)\n  -w, --watch               Watch fixture path for changes and reload\n      --log-level <level>   Log verbosity: silent, info, debug (default: info)\n      --validate-on-load    Validate fixture schemas at startup\n      --metrics             Enable Prometheus metrics at GET /metrics\n      --record              Record mode: proxy unmatched requests and save fixtures\n      --proxy-only          Proxy mode: forward unmatched requests without saving\n      --strict              Strict mode: fail on unmatched requests\n      --journal-max <n>     Max request entries retained in memory (default: 1000, 0 = unbounded)\n      --fixture-counts-max <n>  Max unique testIds retained in fixture match-count map (default: 500, 0 = unbounded)\n      --provider-openai <url>     Upstream URL for OpenAI (used with --record)\n      --provider-anthropic <url>  Upstream URL for Anthropic\n      --provider-gemini <url>     Upstream URL for Gemini\n      --provider-vertexai <url>   Upstream URL for Vertex AI\n      --provider-bedrock <url>    Upstream URL for Bedrock\n      --provider-azure <url>      Upstream URL for Azure OpenAI\n      --provider-ollama <url>     Upstream URL for Ollama\n      --provider-cohere <url>     Upstream URL for Cohere\n      --agui-record              Enable AG-UI recording (proxy unmatched AG-UI requests)\n      --agui-upstream <url>      Upstream AG-UI agent URL (used with --agui-record)\n      --agui-proxy-only          AG-UI proxy mode: forward without saving\n      --chaos-drop <rate>   Probability (0-1) of dropping requests with 500\n      --chaos-malformed <rate>  Probability (0-1) of returning malformed JSON\n      --chaos-disconnect <rate> Probability (0-1) of destroying connection\n      --help                Show this help message\n`.trim();\n\nconst { values } = parseArgs({\n  options: {\n    port: { type: \"string\", short: \"p\", default: \"4010\" },\n    host: { type: \"string\", short: \"h\", default: \"127.0.0.1\" },\n    fixtures: { type: \"string\", short: \"f\", multiple: true },\n    latency: { type: \"string\", short: \"l\", default: \"0\" },\n    \"chunk-size\": { type: \"string\", short: \"c\", default: \"20\" },\n    watch: { type: \"boolean\", short: \"w\", default: false },\n    \"log-level\": { type: \"string\", default: \"info\" },\n    \"validate-on-load\": { type: \"boolean\", default: false },\n    metrics: { type: \"boolean\", default: false },\n    record: { type: \"boolean\", default: false },\n    \"proxy-only\": { type: \"boolean\", default: false },\n    strict: { type: \"boolean\", default: false },\n    \"provider-openai\": { type: \"string\" },\n    \"provider-anthropic\": { type: \"string\" },\n    \"provider-gemini\": { type: \"string\" },\n    \"provider-vertexai\": { type: \"string\" },\n    \"provider-bedrock\": { type: \"string\" },\n    \"provider-azure\": { type: \"string\" },\n    \"provider-ollama\": { type: \"string\" },\n    \"provider-cohere\": { type: \"string\" },\n    \"agui-record\": { type: \"boolean\", default: false },\n    \"agui-upstream\": { type: \"string\" },\n    \"agui-proxy-only\": { type: \"boolean\", default: false },\n    \"chaos-drop\": { type: \"string\" },\n    \"chaos-malformed\": { type: \"string\" },\n    \"chaos-disconnect\": { type: \"string\" },\n    \"journal-max\": { type: \"string\", default: \"1000\" },\n    \"fixture-counts-max\": { type: \"string\", default: \"500\" },\n    help: { type: \"boolean\", default: false },\n  },\n  strict: true,\n});\n\nif (values.help) {\n  console.log(HELP);\n  process.exit(0);\n}\n\nconst port = Number(values.port);\nconst host = values.host!;\nconst latency = Number(values.latency);\nconst chunkSize = Number(values[\"chunk-size\"]);\nconst fixtureValues: string[] =\n  values.fixtures && values.fixtures.length > 0 ? values.fixtures : [\"./fixtures\"];\nconst watchMode = values.watch!;\nconst validateOnLoad = values[\"validate-on-load\"]!;\nconst logLevelStr = values[\"log-level\"]!;\n\nif (![\"silent\", \"info\", \"debug\"].includes(logLevelStr)) {\n  console.error(`Invalid log-level: ${logLevelStr} (must be silent, info, or debug)`);\n  process.exit(1);\n}\nconst logLevel = logLevelStr as LogLevel;\n\nif (Number.isNaN(port) || port < 0 || port > 65535) {\n  console.error(`Invalid port: ${values.port}`);\n  process.exit(1);\n}\n\nif (Number.isNaN(latency) || latency < 0) {\n  console.error(`Invalid latency: ${values.latency}`);\n  process.exit(1);\n}\n\nif (Number.isNaN(chunkSize) || chunkSize < 1) {\n  console.error(`Invalid chunk-size: ${values[\"chunk-size\"]}`);\n  process.exit(1);\n}\n\nconst journalMax = Number(values[\"journal-max\"]);\nif (Number.isNaN(journalMax) || !Number.isInteger(journalMax) || journalMax < 0) {\n  console.error(\n    `Invalid journal-max: ${values[\"journal-max\"]} (must be a non-negative integer; 0 or omitted = unbounded)`,\n  );\n  process.exit(1);\n}\n\nconst fixtureCountsMaxStr = values[\"fixture-counts-max\"];\nconst fixtureCountsMax = Number(fixtureCountsMaxStr);\nif (Number.isNaN(fixtureCountsMax) || !Number.isInteger(fixtureCountsMax) || fixtureCountsMax < 0) {\n  console.error(\n    `Invalid fixture-counts-max: ${fixtureCountsMaxStr} (must be a non-negative integer; 0 = unbounded)`,\n  );\n  process.exit(1);\n}\n\nconst logger = new Logger(logLevel);\n\n// Parse chaos config from CLI flags\nlet chaos: ChaosConfig | undefined;\n{\n  const dropStr = values[\"chaos-drop\"];\n  const malformedStr = values[\"chaos-malformed\"];\n  const disconnectStr = values[\"chaos-disconnect\"];\n\n  if (dropStr !== undefined || malformedStr !== undefined || disconnectStr !== undefined) {\n    chaos = {};\n    if (dropStr !== undefined) {\n      const val = parseFloat(dropStr);\n      if (isNaN(val) || val < 0 || val > 1) {\n        console.error(`Invalid chaos-drop: ${dropStr} (must be 0-1)`);\n        process.exit(1);\n      }\n      chaos.dropRate = val;\n    }\n    if (malformedStr !== undefined) {\n      const val = parseFloat(malformedStr);\n      if (isNaN(val) || val < 0 || val > 1) {\n        console.error(`Invalid chaos-malformed: ${malformedStr} (must be 0-1)`);\n        process.exit(1);\n      }\n      chaos.malformedRate = val;\n    }\n    if (disconnectStr !== undefined) {\n      const val = parseFloat(disconnectStr);\n      if (isNaN(val) || val < 0 || val > 1) {\n        console.error(`Invalid chaos-disconnect: ${disconnectStr} (must be 0-1)`);\n        process.exit(1);\n      }\n      chaos.disconnectRate = val;\n    }\n  }\n}\n\n// Parse record/proxy config from CLI flags\nlet record: RecordConfig | undefined;\nif (values.record || values[\"proxy-only\"]) {\n  const providers: RecordConfig[\"providers\"] = {};\n  if (values[\"provider-openai\"]) providers.openai = values[\"provider-openai\"];\n  if (values[\"provider-anthropic\"]) providers.anthropic = values[\"provider-anthropic\"];\n  if (values[\"provider-gemini\"]) providers.gemini = values[\"provider-gemini\"];\n  if (values[\"provider-vertexai\"]) providers.vertexai = values[\"provider-vertexai\"];\n  if (values[\"provider-bedrock\"]) providers.bedrock = values[\"provider-bedrock\"];\n  if (values[\"provider-azure\"]) providers.azure = values[\"provider-azure\"];\n  if (values[\"provider-ollama\"]) providers.ollama = values[\"provider-ollama\"];\n  if (values[\"provider-cohere\"]) providers.cohere = values[\"provider-cohere\"];\n\n  if (Object.keys(providers).length === 0) {\n    console.error(\n      `Error: --${values[\"proxy-only\"] ? \"proxy-only\" : \"record\"} requires at least one --provider-* flag`,\n    );\n    process.exit(1);\n  }\n\n  // For --record, the first --fixtures value is the base path for the recording\n  // destination and must be a local filesystem path — writing to a URL is not supported.\n  // For --proxy-only, unmatched requests are forwarded without saving, so no writable\n  // destination is required; URL-only --fixtures is valid in that mode.\n  const recordBase = fixtureValues[0];\n  const recordBaseIsUrl = /^https?:\\/\\//i.test(recordBase);\n  if (values.record && recordBaseIsUrl) {\n    console.error(\n      `Error: --record requires a local --fixtures path for the recording destination; got URL ${recordBase}`,\n    );\n    process.exit(1);\n  }\n  record = {\n    providers,\n    // In proxy-only mode with only URL sources, fixturePath is never consumed\n    // (recorder.ts skips disk writes when proxyOnly is set). Leave it undefined\n    // rather than resolving a URL string as a filesystem path.\n    fixturePath: recordBaseIsUrl ? undefined : resolve(recordBase, \"recorded\"),\n    proxyOnly: values[\"proxy-only\"],\n  };\n}\n\n// Parse AG-UI record/proxy config from CLI flags\nlet aguiMount: { path: string; handler: AGUIMock } | undefined;\nif (values[\"agui-record\"] || values[\"agui-proxy-only\"]) {\n  if (!values[\"agui-upstream\"]) {\n    console.error(\"Error: --agui-record/--agui-proxy-only requires --agui-upstream\");\n    process.exit(1);\n  }\n  // --agui-record writes recorded AG-UI fixtures to disk, so a URL source is unsupported.\n  // --agui-proxy-only forwards without saving, so URL-only --fixtures is valid.\n  const aguiBase = fixtureValues[0];\n  const aguiBaseIsUrl = /^https?:\\/\\//i.test(aguiBase);\n  if (values[\"agui-record\"] && aguiBaseIsUrl) {\n    console.error(\n      `Error: --agui-record requires a local --fixtures path for the recording destination; got URL ${aguiBase}`,\n    );\n    process.exit(1);\n  }\n  const agui = new AGUIMock();\n  agui.enableRecording({\n    upstream: values[\"agui-upstream\"],\n    // In proxy-only mode with a URL-only --fixtures, the AG-UI recorder never\n    // writes to disk (see agui-recorder.ts). Leave fixturePath undefined rather\n    // than resolving a URL as a filesystem path.\n    fixturePath: aguiBaseIsUrl ? undefined : resolve(aguiBase, \"agui-recorded\"),\n    proxyOnly: values[\"agui-proxy-only\"],\n  });\n  aguiMount = { path: \"/agui\", handler: agui };\n}\n\ninterface ResolvedFixtureSource {\n  source: string;\n  path: string;\n  isDir: boolean;\n}\n\nasync function resolveAllFixtureSources(): Promise<ResolvedFixtureSource[]> {\n  const resolved: ResolvedFixtureSource[] = [];\n  for (const value of fixtureValues) {\n    let local;\n    try {\n      local = await resolveFixturesValue(value, {\n        validateOnLoad,\n        logger,\n      });\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.error(`Failed to resolve --fixtures value \"${value}\": ${msg}`);\n      process.exit(1);\n    }\n    if (!local.path) {\n      // Remote fetch failed without validate-on-load and no cache — already warned; skip.\n      continue;\n    }\n    try {\n      const stat = statSync(local.path);\n      resolved.push({ source: local.source, path: local.path, isDir: stat.isDirectory() });\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === \"ENOENT\") {\n        console.error(`Fixtures path not found: ${local.path}`);\n      } else {\n        const msg = err instanceof Error ? err.message : String(err);\n        console.error(`Failed to load fixtures from ${local.path}: ${msg}`);\n      }\n      process.exit(1);\n    }\n  }\n  return resolved;\n}\n\nfunction loadSource(source: ResolvedFixtureSource): Fixture[] {\n  return source.isDir\n    ? loadFixturesFromDir(source.path, logger)\n    : loadFixtureFile(source.path, logger);\n}\n\nasync function main() {\n  const sources = await resolveAllFixtureSources();\n\n  const fixtures: Fixture[] = [];\n  for (const src of sources) {\n    fixtures.push(...loadSource(src));\n  }\n\n  if (fixtures.length === 0) {\n    if (validateOnLoad || values.strict) {\n      console.error(\"Error: No fixtures loaded and validation/strict mode is enabled — aborting.\");\n      process.exit(1);\n    }\n    console.warn(\"Warning: No fixtures loaded. The server will return 404 for all requests.\");\n  }\n\n  const sourceLabel = sources.map((s) => s.source).join(\", \") || \"<none>\";\n  logger.info(`Loaded ${fixtures.length} fixture(s) from ${sourceLabel}`);\n\n  // Validate fixtures if requested\n  if (validateOnLoad) {\n    const results = validateFixtures(fixtures);\n    const errors = results.filter((r) => r.severity === \"error\");\n    const warnings = results.filter((r) => r.severity === \"warning\");\n\n    for (const w of warnings) {\n      logger.warn(`Fixture ${w.fixtureIndex}: ${w.message}`);\n    }\n    for (const e of errors) {\n      logger.error(`Fixture ${e.fixtureIndex}: ${e.message}`);\n    }\n\n    if (errors.length > 0) {\n      console.error(`Validation failed: ${errors.length} error(s), ${warnings.length} warning(s)`);\n      process.exit(1);\n    }\n  }\n\n  const mounts = aguiMount ? [aguiMount] : undefined;\n\n  const instance = await createServer(\n    fixtures,\n    {\n      port,\n      host,\n      latency,\n      chunkSize,\n      logLevel,\n      chaos,\n      metrics: values.metrics,\n      record,\n      strict: values.strict,\n      journalMaxEntries: journalMax,\n      fixtureCountsMaxTestIds: fixtureCountsMax,\n    },\n    mounts,\n  );\n\n  logger.info(`aimock server listening on ${instance.url}`);\n\n  // Start file watcher if requested. Only the first local source is watched —\n  // remote URL sources are fetched once at boot and are not monitored.\n  let watcher: { close: () => void } | null = null;\n  if (watchMode) {\n    const primary = sources[0];\n    if (!primary) {\n      logger.warn(\"--watch requested but no resolvable fixture sources; skipping watcher\");\n    } else {\n      const loadFn = (): Fixture[] => loadSource(primary);\n      watcher = watchFixtures(primary.path, fixtures, loadFn, {\n        logger,\n        validate: validateOnLoad,\n        validateFn: validateFixtures,\n      });\n      logger.info(`Watching ${primary.path} for changes`);\n    }\n  }\n\n  function shutdown() {\n    logger.info(\"Shutting down...