@copilotkit/aimock 1.40.0 → 1.42.0

package/dist/provider-auth.cjs

@@ -22,6 +22,7 @@ const PROVIDER_AUTH_SCHEMES = {
 	openrouter: { kind: "bearer" },
 	cohere: { kind: "bearer" },
 	grok: { kind: "bearer" },
+	byteplus: { kind: "bearer" },
 	ollama: { kind: "bearer" },
 	anthropic: { kind: "x-api-key" },
 	gemini: { kind: "x-goog-api-key" },
@@ -175,6 +176,7 @@ function readProviderKeysFromEnv(env = process.env) {
 	if (env.AIMOCK_PROVIDER_OPENROUTER_KEY) keys.openrouter = env.AIMOCK_PROVIDER_OPENROUTER_KEY;
 	if (env.AIMOCK_PROVIDER_COHERE_KEY) keys.cohere = env.AIMOCK_PROVIDER_COHERE_KEY;
 	if (env.AIMOCK_PROVIDER_GROK_KEY) keys.grok = env.AIMOCK_PROVIDER_GROK_KEY;
+	if (env.AIMOCK_PROVIDER_BYTEPLUS_KEY) keys.byteplus = env.AIMOCK_PROVIDER_BYTEPLUS_KEY;
 	if (env.AIMOCK_PROVIDER_OLLAMA_KEY) keys.ollama = env.AIMOCK_PROVIDER_OLLAMA_KEY;
 	if (env.AIMOCK_PROVIDER_VEO_KEY) keys.veo = env.AIMOCK_PROVIDER_VEO_KEY;
 	if (env.AIMOCK_PROVIDER_AZURE_KEY) keys.azure = env.AIMOCK_PROVIDER_AZURE_KEY;

package/dist/provider-auth.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"provider-auth.cjs","names":[],"sources":["../src/provider-auth.ts"],"sourcesContent":["import type { RecordProviderKey } from \"./types.js\";\n\n/**\n * Default marker prefix identifying a \"dummy\" credential that a caller sends\n * only to satisfy an SDK's non-empty API-key requirement (e.g. `sk-aimock-...`).\n * A caller credential that is absent OR begins with this prefix is treated as a\n * placeholder that aimock is free to override with its own built-in upstream key.\n * A caller credential that does NOT begin with this prefix is treated as a real\n * key and forwarded verbatim (the caller overrides aimock).\n *\n * Overridable via the `AIMOCK_DUMMY_KEY_MARKER` env var for setups that mint\n * placeholder keys under a different prefix.\n */\nexport const DEFAULT_DUMMY_KEY_MARKER = \"sk-aimock-\";\n\n/** Resolve the active dummy-key marker, honoring the env override. */\nexport function getDummyKeyMarker(): string {\n  const override = process.env.AIMOCK_DUMMY_KEY_MARKER;\n  return override && override.length > 0 ? override : DEFAULT_DUMMY_KEY_MARKER;\n}\n\n/**\n * How a given provider carries its API credential on the wire. aimock injects\n * its built-in key using the provider's native scheme so the upstream accepts\n * it. Providers whose auth is a signed/exchanged credential (Bedrock SigV4,\n * Vertex AI OAuth) are deliberately absent — those are NOT simple static-key\n * schemes, so aimock never rewrites their auth and always forwards the caller's\n * credential unchanged.\n *\n * Scheme kinds (all static long-lived keys):\n *   - bearer          `Authorization: Bearer <key>`  (OpenAI, OpenRouter, Cohere, Grok/xAI, Ollama)\n *   - fal-key         `Authorization: Key <key>`     (fal.ai — note the `Key ` prefix, NOT `Bearer`)\n *   - x-api-key       `x-api-key: <key>`             (Anthropic)\n *   - x-goog-api-key  `x-goog-api-key: <key>`        (Gemini, Gemini Interactions, Veo)\n *   - api-key         `api-key: <key>`               (Azure OpenAI static-key auth)\n *   - xi-api-key      `xi-api-key: <key>`            (ElevenLabs)\n *\n * Note on Azure: Azure OpenAI also supports Microsoft Entra ID `Authorization:\n * Bearer <token>` OAuth. aimock only ever injects the static `api-key` header,\n * and a real Entra bearer token from the caller is never dummy-prefixed, so it\n * is always forwarded verbatim (the caller overrides aimock).