@copilotkit/aimock 1.37.3 → 1.38.0

package/dist/api-key-auth.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-auth.cjs","names":[],"sources":["../src/api-key-auth.ts"],"sourcesContent":["import { timingSafeEqual } from \"node:crypto\";\nimport type * as http from \"node:http\";\nimport type * as net from \"node:net\";\nimport type { ApiKeyAuthConfig } from \"./types.js\";\n\nexport const INBOUND_API_KEY_HEADERS = [\n  \"authorization\",\n  \"x-api-key\",\n  \"x-goog-api-key\",\n  \"api-key\",\n  \"xi-api-key\",\n] as const;\n\nconst RECOGNIZED_HEADERS = new Set<string>(INBOUND_API_KEY_HEADERS);\n\nexport const API_KEY_ERROR_BODY = JSON.stringify({\n  error: {\n    message: \"Invalid API key\",\n    type: \"authentication_error\",\n    code: \"invalid_api_key\",\n  },\n});\n\n/** @internal */\nexport interface ApiKeyPolicy {\n  readonly enabled: boolean;\n  readonly keys: readonly Buffer[];\n}\n\n/** @internal */\nexport interface ResolvedInboundAuth {\n  readonly publicConfig?: ApiKeyAuthConfig;\n  readonly policy: ApiKeyPolicy;\n}\n\nexport interface AuthResult {\n  readonly ok: boolean;\n  readonly reason?: \"missing\" | \"invalid\" | \"conflict\";\n}\n\nconst DISABLED_POLICY: ApiKeyPolicy = { enabled: false, keys: [] };\nconst authenticatedRequests = new WeakSet<http.IncomingMessage>();\nconst OWS_EDGES = /^[ \\t]+|[ \\t]+$/g;\n\nfunction fail(label: string, suffix: string): never {\n  throw new Error(`${label}${suffix}`);\n}\n\nfunction hasControl(value: string): boolean {\n  for (let index = 0; index < value.length; index += 1) {\n    const code = value.charCodeAt(index);\n    if (code <= 0x1f || code === 0x7f) return true;\n  }\n  return false;\n}\n\nfunction normalizeKey(value: unknown, label: string): string {\n  if (typeof value !== \"string\") fail(label, \" must be a string\");\n  const normalized = value.replace(OWS_EDGES, \"\");\n  if (normalized.length === 0) fail(label, \" must not be empty\");\n  if (hasControl(normalized)) fail(label, \" must not contain control characters\");\n  return normalized;\n}\n\n/** Parse a public auth source once and construct its private server policy. */\nexport function resolveInboundAuth(source: { value: unknown; label: string }): ResolvedInboundAuth {\n  if (source.value === undefined) return { policy: DISABLED_POLICY };\n  if (source.value === null || typeof source.value !== \"object\" || Array.isArray(source.value)) {\n    fail(source.label, \" must be an object\");\n  }\n  const apiKeys = (source.value as { apiKeys?: unknown }).apiKeys;\n  if (!Array.isArray(apiKeys)) fail(`${source.label}.apiKeys`, \" must be an array\");\n  if (apiKeys.length === 0) fail(`${source.label}.apiKeys`, \" must not be empty\");\n  const keys = apiKeys.map((value, index) =>\n    normalizeKey(value, `${source.label}.apiKeys[${index}]`),\n  );\n  const seen = new Set<string>();\n  for (const key of keys) {\n    if (seen.has(key)) fail(source.label, \" must not contain duplicate API keys\");\n    seen.add(key);\n  }\n  return {\n    publicConfig: { apiKeys: keys },\n    policy: { enabled: true, keys: keys.map((key) => Buffer.from(key, \"utf8\")) },\n  };\n}\n\n/** Select configuration without parsing it, so an environment override bypasses malformed JSON auth. */\nexport function selectInboundAuthSource(\n  configAuth: unknown,\n  env: NodeJS.ProcessEnv = process.env,\n): { value: unknown; label: string } {\n  if (Object.prototype.hasOwnProperty.call(env, \"AIMOCK_API_KEYS\")) {\n    return { value: { apiKeys: (env.AIMOCK_API_KEYS ?? \"\").split(\",\") }, label: \"AIMOCK_API_KEYS\" };\n  }\n  return { value: configAuth, label: \"aimock.json.auth\" };\n}\n\nexport function isRecognizedApiKeyHeader(name: string): boolean {\n  return RECOGNIZED_HEADERS.has(name.toLowerCase());\n}\n\nfunction rawCandidates(req: http.IncomingMessage): {\n  candidates?: string[];\n  reason?: \"missing\" | \"invalid\";\n} {\n  const candidates: string[] = [];\n  for (let index = 0; index < req.rawHeaders.length; index += 2) {\n    const name = req.rawHeaders[index];\n    const value = req.rawHeaders[index + 1] ?? \"\";\n    const lower = name.toLowerCase();\n    if (!isRecognizedApiKeyHeader(lower)) continue;\n    if (hasControl(value)) return { reason: \"invalid\" };\n    if (lower === \"authorization\") {\n      const match = /^(?:Bearer|Key)[ \\t]+(.+)$/i.exec(value.replace(OWS_EDGES, \"\"));\n      if (!match) return { reason: \"invalid\" };\n      const candidate = match[1].replace(OWS_EDGES, \"\");\n      if (candidate.length === 0 || hasControl(candidate)) return { reason: \"invalid\" };\n      candidates.push(candidate);\n    } else {\n      const candidate = value.replace(OWS_EDGES, \"\");\n      if (candidate.length === 0) return { reason: \"invalid\" };\n      candidates.push(candidate);\n    }\n  }\n  return candidates.length > 0 ? { candidates } : { reason: \"missing\" };\n}\n\nfunction matchingIndex(candidate: string, keys: readonly Buffer[]): number | undefined {\n  const encoded = Buffer.from(candidate, \"utf8\");\n  for (let index = 0; index < keys.length; index += 1) {\n    const key = keys[index];\n    if (encoded.length === key.length && timingSafeEqual(encoded, key)) return index;\n  }\n  return undefined;\n}\n\nexport function validateRequestApiKey(req: http.IncomingMessage, policy: ApiKeyPolicy): AuthResult {\n  if (!policy.enabled) return { ok: true };\n  const extracted = rawCandidates(req);\n  if (!extracted.candidates) return { ok: false, reason: extracted.reason };\n  let resolved: number | undefined;\n  for (const candidate of extracted.candidates) {\n    const index = matchingIndex(candidate, policy.keys);\n    if (index === undefined) return { ok: false, reason: \"invalid\" };\n    if (resolved !== undefined && resolved !== index) return { ok: false, reason: \"conflict\" };\n    resolved = index;\n  }\n  return { ok: true };\n}\n\n/** @internal Opaque egress marker; it deliberately carries no key material. */\nexport function markAuthenticatedRequest(req: http.IncomingMessage, policy: ApiKeyPolicy): void {\n  if (policy.enabled) authenticatedRequests.add(req);\n}\n\n/** @internal Used by egress paths to select safe credential handling. */\nexport function isAuthenticatedRequest(req: http.IncomingMessage): boolean {\n  return authenticatedRequests.has(req);\n}\n\nexport function writeApiKeyHttpRejection(\n  res: http.ServerResponse,\n  setCorsHeaders: (res: http.ServerResponse) => void,\n): void {\n  setCorsHeaders(res);\n  res.writeHead(401, {\n    \"Content-Type\": \"application/json\",\n    \"Content-Length\": Buffer.byteLength(API_KEY_ERROR_BODY),\n    \"WWW-Authenticate\": 'Bearer realm=\"aimock\"',\n  });\n  res.end(API_KEY_ERROR_BODY);\n}\n\nexport function writeApiKeyUpgradeRejection(socket: net.Socket): void {\n  socket.write(\n    [\n      \"HTTP/1.1 401 Unauthorized\",\n      \"Content-Type: application/json\",\n      `Content-Length: ${Buffer.byteLength(API_KEY_ERROR_BODY)}`,\n      'WWW-Authenticate: Bearer realm=\"aimock\"',\n      \"Connection: close\",\n      \"\",\n      API_KEY_ERROR_BODY,\n    ].join(\"\\r\\n\"),\n  );\n  socket.destroy();\n}\n"],"mappings":";;;;AAKA,MAAa,0BAA0B;CACrC;CACA;CACA;CACA;CACA;CACD;AAED,MAAM,qBAAqB,IAAI,IAAY,wBAAwB;AAEnE,MAAa,qBAAqB,KAAK,UAAU,EAC/C,OAAO;CACL,SAAS;CACT,MAAM;CACN,MAAM;CACP,EACF,CAAC;AAmBF,MAAM,kBAAgC;CAAE,SAAS;CAAO,MAAM,EAAE;CAAE;AAClE,MAAM,wCAAwB,IAAI,SAA+B;AACjE,MAAM,YAAY;AAElB,SAAS,KAAK,OAAe,QAAuB;AAClD,OAAM,IAAI,MAAM,GAAG,QAAQ,SAAS;;AAGtC,SAAS,WAAW,OAAwB;AAC1C,MAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;EACpD,MAAM,OAAO,MAAM,WAAW,MAAM;AACpC,MAAI,QAAQ,MAAQ,SAAS,IAAM,QAAO;;AAE5C,QAAO;;AAGT,SAAS,aAAa,OAAgB,OAAuB;AAC3D,KAAI,OAAO,UAAU,SAAU,MAAK,OAAO,oBAAoB;CAC/D,MAAM,aAAa,MAAM,QAAQ,WAAW,GAAG;AAC/C,KAAI,WAAW,WAAW,EAAG,MAAK,OAAO,qBAAqB;AAC9D,KAAI,WAAW,WAAW,CAAE,MAAK,OAAO,uCAAuC;AAC/E,QAAO;;;AAIT,SAAgB,mBAAmB,QAAgE;AACjG,KAAI,OAAO,UAAU,OAAW,QAAO,EAAE,QAAQ,iBAAiB;AAClE,KAAI,OAAO,UAAU,QAAQ,OAAO,OAAO,UAAU,YAAY,MAAM,QAAQ,OAAO,MAAM,CAC1F,MAAK,OAAO,OAAO,qBAAqB;CAE1C,MAAM,UAAW,OAAO,MAAgC;AACxD,KAAI,CAAC,MAAM,QAAQ,QAAQ,CAAE,MAAK,GAAG,OAAO,MAAM,WAAW,oBAAoB;AACjF,KAAI,QAAQ,WAAW,EAAG,MAAK,GAAG,OAAO,MAAM,WAAW,qBAAqB;CAC/E,MAAM,OAAO,QAAQ,KAAK,OAAO,UAC/B,aAAa,OAAO,GAAG,OAAO,MAAM,WAAW,MAAM,GAAG,CACzD;CACD,MAAM,uBAAO,IAAI,KAAa;AAC9B,MAAK,MAAM,OAAO,MAAM;AACtB,MAAI,KAAK,IAAI,IAAI,CAAE,MAAK,OAAO,OAAO,uCAAuC;AAC7E,OAAK,IAAI,IAAI;;AAEf,QAAO;EACL,cAAc,EAAE,SAAS,MAAM;EAC/B,QAAQ;GAAE,SAAS;GAAM,MAAM,KAAK,KAAK,QAAQ,OAAO,KAAK,KAAK,OAAO,CAAC;GAAE;EAC7E;;;AAIH,SAAgB,wBACd,YACA,MAAyB,QAAQ,KACE;AACnC,KAAI,OAAO,UAAU,eAAe,KAAK,KAAK,kBAAkB,CAC9D,QAAO;EAAE,OAAO,EAAE,UAAU,IAAI,mBAAmB,IAAI,MAAM,IAAI,EAAE;EAAE,OAAO;EAAmB;AAEjG,QAAO;EAAE,OAAO;EAAY,OAAO;EAAoB;;AAGzD,SAAgB,yBAAyB,MAAuB;AAC9D,QAAO,mBAAmB,IAAI,KAAK,aAAa,CAAC;;AAGnD,SAAS,cAAc,KAGrB;CACA,MAAM,aAAuB,EAAE;AAC/B,MAAK,IAAI,QAAQ,GAAG,QAAQ,IAAI,WAAW,QAAQ,SAAS,GAAG;EAC7D,MAAM,OAAO,IAAI,WAAW;EAC5B,MAAM,QAAQ,IAAI,WAAW,QAAQ,MAAM;EAC3C,MAAM,QAAQ,KAAK,aAAa;AAChC,MAAI,CAAC,yBAAyB,MAAM,CAAE;AACtC,MAAI,WAAW,MAAM,CAAE,QAAO,EAAE,QAAQ,WAAW;AACnD,MAAI,UAAU,iBAAiB;GAC7B,MAAM,QAAQ,8BAA8B,KAAK,MAAM,QAAQ,WAAW,GAAG,CAAC;AAC9E,OAAI,CAAC,MAAO,QAAO,EAAE,QAAQ,WAAW;GACxC,MAAM,YAAY,MAAM,GAAG,QAAQ,WAAW,GAAG;AACjD,OAAI,UAAU,WAAW,KAAK,WAAW,UAAU,CAAE,QAAO,EAAE,QAAQ,WAAW;AACjF,cAAW,KAAK,UAAU;SACrB;GACL,MAAM,YAAY,MAAM,QAAQ,WAAW,GAAG;AAC9C,OAAI,UAAU,WAAW,EAAG,QAAO,EAAE,QAAQ,WAAW;AACxD,cAAW,KAAK,UAAU;;;AAG9B,QAAO,WAAW,SAAS,IAAI,EAAE,YAAY,GAAG,EAAE,QAAQ,WAAW;;AAGvE,SAAS,cAAc,WAAmB,MAA6C;CACrF,MAAM,UAAU,OAAO,KAAK,WAAW,OAAO;AAC9C,MAAK,IAAI,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;EACnD,MAAM,MAAM,KAAK;AACjB,MAAI,QAAQ,WAAW,IAAI,2CAA0B,SAAS,IAAI,CAAE,QAAO;;;AAK/E,SAAgB,sBAAsB,KAA2B,QAAkC;AACjG,KAAI,CAAC,OAAO,QAAS,QAAO,EAAE,IAAI,MAAM;CACxC,MAAM,YAAY,cAAc,IAAI;AACpC,KAAI,CAAC,UAAU,WAAY,QAAO;EAAE,IAAI;EAAO,QAAQ,UAAU;EAAQ;CACzE,IAAI;AACJ,MAAK,MAAM,aAAa,UAAU,YAAY;EAC5C,MAAM,QAAQ,cAAc,WAAW,OAAO,KAAK;AACnD,MAAI,UAAU,OAAW,QAAO;GAAE,IAAI;GAAO,QAAQ;GAAW;AAChE,MAAI,aAAa,UAAa,aAAa,MAAO,QAAO;GAAE,IAAI;GAAO,QAAQ;GAAY;AAC1F,aAAW;;AAEb,QAAO,EAAE,IAAI,MAAM;;;AAIrB,SAAgB,yBAAyB,KAA2B,QAA4B;AAC9F,KAAI,OAAO,QAAS,uBAAsB,IAAI,IAAI;;;AAIpD,SAAgB,uBAAuB,KAAoC;AACzE,QAAO,sBAAsB,IAAI,IAAI;;AAGvC,SAAgB,yBACd,KACA,gBACM;AACN,gBAAe,IAAI;AACnB,KAAI,UAAU,KAAK;EACjB,gBAAgB;EAChB,kBAAkB,OAAO,WAAW,mBAAmB;EACvD,oBAAoB;EACrB,CAAC;AACF,KAAI,IAAI,mBAAmB;;AAG7B,SAAgB,4BAA4B,QAA0B;AACpE,QAAO,MACL;EACE;EACA;EACA,mBAAmB,OAAO,WAAW,mBAAmB;EACxD;EACA;EACA;EACA;EACD,CAAC,KAAK,OAAO,CACf;AACD,QAAO,SAAS"}

package/dist/api-key-auth.d.cts

@@ -0,0 +1,17 @@
+import { ApiKeyAuthConfig } from "./types.cjs";
+
+//#region src/api-key-auth.d.ts
+
+/** @internal */
+interface ApiKeyPolicy {
+  readonly enabled: boolean;
+  readonly keys: readonly Buffer[];
+}
+/** @internal */
+interface ResolvedInboundAuth {
+  readonly publicConfig?: ApiKeyAuthConfig;
+  readonly policy: ApiKeyPolicy;
+}
+//#endregion
+export { ResolvedInboundAuth };
+//# sourceMappingURL=api-key-auth.d.cts.map

package/dist/api-key-auth.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-auth.d.cts","names":[],"sources":["../src/api-key-auth.ts"],"sourcesContent":[],"mappings":";;;;;AA+B0B,UAPT,YAAA,CAOS;WACP,OAAA,EAAA,OAAA;EAAY,SAAA,IAAA,EAAA,SANL,MAMK,EAAA;;;UAFd,mBAAA;0BACS;mBACP"}

package/dist/api-key-auth.d.ts

@@ -0,0 +1,17 @@
+import { ApiKeyAuthConfig } from "./types.js";
+
+//#region src/api-key-auth.d.ts
+
+/** @internal */
+interface ApiKeyPolicy {
+  readonly enabled: boolean;
+  readonly keys: readonly Buffer[];
+}
+/** @internal */
+interface ResolvedInboundAuth {
+  readonly publicConfig?: ApiKeyAuthConfig;
+  readonly policy: ApiKeyPolicy;
+}
+//#endregion
+export { ResolvedInboundAuth };
+//# sourceMappingURL=api-key-auth.d.ts.map

package/dist/api-key-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-auth.d.ts","names":[],"sources":["../src/api-key-auth.ts"],"sourcesContent":[],"mappings":";;;;;AA+B0B,UAPT,YAAA,CAOS;WACP,OAAA,EAAA,OAAA;EAAY,SAAA,IAAA,EAAA,SANL,MAMK,EAAA;;;UAFd,mBAAA;0BACS;mBACP"}

package/dist/api-key-auth.js

@@ -0,0 +1,158 @@
+import { timingSafeEqual } from "node:crypto";
+
+//#region src/api-key-auth.ts
+const INBOUND_API_KEY_HEADERS = [
+	"authorization",
+	"x-api-key",
+	"x-goog-api-key",
+	"api-key",
+	"xi-api-key"
+];
+const RECOGNIZED_HEADERS = new Set(INBOUND_API_KEY_HEADERS);
+const API_KEY_ERROR_BODY = JSON.stringify({ error: {
+	message: "Invalid API key",
+	type: "authentication_error",
+	code: "invalid_api_key"
+} });
+const DISABLED_POLICY = {
+	enabled: false,
+	keys: []
+};
+const authenticatedRequests = /* @__PURE__ */ new WeakSet();
+const OWS_EDGES = /^[ \t]+|[ \t]+$/g;
+function fail(label, suffix) {
+	throw new Error(`${label}${suffix}`);
+}
+function hasControl(value) {
+	for (let index = 0; index < value.length; index += 1) {
+		const code = value.charCodeAt(index);
+		if (code <= 31 || code === 127) return true;
+	}
+	return false;
+}
+function normalizeKey(value, label) {
+	if (typeof value !== "string") fail(label, " must be a string");
+	const normalized = value.replace(OWS_EDGES, "");
+	if (normalized.length === 0) fail(label, " must not be empty");
+	if (hasControl(normalized)) fail(label, " must not contain control characters");
+	return normalized;
+}
+/** Parse a public auth source once and construct its private server policy. */
+function resolveInboundAuth(source) {
+	if (source.value === void 0) return { policy: DISABLED_POLICY };
+	if (source.value === null || typeof source.value !== "object" || Array.isArray(source.value)) fail(source.label, " must be an object");
+	const apiKeys = source.value.apiKeys;
+	if (!Array.isArray(apiKeys)) fail(`${source.label}.apiKeys`, " must be an array");
+	if (apiKeys.length === 0) fail(`${source.label}.apiKeys`, " must not be empty");
+	const keys = apiKeys.map((value, index) => normalizeKey(value, `${source.label}.apiKeys[${index}]`));
+	const seen = /* @__PURE__ */ new Set();
+	for (const key of keys) {
+		if (seen.has(key)) fail(source.label, " must not contain duplicate API keys");
+		seen.add(key);
+	}
+	return {
+		publicConfig: { apiKeys: keys },
+		policy: {
+			enabled: true,
+			keys: keys.map((key) => Buffer.from(key, "utf8"))
+		}
+	};
+}
+/** Select configuration without parsing it, so an environment override bypasses malformed JSON auth. */
+function selectInboundAuthSource(configAuth, env = process.env) {
+	if (Object.prototype.hasOwnProperty.call(env, "AIMOCK_API_KEYS")) return {
+		value: { apiKeys: (env.AIMOCK_API_KEYS ?? "").split(",") },
+		label: "AIMOCK_API_KEYS"
+	};
+	return {
+		value: configAuth,
+		label: "aimock.json.auth"
+	};
+}
+function isRecognizedApiKeyHeader(name) {
+	return RECOGNIZED_HEADERS.has(name.toLowerCase());
+}
+function rawCandidates(req) {
+	const candidates = [];
+	for (let index = 0; index < req.rawHeaders.length; index += 2) {
+		const name = req.rawHeaders[index];
+		const value = req.rawHeaders[index + 1] ?? "";
+		const lower = name.toLowerCase();
+		if (!isRecognizedApiKeyHeader(lower)) continue;
+		if (hasControl(value)) return { reason: "invalid" };
+		if (lower === "authorization") {
+			const match = /^(?:Bearer|Key)[ \t]+(.+)$/i.exec(value.replace(OWS_EDGES, ""));
+			if (!match) return { reason: "invalid" };
+			const candidate = match[1].replace(OWS_EDGES, "");
+			if (candidate.length === 0 || hasControl(candidate)) return { reason: "invalid" };
+			candidates.push(candidate);
+		} else {
+			const candidate = value.replace(OWS_EDGES, "");
+			if (candidate.length === 0) return { reason: "invalid" };
+			candidates.push(candidate);
+		}
+	}
+	return candidates.length > 0 ? { candidates } : { reason: "missing" };
+}
+function matchingIndex(candidate, keys) {
+	const encoded = Buffer.from(candidate, "utf8");
+	for (let index = 0; index < keys.length; index += 1) {
+		const key = keys[index];
+		if (encoded.length === key.length && timingSafeEqual(encoded, key)) return index;
+	}
+}
+function validateRequestApiKey(req, policy) {
+	if (!policy.enabled) return { ok: true };
+	const extracted = rawCandidates(req);
+	if (!extracted.candidates) return {
+		ok: false,
+		reason: extracted.reason
+	};
+	let resolved;
+	for (const candidate of extracted.candidates) {
+		const index = matchingIndex(candidate, policy.keys);
+		if (index === void 0) return {
+			ok: false,
+			reason: "invalid"
+		};
+		if (resolved !== void 0 && resolved !== index) return {
+			ok: false,
+			reason: "conflict"
+		};
+		resolved = index;
+	}
+	return { ok: true };
+}
+/** @internal Opaque egress marker; it deliberately carries no key material. */
+function markAuthenticatedRequest(req, policy) {
+	if (policy.enabled) authenticatedRequests.add(req);
+}
+/** @internal Used by egress paths to select safe credential handling. */
+function isAuthenticatedRequest(req) {
+	return authenticatedRequests.has(req);
+}
+function writeApiKeyHttpRejection(res, setCorsHeaders) {
+	setCorsHeaders(res);
+	res.writeHead(401, {
+		"Content-Type": "application/json",
+		"Content-Length": Buffer.byteLength(API_KEY_ERROR_BODY),
+		"WWW-Authenticate": "Bearer realm=\"aimock\""
+	});
+	res.end(API_KEY_ERROR_BODY);
+}
+function writeApiKeyUpgradeRejection(socket) {
+	socket.write([
+		"HTTP/1.1 401 Unauthorized",
+		"Content-Type: application/json",
+		`Content-Length: ${Buffer.byteLength(API_KEY_ERROR_BODY)}`,
+		"WWW-Authenticate: Bearer realm=\"aimock\"",
+		"Connection: close",
+		"",
+		API_KEY_ERROR_BODY
+	].join("\r\n"));
+	socket.destroy();
+}
+
+//#endregion
+export { isAuthenticatedRequest, isRecognizedApiKeyHeader, markAuthenticatedRequest, resolveInboundAuth, selectInboundAuthSource, validateRequestApiKey, writeApiKeyHttpRejection, writeApiKeyUpgradeRejection };
+//# sourceMappingURL=api-key-auth.js.map