\");\n    if (watcher) watcher.close();\n    instance.server.close(() => {\n      process.exit(0);\n    });\n  }\n\n  process.on(\"SIGINT\", shutdown);\n  process.on(\"SIGTERM\", shutdown);\n}\n\nmain().catch((err) => {\n  console.error(err);\n  process.exit(1);\n});\n"],"mappings":";;;;;;;;;;;;;AAYA,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmCX,MAAM;AAER,MAAM,EAAE,oCAAqB;CAC3B,SAAS;EACP,MAAM;GAAE,MAAM;GAAU,OAAO;GAAK,SAAS;GAAQ;EACrD,MAAM;GAAE,MAAM;GAAU,OAAO;GAAK,SAAS;GAAa;EAC1D,UAAU;GAAE,MAAM;GAAU,OAAO;GAAK,UAAU;GAAM;EACxD,SAAS;GAAE,MAAM;GAAU,OAAO;GAAK,SAAS;GAAK;EACrD,cAAc;GAAE,MAAM;GAAU,OAAO;GAAK,SAAS;GAAM;EAC3D,OAAO;GAAE,MAAM;GAAW,OAAO;GAAK,SAAS;GAAO;EACtD,aAAa;GAAE,MAAM;GAAU,SAAS;GAAQ;EAChD,oBAAoB;GAAE,MAAM;GAAW,SAAS;GAAO;EACvD,SAAS;GAAE,MAAM;GAAW,SAAS;GAAO;EAC5C,QAAQ;GAAE,MAAM;GAAW,SAAS;GAAO;EAC3C,cAAc;GAAE,MAAM;GAAW,SAAS;GAAO;EACjD,QAAQ;GAAE,MAAM;GAAW,SAAS;GAAO;EAC3C,mBAAmB,EAAE,MAAM,UAAU;EACrC,sBAAsB,EAAE,MAAM,UAAU;EACxC,mBAAmB,EAAE,MAAM,UAAU;EACrC,qBAAqB,EAAE,MAAM,UAAU;EACvC,oBAAoB,EAAE,MAAM,UAAU;EACtC,kBAAkB,EAAE,MAAM,UAAU;EACpC,mBAAmB,EAAE,MAAM,UAAU;EACrC,mBAAmB,EAAE,MAAM,UAAU;EACrC,eAAe;GAAE,MAAM;GAAW,SAAS;GAAO;EAClD,iBAAiB,EAAE,MAAM,UAAU;EACnC,mBAAmB;GAAE,MAAM;GAAW,SAAS;GAAO;EACtD,cAAc,EAAE,MAAM,UAAU;EAChC,mBAAmB,EAAE,MAAM,UAAU;EACrC,oBAAoB,EAAE,MAAM,UAAU;EACtC,eAAe;GAAE,MAAM;GAAU,SAAS;GAAQ;EAClD,sBAAsB;GAAE,MAAM;GAAU,SAAS;GAAO;EACxD,MAAM;GAAE,MAAM;GAAW,SAAS;GAAO;EAC1C;CACD,QAAQ;CACT,CAAC;AAEF,IAAI,OAAO,MAAM;AACf,SAAQ,IAAI,KAAK;AACjB,SAAQ,KAAK,EAAE;;AAGjB,MAAM,OAAO,OAAO,OAAO,KAAK;AAChC,MAAM,OAAO,OAAO;AACpB,MAAM,UAAU,OAAO,OAAO,QAAQ;AACtC,MAAM,YAAY,OAAO,OAAO,cAAc;AAC9C,MAAM,gBACJ,OAAO,YAAY,OAAO,SAAS,SAAS,IAAI,OAAO,WAAW,CAAC,aAAa;AAClF,MAAM,YAAY,OAAO;AACzB,MAAM,iBAAiB,OAAO;AAC9B,MAAM,cAAc,OAAO;AAE3B,IAAI,CAAC;CAAC;CAAU;CAAQ;CAAQ,CAAC,SAAS,YAAY,EAAE;AACtD,SAAQ,MAAM,sBAAsB,YAAY,mCAAmC;AACnF,SAAQ,KAAK,EAAE;;AAEjB,MAAM,WAAW;AAEjB,IAAI,OAAO,MAAM,KAAK,IAAI,OAAO,KAAK,OAAO,OAAO;AAClD,SAAQ,MAAM,iBAAiB,OAAO,OAAO;AAC7C,SAAQ,KAAK,EAAE;;AAGjB,IAAI,OAAO,MAAM,QAAQ,IAAI,UAAU,GAAG;AACxC,SAAQ,MAAM,oBAAoB,OAAO,UAAU;AACnD,SAAQ,KAAK,EAAE;;AAGjB,IAAI,OAAO,MAAM,UAAU,IAAI,YAAY,GAAG;AAC5C,SAAQ,MAAM,uBAAuB,OAAO,gBAAgB;AAC5D,SAAQ,KAAK,EAAE;;AAGjB,MAAM,aAAa,OAAO,OAAO,eAAe;AAChD,IAAI,OAAO,MAAM,WAAW,IAAI,CAAC,OAAO,UAAU,WAAW,IAAI,aAAa,GAAG;AAC/E,SAAQ,MACN,wBAAwB,OAAO,eAAe,6DAC/C;AACD,SAAQ,KAAK,EAAE;;AAGjB,MAAM,sBAAsB,OAAO;AACnC,MAAM,mBAAmB,OAAO,oBAAoB;AACpD,IAAI,OAAO,MAAM,iBAAiB,IAAI,CAAC,OAAO,UAAU,iBAAiB,IAAI,mBAAmB,GAAG;AACjG,SAAQ,MACN,+BAA+B,oBAAoB,kDACpD;AACD,SAAQ,KAAK,EAAE;;AAGjB,MAAM,SAAS,IAAIA,sBAAO,SAAS;AAGnC,IAAI;AACJ;CACE,MAAM,UAAU,OAAO;CACvB,MAAM,eAAe,OAAO;CAC5B,MAAM,gBAAgB,OAAO;AAE7B,KAAI,YAAY,UAAa,iBAAiB,UAAa,kBAAkB,QAAW;AACtF,UAAQ,EAAE;AACV,MAAI,YAAY,QAAW;GACzB,MAAM,MAAM,WAAW,QAAQ;AAC/B,OAAI,MAAM,IAAI,IAAI,MAAM,KAAK,MAAM,GAAG;AACpC,YAAQ,MAAM,uBAAuB,QAAQ,gBAAgB;AAC7D,YAAQ,KAAK,EAAE;;AAEjB,SAAM,WAAW;;AAEnB,MAAI,iBAAiB,QAAW;GAC9B,MAAM,MAAM,WAAW,aAAa;AACpC,OAAI,MAAM,IAAI,IAAI,MAAM,KAAK,MAAM,GAAG;AACpC,YAAQ,MAAM,4BAA4B,aAAa,gBAAgB;AACvE,YAAQ,KAAK,EAAE;;AAEjB,SAAM,gBAAgB;;AAExB,MAAI,kBAAkB,QAAW;GAC/B,MAAM,MAAM,WAAW,cAAc;AACrC,OAAI,MAAM,IAAI,IAAI,MAAM,KAAK,MAAM,GAAG;AACpC,YAAQ,MAAM,6BAA6B,cAAc,gBAAgB;AACzE,YAAQ,KAAK,EAAE;;AAEjB,SAAM,iBAAiB;;;;AAM7B,IAAI;AACJ,IAAI,OAAO,UAAU,OAAO,eAAe;CACzC,MAAM,YAAuC,EAAE;AAC/C,KAAI,OAAO,mBAAoB,WAAU,SAAS,OAAO;AACzD,KAAI,OAAO,sBAAuB,WAAU,YAAY,OAAO;AAC/D,KAAI,OAAO,mBAAoB,WAAU,SAAS,OAAO;AACzD,KAAI,OAAO,qBAAsB,WAAU,WAAW,OAAO;AAC7D,KAAI,OAAO,oBAAqB,WAAU,UAAU,OAAO;AAC3D,KAAI,OAAO,kBAAmB,WAAU,QAAQ,OAAO;AACvD,KAAI,OAAO,mBAAoB,WAAU,SAAS,OAAO;AACzD,KAAI,OAAO,mBAAoB,WAAU,SAAS,OAAO;AAEzD,KAAI,OAAO,KAAK,UAAU,CAAC,WAAW,GAAG;AACvC,UAAQ,MACN,YAAY,OAAO,gBAAgB,eAAe,SAAS,0CAC5D;AACD,UAAQ,KAAK,EAAE;;CAOjB,MAAM,aAAa,cAAc;CACjC,MAAM,kBAAkB,gBAAgB,KAAK,WAAW;AACxD,KAAI,OAAO,UAAU,iBAAiB;AACpC,UAAQ,MACN,2FAA2F,aAC5F;AACD,UAAQ,KAAK,EAAE;;AAEjB,UAAS;EACP;EAIA,aAAa,kBAAkB,gCAAoB,YAAY,WAAW;EAC1E,WAAW,OAAO;EACnB;;AAIH,IAAI;AACJ,IAAI,OAAO,kBAAkB,OAAO,oBAAoB;AACtD,KAAI,CAAC,OAAO,kBAAkB;AAC5B,UAAQ,MAAM,kEAAkE;AAChF,UAAQ,KAAK,EAAE;;CAIjB,MAAM,WAAW,cAAc;CAC/B,MAAM,gBAAgB,gBAAgB,KAAK,SAAS;AACpD,KAAI,OAAO,kBAAkB,eAAe;AAC1C,UAAQ,MACN,gGAAgG,WACjG;AACD,UAAQ,KAAK,EAAE;;CAEjB,MAAM,OAAO,IAAIC,4BAAU;AAC3B,MAAK,gBAAgB;EACnB,UAAU,OAAO;EAIjB,aAAa,gBAAgB,gCAAoB,UAAU,gBAAgB;EAC3E,WAAW,OAAO;EACnB,CAAC;AACF,aAAY;EAAE,MAAM;EAAS,SAAS;EAAM;;AAS9C,eAAe,2BAA6D;CAC1E,MAAM,WAAoC,EAAE;AAC5C,MAAK,MAAM,SAAS,eAAe;EACjC,IAAI;AACJ,MAAI;AACF,WAAQ,MAAMC,6CAAqB,OAAO;IACxC;IACA;IACD,CAAC;WACK,KAAK;GACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,WAAQ,MAAM,uCAAuC,MAAM,KAAK,MAAM;AACtE,WAAQ,KAAK,EAAE;;AAEjB,MAAI,CAAC,MAAM,KAET;AAEF,MAAI;GACF,MAAM,6BAAgB,MAAM,KAAK;AACjC,YAAS,KAAK;IAAE,QAAQ,MAAM;IAAQ,MAAM,MAAM;IAAM,OAAO,KAAK,aAAa;IAAE,CAAC;WAC7E,KAAK;AACZ,OAAK,IAA8B,SAAS,SAC1C,SAAQ,MAAM,4BAA4B,MAAM,OAAO;QAClD;IACL,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,YAAQ,MAAM,gCAAgC,MAAM,KAAK,IAAI,MAAM;;AAErE,WAAQ,KAAK,EAAE;;;AAGnB,QAAO;;AAGT,SAAS,WAAW,QAA0C;AAC5D,QAAO,OAAO,QACVC,2CAAoB,OAAO,MAAM,OAAO,GACxCC,uCAAgB,OAAO,MAAM,OAAO;;AAG1C,eAAe,OAAO;CACpB,MAAM,UAAU,MAAM,0BAA0B;CAEhD,MAAM,WAAsB,EAAE;AAC9B,MAAK,MAAM,OAAO,QAChB,UAAS,KAAK,GAAG,WAAW,IAAI,CAAC;AAGnC,KAAI,SAAS,WAAW,GAAG;AACzB,MAAI,kBAAkB,OAAO,QAAQ;AACnC,WAAQ,MAAM,8EAA8E;AAC5F,WAAQ,KAAK,EAAE;;AAEjB,UAAQ,KAAK,4EAA4E;;CAG3F,MAAM,cAAc,QAAQ,KAAK,MAAM,EAAE,OAAO,CAAC,KAAK,KAAK,IAAI;AAC/D,QAAO,KAAK,UAAU,SAAS,OAAO,mBAAmB,cAAc;AAGvE,KAAI,gBAAgB;EAClB,MAAM,UAAUC,wCAAiB,SAAS;EAC1C,MAAM,SAAS,QAAQ,QAAQ,MAAM,EAAE,aAAa,QAAQ;EAC5D,MAAM,WAAW,QAAQ,QAAQ,MAAM,EAAE,aAAa,UAAU;AAEhE,OAAK,MAAM,KAAK,SACd,QAAO,KAAK,WAAW,EAAE,aAAa,IAAI,EAAE,UAAU;AAExD,OAAK,MAAM,KAAK,OACd,QAAO,MAAM,WAAW,EAAE,aAAa,IAAI,EAAE,UAAU;AAGzD,MAAI,OAAO,SAAS,GAAG;AACrB,WAAQ,MAAM,sBAAsB,OAAO,OAAO,aAAa,SAAS,OAAO,aAAa;AAC5F,WAAQ,KAAK,EAAE;;;CAInB,MAAM,SAAS,YAAY,CAAC,UAAU,GAAG;CAEzC,MAAM,WAAW,MAAMC,4BACrB,UACA;EACE;EACA;EACA;EACA;EACA;EACA;EACA,SAAS,OAAO;EAChB;EACA,QAAQ,OAAO;EACf,mBAAmB;EACnB,yBAAyB;EAC1B,EACD,OACD;AAED,QAAO,KAAK,8BAA8B,SAAS,MAAM;CAIzD,IAAI,UAAwC;AAC5C,KAAI,WAAW;EACb,MAAM,UAAU,QAAQ;AACxB,MAAI,CAAC,QACH,QAAO,KAAK,wEAAwE;OAC/E;GACL,MAAM,eAA0B,WAAW,QAAQ;AACnD,aAAUC,8BAAc,QAAQ,MAAM,UAAU,QAAQ;IACtD;IACA,UAAU;IACV,YAAYF;IACb,CAAC;AACF,UAAO,KAAK,YAAY,QAAQ,KAAK,cAAc;;;CAIvD,SAAS,WAAW;AAClB,SAAO,KAAK,mBAAmB;AAC/B,MAAI,QAAS,SAAQ,OAAO;AAC5B,WAAS,OAAO,YAAY;AAC1B,WAAQ,KAAK,EAAE;IACf;;AAGJ,SAAQ,GAAG,UAAU,SAAS;AAC9B,SAAQ,GAAG,WAAW,SAAS;;AAGjC,MAAM,CAAC,OAAO,QAAQ;AACpB,SAAQ,MAAM,IAAI;AAClB,SAAQ,KAAK,EAAE;EACf"}

package/dist/cli.js

@@ -4,6 +4,7 @@ import { Logger } from "./logger.js";
 import { createServer } from "./server.js";
 import { AGUIMock } from "./agui-mock.js";
 import { watchFixtures } from "./watcher.js";
+import { resolveFixturesValue } from "./fixtures-remote.js";
 import { parseArgs } from "node:util";
 import { resolve } from "node:path";
 import { statSync } from "node:fs";
@@ -15,7 +16,9 @@ Usage: aimock [options]
 Options:
   -p, --port <number>       Port to listen on (default: 4010)
   -h, --host <string>       Host to bind to (default: 127.0.0.1)
-  -f, --fixtures <path>     Path to fixtures directory or file (default: ./fixtures)
+  -f, --fixtures <value>    Fixture source (repeatable). Accepts:
+                              - filesystem path to a directory or .json file (default: ./fixtures)
+                              - https:// or http:// URL to a .json fixture file
   -l, --latency <ms>        Latency in ms between SSE chunks (default: 0)
   -c, --chunk-size <chars>  Chunk size in characters (default: 20)
   -w, --watch               Watch fixture path for changes and reload
@@ -58,7 +61,7 @@ const { values } = parseArgs({
 		fixtures: {
 			type: "string",
 			short: "f",
-			default: "./fixtures"
+			multiple: true
 		},
 		latency: {
 			type: "string",
@@ -142,7 +145,7 @@ const port = Number(values.port);
 const host = values.host;
 const latency = Number(values.latency);
 const chunkSize = Number(values["chunk-size"]);
-const fixturePath = resolve(values.fixtures);
+const fixtureValues = values.fixtures && values.fixtures.length > 0 ? values.fixtures : ["./fixtures"];
 const watchMode = values.watch;
 const validateOnLoad = values["validate-on-load"];
 const logLevelStr = values["log-level"];
@@ -227,9 +230,15 @@ if (values.record || values["proxy-only"]) {
 		console.error(`Error: --${values["proxy-only"] ? "proxy-only" : "record"} requires at least one --provider-* flag`);
 		process.exit(1);
 	}
+	const recordBase = fixtureValues[0];
+	const recordBaseIsUrl = /^https?:\/\//i.test(recordBase);
+	if (values.record && recordBaseIsUrl) {
+		console.error(`Error: --record requires a local --fixtures path for the recording destination; got URL ${recordBase}`);
+		process.exit(1);
+	}
 	record = {
 		providers,
-		fixturePath: resolve(fixturePath, "recorded"),
+		fixturePath: recordBaseIsUrl ? void 0 : resolve(recordBase, "recorded"),
 		proxyOnly: values["proxy-only"]
 	};
 }
@@ -239,10 +248,16 @@ if (values["agui-record"] || values["agui-proxy-only"]) {
 		console.error("Error: --agui-record/--agui-proxy-only requires --agui-upstream");
 		process.exit(1);
 	}
+	const aguiBase = fixtureValues[0];
+	const aguiBaseIsUrl = /^https?:\/\//i.test(aguiBase);
+	if (values["agui-record"] && aguiBaseIsUrl) {
+		console.error(`Error: --agui-record requires a local --fixtures path for the recording destination; got URL ${aguiBase}`);
+		process.exit(1);
+	}
 	const agui = new AGUIMock();
 	agui.enableRecording({
 		upstream: values["agui-upstream"],
-		fixturePath: resolve(fixturePath, "agui-recorded"),
+		fixturePath: aguiBaseIsUrl ? void 0 : resolve(aguiBase, "agui-recorded"),
 		proxyOnly: values["agui-proxy-only"]
 	});
 	aguiMount = {
@@ -250,21 +265,46 @@ if (values["agui-record"] || values["agui-proxy-only"]) {
 		handler: agui
 	};
 }
-async function main() {
-	let isDir;
-	let fixtures;
-	try {
-		isDir = statSync(fixturePath).isDirectory();
-		if (isDir) fixtures = loadFixturesFromDir(fixturePath, logger);
-		else fixtures = loadFixtureFile(fixturePath, logger);
-	} catch (err) {
-		if (err.code === "ENOENT") console.error(`Fixtures path not found: ${fixturePath}`);
-		else {
+async function resolveAllFixtureSources() {
+	const resolved = [];
+	for (const value of fixtureValues) {
+		let local;
+		try {
+			local = await resolveFixturesValue(value, {
+				validateOnLoad,
+				logger
+			});
+		} catch (err) {
 			const msg = err instanceof Error ? err.message : String(err);
-			console.error(`Failed to load fixtures from ${fixturePath}: ${msg}`);
+			console.error(`Failed to resolve --fixtures value "${value}": ${msg}`);
+			process.exit(1);
+		}
+		if (!local.path) continue;
+		try {
+			const stat = statSync(local.path);
+			resolved.push({
+				source: local.source,
+				path: local.path,
+				isDir: stat.isDirectory()
+			});
+		} catch (err) {
+			if (err.code === "ENOENT") console.error(`Fixtures path not found: ${local.path}`);
+			else {
+				const msg = err instanceof Error ? err.message : String(err);
+				console.error(`Failed to load fixtures from ${local.path}: ${msg}`);
+			}
+			process.exit(1);
 		}
-		process.exit(1);
 	}
+	return resolved;
+}
+function loadSource(source) {
+	return source.isDir ? loadFixturesFromDir(source.path, logger) : loadFixtureFile(source.path, logger);
+}
+async function main() {
+	const sources = await resolveAllFixtureSources();
+	const fixtures = [];
+	for (const src of sources) fixtures.push(...loadSource(src));
 	if (fixtures.length === 0) {
 		if (validateOnLoad || values.strict) {
 			console.error("Error: No fixtures loaded and validation/strict mode is enabled — aborting.");
@@ -272,7 +312,8 @@ async function main() {
 		}
 		console.warn("Warning: No fixtures loaded. The server will return 404 for all requests.");
 	}
-	logger.info(`Loaded ${fixtures.length} fixture(s) from ${fixturePath}`);
+	const sourceLabel = sources.map((s) => s.source).join(", ") || "<none>";
+	logger.info(`Loaded ${fixtures.length} fixture(s) from ${sourceLabel}`);
 	if (validateOnLoad) {
 		const results = validateFixtures(fixtures);
 		const errors = results.filter((r) => r.severity === "error");
@@ -301,12 +342,17 @@ async function main() {
 	logger.info(`aimock server listening on ${instance.url}`);
 	let watcher = null;
 	if (watchMode) {
-		watcher = watchFixtures(fixturePath, fixtures, isDir ? () => loadFixturesFromDir(fixturePath, logger) : () => loadFixtureFile(fixturePath, logger), {
-			logger,
-			validate: validateOnLoad,
-			validateFn: validateFixtures
-		});
-		logger.info(`Watching ${fixturePath} for changes`);
+		const primary = sources[0];
+		if (!primary) logger.warn("--watch requested but no resolvable fixture sources; skipping watcher");
+		else {
+			const loadFn = () => loadSource(primary);
+			watcher = watchFixtures(primary.path, fixtures, loadFn, {
+				logger,
+				validate: validateOnLoad,
+				validateFn: validateFixtures
+			});
+			logger.info(`Watching ${primary.path} for changes`);
+		}
 	}
 	function shutdown() {
 		logger.info("Shutting down...");

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","names":[],"sources":["../src/cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { parseArgs } from \"node:util\";\nimport { statSync } from \"node:fs\";\nimport { resolve } from \"node:path\";\nimport { createServer } from \"./server.js\";\nimport { loadFixtureFile, loadFixturesFromDir, validateFixtures } from \"./fixture-loader.js\";\nimport { Logger, type LogLevel } from \"./logger.js\";\nimport { watchFixtures } from \"./watcher.js\";\nimport { AGUIMock } from \"./agui-mock.js\";\nimport type { ChaosConfig, RecordConfig } from \"./types.js\";\n\nconst HELP = `\nUsage: aimock [options]\n\nOptions:\n  -p, --port <number>       Port to listen on (default: 4010)\n  -h, --host <string>       Host to bind to (default: 127.0.0.1)\n  -f, --fixtures <path>     Path to fixtures directory or file (default: ./fixtures)\n  -l, --latency <ms>        Latency in ms between SSE chunks (default: 0)\n  -c, --chunk-size <chars>  Chunk size in characters (default: 20)\n  -w, --watch               Watch fixture path for changes and reload\n      --log-level <level>   Log verbosity: silent, info, debug (default: info)\n      --validate-on-load    Validate fixture schemas at startup\n      --metrics             Enable Prometheus metrics at GET /metrics\n      --record              Record mode: proxy unmatched requests and save fixtures\n      --proxy-only          Proxy mode: forward unmatched requests without saving\n      --strict              Strict mode: fail on unmatched requests\n      --journal-max <n>     Max request entries retained in memory (default: 1000, 0 = unbounded)\n      --fixture-counts-max <n>  Max unique testIds retained in fixture match-count map (default: 500, 0 = unbounded)\n      --provider-openai <url>     Upstream URL for OpenAI (used with --record)\n      --provider-anthropic <url>  Upstream URL for Anthropic\n      --provider-gemini <url>     Upstream URL for Gemini\n      --provider-vertexai <url>   Upstream URL for Vertex AI\n      --provider-bedrock <url>    Upstream URL for Bedrock\n      --provider-azure <url>      Upstream URL for Azure OpenAI\n      --provider-ollama <url>     Upstream URL for Ollama\n      --provider-cohere <url>     Upstream URL for Cohere\n      --agui-record              Enable AG-UI recording (proxy unmatched AG-UI requests)\n      --agui-upstream <url>      Upstream AG-UI agent URL (used with --agui-record)\n      --agui-proxy-only          AG-UI proxy mode: forward without saving\n      --chaos-drop <rate>   Probability (0-1) of dropping requests with 500\n      --chaos-malformed <rate>  Probability (0-1) of returning malformed JSON\n      --chaos-disconnect <rate> Probability (0-1) of destroying connection\n      --help                Show this help message\n`.trim();\n\nconst { values } = parseArgs({\n  options: {\n    port: { type: \"string\", short: \"p\", default: \"4010\" },\n    host: { type: \"string\", short: \"h\", default: \"127.0.0.1\" },\n    fixtures: { type: \"string\", short: \"f\", default: \"./fixtures\" },\n    latency: { type: \"string\", short: \"l\", default: \"0\" },\n    \"chunk-size\": { type: \"string\", short: \"c\", default: \"20\" },\n    watch: { type: \"boolean\", short: \"w\", default: false },\n    \"log-level\": { type: \"string\", default: \"info\" },\n    \"validate-on-load\": { type: \"boolean\", default: false },\n    metrics: { type: \"boolean\", default: false },\n    record: { type: \"boolean\", default: false },\n    \"proxy-only\": { type: \"boolean\", default: false },\n    strict: { type: \"boolean\", default: false },\n    \"provider-openai\": { type: \"string\" },\n    \"provider-anthropic\": { type: \"string\" },\n    \"provider-gemini\": { type: \"string\" },\n    \"provider-vertexai\": { type: \"string\" },\n    \"provider-bedrock\": { type: \"string\" },\n    \"provider-azure\": { type: \"string\" },\n    \"provider-ollama\": { type: \"string\" },\n    \"provider-cohere\": { type: \"string\" },\n    \"agui-record\": { type: \"boolean\", default: false },\n    \"agui-upstream\": { type: \"string\" },\n    \"agui-proxy-only\": { type: \"boolean\", default: false },\n    \"chaos-drop\": { type: \"string\" },\n    \"chaos-malformed\": { type: \"string\" },\n    \"chaos-disconnect\": { type: \"string\" },\n    \"journal-max\": { type: \"string\", default: \"1000\" },\n    \"fixture-counts-max\": { type: \"string\", default: \"500\" },\n    help: { type: \"boolean\", default: false },\n  },\n  strict: true,\n});\n\nif (values.help) {\n  console.log(HELP);\n  process.exit(0);\n}\n\nconst port = Number(values.port);\nconst host = values.host!;\nconst latency = Number(values.latency);\nconst chunkSize = Number(values[\"chunk-size\"]);\nconst fixturePath = resolve(values.fixtures!);\nconst watchMode = values.watch!;\nconst validateOnLoad = values[\"validate-on-load\"]!;\nconst logLevelStr = values[\"log-level\"]!;\n\nif (![\"silent\", \"info\", \"debug\"].includes(logLevelStr)) {\n  console.error(`Invalid log-level: ${logLevelStr} (must be silent, info, or debug)`);\n  process.exit(1);\n}\nconst logLevel = logLevelStr as LogLevel;\n\nif (Number.isNaN(port) || port < 0 || port > 65535) {\n  console.error(`Invalid port: ${values.port}`);\n  process.exit(1);\n}\n\nif (Number.isNaN(latency) || latency < 0) {\n  console.error(`Invalid latency: ${values.latency}`);\n  process.exit(1);\n}\n\nif (Number.isNaN(chunkSize) || chunkSize < 1) {\n  console.error(`Invalid chunk-size: ${values[\"chunk-size\"]}`);\n  process.exit(1);\n}\n\nconst journalMax = Number(values[\"journal-max\"]);\nif (Number.isNaN(journalMax) || !Number.isInteger(journalMax) || journalMax < 0) {\n  console.error(\n    `Invalid journal-max: ${values[\"journal-max\"]} (must be a non-negative integer; 0 or omitted = unbounded)`,\n  );\n  process.exit(1);\n}\n\nconst fixtureCountsMaxStr = values[\"fixture-counts-max\"];\nconst fixtureCountsMax = Number(fixtureCountsMaxStr);\nif (Number.isNaN(fixtureCountsMax) || !Number.isInteger(fixtureCountsMax) || fixtureCountsMax < 0) {\n  console.error(\n    `Invalid fixture-counts-max: ${fixtureCountsMaxStr} (must be a non-negative integer; 0 = unbounded)`,\n  );\n  process.exit(1);\n}\n\nconst logger = new Logger(logLevel);\n\n// Parse chaos config from CLI flags\nlet chaos: ChaosConfig | undefined;\n{\n  const dropStr = values[\"chaos-drop\"];\n  const malformedStr = values[\"chaos-malformed\"];\n  const disconnectStr = values[\"chaos-disconnect\"];\n\n  if (dropStr !== undefined || malformedStr !== undefined || disconnectStr !== undefined) {\n    chaos = {};\n    if (dropStr !== undefined) {\n      const val = parseFloat(dropStr);\n      if (isNaN(val) || val < 0 || val > 1) {\n        console.error(`Invalid chaos-drop: ${dropStr} (must be 0-1)`);\n        process.exit(1);\n      }\n      chaos.dropRate = val;\n    }\n    if (malformedStr !== undefined) {\n      const val = parseFloat(malformedStr);\n      if (isNaN(val) || val < 0 || val > 1) {\n        console.error(`Invalid chaos-malformed: ${malformedStr} (must be 0-1)`);\n        process.exit(1);\n      }\n      chaos.malformedRate = val;\n    }\n    if (disconnectStr !== undefined) {\n      const val = parseFloat(disconnectStr);\n      if (isNaN(val) || val < 0 || val > 1) {\n        console.error(`Invalid chaos-disconnect: ${disconnectStr} (must be 0-1)`);\n        process.exit(1);\n      }\n      chaos.disconnectRate = val;\n    }\n  }\n}\n\n// Parse record/proxy config from CLI flags\nlet record: RecordConfig | undefined;\nif (values.record || values[\"proxy-only\"]) {\n  const providers: RecordConfig[\"providers\"] = {};\n  if (values[\"provider-openai\"]) providers.openai = values[\"provider-openai\"];\n  if (values[\"provider-anthropic\"]) providers.anthropic = values[\"provider-anthropic\"];\n  if (values[\"provider-gemini\"]) providers.gemini = values[\"provider-gemini\"];\n  if (values[\"provider-vertexai\"]) providers.vertexai = values[\"provider-vertexai\"];\n  if (values[\"provider-bedrock\"]) providers.bedrock = values[\"provider-bedrock\"];\n  if (values[\"provider-azure\"]) providers.azure = values[\"provider-azure\"];\n  if (values[\"provider-ollama\"]) providers.ollama = values[\"provider-ollama\"];\n  if (values[\"provider-cohere\"]) providers.cohere = values[\"provider-cohere\"];\n\n  if (Object.keys(providers).length === 0) {\n    console.error(\n      `Error: --${values[\"proxy-only\"] ? \"proxy-only\" : \"record\"} requires at least one --provider-* flag`,\n    );\n    process.exit(1);\n  }\n\n  record = {\n    providers,\n    fixturePath: resolve(fixturePath, \"recorded\"),\n    proxyOnly: values[\"proxy-only\"],\n  };\n}\n\n// Parse AG-UI record/proxy config from CLI flags\nlet aguiMount: { path: string; handler: AGUIMock } | undefined;\nif (values[\"agui-record\"] || values[\"agui-proxy-only\"]) {\n  if (!values[\"agui-upstream\"]) {\n    console.error(\"Error: --agui-record/--agui-proxy-only requires --agui-upstream\");\n    process.exit(1);\n  }\n  const agui = new AGUIMock();\n  agui.enableRecording({\n    upstream: values[\"agui-upstream\"],\n    fixturePath: resolve(fixturePath, \"agui-recorded\"),\n    proxyOnly: values[\"agui-proxy-only\"],\n  });\n  aguiMount = { path: \"/agui\", handler: agui };\n}\n\nasync function main() {\n  // Load fixtures from path (detect file vs directory)\n  let isDir: boolean;\n  let fixtures;\n  try {\n    const stat = statSync(fixturePath);\n    isDir = stat.isDirectory();\n    if (isDir) {\n      fixtures = loadFixturesFromDir(fixturePath, logger);\n    } else {\n      fixtures = loadFixtureFile(fixturePath, logger);\n    }\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") {\n      console.error(`Fixtures path not found: ${fixturePath}`);\n    } else {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.error(`Failed to load fixtures from ${fixturePath}: ${msg}`);\n    }\n    process.exit(1);\n  }\n\n  if (fixtures.length === 0) {\n    if (validateOnLoad || values.strict) {\n      console.error(\"Error: No fixtures loaded and validation/strict mode is enabled — aborting.\");\n      process.exit(1);\n    }\n    console.warn(\"Warning: No fixtures loaded. The server will return 404 for all requests.\");\n  }\n\n  logger.info(`Loaded ${fixtures.length} fixture(s) from ${fixturePath}`);\n\n  // Validate fixtures if requested\n  if (validateOnLoad) {\n    const results = validateFixtures(fixtures);\n    const errors = results.filter((r) => r.severity === \"error\");\n    const warnings = results.filter((r) => r.severity === \"warning\");\n\n    for (const w of warnings) {\n      logger.warn(`Fixture ${w.fixtureIndex}: ${w.message}`);\n    }\n    for (const e of errors) {\n      logger.error(`Fixture ${e.fixtureIndex}: ${e.message}`);\n    }\n\n    if (errors.length > 0) {\n      console.error(`Validation failed: ${errors.length} error(s), ${warnings.length} warning(s)`);\n      process.exit(1);\n    }\n  }\n\n  const mounts = aguiMount ? [aguiMount] : undefined;\n\n  const instance = await createServer(\n    fixtures,\n    {\n      port,\n      host,\n      latency,\n      chunkSize,\n      logLevel,\n      chaos,\n      metrics: values.metrics,\n      record,\n      strict: values.strict,\n      journalMaxEntries: journalMax,\n      fixtureCountsMaxTestIds: fixtureCountsMax,\n    },\n    mounts,\n  );\n\n  logger.info(`aimock server listening on ${instance.url}`);\n\n  // Start file watcher if requested\n  let watcher: { close: () => void } | null = null;\n  if (watchMode) {\n    const loadFn = isDir!\n      ? () => loadFixturesFromDir(fixturePath, logger)\n      : () => loadFixtureFile(fixturePath, logger);\n\n    watcher = watchFixtures(fixturePath, fixtures, loadFn, {\n      logger,\n      validate: validateOnLoad,\n      validateFn: validateFixtures,\n    });\n    logger.info(`Watching ${fixturePath} for changes`);\n  }\n\n  function shutdown() {\n    logger.info(\"Shutting down...\");\n    if (watcher) watcher.close();\n    instance.server.close(() => {\n      process.exit(0);\n    });\n  }\n\n  process.on(\"SIGINT\", shutdown);\n  process.on(\"SIGTERM\", shutdown);\n}\n\nmain().catch((err) => {\n  console.error(err);\n  process.exit(1);\n});\n"],"mappings":";;;;;;;;;;;AAWA,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiCX,MAAM;AAER,MAAM,EAAE,WAAW,UAAU;CAC3B,SAAS;EACP,MAAM;GAAE,MAAM;GAAU,OAAO;GAAK,SAAS;GAAQ;EACrD,MAAM;GAAE,MAAM;GAAU,OAAO;GAAK,SAAS;GAAa;EAC1D,UAAU;GAAE,MAAM;GAAU,OAAO;GAAK,SAAS;GAAc;EAC/D,SAAS;GAAE,MAAM;GAAU,OAAO;GAAK,SAAS;GAAK;EACrD,cAAc;GAAE,MAAM;GAAU,OAAO;GAAK,SAAS;GAAM;EAC3D,OAAO;GAAE,MAAM;GAAW,OAAO;GAAK,SAAS;GAAO;EACtD,aAAa;GAAE,MAAM;GAAU,SAAS;GAAQ;EAChD,oBAAoB;GAAE,MAAM;GAAW,SAAS;GAAO;EACvD,SAAS;GAAE,MAAM;GAAW,SAAS;GAAO;EAC5C,QAAQ;GAAE,MAAM;GAAW,SAAS;GAAO;EAC3C,cAAc;GAAE,MAAM;GAAW,SAAS;GAAO;EACjD,QAAQ;GAAE,MAAM;GAAW,SAAS;GAAO;EAC3C,mBAAmB,EAAE,MAAM,UAAU;EACrC,sBAAsB,EAAE,MAAM,UAAU;EACxC,mBAAmB,EAAE,MAAM,UAAU;EACrC,qBAAqB,EAAE,MAAM,UAAU;EACvC,oBAAoB,EAAE,MAAM,UAAU;EACtC,kBAAkB,EAAE,MAAM,UAAU;EACpC,mBAAmB,EAAE,MAAM,UAAU;EACrC,mBAAmB,EAAE,MAAM,UAAU;EACrC,eAAe;GAAE,MAAM;GAAW,SAAS;GAAO;EAClD,iBAAiB,EAAE,MAAM,UAAU;EACnC,mBAAmB;GAAE,MAAM;GAAW,SAAS;GAAO;EACtD,cAAc,EAAE,MAAM,UAAU;EAChC,mBAAmB,EAAE,MAAM,UAAU;EACrC,oBAAoB,EAAE,MAAM,UAAU;EACtC,eAAe;GAAE,MAAM;GAAU,SAAS;GAAQ;EAClD,sBAAsB;GAAE,MAAM;GAAU,SAAS;GAAO;EACxD,MAAM;GAAE,MAAM;GAAW,SAAS;GAAO;EAC1C;CACD,QAAQ;CACT,CAAC;AAEF,IAAI,OAAO,MAAM;AACf,SAAQ,IAAI,KAAK;AACjB,SAAQ,KAAK,EAAE;;AAGjB,MAAM,OAAO,OAAO,OAAO,KAAK;AAChC,MAAM,OAAO,OAAO;AACpB,MAAM,UAAU,OAAO,OAAO,QAAQ;AACtC,MAAM,YAAY,OAAO,OAAO,cAAc;AAC9C,MAAM,cAAc,QAAQ,OAAO,SAAU;AAC7C,MAAM,YAAY,OAAO;AACzB,MAAM,iBAAiB,OAAO;AAC9B,MAAM,cAAc,OAAO;AAE3B,IAAI,CAAC;CAAC;CAAU;CAAQ;CAAQ,CAAC,SAAS,YAAY,EAAE;AACtD,SAAQ,MAAM,sBAAsB,YAAY,mCAAmC;AACnF,SAAQ,KAAK,EAAE;;AAEjB,MAAM,WAAW;AAEjB,IAAI,OAAO,MAAM,KAAK,IAAI,OAAO,KAAK,OAAO,OAAO;AAClD,SAAQ,MAAM,iBAAiB,OAAO,OAAO;AAC7C,SAAQ,KAAK,EAAE;;AAGjB,IAAI,OAAO,MAAM,QAAQ,IAAI,UAAU,GAAG;AACxC,SAAQ,MAAM,oBAAoB,OAAO,UAAU;AACnD,SAAQ,KAAK,EAAE;;AAGjB,IAAI,OAAO,MAAM,UAAU,IAAI,YAAY,GAAG;AAC5C,SAAQ,MAAM,uBAAuB,OAAO,gBAAgB;AAC5D,SAAQ,KAAK,EAAE;;AAGjB,MAAM,aAAa,OAAO,OAAO,eAAe;AAChD,IAAI,OAAO,MAAM,WAAW,IAAI,CAAC,OAAO,UAAU,WAAW,IAAI,aAAa,GAAG;AAC/E,SAAQ,MACN,wBAAwB,OAAO,eAAe,6DAC/C;AACD,SAAQ,KAAK,EAAE;;AAGjB,MAAM,sBAAsB,OAAO;AACnC,MAAM,mBAAmB,OAAO,oBAAoB;AACpD,IAAI,OAAO,MAAM,iBAAiB,IAAI,CAAC,OAAO,UAAU,iBAAiB,IAAI,mBAAmB,GAAG;AACjG,SAAQ,MACN,+BAA+B,oBAAoB,kDACpD;AACD,SAAQ,KAAK,EAAE;;AAGjB,MAAM,SAAS,IAAI,OAAO,SAAS;AAGnC,IAAI;AACJ;CACE,MAAM,UAAU,OAAO;CACvB,MAAM,eAAe,OAAO;CAC5B,MAAM,gBAAgB,OAAO;AAE7B,KAAI,YAAY,UAAa,iBAAiB,UAAa,kBAAkB,QAAW;AACtF,UAAQ,EAAE;AACV,MAAI,YAAY,QAAW;GACzB,MAAM,MAAM,WAAW,QAAQ;AAC/B,OAAI,MAAM,IAAI,IAAI,MAAM,KAAK,MAAM,GAAG;AACpC,YAAQ,MAAM,uBAAuB,QAAQ,gBAAgB;AAC7D,YAAQ,KAAK,EAAE;;AAEjB,SAAM,WAAW;;AAEnB,MAAI,iBAAiB,QAAW;GAC9B,MAAM,MAAM,WAAW,aAAa;AACpC,OAAI,MAAM,IAAI,IAAI,MAAM,KAAK,MAAM,GAAG;AACpC,YAAQ,MAAM,4BAA4B,aAAa,gBAAgB;AACvE,YAAQ,KAAK,EAAE;;AAEjB,SAAM,gBAAgB;;AAExB,MAAI,kBAAkB,QAAW;GAC/B,MAAM,MAAM,WAAW,cAAc;AACrC,OAAI,MAAM,IAAI,IAAI,MAAM,KAAK,MAAM,GAAG;AACpC,YAAQ,MAAM,6BAA6B,cAAc,gBAAgB;AACzE,YAAQ,KAAK,EAAE;;AAEjB,SAAM,iBAAiB;;;;AAM7B,IAAI;AACJ,IAAI,OAAO,UAAU,OAAO,eAAe;CACzC,MAAM,YAAuC,EAAE;AAC/C,KAAI,OAAO,mBAAoB,WAAU,SAAS,OAAO;AACzD,KAAI,OAAO,sBAAuB,WAAU,YAAY,OAAO;AAC/D,KAAI,OAAO,mBAAoB,WAAU,SAAS,OAAO;AACzD,KAAI,OAAO,qBAAsB,WAAU,WAAW,OAAO;AAC7D,KAAI,OAAO,oBAAqB,WAAU,UAAU,OAAO;AAC3D,KAAI,OAAO,kBAAmB,WAAU,QAAQ,OAAO;AACvD,KAAI,OAAO,mBAAoB,WAAU,SAAS,OAAO;AACzD,KAAI,OAAO,mBAAoB,WAAU,SAAS,OAAO;AAEzD,KAAI,OAAO,KAAK,UAAU,CAAC,WAAW,GAAG;AACvC,UAAQ,MACN,YAAY,OAAO,gBAAgB,eAAe,SAAS,0CAC5D;AACD,UAAQ,KAAK,EAAE;;AAGjB,UAAS;EACP;EACA,aAAa,QAAQ,aAAa,WAAW;EAC7C,WAAW,OAAO;EACnB;;AAIH,IAAI;AACJ,IAAI,OAAO,kBAAkB,OAAO,oBAAoB;AACtD,KAAI,CAAC,OAAO,kBAAkB;AAC5B,UAAQ,MAAM,kEAAkE;AAChF,UAAQ,KAAK,EAAE;;CAEjB,MAAM,OAAO,IAAI,UAAU;AAC3B,MAAK,gBAAgB;EACnB,UAAU,OAAO;EACjB,aAAa,QAAQ,aAAa,gBAAgB;EAClD,WAAW,OAAO;EACnB,CAAC;AACF,aAAY;EAAE,MAAM;EAAS,SAAS;EAAM;;AAG9C,eAAe,OAAO;CAEpB,IAAI;CACJ,IAAI;AACJ,KAAI;AAEF,UADa,SAAS,YAAY,CACrB,aAAa;AAC1B,MAAI,MACF,YAAW,oBAAoB,aAAa,OAAO;MAEnD,YAAW,gBAAgB,aAAa,OAAO;UAE1C,KAAK;AACZ,MAAK,IAA8B,SAAS,SAC1C,SAAQ,MAAM,4BAA4B,cAAc;OACnD;GACL,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,WAAQ,MAAM,gCAAgC,YAAY,IAAI,MAAM;;AAEtE,UAAQ,KAAK,EAAE;;AAGjB,KAAI,SAAS,WAAW,GAAG;AACzB,MAAI,kBAAkB,OAAO,QAAQ;AACnC,WAAQ,MAAM,8EAA8E;AAC5F,WAAQ,KAAK,EAAE;;AAEjB,UAAQ,KAAK,4EAA4E;;AAG3F,QAAO,KAAK,UAAU,SAAS,OAAO,mBAAmB,cAAc;AAGvE,KAAI,gBAAgB;EAClB,MAAM,UAAU,iBAAiB,SAAS;EAC1C,MAAM,SAAS,QAAQ,QAAQ,MAAM,EAAE,aAAa,QAAQ;EAC5D,MAAM,WAAW,QAAQ,QAAQ,MAAM,EAAE,aAAa,UAAU;AAEhE,OAAK,MAAM,KAAK,SACd,QAAO,KAAK,WAAW,EAAE,aAAa,IAAI,EAAE,UAAU;AAExD,OAAK,MAAM,KAAK,OACd,QAAO,MAAM,WAAW,EAAE,aAAa,IAAI,EAAE,UAAU;AAGzD,MAAI,OAAO,SAAS,GAAG;AACrB,WAAQ,MAAM,sBAAsB,OAAO,OAAO,aAAa,SAAS,OAAO,aAAa;AAC5F,WAAQ,KAAK,EAAE;;;CAInB,MAAM,SAAS,YAAY,CAAC,UAAU,GAAG;CAEzC,MAAM,WAAW,MAAM,aACrB,UACA;EACE;EACA;EACA;EACA;EACA;EACA;EACA,SAAS,OAAO;EAChB;EACA,QAAQ,OAAO;EACf,mBAAmB;EACnB,yBAAyB;EAC1B,EACD,OACD;AAED,QAAO,KAAK,8BAA8B,SAAS,MAAM;CAGzD,IAAI,UAAwC;AAC5C,KAAI,WAAW;AAKb,YAAU,cAAc,aAAa,UAJtB,cACL,oBAAoB,aAAa,OAAO,SACxC,gBAAgB,aAAa,OAAO,EAES;GACrD;GACA,UAAU;GACV,YAAY;GACb,CAAC;AACF,SAAO,KAAK,YAAY,YAAY,cAAc;;CAGpD,SAAS,WAAW;AAClB,SAAO,KAAK,mBAAmB;AAC/B,MAAI,QAAS,SAAQ,OAAO;AAC5B,WAAS,OAAO,YAAY;AAC1B,WAAQ,KAAK,EAAE;IACf;;AAGJ,SAAQ,GAAG,UAAU,SAAS;AAC9B,SAAQ,GAAG,WAAW,SAAS;;AAGjC,MAAM,CAAC,OAAO,QAAQ;AACpB,SAAQ,MAAM,IAAI;AAClB,SAAQ,KAAK,EAAE;EACf"}