\n */\nexport type AuthScheme =\n  | { kind: \"bearer\" } // Authorization: Bearer <key>\n  | { kind: \"fal-key\" } // Authorization: Key <key>\n  | { kind: \"x-api-key\" } // x-api-key: <key>\n  | { kind: \"x-goog-api-key\" } // x-goog-api-key: <key>\n  | { kind: \"api-key\" } // api-key: <key>\n  | { kind: \"xi-api-key\" }; // xi-api-key: <key>\n\nconst PROVIDER_AUTH_SCHEMES: Partial<Record<RecordProviderKey, AuthScheme>> = {\n  // Bearer-token providers.\n  openai: { kind: \"bearer\" },\n  openrouter: { kind: \"bearer\" },\n  cohere: { kind: \"bearer\" },\n  grok: { kind: \"bearer\" }, // xAI\n  ollama: { kind: \"bearer\" }, // Ollama Cloud / bearer-gated Ollama servers\n  // Anthropic.\n  anthropic: { kind: \"x-api-key\" },\n  // Google (Gemini + Veo) use the x-goog-api-key header scheme.\n  gemini: { kind: \"x-goog-api-key\" },\n  \"gemini-interactions\": { kind: \"x-goog-api-key\" },\n  veo: { kind: \"x-goog-api-key\" },\n  // Azure OpenAI static-key auth.\n  azure: { kind: \"api-key\" },\n  // ElevenLabs.\n  elevenlabs: { kind: \"xi-api-key\" },\n  // fal.ai — uses the `Key ` prefix on Authorization, NOT `Bearer `.\n  fal: { kind: \"fal-key\" },\n};\n\nexport function hasStaticProviderAuthScheme(providerKey: RecordProviderKey): boolean {\n  return PROVIDER_AUTH_SCHEMES[providerKey] !== undefined;\n}\n\n/** Force a known provider credential onto an already-scrubbed outbound map. */\nexport function applyConfiguredProviderAuth(\n  forwardHeaders: Record<string, string>,\n  target: URL,\n  providerKey: RecordProviderKey,\n  providerCredential: string,\n): boolean {\n  void target;\n  const scheme = PROVIDER_AUTH_SCHEMES[providerKey];\n  if (!scheme) return false;\n  switch (scheme.kind) {\n    case \"bearer\":\n      takeHeader(forwardHeaders, \"authorization\");\n      forwardHeaders.Authorization = `Bearer ${providerCredential}`;\n      break;\n    case \"fal-key\":\n      takeHeader(forwardHeaders, \"authorization\");\n      forwardHeaders.Authorization = `Key ${providerCredential}`;\n      break;\n    default:\n      takeHeader(forwardHeaders, authHeaderName(scheme));\n      forwardHeaders[authHeaderName(scheme)] = providerCredential;\n  }\n  return true;\n}\n\n/**\n * Case-insensitively delete a header from a forward-header map, returning the\n * value that was present (if any). Header maps preserve the original casing of\n * incoming headers, so we can't assume a canonical key.\n */\nfunction takeHeader(headers: Record<string, string>, name: string): string | undefined {\n  const lowerName = name.toLowerCase();\n  let found: string | undefined;\n  for (const key of Object.keys(headers)) {\n    if (key.toLowerCase() === lowerName) {\n      found = headers[key];\n      delete headers[key];\n    }\n  }\n  return found;\n}\n\n/**\n * Extract the caller's credential value for a given auth scheme from the\n * forwarded headers, if present. For bearer, strips the `Bearer ` prefix.\n */\nfunction readCallerCredential(\n  headers: Record<string, string>,\n  scheme: AuthScheme,\n): string | undefined {\n  if (scheme.kind === \"bearer\" || scheme.kind === \"fal-key\") {\n    const raw = scanHeader(headers, \"authorization\");\n    if (raw === undefined) return undefined;\n    // Strip the scheme prefix (`Bearer ` for bearer, `Key ` for fal) if present,\n    // otherwise treat the whole value as the credential.\n    const prefix = scheme.kind === \"fal-key\" ? \"Key\" : \"Bearer\";\n    const match = new RegExp(`^\\\\s*${prefix}\\\\s+(.+)$`, \"i\").exec(raw);\n    return match ? match[1].trim() : raw.trim();\n  }\n  return scanHeader(headers, authHeaderName(scheme));\n}\n\n/**\n * The wire header name a non-Authorization scheme carries its credential in.\n * (bearer/fal-key both use `Authorization` and are handled separately.)