package/dist/api-key-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-auth.js","names":[],"sources":["../src/api-key-auth.ts"],"sourcesContent":["import { timingSafeEqual } from \"node:crypto\";\nimport type * as http from \"node:http\";\nimport type * as net from \"node:net\";\nimport type { ApiKeyAuthConfig } from \"./types.js\";\n\nexport const INBOUND_API_KEY_HEADERS = [\n  \"authorization\",\n  \"x-api-key\",\n  \"x-goog-api-key\",\n  \"api-key\",\n  \"xi-api-key\",\n] as const;\n\nconst RECOGNIZED_HEADERS = new Set<string>(INBOUND_API_KEY_HEADERS);\n\nexport const API_KEY_ERROR_BODY = JSON.stringify({\n  error: {\n    message: \"Invalid API key\",\n    type: \"authentication_error\",\n    code: \"invalid_api_key\",\n  },\n});\n\n/** @internal */\nexport interface ApiKeyPolicy {\n  readonly enabled: boolean;\n  readonly keys: readonly Buffer[];\n}\n\n/** @internal */\nexport interface ResolvedInboundAuth {\n  readonly publicConfig?: ApiKeyAuthConfig;\n  readonly policy: ApiKeyPolicy;\n}\n\nexport interface AuthResult {\n  readonly ok: boolean;\n  readonly reason?: \"missing\" | \"invalid\" | \"conflict\";\n}\n\nconst DISABLED_POLICY: ApiKeyPolicy = { enabled: false, keys: [] };\nconst authenticatedRequests = new WeakSet<http.IncomingMessage>();\nconst OWS_EDGES = /^[ \\t]+|[ \\t]+$/g;\n\nfunction fail(label: string, suffix: string): never {\n  throw new Error(`${label}${suffix}`);\n}\n\nfunction hasControl(value: string): boolean {\n  for (let index = 0; index < value.length; index += 1) {\n    const code = value.charCodeAt(index);\n    if (code <= 0x1f || code === 0x7f) return true;\n  }\n  return false;\n}\n\nfunction normalizeKey(value: unknown, label: string): string {\n  if (typeof value !== \"string\") fail(label, \" must be a string\");\n  const normalized = value.replace(OWS_EDGES, \"\");\n  if (normalized.length === 0) fail(label, \" must not be empty\");\n  if (hasControl(normalized)) fail(label, \" must not contain control characters\");\n  return normalized;\n}\n\n/** Parse a public auth source once and construct its private server policy. */\nexport function resolveInboundAuth(source: { value: unknown; label: string }): ResolvedInboundAuth {\n  if (source.value === undefined) return { policy: DISABLED_POLICY };\n  if (source.value === null || typeof source.value !== \"object\" || Array.isArray(source.value)) {\n    fail(source.label, \" must be an object\");\n  }\n  const apiKeys = (source.value as { apiKeys?: unknown }).apiKeys;\n  if (!Array.isArray(apiKeys)) fail(`${source.label}.apiKeys`, \" must be an array\");\n  if (apiKeys.length === 0) fail(`${source.label}.apiKeys`, \" must not be empty\");\n  const keys = apiKeys.map((value, index) =>\n    normalizeKey(value, `${source.label}.apiKeys[${index}]`),\n  );\n  const seen = new Set<string>();\n  for (const key of keys) {\n    if (seen.has(key)) fail(source.label, \" must not contain duplicate API keys\");\n    seen.add(key);\n  }\n  return {\n    publicConfig: { apiKeys: keys },\n    policy: { enabled: true, keys: keys.map((key) => Buffer.from(key, \"utf8\")) },\n  };\n}\n\n/** Select configuration without parsing it, so an environment override bypasses malformed JSON auth. */\nexport function selectInboundAuthSource(\n  configAuth: unknown,\n  env: NodeJS.ProcessEnv = process.env,\n): { value: unknown; label: string } {\n  if (Object.prototype.hasOwnProperty.call(env, \"AIMOCK_API_KEYS\")) {\n    return { value: { apiKeys: (env.AIMOCK_API_KEYS ?? \"\").split(\",\") }, label: \"AIMOCK_API_KEYS\" };\n  }\n  return { value: configAuth, label: \"aimock.json.auth\" };\n}\n\nexport function isRecognizedApiKeyHeader(name: string): boolean {\n  return RECOGNIZED_HEADERS.has(name.toLowerCase());\n}\n\nfunction rawCandidates(req: http.IncomingMessage): {\n  candidates?: string[];\n  reason?: \"missing\" | \"invalid\";\n} {\n  const candidates: string[] = [];\n  for (let index = 0; index < req.rawHeaders.length; index += 2) {\n    const name = req.rawHeaders[index];\n    const value = req.rawHeaders[index + 1] ?? \"\";\n    const lower = name.toLowerCase();\n    if (!isRecognizedApiKeyHeader(lower)) continue;\n    if (hasControl(value)) return { reason: \"invalid\" };\n    if (lower === \"authorization\") {\n      const match = /^(?:Bearer|Key)[ \\t]+(.+)$/i.exec(value.replace(OWS_EDGES, \"\"));\n      if (!match) return { reason: \"invalid\" };\n      const candidate = match[1].replace(OWS_EDGES, \"\");\n      if (candidate.length === 0 || hasControl(candidate)) return { reason: \"invalid\" };\n      candidates.push(candidate);\n    } else {\n      const candidate = value.replace(OWS_EDGES, \"\");\n      if (candidate.length === 0) return { reason: \"invalid\" };\n      candidates.push(candidate);\n    }\n  }\n  return candidates.length > 0 ? { candidates } : { reason: \"missing\" };\n}\n\nfunction matchingIndex(candidate: string, keys: readonly Buffer[]): number | undefined {\n  const encoded = Buffer.from(candidate, \"utf8\");\n  for (let index = 0; index < keys.length; index += 1) {\n    const key = keys[index];\n    if (encoded.length === key.length && timingSafeEqual(encoded, key)) return index;\n  }\n  return undefined;\n}\n\nexport function validateRequestApiKey(req: http.IncomingMessage, policy: ApiKeyPolicy): AuthResult {\n  if (!policy.enabled) return { ok: true };\n  const extracted = rawCandidates(req);\n  if (!extracted.candidates) return { ok: false, reason: extracted.reason };\n  let resolved: number | undefined;\n  for (const candidate of extracted.candidates) {\n    const index = matchingIndex(candidate, policy.keys);\n    if (index === undefined) return { ok: false, reason: \"invalid\" };\n    if (resolved !== undefined && resolved !== index) return { ok: false, reason: \"conflict\" };\n    resolved = index;\n  }\n  return { ok: true };\n}\n\n/** @internal Opaque egress marker; it deliberately carries no key material. */\nexport function markAuthenticatedRequest(req: http.IncomingMessage, policy: ApiKeyPolicy): void {\n  if (policy.enabled) authenticatedRequests.add(req);\n}\n\n/** @internal Used by egress paths to select safe credential handling. */\nexport function isAuthenticatedRequest(req: http.IncomingMessage): boolean {\n  return authenticatedRequests.has(req);\n}\n\nexport function writeApiKeyHttpRejection(\n  res: http.ServerResponse,\n  setCorsHeaders: (res: http.ServerResponse) => void,\n): void {\n  setCorsHeaders(res);\n  res.writeHead(401, {\n    \"Content-Type\": \"application/json\",\n    \"Content-Length\": Buffer.byteLength(API_KEY_ERROR_BODY),\n    \"WWW-Authenticate\": 'Bearer realm=\"aimock\"',\n  });\n  res.end(API_KEY_ERROR_BODY);\n}\n\nexport function writeApiKeyUpgradeRejection(socket: net.Socket): void {\n  socket.write(\n    [\n      \"HTTP/1.1 401 Unauthorized\",\n      \"Content-Type: application/json\",\n      `Content-Length: ${Buffer.byteLength(API_KEY_ERROR_BODY)}`,\n      'WWW-Authenticate: Bearer realm=\"aimock\"',\n      \"Connection: close\",\n      \"\",\n      API_KEY_ERROR_BODY,\n    ].join(\"\\r\\n\"),\n  );\n  socket.destroy();\n}\n"],"mappings":";;;AAKA,MAAa,0BAA0B;CACrC;CACA;CACA;CACA;CACA;CACD;AAED,MAAM,qBAAqB,IAAI,IAAY,wBAAwB;AAEnE,MAAa,qBAAqB,KAAK,UAAU,EAC/C,OAAO;CACL,SAAS;CACT,MAAM;CACN,MAAM;CACP,EACF,CAAC;AAmBF,MAAM,kBAAgC;CAAE,SAAS;CAAO,MAAM,EAAE;CAAE;AAClE,MAAM,wCAAwB,IAAI,SAA+B;AACjE,MAAM,YAAY;AAElB,SAAS,KAAK,OAAe,QAAuB;AAClD,OAAM,IAAI,MAAM,GAAG,QAAQ,SAAS;;AAGtC,SAAS,WAAW,OAAwB;AAC1C,MAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;EACpD,MAAM,OAAO,MAAM,WAAW,MAAM;AACpC,MAAI,QAAQ,MAAQ,SAAS,IAAM,QAAO;;AAE5C,QAAO;;AAGT,SAAS,aAAa,OAAgB,OAAuB;AAC3D,KAAI,OAAO,UAAU,SAAU,MAAK,OAAO,oBAAoB;CAC/D,MAAM,aAAa,MAAM,QAAQ,WAAW,GAAG;AAC/C,KAAI,WAAW,WAAW,EAAG,MAAK,OAAO,qBAAqB;AAC9D,KAAI,WAAW,WAAW,CAAE,MAAK,OAAO,uCAAuC;AAC/E,QAAO;;;AAIT,SAAgB,mBAAmB,QAAgE;AACjG,KAAI,OAAO,UAAU,OAAW,QAAO,EAAE,QAAQ,iBAAiB;AAClE,KAAI,OAAO,UAAU,QAAQ,OAAO,OAAO,UAAU,YAAY,MAAM,QAAQ,OAAO,MAAM,CAC1F,MAAK,OAAO,OAAO,qBAAqB;CAE1C,MAAM,UAAW,OAAO,MAAgC;AACxD,KAAI,CAAC,MAAM,QAAQ,QAAQ,CAAE,MAAK,GAAG,OAAO,MAAM,WAAW,oBAAoB;AACjF,KAAI,QAAQ,WAAW,EAAG,MAAK,GAAG,OAAO,MAAM,WAAW,qBAAqB;CAC/E,MAAM,OAAO,QAAQ,KAAK,OAAO,UAC/B,aAAa,OAAO,GAAG,OAAO,MAAM,WAAW,MAAM,GAAG,CACzD;CACD,MAAM,uBAAO,IAAI,KAAa;AAC9B,MAAK,MAAM,OAAO,MAAM;AACtB,MAAI,KAAK,IAAI,IAAI,CAAE,MAAK,OAAO,OAAO,uCAAuC;AAC7E,OAAK,IAAI,IAAI;;AAEf,QAAO;EACL,cAAc,EAAE,SAAS,MAAM;EAC/B,QAAQ;GAAE,SAAS;GAAM,MAAM,KAAK,KAAK,QAAQ,OAAO,KAAK,KAAK,OAAO,CAAC;GAAE;EAC7E;;;AAIH,SAAgB,wBACd,YACA,MAAyB,QAAQ,KACE;AACnC,KAAI,OAAO,UAAU,eAAe,KAAK,KAAK,kBAAkB,CAC9D,QAAO;EAAE,OAAO,EAAE,UAAU,IAAI,mBAAmB,IAAI,MAAM,IAAI,EAAE;EAAE,OAAO;EAAmB;AAEjG,QAAO;EAAE,OAAO;EAAY,OAAO;EAAoB;;AAGzD,SAAgB,yBAAyB,MAAuB;AAC9D,QAAO,mBAAmB,IAAI,KAAK,aAAa,CAAC;;AAGnD,SAAS,cAAc,KAGrB;CACA,MAAM,aAAuB,EAAE;AAC/B,MAAK,IAAI,QAAQ,GAAG,QAAQ,IAAI,WAAW,QAAQ,SAAS,GAAG;EAC7D,MAAM,OAAO,IAAI,WAAW;EAC5B,MAAM,QAAQ,IAAI,WAAW,QAAQ,MAAM;EAC3C,MAAM,QAAQ,KAAK,aAAa;AAChC,MAAI,CAAC,yBAAyB,MAAM,CAAE;AACtC,MAAI,WAAW,MAAM,CAAE,QAAO,EAAE,QAAQ,WAAW;AACnD,MAAI,UAAU,iBAAiB;GAC7B,MAAM,QAAQ,8BAA8B,KAAK,MAAM,QAAQ,WAAW,GAAG,CAAC;AAC9E,OAAI,CAAC,MAAO,QAAO,EAAE,QAAQ,WAAW;GACxC,MAAM,YAAY,MAAM,GAAG,QAAQ,WAAW,GAAG;AACjD,OAAI,UAAU,WAAW,KAAK,WAAW,UAAU,CAAE,QAAO,EAAE,QAAQ,WAAW;AACjF,cAAW,KAAK,UAAU;SACrB;GACL,MAAM,YAAY,MAAM,QAAQ,WAAW,GAAG;AAC9C,OAAI,UAAU,WAAW,EAAG,QAAO,EAAE,QAAQ,WAAW;AACxD,cAAW,KAAK,UAAU;;;AAG9B,QAAO,WAAW,SAAS,IAAI,EAAE,YAAY,GAAG,EAAE,QAAQ,WAAW;;AAGvE,SAAS,cAAc,WAAmB,MAA6C;CACrF,MAAM,UAAU,OAAO,KAAK,WAAW,OAAO;AAC9C,MAAK,IAAI,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;EACnD,MAAM,MAAM,KAAK;AACjB,MAAI,QAAQ,WAAW,IAAI,UAAU,gBAAgB,SAAS,IAAI,CAAE,QAAO;;;AAK/E,SAAgB,sBAAsB,KAA2B,QAAkC;AACjG,KAAI,CAAC,OAAO,QAAS,QAAO,EAAE,IAAI,MAAM;CACxC,MAAM,YAAY,cAAc,IAAI;AACpC,KAAI,CAAC,UAAU,WAAY,QAAO;EAAE,IAAI;EAAO,QAAQ,UAAU;EAAQ;CACzE,IAAI;AACJ,MAAK,MAAM,aAAa,UAAU,YAAY;EAC5C,MAAM,QAAQ,cAAc,WAAW,OAAO,KAAK;AACnD,MAAI,UAAU,OAAW,QAAO;GAAE,IAAI;GAAO,QAAQ;GAAW;AAChE,MAAI,aAAa,UAAa,aAAa,MAAO,QAAO;GAAE,IAAI;GAAO,QAAQ;GAAY;AAC1F,aAAW;;AAEb,QAAO,EAAE,IAAI,MAAM;;;AAIrB,SAAgB,yBAAyB,KAA2B,QAA4B;AAC9F,KAAI,OAAO,QAAS,uBAAsB,IAAI,IAAI;;;AAIpD,SAAgB,uBAAuB,KAAoC;AACzE,QAAO,sBAAsB,IAAI,IAAI;;AAGvC,SAAgB,yBACd,KACA,gBACM;AACN,gBAAe,IAAI;AACnB,KAAI,UAAU,KAAK;EACjB,gBAAgB;EAChB,kBAAkB,OAAO,WAAW,mBAAmB;EACvD,oBAAoB;EACrB,CAAC;AACF,KAAI,IAAI,mBAAmB;;AAG7B,SAAgB,4BAA4B,QAA0B;AACpE,QAAO,MACL;EACE;EACA;EACA,mBAAmB,OAAO,WAAW,mBAAmB;EACxD;EACA;EACA;EACA;EACD,CAAC,KAAK,OAAO,CACf;AACD,QAAO,SAAS"}

package/dist/cli.cjs

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 const require_runtime = require('./_virtual/_rolldown/runtime.cjs');
+const require_api_key_auth = require('./api-key-auth.cjs');
 const require_logger = require('./logger.cjs');
 const require_agui_mock = require('./agui-mock.cjs');
 const require_fixture_loader = require('./fixture-loader.cjs');
@@ -53,6 +54,7 @@ Options:
       --chaos-drop <rate>   Probability (0-1) of dropping requests with 500
       --chaos-malformed <rate>  Probability (0-1) of returning malformed JSON
       --chaos-disconnect <rate> Probability (0-1) of destroying connection
+      AIMOCK_API_KEYS  Comma-separated inbound test API keys (environment only)
       --help                Show this help message
 `.trim();
 const { values } = (0, node_util.parseArgs)({
@@ -423,7 +425,8 @@ async function main() {
 		record,
 		strict: values.strict,
 		journalMaxEntries: journalMax,
-		fixtureCountsMaxTestIds: fixtureCountsMax
+		fixtureCountsMaxTestIds: fixtureCountsMax,
+		auth: require_api_key_auth.resolveInboundAuth(require_api_key_auth.selectInboundAuthSource(void 0)).publicConfig
 	}, mounts);
 	logger.info(`aimock server listening on ${instance.url}`);
 	let watcher = null;