+{"version":3,"file":"cli.js","names":[],"sources":["../src/cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { parseArgs } from \"node:util\";\nimport { statSync } from \"node:fs\";\nimport { resolve } from \"node:path\";\nimport { createServer } from \"./server.js\";\nimport { loadFixtureFile, loadFixturesFromDir, validateFixtures } from \"./fixture-loader.js\";\nimport { Logger, type LogLevel } from \"./logger.js\";\nimport { watchFixtures } from \"./watcher.js\";\nimport { AGUIMock } from \"./agui-mock.js\";\nimport { resolveFixturesValue } from \"./fixtures-remote.js\";\nimport type { Fixture, ChaosConfig, RecordConfig } from \"./types.js\";\n\nconst HELP = `\nUsage: aimock [options]\n\nOptions:\n  -p, --port <number>       Port to listen on (default: 4010)\n  -h, --host <string>       Host to bind to (default: 127.0.0.1)\n  -f, --fixtures <value>    Fixture source (repeatable). Accepts:\n                              - filesystem path to a directory or .json file (default: ./fixtures)\n                              - https:// or http:// URL to a .json fixture file\n  -l, --latency <ms>        Latency in ms between SSE chunks (default: 0)\n  -c, --chunk-size <chars>  Chunk size in characters (default: 20)\n  -w, --watch               Watch fixture path for changes and reload\n      --log-level <level>   Log verbosity: silent, info, debug (default: info)\n      --validate-on-load    Validate fixture schemas at startup\n      --metrics             Enable Prometheus metrics at GET /metrics\n      --record              Record mode: proxy unmatched requests and save fixtures\n      --proxy-only          Proxy mode: forward unmatched requests without saving\n      --strict              Strict mode: fail on unmatched requests\n      --journal-max <n>     Max request entries retained in memory (default: 1000, 0 = unbounded)\n      --fixture-counts-max <n>  Max unique testIds retained in fixture match-count map (default: 500, 0 = unbounded)\n      --provider-openai <url>     Upstream URL for OpenAI (used with --record)\n      --provider-anthropic <url>  Upstream URL for Anthropic\n      --provider-gemini <url>     Upstream URL for Gemini\n      --provider-vertexai <url>   Upstream URL for Vertex AI\n      --provider-bedrock <url>    Upstream URL for Bedrock\n      --provider-azure <url>      Upstream URL for Azure OpenAI\n      --provider-ollama <url>     Upstream URL for Ollama\n      --provider-cohere <url>     Upstream URL for Cohere\n      --agui-record              Enable AG-UI recording (proxy unmatched AG-UI requests)\n      --agui-upstream <url>      Upstream AG-UI agent URL (used with --agui-record)\n      --agui-proxy-only          AG-UI proxy mode: forward without saving\n      --chaos-drop <rate>   Probability (0-1) of dropping requests with 500\n      --chaos-malformed <rate>  Probability (0-1) of returning malformed JSON\n      --chaos-disconnect <rate> Probability (0-1) of destroying connection\n      --help                Show this help message\n`.trim();\n\nconst { values } = parseArgs({\n  options: {\n    port: { type: \"string\", short: \"p\", default: \"4010\" },\n    host: { type: \"string\", short: \"h\", default: \"127.0.0.1\" },\n    fixtures: { type: \"string\", short: \"f\", multiple: true },\n    latency: { type: \"string\", short: \"l\", default: \"0\" },\n    \"chunk-size\": { type: \"string\", short: \"c\", default: \"20\" },\n    watch: { type: \"boolean\", short: \"w\", default: false },\n    \"log-level\": { type: \"string\", default: \"info\" },\n    \"validate-on-load\": { type: \"boolean\", default: false },\n    metrics: { type: \"boolean\", default: false },\n    record: { type: \"boolean\", default: false },\n    \"proxy-only\": { type: \"boolean\", default: false },\n    strict: { type: \"boolean\", default: false },\n    \"provider-openai\": { type: \"string\" },\n    \"provider-anthropic\": { type: \"string\" },\n    \"provider-gemini\": { type: \"string\" },\n    \"provider-vertexai\": { type: \"string\" },\n    \"provider-bedrock\": { type: \"string\" },\n    \"provider-azure\": { type: \"string\" },\n    \"provider-ollama\": { type: \"string\" },\n    \"provider-cohere\": { type: \"string\" },\n    \"agui-record\": { type: \"boolean\", default: false },\n    \"agui-upstream\": { type: \"string\" },\n    \"agui-proxy-only\": { type: \"boolean\", default: false },\n    \"chaos-drop\": { type: \"string\" },\n    \"chaos-malformed\": { type: \"string\" },\n    \"chaos-disconnect\": { type: \"string\" },\n    \"journal-max\": { type: \"string\", default: \"1000\" },\n    \"fixture-counts-max\": { type: \"string\", default: \"500\" },\n    help: { type: \"boolean\", default: false },\n  },\n  strict: true,\n});\n\nif (values.help) {\n  console.log(HELP);\n  process.exit(0);\n}\n\nconst port = Number(values.port);\nconst host = values.host!;\nconst latency = Number(values.latency);\nconst chunkSize = Number(values[\"chunk-size\"]);\nconst fixtureValues: string[] =\n  values.fixtures && values.fixtures.length > 0 ? values.fixtures : [\"./fixtures\"];\nconst watchMode = values.watch!;\nconst validateOnLoad = values[\"validate-on-load\"]!;\nconst logLevelStr = values[\"log-level\"]!;\n\nif (![\"silent\", \"info\", \"debug\"].includes(logLevelStr)) {\n  console.error(`Invalid log-level: ${logLevelStr} (must be silent, info, or debug)`);\n  process.exit(1);\n}\nconst logLevel = logLevelStr as LogLevel;\n\nif (Number.isNaN(port) || port < 0 || port > 65535) {\n  console.error(`Invalid port: ${values.port}`);\n  process.exit(1);\n}\n\nif (Number.isNaN(latency) || latency < 0) {\n  console.error(`Invalid latency: ${values.latency}`);\n  process.exit(1);\n}\n\nif (Number.isNaN(chunkSize) || chunkSize < 1) {\n  console.error(`Invalid chunk-size: ${values[\"chunk-size\"]}`);\n  process.exit(1);\n}\n\nconst journalMax = Number(values[\"journal-max\"]);\nif (Number.isNaN(journalMax) || !Number.isInteger(journalMax) || journalMax < 0) {\n  console.error(\n    `Invalid journal-max: ${values[\"journal-max\"]} (must be a non-negative integer; 0 or omitted = unbounded)`,\n  );\n  process.exit(1);\n}\n\nconst fixtureCountsMaxStr = values[\"fixture-counts-max\"];\nconst fixtureCountsMax = Number(fixtureCountsMaxStr);\nif (Number.isNaN(fixtureCountsMax) || !Number.isInteger(fixtureCountsMax) || fixtureCountsMax < 0) {\n  console.error(\n    `Invalid fixture-counts-max: ${fixtureCountsMaxStr} (must be a non-negative integer; 0 = unbounded)`,\n  );\n  process.exit(1);\n}\n\nconst logger = new Logger(logLevel);\n\n// Parse chaos config from CLI flags\nlet chaos: ChaosConfig | undefined;\n{\n  const dropStr = values[\"chaos-drop\"];\n  const malformedStr = values[\"chaos-malformed\"];\n  const disconnectStr = values[\"chaos-disconnect\"];\n\n  if (dropStr !== undefined || malformedStr !== undefined || disconnectStr !== undefined) {\n    chaos = {};\n    if (dropStr !== undefined) {\n      const val = parseFloat(dropStr);\n      if (isNaN(val) || val < 0 || val > 1) {\n        console.error(`Invalid chaos-drop: ${dropStr} (must be 0-1)`);\n        process.exit(1);\n      }\n      chaos.dropRate = val;\n    }\n    if (malformedStr !== undefined) {\n      const val = parseFloat(malformedStr);\n      if (isNaN(val) || val < 0 || val > 1) {\n        console.error(`Invalid chaos-malformed: ${malformedStr} (must be 0-1)`);\n        process.exit(1);\n      }\n      chaos.malformedRate = val;\n    }\n    if (disconnectStr !== undefined) {\n      const val = parseFloat(disconnectStr);\n      if (isNaN(val) || val < 0 || val > 1) {\n        console.error(`Invalid chaos-disconnect: ${disconnectStr} (must be 0-1)`);\n        process.exit(1);\n      }\n      chaos.disconnectRate = val;\n    }\n  }\n}\n\n// Parse record/proxy config from CLI flags\nlet record: RecordConfig | undefined;\nif (values.record || values[\"proxy-only\"]) {\n  const providers: RecordConfig[\"providers\"] = {};\n  if (values[\"provider-openai\"]) providers.openai = values[\"provider-openai\"];\n  if (values[\"provider-anthropic\"]) providers.anthropic = values[\"provider-anthropic\"];\n  if (values[\"provider-gemini\"]) providers.gemini = values[\"provider-gemini\"];\n  if (values[\"provider-vertexai\"]) providers.vertexai = values[\"provider-vertexai\"];\n  if (values[\"provider-bedrock\"]) providers.bedrock = values[\"provider-bedrock\"];\n  if (values[\"provider-azure\"]) providers.azure = values[\"provider-azure\"];\n  if (values[\"provider-ollama\"]) providers.ollama = values[\"provider-ollama\"];\n  if (values[\"provider-cohere\"]) providers.cohere = values[\"provider-cohere\"];\n\n  if (Object.keys(providers).length === 0) {\n    console.error(\n      `Error: --${values[\"proxy-only\"] ? \"proxy-only\" : \"record\"} requires at least one --provider-* flag`,\n    );\n    process.exit(1);\n  }\n\n  // For --record, the first --fixtures value is the base path for the recording\n  // destination and must be a local filesystem path — writing to a URL is not supported.\n  // For --proxy-only, unmatched requests are forwarded without saving, so no writable\n  // destination is required; URL-only --fixtures is valid in that mode.\n  const recordBase = fixtureValues[0];\n  const recordBaseIsUrl = /^https?:\\/\\//i.test(recordBase);\n  if (values.record && recordBaseIsUrl) {\n    console.error(\n      `Error: --record requires a local --fixtures path for the recording destination; got URL ${recordBase}`,\n    );\n    process.exit(1);\n  }\n  record = {\n    providers,\n    // In proxy-only mode with only URL sources, fixturePath is never consumed\n    // (recorder.ts skips disk writes when proxyOnly is set). Leave it undefined\n    // rather than resolving a URL string as a filesystem path.\n    fixturePath: recordBaseIsUrl ? undefined : resolve(recordBase, \"recorded\"),\n    proxyOnly: values[\"proxy-only\"],\n  };\n}\n\n// Parse AG-UI record/proxy config from CLI flags\nlet aguiMount: { path: string; handler: AGUIMock } | undefined;\nif (values[\"agui-record\"] || values[\"agui-proxy-only\"]) {\n  if (!values[\"agui-upstream\"]) {\n    console.error(\"Error: --agui-record/--agui-proxy-only requires --agui-upstream\");\n    process.exit(1);\n  }\n  // --agui-record writes recorded AG-UI fixtures to disk, so a URL source is unsupported.\n  // --agui-proxy-only forwards without saving, so URL-only --fixtures is valid.\n  const aguiBase = fixtureValues[0];\n  const aguiBaseIsUrl = /^https?:\\/\\//i.test(aguiBase);\n  if (values[\"agui-record\"] && aguiBaseIsUrl) {\n    console.error(\n      `Error: --agui-record requires a local --fixtures path for the recording destination; got URL ${aguiBase}`,\n    );\n    process.exit(1);\n  }\n  const agui = new AGUIMock();\n  agui.enableRecording({\n    upstream: values[\"agui-upstream\"],\n    // In proxy-only mode with a URL-only --fixtures, the AG-UI recorder never\n    // writes to disk (see agui-recorder.ts). Leave fixturePath undefined rather\n    // than resolving a URL as a filesystem path.\n    fixturePath: aguiBaseIsUrl ? undefined : resolve(aguiBase, \"agui-recorded\"),\n    proxyOnly: values[\"agui-proxy-only\"],\n  });\n  aguiMount = { path: \"/agui\", handler: agui };\n}\n\ninterface ResolvedFixtureSource {\n  source: string;\n  path: string;\n  isDir: boolean;\n}\n\nasync function resolveAllFixtureSources(): Promise<ResolvedFixtureSource[]> {\n  const resolved: ResolvedFixtureSource[] = [];\n  for (const value of fixtureValues) {\n    let local;\n    try {\n      local = await resolveFixturesValue(value, {\n        validateOnLoad,\n        logger,\n      });\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.error(`Failed to resolve --fixtures value \"${value}\": ${msg}`);\n      process.exit(1);\n    }\n    if (!local.path) {\n      // Remote fetch failed without validate-on-load and no cache — already warned; skip.\n      continue;\n    }\n    try {\n      const stat = statSync(local.path);\n      resolved.push({ source: local.source, path: local.path, isDir: stat.isDirectory() });\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === \"ENOENT\") {\n        console.error(`Fixtures path not found: ${local.path}`);\n      } else {\n        const msg = err instanceof Error ? err.message : String(err);\n        console.error(`Failed to load fixtures from ${local.path}: ${msg}`);\n      }\n      process.exit(1);\n    }\n  }\n  return resolved;\n}\n\nfunction loadSource(source: ResolvedFixtureSource): Fixture[] {\n  return source.isDir\n    ? loadFixturesFromDir(source.path, logger)\n    : loadFixtureFile(source.path, logger);\n}\n\nasync function main() {\n  const sources = await resolveAllFixtureSources();\n\n  const fixtures: Fixture[] = [];\n  for (const src of sources) {\n    fixtures.push(...loadSource(src));\n  }\n\n  if (fixtures.length === 0) {\n    if (validateOnLoad || values.strict) {\n      console.error(\"Error: No fixtures loaded and validation/strict mode is enabled — aborting.\");\n      process.exit(1);\n    }\n    console.warn(\"Warning: No fixtures loaded. The server will return 404 for all requests.\");\n  }\n\n  const sourceLabel = sources.map((s) => s.source).join(\", \") || \"<none>\";\n  logger.info(`Loaded ${fixtures.length} fixture(s) from ${sourceLabel}`);\n\n  // Validate fixtures if requested\n  if (validateOnLoad) {\n    const results = validateFixtures(fixtures);\n    const errors = results.filter((r) => r.severity === \"error\");\n    const warnings = results.filter((r) => r.severity === \"warning\");\n\n    for (const w of warnings) {\n      logger.warn(`Fixture ${w.fixtureIndex}: ${w.message}`);\n    }\n    for (const e of errors) {\n      logger.error(`Fixture ${e.fixtureIndex}: ${e.message}`);\n    }\n\n    if (errors.length > 0) {\n      console.error(`Validation failed: ${errors.length} error(s), ${warnings.length} warning(s)`);\n      process.exit(1);\n    }\n  }\n\n  const mounts = aguiMount ? [aguiMount] : undefined;\n\n  const instance = await createServer(\n    fixtures,\n    {\n      port,\n      host,\n      latency,\n      chunkSize,\n      logLevel,\n      chaos,\n      metrics: values.metrics,\n      record,\n      strict: values.strict,\n      journalMaxEntries: journalMax,\n      fixtureCountsMaxTestIds: fixtureCountsMax,\n    },\n    mounts,\n  );\n\n  logger.info(`aimock server listening on ${instance.url}`);\n\n  // Start file watcher if requested. Only the first local source is watched —\n  // remote URL sources are fetched once at boot and are not monitored.