\n */\nfunction authHeaderName(scheme: AuthScheme): string {\n  switch (scheme.kind) {\n    case \"x-api-key\":\n      return \"x-api-key\";\n    case \"x-goog-api-key\":\n      return \"x-goog-api-key\";\n    case \"api-key\":\n      return \"api-key\";\n    case \"xi-api-key\":\n      return \"xi-api-key\";\n    case \"bearer\":\n    case \"fal-key\":\n      return \"authorization\";\n  }\n}\n\n/** Case-insensitive header lookup that does not mutate the map. */\nfunction scanHeader(headers: Record<string, string>, name: string): string | undefined {\n  const lowerName = name.toLowerCase();\n  for (const key of Object.keys(headers)) {\n    if (key.toLowerCase() === lowerName) return headers[key];\n  }\n  return undefined;\n}\n\n/**\n * Decide whether aimock should override the caller's credential with its own\n * built-in key. Override when the caller sent no credential OR sent a dummy\n * placeholder (prefixed with the active marker). A real caller key is left\n * untouched so the caller can always override aimock.\n */\nfunction shouldOverride(callerCredential: string | undefined, marker: string): boolean {\n  if (callerCredential === undefined || callerCredential.length === 0) return true;\n  return callerCredential.startsWith(marker);\n}\n\n/**\n * Inject aimock's built-in upstream credential into the forwarded headers when\n * appropriate (opt-in, backward-compatible). Mutates `forwardHeaders` in place\n * and may mutate `target` (query-param schemes; none currently).\n *\n * Precedence:\n *   - No built-in key configured for this provider    → no-op (forward verbatim).\n *   - Provider not a static-key scheme                → no-op (Bedrock SigV4 / Vertex AI OAuth).\n *   - Caller credential absent or dummy-prefixed      → inject built-in key.\n *   - Caller credential is a real key                 → forward it unchanged.\n *\n * @param forwardHeaders headers already built by buildForwardHeaders(req)\n * @param target upstream URL (reserved for query-param auth schemes)\n * @param providerKey which provider this request is routed to\n * @param builtinKey aimock's configured key for this provider (if any)\n */\nexport function applyProviderAuth(\n  forwardHeaders: Record<string, string>,\n  target: URL,\n  providerKey: RecordProviderKey,\n  builtinKey: string | undefined,\n): void {\n  void target; // reserved for future query-param schemes (e.g. Gemini ?key=)\n  if (!builtinKey) return; // feature inert for this provider\n\n  const scheme = PROVIDER_AUTH_SCHEMES[providerKey];\n  if (!scheme) return; // signed/OAuth provider — never rewrite auth\n\n  const marker = getDummyKeyMarker();\n  const callerCredential = readCallerCredential(forwardHeaders, scheme);\n  if (!shouldOverride(callerCredential, marker)) return; // caller sent a real key\n\n  // Strip any existing auth headers for this scheme (across casings) before\n  // setting aimock's key, so a dummy caller key can't linger alongside ours.\n  switch (scheme.kind) {\n    case \"bearer\":\n      takeHeader(forwardHeaders, \"authorization\");\n      forwardHeaders[\"Authorization\"] = `Bearer ${builtinKey}`;\n      break;\n    case \"fal-key\":\n      takeHeader(forwardHeaders, \"authorization\");\n      forwardHeaders[\"Authorization\"] = `Key ${builtinKey}`;\n      break;\n    case \"x-api-key\":\n      takeHeader(forwardHeaders, \"x-api-key\");\n      forwardHeaders[\"x-api-key\"] = builtinKey;\n      break;\n    case \"x-goog-api-key\":\n      takeHeader(forwardHeaders, \"x-goog-api-key\");\n      forwardHeaders[\"x-goog-api-key\"] = builtinKey;\n      break;\n    case \"api-key\":\n      takeHeader(forwardHeaders, \"api-key\");\n      forwardHeaders[\"api-key\"] = builtinKey;\n      break;\n    case \"xi-api-key\":\n      takeHeader(forwardHeaders, \"xi-api-key\");\n      forwardHeaders[\"xi-api-key\"] = builtinKey;\n      break;\n  }\n}\n\n/**\n * Read per-provider built-in keys from the environment. Returns undefined when\n * no provider key is configured so the feature stays fully inert by default.