package/dist/cli.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"cli.cjs","names":["Logger","readProviderKeysFromEnv","AGUIMock","resolveFixturesValue","loadFixturesFromDir","loadFixtureFile","validateFixtures","createServer","watchFixtures"],"sources":["../src/cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { parseArgs } from \"node:util\";\nimport { statSync } from \"node:fs\";\nimport { resolve } from \"node:path\";\nimport { createServer } from \"./server.js\";\nimport { loadFixtureFile, loadFixturesFromDir, validateFixtures } from \"./fixture-loader.js\";\nimport { Logger, type LogLevel } from \"./logger.js\";\nimport { watchFixtures } from \"./watcher.js\";\nimport { AGUIMock } from \"./agui-mock.js\";\nimport { resolveFixturesValue } from \"./fixtures-remote.js\";\nimport { readProviderKeysFromEnv } from \"./provider-auth.js\";\nimport type { Fixture, ChaosConfig, RecordConfig } from \"./types.js\";\n\nconst HELP = `\nUsage: aimock [options]\n\nOptions:\n  -p, --port <number>       Port to listen on (default: 4010)\n  -h, --host <string>       Host to bind to (default: 127.0.0.1)\n  -f, --fixtures <value>    Fixture source (repeatable). Accepts:\n                              - filesystem path to a directory or .json file (default: ./fixtures)\n                              - https:// or http:// URL to a .json fixture file\n  -l, --latency <ms>        Latency in ms between SSE chunks (default: 0)\n  -c, --chunk-size <chars>  Chunk size in characters (default: 20)\n  -w, --watch               Watch fixture path for changes and reload\n      --log-level <level>   Log verbosity: silent, warn, info, debug (default: info)\n      --validate-on-load    Validate fixture schemas at startup\n      --metrics             Enable Prometheus metrics at GET /metrics\n      --record              Record mode: proxy unmatched requests and save fixtures\n      --record-full-model-version  Record exact model version without date stripping (default: false)\n      --proxy-only          Proxy mode: forward unmatched requests without saving\n      --strict              Strict mode: fail on unmatched requests (overridable per-request via X-AIMock-Strict header)\n      --journal-max <n>     Max request entries retained in memory (default: 1000, 0 = unbounded)\n      --fixture-counts-max <n>  Max unique testIds retained in fixture match-count map (default: 500, 0 = unbounded)\n      --provider-openai <url>     Upstream URL for OpenAI (used with --record)\n      --provider-anthropic <url>  Upstream URL for Anthropic\n      --provider-gemini <url>     Upstream URL for Gemini\n      --provider-vertexai <url>   Upstream URL for Vertex AI\n      --provider-bedrock <url>    Upstream URL for Bedrock\n      --provider-azure <url>      Upstream URL for Azure OpenAI\n      --provider-ollama <url>     Upstream URL for Ollama\n      --provider-cohere <url>     Upstream URL for Cohere\n      --provider-openrouter <url> Upstream URL for OpenRouter (video record proxy)\n      --upstream-timeout-ms <ms>  Idle timeout (ms) on upstream socket before response (default: 30000)\n      --body-timeout-ms <ms>      Idle timeout (ms) on upstream response body between chunks (default: 30000)\n      --max-proxy-buffer-bytes <n> Cap (bytes) on in-memory proxy-path buffer; full body still relayed (default: 67108864)\n      --max-proxy-buffer-frames <n> Cap (frames) on in-memory proxy-path per-frame state; full body still relayed (default: 5000000)\n      --agui-record              Enable AG-UI recording (proxy unmatched AG-UI requests)\n      --agui-upstream <url>      Upstream AG-UI agent URL (used with --agui-record)\n      --agui-proxy-only          AG-UI proxy mode: forward without saving\n      --replay-speed <n>    Replay speed multiplier (default: 1.0, 2.0 = 2x faster)\n      --chaos-drop <rate>   Probability (0-1) of dropping requests with 500\n      --chaos-malformed <rate>  Probability (0-1) of returning malformed JSON\n      --chaos-disconnect <rate> Probability (0-1) of destroying connection\n      --help                Show this help message\n`.trim();\n\nconst { values } = parseArgs({\n  options: {\n    port: { type: \"string\", short: \"p\", default: \"4010\" },\n    host: { type: \"string\", short: \"h\", default: \"127.0.0.1\" },\n    fixtures: { type: \"string\", short: \"f\", multiple: true },\n    latency: { type: \"string\", short: \"l\", default: \"0\" },\n    \"chunk-size\": { type: \"string\", short: \"c\", default: \"20\" },\n    watch: { type: \"boolean\", short: \"w\", default: false },\n    \"log-level\": { type: \"string\", default: \"info\" },\n    \"validate-on-load\": { type: \"boolean\", default: false },\n    metrics: { type: \"boolean\", default: false },\n    record: { type: \"boolean\", default: false },\n    \"record-full-model-version\": { type: \"boolean\", default: false },\n    \"proxy-only\": { type: \"boolean\", default: false },\n    strict: { type: \"boolean\", default: false },\n    \"provider-openai\": { type: \"string\" },\n    \"provider-anthropic\": { type: \"string\" },\n    \"provider-gemini\": { type: \"string\" },\n    \"provider-vertexai\": { type: \"string\" },\n    \"provider-bedrock\": { type: \"string\" },\n    \"provider-azure\": { type: \"string\" },\n    \"provider-ollama\": { type: \"string\" },\n    \"provider-cohere\": { type: \"string\" },\n    \"provider-openrouter\": { type: \"string\" },\n    \"upstream-timeout-ms\": { type: \"string\" },\n    \"body-timeout-ms\": { type: \"string\" },\n    \"max-proxy-buffer-bytes\": { type: \"string\" },\n    \"max-proxy-buffer-frames\": { type: \"string\" },\n    \"agui-record\": { type: \"boolean\", default: false },\n    \"agui-upstream\": { type: \"string\" },\n    \"agui-proxy-only\": { type: \"boolean\", default: false },\n    \"replay-speed\": { type: \"string\", default: \"1.0\" },\n    \"chaos-drop\": { type: \"string\" },\n    \"chaos-malformed\": { type: \"string\" },\n    \"chaos-disconnect\": { type: \"string\" },\n    \"journal-max\": { type: \"string\", default: \"1000\" },\n    \"fixture-counts-max\": { type: \"string\", default: \"500\" },\n    help: { type: \"boolean\", default: false },\n  },\n  strict: true,\n});\n\nif (values.help) {\n  console.log(HELP);\n  process.exit(0);\n}\n\nconst port = Number(values.port);\nconst host = values.host!;\nconst latency = Number(values.latency);\nconst chunkSize = Number(values[\"chunk-size\"]);\nconst fixtureValues: string[] =\n  values.fixtures && values.fixtures.length > 0 ? values.fixtures : [\"./fixtures\"];\nconst watchMode = values.watch!;\nconst validateOnLoad = values[\"validate-on-load\"]!;\nconst logLevelStr = values[\"log-level\"]!;\n\nif (![\"silent\", \"warn\", \"info\", \"debug\"].includes(logLevelStr)) {\n  console.error(`Invalid log-level: ${logLevelStr} (must be silent, warn, info, or debug)`);\n  process.exit(1);\n}\nconst logLevel = logLevelStr as LogLevel;\n\nif (Number.isNaN(port) || port < 0 || port > 65535) {\n  console.error(`Invalid port: ${values.port}`);\n  process.exit(1);\n}\n\nif (Number.isNaN(latency) || latency < 0) {\n  console.error(`Invalid latency: ${values.latency}`);\n  process.exit(1);\n}\n\nif (Number.isNaN(chunkSize) || chunkSize < 1) {\n  console.error(`Invalid chunk-size: ${values[\"chunk-size\"]}`);\n  process.exit(1);\n}\n\nconst replaySpeed = Number(values[\"replay-speed\"]);\nif (Number.isNaN(replaySpeed) || replaySpeed <= 0) {\n  console.error(\"--replay-speed must be a positive number\");\n  process.exit(1);\n}\n\nconst journalMax = Number(values[\"journal-max\"]);\nif (Number.isNaN(journalMax) || !Number.isInteger(journalMax) || journalMax < 0) {\n  console.error(\n    `Invalid journal-max: ${values[\"journal-max\"]} (must be a non-negative integer; 0 = unbounded)`,\n  );\n  process.exit(1);\n}\n\nconst fixtureCountsMaxStr = values[\"fixture-counts-max\"];\nconst fixtureCountsMax = Number(fixtureCountsMaxStr);\nif (Number.isNaN(fixtureCountsMax) || !Number.isInteger(fixtureCountsMax) || fixtureCountsMax < 0) {\n  console.error(\n    `Invalid fixture-counts-max: ${fixtureCountsMaxStr} (must be a non-negative integer; 0 = unbounded)`,\n  );\n  process.exit(1);\n}\n\nconst upstreamTimeoutMsStr = values[\"upstream-timeout-ms\"];\nlet upstreamTimeoutMs: number | undefined;\nif (upstreamTimeoutMsStr !== undefined) {\n  upstreamTimeoutMs = Number(upstreamTimeoutMsStr);\n  if (!Number.isFinite(upstreamTimeoutMs) || upstreamTimeoutMs <= 0) {\n    console.error(\n      `Invalid upstream-timeout-ms: ${upstreamTimeoutMsStr} (must be a positive finite number)`,\n    );\n    process.exit(1);\n  }\n}\n\nconst bodyTimeoutMsStr = values[\"body-timeout-ms\"];\nlet bodyTimeoutMs: number | undefined;\nif (bodyTimeoutMsStr !== undefined) {\n  bodyTimeoutMs = Number(bodyTimeoutMsStr);\n  if (!Number.isFinite(bodyTimeoutMs) || bodyTimeoutMs <= 0) {\n    console.error(\n      `Invalid body-timeout-ms: ${bodyTimeoutMsStr} (must be a positive finite number)`,\n    );\n    process.exit(1);\n  }\n}\n\nconst maxProxyBufferBytesStr = values[\"max-proxy-buffer-bytes\"];\nlet maxProxyBufferBytes: number | undefined;\nif (maxProxyBufferBytesStr !== undefined) {\n  maxProxyBufferBytes = Number(maxProxyBufferBytesStr);\n  if (!Number.isFinite(maxProxyBufferBytes) || maxProxyBufferBytes <= 0) {\n    console.error(\n      `Invalid max-proxy-buffer-bytes: ${maxProxyBufferBytesStr} (must be a positive finite number)`,\n    );\n    process.exit(1);\n  }\n}\n\nconst maxProxyBufferFramesStr = values[\"max-proxy-buffer-frames\"];\nlet maxProxyBufferFrames: number | undefined;\nif (maxProxyBufferFramesStr !== undefined) {\n  maxProxyBufferFrames = Number(maxProxyBufferFramesStr);\n  if (!Number.isFinite(maxProxyBufferFrames) || maxProxyBufferFrames <= 0) {\n    console.error(\n      `Invalid max-proxy-buffer-frames: ${maxProxyBufferFramesStr} (must be a positive finite number)`,\n    );\n    process.exit(1);\n  }\n}\n\nconst logger = new Logger(logLevel);\n\n// Parse chaos config from CLI flags\nlet chaos: ChaosConfig | undefined;\n{\n  const dropStr = values[\"chaos-drop\"];\n  const malformedStr = values[\"chaos-malformed\"];\n  const disconnectStr = values[\"chaos-disconnect\"];\n\n  if (dropStr !== undefined || malformedStr !== undefined || disconnectStr !== undefined) {\n    chaos = {};\n    if (dropStr !== undefined) {\n      const val = parseFloat(dropStr);\n      if (isNaN(val) || val < 0 || val > 1) {\n        console.error(`Invalid chaos-drop: ${dropStr} (must be 0-1)`);\n        process.exit(1);\n      }\n      chaos.dropRate = val;\n    }\n    if (malformedStr !== undefined) {\n      const val = parseFloat(malformedStr);\n      if (isNaN(val) || val < 0 || val > 1) {\n        console.error(`Invalid chaos-malformed: ${malformedStr} (must be 0-1)`);\n        process.exit(1);\n      }\n      chaos.malformedRate = val;\n    }\n    if (disconnectStr !== undefined) {\n      const val = parseFloat(disconnectStr);\n      if (isNaN(val) || val < 0 || val > 1) {\n        console.error(`Invalid chaos-disconnect: ${disconnectStr} (must be 0-1)`);\n        process.exit(1);\n      }\n      chaos.disconnectRate = val;\n    }\n  }\n}\n\n// Parse record/proxy config from CLI flags\nlet record: RecordConfig | undefined;\nif (values.record || values[\"proxy-only\"]) {\n  const providers: RecordConfig[\"providers\"] = {};\n  if (values[\"provider-openai\"]) providers.openai = values[\"provider-openai\"];\n  if (values[\"provider-anthropic\"]) providers.anthropic = values[\"provider-anthropic\"];\n  if (values[\"provider-gemini\"]) providers.gemini = values[\"provider-gemini\"];\n  if (values[\"provider-vertexai\"]) providers.vertexai = values[\"provider-vertexai\"];\n  if (values[\"provider-bedrock\"]) providers.bedrock = values[\"provider-bedrock\"];\n  if (values[\"provider-azure\"]) providers.azure = values[\"provider-azure\"];\n  if (values[\"provider-ollama\"]) providers.ollama = values[\"provider-ollama\"];\n  if (values[\"provider-cohere\"]) providers.cohere = values[\"provider-cohere\"];\n  if (values[\"provider-openrouter\"]) providers.openrouter = values[\"provider-openrouter\"];\n\n  if (Object.keys(providers).length === 0) {\n    console.error(\n      `Error: --${values[\"proxy-only\"] ? \"proxy-only\" : \"record\"} requires at least one --provider-* flag`,\n    );\n    process.exit(1);\n  }\n\n  // For --record, the first --fixtures value is the base path for the recording\n  // destination and must be a local filesystem path — writing to a URL is not supported.\n  // For --proxy-only, unmatched requests are forwarded without saving, so no writable\n  // destination is required; URL-only --fixtures is valid in that mode.\n  const recordBase = fixtureValues[0];\n  const recordBaseIsUrl = /^https?:\\/\\//i.test(recordBase);\n  if (values.record && recordBaseIsUrl) {\n    console.error(\n      `Error: --record requires a local --fixtures path for the recording destination; got URL ${recordBase}`,\n    );\n    process.exit(1);\n  }\n  record = {\n    providers,\n    // aimock's own upstream keys, sourced from AIMOCK_PROVIDER_*_KEY env vars\n    // (not CLI flags — secrets must not appear in `ps`). Injected on a\n    // fixture-miss passthrough when the caller sent no/dummy credential.\n    providerKeys: readProviderKeysFromEnv(),\n    // In proxy-only mode with only URL sources, fixturePath is never consumed\n    // (recorder.ts skips disk writes when proxyOnly is set). Leave it undefined\n    // rather than resolving a URL string as a filesystem path.\n    fixturePath: recordBaseIsUrl ? undefined : resolve(recordBase, \"recorded\"),\n    proxyOnly: values[\"proxy-only\"],\n    recordFullModelVersion: values[\"record-full-model-version\"],\n    upstreamTimeoutMs,\n    bodyTimeoutMs,\n    maxProxyBufferBytes,\n    maxProxyBufferFrames,\n  };\n} else {\n  // These flags configure upstream proxying — without --record or\n  // --proxy-only they would be parsed and then silently dropped. Routed\n  // through the constructed logger so --log-level is respected.\n  const droppedProviderFlags = (\n    [\n      \"provider-openai\",\n      \"provider-anthropic\",\n      \"provider-gemini\",\n      \"provider-vertexai\",\n      \"provider-bedrock\",\n      \"provider-azure\",\n      \"provider-ollama\",\n      \"provider-cohere\",\n      \"provider-openrouter\",\n    ] as const\n  ).filter((flag) => values[flag] !== undefined);\n  if (droppedProviderFlags.length > 0) {\n    logger.warn(\n      `--${droppedProviderFlags.join(\"/--\")} only apply to --record/--proxy-only upstream proxying — ignored without one of those flags.`,\n    );\n  }\n  if (\n    upstreamTimeoutMs !== undefined ||\n    bodyTimeoutMs !== undefined ||\n    maxProxyBufferBytes !== undefined ||\n    maxProxyBufferFrames !== undefined\n  ) {\n    logger.warn(\n      \"--upstream-timeout-ms/--body-timeout-ms/--max-proxy-buffer-bytes/--max-proxy-buffer-frames only apply to --record/--proxy-only upstream proxying — ignored without one of those flags.\",\n    );\n  }\n}\n\n// Parse AG-UI record/proxy config from CLI flags\nlet aguiMount: { path: string; handler: AGUIMock } | undefined;\nif (values[\"agui-record\"] || values[\"agui-proxy-only\"]) {\n  if (!values[\"agui-upstream\"]) {\n    console.error(\"Error: --agui-record/--agui-proxy-only requires --agui-upstream\");\n    process.exit(1);\n  }\n  // --agui-record writes recorded AG-UI fixtures to disk, so a URL source is unsupported.\n  // --agui-proxy-only forwards without saving, so URL-only --fixtures is valid.\n  const aguiBase = fixtureValues[0];\n  const aguiBaseIsUrl = /^https?:\\/\\//i.test(aguiBase);\n  if (values[\"agui-record\"] && aguiBaseIsUrl) {\n    console.error(\n      `Error: --agui-record requires a local --fixtures path for the recording destination; got URL ${aguiBase}`,\n    );\n    process.exit(1);\n  }\n  const agui = new AGUIMock();\n  agui.enableRecording({\n    upstream: values[\"agui-upstream\"],\n    // In proxy-only mode with a URL-only --fixtures, the AG-UI recorder never\n    // writes to disk (see agui-recorder.ts). Leave fixturePath undefined rather\n    // than resolving a URL as a filesystem path.\n    fixturePath: aguiBaseIsUrl ? undefined : resolve(aguiBase, \"agui-recorded\"),\n    proxyOnly: values[\"agui-proxy-only\"],\n  });\n  aguiMount = { path: \"/agui\", handler: agui };\n}\n\ninterface ResolvedFixtureSource {\n  source: string;\n  path: string;\n  isDir: boolean;\n}\n\nasync function resolveAllFixtureSources(): Promise<ResolvedFixtureSource[]> {\n  const resolved: ResolvedFixtureSource[] = [];\n  for (const value of fixtureValues) {\n    let local;\n    try {\n      local = await resolveFixturesValue(value, {\n        validateOnLoad,\n        logger,\n      });\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.error(`Failed to resolve --fixtures value \"${value}\": ${msg}`);\n      process.exit(1);\n    }\n    if (!local.path) {\n      // Remote fetch failed without validate-on-load and no cache — already warned; skip.\n      continue;\n    }\n    try {\n      const stat = statSync(local.path);\n      resolved.push({ source: local.source, path: local.path, isDir: stat.isDirectory() });\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === \"ENOENT\") {\n        console.error(`Fixtures path not found: ${local.path}`);\n      } else {\n        const msg = err instanceof Error ? err.message : String(err);\n        console.error(`Failed to load fixtures from ${local.path}: ${msg}`);\n      }\n      process.exit(1);\n    }\n  }\n  return resolved;\n}\n\nfunction loadSource(source: ResolvedFixtureSource): Fixture[] {\n  return source.isDir\n    ? loadFixturesFromDir(source.path, logger)\n    : loadFixtureFile(source.path, logger);\n}\n\nasync function main() {\n  const sources = await resolveAllFixtureSources();\n\n  const fixtures: Fixture[] = [];\n  for (const src of sources) {\n    fixtures.push(...loadSource(src));\n  }\n\n  if (fixtures.length === 0) {\n    if (validateOnLoad || values.strict) {\n      console.error(\"Error: No fixtures loaded and validation/strict mode is enabled — aborting.\");\n      process.exit(1);\n    }\n    console.warn(\"Warning: No fixtures loaded. The server will return 404 for all requests.\");\n  }\n\n  const sourceLabel = sources.map((s) => s.source).join(\", \") || \"<none>\";\n  logger.info(`Loaded ${fixtures.length} fixture(s) from ${sourceLabel}`);\n\n  // Validate fixtures if requested\n  if (validateOnLoad) {\n    const results = validateFixtures(fixtures);\n    const errors = results.filter((r) => r.severity === \"error\");\n    const warnings = results.filter((r) => r.severity === \"warning\");\n\n    for (const w of warnings) {\n      logger.warn(`Fixture ${w.fixtureIndex}: ${w.message}`);\n    }\n    for (const e of errors) {\n      logger.error(`Fixture ${e.fixtureIndex}: ${e.message}`);\n    }\n\n    if (errors.length > 0) {\n      console.error(`Validation failed: ${errors.length} error(s), ${warnings.length} warning(s)`);\n      process.exit(1);\n    }\n  }\n\n  const mounts = aguiMount ? [aguiMount] : undefined;\n\n  const instance = await createServer(\n    fixtures,\n    {\n      port,\n      host,\n      latency,\n      chunkSize,\n      replaySpeed,\n      logLevel,\n      chaos,\n      metrics: values.metrics,\n      record,\n      strict: values.strict,\n      journalMaxEntries: journalMax,\n      fixtureCountsMaxTestIds: fixtureCountsMax,\n    },\n    mounts,\n  );\n\n  logger.info(`aimock server listening on ${instance.url}`);\n\n  // Start file watcher if requested. Only the first local source is watched —\n  // remote URL sources are fetched once at boot and are not monitored.\n  let watcher: { close: () => void } | null = null;\n  if (watchMode) {\n    const primary = sources[0];\n    if (!primary) {\n      logger.warn(\"--watch requested but no resolvable fixture sources; skipping watcher\");\n    } else {\n      const loadFn = (): Fixture[] => loadSource(primary);\n      watcher = watchFixtures(primary.path, fixtures, loadFn, {\n        logger,\n        validate: validateOnLoad,\n        validateFn: validateFixtures,\n      });\n      logger.info(`Watching ${primary.path} for changes`);\n    }\n  }\n\n  function shutdown() {\n    logger.info(\"Shutting down...\");\n    if (watcher) watcher.close();\n    instance.server.close(() => {\n      process.exit(0);\n    });\n  }\n\n  process.on(\"SIGINT\", shutdown);\n  process.on(\"SIGTERM\", shutdown);\n}\n\nmain().catch((err) => {\n  console.error(err);\n  process.exit(1);\n});\n"],"mappings":";;;;;;;;;;;;;;AAaA,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0CX,MAAM;AAER,MAAM,EAAE,oCAAqB;CAC3B,SAAS;EACP,MAAM;GAAE,MAAM;GAAU,OAAO;GAAK,SAAS;GAAQ;EACrD,MAAM;GAAE,MAAM;GAAU,OAAO;GAAK,SAAS;GAAa;EAC1D,UAAU;GAAE,MAAM;GAAU,OAAO;GAAK,UAAU;GAAM;EACxD,SAAS;GAAE,MAAM;GAAU,OAAO;GAAK,SAAS;GAAK;EACrD,cAAc;GAAE,MAAM;GAAU,OAAO;GAAK,SAAS;GAAM;EAC3D,OAAO;GAAE,MAAM;GAAW,OAAO;GAAK,SAAS;GAAO;EACtD,aAAa;GAAE,MAAM;GAAU,SAAS;GAAQ;EAChD,oBAAoB;GAAE,MAAM;GAAW,SAAS;GAAO;EACvD,SAAS;GAAE,MAAM;GAAW,SAAS;GAAO;EAC5C,QAAQ;GAAE,MAAM;GAAW,SAAS;GAAO;EAC3C,6BAA6B;GAAE,MAAM;GAAW,SAAS;GAAO;EAChE,cAAc;GAAE,MAAM;GAAW,SAAS;GAAO;EACjD,QAAQ;GAAE,MAAM;GAAW,SAAS;GAAO;EAC3C,mBAAmB,EAAE,MAAM,UAAU;EACrC,sBAAsB,EAAE,MAAM,UAAU;EACxC,mBAAmB,EAAE,MAAM,UAAU;EACrC,qBAAqB,EAAE,MAAM,UAAU;EACvC,oBAAoB,EAAE,MAAM,UAAU;EACtC,kBAAkB,EAAE,MAAM,UAAU;EACpC,mBAAmB,EAAE,MAAM,UAAU;EACrC,mBAAmB,EAAE,MAAM,UAAU;EACrC,uBAAuB,EAAE,MAAM,UAAU;EACzC,uBAAuB,EAAE,MAAM,UAAU;EACzC,mBAAmB,EAAE,MAAM,UAAU;EACrC,0BAA0B,EAAE,MAAM,UAAU;EAC5C,2BAA2B,EAAE,MAAM,UAAU;EAC7C,eAAe;GAAE,MAAM;GAAW,SAAS;GAAO;EAClD,iBAAiB,EAAE,MAAM,UAAU;EACnC,mBAAmB;GAAE,MAAM;GAAW,SAAS;GAAO;EACtD,gBAAgB;GAAE,MAAM;GAAU,SAAS;GAAO;EAClD,cAAc,EAAE,MAAM,UAAU;EAChC,mBAAmB,EAAE,MAAM,UAAU;EACrC,oBAAoB,EAAE,MAAM,UAAU;EACtC,eAAe;GAAE,MAAM;GAAU,SAAS;GAAQ;EAClD,sBAAsB;GAAE,MAAM;GAAU,SAAS;GAAO;EACxD,MAAM;GAAE,MAAM;GAAW,SAAS;GAAO;EAC1C;CACD,QAAQ;CACT,CAAC;AAEF,IAAI,OAAO,MAAM;AACf,SAAQ,IAAI,KAAK;AACjB,SAAQ,KAAK,EAAE;;AAGjB,MAAM,OAAO,OAAO,OAAO,KAAK;AAChC,MAAM,OAAO,OAAO;AACpB,MAAM,UAAU,OAAO,OAAO,QAAQ;AACtC,MAAM,YAAY,OAAO,OAAO,cAAc;AAC9C,MAAM,gBACJ,OAAO,YAAY,OAAO,SAAS,SAAS,IAAI,OAAO,WAAW,CAAC,aAAa;AAClF,MAAM,YAAY,OAAO;AACzB,MAAM,iBAAiB,OAAO;AAC9B,MAAM,cAAc,OAAO;AAE3B,IAAI,CAAC;CAAC;CAAU;CAAQ;CAAQ;CAAQ,CAAC,SAAS,YAAY,EAAE;AAC9D,SAAQ,MAAM,sBAAsB,YAAY,yCAAyC;AACzF,SAAQ,KAAK,EAAE;;AAEjB,MAAM,WAAW;AAEjB,IAAI,OAAO,MAAM,KAAK,IAAI,OAAO,KAAK,OAAO,OAAO;AAClD,SAAQ,MAAM,iBAAiB,OAAO,OAAO;AAC7C,SAAQ,KAAK,EAAE;;AAGjB,IAAI,OAAO,MAAM,QAAQ,IAAI,UAAU,GAAG;AACxC,SAAQ,MAAM,oBAAoB,OAAO,UAAU;AACnD,SAAQ,KAAK,EAAE;;AAGjB,IAAI,OAAO,MAAM,UAAU,IAAI,YAAY,GAAG;AAC5C,SAAQ,MAAM,uBAAuB,OAAO,gBAAgB;AAC5D,SAAQ,KAAK,EAAE;;AAGjB,MAAM,cAAc,OAAO,OAAO,gBAAgB;AAClD,IAAI,OAAO,MAAM,YAAY,IAAI,eAAe,GAAG;AACjD,SAAQ,MAAM,2CAA2C;AACzD,SAAQ,KAAK,EAAE;;AAGjB,MAAM,aAAa,OAAO,OAAO,eAAe;AAChD,IAAI,OAAO,MAAM,WAAW,IAAI,CAAC,OAAO,UAAU,WAAW,IAAI,aAAa,GAAG;AAC/E,SAAQ,MACN,wBAAwB,OAAO,eAAe,kDAC/C;AACD,SAAQ,KAAK,EAAE;;AAGjB,MAAM,sBAAsB,OAAO;AACnC,MAAM,mBAAmB,OAAO,oBAAoB;AACpD,IAAI,OAAO,MAAM,iBAAiB,IAAI,CAAC,OAAO,UAAU,iBAAiB,IAAI,mBAAmB,GAAG;AACjG,SAAQ,MACN,+BAA+B,oBAAoB,kDACpD;AACD,SAAQ,KAAK,EAAE;;AAGjB,MAAM,uBAAuB,OAAO;AACpC,IAAI;AACJ,IAAI,yBAAyB,QAAW;AACtC,qBAAoB,OAAO,qBAAqB;AAChD,KAAI,CAAC,OAAO,SAAS,kBAAkB,IAAI,qBAAqB,GAAG;AACjE,UAAQ,MACN,gCAAgC,qBAAqB,qCACtD;AACD,UAAQ,KAAK,EAAE;;;AAInB,MAAM,mBAAmB,OAAO;AAChC,IAAI;AACJ,IAAI,qBAAqB,QAAW;AAClC,iBAAgB,OAAO,iBAAiB;AACxC,KAAI,CAAC,OAAO,SAAS,cAAc,IAAI,iBAAiB,GAAG;AACzD,UAAQ,MACN,4BAA4B,iBAAiB,qCAC9C;AACD,UAAQ,KAAK,EAAE;;;AAInB,MAAM,yBAAyB,OAAO;AACtC,IAAI;AACJ,IAAI,2BAA2B,QAAW;AACxC,uBAAsB,OAAO,uBAAuB;AACpD,KAAI,CAAC,OAAO,SAAS,oBAAoB,IAAI,uBAAuB,GAAG;AACrE,UAAQ,MACN,mCAAmC,uBAAuB,qCAC3D;AACD,UAAQ,KAAK,EAAE;;;AAInB,MAAM,0BAA0B,OAAO;AACvC,IAAI;AACJ,IAAI,4BAA4B,QAAW;AACzC,wBAAuB,OAAO,wBAAwB;AACtD,KAAI,CAAC,OAAO,SAAS,qBAAqB,IAAI,wBAAwB,GAAG;AACvE,UAAQ,MACN,oCAAoC,wBAAwB,qCAC7D;AACD,UAAQ,KAAK,EAAE;;;AAInB,MAAM,SAAS,IAAIA,sBAAO,SAAS;AAGnC,IAAI;AACJ;CACE,MAAM,UAAU,OAAO;CACvB,MAAM,eAAe,OAAO;CAC5B,MAAM,gBAAgB,OAAO;AAE7B,KAAI,YAAY,UAAa,iBAAiB,UAAa,kBAAkB,QAAW;AACtF,UAAQ,EAAE;AACV,MAAI,YAAY,QAAW;GACzB,MAAM,MAAM,WAAW,QAAQ;AAC/B,OAAI,MAAM,IAAI,IAAI,MAAM,KAAK,MAAM,GAAG;AACpC,YAAQ,MAAM,uBAAuB,QAAQ,gBAAgB;AAC7D,YAAQ,KAAK,EAAE;;AAEjB,SAAM,WAAW;;AAEnB,MAAI,iBAAiB,QAAW;GAC9B,MAAM,MAAM,WAAW,aAAa;AACpC,OAAI,MAAM,IAAI,IAAI,MAAM,KAAK,MAAM,GAAG;AACpC,YAAQ,MAAM,4BAA4B,aAAa,gBAAgB;AACvE,YAAQ,KAAK,EAAE;;AAEjB,SAAM,gBAAgB;;AAExB,MAAI,kBAAkB,QAAW;GAC/B,MAAM,MAAM,WAAW,cAAc;AACrC,OAAI,MAAM,IAAI,IAAI,MAAM,KAAK,MAAM,GAAG;AACpC,YAAQ,MAAM,6BAA6B,cAAc,gBAAgB;AACzE,YAAQ,KAAK,EAAE;;AAEjB,SAAM,iBAAiB;;;;AAM7B,IAAI;AACJ,IAAI,OAAO,UAAU,OAAO,eAAe;CACzC,MAAM,YAAuC,EAAE;AAC/C,KAAI,OAAO,mBAAoB,WAAU,SAAS,OAAO;AACzD,KAAI,OAAO,sBAAuB,WAAU,YAAY,OAAO;AAC/D,KAAI,OAAO,mBAAoB,WAAU,SAAS,OAAO;AACzD,KAAI,OAAO,qBAAsB,WAAU,WAAW,OAAO;AAC7D,KAAI,OAAO,oBAAqB,WAAU,UAAU,OAAO;AAC3D,KAAI,OAAO,kBAAmB,WAAU,QAAQ,OAAO;AACvD,KAAI,OAAO,mBAAoB,WAAU,SAAS,OAAO;AACzD,KAAI,OAAO,mBAAoB,WAAU,SAAS,OAAO;AACzD,KAAI,OAAO,uBAAwB,WAAU,aAAa,OAAO;AAEjE,KAAI,OAAO,KAAK,UAAU,CAAC,WAAW,GAAG;AACvC,UAAQ,MACN,YAAY,OAAO,gBAAgB,eAAe,SAAS,0CAC5D;AACD,UAAQ,KAAK,EAAE;;CAOjB,MAAM,aAAa,cAAc;CACjC,MAAM,kBAAkB,gBAAgB,KAAK,WAAW;AACxD,KAAI,OAAO,UAAU,iBAAiB;AACpC,UAAQ,MACN,2FAA2F,aAC5F;AACD,UAAQ,KAAK,EAAE;;AAEjB,UAAS;EACP;EAIA,cAAcC,+CAAyB;EAIvC,aAAa,kBAAkB,gCAAoB,YAAY,WAAW;EAC1E,WAAW,OAAO;EAClB,wBAAwB,OAAO;EAC/B;EACA;EACA;EACA;EACD;OACI;CAIL,MAAM,uBACJ;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CACD,QAAQ,SAAS,OAAO,UAAU,OAAU;AAC9C,KAAI,qBAAqB,SAAS,EAChC,QAAO,KACL,KAAK,qBAAqB,KAAK,MAAM,CAAC,8FACvC;AAEH,KACE,sBAAsB,UACtB,kBAAkB,UAClB,wBAAwB,UACxB,yBAAyB,OAEzB,QAAO,KACL,yLACD;;AAKL,IAAI;AACJ,IAAI,OAAO,kBAAkB,OAAO,oBAAoB;AACtD,KAAI,CAAC,OAAO,kBAAkB;AAC5B,UAAQ,MAAM,kEAAkE;AAChF,UAAQ,KAAK,EAAE;;CAIjB,MAAM,WAAW,cAAc;CAC/B,MAAM,gBAAgB,gBAAgB,KAAK,SAAS;AACpD,KAAI,OAAO,kBAAkB,eAAe;AAC1C,UAAQ,MACN,gGAAgG,WACjG;AACD,UAAQ,KAAK,EAAE;;CAEjB,MAAM,OAAO,IAAIC,4BAAU;AAC3B,MAAK,gBAAgB;EACnB,UAAU,OAAO;EAIjB,aAAa,gBAAgB,gCAAoB,UAAU,gBAAgB;EAC3E,WAAW,OAAO;EACnB,CAAC;AACF,aAAY;EAAE,MAAM;EAAS,SAAS;EAAM;;AAS9C,eAAe,2BAA6D;CAC1E,MAAM,WAAoC,EAAE;AAC5C,MAAK,MAAM,SAAS,eAAe;EACjC,IAAI;AACJ,MAAI;AACF,WAAQ,MAAMC,6CAAqB,OAAO;IACxC;IACA;IACD,CAAC;WACK,KAAK;GACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,WAAQ,MAAM,uCAAuC,MAAM,KAAK,MAAM;AACtE,WAAQ,KAAK,EAAE;;AAEjB,MAAI,CAAC,MAAM,KAET;AAEF,MAAI;GACF,MAAM,6BAAgB,MAAM,KAAK;AACjC,YAAS,KAAK;IAAE,QAAQ,MAAM;IAAQ,MAAM,MAAM;IAAM,OAAO,KAAK,aAAa;IAAE,CAAC;WAC7E,KAAK;AACZ,OAAK,IAA8B,SAAS,SAC1C,SAAQ,MAAM,4BAA4B,MAAM,OAAO;QAClD;IACL,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,YAAQ,MAAM,gCAAgC,MAAM,KAAK,IAAI,MAAM;;AAErE,WAAQ,KAAK,EAAE;;;AAGnB,QAAO;;AAGT,SAAS,WAAW,QAA0C;AAC5D,QAAO,OAAO,QACVC,2CAAoB,OAAO,MAAM,OAAO,GACxCC,uCAAgB,OAAO,MAAM,OAAO;;AAG1C,eAAe,OAAO;CACpB,MAAM,UAAU,MAAM,0BAA0B;CAEhD,MAAM,WAAsB,EAAE;AAC9B,MAAK,MAAM,OAAO,QAChB,UAAS,KAAK,GAAG,WAAW,IAAI,CAAC;AAGnC,KAAI,SAAS,WAAW,GAAG;AACzB,MAAI,kBAAkB,OAAO,QAAQ;AACnC,WAAQ,MAAM,8EAA8E;AAC5F,WAAQ,KAAK,EAAE;;AAEjB,UAAQ,KAAK,4EAA4E;;CAG3F,MAAM,cAAc,QAAQ,KAAK,MAAM,EAAE,OAAO,CAAC,KAAK,KAAK,IAAI;AAC/D,QAAO,KAAK,UAAU,SAAS,OAAO,mBAAmB,cAAc;AAGvE,KAAI,gBAAgB;EAClB,MAAM,UAAUC,wCAAiB,SAAS;EAC1C,MAAM,SAAS,QAAQ,QAAQ,MAAM,EAAE,aAAa,QAAQ;EAC5D,MAAM,WAAW,QAAQ,QAAQ,MAAM,EAAE,aAAa,UAAU;AAEhE,OAAK,MAAM,KAAK,SACd,QAAO,KAAK,WAAW,EAAE,aAAa,IAAI,EAAE,UAAU;AAExD,OAAK,MAAM,KAAK,OACd,QAAO,MAAM,WAAW,EAAE,aAAa,IAAI,EAAE,UAAU;AAGzD,MAAI,OAAO,SAAS,GAAG;AACrB,WAAQ,MAAM,sBAAsB,OAAO,OAAO,aAAa,SAAS,OAAO,aAAa;AAC5F,WAAQ,KAAK,EAAE;;;CAInB,MAAM,SAAS,YAAY,CAAC,UAAU,GAAG;CAEzC,MAAM,WAAW,MAAMC,4BACrB,UACA;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA,SAAS,OAAO;EAChB;EACA,QAAQ,OAAO;EACf,mBAAmB;EACnB,yBAAyB;EAC1B,EACD,OACD;AAED,QAAO,KAAK,8BAA8B,SAAS,MAAM;CAIzD,IAAI,UAAwC;AAC5C,KAAI,WAAW;EACb,MAAM,UAAU,QAAQ;AACxB,MAAI,CAAC,QACH,QAAO,KAAK,wEAAwE;OAC/E;GACL,MAAM,eAA0B,WAAW,QAAQ;AACnD,aAAUC,8BAAc,QAAQ,MAAM,UAAU,QAAQ;IACtD;IACA,UAAU;IACV,YAAYF;IACb,CAAC;AACF,UAAO,KAAK,YAAY,QAAQ,KAAK,cAAc;;;CAIvD,SAAS,WAAW;AAClB,SAAO,KAAK,mBAAmB;AAC/B,MAAI,QAAS,SAAQ,OAAO;AAC5B,WAAS,OAAO,YAAY;AAC1B,WAAQ,KAAK,EAAE;IACf;;AAGJ,SAAQ,GAAG,UAAU,SAAS;AAC9B,SAAQ,GAAG,WAAW,SAAS;;AAGjC,MAAM,CAAC,OAAO,QAAQ;AACpB,SAAQ,MAAM,IAAI;AAClB,SAAQ,KAAK,EAAE;EACf"}