\n  let watcher: { close: () => void } | null = null;\n  if (watchMode) {\n    const primary = sources[0];\n    if (!primary) {\n      logger.warn(\"--watch requested but no resolvable fixture sources; skipping watcher\");\n    } else {\n      const loadFn = (): Fixture[] => loadSource(primary);\n      watcher = watchFixtures(primary.path, fixtures, loadFn, {\n        logger,\n        validate: validateOnLoad,\n        validateFn: validateFixtures,\n      });\n      logger.info(`Watching ${primary.path} for changes`);\n    }\n  }\n\n  function shutdown() {\n    logger.info(\"Shutting down...\");\n    if (watcher) watcher.close();\n    instance.server.close(() => {\n      process.exit(0);\n    });\n  }\n\n  process.on(\"SIGINT\", shutdown);\n  process.on(\"SIGTERM\", shutdown);\n}\n\nmain().catch((err) => {\n  console.error(err);\n  process.exit(1);\n});\n"],"mappings":";;;;;;;;;;;;AAYA,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmCX,MAAM;AAER,MAAM,EAAE,WAAW,UAAU;CAC3B,SAAS;EACP,MAAM;GAAE,MAAM;GAAU,OAAO;GAAK,SAAS;GAAQ;EACrD,MAAM;GAAE,MAAM;GAAU,OAAO;GAAK,SAAS;GAAa;EAC1D,UAAU;GAAE,MAAM;GAAU,OAAO;GAAK,UAAU;GAAM;EACxD,SAAS;GAAE,MAAM;GAAU,OAAO;GAAK,SAAS;GAAK;EACrD,cAAc;GAAE,MAAM;GAAU,OAAO;GAAK,SAAS;GAAM;EAC3D,OAAO;GAAE,MAAM;GAAW,OAAO;GAAK,SAAS;GAAO;EACtD,aAAa;GAAE,MAAM;GAAU,SAAS;GAAQ;EAChD,oBAAoB;GAAE,MAAM;GAAW,SAAS;GAAO;EACvD,SAAS;GAAE,MAAM;GAAW,SAAS;GAAO;EAC5C,QAAQ;GAAE,MAAM;GAAW,SAAS;GAAO;EAC3C,cAAc;GAAE,MAAM;GAAW,SAAS;GAAO;EACjD,QAAQ;GAAE,MAAM;GAAW,SAAS;GAAO;EAC3C,mBAAmB,EAAE,MAAM,UAAU;EACrC,sBAAsB,EAAE,MAAM,UAAU;EACxC,mBAAmB,EAAE,MAAM,UAAU;EACrC,qBAAqB,EAAE,MAAM,UAAU;EACvC,oBAAoB,EAAE,MAAM,UAAU;EACtC,kBAAkB,EAAE,MAAM,UAAU;EACpC,mBAAmB,EAAE,MAAM,UAAU;EACrC,mBAAmB,EAAE,MAAM,UAAU;EACrC,eAAe;GAAE,MAAM;GAAW,SAAS;GAAO;EAClD,iBAAiB,EAAE,MAAM,UAAU;EACnC,mBAAmB;GAAE,MAAM;GAAW,SAAS;GAAO;EACtD,cAAc,EAAE,MAAM,UAAU;EAChC,mBAAmB,EAAE,MAAM,UAAU;EACrC,oBAAoB,EAAE,MAAM,UAAU;EACtC,eAAe;GAAE,MAAM;GAAU,SAAS;GAAQ;EAClD,sBAAsB;GAAE,MAAM;GAAU,SAAS;GAAO;EACxD,MAAM;GAAE,MAAM;GAAW,SAAS;GAAO;EAC1C;CACD,QAAQ;CACT,CAAC;AAEF,IAAI,OAAO,MAAM;AACf,SAAQ,IAAI,KAAK;AACjB,SAAQ,KAAK,EAAE;;AAGjB,MAAM,OAAO,OAAO,OAAO,KAAK;AAChC,MAAM,OAAO,OAAO;AACpB,MAAM,UAAU,OAAO,OAAO,QAAQ;AACtC,MAAM,YAAY,OAAO,OAAO,cAAc;AAC9C,MAAM,gBACJ,OAAO,YAAY,OAAO,SAAS,SAAS,IAAI,OAAO,WAAW,CAAC,aAAa;AAClF,MAAM,YAAY,OAAO;AACzB,MAAM,iBAAiB,OAAO;AAC9B,MAAM,cAAc,OAAO;AAE3B,IAAI,CAAC;CAAC;CAAU;CAAQ;CAAQ,CAAC,SAAS,YAAY,EAAE;AACtD,SAAQ,MAAM,sBAAsB,YAAY,mCAAmC;AACnF,SAAQ,KAAK,EAAE;;AAEjB,MAAM,WAAW;AAEjB,IAAI,OAAO,MAAM,KAAK,IAAI,OAAO,KAAK,OAAO,OAAO;AAClD,SAAQ,MAAM,iBAAiB,OAAO,OAAO;AAC7C,SAAQ,KAAK,EAAE;;AAGjB,IAAI,OAAO,MAAM,QAAQ,IAAI,UAAU,GAAG;AACxC,SAAQ,MAAM,oBAAoB,OAAO,UAAU;AACnD,SAAQ,KAAK,EAAE;;AAGjB,IAAI,OAAO,MAAM,UAAU,IAAI,YAAY,GAAG;AAC5C,SAAQ,MAAM,uBAAuB,OAAO,gBAAgB;AAC5D,SAAQ,KAAK,EAAE;;AAGjB,MAAM,aAAa,OAAO,OAAO,eAAe;AAChD,IAAI,OAAO,MAAM,WAAW,IAAI,CAAC,OAAO,UAAU,WAAW,IAAI,aAAa,GAAG;AAC/E,SAAQ,MACN,wBAAwB,OAAO,eAAe,6DAC/C;AACD,SAAQ,KAAK,EAAE;;AAGjB,MAAM,sBAAsB,OAAO;AACnC,MAAM,mBAAmB,OAAO,oBAAoB;AACpD,IAAI,OAAO,MAAM,iBAAiB,IAAI,CAAC,OAAO,UAAU,iBAAiB,IAAI,mBAAmB,GAAG;AACjG,SAAQ,MACN,+BAA+B,oBAAoB,kDACpD;AACD,SAAQ,KAAK,EAAE;;AAGjB,MAAM,SAAS,IAAI,OAAO,SAAS;AAGnC,IAAI;AACJ;CACE,MAAM,UAAU,OAAO;CACvB,MAAM,eAAe,OAAO;CAC5B,MAAM,gBAAgB,OAAO;AAE7B,KAAI,YAAY,UAAa,iBAAiB,UAAa,kBAAkB,QAAW;AACtF,UAAQ,EAAE;AACV,MAAI,YAAY,QAAW;GACzB,MAAM,MAAM,WAAW,QAAQ;AAC/B,OAAI,MAAM,IAAI,IAAI,MAAM,KAAK,MAAM,GAAG;AACpC,YAAQ,MAAM,uBAAuB,QAAQ,gBAAgB;AAC7D,YAAQ,KAAK,EAAE;;AAEjB,SAAM,WAAW;;AAEnB,MAAI,iBAAiB,QAAW;GAC9B,MAAM,MAAM,WAAW,aAAa;AACpC,OAAI,MAAM,IAAI,IAAI,MAAM,KAAK,MAAM,GAAG;AACpC,YAAQ,MAAM,4BAA4B,aAAa,gBAAgB;AACvE,YAAQ,KAAK,EAAE;;AAEjB,SAAM,gBAAgB;;AAExB,MAAI,kBAAkB,QAAW;GAC/B,MAAM,MAAM,WAAW,cAAc;AACrC,OAAI,MAAM,IAAI,IAAI,MAAM,KAAK,MAAM,GAAG;AACpC,YAAQ,MAAM,6BAA6B,cAAc,gBAAgB;AACzE,YAAQ,KAAK,EAAE;;AAEjB,SAAM,iBAAiB;;;;AAM7B,IAAI;AACJ,IAAI,OAAO,UAAU,OAAO,eAAe;CACzC,MAAM,YAAuC,EAAE;AAC/C,KAAI,OAAO,mBAAoB,WAAU,SAAS,OAAO;AACzD,KAAI,OAAO,sBAAuB,WAAU,YAAY,OAAO;AAC/D,KAAI,OAAO,mBAAoB,WAAU,SAAS,OAAO;AACzD,KAAI,OAAO,qBAAsB,WAAU,WAAW,OAAO;AAC7D,KAAI,OAAO,oBAAqB,WAAU,UAAU,OAAO;AAC3D,KAAI,OAAO,kBAAmB,WAAU,QAAQ,OAAO;AACvD,KAAI,OAAO,mBAAoB,WAAU,SAAS,OAAO;AACzD,KAAI,OAAO,mBAAoB,WAAU,SAAS,OAAO;AAEzD,KAAI,OAAO,KAAK,UAAU,CAAC,WAAW,GAAG;AACvC,UAAQ,MACN,YAAY,OAAO,gBAAgB,eAAe,SAAS,0CAC5D;AACD,UAAQ,KAAK,EAAE;;CAOjB,MAAM,aAAa,cAAc;CACjC,MAAM,kBAAkB,gBAAgB,KAAK,WAAW;AACxD,KAAI,OAAO,UAAU,iBAAiB;AACpC,UAAQ,MACN,2FAA2F,aAC5F;AACD,UAAQ,KAAK,EAAE;;AAEjB,UAAS;EACP;EAIA,aAAa,kBAAkB,SAAY,QAAQ,YAAY,WAAW;EAC1E,WAAW,OAAO;EACnB;;AAIH,IAAI;AACJ,IAAI,OAAO,kBAAkB,OAAO,oBAAoB;AACtD,KAAI,CAAC,OAAO,kBAAkB;AAC5B,UAAQ,MAAM,kEAAkE;AAChF,UAAQ,KAAK,EAAE;;CAIjB,MAAM,WAAW,cAAc;CAC/B,MAAM,gBAAgB,gBAAgB,KAAK,SAAS;AACpD,KAAI,OAAO,kBAAkB,eAAe;AAC1C,UAAQ,MACN,gGAAgG,WACjG;AACD,UAAQ,KAAK,EAAE;;CAEjB,MAAM,OAAO,IAAI,UAAU;AAC3B,MAAK,gBAAgB;EACnB,UAAU,OAAO;EAIjB,aAAa,gBAAgB,SAAY,QAAQ,UAAU,gBAAgB;EAC3E,WAAW,OAAO;EACnB,CAAC;AACF,aAAY;EAAE,MAAM;EAAS,SAAS;EAAM;;AAS9C,eAAe,2BAA6D;CAC1E,MAAM,WAAoC,EAAE;AAC5C,MAAK,MAAM,SAAS,eAAe;EACjC,IAAI;AACJ,MAAI;AACF,WAAQ,MAAM,qBAAqB,OAAO;IACxC;IACA;IACD,CAAC;WACK,KAAK;GACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,WAAQ,MAAM,uCAAuC,MAAM,KAAK,MAAM;AACtE,WAAQ,KAAK,EAAE;;AAEjB,MAAI,CAAC,MAAM,KAET;AAEF,MAAI;GACF,MAAM,OAAO,SAAS,MAAM,KAAK;AACjC,YAAS,KAAK;IAAE,QAAQ,MAAM;IAAQ,MAAM,MAAM;IAAM,OAAO,KAAK,aAAa;IAAE,CAAC;WAC7E,KAAK;AACZ,OAAK,IAA8B,SAAS,SAC1C,SAAQ,MAAM,4BAA4B,MAAM,OAAO;QAClD;IACL,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,YAAQ,MAAM,gCAAgC,MAAM,KAAK,IAAI,MAAM;;AAErE,WAAQ,KAAK,EAAE;;;AAGnB,QAAO;;AAGT,SAAS,WAAW,QAA0C;AAC5D,QAAO,OAAO,QACV,oBAAoB,OAAO,MAAM,OAAO,GACxC,gBAAgB,OAAO,MAAM,OAAO;;AAG1C,eAAe,OAAO;CACpB,MAAM,UAAU,MAAM,0BAA0B;CAEhD,MAAM,WAAsB,EAAE;AAC9B,MAAK,MAAM,OAAO,QAChB,UAAS,KAAK,GAAG,WAAW,IAAI,CAAC;AAGnC,KAAI,SAAS,WAAW,GAAG;AACzB,MAAI,kBAAkB,OAAO,QAAQ;AACnC,WAAQ,MAAM,8EAA8E;AAC5F,WAAQ,KAAK,EAAE;;AAEjB,UAAQ,KAAK,4EAA4E;;CAG3F,MAAM,cAAc,QAAQ,KAAK,MAAM,EAAE,OAAO,CAAC,KAAK,KAAK,IAAI;AAC/D,QAAO,KAAK,UAAU,SAAS,OAAO,mBAAmB,cAAc;AAGvE,KAAI,gBAAgB;EAClB,MAAM,UAAU,iBAAiB,SAAS;EAC1C,MAAM,SAAS,QAAQ,QAAQ,MAAM,EAAE,aAAa,QAAQ;EAC5D,MAAM,WAAW,QAAQ,QAAQ,MAAM,EAAE,aAAa,UAAU;AAEhE,OAAK,MAAM,KAAK,SACd,QAAO,KAAK,WAAW,EAAE,aAAa,IAAI,EAAE,UAAU;AAExD,OAAK,MAAM,KAAK,OACd,QAAO,MAAM,WAAW,EAAE,aAAa,IAAI,EAAE,UAAU;AAGzD,MAAI,OAAO,SAAS,GAAG;AACrB,WAAQ,MAAM,sBAAsB,OAAO,OAAO,aAAa,SAAS,OAAO,aAAa;AAC5F,WAAQ,KAAK,EAAE;;;CAInB,MAAM,SAAS,YAAY,CAAC,UAAU,GAAG;CAEzC,MAAM,WAAW,MAAM,aACrB,UACA;EACE;EACA;EACA;EACA;EACA;EACA;EACA,SAAS,OAAO;EAChB;EACA,QAAQ,OAAO;EACf,mBAAmB;EACnB,yBAAyB;EAC1B,EACD,OACD;AAED,QAAO,KAAK,8BAA8B,SAAS,MAAM;CAIzD,IAAI,UAAwC;AAC5C,KAAI,WAAW;EACb,MAAM,UAAU,QAAQ;AACxB,MAAI,CAAC,QACH,QAAO,KAAK,wEAAwE;OAC/E;GACL,MAAM,eAA0B,WAAW,QAAQ;AACnD,aAAU,cAAc,QAAQ,MAAM,UAAU,QAAQ;IACtD;IACA,UAAU;IACV,YAAY;IACb,CAAC;AACF,UAAO,KAAK,YAAY,QAAQ,KAAK,cAAc;;;CAIvD,SAAS,WAAW;AAClB,SAAO,KAAK,mBAAmB;AAC/B,MAAI,QAAS,SAAQ,OAAO;AAC5B,WAAS,OAAO,YAAY;AAC1B,WAAQ,KAAK,EAAE;IACf;;AAGJ,SAAQ,GAAG,UAAU,SAAS;AAC9B,SAAQ,GAAG,WAAW,SAAS;;AAGjC,MAAM,CAAC,OAAO,QAAQ;AACpB,SAAQ,MAAM,IAAI;AAClB,SAAQ,KAAK,EAAE;EACf"}

package/dist/config-loader.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"config-loader.d.cts","names":[],"sources":["../src/config-loader.ts"],"sourcesContent":[],"mappings":";;;;;;;;UAciB,aAAA,SAAsB;;AAAvC;AAIiB,UAAA,iBAAA,CAAiB;EASjB,GAAA,EAAA,MAAA;EAAgB,IAAA,EAAA,MAAA;UAEnB,CAAA,EAAA,MAAA;aAF2B,CAAA,EAAA,MAAA;EAAmB,IAAA,CAAA,EAAA,MAAA;EAM3C,IAAA,CAAA,EAAA,MAAS;;AAGhB,UATO,eAAA,SAAwB,mBAS/B,CAAA;QACI,CAAA,EAAA;IACF,QAAA,EATE,KASF,CAAA;MAAe,IAAA,EAAA,MAAA;MAGV,OAAA,EAAA;QAAgB,IAAA,EAAA,MAAA;QAEvB,IAAA,EAAA,MAAA;MACI,CAAA;IACH,CAAA,CAAA;EAAc,CAAA;AAIzB;AAAgC,UAhBf,SAAA,CAgBe;MACnB,CAAA,EAAA,MAAA;YACH,CAAA,EAAA;IACS,IAAA,EAAA,MAAA;IAHqB,OAAA,EAAA,MAAA;EAAkB,CAAA;EAMzC,KAAA,CAAA,EAnBP,aAmBgB,EAAA;EAKT,SAAA,CAAA,EAvBH,iBAuBoB,EAAA;EAOjB,OAAA,CAAA,EA7BL,eA+BC,EAAA;AAGb;AAAuC,UA/BtB,gBAAA,CA+BsB;SAMxB,EAAA,MAAA;OAHH,CAAA,EAhCF,OAgCE,EAAA;WAKK,CAAA,EApCH,WAoCG,EAAA;EAAW,MAAA,CAAA,EAnCjB,cAmCiB,EAAA;EAGX,OAAA,CAAA,EAAA,MAAY;AAK7B;AAA6B,UAvCZ,cAAA,SAAuB,kBAuCX,CAAA;UAGjB,CAAA,EAzCC,gBAyCD,EAAA;OACC,CAAA,EAzCH,gBAyCG,EAAA;gBAEL,CAAA,EA1CW,gBA0CX,EAAA;;AAEC,UAzCQ,SAAA,CAyCR;MACE,CAAA,EAAA,MAAA;EAAY,MAAA,CAAA,EAxCZ,cAwCY,EAAA;AAQvB;AAKsB,UAlDL,iBAAA,CAkDoB;EAAA,KAAA,EAAA;IAC3B,OAAA,CAAA,EAAA,MAAA;IAEW,QAAA,CAAA,EAAA,MAAA;IAAlB,QAAA,CAAA,EAAA,MAAA;EAAO,CAAA;;WAlDC;;;UAIM,UAAA;;aAEJ;;UAGI,sBAAA;;;YAGL;;;eAGG;;iBAEE;;UAGA,YAAA;;gBAED;;UAGC,YAAA;;;YAGL;aACC;;QAEL;QACA;SACC;WACE;;;;;;;;;;;iBAQK,UAAA,sBAAgC;iBAK1B,eAAA,SACZ;;;IAEP;UAAkB"}
+{"version":3,"file":"config-loader.d.cts","names":[],"sources":["../src/config-loader.ts"],"sourcesContent":[],"mappings":";;;;;;;;UAciB,aAAA,SAAsB;;AAAvC;AAIiB,UAAA,iBAAA,CAAiB;EASjB,GAAA,EAAA,MAAA;EAAgB,IAAA,EAAA,MAAA;UAEnB,CAAA,EAAA,MAAA;aAF2B,CAAA,EAAA,MAAA;EAAmB,IAAA,CAAA,EAAA,MAAA;EAM3C,IAAA,CAAA,EAAA,MAAS;;AAGhB,UATO,eAAA,SAAwB,mBAS/B,CAAA;QACI,CAAA,EAAA;IACF,QAAA,EATE,KASF,CAAA;MAAe,IAAA,EAAA,MAAA;MAGV,OAAA,EAAA;QAAgB,IAAA,EAAA,MAAA;QAEvB,IAAA,EAAA,MAAA;MACI,CAAA;IACH,CAAA,CAAA;EAAc,CAAA;AAIzB;AAAgC,UAhBf,SAAA,CAgBe;MACnB,CAAA,EAAA,MAAA;YACH,CAAA,EAAA;IACS,IAAA,EAAA,MAAA;IAHqB,OAAA,EAAA,MAAA;EAAkB,CAAA;EAMzC,KAAA,CAAA,EAnBP,aAmBgB,EAEf;EAGM,SAAA,CAAA,EAvBH,iBAuBoB,EAGvB;EAIM,OAAA,CAAA,EA7BL,eA+BC,EAAA;AAGb;AAAuC,UA/BtB,gBAAA,CA+BsB;SAMxB,EAAA,MAAA;OAHH,CAAA,EAhCF,OAgCE,EAAA;WAKK,CAAA,EApCH,WAoCG,EAAA;EAAW,MAAA,CAAA,EAnCjB,cAmCiB,EAAA;EAGX,OAAA,CAAA,EAAA,MAAY;AAK7B;AAA6B,UAvCZ,cAAA,SAAuB,kBAuCX,CAAA;UAGjB,CAAA,EAzCC,gBAyCD,EAAA;OACC,CAAA,EAzCH,gBAyCG,EAAA;gBAEL,CAAA,EA1CW,gBA0CX,EAAA;;AAEC,UAzCQ,SAAA,CAyCR;MACE,CAAA,EAAA,MAAA;EAAY,MAAA,CAAA,EAxCZ,cAwCY,EAAA;AAQvB;AAKsB,UAlDL,iBAAA,CAkDoB;EAAA,KAAA,EAAA;IAC3B,OAAA,CAAA,EAAA,MAAA;IAEW,QAAA,CAAA,EAAA,MAAA;IAAlB,QAAA,CAAA,EAAA,MAAA;EAAO,CAAA;;WAlDC;;;UAIM,UAAA;;aAEJ;;UAGI,sBAAA;;;YAGL;;;eAGG;;iBAEE;;UAGA,YAAA;;gBAED;;UAGC,YAAA;;;YAGL;aACC;;QAEL;QACA;SACC;WACE;;;;;;;;;;;iBAQK,UAAA,sBAAgC;iBAK1B,eAAA,SACZ;;;IAEP;UAAkB"}

package/dist/config-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-loader.d.ts","names":[],"sources":["../src/config-loader.ts"],"sourcesContent":[],"mappings":";;;;;;;;UAciB,aAAA,SAAsB;;AAAvC;AAIiB,UAAA,iBAAA,CAAiB;EASjB,GAAA,EAAA,MAAA;EAAgB,IAAA,EAAA,MAAA;UAEnB,CAAA,EAAA,MAAA;aAF2B,CAAA,EAAA,MAAA;EAAmB,IAAA,CAAA,EAAA,MAAA;EAM3C,IAAA,CAAA,EAAA,MAAS;;AAGhB,UATO,eAAA,SAAwB,mBAS/B,CAAA;QACI,CAAA,EAAA;IACF,QAAA,EATE,KASF,CAAA;MAAe,IAAA,EAAA,MAAA;MAGV,OAAA,EAAA;QAAgB,IAAA,EAAA,MAAA;QAEvB,IAAA,EAAA,MAAA;MACI,CAAA;IACH,CAAA,CAAA;EAAc,CAAA;AAIzB;AAAgC,UAhBf,SAAA,CAgBe;MACnB,CAAA,EAAA,MAAA;YACH,CAAA,EAAA;IACS,IAAA,EAAA,MAAA;IAHqB,OAAA,EAAA,MAAA;EAAkB,CAAA;EAMzC,KAAA,CAAA,EAnBP,aAmBgB,EAEf;EAGM,SAAA,CAAA,EAvBH,iBAuBoB,EAGvB;EAIM,OAAA,CAAA,EA7BL,eA+BC,EAAA;AAGb;AAAuC,UA/BtB,gBAAA,CA+BsB;SAMxB,EAAA,MAAA;OAHH,CAAA,EAhCF,OAgCE,EAAA;WAKK,CAAA,EApCH,WAoCG,EAAA;EAAW,MAAA,CAAA,EAnCjB,cAmCiB,EAAA;EAGX,OAAA,CAAA,EAAA,MAAY;AAK7B;AAA6B,UAvCZ,cAAA,SAAuB,kBAuCX,CAAA;UAGjB,CAAA,EAzCC,gBAyCD,EAAA;OACC,CAAA,EAzCH,gBAyCG,EAAA;gBAEL,CAAA,EA1CW,gBA0CX,EAAA;;AAEC,UAzCQ,SAAA,CAyCR;MACE,CAAA,EAAA,MAAA;EAAY,MAAA,CAAA,EAxCZ,cAwCY,EAAA;AAQvB;AAKsB,UAlDL,iBAAA,CAkDoB;EAAA,KAAA,EAAA;IAC3B,OAAA,CAAA,EAAA,MAAA;IAEW,QAAA,CAAA,EAAA,MAAA;IAAlB,QAAA,CAAA,EAAA,MAAA;EAAO,CAAA;;WAlDC;;;UAIM,UAAA;;aAEJ;;UAGI,sBAAA;;;YAGL;;;eAGG;;iBAEE;;UAGA,YAAA;;gBAED;;UAGC,YAAA;;;YAGL;aACC;;QAEL;QACA;SACC;WACE;;;;;;;;;;;iBAQK,UAAA,sBAAgC;iBAK1B,eAAA,SACZ;;;IAEP;UAAkB"}
+{"version":3,"file":"config-loader.d.ts","names":[],"sources":["../src/config-loader.ts"],"sourcesContent":[],"mappings":";;;;;;;;UAciB,aAAA,SAAsB;;AAAvC;AAIiB,UAAA,iBAAA,CAAiB;EASjB,GAAA,EAAA,MAAA;EAAgB,IAAA,EAAA,MAAA;UAEnB,CAAA,EAAA,MAAA;aAF2B,CAAA,EAAA,MAAA;EAAmB,IAAA,CAAA,EAAA,MAAA;EAM3C,IAAA,CAAA,EAAA,MAAS;;AAGhB,UATO,eAAA,SAAwB,mBAS/B,CAAA;QACI,CAAA,EAAA;IACF,QAAA,EATE,KASF,CAAA;MAAe,IAAA,EAAA,MAAA;MAGV,OAAA,EAAA;QAAgB,IAAA,EAAA,MAAA;QAEvB,IAAA,EAAA,MAAA;MACI,CAAA;IACH,CAAA,CAAA;EAAc,CAAA;AAIzB;AAAgC,UAhBf,SAAA,CAgBe;MACnB,CAAA,EAAA,MAAA;YACH,CAAA,EAAA;IACS,IAAA,EAAA,MAAA;IAHqB,OAAA,EAAA,MAAA;EAAkB,CAAA;EAMzC,KAAA,CAAA,EAnBP,aAmBgB,EAAA;EAKT,SAAA,CAAA,EAvBH,iBAuBoB,EAAA;EAOjB,OAAA,CAAA,EA7BL,eA+BC,EAAA;AAGb;AAAuC,UA/BtB,gBAAA,CA+BsB;SAMxB,EAAA,MAAA;OAHH,CAAA,EAhCF,OAgCE,EAAA;WAKK,CAAA,EApCH,WAoCG,EAAA;EAAW,MAAA,CAAA,EAnCjB,cAmCiB,EAAA;EAGX,OAAA,CAAA,EAAA,MAAY;AAK7B;AAA6B,UAvCZ,cAAA,SAAuB,kBAuCX,CAAA;UAGjB,CAAA,EAzCC,gBAyCD,EAAA;OACC,CAAA,EAzCH,gBAyCG,EAAA;gBAEL,CAAA,EA1CW,gBA0CX,EAAA;;AAEC,UAzCQ,SAAA,CAyCR;MACE,CAAA,EAAA,MAAA;EAAY,MAAA,CAAA,EAxCZ,cAwCY,EAAA;AAQvB;AAKsB,UAlDL,iBAAA,CAkDoB;EAAA,KAAA,EAAA;IAC3B,OAAA,CAAA,EAAA,MAAA;IAEW,QAAA,CAAA,EAAA,MAAA;IAAlB,QAAA,CAAA,EAAA,MAAA;EAAO,CAAA;;WAlDC;;;UAIM,UAAA;;aAEJ;;UAGI,sBAAA;;;YAGL;;;eAGG;;iBAEE;;UAGA,YAAA;;gBAED;;UAGC,YAAA;;;YAGL;aACC;;QAEL;QACA;SACC;WACE;;;;;;;;;;;iBAQK,UAAA,sBAAgC;iBAK1B,eAAA,SACZ;;;IAEP;UAAkB"}

package/dist/fixtures-remote.cjs

@@ -0,0 +1,225 @@
+const require_runtime = require('./_virtual/_rolldown/runtime.cjs');
+let node_crypto = require("node:crypto");
+let node_path = require("node:path");
+let node_fs = require("node:fs");
+let node_dns_promises = require("node:dns/promises");
+let node_net = require("node:net");
+let node_os = require("node:os");
+
+//#region src/fixtures-remote.ts
+const REMOTE_FETCH_TIMEOUT_MS = 1e4;
+const REMOTE_MAX_BYTES = 50 * 1024 * 1024;
+/**
+* Private / reserved address ranges blocked by default to prevent SSRF.
+*
+* The list covers RFC1918 / CGNAT / loopback / link-local / cloud-metadata /
+* ULA / multicast / unspecified — any destination that could let an attacker
+* pivot a fetch into the local network or cloud control plane via a hostile
+* `--fixtures` URL.  Set `AIMOCK_ALLOW_PRIVATE_URLS=1` to opt out (required
+* for local dev / tests that target 127.0.0.1).
+*/
+const PRIVATE_V4_RANGES = [
+	["0.0.0.0", 8],
+	["10.0.0.0", 8],
+	["100.64.0.0", 10],
+	["127.0.0.0", 8],
+	["169.254.0.0", 16],
+	["172.16.0.0", 12],
+	["192.0.0.0", 24],
+	["192.0.2.0", 24],
+	["192.88.99.0", 24],
+	["192.168.0.0", 16],
+	["198.18.0.0", 15],
+	["198.51.100.0", 24],
+	["203.0.113.0", 24],
+	["224.0.0.0", 4],
+	["240.0.0.0", 4],
+	["255.255.255.255", 32]
+];
+const PRIVATE_V6_RANGES = [
+	["::", 128],
+	["::1", 128],
+	["fc00::", 7],
+	["fe80::", 10]
+];
+function buildBlockList() {
+	const bl = new node_net.BlockList();
+	for (const [addr, prefix] of PRIVATE_V4_RANGES) bl.addSubnet(addr, prefix, "ipv4");
+	for (const [addr, prefix] of PRIVATE_V6_RANGES) bl.addSubnet(addr, prefix, "ipv6");
+	return bl;
+}
+const PRIVATE_BLOCKLIST = buildBlockList();
+/**
+* Returns true if `address` is a literal IP (v4 or v6) that falls in any
+* blocked range (loopback, RFC1918, CGNAT, link-local, cloud-metadata,
+* ULA, multicast, unspecified, reserved).  Returns false for public IPs
+* and for non-literal hostnames.