\n *\n * Each wired static-key provider reads `AIMOCK_PROVIDER_<PROVIDER>_KEY`. An\n * empty-string value is treated as unset (existing truthiness pattern), keeping\n * the feature inert. `gemini-interactions` is not read here: it reuses the\n * Gemini key via the lookup-key remap in `proxyAndRecord`. Signed/OAuth\n * providers (`bedrock`, `vertexai`) have no env var — aimock never rewrites\n * their auth.\n */\nexport function readProviderKeysFromEnv(\n  env: NodeJS.ProcessEnv = process.env,\n): Partial<Record<RecordProviderKey, string>> | undefined {\n  const keys: Partial<Record<RecordProviderKey, string>> = {};\n  if (env.AIMOCK_PROVIDER_OPENAI_KEY) keys.openai = env.AIMOCK_PROVIDER_OPENAI_KEY;\n  if (env.AIMOCK_PROVIDER_ANTHROPIC_KEY) keys.anthropic = env.AIMOCK_PROVIDER_ANTHROPIC_KEY;\n  if (env.AIMOCK_PROVIDER_GEMINI_KEY) keys.gemini = env.AIMOCK_PROVIDER_GEMINI_KEY;\n  if (env.AIMOCK_PROVIDER_OPENROUTER_KEY) keys.openrouter = env.AIMOCK_PROVIDER_OPENROUTER_KEY;\n  if (env.AIMOCK_PROVIDER_COHERE_KEY) keys.cohere = env.AIMOCK_PROVIDER_COHERE_KEY;\n  if (env.AIMOCK_PROVIDER_GROK_KEY) keys.grok = env.AIMOCK_PROVIDER_GROK_KEY;\n  if (env.AIMOCK_PROVIDER_OLLAMA_KEY) keys.ollama = env.AIMOCK_PROVIDER_OLLAMA_KEY;\n  if (env.AIMOCK_PROVIDER_VEO_KEY) keys.veo = env.AIMOCK_PROVIDER_VEO_KEY;\n  if (env.AIMOCK_PROVIDER_AZURE_KEY) keys.azure = env.AIMOCK_PROVIDER_AZURE_KEY;\n  if (env.AIMOCK_PROVIDER_ELEVENLABS_KEY) keys.elevenlabs = env.AIMOCK_PROVIDER_ELEVENLABS_KEY;\n  if (env.AIMOCK_PROVIDER_FAL_KEY) keys.fal = env.AIMOCK_PROVIDER_FAL_KEY;\n  return Object.keys(keys).length > 0 ? keys : undefined;\n}\n"],"mappings":";;;;;;;;;;;;;AAaA,MAAa,2BAA2B;;AAGxC,SAAgB,oBAA4B;CAC1C,MAAM,WAAW,QAAQ,IAAI;AAC7B,QAAO,YAAY,SAAS,SAAS,IAAI,WAAW;;AAgCtD,MAAM,wBAAwE;CAE5E,QAAQ,EAAE,MAAM,UAAU;CAC1B,YAAY,EAAE,MAAM,UAAU;CAC9B,QAAQ,EAAE,MAAM,UAAU;CAC1B,MAAM,EAAE,MAAM,UAAU;CACxB,QAAQ,EAAE,MAAM,UAAU;CAE1B,WAAW,EAAE,MAAM,aAAa;CAEhC,QAAQ,EAAE,MAAM,kBAAkB;CAClC,uBAAuB,EAAE,MAAM,kBAAkB;CACjD,KAAK,EAAE,MAAM,kBAAkB;CAE/B,OAAO,EAAE,MAAM,WAAW;CAE1B,YAAY,EAAE,MAAM,cAAc;CAElC,KAAK,EAAE,MAAM,WAAW;CACzB;;AAOD,SAAgB,4BACd,gBACA,QACA,aACA,oBACS;CAET,MAAM,SAAS,sBAAsB;AACrC,KAAI,CAAC,OAAQ,QAAO;AACpB,SAAQ,OAAO,MAAf;EACE,KAAK;AACH,cAAW,gBAAgB,gBAAgB;AAC3C,kBAAe,gBAAgB,UAAU;AACzC;EACF,KAAK;AACH,cAAW,gBAAgB,gBAAgB;AAC3C,kBAAe,gBAAgB,OAAO;AACtC;EACF;AACE,cAAW,gBAAgB,eAAe,OAAO,CAAC;AAClD,kBAAe,eAAe,OAAO,IAAI;;AAE7C,QAAO;;;;;;;AAQT,SAAS,WAAW,SAAiC,MAAkC;CACrF,MAAM,YAAY,KAAK,aAAa;CACpC,IAAI;AACJ,MAAK,MAAM,OAAO,OAAO,KAAK,QAAQ,CACpC,KAAI,IAAI,aAAa,KAAK,WAAW;AACnC,UAAQ,QAAQ;AAChB,SAAO,QAAQ;;AAGnB,QAAO;;;;;;AAOT,SAAS,qBACP,SACA,QACoB;AACpB,KAAI,OAAO,SAAS,YAAY,OAAO,SAAS,WAAW;EACzD,MAAM,MAAM,WAAW,SAAS,gBAAgB;AAChD,MAAI,QAAQ,OAAW,QAAO;EAG9B,MAAM,SAAS,OAAO,SAAS,YAAY,QAAQ;EACnD,MAAM,QAAQ,IAAI,OAAO,QAAQ,OAAO,YAAY,IAAI,CAAC,KAAK,IAAI;AAClE,SAAO,QAAQ,MAAM,GAAG,MAAM,GAAG,IAAI,MAAM;;AAE7C,QAAO,WAAW,SAAS,eAAe,OAAO,CAAC;;;;;;AAOpD,SAAS,eAAe,QAA4B;AAClD,SAAQ,OAAO,MAAf;EACE,KAAK,YACH,QAAO;EACT,KAAK,iBACH,QAAO;EACT,KAAK,UACH,QAAO;EACT,KAAK,aACH,QAAO;EACT,KAAK;EACL,KAAK,UACH,QAAO;;;;AAKb,SAAS,WAAW,SAAiC,MAAkC;CACrF,MAAM,YAAY,KAAK,aAAa;AACpC,MAAK,MAAM,OAAO,OAAO,KAAK,QAAQ,CACpC,KAAI,IAAI,aAAa,KAAK,UAAW,QAAO,QAAQ;;;;;;;;AAWxD,SAAS,eAAe,kBAAsC,QAAyB;AACrF,KAAI