+{"version":3,"file":"cli.cjs","names":["Logger","readProviderKeysFromEnv","AGUIMock","resolveFixturesValue","loadFixturesFromDir","loadFixtureFile","validateFixtures","createServer","resolveInboundAuth","selectInboundAuthSource","watchFixtures"],"sources":["../src/cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { parseArgs } from \"node:util\";\nimport { statSync } from \"node:fs\";\nimport { resolve } from \"node:path\";\nimport { createServer } from \"./server.js\";\nimport { loadFixtureFile, loadFixturesFromDir, validateFixtures } from \"./fixture-loader.js\";\nimport { Logger, type LogLevel } from \"./logger.js\";\nimport { watchFixtures } from \"./watcher.js\";\nimport { AGUIMock } from \"./agui-mock.js\";\nimport { resolveFixturesValue } from \"./fixtures-remote.js\";\nimport { readProviderKeysFromEnv } from \"./provider-auth.js\";\nimport { resolveInboundAuth, selectInboundAuthSource } from \"./api-key-auth.js\";\nimport type { Fixture, ChaosConfig, RecordConfig } from \"./types.js\";\n\nconst HELP = `\nUsage: aimock [options]\n\nOptions:\n  -p, --port <number>       Port to listen on (default: 4010)\n  -h, --host <string>       Host to bind to (default: 127.0.0.1)\n  -f, --fixtures <value>    Fixture source (repeatable). Accepts:\n                              - filesystem path to a directory or .json file (default: ./fixtures)\n                              - https:// or http:// URL to a .json fixture file\n  -l, --latency <ms>        Latency in ms between SSE chunks (default: 0)\n  -c, --chunk-size <chars>  Chunk size in characters (default: 20)\n  -w, --watch               Watch fixture path for changes and reload\n      --log-level <level>   Log verbosity: silent, warn, info, debug (default: info)\n      --validate-on-load    Validate fixture schemas at startup\n      --metrics             Enable Prometheus metrics at GET /metrics\n      --record              Record mode: proxy unmatched requests and save fixtures\n      --record-full-model-version  Record exact model version without date stripping (default: false)\n      --proxy-only          Proxy mode: forward unmatched requests without saving\n      --strict              Strict mode: fail on unmatched requests (overridable per-request via X-AIMock-Strict header)\n      --journal-max <n>     Max request entries retained in memory (default: 1000, 0 = unbounded)\n      --fixture-counts-max <n>  Max unique testIds retained in fixture match-count map (default: 500, 0 = unbounded)\n      --provider-openai <url>     Upstream URL for OpenAI (used with --record)\n      --provider-anthropic <url>  Upstream URL for Anthropic\n      --provider-gemini <url>     Upstream URL for Gemini\n      --provider-vertexai <url>   Upstream URL for Vertex AI\n      --provider-bedrock <url>    Upstream URL for Bedrock\n      --provider-azure <url>      Upstream URL for Azure OpenAI\n      --provider-ollama <url>     Upstream URL for Ollama\n      --provider-cohere <url>     Upstream URL for Cohere\n      --provider-openrouter <url> Upstream URL for OpenRouter (video record proxy)\n      --upstream-timeout-ms <ms>  Idle timeout (ms) on upstream socket before response (default: 30000)\n      --body-timeout-ms <ms>      Idle timeout (ms) on upstream response body between chunks (default: 30000)\n      --max-proxy-buffer-bytes <n> Cap (bytes) on in-memory proxy-path buffer; full body still relayed (default: 67108864)\n      --max-proxy-buffer-frames <n> Cap (frames) on in-memory proxy-path per-frame state; full body still relayed (default: 5000000)\n      --agui-record              Enable AG-UI recording (proxy unmatched AG-UI requests)\n      --agui-upstream <url>      Upstream AG-UI agent URL (used with --agui-record)\n      --agui-proxy-only          AG-UI proxy mode: forward without saving\n      --replay-speed <n>    Replay speed multiplier (default: 1.0, 2.0 = 2x faster)\n      --chaos-drop <rate>   Probability (0-1) of dropping requests with 500\n      --chaos-malformed <rate>  Probability (0-1) of returning malformed JSON\n      --chaos-disconnect <rate> Probability (0-1) of destroying connection\n      AIMOCK_API_KEYS  Comma-separated inbound test API keys (environment only)\n      --help                Show this help message\n`.trim();\n\nconst { values } = parseArgs({\n  options: {\n    port: { type: \"string\", short: \"p\", default: \"4010\" },\n    host: { type: \"string\", short: \"h\", default: \"127.0.0.1\" },\n    fixtures: { type: \"string\", short: \"f\", multiple: true },\n    latency: { type: \"string\", short: \"l\", default: \"0\" },\n    \"chunk-size\": { type: \"string\", short: \"c\", default: \"20\" },\n    watch: { type: \"boolean\", short: \"w\", default: false },\n    \"log-level\": { type: \"string\", default: \"info\" },\n    \"validate-on-load\": { type: \"boolean\", default: false },\n    metrics: { type: \"boolean\", default: false },\n    record: { type: \"boolean\", default: false },\n    \"record-full-model-version\": { type: \"boolean\", default: false },\n    \"proxy-only\": { type: \"boolean\", default: false },\n    strict: { type: \"boolean\", default: false },\n    \"provider-openai\": { type: \"string\" },\n    \"provider-anthropic\": { type: \"string\" },\n    \"provider-gemini\": { type: \"string\" },\n    \"provider-vertexai\": { type: \"string\" },\n    \"provider-bedrock\": { type: \"string\" },\n    \"provider-azure\": { type: \"string\" },\n    \"provider-ollama\": { type: \"string\" },\n    \"provider-cohere\": { type: \"string\" },\n    \"provider-openrouter\": { type: \"string\" },\n    \"upstream-timeout-ms\": { type: \"string\" },\n    \"body-timeout-ms\": { type: \"string\" },\n    \"max-proxy-buffer-bytes\": { type: \"string\" },\n    \"max-proxy-buffer-frames\": { type: \"string\" },\n    \"agui-record\": { type: \"boolean\", default: false },\n    \"agui-upstream\": { type: \"string\" },\n    \"agui-proxy-only\": { type: \"boolean\", default: false },\n    \"replay-speed\": { type: \"string\", default: \"1.0\" },\n    \"chaos-drop\": { type: \"string\" },\n    \"chaos-malformed\": { type: \"string\" },\n    \"chaos-disconnect\": { type: \"string\" },\n    \"journal-max\": { type: \"string\", default: \"1000\" },\n    \"fixture-counts-max\": { type: \"string\", default: \"500\" },\n    help: { type: \"boolean\", default: false },\n  },\n  strict: true,\n});\n\nif (values.help) {\n  console.log(HELP);\n  process.exit(0);\n}\n\nconst port = Number(values.port);\nconst host = values.host!;\nconst latency = Number(values.latency);\nconst chunkSize = Number(values[\"chunk-size\"]);\nconst fixtureValues: string[] =\n  values.fixtures && values.fixtures.length > 0 ? values.fixtures : [\"./fixtures\"];\nconst watchMode = values.watch!;\nconst validateOnLoad = values[\"validate-on-load\"]!;\nconst logLevelStr = values[\"log-level\"]!;\n\nif (![\"silent\", \"warn\", \"info\", \"debug\"].includes(logLevelStr)) {\n  console.error(`Invalid log-level: ${logLevelStr} (must be silent, warn, info, or debug)`);\n  process.exit(1);\n}\nconst logLevel = logLevelStr as LogLevel;\n\nif (Number.isNaN(port) || port < 0 || port > 65535) {\n  console.error(`Invalid port: ${values.port}`);\n  process.exit(1);\n}\n\nif (Number.isNaN(latency) || latency < 0) {\n  console.error(`Invalid latency: ${values.latency}`);\n  process.exit(1);\n}\n\nif (Number.isNaN(chunkSize) || chunkSize < 1) {\n  console.error(`Invalid chunk-size: ${values[\"chunk-size\"]}`);\n  process.exit(1);\n}\n\nconst replaySpeed = Number(values[\"replay-speed\"]);\nif (Number.isNaN(replaySpeed) || replaySpeed <= 0) {\n  console.error(\"--replay-speed must be a positive number\");\n  process.exit(1);\n}\n\nconst journalMax = Number(values[\"journal-max\"]);\nif (Number.isNaN(journalMax) || !Number.isInteger(journalMax) || journalMax < 0) {\n  console.error(\n    `Invalid journal-max: ${values[\"journal-max\"]} (must be a non-negative integer; 0 = unbounded)`,\n  );\n  process.exit(1);\n}\n\nconst fixtureCountsMaxStr = values[\"fixture-counts-max\"];\nconst fixtureCountsMax = Number(fixtureCountsMaxStr);\nif (Number.isNaN(fixtureCountsMax) || !Number.isInteger(fixtureCountsMax) || fixtureCountsMax < 0) {\n  console.error(\n    `Invalid fixture-counts-max: ${fixtureCountsMaxStr} (must be a non-negative integer; 0 = unbounded)`,\n  );\n  process.exit(1);\n}\n\nconst upstreamTimeoutMsStr = values[\"upstream-timeout-ms\"];\nlet upstreamTimeoutMs: number | undefined;\nif (upstreamTimeoutMsStr !== undefined) {\n  upstreamTimeoutMs = Number(upstreamTimeoutMsStr);\n  if (!Number.isFinite(upstreamTimeoutMs) || upstreamTimeoutMs <= 0) {\n    console.error(\n      `Invalid upstream-timeout-ms: ${upstreamTimeoutMsStr} (must be a positive finite number)`,\n    );\n    process.exit(1);\n  }\n}\n\nconst bodyTimeoutMsStr = values[\"body-timeout-ms\"];\nlet bodyTimeoutMs: number | undefined;\nif (bodyTimeoutMsStr !== undefined) {\n  bodyTimeoutMs = Number(bodyTimeoutMsStr);\n  if (!Number.isFinite(bodyTimeoutMs) || bodyTimeoutMs <= 0) {\n    console.error(\n      `Invalid body-timeout-ms: ${bodyTimeoutMsStr} (must be a positive finite number)`,\n    );\n    process.exit(1);\n  }\n}\n\nconst maxProxyBufferBytesStr = values[\"max-proxy-buffer-bytes\"];\nlet maxProxyBufferBytes: number | undefined;\nif (maxProxyBufferBytesStr !== undefined) {\n  maxProxyBufferBytes = Number(maxProxyBufferBytesStr);\n  if (!Number.isFinite(maxProxyBufferBytes) || maxProxyBufferBytes <= 0) {\n    console.error(\n      `Invalid max-proxy-buffer-bytes: ${maxProxyBufferBytesStr} (must be a positive finite number)`,\n    );\n    process.exit(1);\n  }\n}\n\nconst maxProxyBufferFramesStr = values[\"max-proxy-buffer-frames\"];\nlet maxProxyBufferFrames: number | undefined;\nif (maxProxyBufferFramesStr !== undefined) {\n  maxProxyBufferFrames = Number(maxProxyBufferFramesStr);\n  if (!Number.isFinite(maxProxyBufferFrames) || maxProxyBufferFrames <= 0) {\n    console.error(\n      `Invalid max-proxy-buffer-frames: ${maxProxyBufferFramesStr} (must be a positive finite number)`,\n    );\n    process.exit(1);\n  }\n}\n\nconst logger = new Logger(logLevel);\n\n// Parse chaos config from CLI flags\nlet chaos: ChaosConfig | undefined;\n{\n  const dropStr = values[\"chaos-drop\"];\n  const malformedStr = values[\"chaos-malformed\"];\n  const disconnectStr = values[\"chaos-disconnect\"];\n\n  if (dropStr !== undefined || malformedStr !== undefined || disconnectStr !== undefined) {\n    chaos = {};\n    if (dropStr !== undefined) {\n      const val = parseFloat(dropStr);\n      if (isNaN(val) || val < 0 || val > 1) {\n        console.error(`Invalid chaos-drop: ${dropStr} (must be 0-1)`);\n        process.exit(1);\n      }\n      chaos.dropRate = val;\n    }\n    if (malformedStr !== undefined) {\n      const val = parseFloat(malformedStr);\n      if (isNaN(val) || val < 0 || val > 1) {\n        console.error(`Invalid chaos-malformed: ${malformedStr} (must be 0-1)`);\n        process.exit(1);\n      }\n      chaos.malformedRate = val;\n    }\n    if (disconnectStr !== undefined) {\n      const val = parseFloat(disconnectStr);\n      if (isNaN(val) || val < 0 || val > 1) {\n        console.error(`Invalid chaos-disconnect: ${disconnectStr} (must be 0-1)`);\n        process.exit(1);\n      }\n      chaos.disconnectRate = val;\n    }\n  }\n}\n\n// Parse record/proxy config from CLI flags\nlet record: RecordConfig | undefined;\nif (values.record || values[\"proxy-only\"]) {\n  const providers: RecordConfig[\"providers\"] = {};\n  if (values[\"provider-openai\"]) providers.openai = values[\"provider-openai\"];\n  if (values[\"provider-anthropic\"]) providers.anthropic = values[\"provider-anthropic\"];\n  if (values[\"provider-gemini\"]) providers.gemini = values[\"provider-gemini\"];\n  if (values[\"provider-vertexai\"]) providers.vertexai = values[\"provider-vertexai\"];\n  if (values[\"provider-bedrock\"]) providers.bedrock = values[\"provider-bedrock\"];\n  if (values[\"provider-azure\"]) providers.azure = values[\"provider-azure\"];\n  if (values[\"provider-ollama\"]) providers.ollama = values[\"provider-ollama\"];\n  if (values[\"provider-cohere\"]) providers.cohere = values[\"provider-cohere\"];\n  if (values[\"provider-openrouter\"]) providers.openrouter = values[\"provider-openrouter\"];\n\n  if (Object.keys(providers).length === 0) {\n    console.error(\n      `Error: --${values[\"proxy-only\"] ? \"proxy-only\" : \"record\"} requires at least one --provider-* flag`,\n    );\n    process.exit(1);\n  }\n\n  // For --record, the first --fixtures value is the base path for the recording\n  // destination and must be a local filesystem path — writing to a URL is not supported.\n  // For --proxy-only, unmatched requests are forwarded without saving, so no writable\n  // destination is required; URL-only --fixtures is valid in that mode.\n  const recordBase = fixtureValues[0];\n  const recordBaseIsUrl = /^https?:\\/\\//i.test(recordBase);\n  if (values.record && recordBaseIsUrl) {\n    console.error(\n      `Error: --record requires a local --fixtures path for the recording destination; got URL ${recordBase}`,\n    );\n    process.exit(1);\n  }\n  record = {\n    providers,\n    // aimock's own upstream keys, sourced from AIMOCK_PROVIDER_*_KEY env vars\n    // (not CLI flags — secrets must not appear in `ps`). Injected on a\n    // fixture-miss passthrough when the caller sent no/dummy credential.\n    providerKeys: readProviderKeysFromEnv(),\n    // In proxy-only mode with only URL sources, fixturePath is never consumed\n    // (recorder.ts skips disk writes when proxyOnly is set). Leave it undefined\n    // rather than resolving a URL string as a filesystem path.\n    fixturePath: recordBaseIsUrl ? undefined : resolve(recordBase, \"recorded\"),\n    proxyOnly: values[\"proxy-only\"],\n    recordFullModelVersion: values[\"record-full-model-version\"],\n    upstreamTimeoutMs,\n    bodyTimeoutMs,\n    maxProxyBufferBytes,\n    maxProxyBufferFrames,\n  };\n} else {\n  // These flags configure upstream proxying — without --record or\n  // --proxy-only they would be parsed and then silently dropped. Routed\n  // through the constructed logger so --log-level is respected.\n  const droppedProviderFlags = (\n    [\n      \"provider-openai\",\n      \"provider-anthropic\",\n      \"provider-gemini\",\n      \"provider-vertexai\",\n      \"provider-bedrock\",\n      \"provider-azure\",\n      \"provider-ollama\",\n      \"provider-cohere\",\n      \"provider-openrouter\",\n    ] as const\n  ).filter((flag) => values[flag] !== undefined);\n  if (droppedProviderFlags.length > 0) {\n    logger.warn(\n      `--${droppedProviderFlags.join(\"/--\")} only apply to --record/--proxy-only upstream proxying — ignored without one of those flags.`,\n    );\n  }\n  if (\n    upstreamTimeoutMs !== undefined ||\n    bodyTimeoutMs !== undefined ||\n    maxProxyBufferBytes !== undefined ||\n    maxProxyBufferFrames !== undefined\n  ) {\n    logger.warn(\n      \"--upstream-timeout-ms/--body-timeout-ms/--max-proxy-buffer-bytes/--max-proxy-buffer-frames only apply to --record/--proxy-only upstream proxying — ignored without one of those flags.\",\n    );\n  }\n}\n\n// Parse AG-UI record/proxy config from CLI flags\nlet aguiMount: { path: string; handler: AGUIMock } | undefined;\nif (values[\"agui-record\"] || values[\"agui-proxy-only\"]) {\n  if (!values[\"agui-upstream\"]) {\n    console.error(\"Error: --agui-record/--agui-proxy-only requires --agui-upstream\");\n    process.exit(1);\n  }\n  // --agui-record writes recorded AG-UI fixtures to disk, so a URL source is unsupported.\n  // --agui-proxy-only forwards without saving, so URL-only --fixtures is valid.\n  const aguiBase = fixtureValues[0];\n  const aguiBaseIsUrl = /^https?:\\/\\//i.test(aguiBase);\n  if (values[\"agui-record\"] && aguiBaseIsUrl) {\n    console.error(\n      `Error: --agui-record requires a local --fixtures path for the recording destination; got URL ${aguiBase}`,\n    );\n    process.exit(1);\n  }\n  const agui = new AGUIMock();\n  agui.enableRecording({\n    upstream: values[\"agui-upstream\"],\n    // In proxy-only mode with a URL-only --fixtures, the AG-UI recorder never\n    // writes to disk (see agui-recorder.ts). Leave fixturePath undefined rather\n    // than resolving a URL as a filesystem path.\n    fixturePath: aguiBaseIsUrl ? undefined : resolve(aguiBase, \"agui-recorded\"),\n    proxyOnly: values[\"agui-proxy-only\"],\n  });\n  aguiMount = { path: \"/agui\", handler: agui };\n}\n\ninterface ResolvedFixtureSource {\n  source: string;\n  path: string;\n  isDir: boolean;\n}\n\nasync function resolveAllFixtureSources(): Promise<ResolvedFixtureSource[]> {\n  const resolved: ResolvedFixtureSource[] = [];\n  for (const value of fixtureValues) {\n    let local;\n    try {\n      local = await resolveFixturesValue(value, {\n        validateOnLoad,\n        logger,\n      });\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.error(`Failed to resolve --fixtures value \"${value}\": ${msg}`);\n      process.exit(1);\n    }\n    if (!local.path) {\n      // Remote fetch failed without validate-on-load and no cache — already warned; skip.\n      continue;\n    }\n    try {\n      const stat = statSync(local.path);\n      resolved.push({ source: local.source, path: local.path, isDir: stat.isDirectory() });\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === \"ENOENT\") {\n        console.error(`Fixtures path not found: ${local.path}`);\n      } else {\n        const msg = err instanceof Error ? err.message : String(err);\n        console.error(`Failed to load fixtures from ${local.path}: ${msg}`);\n      }\n      process.exit(1);\n    }\n  }\n  return resolved;\n}\n\nfunction loadSource(source: ResolvedFixtureSource): Fixture[] {\n  return source.isDir\n    ? loadFixturesFromDir(source.path, logger)\n    : loadFixtureFile(source.path, logger);\n}\n\nasync function main() {\n  const sources = await resolveAllFixtureSources();\n\n  const fixtures: Fixture[] = [];\n  for (const src of sources) {\n    fixtures.push(...loadSource(src));\n  }\n\n  if (fixtures.length === 0) {\n    if (validateOnLoad || values.strict) {\n      console.error(\"Error: No fixtures loaded and validation/strict mode is enabled — aborting.\");\n      process.exit(1);\n    }\n    console.warn(\"Warning: No fixtures loaded. The server will return 404 for all requests.\");\n  }\n\n  const sourceLabel = sources.map((s) => s.source).join(\", \") || \"<none>\";\n  logger.info(`Loaded ${fixtures.length} fixture(s) from ${sourceLabel}`);\n\n  // Validate fixtures if requested\n  if (validateOnLoad) {\n    const results = validateFixtures(fixtures);\n    const errors = results.filter((r) => r.severity === \"error\");\n    const warnings = results.filter((r) => r.severity === \"warning\");\n\n    for (const w of warnings) {\n      logger.warn(`Fixture ${w.fixtureIndex}: ${w.message}`);\n    }\n    for (const e of errors) {\n      logger.error(`Fixture ${e.fixtureIndex}: ${e.message}`);\n    }\n\n    if (errors.length > 0) {\n      console.error(`Validation failed: ${errors.length} error(s), ${warnings.length} warning(s)`);\n      process.exit(1);\n    }\n  }\n\n  const mounts = aguiMount ? [aguiMount] : undefined;\n\n  const instance = await createServer(\n    fixtures,\n    {\n      port,\n      host,\n      latency,\n      chunkSize,\n      replaySpeed,\n      logLevel,\n      chaos,\n      metrics: values.metrics,\n      record,\n      strict: values.strict,\n      journalMaxEntries: journalMax,\n      fixtureCountsMaxTestIds: fixtureCountsMax,\n      auth: resolveInboundAuth(selectInboundAuthSource(undefined)).publicConfig,\n    },\n    mounts,\n  );\n\n  logger.info(`aimock server listening on ${instance.url}`);\n\n  // Start file watcher if requested. Only the first local source is watched —\n  // remote URL sources are fetched once at boot and are not monitored.\n  let watcher: { close: () => void } | null = null;\n  if (watchMode) {\n    const primary = sources[0];\n    if (!primary) {\n      logger.warn(\"--watch requested but no resolvable fixture sources; skipping watcher\");\n    } else {\n      const loadFn = (): Fixture[] => loadSource(primary);\n      watcher = watchFixtures(primary.path, fixtures, loadFn, {\n        logger,\n        validate: validateOnLoad,\n        validateFn: validateFixtures,\n      });\n      logger.info(`Watching ${primary.path} for changes`);\n    }\n  }\n\n  function shutdown() {\n    logger.info(\"Shutting down...\");\n    if (watcher) watcher.close();\n    instance.server.close(() => {\n      process.exit(0);\n    });\n  }\n\n  process.on(\"SIGINT\", shutdown);\n  process.on(\"SIGTERM\", shutdown);\n}\n\nmain().catch((err) => {\n  console.error(err);\n  process.exit(1);\n});\n"],"mappings":";;;;;;;;;;;;;;;AAcA,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2CX,MAAM;AAER,MAAM,EAAE,oCAAqB;CAC3B,SAAS;EACP,MAAM;GAAE,MAAM;GAAU,OAAO;GAAK,SAAS;GAAQ;EACrD,MAAM;GAAE,MAAM;GAAU,OAAO;GAAK,SAAS;GAAa;EAC1D,UAAU;GAAE,MAAM;GAAU,OAAO;GAAK,UAAU;GAAM;EACxD,SAAS;GAAE,MAAM;GAAU,OAAO;GAAK,SAAS;GAAK;EACrD,cAAc;GAAE,MAAM;GAAU,OAAO;GAAK,SAAS;GAAM;EAC3D,OAAO;GAAE,MAAM;GAAW,OAAO;GAAK,SAAS;GAAO;EACtD,aAAa;GAAE,MAAM;GAAU,SAAS;GAAQ;EAChD,oBAAoB;GAAE,MAAM;GAAW,SAAS;GAAO;EACvD,SAAS;GAAE,MAAM;GAAW,SAAS;GAAO;EAC5C,QAAQ;GAAE,MAAM;GAAW,SAAS;GAAO;EAC3C,6BAA6B;GAAE,MAAM;GAAW,SAAS;GAAO;EAChE,cAAc;GAAE,MAAM;GAAW,SAAS;GAAO;EACjD,QAAQ;GAAE,MAAM;GAAW,SAAS;GAAO;EAC3C,mBAAmB,EAAE,MAAM,UAAU;EACrC,sBAAsB,EAAE,MAAM,UAAU;EACxC,mBAAmB,EAAE,MAAM,UAAU;EACrC,qBAAqB,EAAE,MAAM,UAAU;EACvC,oBAAoB,EAAE,MAAM,UAAU;EACtC,kBAAkB,EAAE,MAAM,UAAU;EACpC,mBAAmB,EAAE,MAAM,UAAU;EACrC,mBAAmB,EAAE,MAAM,UAAU;EACrC,uBAAuB,EAAE,MAAM,UAAU;EACzC,uBAAuB,EAAE,MAAM,UAAU;EACzC,mBAAmB,EAAE,MAAM,UAAU;EACrC,0BAA0B,EAAE,MAAM,UAAU;EAC5C,2BAA2B,EAAE,MAAM,UAAU;EAC7C,eAAe;GAAE,MAAM;GAAW,SAAS;GAAO;EAClD,iBAAiB,EAAE,MAAM,UAAU;EACnC,mBAAmB;GAAE,MAAM;GAAW,SAAS;GAAO;EACtD,gBAAgB;GAAE,MAAM;GAAU,SAAS;GAAO;EAClD,cAAc,EAAE,MAAM,UAAU;EAChC,mBAAmB,EAAE,MAAM,UAAU;EACrC,oBAAoB,EAAE,MAAM,UAAU;EACtC,eAAe;GAAE,MAAM;GAAU,SAAS;GAAQ;EAClD,sBAAsB;GAAE,MAAM;GAAU,SAAS;GAAO;EACxD,MAAM;GAAE,MAAM;GAAW,SAAS;GAAO;EAC1C;CACD,QAAQ;CACT,CAAC;AAEF,IAAI,OAAO,MAAM;AACf,SAAQ,IAAI,KAAK;AACjB,SAAQ,KAAK,EAAE;;AAGjB,MAAM,OAAO,OAAO,OAAO,KAAK;AAChC,MAAM,OAAO,OAAO;AACpB,MAAM,UAAU,OAAO,OAAO,QAAQ;AACtC,MAAM,YAAY,OAAO,OAAO,cAAc;AAC9C,MAAM,gBACJ,OAAO,YAAY,OAAO,SAAS,SAAS,IAAI,OAAO,WAAW,CAAC,aAAa;AAClF,MAAM,YAAY,OAAO;AACzB,MAAM,iBAAiB,OAAO;AAC9B,MAAM,cAAc,OAAO;AAE3B,IAAI,CAAC;CAAC;CAAU;CAAQ;CAAQ;CAAQ,CAAC,SAAS,YAAY,EAAE;AAC9D,SAAQ,MAAM,sBAAsB,YAAY,yCAAyC;AACzF,SAAQ,KAAK,EAAE;;AAEjB,MAAM,WAAW;AAEjB,IAAI,OAAO,MAAM,KAAK,IAAI,OAAO,KAAK,OAAO,OAAO;AAClD,SAAQ,MAAM,iBAAiB,OAAO,OAAO;AAC7C,SAAQ,KAAK,EAAE;;AAGjB,IAAI,OAAO,MAAM,QAAQ,IAAI,UAAU,GAAG;AACxC,SAAQ,MAAM,oBAAoB,OAAO,UAAU;AACnD,SAAQ,KAAK,EAAE;;AAGjB,IAAI,OAAO,MAAM,UAAU,IAAI,YAAY,GAAG;AAC5C,SAAQ,MAAM,uBAAuB,OAAO,gBAAgB;AAC5D,SAAQ,KAAK,EAAE;;AAGjB,MAAM,cAAc,OAAO,OAAO,gBAAgB;AAClD,IAAI,OAAO,MAAM,YAAY,IAAI,eAAe,GAAG;AACjD,SAAQ,MAAM,2CAA2C;AACzD,SAAQ,KAAK,EAAE;;AAGjB,MAAM,aAAa,OAAO,OAAO,eAAe;AAChD,IAAI,OAAO,MAAM,WAAW,IAAI,CAAC,OAAO,UAAU,WAAW,IAAI,aAAa,GAAG;AAC/E,SAAQ,MACN,wBAAwB,OAAO,eAAe,kDAC/C;AACD,SAAQ,KAAK,EAAE;;AAGjB,MAAM,sBAAsB,OAAO;AACnC,MAAM,mBAAmB,OAAO,oBAAoB;AACpD,IAAI,OAAO,MAAM,iBAAiB,IAAI,CAAC,OAAO,UAAU,iBAAiB,IAAI,mBAAmB,GAAG;AACjG,SAAQ,MACN,+BAA+B,oBAAoB,kDACpD;AACD,SAAQ,KAAK,EAAE;;AAGjB,MAAM,uBAAuB,OAAO;AACpC,IAAI;AACJ,IAAI,yBAAyB,QAAW;AACtC,qBAAoB,OAAO,qBAAqB;AAChD,KAAI,CAAC,OAAO,SAAS,kBAAkB,IAAI,qBAAqB,GAAG;AACjE,UAAQ,MACN,gCAAgC,qBAAqB,qCACtD;AACD,UAAQ,KAAK,EAAE;;;AAInB,MAAM,mBAAmB,OAAO;AAChC,IAAI;AACJ,IAAI,qBAAqB,QAAW;AAClC,iBAAgB,OAAO,iBAAiB;AACxC,KAAI,CAAC,OAAO,SAAS,cAAc,IAAI,iBAAiB,GAAG;AACzD,UAAQ,MACN,4BAA4B,iBAAiB,qCAC9C;AACD,UAAQ,KAAK,EAAE;;;AAInB,MAAM,yBAAyB,OAAO;AACtC,IAAI;AACJ,IAAI,2BAA2B,QAAW;AACxC,uBAAsB,OAAO,uBAAuB;AACpD,KAAI,CAAC,OAAO,SAAS,oBAAoB,IAAI,uBAAuB,GAAG;AACrE,UAAQ,MACN,mCAAmC,uBAAuB,qCAC3D;AACD,UAAQ,KAAK,EAAE;;;AAInB,MAAM,0BAA0B,OAAO;AACvC,IAAI;AACJ,IAAI,4BAA4B,QAAW;AACzC,wBAAuB,OAAO,wBAAwB;AACtD,KAAI,CAAC,OAAO,SAAS,qBAAqB,IAAI,wBAAwB,GAAG;AACvE,UAAQ,MACN,oCAAoC,wBAAwB,qCAC7D;AACD,UAAQ,KAAK,EAAE;;;AAInB,MAAM,SAAS,IAAIA,sBAAO,SAAS;AAGnC,IAAI;AACJ;CACE,MAAM,UAAU,OAAO;CACvB,MAAM,eAAe,OAAO;CAC5B,MAAM,gBAAgB,OAAO;AAE7B,KAAI,YAAY,UAAa,iBAAiB,UAAa,kBAAkB,QAAW;AACtF,UAAQ,EAAE;AACV,MAAI,YAAY,QAAW;GACzB,MAAM,MAAM,WAAW,QAAQ;AAC/B,OAAI,MAAM,IAAI,IAAI,MAAM,KAAK,MAAM,GAAG;AACpC,YAAQ,MAAM,uBAAuB,QAAQ,gBAAgB;AAC7D,YAAQ,KAAK,EAAE;;AAEjB,SAAM,WAAW;;AAEnB,MAAI,iBAAiB,QAAW;GAC9B,MAAM,MAAM,WAAW,aAAa;AACpC,OAAI,MAAM,IAAI,IAAI,MAAM,KAAK,MAAM,GAAG;AACpC,YAAQ,MAAM,4BAA4B,aAAa,gBAAgB;AACvE,YAAQ,KAAK,EAAE;;AAEjB,SAAM,gBAAgB;;AAExB,MAAI,kBAAkB,QAAW;GAC/B,MAAM,MAAM,WAAW,cAAc;AACrC,OAAI,MAAM,IAAI,IAAI,MAAM,KAAK,MAAM,GAAG;AACpC,YAAQ,MAAM,6BAA6B,cAAc,gBAAgB;AACzE,YAAQ,KAAK,EAAE;;AAEjB,SAAM,iBAAiB;;;;AAM7B,IAAI;AACJ,IAAI,OAAO,UAAU,OAAO,eAAe;CACzC,MAAM,YAAuC,EAAE;AAC/C,KAAI,OAAO,mBAAoB,WAAU,SAAS,OAAO;AACzD,KAAI,OAAO,sBAAuB,WAAU,YAAY,OAAO;AAC/D,KAAI,OAAO,mBAAoB,WAAU,SAAS,OAAO;AACzD,KAAI,OAAO,qBAAsB,WAAU,WAAW,OAAO;AAC7D,KAAI,OAAO,oBAAqB,WAAU,UAAU,OAAO;AAC3D,KAAI,OAAO,kBAAmB,WAAU,QAAQ,OAAO;AACvD,KAAI,OAAO,mBAAoB,WAAU,SAAS,OAAO;AACzD,KAAI,OAAO,mBAAoB,WAAU,SAAS,OAAO;AACzD,KAAI,OAAO,uBAAwB,WAAU,aAAa,OAAO;AAEjE,KAAI,OAAO,KAAK,UAAU,CAAC,WAAW,GAAG;AACvC,UAAQ,MACN,YAAY,OAAO,gBAAgB,eAAe,SAAS,0CAC5D;AACD,UAAQ,KAAK,EAAE;;CAOjB,MAAM,aAAa,cAAc;CACjC,MAAM,kBAAkB,gBAAgB,KAAK,WAAW;AACxD,KAAI,OAAO,UAAU,iBAAiB;AACpC,UAAQ,MACN,2FAA2F,aAC5F;AACD,UAAQ,KAAK,EAAE;;AAEjB,UAAS;EACP;EAIA,cAAcC,+CAAyB;EAIvC,aAAa,kBAAkB,gCAAoB,YAAY,WAAW;EAC1E,WAAW,OAAO;EAClB,wBAAwB,OAAO;EAC/B;EACA;EACA;EACA;EACD;OACI;CAIL,MAAM,uBACJ;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CACD,QAAQ,SAAS,OAAO,UAAU,OAAU;AAC9C,KAAI,qBAAqB,SAAS,EAChC,QAAO,KACL,KAAK,qBAAqB,KAAK,MAAM,CAAC,8FACvC;AAEH,KACE,sBAAsB,UACtB,kBAAkB,UAClB,wBAAwB,UACxB,yBAAyB,OAEzB,QAAO,KACL,yLACD;;AAKL,IAAI;AACJ,IAAI,OAAO,kBAAkB,OAAO,oBAAoB;AACtD,KAAI,CAAC,OAAO,kBAAkB;AAC5B,UAAQ,MAAM,kEAAkE;AAChF,UAAQ,KAAK,EAAE;;CAIjB,MAAM,WAAW,cAAc;CAC/B,MAAM,gBAAgB,gBAAgB,KAAK,SAAS;AACpD,KAAI,OAAO,kBAAkB,eAAe;AAC1C,UAAQ,MACN,gGAAgG,WACjG;AACD,UAAQ,KAAK,EAAE;;CAEjB,MAAM,OAAO,IAAIC,4BAAU;AAC3B,MAAK,gBAAgB;EACnB,UAAU,OAAO;EAIjB,aAAa,gBAAgB,gCAAoB,UAAU,gBAAgB;EAC3E,WAAW,OAAO;EACnB,CAAC;AACF,aAAY;EAAE,MAAM;EAAS,SAAS;EAAM;;AAS9C,eAAe,2BAA6D;CAC1E,MAAM,WAAoC,EAAE;AAC5C,MAAK,MAAM,SAAS,eAAe;EACjC,IAAI;AACJ,MAAI;AACF,WAAQ,MAAMC,6CAAqB,OAAO;IACxC;IACA;IACD,CAAC;WACK,KAAK;GACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,WAAQ,MAAM,uCAAuC,MAAM,KAAK,MAAM;AACtE,WAAQ,KAAK,EAAE;;AAEjB,MAAI,CAAC,MAAM,KAET;AAEF,MAAI;GACF,MAAM,6BAAgB,MAAM,KAAK;AACjC,YAAS,KAAK;IAAE,QAAQ,MAAM;IAAQ,MAAM,MAAM;IAAM,OAAO,KAAK,aAAa;IAAE,CAAC;WAC7E,KAAK;AACZ,OAAK,IAA8B,SAAS,SAC1C,SAAQ,MAAM,4BAA4B,MAAM,OAAO;QAClD;IACL,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,YAAQ,MAAM,gCAAgC,MAAM,KAAK,IAAI,MAAM;;AAErE,WAAQ,KAAK,EAAE;;;AAGnB,QAAO;;AAGT,SAAS,WAAW,QAA0C;AAC5D,QAAO,OAAO,QACVC,2CAAoB,OAAO,MAAM,OAAO,GACxCC,uCAAgB,OAAO,MAAM,OAAO;;AAG1C,eAAe,OAAO;CACpB,MAAM,UAAU,MAAM,0BAA0B;CAEhD,MAAM,WAAsB,EAAE;AAC9B,MAAK,MAAM,OAAO,QAChB,UAAS,KAAK,GAAG,WAAW,IAAI,CAAC;AAGnC,KAAI,SAAS,WAAW,GAAG;AACzB,MAAI,kBAAkB,OAAO,QAAQ;AACnC,WAAQ,MAAM,8EAA8E;AAC5F,WAAQ,KAAK,EAAE;;AAEjB,UAAQ,KAAK,4EAA4E;;CAG3F,MAAM,cAAc,QAAQ,KAAK,MAAM,EAAE,OAAO,CAAC,KAAK,KAAK,IAAI;AAC/D,QAAO,KAAK,UAAU,SAAS,OAAO,mBAAmB,cAAc;AAGvE,KAAI,gBAAgB;EAClB,MAAM,UAAUC,wCAAiB,SAAS;EAC1C,MAAM,SAAS,QAAQ,QAAQ,MAAM,EAAE,aAAa,QAAQ;EAC5D,MAAM,WAAW,QAAQ,QAAQ,MAAM,EAAE,aAAa,UAAU;AAEhE,OAAK,MAAM,KAAK,SACd,QAAO,KAAK,WAAW,EAAE,aAAa,IAAI,EAAE,UAAU;AAExD,OAAK,MAAM,KAAK,OACd,QAAO,MAAM,WAAW,EAAE,aAAa,IAAI,EAAE,UAAU;AAGzD,MAAI,OAAO,SAAS,GAAG;AACrB,WAAQ,MAAM,sBAAsB,OAAO,OAAO,aAAa,SAAS,OAAO,aAAa;AAC5F,WAAQ,KAAK,EAAE;;;CAInB,MAAM,SAAS,YAAY,CAAC,UAAU,GAAG;CAEzC,MAAM,WAAW,MAAMC,4BACrB,UACA;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA,SAAS,OAAO;EAChB;EACA,QAAQ,OAAO;EACf,mBAAmB;EACnB,yBAAyB;EACzB,MAAMC,wCAAmBC,6CAAwB,OAAU,CAAC,CAAC;EAC9D,EACD,OACD;AAED,QAAO,KAAK,8BAA8B,SAAS,MAAM;CAIzD,IAAI,UAAwC;AAC5C,KAAI,WAAW;EACb,MAAM,UAAU,QAAQ;AACxB,MAAI,CAAC,QACH,QAAO,KAAK,wEAAwE;OAC/E;GACL,MAAM,eAA0B,WAAW,QAAQ;AACnD,aAAUC,8BAAc,QAAQ,MAAM,UAAU,QAAQ;IACtD;IACA,UAAU;IACV,YAAYJ;IACb,CAAC;AACF,UAAO,KAAK,YAAY,QAAQ,KAAK,cAAc;;;CAIvD,SAAS,WAAW;AAClB,SAAO,KAAK,mBAAmB;AAC/B,MAAI,QAAS,SAAQ,OAAO;AAC5B,WAAS,OAAO,YAAY;AAC1B,WAAQ,KAAK,EAAE;IACf;;AAGJ,SAAQ,GAAG,UAAU,SAAS;AAC9B,SAAQ,GAAG,WAAW,SAAS;;AAGjC,MAAM,CAAC,OAAO,QAAQ;AACpB,SAAQ,MAAM,IAAI;AAClB,SAAQ,KAAK,EAAE;EACf"}