+*/
+function isPrivateAddress(address) {
+	const family = (0, node_net.isIP)(address);
+	if (family === 0) return false;
+	if (family === 6) {
+		const mapped = address.toLowerCase().match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);
+		if (mapped) return isPrivateAddress(mapped[1]);
+	}
+	return PRIVATE_BLOCKLIST.check(address, family === 4 ? "ipv4" : "ipv6");
+}
+function privateUrlsAllowed() {
+	const v = process.env.AIMOCK_ALLOW_PRIVATE_URLS;
+	return v === "1" || v === "true";
+}
+/**
+* Throws if `hostname` resolves to (or literally is) a private / reserved
+* address, unless `AIMOCK_ALLOW_PRIVATE_URLS=1` is set.  If the hostname is
+* not a literal IP, all resolved addresses are checked — any blocked
+* address in the set rejects the host.
+*/
+async function assertAllowedHost(hostname) {
+	if (privateUrlsAllowed()) return;
+	if ((0, node_net.isIP)(hostname) !== 0) {
+		if (isPrivateAddress(hostname)) throw new Error(`Refusing to fetch from private address ${hostname}: not allowed by default (set AIMOCK_ALLOW_PRIVATE_URLS=1 to override)`);
+		return;
+	}
+	let addresses;
+	try {
+		addresses = await (0, node_dns_promises.lookup)(hostname, { all: true });
+	} catch (err) {
+		return;
+	}
+	for (const a of addresses) if (isPrivateAddress(a.address)) throw new Error(`Refusing to fetch from ${hostname}: resolves to private address ${a.address} (set AIMOCK_ALLOW_PRIVATE_URLS=1 to override)`);
+}
+/**
+* Returns true if `value` looks like a URL (has a scheme followed by ://).
+* Path inputs like ./fixtures or /tmp/x never start with a scheme.
+*/
+function looksLikeUrl(value) {
+	return /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//.test(value);
+}
+/**
+* Returns the default on-disk cache root for fetched fixtures.
+* Honors $XDG_CACHE_HOME when set, otherwise falls back to ~/.cache.
+*/
+function defaultCacheRoot() {
+	const xdg = process.env.XDG_CACHE_HOME;
+	return (0, node_path.join)(xdg && xdg.length > 0 ? xdg : (0, node_path.join)((0, node_os.homedir)(), ".cache"), "aimock", "fixtures");
+}
+function sha256Hex(input) {
+	return (0, node_crypto.createHash)("sha256").update(input).digest("hex");
+}
+/**
+* Resolve a single --fixtures value to a local filesystem path.
+*
+* Behavior:
+* - Filesystem path → return as-is.
+* - https://, http:// URL → fetch JSON (once) to the on-disk cache; return the cached path.
+*   On fetch failure, fall back to a pre-existing cached copy if present (warn + continue).
+*   If --validate-on-load is set and no cache is usable, throws.
+* - Any other scheme (file://, ftp://, ...) → throws.
+*/
+async function resolveFixturesValue(value, opts) {
+	if (!looksLikeUrl(value)) return {
+		source: value,
+		path: (0, node_path.resolve)(value)
+	};
+	const lower = value.toLowerCase();
+	if (!lower.startsWith("https://") && !lower.startsWith("http://")) {
+		const match = value.match(/^([a-zA-Z][a-zA-Z0-9+.-]*):\/\//);
+		const scheme = match ? match[1] : "unknown";
+		throw new Error(`Unsupported --fixtures URL scheme "${scheme}" in ${value} (only https:// and http:// are supported)`);
+	}
+	return await resolveHttpFixture(value, opts);
+}
+async function resolveHttpFixture(url, opts) {
+	const fetchImpl = opts.fetchImpl ?? fetch;
+	const cacheRoot = opts.cacheRoot ?? defaultCacheRoot();
+	const timeoutMs = opts.timeoutMs ?? REMOTE_FETCH_TIMEOUT_MS;
+	const maxBytes = opts.maxBytes ?? REMOTE_MAX_BYTES;
+	const cacheDir = (0, node_path.join)(cacheRoot, sha256Hex(url));
+	const cacheFile = (0, node_path.join)(cacheDir, "fixtures.json");
+	try {
+		await assertAllowedHost(new URL(url).hostname);
+		const body = await fetchWithLimits(url, fetchImpl, timeoutMs, maxBytes);
+		JSON.parse(body);
+		(0, node_fs.mkdirSync)(cacheDir, { recursive: true });
+		(0, node_fs.writeFileSync)(cacheFile, body, "utf-8");
+		opts.logger.info(`Fetched ${url} (${body.length} bytes) → cached at ${cacheFile}`);
+		return {
+			source: url,
+			path: cacheFile
+		};
+	} catch (err) {
+		const msg = err instanceof Error ? err.message : String(err);
+		if (cacheFileExists(cacheFile)) {
+			opts.logger.warn(`upstream fetch failed for ${url} (${msg}); using cached copy at ${cacheFile}`);
+			return {
+				source: url,
+				path: cacheFile
+			};
+		}
+		if (opts.validateOnLoad) throw new Error(`Failed to fetch ${url} and no cached copy available: ${msg}`);
+		opts.logger.warn(`upstream fetch failed for ${url} (${msg}); no cached copy available — skipping`);
+		return {
+			source: url,
+			path: ""
+		};
+	}
+}
+function cacheFileExists(file) {
+	try {
+		return (0, node_fs.statSync)(file).isFile();
+	} catch {
+		return false;
+	}
+}
+async function fetchWithLimits(url, fetchImpl, timeoutMs, maxBytes) {
+	const controller = new AbortController();
+	const timer = setTimeout(() => controller.abort(/* @__PURE__ */ new Error("timeout")), timeoutMs);
+	try {
+		const res = await fetchImpl(url, {
+			signal: controller.signal,
+			redirect: "manual"
+		});
+		if (res.status >= 300 && res.status < 400) {
+			const location = res.headers.get("location") ?? "<none>";
+			throw new Error(`redirect not allowed: upstream returned ${res.status} → ${location} (configure the upstream to serve the final URL directly; redirects are disabled to prevent scheme-bypass)`);
+		}
+		if (!res.ok) throw new Error(`HTTP ${res.status} ${res.statusText}`);
+		const len = res.headers.get("content-length");
+		if (len) {
+			const n = Number(len);
+			if (Number.isFinite(n) && n > maxBytes) throw new Error(`response too large: content-length ${n} exceeds limit ${maxBytes} bytes`);
+		}
+		if (!res.body) {
+			const text = await res.text();
+			if (Buffer.byteLength(text, "utf-8") > maxBytes) throw new Error(`response too large: body exceeds limit ${maxBytes} bytes`);
+			return text;
+		}
+		const reader = res.body.getReader();
+		const chunks = [];
+		let total = 0;
+		for (;;) {
+			const { value, done } = await reader.read();
+			if (done) break;
+			if (value) {
+				total += value.byteLength;
+				if (total > maxBytes) {
+					try {
+						await reader.cancel();
+					} catch {}
+					throw new Error(`response too large: body exceeds limit ${maxBytes} bytes`);
+				}
+				chunks.push(value);
+			}
+		}
+		return Buffer.concat(chunks).toString("utf-8");
+	} catch (err) {
+		if (err instanceof Error && (err.name === "AbortError" || err.message === "timeout")) throw new Error(`fetch timed out after ${timeoutMs}ms`);
+		throw err;
+	} finally {
+		clearTimeout(timer);
+	}
+}
+
+//#endregion
+exports.resolveFixturesValue = resolveFixturesValue;
+//# sourceMappingURL=fixtures-remote.cjs.map

package/dist/fixtures-remote.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"fixtures-remote.cjs","names":["BlockList"],"sources":["../src/fixtures-remote.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { mkdirSync, writeFileSync, statSync } from \"node:fs\";\nimport { lookup as dnsLookup } from \"node:dns/promises\";\nimport { BlockList, isIP } from \"node:net\";\nimport { homedir } from \"node:os\";\nimport { join, resolve as pathResolve } from \"node:path\";\nimport type { Logger } from \"./logger.js\";\n\nexport const REMOTE_FETCH_TIMEOUT_MS = 10_000;\nexport const REMOTE_MAX_BYTES = 50 * 1024 * 1024; // 50 MB\n\n/**\n * Private / reserved address ranges blocked by default to prevent SSRF.\n *\n * The list covers RFC1918 / CGNAT / loopback / link-local / cloud-metadata /\n * ULA / multicast / unspecified — any destination that could let an attacker\n * pivot a fetch into the local network or cloud control plane via a hostile\n * `--fixtures` URL.  Set `AIMOCK_ALLOW_PRIVATE_URLS=1` to opt out (required\n * for local dev / tests that target 127.0.0.1).\n */\nconst PRIVATE_V4_RANGES: Array<[string, number]> = [\n  [\"0.0.0.0\", 8], // \"this network\"\n  [\"10.0.0.0\", 8], // RFC1918\n  [\"100.64.0.0\", 10], // CGNAT\n  [\"127.0.0.0\", 8], // loopback\n  [\"169.254.0.0\", 16], // link-local / cloud metadata\n  [\"172.16.0.0\", 12], // RFC1918\n  [\"192.0.0.0\", 24], // IETF protocol assignments\n  [\"192.0.2.0\", 24], // TEST-NET-1\n  [\"192.88.99.0\", 24], // 6to4 relay anycast (deprecated)\n  [\"192.168.0.0\", 16], // RFC1918\n  [\"198.18.0.0\", 15], // benchmarking\n  [\"198.51.100.0\", 24], // TEST-NET-2\n  [\"203.0.113.0\", 24], // TEST-NET-3\n  [\"224.0.0.0\", 4], // multicast\n  [\"240.0.0.0\", 4], // reserved\n  [\"255.255.255.255\", 32], // broadcast\n];\n\nconst PRIVATE_V6_RANGES: Array<[string, number]> = [\n  [\"::\", 128], // unspecified\n  [\"::1\", 128], // loopback\n  [\"fc00::\", 7], // ULA\n  [\"fe80::\", 10], // link-local\n];\n\nfunction buildBlockList(): BlockList {\n  const bl = new BlockList();\n  for (const [addr, prefix] of PRIVATE_V4_RANGES) bl.addSubnet(addr, prefix, \"ipv4\");\n  for (const [addr, prefix] of PRIVATE_V6_RANGES) bl.addSubnet(addr, prefix, \"ipv6\");\n  return bl;\n}\n\nconst PRIVATE_BLOCKLIST: BlockList = buildBlockList();\n\n/**\n * Returns true if `address` is a literal IP (v4 or v6) that falls in any\n * blocked range (loopback, RFC1918, CGNAT, link-local, cloud-metadata,\n * ULA, multicast, unspecified, reserved).  Returns false for public IPs\n * and for non-literal hostnames.\n */\nexport function isPrivateAddress(address: string): boolean {\n  const family = isIP(address);\n  if (family === 0) return false; // not a literal IP\n  // BlockList.check's \"ipv6\" bucket does not match v4-mapped ::ffff:a.b.c.d\n  // automatically — unwrap to the underlying v4 address and recurse.\n  if (family === 6) {\n    const lower = address.toLowerCase();\n    const mapped = lower.match(/^::ffff:(\\d+\\.\\d+\\.\\d+\\.\\d+)$/);\n    if (mapped) return isPrivateAddress(mapped[1]);\n  }\n  return PRIVATE_BLOCKLIST.check(address, family === 4 ? \"ipv4\" : \"ipv6\");\n}\n\nfunction privateUrlsAllowed(): boolean {\n  const v = process.env.AIMOCK_ALLOW_PRIVATE_URLS;\n  return v === \"1\" || v === \"true\";\n}\n\n/**\n * Throws if `hostname` resolves to (or literally is) a private / reserved\n * address, unless `AIMOCK_ALLOW_PRIVATE_URLS=1` is set.  If the hostname is\n * not a literal IP, all resolved addresses are checked — any blocked\n * address in the set rejects the host.\n */\nexport async function assertAllowedHost(hostname: string): Promise<void> {\n  if (privateUrlsAllowed()) return;\n\n  if (isIP(hostname) !== 0) {\n    if (isPrivateAddress(hostname)) {\n      throw new Error(\n        `Refusing to fetch from private address ${hostname}: not allowed by default (set AIMOCK_ALLOW_PRIVATE_URLS=1 to override)`,\n      );\n    }\n    return;\n  }\n\n  let addresses: Array<{ address: string; family: number }>;\n  try {\n    addresses = await dnsLookup(hostname, { all: true });\n  } catch (err) {\n    // DNS failure is not an SSRF signal — let the fetch itself surface the\n    // resolution error with its own (more detailed) message.\n    void err;\n    return;\n  }\n  for (const a of addresses) {\n    if (isPrivateAddress(a.address)) {\n      throw new Error(\n        `Refusing to fetch from ${hostname}: resolves to private address ${a.address} (set AIMOCK_ALLOW_PRIVATE_URLS=1 to override)`,\n      );\n    }\n  }\n}\n\nexport interface RemoteResolveOptions {\n  validateOnLoad: boolean;\n  logger: Logger;\n  /** Override fetch implementation (tests). */\n  fetchImpl?: typeof fetch;\n  /** Override cache root (tests). */\n  cacheRoot?: string;\n  /** Override timeout (tests). */\n  timeoutMs?: number;\n  /** Override max response size (tests). */\n  maxBytes?: number;\n}\n\nexport interface ResolvedLocalFixture {\n  /** Original value as passed on the CLI (for logging). */\n  source: string;\n  /** Filesystem path — downstream code treats this identically to a --fixtures path. */\n  path: string;\n}\n\n/**\n * Returns true if `value` looks like a URL (has a scheme followed by ://).\n * Path inputs like ./fixtures or /tmp/x never start with a scheme.\n */\nexport function looksLikeUrl(value: string): boolean {\n  return /^[a-zA-Z][a-zA-Z0-9+.-]*:\\/\\//.test(value);\n}\n\n/**\n * Returns the default on-disk cache root for fetched fixtures.\n * Honors $XDG_CACHE_HOME when set, otherwise falls back to ~/.cache.\n */\nexport function defaultCacheRoot(): string {\n  const xdg = process.env.XDG_CACHE_HOME;\n  const base = xdg && xdg.length > 0 ? xdg : join(homedir(), \".cache\");\n  return join(base, \"aimock\", \"fixtures\");\n}\n\nfunction sha256Hex(input: string): string {\n  return createHash(\"sha256\").update(input).digest(\"hex\");\n}\n\n/**\n * Resolve a single --fixtures value to a local filesystem path.\n *\n * Behavior:\n * - Filesystem path → return as-is.\n * - https://, http:// URL → fetch JSON (once) to the on-disk cache; return the cached path.\n *   On fetch failure, fall back to a pre-existing cached copy if present (warn + continue).\n *   If --validate-on-load is set and no cache is usable, throws.\n * - Any other scheme (file://, ftp://, ...) → throws.\n */\nexport async function resolveFixturesValue(\n  value: string,\n  opts: RemoteResolveOptions,\n): Promise<ResolvedLocalFixture> {\n  if (!looksLikeUrl(value)) {\n    return { source: value, path: pathResolve(value) };\n  }\n\n  const lower = value.toLowerCase();\n  if (!lower.startsWith(\"https://\") && !lower.startsWith(\"http://\")) {\n    // Extract the scheme for a clearer error\n    const match = value.match(/^([a-zA-Z][a-zA-Z0-9+.-]*):\\/\\//);\n    const scheme = match ? match[1] : \"unknown\";\n    throw new Error(\n      `Unsupported --fixtures URL scheme \"${scheme}\" in ${value} (only https:// and http:// are supported)`,\n    );\n  }\n\n  return await resolveHttpFixture(value, opts);\n}\n\nasync function resolveHttpFixture(\n  url: string,\n  opts: RemoteResolveOptions,\n): Promise<ResolvedLocalFixture> {\n  const fetchImpl = opts.fetchImpl ?? fetch;\n  const cacheRoot = opts.cacheRoot ?? defaultCacheRoot();\n  const timeoutMs = opts.timeoutMs ?? REMOTE_FETCH_TIMEOUT_MS;\n  const maxBytes = opts.maxBytes ?? REMOTE_MAX_BYTES;\n\n  const digest = sha256Hex(url);\n  const cacheDir = join(cacheRoot, digest);\n  const cacheFile = join(cacheDir, \"fixtures.json\");\n\n  try {\n    // SSRF defense: reject private / reserved destinations before any network\n    // I/O, unless explicitly opted in via AIMOCK_ALLOW_PRIVATE_URLS=1.\n    const parsed = new URL(url);\n    await assertAllowedHost(parsed.hostname);\n\n    const body = await fetchWithLimits(url, fetchImpl, timeoutMs, maxBytes);\n    // Parse to verify it is valid JSON before caching — fail loud if not.\n    JSON.parse(body);\n    mkdirSync(cacheDir, { recursive: true });\n    writeFileSync(cacheFile, body, \"utf-8\");\n    opts.logger.info(`Fetched ${url} (${body.length} bytes) → cached at ${cacheFile}`);\n    return { source: url, path: cacheFile };\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    const cacheExists = cacheFileExists(cacheFile);\n    if (cacheExists) {\n      opts.logger.warn(\n        `upstream fetch failed for ${url} (${msg}); using cached copy at ${cacheFile}`,\n      );\n      return { source: url, path: cacheFile };\n    }\n    if (opts.validateOnLoad) {\n      throw new Error(`Failed to fetch ${url} and no cached copy available: ${msg}`);\n    }\n    opts.logger.warn(\n      `upstream fetch failed for ${url} (${msg}); no cached copy available — skipping`,\n    );\n    // Signal \"no path\" by returning a sentinel with empty path — callers detect and skip.\n    return { source: url, path: \"\" };\n  }\n}\n\nfunction cacheFileExists(file: string): boolean {\n  try {\n    return statSync(file).isFile();\n  } catch {\n    return false;\n  }\n}\n\nasync function fetchWithLimits(\n  url: string,\n  fetchImpl: typeof fetch,\n  timeoutMs: number,\n  maxBytes: number,\n): Promise<string> {\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(new Error(\"timeout\")), timeoutMs);\n  try {\n    // Redirects are disabled: following a 3xx into a different scheme or host\n    // would bypass the scheme check and SSRF denylist.  