,qBAAqB,UAAa,iBAAiB,WAAW,EAAG,QAAO;AAC5E,QAAO,iBAAiB,WAAW,OAAO;;;;;;;;;;;;;;;;;;AAmB5C,SAAgB,kBACd,gBACA,QACA,aACA,YACM;AAEN,KAAI,CAAC,WAAY;CAEjB,MAAM,SAAS,sBAAsB;AACrC,KAAI,CAAC,OAAQ;CAEb,MAAM,SAAS,mBAAmB;AAElC,KAAI,CAAC,eADoB,qBAAqB,gBAAgB,OAAO,EAC/B,OAAO,CAAE;AAI/C,SAAQ,OAAO,MAAf;EACE,KAAK;AACH,cAAW,gBAAgB,gBAAgB;AAC3C,kBAAe,mBAAmB,UAAU;AAC5C;EACF,KAAK;AACH,cAAW,gBAAgB,gBAAgB;AAC3C,kBAAe,mBAAmB,OAAO;AACzC;EACF,KAAK;AACH,cAAW,gBAAgB,YAAY;AACvC,kBAAe,eAAe;AAC9B;EACF,KAAK;AACH,cAAW,gBAAgB,iBAAiB;AAC5C,kBAAe,oBAAoB;AACnC;EACF,KAAK;AACH,cAAW,gBAAgB,UAAU;AACrC,kBAAe,aAAa;AAC5B;EACF,KAAK;AACH,cAAW,gBAAgB,aAAa;AACxC,kBAAe,gBAAgB;AAC/B;;;;;;;;;;;;;;AAeN,SAAgB,wBACd,MAAyB,QAAQ,KACuB;CACxD,MAAM,OAAmD,EAAE;AAC3D,KAAI,IAAI,2BAA4B,MAAK,SAAS,IAAI;AACtD,KAAI,IAAI,8BAA+B,MAAK,YAAY,IAAI;AAC5D,KAAI,IAAI,2BAA4B,MAAK,SAAS,IAAI;AACtD,KAAI,IAAI,+BAAgC,MAAK,aAAa,IAAI;AAC9D,KAAI,IAAI,2BAA4B,MAAK,SAAS,IAAI;AACtD,KAAI,IAAI,yBAA0B,MAAK,OAAO,IAAI;AAClD,KAAI,IAAI,2BAA4B,MAAK,SAAS,IAAI;AACtD,KAAI,IAAI,wBAAyB,MAAK,MAAM,IAAI;AAChD,KAAI,IAAI,0BAA2B,MAAK,QAAQ,IAAI;AACpD,KAAI,IAAI,+BAAgC,MAAK,aAAa,IAAI;AAC9D,KAAI,IAAI,wBAAyB,MAAK,MAAM,IAAI;AAChD,QAAO,OAAO,KAAK,KAAK,CAAC,SAAS,IAAI,OAAO"}
+{"version":3,"file":"provider-auth.cjs","names":[],"sources":["../src/provider-auth.ts"],"sourcesContent":["import type { RecordProviderKey } from \"./types.js\";\n\n/**\n * Default marker prefix identifying a \"dummy\" credential that a caller sends\n * only to satisfy an SDK's non-empty API-key requirement (e.g. `sk-aimock-...`).\n * A caller credential that is absent OR begins with this prefix is treated as a\n * placeholder that aimock is free to override with its own built-in upstream key.\n * A caller credential that does NOT begin with this prefix is treated as a real\n * key and forwarded verbatim (the caller overrides aimock).\n *\n * Overridable via the `AIMOCK_DUMMY_KEY_MARKER` env var for setups that mint\n * placeholder keys under a different prefix.\n */\nexport const DEFAULT_DUMMY_KEY_MARKER = \"sk-aimock-\";\n\n/** Resolve the active dummy-key marker, honoring the env override. */\nexport function getDummyKeyMarker(): string {\n  const override = process.env.AIMOCK_DUMMY_KEY_MARKER;\n  return override && override.length > 0 ? override : DEFAULT_DUMMY_KEY_MARKER;\n}\n\n/**\n * How a given provider carries its API credential on the wire. aimock injects\n * its built-in key using the provider's native scheme so the upstream accepts\n * it. Providers whose auth is a signed/exchanged credential (Bedrock SigV4,\n * Vertex AI OAuth) are deliberately absent — those are NOT simple static-key\n * schemes, so aimock never rewrites their auth and always forwards the caller's\n * credential unchanged.\n *\n * Scheme kinds (all static long-lived keys):\n *   - bearer          `Authorization: Bearer <key>`  (OpenAI, OpenRouter, Cohere, Grok/xAI, BytePlus Ark, Ollama)\n *   - fal-key         `Authorization: Key <key>`     (fal.ai — note the `Key ` prefix, NOT `Bearer`)\n *   - x-api-key       `x-api-key: <key>`             (Anthropic)\n *   - x-goog-api-key  `x-goog-api-key: <key>`        (Gemini, Gemini Interactions, Veo)\n *   - api-key         `api-key: <key>`               (Azure OpenAI static-key auth)\n *   - xi-api-key      `xi-api-key: <key>`            (ElevenLabs)\n *\n * Note on Azure: Azure OpenAI also supports Microsoft Entra ID `Authorization:\n * Bearer <token>` OAuth. aimock only ever injects the static `api-key` header,\n * and a real Entra bearer token from the caller is never dummy-prefixed, so it\n * is always forwarded verbatim (the caller overrides aimock).