package/dist/cli.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { resolveInboundAuth, selectInboundAuthSource } from "./api-key-auth.js";
 import { Logger } from "./logger.js";
 import { AGUIMock } from "./agui-mock.js";
 import { loadFixtureFile, loadFixturesFromDir, validateFixtures } from "./fixture-loader.js";
@@ -52,6 +53,7 @@ Options:
       --chaos-drop <rate>   Probability (0-1) of dropping requests with 500
       --chaos-malformed <rate>  Probability (0-1) of returning malformed JSON
       --chaos-disconnect <rate> Probability (0-1) of destroying connection
+      AIMOCK_API_KEYS  Comma-separated inbound test API keys (environment only)
       --help                Show this help message
 `.trim();
 const { values } = parseArgs({
@@ -422,7 +424,8 @@ async function main() {
 		record,
 		strict: values.strict,
 		journalMaxEntries: journalMax,
-		fixtureCountsMaxTestIds: fixtureCountsMax
+		fixtureCountsMaxTestIds: fixtureCountsMax,
+		auth: resolveInboundAuth(selectInboundAuthSource(void 0)).publicConfig
 	}, mounts);
 	logger.info(`aimock server listening on ${instance.url}`);
 	let watcher = null;

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","names":[],"sources":["../src/cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { parseArgs } from \"node:util\";\nimport { statSync } from \"node:fs\";\nimport { resolve } from \"node:path\";\nimport { createServer } from \"./server.js\";\nimport { loadFixtureFile, loadFixturesFromDir, validateFixtures } from \"./fixture-loader.js\";\nimport { Logger, type LogLevel } from \"./logger.js\";\nimport { watchFixtures } from \"./watcher.js\";\nimport { AGUIMock } from \"./agui-mock.js\";\nimport { resolveFixturesValue } from \"./fixtures-remote.js\";\nimport { readProviderKeysFromEnv } from \"./provider-auth.js\";\nimport type { Fixture, ChaosConfig, RecordConfig } from \"./types.js\";\n\nconst HELP = `\nUsage: aimock [options]\n\nOptions:\n  -p, --port <number>       Port to listen on (default: 4010)\n  -h, --host <string>       Host to bind to (default: 127.0.0.1)\n  -f, --fixtures <value>    Fixture source (repeatable). Accepts:\n                              - filesystem path to a directory or .json file (default: ./fixtures)\n                              - https:// or http:// URL to a .json fixture file\n  -l, --latency <ms>        Latency in ms between SSE chunks (default: 0)\n  -c, --chunk-size <chars>  Chunk size in characters (default: 20)\n  -w, --watch               Watch fixture path for changes and reload\n      --log-level <level>   Log verbosity: silent, warn, info, debug (default: info)\n      --validate-on-load    Validate fixture schemas at startup\n      --metrics             Enable Prometheus metrics at GET /metrics\n      --record              Record mode: proxy unmatched requests and save fixtures\n      --record-full-model-version  Record exact model version without date stripping (default: false)\n      --proxy-only          Proxy mode: forward unmatched requests without saving\n      --strict              Strict mode: fail on unmatched requests (overridable per-request via X-AIMock-Strict header)\n      --journal-max <n>     Max request entries retained in memory (default: 1000, 0 = unbounded)\n      --fixture-counts-max <n>  Max unique testIds retained in fixture match-count map (default: 500, 0 = unbounded)\n      --provider-openai <url>     Upstream URL for OpenAI (used with --record)\n      --provider-anthropic <url>  Upstream URL for Anthropic\n      --provider-gemini <url>     Upstream URL for Gemini\n      --provider-vertexai <url>   Upstream URL for Vertex AI\n      --provider-bedrock <url>    Upstream URL for Bedrock\n      --provider-azure <url>      Upstream URL for Azure OpenAI\n      --provider-ollama <url>     Upstream URL for Ollama\n      --provider-cohere <url>     Upstream URL for Cohere\n      --provider-openrouter <url> Upstream URL for OpenRouter (video record proxy)\n      --upstream-timeout-ms <ms>  Idle timeout (ms) on upstream socket before response (default: 30000)\n      --body-timeout-ms <ms>      Idle timeout (ms) on upstream response body between chunks (default: 30000)\n      --max-proxy-buffer-bytes <n> Cap (bytes) on in-memory proxy-path buffer; full body still relayed (default: 67108864)\n      --max-proxy-buffer-frames <n> Cap (frames) on in-memory proxy-path per-frame state; full body still relayed (default: 5000000)\n      --agui-record              Enable AG-UI recording (proxy unmatched AG-UI requests)\n      --agui-upstream <url>      Upstream AG-UI agent URL (used with --agui-record)\n      --agui-proxy-only          AG-UI proxy mode: forward without saving\n      --replay-speed <n>    Replay speed multiplier (default: 1.0, 2.0 = 2x faster)\n      --chaos-drop <rate>   Probability (0-1) of dropping requests with 500\n      --chaos-malformed <rate>  Probability (0-1) of returning malformed JSON\n      --chaos-disconnect <rate> Probability (0-1) of destroying connection\n      --help                Show this help message\n`.trim();\n\nconst { values } = parseArgs({\n  options: {\n    port: { type: \"string\", short: \"p\", default: \"4010\" },\n    host: { type: \"string\", short: \"h\", default: \"127.0.0.1\" },\n    fixtures: { type: \"string\", short: \"f\", multiple: true },\n    latency: { type: \"string\", short: \"l\", default: \"0\" },\n    \"chunk-size\": { type: \"string\", short: \"c\", default: \"20\" },\n    watch: { type: \"boolean\", short: \"w\", default: false },\n    \"log-level\": { type: \"string\", default: \"info\" },\n    \"validate-on-load\": { type: \"boolean\", default: false },\n    metrics: { type: \"boolean\", default: false },\n    record: { type: \"boolean\", default: false },\n    \"record-full-model-version\": { type: \"boolean\", default: false },\n    \"proxy-only\": { type: \"boolean\", default: false },\n    strict: { type: \"boolean\", default: false },\n    \"provider-openai\": { type: \"string\" },\n    \"provider-anthropic\": { type: \"string\" },\n    \"provider-gemini\": { type: \"string\" },\n    \"provider-vertexai\": { type: \"string\" },\n    \"provider-bedrock\": { type: \"string\" },\n    \"provider-azure\": { type: \"string\" },\n    \"provider-ollama\": { type: \"string\" },\n    \"provider-cohere\": { type: \"string\" },\n    \"provider-openrouter\": { type: \"string\" },\n    \"upstream-timeout-ms\": { type: \"string\" },\n    \"body-timeout-ms\": { type: \"string\" },\n    \"max-proxy-buffer-bytes\": { type: \"string\" },\n    \"max-proxy-buffer-frames\": { type: \"string\" },\n    \"agui-record\": { type: \"boolean\", default: false },\n    \"agui-upstream\": { type: \"string\" },\n    \"agui-proxy-only\": { type: \"boolean\", default: false },\n    \"replay-speed\": { type: \"string\", default: \"1.0\" },\n    \"chaos-drop\": { type: \"string\" },\n    \"chaos-malformed\": { type: \"string\" },\n    \"chaos-disconnect\": { type: \"string\" },\n    \"journal-max\": { type: \"string\", default: \"1000\" },\n    \"fixture-counts-max\": { type: \"string\", default: \"500\" },\n    help: { type: \"boolean\", default: false },\n  },\n  strict: true,\n});\n\nif (values.help) {\n  console.log(HELP);\n  process.exit(0);\n}\n\nconst port = Number(values.port);\nconst host = values.host!;\nconst latency = Number(values.latency);\nconst chunkSize = Number(values[\"chunk-size\"]);\nconst fixtureValues: string[] =\n  values.fixtures && values.fixtures.length > 0 ? values.fixtures : [\"./fixtures\"];\nconst watchMode = values.watch!;\nconst validateOnLoad = values[\"validate-on-load\"]!;\nconst logLevelStr = values[\"log-level\"]!;\n\nif (![\"silent\", \"warn\", \"info\", \"debug\"].includes(logLevelStr)) {\n  console.error(`Invalid log-level: ${logLevelStr} (must be silent, warn, info, or debug)`);\n  process.exit(1);\n}\nconst logLevel = logLevelStr as LogLevel;\n\nif (Number.isNaN(port) || port < 0 || port > 65535) {\n  console.error(`Invalid port: ${values.port}`);\n  process.exit(1);\n}\n\nif (Number.isNaN(latency) || latency < 0) {\n  console.error(`Invalid latency: ${values.latency}`);\n  process.exit(1);\n}\n\nif (Number.isNaN(chunkSize) || chunkSize < 1) {\n  console.error(`Invalid chunk-size: ${values[\"chunk-size\"]}`);\n  process.exit(1);\n}\n\nconst replaySpeed = Number(values[\"replay-speed\"]);\nif (Number.isNaN(replaySpeed) || replaySpeed <= 0) {\n  console.error(\"--replay-speed must be a positive number\");\n  process.exit(1);\n}\n\nconst journalMax = Number(values[\"journal-max\"]);\nif (Number.isNaN(journalMax) || !Number.isInteger(journalMax) || journalMax < 0) {\n  console.error(\n    `Invalid journal-max: ${values[\"journal-max\"]} (must be a non-negative integer; 0 = unbounded)`,\n  );\n  process.exit(1);\n}\n\nconst fixtureCountsMaxStr = values[\"fixture-counts-max\"];\nconst fixtureCountsMax = Number(fixtureCountsMaxStr);\nif (Number.isNaN(fixtureCountsMax) || !Number.isInteger(fixtureCountsMax) || fixtureCountsMax < 0) {\n  console.error(\n    `Invalid fixture-counts-max: ${fixtureCountsMaxStr} (must be a non-negative integer; 0 = unbounded)`,\n  );\n  process.exit(1);\n}\n\nconst upstreamTimeoutMsStr = values[\"upstream-timeout-ms\"];\nlet upstreamTimeoutMs: number | undefined;\nif (upstreamTimeoutMsStr !== undefined) {\n  upstreamTimeoutMs = Number(upstreamTimeoutMsStr);\n  if (!Number.isFinite(upstreamTimeoutMs) || upstreamTimeoutMs <= 0) {\n    console.error(\n      `Invalid upstream-timeout-ms: ${upstreamTimeoutMsStr} (must be a positive finite number)`,\n    );\n    process.exit(1);\n  }\n}\n\nconst bodyTimeoutMsStr = values[\"body-timeout-ms\"];\nlet bodyTimeoutMs: number | undefined;\nif (bodyTimeoutMsStr !== undefined) {\n  bodyTimeoutMs = Number(bodyTimeoutMsStr);\n  if (!Number.isFinite(bodyTimeoutMs) || bodyTimeoutMs <= 0) {\n    console.error(\n      `Invalid body-timeout-ms: ${bodyTimeoutMsStr} (must be a positive finite number)`,\n    );\n    process.exit(1);\n  }\n}\n\nconst maxProxyBufferBytesStr = values[\"max-proxy-buffer-bytes\"];\nlet maxProxyBufferBytes: number | undefined;\nif (maxProxyBufferBytesStr !== undefined) {\n  maxProxyBufferBytes = Number(maxProxyBufferBytesStr);\n  if (!Number.isFinite(maxProxyBufferBytes) || maxProxyBufferBytes <= 0) {\n    console.error(\n      `Invalid max-proxy-buffer-bytes: ${maxProxyBufferBytesStr} (must be a positive finite number)`,\n    );\n    process.exit(1);\n  }\n}\n\nconst maxProxyBufferFramesStr = values[\"max-proxy-buffer-frames\"];\nlet maxProxyBufferFrames: number | undefined;\nif (maxProxyBufferFramesStr !== undefined) {\n  maxProxyBufferFrames = Number(maxProxyBufferFramesStr);\n  if (!Number.isFinite(maxProxyBufferFrames) || maxProxyBufferFrames <= 0) {\n    console.error(\n      `Invalid max-proxy-buffer-frames: ${maxProxyBufferFramesStr} (must be a positive finite number)`,\n    );\n    process.exit(1);\n  }\n}\n\nconst logger = new Logger(logLevel);\n\n// Parse chaos config from CLI flags\nlet chaos: ChaosConfig | undefined;\n{\n  const dropStr = values[\"chaos-drop\"];\n  const malformedStr = values[\"chaos-malformed\"];\n  const disconnectStr = values[\"chaos-disconnect\"];\n\n  if (dropStr !== undefined || malformedStr !== undefined || disconnectStr !== undefined) {\n    chaos = {};\n    if (dropStr !== undefined) {\n      const val = parseFloat(dropStr);\n      if (isNaN(val) || val < 0 || val > 1) {\n        console.error(`Invalid chaos-drop: ${dropStr} (must be 0-1)`);\n        process.exit(1);\n      }\n      chaos.dropRate = val;\n    }\n    if (malformedStr !== undefined) {\n      const val = parseFloat(malformedStr);\n      if (isNaN(val) || val < 0 || val > 1) {\n        console.error(`Invalid chaos-malformed: ${malformedStr} (must be 0-1)`);\n        process.exit(1);\n      }\n      chaos.malformedRate = val;\n    }\n    if (disconnectStr !== undefined) {\n      const val = parseFloat(disconnectStr);\n      if (isNaN(val) || val < 0 || val > 1) {\n        console.error(`Invalid chaos-disconnect: ${disconnectStr} (must be 0-1)`);\n        process.exit(1);\n      }\n      chaos.disconnectRate = val;\n    }\n  }\n}\n\n// Parse record/proxy config from CLI flags\nlet record: RecordConfig | undefined;\nif (values.record || values[\"proxy-only\"]) {\n  const providers: RecordConfig[\"providers\"] = {};\n  if (values[\"provider-openai\"]) providers.openai = values[\"provider-openai\"];\n  if (values[\"provider-anthropic\"]) providers.anthropic = values[\"provider-anthropic\"];\n  if (values[\"provider-gemini\"]) providers.gemini = values[\"provider-gemini\"];\n  if (values[\"provider-vertexai\"]) providers.vertexai = values[\"provider-vertexai\"];\n  if (values[\"provider-bedrock\"]) providers.bedrock = values[\"provider-bedrock\"];\n  if (values[\"provider-azure\"]) providers.azure = values[\"provider-azure\"];\n  if (values[\"provider-ollama\"]) providers.ollama = values[\"provider-ollama\"];\n  if (values[\"provider-cohere\"]) providers.cohere = values[\"provider-cohere\"];\n  if (values[\"provider-openrouter\"]) providers.openrouter = values[\"provider-openrouter\"];\n\n  if (Object.keys(providers).length === 0) {\n    console.error(\n      `Error: --${values[\"proxy-only\"] ? \"proxy-only\" : \"record\"} requires at least one --provider-* flag`,\n    );\n    process.exit(1);\n  }\n\n  // For --record, the first --fixtures value is the base path for the recording\n  // destination and must be a local filesystem path — writing to a URL is not supported.\n  // For --proxy-only, unmatched requests are forwarded without saving, so no writable\n  // destination is required; URL-only --fixtures is valid in that mode.\n  const recordBase = fixtureValues[0];\n  const recordBaseIsUrl = /^https?:\\/\\//i.test(recordBase);\n  if (values.record && recordBaseIsUrl) {\n    console.error(\n      `Error: --record requires a local --fixtures path for the recording destination; got URL ${recordBase}`,\n    );\n    process.exit(1);\n  }\n  record = {\n    providers,\n    // aimock's own upstream keys, sourced from AIMOCK_PROVIDER_*_KEY env vars\n    // (not CLI flags — secrets must not appear in `ps`). Injected on a\n    // fixture-miss passthrough when the caller sent no/dummy credential.\n    providerKeys: readProviderKeysFromEnv(),\n    // In proxy-only mode with only URL sources, fixturePath is never consumed\n    // (recorder.ts skips disk writes when proxyOnly is set). Leave it undefined\n    // rather than resolving a URL string as a filesystem path.\n    fixturePath: recordBaseIsUrl ? undefined : resolve(recordBase, \"recorded\"),\n    proxyOnly: values[\"proxy-only\"],\n    recordFullModelVersion: values[\"record-full-model-version\"],\n    upstreamTimeoutMs,\n    bodyTimeoutMs,\n    maxProxyBufferBytes,\n    maxProxyBufferFrames,\n  };\n} else {\n  // These flags configure upstream proxying — without --record or\n  // --proxy-only they would be parsed and then silently dropped. Routed\n  // through the constructed logger so --log-level is respected.\n  const droppedProviderFlags = (\n    [\n      \"provider-openai\",\n      \"provider-anthropic\",\n      \"provider-gemini\",\n      \"provider-vertexai\",\n      \"provider-bedrock\",\n      \"provider-azure\",\n      \"provider-ollama\",\n      \"provider-cohere\",\n      \"provider-openrouter\",\n    ] as const\n  ).filter((flag) => values[flag] !== undefined);\n  if (droppedProviderFlags.length > 0) {\n    logger.warn(\n      `--${droppedProviderFlags.join(\"/--\")} only apply to --record/--proxy-only upstream proxying — ignored without one of those flags.`,\n    );\n  }\n  if (\n    upstreamTimeoutMs !== undefined ||\n    bodyTimeoutMs !== undefined ||\n    maxProxyBufferBytes !== undefined ||\n    maxProxyBufferFrames !== undefined\n  ) {\n    logger.warn(\n      \"--upstream-timeout-ms/--body-timeout-ms/--max-proxy-buffer-bytes/--max-proxy-buffer-frames only apply to --record/--proxy-only upstream proxying — ignored without one of those flags.\",\n    );\n  }\n}\n\n// Parse AG-UI record/proxy config from CLI flags\nlet aguiMount: { path: string; handler: AGUIMock } | undefined;\nif (values[\"agui-record\"] || values[\"agui-proxy-only\"]) {\n  if (!values[\"agui-upstream\"]) {\n    console.error(\"Error: --agui-record/--agui-proxy-only requires --agui-upstream\");\n    process.exit(1);\n  }\n  // --agui-record writes recorded AG-UI fixtures to disk, so a URL source is unsupported.\n  // --agui-proxy-only forwards without saving, so URL-only --fixtures is valid.\n  const aguiBase = fixtureValues[0];\n  const aguiBaseIsUrl = /^https?:\\/\\//i.test(aguiBase);\n  if (values[\"agui-record\"] && aguiBaseIsUrl) {\n    console.error(\n      `Error: --agui-record requires a local --fixtures path for the recording destination; got URL ${aguiBase}`,\n    );\n    process.exit(1);\n  }\n  const agui = new AGUIMock();\n  agui.enableRecording({\n    upstream: values[\"agui-upstream\"],\n    // In proxy-only mode with a URL-only --fixtures, the AG-UI recorder never\n    // writes to disk (see agui-recorder.ts). Leave fixturePath undefined rather\n    // than resolving a URL as a filesystem path.\n    fixturePath: aguiBaseIsUrl ? undefined : resolve(aguiBase, \"agui-recorded\"),\n    proxyOnly: values[\"agui-proxy-only\"],\n  });\n  aguiMount = { path: \"/agui\", handler: agui };\n}\n\ninterface ResolvedFixtureSource {\n  source: string;\n  path: string;\n  isDir: boolean;\n}\n\nasync function resolveAllFixtureSources(): Promise<ResolvedFixtureSource[]> {\n  const resolved: ResolvedFixtureSource[] = [];\n  for (const value of fixtureValues) {\n    let local;\n    try {\n      local = await resolveFixturesValue(value, {\n        validateOnLoad,\n        logger,\n      });\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.error(`Failed to resolve --fixtures value \"${value}\": ${msg}`);\n      process.exit(1);\n    }\n    if (!local.path) {\n      // Remote fetch failed without validate-on-load and no cache — already warned; skip.\n      continue;\n    }\n    try {\n      const stat = statSync(local.path);\n      resolved.push({ source: local.source, path: local.path, isDir: stat.isDirectory() });\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === \"ENOENT\") {\n        console.error(`Fixtures path not found: ${local.path}`);\n      } else {\n        const msg = err instanceof Error ? err.message : String(err);\n        console.error(`Failed to load fixtures from ${local.path}: ${msg}`);\n      }\n      process.exit(1);\n    }\n  }\n  return resolved;\n}\n\nfunction loadSource(source: ResolvedFixtureSource): Fixture[] {\n  return source.isDir\n    ? loadFixturesFromDir(source.path, logger)\n    : loadFixtureFile(source.path, logger);\n}\n\nasync function main() {\n  const sources = await resolveAllFixtureSources();\n\n  const fixtures: Fixture[] = [];\n  for (const src of sources) {\n    fixtures.push(...loadSource(src));\n  }\n\n  if (fixtures.length === 0) {\n    if (validateOnLoad || values.strict) {\n      console.error(\"Error: No fixtures loaded and validation/strict mode is enabled — aborting.