Upstream services\n    // should serve the final URL directly (e.g. GitHub raw content URLs).\n    const res = await fetchImpl(url, {\n      signal: controller.signal,\n      redirect: \"manual\",\n    });\n    if (res.status >= 300 && res.status < 400) {\n      const location = res.headers.get(\"location\") ?? \"<none>\";\n      throw new Error(\n        `redirect not allowed: upstream returned ${res.status} → ${location} (configure the upstream to serve the final URL directly; redirects are disabled to prevent scheme-bypass)`,\n      );\n    }\n    if (!res.ok) {\n      throw new Error(`HTTP ${res.status} ${res.statusText}`);\n    }\n    // Early reject on over-large Content-Length when the server reports it.\n    const len = res.headers.get(\"content-length\");\n    if (len) {\n      const n = Number(len);\n      if (Number.isFinite(n) && n > maxBytes) {\n        throw new Error(`response too large: content-length ${n} exceeds limit ${maxBytes} bytes`);\n      }\n    }\n\n    // Stream and enforce the limit incrementally in case Content-Length is absent/lying.\n    if (!res.body) {\n      const text = await res.text();\n      if (Buffer.byteLength(text, \"utf-8\") > maxBytes) {\n        throw new Error(`response too large: body exceeds limit ${maxBytes} bytes`);\n      }\n      return text;\n    }\n\n    const reader = res.body.getReader();\n    const chunks: Uint8Array[] = [];\n    let total = 0;\n    for (;;) {\n      const { value, done } = await reader.read();\n      if (done) break;\n      if (value) {\n        total += value.byteLength;\n        if (total > maxBytes) {\n          try {\n            await reader.cancel();\n          } catch {\n            // ignore cancel errors\n          }\n          throw new Error(`response too large: body exceeds limit ${maxBytes} bytes`);\n        }\n        chunks.push(value);\n      }\n    }\n    return Buffer.concat(chunks).toString(\"utf-8\");\n  } catch (err) {\n    if (err instanceof Error && (err.name === \"AbortError\" || err.message === \"timeout\")) {\n      throw new Error(`fetch timed out after ${timeoutMs}ms`);\n    }\n    throw err;\n  } finally {\n    clearTimeout(timer);\n  }\n}\n"],"mappings":";;;;;;;;;AAQA,MAAa,0BAA0B;AACvC,MAAa,mBAAmB,KAAK,OAAO;;;;;;;;;;AAW5C,MAAM,oBAA6C;CACjD,CAAC,WAAW,EAAE;CACd,CAAC,YAAY,EAAE;CACf,CAAC,cAAc,GAAG;CAClB,CAAC,aAAa,EAAE;CAChB,CAAC,eAAe,GAAG;CACnB,CAAC,cAAc,GAAG;CAClB,CAAC,aAAa,GAAG;CACjB,CAAC,aAAa,GAAG;CACjB,CAAC,eAAe,GAAG;CACnB,CAAC,eAAe,GAAG;CACnB,CAAC,cAAc,GAAG;CAClB,CAAC,gBAAgB,GAAG;CACpB,CAAC,eAAe,GAAG;CACnB,CAAC,aAAa,EAAE;CAChB,CAAC,aAAa,EAAE;CAChB,CAAC,mBAAmB,GAAG;CACxB;AAED,MAAM,oBAA6C;CACjD,CAAC,MAAM,IAAI;CACX,CAAC,OAAO,IAAI;CACZ,CAAC,UAAU,EAAE;CACb,CAAC,UAAU,GAAG;CACf;AAED,SAAS,iBAA4B;CACnC,MAAM,KAAK,IAAIA,oBAAW;AAC1B,MAAK,MAAM,CAAC,MAAM,WAAW,kBAAmB,IAAG,UAAU,MAAM,QAAQ,OAAO;AAClF,MAAK,MAAM,CAAC,MAAM,WAAW,kBAAmB,IAAG,UAAU,MAAM,QAAQ,OAAO;AAClF,QAAO;;AAGT,MAAM,oBAA+B,gBAAgB;;;;;;;AAQrD,SAAgB,iBAAiB,SAA0B;CACzD,MAAM,4BAAc,QAAQ;AAC5B,KAAI,WAAW,EAAG,QAAO;AAGzB,KAAI,WAAW,GAAG;EAEhB,MAAM,SADQ,QAAQ,aAAa,CACd,MAAM,gCAAgC;AAC3D,MAAI,OAAQ,QAAO,iBAAiB,OAAO,GAAG;;AAEhD,QAAO,kBAAkB,MAAM,SAAS,WAAW,IAAI,SAAS,OAAO;;AAGzE,SAAS,qBAA8B;CACrC,MAAM,IAAI,QAAQ,IAAI;AACtB,QAAO,MAAM,OAAO,MAAM;;;;;;;;AAS5B,eAAsB,kBAAkB,UAAiC;AACvE,KAAI,oBAAoB,CAAE;AAE1B,wBAAS,SAAS,KAAK,GAAG;AACxB,MAAI,iBAAiB,SAAS,CAC5B,OAAM,IAAI,MACR,0CAA0C,SAAS,wEACpD;AAEH;;CAGF,IAAI;AACJ,KAAI;AACF,cAAY,oCAAgB,UAAU,EAAE,KAAK,MAAM,CAAC;UAC7C,KAAK;AAIZ;;AAEF,MAAK,MAAM,KAAK,UACd,KAAI,iBAAiB,EAAE,QAAQ,CAC7B,OAAM,IAAI,MACR,0BAA0B,SAAS,gCAAgC,EAAE,QAAQ,gDAC9E;;;;;;AA6BP,SAAgB,aAAa,OAAwB;AACnD,QAAO,gCAAgC,KAAK,MAAM;;;;;;AAOpD,SAAgB,mBAA2B;CACzC,MAAM,MAAM,QAAQ,IAAI;AAExB,4BADa,OAAO,IAAI,SAAS,IAAI,gDAAoB,EAAE,SAAS,EAClD,UAAU,WAAW;;AAGzC,SAAS,UAAU,OAAuB;AACxC,oCAAkB,SAAS,CAAC,OAAO,MAAM,CAAC,OAAO,MAAM;;;;;;;;;;;;AAazD,eAAsB,qBACpB,OACA,MAC+B;AAC/B,KAAI,CAAC,aAAa,MAAM,CACtB,QAAO;EAAE,QAAQ;EAAO,6BAAkB,MAAM;EAAE;CAGpD,MAAM,QAAQ,MAAM,aAAa;AACjC,KAAI,CAAC,MAAM,WAAW,WAAW,IAAI,CAAC,MAAM,WAAW,UAAU,EAAE;EAEjE,MAAM,QAAQ,MAAM,MAAM,kCAAkC;EAC5D,MAAM,SAAS,QAAQ,MAAM,KAAK;AAClC,QAAM,IAAI,MACR,sCAAsC,OAAO,OAAO,MAAM,4CAC3D;;AAGH,QAAO,MAAM,mBAAmB,OAAO,KAAK;;AAG9C,eAAe,mBACb,KACA,MAC+B;CAC/B,MAAM,YAAY,KAAK,aAAa;CACpC,MAAM,YAAY,KAAK,aAAa,kBAAkB;CACtD,MAAM,YAAY,KAAK,aAAa;CACpC,MAAM,WAAW,KAAK,YAAY;CAGlC,MAAM,+BAAgB,WADP,UAAU,IAAI,CACW;CACxC,MAAM,gCAAiB,UAAU,gBAAgB;AAEjD,KAAI;AAIF,QAAM,kBADS,IAAI,IAAI,IAAI,CACI,SAAS;EAExC,MAAM,OAAO,MAAM,gBAAgB,KAAK,WAAW,WAAW,SAAS;AAEvE,OAAK,MAAM,KAAK;AAChB,yBAAU,UAAU,EAAE,WAAW,MAAM,CAAC;AACxC,6BAAc,WAAW,MAAM,QAAQ;AACvC,OAAK,OAAO,KAAK,WAAW,IAAI,IAAI,KAAK,OAAO,sBAAsB,YAAY;AAClF,SAAO;GAAE,QAAQ;GAAK,MAAM;GAAW;UAChC,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAE5D,MADoB,gBAAgB,UAAU,EAC7B;AACf,QAAK,OAAO,KACV,6BAA6B,IAAI,IAAI,IAAI,0BAA0B,YACpE;AACD,UAAO;IAAE,QAAQ;IAAK,MAAM;IAAW;;AAEzC,MAAI,KAAK,eACP,OAAM,IAAI,MAAM,mBAAmB,IAAI,iCAAiC,MAAM;AAEhF,OAAK,OAAO,KACV,6BAA6B,IAAI,IAAI,IAAI,wCAC1C;AAED,SAAO;GAAE,QAAQ;GAAK,MAAM;GAAI;;;AAIpC,SAAS,gBAAgB,MAAuB;AAC9C,KAAI;AACF,+BAAgB,KAAK,CAAC,QAAQ;SACxB;AACN,SAAO;;;AAIX,eAAe,gBACb,KACA,WACA,WACA,UACiB;CACjB,MAAM,aAAa,IAAI,iBAAiB;CACxC,MAAM,QAAQ,iBAAiB,WAAW,sBAAM,IAAI,MAAM,UAAU,CAAC,EAAE,UAAU;AACjF,KAAI;EAIF,MAAM,MAAM,MAAM,UAAU,KAAK;GAC/B,QAAQ,WAAW;GACnB,UAAU;GACX,CAAC;AACF,MAAI,IAAI,UAAU,OAAO,IAAI,SAAS,KAAK;GACzC,MAAM,WAAW,IAAI,QAAQ,IAAI,WAAW,IAAI;AAChD,SAAM,IAAI,MACR,2CAA2C,IAAI,OAAO,KAAK,SAAS,4GACrE;;AAEH,MAAI,CAAC,IAAI,GACP,OAAM,IAAI,MAAM,QAAQ,IAAI,OAAO,GAAG,IAAI,aAAa;EAGzD,MAAM,MAAM,IAAI,QAAQ,IAAI,iBAAiB;AAC7C,MAAI,KAAK;GACP,MAAM,IAAI,OAAO,IAAI;AACrB,OAAI,OAAO,SAAS,EAAE,IAAI,IAAI,SAC5B,OAAM,IAAI,MAAM,sCAAsC,EAAE,iBAAiB,SAAS,QAAQ;;AAK9F,MAAI,CAAC,IAAI,MAAM;GACb,MAAM,OAAO,MAAM,IAAI,MAAM;AAC7B,OAAI,OAAO,WAAW,MAAM,QAAQ,GAAG,SACrC,OAAM,IAAI,MAAM,0CAA0C,SAAS,QAAQ;AAE7E,UAAO;;EAGT,MAAM,SAAS,IAAI,KAAK,WAAW;EACnC,MAAM,SAAuB,EAAE;EAC/B,IAAI,QAAQ;AACZ,WAAS;GACP,MAAM,EAAE,OAAO,SAAS,MAAM,OAAO,MAAM;AAC3C,OAAI,KAAM;AACV,OAAI,OAAO;AACT,aAAS,MAAM;AACf,QAAI,QAAQ,UAAU;AACpB,SAAI;AACF,YAAM,OAAO,QAAQ;aACf;AAGR,WAAM,IAAI,MAAM,0CAA0C,SAAS,QAAQ;;AAE7E,WAAO,KAAK,MAAM;;;AAGtB,SAAO,OAAO,OAAO,OAAO,CAAC,SAAS,QAAQ;UACvC,KAAK;AACZ,MAAI,eAAe,UAAU,IAAI,SAAS,gBAAgB,IAAI,YAAY,WACxE,OAAM,IAAI,MAAM,yBAAyB,UAAU,IAAI;AAEzD,QAAM;WACE;AACR,eAAa,MAAM"}

package/dist/fixtures-remote.js

@@ -0,0 +1,224 @@
+import { createHash } from "node:crypto";
+import { join, resolve } from "node:path";
+import { mkdirSync, statSync, writeFileSync } from "node:fs";
+import { lookup } from "node:dns/promises";
+import { BlockList, isIP } from "node:net";
+import { homedir } from "node:os";
+
+//#region src/fixtures-remote.ts
+const REMOTE_FETCH_TIMEOUT_MS = 1e4;
+const REMOTE_MAX_BYTES = 50 * 1024 * 1024;
+/**
+* Private / reserved address ranges blocked by default to prevent SSRF.
+*
+* The list covers RFC1918 / CGNAT / loopback / link-local / cloud-metadata /
+* ULA / multicast / unspecified — any destination that could let an attacker
+* pivot a fetch into the local network or cloud control plane via a hostile
+* `--fixtures` URL.  Set `AIMOCK_ALLOW_PRIVATE_URLS=1` to opt out (required
+* for local dev / tests that target 127.0.0.1).
+*/
+const PRIVATE_V4_RANGES = [
+	["0.0.0.0", 8],
+	["10.0.0.0", 8],
+	["100.64.0.0", 10],
+	["127.0.0.0", 8],
+	["169.254.0.0", 16],
+	["172.16.0.0", 12],
+	["192.0.0.0", 24],
+	["192.0.2.0", 24],
+	["192.88.99.0", 24],
+	["192.168.0.0", 16],
+	["198.18.0.0", 15],
+	["198.51.100.0", 24],
+	["203.0.113.0", 24],
+	["224.0.0.0", 4],
+	["240.0.0.0", 4],
+	["255.255.255.255", 32]
+];
+const PRIVATE_V6_RANGES = [
+	["::", 128],
+	["::1", 128],
+	["fc00::", 7],
+	["fe80::", 10]
+];
+function buildBlockList() {
+	const bl = new BlockList();
+	for (const [addr, prefix] of PRIVATE_V4_RANGES) bl.addSubnet(addr, prefix, "ipv4");
+	for (const [addr, prefix] of PRIVATE_V6_RANGES) bl.addSubnet(addr, prefix, "ipv6");
+	return bl;
+}
+const PRIVATE_BLOCKLIST = buildBlockList();
+/**
+* Returns true if `address` is a literal IP (v4 or v6) that falls in any
+* blocked range (loopback, RFC1918, CGNAT, link-local, cloud-metadata,
+* ULA, multicast, unspecified, reserved).  Returns false for public IPs
+* and for non-literal hostnames.
+*/
+function isPrivateAddress(address) {
+	const family = isIP(address);
+	if (family === 0) return false;
+	if (family === 6) {
+		const mapped = address.toLowerCase().match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);
+		if (mapped) return isPrivateAddress(mapped[1]);
+	}
+	return PRIVATE_BLOCKLIST.check(address, family === 4 ? "ipv4" : "ipv6");
+}
+function privateUrlsAllowed() {
+	const v = process.env.AIMOCK_ALLOW_PRIVATE_URLS;
+	return v === "1" || v === "true";
+}
+/**
+* Throws if `hostname` resolves to (or literally is) a private / reserved
+* address, unless `AIMOCK_ALLOW_PRIVATE_URLS=1` is set.  If the hostname is
+* not a literal IP, all resolved addresses are checked — any blocked
+* address in the set rejects the host.
+*/
+async function assertAllowedHost(hostname) {
+	if (privateUrlsAllowed()) return;
+	if (isIP(hostname) !== 0) {
+		if (isPrivateAddress(hostname)) throw new Error(`Refusing to fetch from private address ${hostname}: not allowed by default (set AIMOCK_ALLOW_PRIVATE_URLS=1 to override)`);
+		return;
+	}
+	let addresses;
+	try {
+		addresses = await lookup(hostname, { all: true });
+	} catch (err) {
+		return;
+	}
+	for (const a of addresses) if (isPrivateAddress(a.address)) throw new Error(`Refusing to fetch from ${hostname}: resolves to private address ${a.address} (set AIMOCK_ALLOW_PRIVATE_URLS=1 to override)`);
+}
+/**
+* Returns true if `value` looks like a URL (has a scheme followed by ://).
+* Path inputs like ./fixtures or /tmp/x never start with a scheme.
+*/
+function looksLikeUrl(value) {
+	return /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//.test(value);
+}
+/**
+* Returns the default on-disk cache root for fetched fixtures.
+* Honors $XDG_CACHE_HOME when set, otherwise falls back to ~/.cache.
+*/
+function defaultCacheRoot() {
+	const xdg = process.env.XDG_CACHE_HOME;
+	return join(xdg && xdg.length > 0 ? xdg : join(homedir(), ".cache"), "aimock", "fixtures");
+}
+function sha256Hex(input) {
+	return createHash("sha256").update(input).digest("hex");
+}
+/**
+* Resolve a single --fixtures value to a local filesystem path.
+*
+* Behavior:
+* - Filesystem path → return as-is.
+* - https://, http:// URL → fetch JSON (once) to the on-disk cache; return the cached path.
+*   On fetch failure, fall back to a pre-existing cached copy if present (warn + continue).
+*   If --validate-on-load is set and no cache is usable, throws.
+* - Any other scheme (file://, ftp://, ...) → throws.
+*/
+async function resolveFixturesValue(value, opts) {
+	if (!looksLikeUrl(value)) return {
+		source: value,
+		path: resolve(value)
+	};
+	const lower = value.toLowerCase();
+	if (!lower.startsWith("https://") && !lower.startsWith("http://")) {
+		const match = value.match(/^([a-zA-Z][a-zA-Z0-9+.-]*):\/\//);
+		const scheme = match ? match[1] : "unknown";
+		throw new Error(`Unsupported --fixtures URL scheme "${scheme}" in ${value} (only https:// and http:// are supported)`);
+	}
+	return await resolveHttpFixture(value, opts);
+}
+async function resolveHttpFixture(url, opts) {
+	const fetchImpl = opts.fetchImpl ?? fetch;
+	const cacheRoot = opts.cacheRoot ?? defaultCacheRoot();
+	const timeoutMs = opts.timeoutMs ?? REMOTE_FETCH_TIMEOUT_MS;
+	const maxBytes = opts.maxBytes ?? REMOTE_MAX_BYTES;
+	const cacheDir = join(cacheRoot, sha256Hex(url));
+	const cacheFile = join(cacheDir, "fixtures.json");
+	try {
+		await assertAllowedHost(new URL(url).hostname);
+		const body = await fetchWithLimits(url, fetchImpl, timeoutMs, maxBytes);
+		JSON.parse(body);
+		mkdirSync(cacheDir, { recursive: true });
+		writeFileSync(cacheFile, body, "utf-8");
+		opts.logger.info(`Fetched ${url} (${body.length} bytes) → cached at ${cacheFile}`);
+		return {
+			source: url,
+			path: cacheFile
+		};
+	} catch (err) {
+		const msg = err instanceof Error ? err.message : String(err);
+		if (cacheFileExists(cacheFile)) {
+			opts.logger.warn(`upstream fetch failed for ${url} (${msg}); using cached copy at ${cacheFile}`);
+			return {
+				source: url,
+				path: cacheFile
+			};
+		}
+		if (opts.validateOnLoad) throw new Error(`Failed to fetch ${url} and no cached copy available: ${msg}`);
+		opts.logger.warn(`upstream fetch failed for ${url} (${msg}); no cached copy available — skipping`);
+		return {
+			source: url,
+			path: ""
+		};
+	}
+}
+function cacheFileExists(file) {
+	try {
+		return statSync(file).isFile();
+	} catch {
+		return false;
+	}
+}
+async function fetchWithLimits(url, fetchImpl, timeoutMs, maxBytes) {
+	const controller = new AbortController();
+	const timer = setTimeout(() => controller.abort(/* @__PURE__ */ new Error("timeout")), timeoutMs);
+	try {
+		const res = await fetchImpl(url, {
+			signal: controller.signal,
+			redirect: "manual"
+		});
+		if (res.status >= 300 && res.status < 400) {
+			const location = res.headers.get("location") ?? "<none>";
+			throw new Error(`redirect not allowed: upstream returned ${res.status} → ${location} (configure the upstream to serve the final URL directly; redirects are disabled to prevent scheme-bypass)`);
+		}
+		if (!res.ok) throw new Error(`HTTP ${res.status} ${res.statusText}`);
+		const len = res.headers.get("content-length");
+		if (len) {
+			const n = Number(len);
+			if (Number.isFinite(n) && n > maxBytes) throw new Error(`response too large: content-length ${n} exceeds limit ${maxBytes} bytes`);
+		}
+		if (!res.body) {
+			const text = await res.text();
+			if (Buffer.byteLength(text, "utf-8") > maxBytes) throw new Error(`response too large: body exceeds limit ${maxBytes} bytes`);
+			return text;
+		}
+		const reader = res.body.getReader();
+		const chunks = [];
+		let total = 0;
+		for (;;) {
+			const { value, done } = await reader.read();
+			if (done) break;
+			if (value) {
+				total += value.byteLength;
+				if (total > maxBytes) {
+					try {
+						await reader.cancel();
+					} catch {}
+					throw new Error(`response too large: body exceeds limit ${maxBytes} bytes`);
+				}
+				chunks.push(value);
+			}
+		}
+		return Buffer.concat(chunks).toString("utf-8");
+	} catch (err) {
+		if (err instanceof Error && (err.name === "AbortError" || err.message === "timeout")) throw new Error(`fetch timed out after ${timeoutMs}ms`);
+		throw err;
+	} finally {
+		clearTimeout(timer);
+	}
+}
+
+//#endregion
+export { resolveFixturesValue };
+//# sourceMappingURL=fixtures-remote.js.map