\n */\nexport type AuthScheme =\n  | { kind: \"bearer\" } // Authorization: Bearer <key>\n  | { kind: \"fal-key\" } // Authorization: Key <key>\n  | { kind: \"x-api-key\" } // x-api-key: <key>\n  | { kind: \"x-goog-api-key\" } // x-goog-api-key: <key>\n  | { kind: \"api-key\" } // api-key: <key>\n  | { kind: \"xi-api-key\" }; // xi-api-key: <key>\n\nconst PROVIDER_AUTH_SCHEMES: Partial<Record<RecordProviderKey, AuthScheme>> = {\n  // Bearer-token providers.\n  openai: { kind: \"bearer\" },\n  openrouter: { kind: \"bearer\" },\n  cohere: { kind: \"bearer\" },\n  grok: { kind: \"bearer\" }, // xAI\n  byteplus: { kind: \"bearer\" }, // BytePlus Ark (ModelArk) — Authorization: Bearer $ARK_API_KEY\n  ollama: { kind: \"bearer\" }, // Ollama Cloud / bearer-gated Ollama servers\n  // Anthropic.\n  anthropic: { kind: \"x-api-key\" },\n  // Google (Gemini + Veo) use the x-goog-api-key header scheme.\n  gemini: { kind: \"x-goog-api-key\" },\n  \"gemini-interactions\": { kind: \"x-goog-api-key\" },\n  veo: { kind: \"x-goog-api-key\" },\n  // Azure OpenAI static-key auth.\n  azure: { kind: \"api-key\" },\n  // ElevenLabs.\n  elevenlabs: { kind: \"xi-api-key\" },\n  // fal.ai — uses the `Key ` prefix on Authorization, NOT `Bearer `.\n  fal: { kind: \"fal-key\" },\n};\n\nexport function hasStaticProviderAuthScheme(providerKey: RecordProviderKey): boolean {\n  return PROVIDER_AUTH_SCHEMES[providerKey] !== undefined;\n}\n\n/** Force a known provider credential onto an already-scrubbed outbound map. */\nexport function applyConfiguredProviderAuth(\n  forwardHeaders: Record<string, string>,\n  target: URL,\n  providerKey: RecordProviderKey,\n  providerCredential: string,\n): boolean {\n  void target;\n  const scheme = PROVIDER_AUTH_SCHEMES[providerKey];\n  if (!scheme) return false;\n  switch (scheme.kind) {\n    case \"bearer\":\n      takeHeader(forwardHeaders, \"authorization\");\n      forwardHeaders.Authorization = `Bearer ${providerCredential}`;\n      break;\n    case \"fal-key\":\n      takeHeader(forwardHeaders, \"authorization\");\n      forwardHeaders.Authorization = `Key ${providerCredential}`;\n      break;\n    default:\n      takeHeader(forwardHeaders, authHeaderName(scheme));\n      forwardHeaders[authHeaderName(scheme)] = providerCredential;\n  }\n  return true;\n}\n\n/**\n * Case-insensitively delete a header from a forward-header map, returning the\n * value that was present (if any). Header maps preserve the original casing of\n * incoming headers, so we can't assume a canonical key.\n */\nfunction takeHeader(headers: Record<string, string>, name: string): string | undefined {\n  const lowerName = name.toLowerCase();\n  let found: string | undefined;\n  for (const key of Object.keys(headers)) {\n    if (key.toLowerCase() === lowerName) {\n      found = headers[key];\n      delete headers[key];\n    }\n  }\n  return found;\n}\n\n/**\n * Extract the caller's credential value for a given auth scheme from the\n * forwarded headers, if present. For bearer, strips the `Bearer ` prefix.\n */\nfunction readCallerCredential(\n  headers: Record<string, string>,\n  scheme: AuthScheme,\n): string | undefined {\n  if (scheme.kind === \"bearer\" || scheme.kind === \"fal-key\") {\n    const raw = scanHeader(headers, \"authorization\");\n    if (raw === undefined) return undefined;\n    // Strip the scheme prefix (`Bearer ` for bearer, `Key ` for fal) if present,\n    // otherwise treat the whole value as the credential.\n    const prefix = scheme.kind === \"fal-key\" ? \"Key\" : \"Bearer\";\n    const match = new RegExp(`^\\\\s*${prefix}\\\\s+(.