\");\n      process.exit(1);\n    }\n    console.warn(\"Warning: No fixtures loaded. The server will return 404 for all requests.\");\n  }\n\n  const sourceLabel = sources.map((s) => s.source).join(\", \") || \"<none>\";\n  logger.info(`Loaded ${fixtures.length} fixture(s) from ${sourceLabel}`);\n\n  // Validate fixtures if requested\n  if (validateOnLoad) {\n    const results = validateFixtures(fixtures);\n    const errors = results.filter((r) => r.severity === \"error\");\n    const warnings = results.filter((r) => r.severity === \"warning\");\n\n    for (const w of warnings) {\n      logger.warn(`Fixture ${w.fixtureIndex}: ${w.message}`);\n    }\n    for (const e of errors) {\n      logger.error(`Fixture ${e.fixtureIndex}: ${e.message}`);\n    }\n\n    if (errors.length > 0) {\n      console.error(`Validation failed: ${errors.length} error(s), ${warnings.length} warning(s)`);\n      process.exit(1);\n    }\n  }\n\n  const mounts = aguiMount ? [aguiMount] : undefined;\n\n  const instance = await createServer(\n    fixtures,\n    {\n      port,\n      host,\n      latency,\n      chunkSize,\n      replaySpeed,\n      logLevel,\n      chaos,\n      metrics: values.metrics,\n      record,\n      strict: values.strict,\n      journalMaxEntries: journalMax,\n      fixtureCountsMaxTestIds: fixtureCountsMax,\n    },\n    mounts,\n  );\n\n  logger.info(`aimock server listening on ${instance.url}`);\n\n  // Start file watcher if requested. Only the first local source is watched —\n  // remote URL sources are fetched once at boot and are not monitored.\n  let watcher: { close: () => void } | null = null;\n  if (watchMode) {\n    const primary = sources[0];\n    if (!primary) {\n      logger.warn(\"--watch requested but no resolvable fixture sources; skipping watcher\");\n    } else {\n      const loadFn = (): Fixture[] => loadSource(primary);\n      watcher = watchFixtures(primary.path, fixtures, loadFn, {\n        logger,\n        validate: validateOnLoad,\n        validateFn: validateFixtures,\n      });\n      logger.info(`Watching ${primary.path} for changes`);\n    }\n  }\n\n  function shutdown() {\n    logger.info(\"Shutting down...\");\n    if (watcher) watcher.close();\n    instance.server.close(() => {\n      process.exit(0);\n    });\n  }\n\n  process.on(\"SIGINT\", shutdown);\n  process.on(\"SIGTERM\", shutdown);\n}\n\nmain().catch((err) => {\n  console.error(err);\n  process.exit(1);\n});\n"],"mappings":";;;;;;;;;;;;;AAaA,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0CX,MAAM;AAER,MAAM,EAAE,WAAW,UAAU;CAC3B,SAAS;EACP,MAAM;GAAE,MAAM;GAAU,OAAO;GAAK,SAAS;GAAQ;EACrD,MAAM;GAAE,MAAM;GAAU,OAAO;GAAK,SAAS;GAAa;EAC1D,UAAU;GAAE,MAAM;GAAU,OAAO;GAAK,UAAU;GAAM;EACxD,SAAS;GAAE,MAAM;GAAU,OAAO;GAAK,SAAS;GAAK;EACrD,cAAc;GAAE,MAAM;GAAU,OAAO;GAAK,SAAS;GAAM;EAC3D,OAAO;GAAE,MAAM;GAAW,OAAO;GAAK,SAAS;GAAO;EACtD,aAAa;GAAE,MAAM;GAAU,SAAS;GAAQ;EAChD,oBAAoB;GAAE,MAAM;GAAW,SAAS;GAAO;EACvD,SAAS;GAAE,MAAM;GAAW,SAAS;GAAO;EAC5C,QAAQ;GAAE,MAAM;GAAW,SAAS;GAAO;EAC3C,6BAA6B;GAAE,MAAM;GAAW,SAAS;GAAO;EAChE,cAAc;GAAE,MAAM;GAAW,SAAS;GAAO;EACjD,QAAQ;GAAE,MAAM;GAAW,SAAS;GAAO;EAC3C,mBAAmB,EAAE,MAAM,UAAU;EACrC,sBAAsB,EAAE,MAAM,UAAU;EACxC,mBAAmB,EAAE,MAAM,UAAU;EACrC,qBAAqB,EAAE,MAAM,UAAU;EACvC,oBAAoB,EAAE,MAAM,UAAU;EACtC,kBAAkB,EAAE,MAAM,UAAU;EACpC,mBAAmB,EAAE,MAAM,UAAU;EACrC,mBAAmB,EAAE,MAAM,UAAU;EACrC,uBAAuB,EAAE,MAAM,UAAU;EACzC,uBAAuB,EAAE,MAAM,UAAU;EACzC,mBAAmB,EAAE,MAAM,UAAU;EACrC,0BAA0B,EAAE,MAAM,UAAU;EAC5C,2BAA2B,EAAE,MAAM,UAAU;EAC7C,eAAe;GAAE,MAAM;GAAW,SAAS;GAAO;EAClD,iBAAiB,EAAE,MAAM,UAAU;EACnC,mBAAmB;GAAE,MAAM;GAAW,SAAS;GAAO;EACtD,gBAAgB;GAAE,MAAM;GAAU,SAAS;GAAO;EAClD,cAAc,EAAE,MAAM,UAAU;EAChC,mBAAmB,EAAE,MAAM,UAAU;EACrC,oBAAoB,EAAE,MAAM,UAAU;EACtC,eAAe;GAAE,MAAM;GAAU,SAAS;GAAQ;EAClD,sBAAsB;GAAE,MAAM;GAAU,SAAS;GAAO;EACxD,MAAM;GAAE,MAAM;GAAW,SAAS;GAAO;EAC1C;CACD,QAAQ;CACT,CAAC;AAEF,IAAI,OAAO,MAAM;AACf,SAAQ,IAAI,KAAK;AACjB,SAAQ,KAAK,EAAE;;AAGjB,MAAM,OAAO,OAAO,OAAO,KAAK;AAChC,MAAM,OAAO,OAAO;AACpB,MAAM,UAAU,OAAO,OAAO,QAAQ;AACtC,MAAM,YAAY,OAAO,OAAO,cAAc;AAC9C,MAAM,gBACJ,OAAO,YAAY,OAAO,SAAS,SAAS,IAAI,OAAO,WAAW,CAAC,aAAa;AAClF,MAAM,YAAY,OAAO;AACzB,MAAM,iBAAiB,OAAO;AAC9B,MAAM,cAAc,OAAO;AAE3B,IAAI,CAAC;CAAC;CAAU;CAAQ;CAAQ;CAAQ,CAAC,SAAS,YAAY,EAAE;AAC9D,SAAQ,MAAM,sBAAsB,YAAY,yCAAyC;AACzF,SAAQ,KAAK,EAAE;;AAEjB,MAAM,WAAW;AAEjB,IAAI,OAAO,MAAM,KAAK,IAAI,OAAO,KAAK,OAAO,OAAO;AAClD,SAAQ,MAAM,iBAAiB,OAAO,OAAO;AAC7C,SAAQ,KAAK,EAAE;;AAGjB,IAAI,OAAO,MAAM,QAAQ,IAAI,UAAU,GAAG;AACxC,SAAQ,MAAM,oBAAoB,OAAO,UAAU;AACnD,SAAQ,KAAK,EAAE;;AAGjB,IAAI,OAAO,MAAM,UAAU,IAAI,YAAY,GAAG;AAC5C,SAAQ,MAAM,uBAAuB,OAAO,gBAAgB;AAC5D,SAAQ,KAAK,EAAE;;AAGjB,MAAM,cAAc,OAAO,OAAO,gBAAgB;AAClD,IAAI,OAAO,MAAM,YAAY,IAAI,eAAe,GAAG;AACjD,SAAQ,MAAM,2CAA2C;AACzD,SAAQ,KAAK,EAAE;;AAGjB,MAAM,aAAa,OAAO,OAAO,eAAe;AAChD,IAAI,OAAO,MAAM,WAAW,IAAI,CAAC,OAAO,UAAU,WAAW,IAAI,aAAa,GAAG;AAC/E,SAAQ,MACN,wBAAwB,OAAO,eAAe,kDAC/C;AACD,SAAQ,KAAK,EAAE;;AAGjB,MAAM,sBAAsB,OAAO;AACnC,MAAM,mBAAmB,OAAO,oBAAoB;AACpD,IAAI,OAAO,MAAM,iBAAiB,IAAI,CAAC,OAAO,UAAU,iBAAiB,IAAI,mBAAmB,GAAG;AACjG,SAAQ,MACN,+BAA+B,oBAAoB,kDACpD;AACD,SAAQ,KAAK,EAAE;;AAGjB,MAAM,uBAAuB,OAAO;AACpC,IAAI;AACJ,IAAI,yBAAyB,QAAW;AACtC,qBAAoB,OAAO,qBAAqB;AAChD,KAAI,CAAC,OAAO,SAAS,kBAAkB,IAAI,qBAAqB,GAAG;AACjE,UAAQ,MACN,gCAAgC,qBAAqB,qCACtD;AACD,UAAQ,KAAK,EAAE;;;AAInB,MAAM,mBAAmB,OAAO;AAChC,IAAI;AACJ,IAAI,qBAAqB,QAAW;AAClC,iBAAgB,OAAO,iBAAiB;AACxC,KAAI,CAAC,OAAO,SAAS,cAAc,IAAI,iBAAiB,GAAG;AACzD,UAAQ,MACN,4BAA4B,iBAAiB,qCAC9C;AACD,UAAQ,KAAK,EAAE;;;AAInB,MAAM,yBAAyB,OAAO;AACtC,IAAI;AACJ,IAAI,2BAA2B,QAAW;AACxC,uBAAsB,OAAO,uBAAuB;AACpD,KAAI,CAAC,OAAO,SAAS,oBAAoB,IAAI,uBAAuB,GAAG;AACrE,UAAQ,MACN,mCAAmC,uBAAuB,qCAC3D;AACD,UAAQ,KAAK,EAAE;;;AAInB,MAAM,0BAA0B,OAAO;AACvC,IAAI;AACJ,IAAI,4BAA4B,QAAW;AACzC,wBAAuB,OAAO,wBAAwB;AACtD,KAAI,CAAC,OAAO,SAAS,qBAAqB,IAAI,wBAAwB,GAAG;AACvE,UAAQ,MACN,oCAAoC,wBAAwB,qCAC7D;AACD,UAAQ,KAAK,EAAE;;;AAInB,MAAM,SAAS,IAAI,OAAO,SAAS;AAGnC,IAAI;AACJ;CACE,MAAM,UAAU,OAAO;CACvB,MAAM,eAAe,OAAO;CAC5B,MAAM,gBAAgB,OAAO;AAE7B,KAAI,YAAY,UAAa,iBAAiB,UAAa,kBAAkB,QAAW;AACtF,UAAQ,EAAE;AACV,MAAI,YAAY,QAAW;GACzB,MAAM,MAAM,WAAW,QAAQ;AAC/B,OAAI,MAAM,IAAI,IAAI,MAAM,KAAK,MAAM,GAAG;AACpC,YAAQ,MAAM,uBAAuB,QAAQ,gBAAgB;AAC7D,YAAQ,KAAK,EAAE;;AAEjB,SAAM,WAAW;;AAEnB,MAAI,iBAAiB,QAAW;GAC9B,MAAM,MAAM,WAAW,aAAa;AACpC,OAAI,MAAM,IAAI,IAAI,MAAM,KAAK,MAAM,GAAG;AACpC,YAAQ,MAAM,4BAA4B,aAAa,gBAAgB;AACvE,YAAQ,KAAK,EAAE;;AAEjB,SAAM,gBAAgB;;AAExB,MAAI,kBAAkB,QAAW;GAC/B,MAAM,MAAM,WAAW,cAAc;AACrC,OAAI,MAAM,IAAI,IAAI,MAAM,KAAK,MAAM,GAAG;AACpC,YAAQ,MAAM,6BAA6B,cAAc,gBAAgB;AACzE,YAAQ,KAAK,EAAE;;AAEjB,SAAM,iBAAiB;;;;AAM7B,IAAI;AACJ,IAAI,OAAO,UAAU,OAAO,eAAe;CACzC,MAAM,YAAuC,EAAE;AAC/C,KAAI,OAAO,mBAAoB,WAAU,SAAS,OAAO;AACzD,KAAI,OAAO,sBAAuB,WAAU,YAAY,OAAO;AAC/D,KAAI,OAAO,mBAAoB,WAAU,SAAS,OAAO;AACzD,KAAI,OAAO,qBAAsB,WAAU,WAAW,OAAO;AAC7D,KAAI,OAAO,oBAAqB,WAAU,UAAU,OAAO;AAC3D,KAAI,OAAO,kBAAmB,WAAU,QAAQ,OAAO;AACvD,KAAI,OAAO,mBAAoB,WAAU,SAAS,OAAO;AACzD,KAAI,OAAO,mBAAoB,WAAU,SAAS,OAAO;AACzD,KAAI,OAAO,uBAAwB,WAAU,aAAa,OAAO;AAEjE,KAAI,OAAO,KAAK,UAAU,CAAC,WAAW,GAAG;AACvC,UAAQ,MACN,YAAY,OAAO,gBAAgB,eAAe,SAAS,0CAC5D;AACD,UAAQ,KAAK,EAAE;;CAOjB,MAAM,aAAa,cAAc;CACjC,MAAM,kBAAkB,gBAAgB,KAAK,WAAW;AACxD,KAAI,OAAO,UAAU,iBAAiB;AACpC,UAAQ,MACN,2FAA2F,aAC5F;AACD,UAAQ,KAAK,EAAE;;AAEjB,UAAS;EACP;EAIA,cAAc,yBAAyB;EAIvC,aAAa,kBAAkB,SAAY,QAAQ,YAAY,WAAW;EAC1E,WAAW,OAAO;EAClB,wBAAwB,OAAO;EAC/B;EACA;EACA;EACA;EACD;OACI;CAIL,MAAM,uBACJ;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CACD,QAAQ,SAAS,OAAO,UAAU,OAAU;AAC9C,KAAI,qBAAqB,SAAS,EAChC,QAAO,KACL,KAAK,qBAAqB,KAAK,MAAM,CAAC,8FACvC;AAEH,KACE,sBAAsB,UACtB,kBAAkB,UAClB,wBAAwB,UACxB,yBAAyB,OAEzB,QAAO,KACL,yLACD;;AAKL,IAAI;AACJ,IAAI,OAAO,kBAAkB,OAAO,oBAAoB;AACtD,KAAI,CAAC,OAAO,kBAAkB;AAC5B,UAAQ,MAAM,kEAAkE;AAChF,UAAQ,KAAK,EAAE;;CAIjB,MAAM,WAAW,cAAc;CAC/B,MAAM,gBAAgB,gBAAgB,KAAK,SAAS;AACpD,KAAI,OAAO,kBAAkB,eAAe;AAC1C,UAAQ,MACN,gGAAgG,WACjG;AACD,UAAQ,KAAK,EAAE;;CAEjB,MAAM,OAAO,IAAI,UAAU;AAC3B,MAAK,gBAAgB;EACnB,UAAU,OAAO;EAIjB,aAAa,gBAAgB,SAAY,QAAQ,UAAU,gBAAgB;EAC3E,WAAW,OAAO;EACnB,CAAC;AACF,aAAY;EAAE,MAAM;EAAS,SAAS;EAAM;;AAS9C,eAAe,2BAA6D;CAC1E,MAAM,WAAoC,EAAE;AAC5C,MAAK,MAAM,SAAS,eAAe;EACjC,IAAI;AACJ,MAAI;AACF,WAAQ,MAAM,qBAAqB,OAAO;IACxC;IACA;IACD,CAAC;WACK,KAAK;GACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,WAAQ,MAAM,uCAAuC,MAAM,KAAK,MAAM;AACtE,WAAQ,KAAK,EAAE;;AAEjB,MAAI,CAAC,MAAM,KAET;AAEF,MAAI;GACF,MAAM,OAAO,SAAS,MAAM,KAAK;AACjC,YAAS,KAAK;IAAE,QAAQ,MAAM;IAAQ,MAAM,MAAM;IAAM,OAAO,KAAK,aAAa;IAAE,CAAC;WAC7E,KAAK;AACZ,OAAK,IAA8B,SAAS,SAC1C,SAAQ,MAAM,4BAA4B,MAAM,OAAO;QAClD;IACL,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,YAAQ,MAAM,gCAAgC,MAAM,KAAK,IAAI,MAAM;;AAErE,WAAQ,KAAK,EAAE;;;AAGnB,QAAO;;AAGT,SAAS,WAAW,QAA0C;AAC5D,QAAO,OAAO,QACV,oBAAoB,OAAO,MAAM,OAAO,GACxC,gBAAgB,OAAO,MAAM,OAAO;;AAG1C,eAAe,OAAO;CACpB,MAAM,UAAU,MAAM,0BAA0B;CAEhD,MAAM,WAAsB,EAAE;AAC9B,MAAK,MAAM,OAAO,QAChB,UAAS,KAAK,GAAG,WAAW,IAAI,CAAC;AAGnC,KAAI,SAAS,WAAW,GAAG;AACzB,MAAI,kBAAkB,OAAO,QAAQ;AACnC,WAAQ,MAAM,8EAA8E;AAC5F,WAAQ,KAAK,EAAE;;AAEjB,UAAQ,KAAK,4EAA4E;;CAG3F,MAAM,cAAc,QAAQ,KAAK,MAAM,EAAE,OAAO,CAAC,KAAK,KAAK,IAAI;AAC/D,QAAO,KAAK,UAAU,SAAS,OAAO,mBAAmB,cAAc;AAGvE,KAAI,gBAAgB;EAClB,MAAM,UAAU,iBAAiB,SAAS;EAC1C,MAAM,SAAS,QAAQ,QAAQ,MAAM,EAAE,aAAa,QAAQ;EAC5D,MAAM,WAAW,QAAQ,QAAQ,MAAM,EAAE,aAAa,UAAU;AAEhE,OAAK,MAAM,KAAK,SACd,QAAO,KAAK,WAAW,EAAE,aAAa,IAAI,EAAE,UAAU;AAExD,OAAK,MAAM,KAAK,OACd,QAAO,MAAM,WAAW,EAAE,aAAa,IAAI,EAAE,UAAU;AAGzD,MAAI,OAAO,SAAS,GAAG;AACrB,WAAQ,MAAM,sBAAsB,OAAO,OAAO,aAAa,SAAS,OAAO,aAAa;AAC5F,WAAQ,KAAK,EAAE;;;CAInB,MAAM,SAAS,YAAY,CAAC,UAAU,GAAG;CAEzC,MAAM,WAAW,MAAM,aACrB,UACA;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA,SAAS,OAAO;EAChB;EACA,QAAQ,OAAO;EACf,mBAAmB;EACnB,yBAAyB;EAC1B,EACD,OACD;AAED,QAAO,KAAK,8BAA8B,SAAS,MAAM;CAIzD,IAAI,UAAwC;AAC5C,KAAI,WAAW;EACb,MAAM,UAAU,QAAQ;AACxB,MAAI,CAAC,QACH,QAAO,KAAK,wEAAwE;OAC/E;GACL,MAAM,eAA0B,WAAW,QAAQ;AACnD,aAAU,cAAc,QAAQ,MAAM,UAAU,QAAQ;IACtD;IACA,UAAU;IACV,YAAY;IACb,CAAC;AACF,UAAO,KAAK,YAAY,QAAQ,KAAK,cAAc;;;CAIvD,SAAS,WAAW;AAClB,SAAO,KAAK,mBAAmB;AAC/B,MAAI,QAAS,SAAQ,OAAO;AAC5B,WAAS,OAAO,YAAY;AAC1B,WAAQ,KAAK,EAAE;IACf;;AAGJ,SAAQ,GAAG,UAAU,SAAS;AAC9B,SAAQ,GAAG,WAAW,SAAS;;AAGjC,MAAM,CAAC,OAAO,QAAQ;AACpB,SAAQ,MAAM,IAAI;AAClB,SAAQ,KAAK,EAAE;EACf"}
+{"version":3,"file":"cli.js","names":[],"sources":["../src/cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { parseArgs } from \"node:util\";\nimport { statSync } from \"node:fs\";\nimport { resolve } from \"node:path\";\nimport { createServer } from \"./server.js\";\nimport { loadFixtureFile, loadFixturesFromDir, validateFixtures } from \"./fixture-loader.js\";\nimport { Logger, type LogLevel } from \"./logger.js\";\nimport { watchFixtures } from \"./watcher.js\";\nimport { AGUIMock } from \"./agui-mock.js\";\nimport { resolveFixturesValue } from \"./fixtures-remote.js\";\nimport { readProviderKeysFromEnv } from \"./provider-auth.js\";\nimport { resolveInboundAuth, selectInboundAuthSource } from \"./api-key-auth.js\";\nimport type { Fixture, ChaosConfig, RecordConfig } from \"./types.js\";\n\nconst HELP = `\nUsage: aimock [options]\n\nOptions:\n  -p, --port <number>       Port to listen on (default: 4010)\n  -h, --host <string>       Host to bind to (default: 127.0.0.1)\n  -f, --fixtures <value>    Fixture source (repeatable). Accepts:\n                              - filesystem path to a directory or .json file (default: ./fixtures)\n                              - https:// or http:// URL to a .json fixture file\n  -l, --latency <ms>        Latency in ms between SSE chunks (default: 0)\n  -c, --chunk-size <chars>  Chunk size in characters (default: 20)\n  -w, --watch               Watch fixture path for changes and reload\n      --log-level <level>   Log verbosity: silent, warn, info, debug (default: info)\n      --validate-on-load    Validate fixture schemas at startup\n      --metrics             Enable Prometheus metrics at GET /metrics\n      --record              Record mode: proxy unmatched requests and save fixtures\n      --record-full-model-version  Record exact model version without date stripping (default: false)\n      --proxy-only          Proxy mode: forward unmatched requests without saving\n      --strict              Strict mode: fail on unmatched requests (overridable per-request via X-AIMock-Strict header)\n      --journal-max <n>     Max request entries retained in memory (default: 1000, 0 = unbounded)\n      --fixture-counts-max <n>  Max unique testIds retained in fixture match-count map (default: 500, 0 = unbounded)\n      --provider-openai <url>     Upstream URL for OpenAI (used with --record)\n      --provider-anthropic <url>  Upstream URL for Anthropic\n      --provider-gemini <url>     Upstream URL for Gemini\n      --provider-vertexai <url>   Upstream URL for Vertex AI\n      --provider-bedrock <url>    Upstream URL for Bedrock\n      --provider-azure <url>      Upstream URL for Azure OpenAI\n      --provider-ollama <url>     Upstream URL for Ollama\n      --provider-cohere <url>     Upstream URL for Cohere\n      --provider-openrouter <url> Upstream URL for OpenRouter (video record proxy)\n      --upstream-timeout-ms <ms>  Idle timeout (ms) on upstream socket before response (default: 30000)\n      --body-timeout-ms <ms>      Idle timeout (ms) on upstream response body between chunks (default: 30000)\n      --max-proxy-buffer-bytes <n> Cap (bytes) on in-memory proxy-path buffer; full body still relayed (default: 67108864)\n      --max-proxy-buffer-frames <n> Cap (frames) on in-memory proxy-path per-frame state; full body still relayed (default: 5000000)\n      --agui-record              Enable AG-UI recording (proxy unmatched AG-UI requests)\n      --agui-upstream <url>      Upstream AG-UI agent URL (used with --agui-record)\n      --agui-proxy-only          AG-UI proxy mode: forward without saving\n      --replay-speed <n>    Replay speed multiplier (default: 1.0, 2.0 = 2x faster)\n      --chaos-drop <rate>   Probability (0-1) of dropping requests with 500\n      --chaos-malformed <rate>  Probability (0-1) of returning malformed JSON\n      --chaos-disconnect <rate> Probability (0-1) of destroying connection\n      AIMOCK_API_KEYS  Comma-separated inbound test API keys (environment only)\n      --help                Show this help message\n`.trim();\n\nconst { values } = parseArgs({\n  options: {\n    port: { type: \"string\", short: \"p\", default: \"4010\" },\n    host: { type: \"string\", short: \"h\", default: \"127.0.0.1\" },\n    fixtures: { type: \"string\", short: \"f\", multiple: true },\n    latency: { type: \"string\", short: \"l\", default: \"0\" },\n    \"chunk-size\": { type: \"string\", short: \"c\", default: \"20\" },\n    watch: { type: \"boolean\", short: \"w\", default: false },\n    \"log-level\": { type: \"string\", default: \"info\" },\n    \"validate-on-load\": { type: \"boolean\", default: false },\n    metrics: { type: \"boolean\", default: false },\n    record: { type: \"boolean\", default: false },\n    \"record-full-model-version\": { type: \"boolean\", default: false },\n    \"proxy-only\": { type: \"boolean\", default: false },\n    strict: { type: \"boolean\", default: false },\n    \"provider-openai\": { type: \"string\" },\n    \"provider-anthropic\": { type: \"string\" },\n    \"provider-gemini\": { type: \"string\" },\n    \"provider-vertexai\": { type: \"string\" },\n    \"provider-bedrock\": { type: \"string\" },\n    \"provider-azure\": { type: \"string\" },\n    \"provider-ollama\": { type: \"string\" },\n    \"provider-cohere\": { type: \"string\" },\n    \"provider-openrouter\": { type: \"string\" },\n    \"upstream-timeout-ms\": { type: \"string\" },\n    \"body-timeout-ms\": { type: \"string\" },\n    \"max-proxy-buffer-bytes\": { type: \"string\" },\n    \"max-proxy-buffer-frames\": { type: \"string\" },\n    \"agui-record\": { type: \"boolean\", default: false },\n    \"agui-upstream\": { type: \"string\" },\n    \"agui-proxy-only\": { type: \"boolean\", default: false },\n    \"replay-speed\": { type: \"string\", default: \"1.0\" },\n    \"chaos-drop\": { type: \"string\" },\n    \"chaos-malformed\": { type: \"string\" },\n    \"chaos-disconnect\": { type: \"string\" },\n    \"journal-max\": { type: \"string\", default: \"1000\" },\n    \"fixture-counts-max\": { type: \"string\", default: \"500\" },\n    help: { type: \"boolean\", default: false },\n  },\n  strict: true,\n});\n\nif (values.help) {\n  console.log(HELP);\n  process.exit(0);\n}\n\nconst port = Number(values.port);\nconst host = values.host!;\nconst latency = Number(values.latency);\nconst chunkSize = Number(values[\"chunk-size\"]);\nconst fixtureValues: string[] =\n  values.fixtures && values.fixtures.length > 0 ? values.fixtures : [\"./fixtures\"];\nconst watchMode = values.watch!;\nconst validateOnLoad = values[\"validate-on-load\"]!;\nconst logLevelStr = values[\"log-level\"]!;\n\nif (![\"silent\", \"warn\", \"info\", \"debug\"].includes(logLevelStr)) {\n  console.error(`Invalid log-level: ${logLevelStr} (must be silent, warn, info, or debug)`);\n  process.exit(1);\n}\nconst logLevel = logLevelStr as LogLevel;\n\nif (Number.isNaN(port) || port < 0 || port > 65535) {\n  console.error(`Invalid port: ${values.port}`);\n  process.exit(1);\n}\n\nif (Number.isNaN(latency) || latency < 0) {\n  console.error(`Invalid latency: ${values.latency}`);\n  process.exit(1);\n}\n\nif (Number.isNaN(chunkSize) || chunkSize < 1) {\n  console.error(`Invalid chunk-size: ${values[\"chunk-size\"]}`);\n  process.exit(1);\n}\n\nconst replaySpeed = Number(values[\"replay-speed\"]);\nif (Number.isNaN(replaySpeed) || replaySpeed <= 0) {\n  console.error(\"--replay-speed must be a positive number\");\n  process.exit(1);\n}\n\nconst journalMax = Number(values[\"journal-max\"]);\nif (Number.isNaN(journalMax) || !Number.isInteger(journalMax) || journalMax < 0) {\n  console.error(\n    `Invalid journal-max: ${values[\"journal-max\"]} (must be a non-negative integer; 0 = unbounded)`,\n  );\n  process.exit(1);\n}\n\nconst fixtureCountsMaxStr = values[\"fixture-counts-max\"];\nconst fixtureCountsMax = Number(fixtureCountsMaxStr);\nif (Number.isNaN(fixtureCountsMax) || !Number.isInteger(fixtureCountsMax) || fixtureCountsMax < 0) {\n  console.error(\n    `Invalid fixture-counts-max: ${fixtureCountsMaxStr} (must be a non-negative integer; 0 = unbounded)`,\n  );\n  process.exit(1);\n}\n\nconst upstreamTimeoutMsStr = values[\"upstream-timeout-ms\"];\nlet upstreamTimeoutMs: number | undefined;\nif (upstreamTimeoutMsStr !== undefined) {\n  upstreamTimeoutMs = Number(upstreamTimeoutMsStr);\n  if (!Number.isFinite(upstreamTimeoutMs) || upstreamTimeoutMs <= 0) {\n    console.error(\n      `Invalid upstream-timeout-ms: ${upstreamTimeoutMsStr} (must be a positive finite number)`,\n    );\n    process.exit(1);\n  }\n}\n\nconst bodyTimeoutMsStr = values[\"body-timeout-ms\"];\nlet bodyTimeoutMs: number | undefined;\nif (bodyTimeoutMsStr !== undefined) {\n  bodyTimeoutMs = Number(bodyTimeoutMsStr);\n  if (!Number.isFinite(bodyTimeoutMs) || bodyTimeoutMs <= 0) {\n    console.error(\n      `Invalid body-timeout-ms: ${bodyTimeoutMsStr} (must be a positive finite number)`,\n    );\n    process.exit(1);\n  }\n}\n\nconst maxProxyBufferBytesStr = values[\"max-proxy-buffer-bytes\"];\nlet maxProxyBufferBytes: number | undefined;\nif (maxProxyBufferBytesStr !