package/dist/fixtures-remote.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fixtures-remote.js","names":["dnsLookup","pathResolve"],"sources":["../src/fixtures-remote.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { mkdirSync, writeFileSync, statSync } from \"node:fs\";\nimport { lookup as dnsLookup } from \"node:dns/promises\";\nimport { BlockList, isIP } from \"node:net\";\nimport { homedir } from \"node:os\";\nimport { join, resolve as pathResolve } from \"node:path\";\nimport type { Logger } from \"./logger.js\";\n\nexport const REMOTE_FETCH_TIMEOUT_MS = 10_000;\nexport const REMOTE_MAX_BYTES = 50 * 1024 * 1024; // 50 MB\n\n/**\n * Private / reserved address ranges blocked by default to prevent SSRF.\n *\n * The list covers RFC1918 / CGNAT / loopback / link-local / cloud-metadata /\n * ULA / multicast / unspecified — any destination that could let an attacker\n * pivot a fetch into the local network or cloud control plane via a hostile\n * `--fixtures` URL.  Set `AIMOCK_ALLOW_PRIVATE_URLS=1` to opt out (required\n * for local dev / tests that target 127.0.0.1).\n */\nconst PRIVATE_V4_RANGES: Array<[string, number]> = [\n  [\"0.0.0.0\", 8], // \"this network\"\n  [\"10.0.0.0\", 8], // RFC1918\n  [\"100.64.0.0\", 10], // CGNAT\n  [\"127.0.0.0\", 8], // loopback\n  [\"169.254.0.0\", 16], // link-local / cloud metadata\n  [\"172.16.0.0\", 12], // RFC1918\n  [\"192.0.0.0\", 24], // IETF protocol assignments\n  [\"192.0.2.0\", 24], // TEST-NET-1\n  [\"192.88.99.0\", 24], // 6to4 relay anycast (deprecated)\n  [\"192.168.0.0\", 16], // RFC1918\n  [\"198.18.0.0\", 15], // benchmarking\n  [\"198.51.100.0\", 24], // TEST-NET-2\n  [\"203.0.113.0\", 24], // TEST-NET-3\n  [\"224.0.0.0\", 4], // multicast\n  [\"240.0.0.0\", 4], // reserved\n  [\"255.255.255.255\", 32], // broadcast\n];\n\nconst PRIVATE_V6_RANGES: Array<[string, number]> = [\n  [\"::\", 128], // unspecified\n  [\"::1\", 128], // loopback\n  [\"fc00::\", 7], // ULA\n  [\"fe80::\", 10], // link-local\n];\n\nfunction buildBlockList(): BlockList {\n  const bl = new BlockList();\n  for (const [addr, prefix] of PRIVATE_V4_RANGES) bl.addSubnet(addr, prefix, \"ipv4\");\n  for (const [addr, prefix] of PRIVATE_V6_RANGES) bl.addSubnet(addr, prefix, \"ipv6\");\n  return bl;\n}\n\nconst PRIVATE_BLOCKLIST: BlockList = buildBlockList();\n\n/**\n * Returns true if `address` is a literal IP (v4 or v6) that falls in any\n * blocked range (loopback, RFC1918, CGNAT, link-local, cloud-metadata,\n * ULA, multicast, unspecified, reserved).  Returns false for public IPs\n * and for non-literal hostnames.\n */\nexport function isPrivateAddress(address: string): boolean {\n  const family = isIP(address);\n  if (family === 0) return false; // not a literal IP\n  // BlockList.check's \"ipv6\" bucket does not match v4-mapped ::ffff:a.b.c.d\n  // automatically — unwrap to the underlying v4 address and recurse.\n  if (family === 6) {\n    const lower = address.toLowerCase();\n    const mapped = lower.match(/^::ffff:(\\d+\\.\\d+\\.\\d+\\.\\d+)$/);\n    if (mapped) return isPrivateAddress(mapped[1]);\n  }\n  return PRIVATE_BLOCKLIST.check(address, family === 4 ? \"ipv4\" : \"ipv6\");\n}\n\nfunction privateUrlsAllowed(): boolean {\n  const v = process.env.AIMOCK_ALLOW_PRIVATE_URLS;\n  return v === \"1\" || v === \"true\";\n}\n\n/**\n * Throws if `hostname` resolves to (or literally is) a private / reserved\n * address, unless `AIMOCK_ALLOW_PRIVATE_URLS=1` is set.  If the hostname is\n * not a literal IP, all resolved addresses are checked — any blocked\n * address in the set rejects the host.\n */\nexport async function assertAllowedHost(hostname: string): Promise<void> {\n  if (privateUrlsAllowed()) return;\n\n  if (isIP(hostname) !== 0) {\n    if (isPrivateAddress(hostname)) {\n      throw new Error(\n        `Refusing to fetch from private address ${hostname}: not allowed by default (set AIMOCK_ALLOW_PRIVATE_URLS=1 to override)`,\n      );\n    }\n    return;\n  }\n\n  let addresses: Array<{ address: string; family: number }>;\n  try {\n    addresses = await dnsLookup(hostname, { all: true });\n  } catch (err) {\n    // DNS failure is not an SSRF signal — let the fetch itself surface the\n    // resolution error with its own (more detailed) message.\n    void err;\n    return;\n  }\n  for (const a of addresses) {\n    if (isPrivateAddress(a.address)) {\n      throw new Error(\n        `Refusing to fetch from ${hostname}: resolves to private address ${a.address} (set AIMOCK_ALLOW_PRIVATE_URLS=1 to override)`,\n      );\n    }\n  }\n}\n\nexport interface RemoteResolveOptions {\n  validateOnLoad: boolean;\n  logger: Logger;\n  /** Override fetch implementation (tests). */\n  fetchImpl?: typeof fetch;\n  /** Override cache root (tests). */\n  cacheRoot?: string;\n  /** Override timeout (tests). */\n  timeoutMs?: number;\n  /** Override max response size (tests). */\n  maxBytes?: number;\n}\n\nexport interface ResolvedLocalFixture {\n  /** Original value as passed on the CLI (for logging). */\n  source: string;\n  /** Filesystem path — downstream code treats this identically to a --fixtures path. */\n  path: string;\n}\n\n/**\n * Returns true if `value` looks like a URL (has a scheme followed by ://).\n * Path inputs like ./fixtures or /tmp/x never start with a scheme.\n */\nexport function looksLikeUrl(value: string): boolean {\n  return /^[a-zA-Z][a-zA-Z0-9+.-]*:\\/\\//.test(value);\n}\n\n/**\n * Returns the default on-disk cache root for fetched fixtures.\n * Honors $XDG_CACHE_HOME when set, otherwise falls back to ~/.cache.\n */\nexport function defaultCacheRoot(): string {\n  const xdg = process.env.XDG_CACHE_HOME;\n  const base = xdg && xdg.length > 0 ? xdg : join(homedir(), \".cache\");\n  return join(base, \"aimock\", \"fixtures\");\n}\n\nfunction sha256Hex(input: string): string {\n  return createHash(\"sha256\").update(input).digest(\"hex\");\n}\n\n/**\n * Resolve a single --fixtures value to a local filesystem path.\n *\n * Behavior:\n * - Filesystem path → return as-is.\n * - https://, http:// URL → fetch JSON (once) to the on-disk cache; return the cached path.\n *   On fetch failure, fall back to a pre-existing cached copy if present (warn + continue).\n *   If --validate-on-load is set and no cache is usable, throws.\n * - Any other scheme (file://, ftp://, ...) → throws.\n */\nexport async function resolveFixturesValue(\n  value: string,\n  opts: RemoteResolveOptions,\n): Promise<ResolvedLocalFixture> {\n  if (!looksLikeUrl(value)) {\n    return { source: value, path: pathResolve(value) };\n  }\n\n  const lower = value.toLowerCase();\n  if (!lower.startsWith(\"https://\") && !lower.startsWith(\"http://\")) {\n    // Extract the scheme for a clearer error\n    const match = value.match(/^([a-zA-Z][a-zA-Z0-9+.-]*):\\/\\//);\n    const scheme = match ? match[1] : \"unknown\";\n    throw new Error(\n      `Unsupported --fixtures URL scheme \"${scheme}\" in ${value} (only https:// and http:// are supported)`,\n    );\n  }\n\n  return await resolveHttpFixture(value, opts);\n}\n\nasync function resolveHttpFixture(\n  url: string,\n  opts: RemoteResolveOptions,\n): Promise<ResolvedLocalFixture> {\n  const fetchImpl = opts.fetchImpl ?? fetch;\n  const cacheRoot = opts.cacheRoot ?? defaultCacheRoot();\n  const timeoutMs = opts.timeoutMs ?? REMOTE_FETCH_TIMEOUT_MS;\n  const maxBytes = opts.maxBytes ?? REMOTE_MAX_BYTES;\n\n  const digest = sha256Hex(url);\n  const cacheDir = join(cacheRoot, digest);\n  const cacheFile = join(cacheDir, \"fixtures.json\");\n\n  try {\n    // SSRF defense: reject private / reserved destinations before any network\n    // I/O, unless explicitly opted in via AIMOCK_ALLOW_PRIVATE_URLS=1.\n    const parsed = new URL(url);\n    await assertAllowedHost(parsed.hostname);\n\n    const body = await fetchWithLimits(url, fetchImpl, timeoutMs, maxBytes);\n    // Parse to verify it is valid JSON before caching — fail loud if not.\n    JSON.parse(body);\n    mkdirSync(cacheDir, { recursive: true });\n    writeFileSync(cacheFile, body, \"utf-8\");\n    opts.logger.info(`Fetched ${url} (${body.length} bytes) → cached at ${cacheFile}`);\n    return { source: url, path: cacheFile };\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    const cacheExists = cacheFileExists(cacheFile);\n    if (cacheExists) {\n      opts.logger.warn(\n        `upstream fetch failed for ${url} (${msg}); using cached copy at ${cacheFile}`,\n      );\n      return { source: url, path: cacheFile };\n    }\n    if (opts.validateOnLoad) {\n      throw new Error(`Failed to fetch ${url} and no cached copy available: ${msg}`);\n    }\n    opts.logger.warn(\n      `upstream fetch failed for ${url} (${msg}); no cached copy available — skipping`,\n    );\n    // Signal \"no path\" by returning a sentinel with empty path — callers detect and skip.\n    return { source: url, path: \"\" };\n  }\n}\n\nfunction cacheFileExists(file: string): boolean {\n  try {\n    return statSync(file).isFile();\n  } catch {\n    return false;\n  }\n}\n\nasync function fetchWithLimits(\n  url: string,\n  fetchImpl: typeof fetch,\n  timeoutMs: number,\n  maxBytes: number,\n): Promise<string> {\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(new Error(\"timeout\")), timeoutMs);\n  try {\n    // Redirects are disabled: following a 3xx into a different scheme or host\n    // would bypass the scheme check and SSRF denylist.  Upstream services\n    // should serve the final URL directly (e.g. GitHub raw content URLs).\n    const res = await fetchImpl(url, {\n      signal: controller.signal,\n      redirect: \"manual\",\n    });\n    if (res.status >= 300 && res.status < 400) {\n      const location = res.headers.get(\"location\") ?? \"<none>\";\n      throw new Error(\n        `redirect not allowed: upstream returned ${res.status} → ${location} (configure the upstream to serve the final URL directly; redirects are disabled to prevent scheme-bypass)`,\n      );\n    }\n    if (!res.ok) {\n      throw new Error(`HTTP ${res.status} ${res.statusText}`);\n    }\n    // Early reject on over-large Content-Length when the server reports it.\n    const len = res.headers.get(\"content-length\");\n    if (len) {\n      const n = Number(len);\n      if (Number.isFinite(n) && n > maxBytes) {\n        throw new Error(`response too large: content-length ${n} exceeds limit ${maxBytes} bytes`);\n      }\n    }\n\n    // Stream and enforce the limit incrementally in case Content-Length is absent/lying.\n    if (!res.body) {\n      const text = await res.text();\n      if (Buffer.byteLength(text, \"utf-8\") > maxBytes) {\n        throw new Error(`response too large: body exceeds limit ${maxBytes} bytes`);\n      }\n      return text;\n    }\n\n    const reader = res.body.getReader();\n    const chunks: Uint8Array[] = [];\n    let total = 0;\n    for (;;) {\n      const { value, done } = await reader.read();\n      if (done) break;\n      if (value) {\n        total += value.byteLength;\n        if (total > maxBytes) {\n          try {\n            await reader.cancel();\n          } catch {\n            // ignore cancel errors\n          }\n          throw new Error(`response too large: body exceeds limit ${maxBytes} bytes`);\n        }\n        chunks.push(value);\n      }\n    }\n    return Buffer.concat(chunks).toString(\"utf-8\");\n  } catch (err) {\n    if (err instanceof Error && (err.name === \"AbortError\" || err.message === \"timeout\")) {\n      throw new Error(`fetch timed out after ${timeoutMs}ms`);\n    }\n    throw err;\n  } finally {\n    clearTimeout(timer);\n  }\n}\n"],"mappings":";;;;;;;;AAQA,MAAa,0BAA0B;AACvC,MAAa,mBAAmB,KAAK,OAAO;;;;;;;;;;AAW5C,MAAM,oBAA6C;CACjD,CAAC,WAAW,EAAE;CACd,CAAC,YAAY,EAAE;CACf,CAAC,cAAc,GAAG;CAClB,CAAC,aAAa,EAAE;CAChB,CAAC,eAAe,GAAG;CACnB,CAAC,cAAc,GAAG;CAClB,CAAC,aAAa,GAAG;CACjB,CAAC,aAAa,GAAG;CACjB,CAAC,eAAe,GAAG;CACnB,CAAC,eAAe,GAAG;CACnB,CAAC,cAAc,GAAG;CAClB,CAAC,gBAAgB,GAAG;CACpB,CAAC,eAAe,GAAG;CACnB,CAAC,aAAa,EAAE;CAChB,CAAC,aAAa,EAAE;CAChB,CAAC,mBAAmB,GAAG;CACxB;AAED,MAAM,oBAA6C;CACjD,CAAC,MAAM,IAAI;CACX,CAAC,OAAO,IAAI;CACZ,CAAC,UAAU,EAAE;CACb,CAAC,UAAU,GAAG;CACf;AAED,SAAS,iBAA4B;CACnC,MAAM,KAAK,IAAI,WAAW;AAC1B,MAAK,MAAM,CAAC,MAAM,WAAW,kBAAmB,IAAG,UAAU,MAAM,QAAQ,OAAO;AAClF,MAAK,MAAM,CAAC,MAAM,WAAW,kBAAmB,IAAG,UAAU,MAAM,QAAQ,OAAO;AAClF,QAAO;;AAGT,MAAM,oBAA+B,gBAAgB;;;;;;;AAQrD,SAAgB,iBAAiB,SAA0B;CACzD,MAAM,SAAS,KAAK,QAAQ;AAC5B,KAAI,WAAW,EAAG,QAAO;AAGzB,KAAI,WAAW,GAAG;EAEhB,MAAM,SADQ,QAAQ,aAAa,CACd,MAAM,gCAAgC;AAC3D,MAAI,OAAQ,QAAO,iBAAiB,OAAO,GAAG;;AAEhD,QAAO,kBAAkB,MAAM,SAAS,WAAW,IAAI,SAAS,OAAO;;AAGzE,SAAS,qBAA8B;CACrC,MAAM,IAAI,QAAQ,IAAI;AACtB,QAAO,MAAM,OAAO,MAAM;;;;;;;;AAS5B,eAAsB,kBAAkB,UAAiC;AACvE,KAAI,oBAAoB,CAAE;AAE1B,KAAI,KAAK,SAAS,KAAK,GAAG;AACxB,MAAI,iBAAiB,SAAS,CAC5B,OAAM,IAAI,MACR,0CAA0C,SAAS,wEACpD;AAEH;;CAGF,IAAI;AACJ,KAAI;AACF,cAAY,MAAMA,OAAU,UAAU,EAAE,KAAK,MAAM,CAAC;UAC7C,KAAK;AAIZ;;AAEF,MAAK,MAAM,KAAK,UACd,KAAI,iBAAiB,EAAE,QAAQ,CAC7B,OAAM,IAAI,MACR,0BAA0B,SAAS,gCAAgC,EAAE,QAAQ,gDAC9E;;;;;;AA6BP,SAAgB,aAAa,OAAwB;AACnD,QAAO,gCAAgC,KAAK,MAAM;;;;;;AAOpD,SAAgB,mBAA2B;CACzC,MAAM,MAAM,QAAQ,IAAI;AAExB,QAAO,KADM,OAAO,IAAI,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,SAAS,EAClD,UAAU,WAAW;;AAGzC,SAAS,UAAU,OAAuB;AACxC,QAAO,WAAW,SAAS,CAAC,OAAO,MAAM,CAAC,OAAO,MAAM;;;;;;;;;;;;AAazD,eAAsB,qBACpB,OACA,MAC+B;AAC/B,KAAI,CAAC,aAAa,MAAM,CACtB,QAAO;EAAE,QAAQ;EAAO,MAAMC,QAAY,MAAM;EAAE;CAGpD,MAAM,QAAQ,MAAM,aAAa;AACjC,KAAI,CAAC,MAAM,WAAW,WAAW,IAAI,CAAC,MAAM,WAAW,UAAU,EAAE;EAEjE,MAAM,QAAQ,MAAM,MAAM,kCAAkC;EAC5D,MAAM,SAAS,QAAQ,MAAM,KAAK;AAClC,QAAM,IAAI,MACR,sCAAsC,OAAO,OAAO,MAAM,4CAC3D;;AAGH,QAAO,MAAM,mBAAmB,OAAO,KAAK;;AAG9C,eAAe,mBACb,KACA,MAC+B;CAC/B,MAAM,YAAY,KAAK,aAAa;CACpC,MAAM,YAAY,KAAK,aAAa,kBAAkB;CACtD,MAAM,YAAY,KAAK,aAAa;CACpC,MAAM,WAAW,KAAK,YAAY;CAGlC,MAAM,WAAW,KAAK,WADP,UAAU,IAAI,CACW;CACxC,MAAM,YAAY,KAAK,UAAU,gBAAgB;AAEjD,KAAI;AAIF,QAAM,kBADS,IAAI,IAAI,IAAI,CACI,SAAS;EAExC,MAAM,OAAO,MAAM,gBAAgB,KAAK,WAAW,WAAW,SAAS;AAEvE,OAAK,MAAM,KAAK;AAChB,YAAU,UAAU,EAAE,WAAW,MAAM,CAAC;AACxC,gBAAc,WAAW,MAAM,QAAQ;AACvC,OAAK,OAAO,KAAK,WAAW,IAAI,IAAI,KAAK,OAAO,sBAAsB,YAAY;AAClF,SAAO;GAAE,QAAQ;GAAK,MAAM;GAAW;UAChC,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAE5D,MADoB,gBAAgB,UAAU,EAC7B;AACf,QAAK,OAAO,KACV,6BAA6B,IAAI,IAAI,IAAI,0BAA0B,YACpE;AACD,UAAO;IAAE,QAAQ;IAAK,MAAM;IAAW;;AAEzC,MAAI,KAAK,eACP,OAAM,IAAI,MAAM,mBAAmB,IAAI,iCAAiC,MAAM;AAEhF,OAAK,OAAO,KACV,6BAA6B,IAAI,IAAI,IAAI,wCAC1C;AAED,SAAO;GAAE,QAAQ;GAAK,MAAM;GAAI;;;AAIpC,SAAS,gBAAgB,MAAuB;AAC9C,KAAI;AACF,SAAO,SAAS,KAAK,CAAC,QAAQ;SACxB;AACN,SAAO;;;AAIX,eAAe,gBACb,KACA,WACA,WACA,UACiB;CACjB,MAAM,aAAa,IAAI,iBAAiB;CACxC,MAAM,QAAQ,iBAAiB,WAAW,sBAAM,IAAI,MAAM,UAAU,CAAC,EAAE,UAAU;AACjF,KAAI;EAIF,MAAM,MAAM,MAAM,UAAU,KAAK;GAC/B,QAAQ,WAAW;GACnB,UAAU;GACX,CAAC;AACF,MAAI,IAAI,UAAU,OAAO,IAAI,SAAS,KAAK;GACzC,MAAM,WAAW,IAAI,QAAQ,IAAI,WAAW,IAAI;AAChD,SAAM,IAAI,MACR,2CAA2C,IAAI,OAAO,KAAK,SAAS,4GACrE;;AAEH,MAAI,CAAC,IAAI,GACP,OAAM,IAAI,MAAM,QAAQ,IAAI,OAAO,GAAG,IAAI,aAAa;EAGzD,MAAM,MAAM,IAAI,QAAQ,IAAI,iBAAiB;AAC7C,MAAI,KAAK;GACP,MAAM,IAAI,OAAO,IAAI;AACrB,OAAI,OAAO,SAAS,EAAE,IAAI,IAAI,SAC5B,OAAM,IAAI,MAAM,sCAAsC,EAAE,iBAAiB,SAAS,QAAQ;;AAK9F,MAAI,CAAC,IAAI,MAAM;GACb,MAAM,OAAO,MAAM,IAAI,MAAM;AAC7B,OAAI,OAAO,WAAW,MAAM,QAAQ,GAAG,SACrC,OAAM,IAAI,MAAM,0CAA0C,SAAS,QAAQ;AAE7E,UAAO;;EAGT,MAAM,SAAS,IAAI,KAAK,WAAW;EACnC,MAAM,SAAuB,EAAE;EAC/B,IAAI,QAAQ;AACZ,WAAS;GACP,MAAM,EAAE,OAAO,SAAS,MAAM,OAAO,MAAM;AAC3C,OAAI,KAAM;AACV,OAAI,OAAO;AACT,aAAS,MAAM;AACf,QAAI,QAAQ,UAAU;AACpB,SAAI;AACF,YAAM,OAAO,QAAQ;aACf;AAGR,WAAM,IAAI,MAAM,0CAA0C,SAAS,QAAQ;;AAE7E,WAAO,KAAK,MAAM;;;AAGtB,SAAO,OAAO,OAAO,OAAO,CAAC,SAAS,QAAQ;UACvC,KAAK;AACZ,MAAI,eAAe,UAAU,IAAI,SAAS,gBAAgB,IAAI,YAAY,WACxE,OAAM,IAAI,MAAM,yBAAyB,UAAU,IAAI;AAEzD,QAAM;WACE;AACR,eAAa,MAAM"}

package/dist/vector-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vector-types.d.ts","names":[],"sources":["../src/vector-types.ts"],"sourcesContent":[],"mappings":";UAAiB,iBAAA;EAAA,IAAA,CAAA,EAAA,MAAA;EAKA,IAAA,CAAA,EAAA,MAAA;;AAGM,UAHN,gBAAA,CAGM;MAAZ,EAAA,MAAA;EAAG,SAAA,EAAA,MAAA;EAGG,OAAA,EAHN,GAGM,CAAA,MAAW,EAHL,WAMJ,CAAA;AAGnB;AAOiB,UAbA,WAAA,CAaW;EAOhB,EAAA,EAAA,MAAA;EAAY,MAAA,EAAA,MAAA,EAAA;UAAG,CAAA,EAjBd,MAiBc,CAAA,MAAA,EAAA,OAAA,CAAA;;AAAyC,UAdnD,WAAA,CAcmD;EAAW,EAAA,EAAA,MAAA;;aAXlE;;;UAII,WAAA;;;;;;KAOL,YAAA,GAAe,yBAAyB,gBAAgB"}
+{"version":3,"file":"vector-types.d.ts","names":[],"sources":["../src/vector-types.ts"],"sourcesContent":[],"mappings":";UAAiB,iBAAA;EAAA,IAAA,CAAA,EAAA,MAAA;EAKA,IAAA,CAAA,EAAA,MAAA;;AAGM,UAHN,gBAAA,CAGM;MAAZ,EAAA,MAAA;EAAG,SAAA,EAAA,MAAA;EAGG,OAAA,EAHN,GAGM,CAAA,MAAW,EAHL,WAMV,CAAM;AAGnB;AAOiB,UAbA,WAAA,CAaW;EAOhB,EAAA,EAAA,MAAA;EAAY,MAAA,EAAA,MAAA,EAAA;UAAG,CAAA,EAjBd,MAiBc,CAAA,MAAA,EAAA,OAAA,CAAA;;AAAyC,UAdnD,WAAA,CAcmD;EAAW,EAAA,EAAA,MAAA;;aAXlE;;;UAII,WAAA;;;;;;KAOL,YAAA,GAAe,yBAAyB,gBAAgB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@copilotkit/aimock",
-  "version": "1.14.6",
+  "version": "1.14.8",
   "description": "Mock infrastructure for AI application testing — LLM APIs, image generation, text-to-speech, transcription, video generation, MCP tools, A2A agents, AG-UI event streams, vector databases, search, rerank, and moderation. One package, one port, zero dependencies.",
   "license": "MIT",
   "keywords": [