+)$`, \"i\").exec(raw);\n    return match ? match[1].trim() : raw.trim();\n  }\n  return scanHeader(headers, authHeaderName(scheme));\n}\n\n/**\n * The wire header name a non-Authorization scheme carries its credential in.\n * (bearer/fal-key both use `Authorization` and are handled separately.)\n */\nfunction authHeaderName(scheme: AuthScheme): string {\n  switch (scheme.kind) {\n    case \"x-api-key\":\n      return \"x-api-key\";\n    case \"x-goog-api-key\":\n      return \"x-goog-api-key\";\n    case \"api-key\":\n      return \"api-key\";\n    case \"xi-api-key\":\n      return \"xi-api-key\";\n    case \"bearer\":\n    case \"fal-key\":\n      return \"authorization\";\n  }\n}\n\n/** Case-insensitive header lookup that does not mutate the map. */\nfunction scanHeader(headers: Record<string, string>, name: string): string | undefined {\n  const lowerName = name.toLowerCase();\n  for (const key of Object.keys(headers)) {\n    if (key.toLowerCase() === lowerName) return headers[key];\n  }\n  return undefined;\n}\n\n/**\n * Decide whether aimock should override the caller's credential with its own\n * built-in key. Override when the caller sent no credential OR sent a dummy\n * placeholder (prefixed with the active marker). A real caller key is left\n * untouched so the caller can always override aimock.\n */\nfunction shouldOverride(callerCredential: string | undefined, marker: string): boolean {\n  if (callerCredential === undefined || callerCredential.length === 0) return true;\n  return callerCredential.startsWith(marker);\n}\n\n/**\n * Inject aimock's built-in upstream credential into the forwarded headers when\n * appropriate (opt-in, backward-compatible). Mutates `forwardHeaders` in place\n * and may mutate `target` (query-param schemes; none currently).\n *\n * Precedence:\n *   - No built-in key configured for this provider    → no-op (forward verbatim).\n *   - Provider not a static-key scheme                → no-op (Bedrock SigV4 / Vertex AI OAuth).\n *   - Caller credential absent or dummy-prefixed      → inject built-in key.\n *   - Caller credential is a real key                 → forward it unchanged.\n *\n * @param forwardHeaders headers already built by buildForwardHeaders(req)\n * @param target upstream URL (reserved for query-param auth schemes)\n * @param providerKey which provider this request is routed to\n * @param builtinKey aimock's configured key for this provider (if any)\n */\nexport function applyProviderAuth(\n  forwardHeaders: Record<string, string>,\n  target: URL,\n  providerKey: RecordProviderKey,\n  builtinKey: string | undefined,\n): void {\n  void target; // reserved for future query-param schemes (e.g. Gemini ?key=)\n  if (!builtinKey) return; // feature inert for this provider\n\n  const scheme = PROVIDER_AUTH_SCHEMES[providerKey];\n  if (!scheme) return; // signed/OAuth provider — never rewrite auth\n\n  const marker = getDummyKeyMarker();\n  const callerCredential = readCallerCredential(forwardHeaders, scheme);\n  if (!shouldOverride(callerCredential, marker)) return; // caller sent a real key\n\n  // Strip any existing auth headers for this scheme (across casings) before\n  // setting aimock's key, so a dummy caller key can't linger alongside ours.