== undefined) {\n  maxProxyBufferBytes = Number(maxProxyBufferBytesStr);\n  if (!Number.isFinite(maxProxyBufferBytes) || maxProxyBufferBytes <= 0) {\n    console.error(\n      `Invalid max-proxy-buffer-bytes: ${maxProxyBufferBytesStr} (must be a positive finite number)`,\n    );\n    process.exit(1);\n  }\n}\n\nconst maxProxyBufferFramesStr = values[\"max-proxy-buffer-frames\"];\nlet maxProxyBufferFrames: number | undefined;\nif (maxProxyBufferFramesStr !== undefined) {\n  maxProxyBufferFrames = Number(maxProxyBufferFramesStr);\n  if (!Number.isFinite(maxProxyBufferFrames) || maxProxyBufferFrames <= 0) {\n    console.error(\n      `Invalid max-proxy-buffer-frames: ${maxProxyBufferFramesStr} (must be a positive finite number)`,\n    );\n    process.exit(1);\n  }\n}\n\nconst logger = new Logger(logLevel);\n\n// Parse chaos config from CLI flags\nlet chaos: ChaosConfig | undefined;\n{\n  const dropStr = values[\"chaos-drop\"];\n  const malformedStr = values[\"chaos-malformed\"];\n  const disconnectStr = values[\"chaos-disconnect\"];\n\n  if (dropStr !== undefined || malformedStr !== undefined || disconnectStr !== undefined) {\n    chaos = {};\n    if (dropStr !== undefined) {\n      const val = parseFloat(dropStr);\n      if (isNaN(val) || val < 0 || val > 1) {\n        console.error(`Invalid chaos-drop: ${dropStr} (must be 0-1)`);\n        process.exit(1);\n      }\n      chaos.dropRate = val;\n    }\n    if (malformedStr !== undefined) {\n      const val = parseFloat(malformedStr);\n      if (isNaN(val) || val < 0 || val > 1) {\n        console.error(`Invalid chaos-malformed: ${malformedStr} (must be 0-1)`);\n        process.exit(1);\n      }\n      chaos.malformedRate = val;\n    }\n    if (disconnectStr !== undefined) {\n      const val = parseFloat(disconnectStr);\n      if (isNaN(val) || val < 0 || val > 1) {\n        console.error(`Invalid chaos-disconnect: ${disconnectStr} (must be 0-1)`);\n        process.exit(1);\n      }\n      chaos.disconnectRate = val;\n    }\n  }\n}\n\n// Parse record/proxy config from CLI flags\nlet record: RecordConfig | undefined;\nif (values.record || values[\"proxy-only\"]) {\n  const providers: RecordConfig[\"providers\"] = {};\n  if (values[\"provider-openai\"]) providers.openai = values[\"provider-openai\"];\n  if (values[\"provider-anthropic\"]) providers.anthropic = values[\"provider-anthropic\"];\n  if (values[\"provider-gemini\"]) providers.gemini = values[\"provider-gemini\"];\n  if (values[\"provider-vertexai\"]) providers.vertexai = values[\"provider-vertexai\"];\n  if (values[\"provider-bedrock\"]) providers.bedrock = values[\"provider-bedrock\"];\n  if (values[\"provider-azure\"]) providers.azure = values[\"provider-azure\"];\n  if (values[\"provider-ollama\"]) providers.ollama = values[\"provider-ollama\"];\n  if (values[\"provider-cohere\"]) providers.cohere = values[\"provider-cohere\"];\n  if (values[\"provider-openrouter\"]) providers.openrouter = values[\"provider-openrouter\"];\n\n  if (Object.keys(providers).length === 0) {\n    console.error(\n      `Error: --${values[\"proxy-only\"] ? \"proxy-only\" : \"record\"} requires at least one --provider-* flag`,\n    );\n    process.exit(1);\n  }\n\n  // For --record, the first --fixtures value is the base path for the recording\n  // destination and must be a local filesystem path — writing to a URL is not supported.\n  // For --proxy-only, unmatched requests are forwarded without saving, so no writable\n  // destination is required; URL-only --fixtures is valid in that mode.\n  const recordBase = fixtureValues[0];\n  const recordBaseIsUrl = /^https?:\\/\\//i.test(recordBase);\n  if (values.record && recordBaseIsUrl) {\n    console.error(\n      `Error: --record requires a local --fixtures path for the recording destination; got URL ${recordBase}`,\n    );\n    process.exit(1);\n  }\n  record = {\n    providers,\n    // aimock's own upstream keys, sourced from AIMOCK_PROVIDER_*_KEY env vars\n    // (not CLI flags — secrets must not appear in `ps`). Injected on a\n    // fixture-miss passthrough when the caller sent no/dummy credential.\n    providerKeys: readProviderKeysFromEnv(),\n    // In proxy-only mode with only URL sources, fixturePath is never consumed\n    // (recorder.ts skips disk writes when proxyOnly is set). Leave it undefined\n    // rather than resolving a URL string as a filesystem path.\n    fixturePath: recordBaseIsUrl ? undefined : resolve(recordBase, \"recorded\"),\n    proxyOnly: values[\"proxy-only\"],\n    recordFullModelVersion: values[\"record-full-model-version\"],\n    upstreamTimeoutMs,\n    bodyTimeoutMs,\n    maxProxyBufferBytes,\n    maxProxyBufferFrames,\n  };\n} else {\n  // These flags configure upstream proxying — without --record or\n  // --proxy-only they would be parsed and then silently dropped. Routed\n  // through the constructed logger so --log-level is respected.\n  const droppedProviderFlags = (\n    [\n      \"provider-openai\",\n      \"provider-anthropic\",\n      \"provider-gemini\",\n      \"provider-vertexai\",\n      \"provider-bedrock\",\n      \"provider-azure\",\n      \"provider-ollama\",\n      \"provider-cohere\",\n      \"provider-openrouter\",\n    ] as const\n  ).filter((flag) => values[flag] !== undefined);\n  if (droppedProviderFlags.length > 0) {\n    logger.warn(\n      `--${droppedProviderFlags.join(\"/--\")} only apply to --record/--proxy-only upstream proxying — ignored without one of those flags.`,\n    );\n  }\n  if (\n    upstreamTimeoutMs !== undefined ||\n    bodyTimeoutMs !== undefined ||\n    maxProxyBufferBytes !== undefined ||\n    maxProxyBufferFrames !== undefined\n  ) {\n    logger.warn(\n      \"--upstream-timeout-ms/--body-timeout-ms/--max-proxy-buffer-bytes/--max-proxy-buffer-frames only apply to --record/--proxy-only upstream proxying — ignored without one of those flags.\",\n    );\n  }\n}\n\n// Parse AG-UI record/proxy config from CLI flags\nlet aguiMount: { path: string; handler: AGUIMock } | undefined;\nif (values[\"agui-record\"] || values[\"agui-proxy-only\"]) {\n  if (!values[\"agui-upstream\"]) {\n    console.error(\"Error: --agui-record/--agui-proxy-only requires --agui-upstream\");\n    process.exit(1);\n  }\n  // --agui-record writes recorded AG-UI fixtures to disk, so a URL source is unsupported.\n  // --agui-proxy-only forwards without saving, so URL-only --fixtures is valid.\n  const aguiBase = fixtureValues[0];\n  const aguiBaseIsUrl = /^https?:\\/\\//i.test(aguiBase);\n  if (values[\"agui-record\"] && aguiBaseIsUrl) {\n    console.error(\n      `Error: --agui-record requires a local --fixtures path for the recording destination; got URL ${aguiBase}`,\n    );\n    process.exit(1);\n  }\n  const agui = new AGUIMock();\n  agui.enableRecording({\n    upstream: values[\"agui-upstream\"],\n    // In proxy-only mode with a URL-only --fixtures, the AG-UI recorder never\n    // writes to disk (see agui-recorder.ts). Leave fixturePath undefined rather\n    // than resolving a URL as a filesystem path.\n    fixturePath: aguiBaseIsUrl ? undefined : resolve(aguiBase, \"agui-recorded\"),\n    proxyOnly: values[\"agui-proxy-only\"],\n  });\n  aguiMount = { path: \"/agui\", handler: agui };\n}\n\ninterface ResolvedFixtureSource {\n  source: string;\n  path: string;\n  isDir: boolean;\n}\n\nasync function resolveAllFixtureSources(): Promise<ResolvedFixtureSource[]> {\n  const resolved: ResolvedFixtureSource[] = [];\n  for (const value of fixtureValues) {\n    let local;\n    try {\n      local = await resolveFixturesValue(value, {\n        validateOnLoad,\n        logger,\n      });\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      console.error(`Failed to resolve --fixtures value \"${value}\": ${msg}`);\n      process.exit(1);\n    }\n    if (!local.path) {\n      // Remote fetch failed without validate-on-load and no cache — already warned; skip.\n      continue;\n    }\n    try {\n      const stat = statSync(local.path);\n      resolved.push({ source: local.source, path: local.path, isDir: stat.isDirectory() });\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === \"ENOENT\") {\n        console.error(`Fixtures path not found: ${local.path}`);\n      } else {\n        const msg = err instanceof Error ? err.message : String(err);\n        console.error(`Failed to load fixtures from ${local.path}: ${msg}`);\n      }\n      process.exit(1);\n    }\n  }\n  return resolved;\n}\n\nfunction loadSource(source: ResolvedFixtureSource): Fixture[] {\n  return source.isDir\n    ? loadFixturesFromDir(source.path, logger)\n    : loadFixtureFile(source.path, logger);\n}\n\nasync function main() {\n  const sources = await resolveAllFixtureSources();\n\n  const fixtures: Fixture[] = [];\n  for (const src of sources) {\n    fixtures.push(...loadSource(src));\n  }\n\n  if (fixtures.length === 0) {\n    if (validateOnLoad || values.strict) {\n      console.error(\"Error: No fixtures loaded and validation/strict mode is enabled — aborting.\");\n      process.exit(1);\n    }\n    console.warn(\"Warning: No fixtures loaded. The server will return 404 for all requests.\");\n  }\n\n  const sourceLabel = sources.map((s) => s.source).join(\", \") || \"<none>\";\n  logger.info(`Loaded ${fixtures.length} fixture(s) from ${sourceLabel}`);\n\n  // Validate fixtures if requested\n  if (validateOnLoad) {\n    const results = validateFixtures(fixtures);\n    const errors = results.filter((r) => r.severity === \"error\");\n    const warnings = results.filter((r) => r.severity === \"warning\");\n\n    for (const w of warnings) {\n      logger.warn(`Fixture ${w.fixtureIndex}: ${w.message}`);\n    }\n    for (const e of errors) {\n      logger.error(`Fixture ${e.fixtureIndex}: ${e.message}`);\n    }\n\n    if (errors.length > 0) {\n      console.error(`Validation failed: ${errors.length} error(s), ${warnings.length} warning(s)`);\n      process.exit(1);\n    }\n  }\n\n  const mounts = aguiMount ? [aguiMount] : undefined;\n\n  const instance = await createServer(\n    fixtures,\n    {\n      port,\n      host,\n      latency,\n      chunkSize,\n      replaySpeed,\n      logLevel,\n      chaos,\n      metrics: values.metrics,\n      record,\n      strict: values.strict,\n      journalMaxEntries: journalMax,\n      fixtureCountsMaxTestIds: fixtureCountsMax,\n      auth: resolveInboundAuth(selectInboundAuthSource(undefined)).publicConfig,\n    },\n    mounts,\n  );\n\n  logger.info(`aimock server listening on ${instance.url}`);\n\n  // Start file watcher if requested. Only the first local source is watched —\n  // remote URL sources are fetched once at boot and are not monitored.\n  let watcher: { close: () => void } | null = null;\n  if (watchMode) {\n    const primary = sources[0];\n    if (!primary) {\n      logger.warn(\"--watch requested but no resolvable fixture sources; skipping watcher\");\n    } else {\n      const loadFn = (): Fixture[] => loadSource(primary);\n      watcher = watchFixtures(primary.path, fixtures, loadFn, {\n        logger,\n        validate: validateOnLoad,\n        validateFn: validateFixtures,\n      });\n      logger.info(`Watching ${primary.path} for changes`);\n    }\n  }\n\n  function shutdown() {\n    logger.info(\"Shutting down...\");\n    if (watcher) watcher.close();\n    instance.server.close(() => {\n      process.exit(0);\n    });\n  }\n\n  process.on(\"SIGINT\", shutdown);\n  process.on(\"SIGTERM\", shutdown);\n}\n\nmain().catch((err) => {\n  console.error(err);\n  process.exit(1);\n});\n"],"mappings":";;;;;;;;;;;;;;AAcA,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2CX,MAAM;AAER,MAAM,EAAE,WAAW,UAAU;CAC3B,SAAS;EACP,MAAM;GAAE,MAAM;GAAU,OAAO;GAAK,SAAS;GAAQ;EACrD,MAAM;GAAE,MAAM;GAAU,OAAO;GAAK,SAAS;GAAa;EAC1D,UAAU;GAAE,MAAM;GAAU,OAAO;GAAK,UAAU;GAAM;EACxD,SAAS;GAAE,MAAM;GAAU,OAAO;GAAK,SAAS;GAAK;EACrD,cAAc;GAAE,MAAM;GAAU,OAAO;GAAK,SAAS;GAAM;EAC3D,OAAO;GAAE,MAAM;GAAW,OAAO;GAAK,SAAS;GAAO;EACtD,aAAa;GAAE,MAAM;GAAU,SAAS;GAAQ;EAChD,oBAAoB;GAAE,MAAM;GAAW,SAAS;GAAO;EACvD,SAAS;GAAE,MAAM;GAAW,SAAS;GAAO;EAC5C,QAAQ;GAAE,MAAM;GAAW,SAAS;GAAO;EAC3C,6BAA6B;GAAE,MAAM;GAAW,SAAS;GAAO;EAChE,cAAc;GAAE,MAAM;GAAW,SAAS;GAAO;EACjD,QAAQ;GAAE,MAAM;GAAW,SAAS;GAAO;EAC3C,mBAAmB,EAAE,MAAM,UAAU;EACrC,sBAAsB,EAAE,MAAM,UAAU;EACxC,mBAAmB,EAAE,MAAM,UAAU;EACrC,qBAAqB,EAAE,MAAM,UAAU;EACvC,oBAAoB,EAAE,MAAM,UAAU;EACtC,kBAAkB,EAAE,MAAM,UAAU;EACpC,mBAAmB,EAAE,MAAM,UAAU;EACrC,mBAAmB,EAAE,MAAM,UAAU;EACrC,uBAAuB,EAAE,MAAM,UAAU;EACzC,uBAAuB,EAAE,MAAM,UAAU;EACzC,mBAAmB,EAAE,MAAM,UAAU;EACrC,0BAA0B,EAAE,MAAM,UAAU;EAC5C,2BAA2B,EAAE,MAAM,UAAU;EAC7C,eAAe;GAAE,MAAM;GAAW,SAAS;GAAO;EAClD,iBAAiB,EAAE,MAAM,UAAU;EACnC,mBAAmB;GAAE,MAAM;GAAW,SAAS;GAAO;EACtD,gBAAgB;GAAE,MAAM;GAAU,SAAS;GAAO;EAClD,cAAc,EAAE,MAAM,UAAU;EAChC,mBAAmB,EAAE,MAAM,UAAU;EACrC,oBAAoB,EAAE,MAAM,UAAU;EACtC,eAAe;GAAE,MAAM;GAAU,SAAS;GAAQ;EAClD,sBAAsB;GAAE,MAAM;GAAU,SAAS;GAAO;EACxD,MAAM;GAAE,MAAM;GAAW,SAAS;GAAO;EAC1C;CACD,QAAQ;CACT,CAAC;AAEF,IAAI,OAAO,MAAM;AACf,SAAQ,IAAI,KAAK;AACjB,SAAQ,KAAK,EAAE;;AAGjB,MAAM,OAAO,OAAO,OAAO,KAAK;AAChC,MAAM,OAAO,OAAO;AACpB,MAAM,UAAU,OAAO,OAAO,QAAQ;AACtC,MAAM,YAAY,OAAO,OAAO,cAAc;AAC9C,MAAM,gBACJ,OAAO,YAAY,OAAO,SAAS,SAAS,IAAI,OAAO,WAAW,CAAC,aAAa;AAClF,MAAM,YAAY,OAAO;AACzB,MAAM,iBAAiB,OAAO;AAC9B,MAAM,cAAc,OAAO;AAE3B,IAAI,CAAC;CAAC;CAAU;CAAQ;CAAQ;CAAQ,CAAC,SAAS,YAAY,EAAE;AAC9D,SAAQ,MAAM,sBAAsB,YAAY,yCAAyC;AACzF,SAAQ,KAAK,EAAE;;AAEjB,MAAM,WAAW;AAEjB,IAAI,OAAO,MAAM,KAAK,IAAI,OAAO,KAAK,OAAO,OAAO;AAClD,SAAQ,MAAM,iBAAiB,OAAO,OAAO;AAC7C,SAAQ,KAAK,EAAE;;AAGjB,IAAI,OAAO,MAAM,QAAQ,IAAI,UAAU,GAAG;AACxC,SAAQ,MAAM,oBAAoB,OAAO,UAAU;AACnD,SAAQ,KAAK,EAAE;;AAGjB,IAAI,OAAO,MAAM,UAAU,IAAI,YAAY,GAAG;AAC5C,SAAQ,MAAM,uBAAuB,OAAO,gBAAgB;AAC5D,SAAQ,KAAK,EAAE;;AAGjB,MAAM,cAAc,OAAO,OAAO,gBAAgB;AAClD,IAAI,OAAO,MAAM,YAAY,IAAI,eAAe,GAAG;AACjD,SAAQ,MAAM,2CAA2C;AACzD,SAAQ,KAAK,EAAE;;AAGjB,MAAM,aAAa,OAAO,OAAO,eAAe;AAChD,IAAI,OAAO,MAAM,WAAW,IAAI,CAAC,OAAO,UAAU,WAAW,IAAI,aAAa,GAAG;AAC/E,SAAQ,MACN,wBAAwB,OAAO,eAAe,kDAC/C;AACD,SAAQ,KAAK,EAAE;;AAGjB,MAAM,sBAAsB,OAAO;AACnC,MAAM,mBAAmB,OAAO,oBAAoB;AACpD,IAAI,OAAO,MAAM,iBAAiB,IAAI,CAAC,OAAO,UAAU,iBAAiB,IAAI,mBAAmB,GAAG;AACjG,SAAQ,MACN,+BAA+B,oBAAoB,kDACpD;AACD,SAAQ,KAAK,EAAE;;AAGjB,MAAM,uBAAuB,OAAO;AACpC,IAAI;AACJ,IAAI,yBAAyB,QAAW;AACtC,qBAAoB,OAAO,qBAAqB;AAChD,KAAI,CAAC,OAAO,SAAS,kBAAkB,IAAI,qBAAqB,GAAG;AACjE,UAAQ,MACN,gCAAgC,qBAAqB,qCACtD;AACD,UAAQ,KAAK,EAAE;;;AAInB,MAAM,mBAAmB,OAAO;AAChC,IAAI;AACJ,IAAI,qBAAqB,QAAW;AAClC,iBAAgB,OAAO,iBAAiB;AACxC,KAAI,CAAC,OAAO,SAAS,cAAc,IAAI,iBAAiB,GAAG;AACzD,UAAQ,MACN,4BAA4B,iBAAiB,qCAC9C;AACD,UAAQ,KAAK,EAAE;;;AAInB,MAAM,yBAAyB,OAAO;AACtC,IAAI;AACJ,IAAI,2BAA2B,QAAW;AACxC,uBAAsB,OAAO,uBAAuB;AACpD,KAAI,CAAC,OAAO,SAAS,oBAAoB,IAAI,uBAAuB,GAAG;AACrE,UAAQ,MACN,mCAAmC,uBAAuB,qCAC3D;AACD,UAAQ,KAAK,EAAE;;;AAInB,MAAM,0BAA0B,OAAO;AACvC,IAAI;AACJ,IAAI,4BAA4B,QAAW;AACzC,wBAAuB,OAAO,wBAAwB;AACtD,KAAI,CAAC,OAAO,SAAS,qBAAqB,IAAI,wBAAwB,GAAG;AACvE,UAAQ,MACN,oCAAoC,wBAAwB,qCAC7D;AACD,UAAQ,KAAK,EAAE;;;AAInB,MAAM,SAAS,IAAI,OAAO,SAAS;AAGnC,IAAI;AACJ;CACE,MAAM,UAAU,OAAO;CACvB,MAAM,eAAe,OAAO;CAC5B,MAAM,gBAAgB,OAAO;AAE7B,KAAI,YAAY,UAAa,iBAAiB,UAAa,kBAAkB,QAAW;AACtF,UAAQ,EAAE;AACV,MAAI,YAAY,QAAW;GACzB,MAAM,MAAM,WAAW,QAAQ;AAC/B,OAAI,MAAM,IAAI,IAAI,MAAM,KAAK,MAAM,GAAG;AACpC,YAAQ,MAAM,uBAAuB,QAAQ,gBAAgB;AAC7D,YAAQ,KAAK,EAAE;;AAEjB,SAAM,WAAW;;AAEnB,MAAI,iBAAiB,QAAW;GAC9B,MAAM,MAAM,WAAW,aAAa;AACpC,OAAI,MAAM,IAAI,IAAI,MAAM,KAAK,MAAM,GAAG;AACpC,YAAQ,MAAM,4BAA4B,aAAa,gBAAgB;AACvE,YAAQ,KAAK,EAAE;;AAEjB,SAAM,gBAAgB;;AAExB,MAAI,kBAAkB,QAAW;GAC/B,MAAM,MAAM,WAAW,cAAc;AACrC,OAAI,MAAM,IAAI,IAAI,MAAM,KAAK,MAAM,GAAG;AACpC,YAAQ,MAAM,6BAA6B,cAAc,gBAAgB;AACzE,YAAQ,KAAK,EAAE;;AAEjB,SAAM,iBAAiB;;;;AAM7B,IAAI;AACJ,IAAI,OAAO,UAAU,OAAO,eAAe;CACzC,MAAM,YAAuC,EAAE;AAC/C,KAAI,OAAO,mBAAoB,WAAU,SAAS,OAAO;AACzD,KAAI,OAAO,sBAAuB,WAAU,YAAY,OAAO;AAC/D,KAAI,OAAO,mBAAoB,WAAU,SAAS,OAAO;AACzD,KAAI,OAAO,qBAAsB,WAAU,WAAW,OAAO;AAC7D,KAAI,OAAO,oBAAqB,WAAU,UAAU,OAAO;AAC3D,KAAI,OAAO,kBAAmB,WAAU,QAAQ,OAAO;AACvD,KAAI,OAAO,mBAAoB,WAAU,SAAS,OAAO;AACzD,KAAI,OAAO,mBAAoB,WAAU,SAAS,OAAO;AACzD,KAAI,OAAO,uBAAwB,WAAU,aAAa,OAAO;AAEjE,KAAI,OAAO,KAAK,UAAU,CAAC,WAAW,GAAG;AACvC,UAAQ,MACN,YAAY,OAAO,gBAAgB,eAAe,SAAS,0CAC5D;AACD,UAAQ,KAAK,EAAE;;CAOjB,MAAM,aAAa,cAAc;CACjC,MAAM,kBAAkB,gBAAgB,KAAK,WAAW;AACxD,KAAI,OAAO,UAAU,iBAAiB;AACpC,UAAQ,MACN,2FAA2F,aAC5F;AACD,UAAQ,KAAK,EAAE;;AAEjB,UAAS;EACP;EAIA,cAAc,yBAAyB;EAIvC,aAAa,kBAAkB,SAAY,QAAQ,YAAY,WAAW;EAC1E,WAAW,OAAO;EAClB,wBAAwB,OAAO;EAC/B;EACA;EACA;EACA;EACD;OACI;CAIL,MAAM,uBACJ;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CACD,QAAQ,SAAS,OAAO,UAAU,OAAU;AAC9C,KAAI,qBAAqB,SAAS,EAChC,QAAO,KACL,KAAK,qBAAqB,KAAK,MAAM,CAAC,8FACvC;AAEH,KACE,sBAAsB,UACtB,kBAAkB,UAClB,wBAAwB,UACxB,yBAAyB,OAEzB,QAAO,KACL,yLACD;;AAKL,IAAI;AACJ,IAAI,OAAO,kBAAkB,OAAO,oBAAoB;AACtD,KAAI,CAAC,OAAO,kBAAkB;AAC5B,UAAQ,MAAM,kEAAkE;AAChF,UAAQ,KAAK,EAAE;;CAIjB,MAAM,WAAW,cAAc;CAC/B,MAAM,gBAAgB,gBAAgB,KAAK,SAAS;AACpD,KAAI,OAAO,kBAAkB,eAAe;AAC1C,UAAQ,MACN,gGAAgG,WACjG;AACD,UAAQ,KAAK,EAAE;;CAEjB,MAAM,OAAO,IAAI,UAAU;AAC3B,MAAK,gBAAgB;EACnB,UAAU,OAAO;EAIjB,aAAa,gBAAgB,SAAY,QAAQ,UAAU,gBAAgB;EAC3E,WAAW,OAAO;EACnB,CAAC;AACF,aAAY;EAAE,MAAM;EAAS,SAAS;EAAM;;AAS9C,eAAe,2BAA6D;CAC1E,MAAM,WAAoC,EAAE;AAC5C,MAAK,MAAM,SAAS,eAAe;EACjC,IAAI;AACJ,MAAI;AACF,WAAQ,MAAM,qBAAqB,OAAO;IACxC;IACA;IACD,CAAC;WACK,KAAK;GACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,WAAQ,MAAM,uCAAuC,MAAM,KAAK,MAAM;AACtE,WAAQ,KAAK,EAAE;;AAEjB,MAAI,CAAC,MAAM,KAET;AAEF,MAAI;GACF,MAAM,OAAO,SAAS,MAAM,KAAK;AACjC,YAAS,KAAK;IAAE,QAAQ,MAAM;IAAQ,MAAM,MAAM;IAAM,OAAO,KAAK,aAAa;IAAE,CAAC;WAC7E,KAAK;AACZ,OAAK,IAA8B,SAAS,SAC1C,SAAQ,MAAM,4BAA4B,MAAM,OAAO;QAClD;IACL,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,YAAQ,MAAM,gCAAgC,MAAM,KAAK,IAAI,MAAM;;AAErE,WAAQ,KAAK,EAAE;;;AAGnB,QAAO;;AAGT,SAAS,WAAW,QAA0C;AAC5D,QAAO,OAAO,QACV,oBAAoB,OAAO,MAAM,OAAO,GACxC,gBAAgB,OAAO,MAAM,OAAO;;AAG1C,eAAe,OAAO;CACpB,MAAM,UAAU,MAAM,0BAA0B;CAEhD,MAAM,WAAsB,EAAE;AAC9B,MAAK,MAAM,OAAO,QAChB,UAAS,KAAK,GAAG,WAAW,IAAI,CAAC;AAGnC,KAAI,SAAS,WAAW,GAAG;AACzB,MAAI,kBAAkB,OAAO,QAAQ;AACnC,WAAQ,MAAM,8EAA8E;AAC5F,WAAQ,KAAK,EAAE;;AAEjB,UAAQ,KAAK,4EAA4E;;CAG3F,MAAM,cAAc,QAAQ,KAAK,MAAM,EAAE,OAAO,CAAC,KAAK,KAAK,IAAI;AAC/D,QAAO,KAAK,UAAU,SAAS,OAAO,mBAAmB,cAAc;AAGvE,KAAI,gBAAgB;EAClB,MAAM,UAAU,iBAAiB,SAAS;EAC1C,MAAM,SAAS,QAAQ,QAAQ,MAAM,EAAE,aAAa,QAAQ;EAC5D,MAAM,WAAW,QAAQ,QAAQ,MAAM,EAAE,aAAa,UAAU;AAEhE,OAAK,MAAM,KAAK,SACd,QAAO,KAAK,WAAW,EAAE,aAAa,IAAI,EAAE,UAAU;AAExD,OAAK,MAAM,KAAK,OACd,QAAO,MAAM,WAAW,EAAE,aAAa,IAAI,EAAE,UAAU;AAGzD,MAAI,OAAO,SAAS,GAAG;AACrB,WAAQ,MAAM,sBAAsB,OAAO,OAAO,aAAa,SAAS,OAAO,aAAa;AAC5F,WAAQ,KAAK,EAAE;;;CAInB,MAAM,SAAS,YAAY,CAAC,UAAU,GAAG;CAEzC,MAAM,WAAW,MAAM,aACrB,UACA;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA,SAAS,OAAO;EAChB;EACA,QAAQ,OAAO;EACf,mBAAmB;EACnB,yBAAyB;EACzB,MAAM,mBAAmB,wBAAwB,OAAU,CAAC,CAAC;EAC9D,EACD,OACD;AAED,QAAO,KAAK,8BAA8B,SAAS,MAAM;CAIzD,IAAI,UAAwC;AAC5C,KAAI,WAAW;EACb,MAAM,UAAU,QAAQ;AACxB,MAAI,CAAC,QACH,QAAO,KAAK,wEAAwE;OAC/E;GACL,MAAM,eAA0B,WAAW,QAAQ;AACnD,aAAU,cAAc,QAAQ,MAAM,UAAU,QAAQ;IACtD;IACA,UAAU;IACV,YAAY;IACb,CAAC;AACF,UAAO,KAAK,YAAY,QAAQ,KAAK,cAAc;;;CAIvD,SAAS,WAAW;AAClB,SAAO,KAAK,mBAAmB;AAC/B,MAAI,QAAS,SAAQ,OAAO;AAC5B,WAAS,OAAO,YAAY;AAC1B,WAAQ,KAAK,EAAE;IACf;;AAGJ,SAAQ,GAAG,UAAU,SAAS;AAC9B,SAAQ,GAAG,WAAW,SAAS;;AAGjC,MAAM,CAAC,OAAO,QAAQ;AACpB,SAAQ,MAAM,IAAI;AAClB,SAAQ,KAAK,EAAE;EACf"}

package/dist/config-loader.cjs

@@ -1,4 +1,5 @@
 const require_runtime = require('./_virtual/_rolldown/runtime.cjs');
+const require_api_key_auth = require('./api-key-auth.cjs');
 const require_a2a_mock = require('./a2a-mock.cjs');
 const require_agui_handler = require('./agui-handler.cjs');
 const require_logger = require('./logger.cjs');
@@ -23,7 +24,8 @@ async function startFromConfig(config, overrides) {
 		logger.warn(`llm.replaySpeed must be a positive number, got ${replaySpeed}. Ignoring.`);
 		replaySpeed = void 0;
 	}
-	const llmock = new require_llmock.LLMock({
+	const resolvedAuth = require_api_key_auth.resolveInboundAuth(require_api_key_auth.selectInboundAuthSource(config.auth));
+	const llmock = require_llmock.createLLMockWithResolvedAuth({
 		port: overrides?.port ?? config.port ?? 0,
 		host: overrides?.host ?? config.host ?? "127.0.0.1",
 		latency: config.llm?.latency,
@@ -34,7 +36,7 @@ async function startFromConfig(config, overrides) {
 		record: config.llm?.record,
 		metrics: config.metrics,
 		strict: config.strict
-	});
+	}, resolvedAuth);
 	if (config.llm?.fixtures) {
 		const fixturePath = node_path.resolve(config.llm.fixtures);
 		if (node_fs.statSync(fixturePath).isDirectory()) llmock.loadFixtureDir(fixturePath);