\n  switch (scheme.kind) {\n    case \"bearer\":\n      takeHeader(forwardHeaders, \"authorization\");\n      forwardHeaders[\"Authorization\"] = `Bearer ${builtinKey}`;\n      break;\n    case \"fal-key\":\n      takeHeader(forwardHeaders, \"authorization\");\n      forwardHeaders[\"Authorization\"] = `Key ${builtinKey}`;\n      break;\n    case \"x-api-key\":\n      takeHeader(forwardHeaders, \"x-api-key\");\n      forwardHeaders[\"x-api-key\"] = builtinKey;\n      break;\n    case \"x-goog-api-key\":\n      takeHeader(forwardHeaders, \"x-goog-api-key\");\n      forwardHeaders[\"x-goog-api-key\"] = builtinKey;\n      break;\n    case \"api-key\":\n      takeHeader(forwardHeaders, \"api-key\");\n      forwardHeaders[\"api-key\"] = builtinKey;\n      break;\n    case \"xi-api-key\":\n      takeHeader(forwardHeaders, \"xi-api-key\");\n      forwardHeaders[\"xi-api-key\"] = builtinKey;\n      break;\n  }\n}\n\n/**\n * Read per-provider built-in keys from the environment. Returns undefined when\n * no provider key is configured so the feature stays fully inert by default.\n *\n * Each wired static-key provider reads `AIMOCK_PROVIDER_<PROVIDER>_KEY`. An\n * empty-string value is treated as unset (existing truthiness pattern), keeping\n * the feature inert. `gemini-interactions` is not read here: it reuses the\n * Gemini key via the lookup-key remap in `proxyAndRecord`. Signed/OAuth\n * providers (`bedrock`, `vertexai`) have no env var — aimock never rewrites\n * their auth.\n */\nexport function readProviderKeysFromEnv(\n  env: NodeJS.ProcessEnv = process.env,\n): Partial<Record<RecordProviderKey, string>> | undefined {\n  const keys: Partial<Record<RecordProviderKey, string>> = {};\n  if (env.AIMOCK_PROVIDER_OPENAI_KEY) keys.openai = env.AIMOCK_PROVIDER_OPENAI_KEY;\n  if (env.AIMOCK_PROVIDER_ANTHROPIC_KEY) keys.anthropic = env.AIMOCK_PROVIDER_ANTHROPIC_KEY;\n  if (env.AIMOCK_PROVIDER_GEMINI_KEY) keys.gemini = env.AIMOCK_PROVIDER_GEMINI_KEY;\n  if (env.AIMOCK_PROVIDER_OPENROUTER_KEY) keys.openrouter = env.AIMOCK_PROVIDER_OPENROUTER_KEY;\n  if (env.AIMOCK_PROVIDER_COHERE_KEY) keys.cohere = env.AIMOCK_PROVIDER_COHERE_KEY;\n  if (env.AIMOCK_PROVIDER_GROK_KEY) keys.grok = env.AIMOCK_PROVIDER_GROK_KEY;\n  if (env.AIMOCK_PROVIDER_BYTEPLUS_KEY) keys.byteplus = env.AIMOCK_PROVIDER_BYTEPLUS_KEY;\n  if (env.AIMOCK_PROVIDER_OLLAMA_KEY) keys.ollama = env.AIMOCK_PROVIDER_OLLAMA_KEY;\n  if (env.AIMOCK_PROVIDER_VEO_KEY) keys.veo = env.AIMOCK_PROVIDER_VEO_KEY;\n  if (env.AIMOCK_PROVIDER_AZURE_KEY) keys.azure = env.AIMOCK_PROVIDER_AZURE_KEY;\n  if (env.AIMOCK_PROVIDER_ELEVENLABS_KEY) keys.elevenlabs = env.AIMOCK_PROVIDER_ELEVENLABS_KEY;\n  if (env.AIMOCK_PROVIDER_FAL_KEY) keys.fal = env.AIMOCK_PROVIDER_FAL_KEY;\n  return Object.keys(keys).length > 0 ? keys : undefined;\n}\n"],"mappings":";;;;;;;;;;;;;AAaA,MAAa,2BAA2B;;AAGxC,SAAgB,oBAA4B;CAC1C,MAAM,WAAW,QAAQ,IAAI;AAC7B,QAAO,YAAY,SAAS,SAAS,IAAI,WAAW;;AAgCtD,MAAM,wBAAwE;CAE5E,QAAQ,EAAE,MAAM,UAAU;CAC1B,YAAY,EAAE,MAAM,UAAU;CAC9B,QAAQ,EAAE,MAAM,UAAU;CAC1B,MAAM,EAAE,MAAM,UAAU;CACxB,UAAU,EAAE,MAAM,UAAU;CAC5B,QAAQ,EAAE,MAAM,UAAU;CAE1B,WAAW,EAAE,MAAM,aAAa;CAEhC,QAAQ,EAAE,MAAM,kBAAkB;CAClC,uBAAuB,EAAE,MAAM,kBAAkB;CACjD,KAAK,EAAE,MAAM,kBAAkB;CAE/B,OAAO,EAAE,MAAM,WAAW;CAE1B,YAAY,EAAE,MAAM,cAAc;CAElC,KAAK,EAAE,MAAM,WAAW;CACzB;;AAOD,SAAgB,4BACd,gBACA,QACA,aACA,oBACS;CAET,MAAM,SAAS,sBAAsB;AACrC,KAAI,CAAC,OAAQ,QAAO;AACpB,SAAQ,OAAO,MAAf;EACE,KAAK;AACH,cAAW,gBAAgB,gBAAgB;AAC3C,kBAAe,gBAAgB,UAAU;AACzC;EACF,KAAK;AACH,cAAW,gBAAgB,gBAAgB;AAC3C,kBAAe,gBAAgB,OAAO;AACtC;EACF;AACE,cAAW,gBAAgB,eAAe,OAAO,CAAC;AAClD,kBAAe,eAAe,OAAO,IAAI;;AAE7C,QAAO;;;;;;;AAQT,SAAS,WAAW,SAAiC,MAAkC;CACrF,MAAM,YAAY,KAAK,aAAa;CACpC,IAAI;AACJ,MAAK,MAAM,OAAO,OAAO,KAAK,QAAQ,CACpC,KAAI,IAAI,aAAa,KAAK,WAAW;AACnC,UAAQ,QAAQ;AAChB,SAAO,QAAQ;;AAGnB,QAAO;;;;;;AAOT,SAAS,qBACP,SACA,QACoB;AACpB,KAAI,OAAO,SAAS,YAAY,OAAO,SAAS,WAAW;EACzD,MAAM,MAAM,WAAW,SAAS,gBAAgB;AAChD,MAAI,QAAQ,OAAW,QAAO;EAG9B,MAAM,SAAS,OAAO,SAAS,YAAY,QAAQ;EACnD,MAAM,QAAQ,IAAI,OAAO,QAAQ,OAAO,YAAY,IAAI,CAAC,KAAK,IAAI;AAClE,SAAO,QAAQ,MAAM,GAAG,MAAM,GAAG,IAAI,MAAM;;AAE7C,QAAO,WAAW,SAAS,eAAe,OAAO,CAAC;;;;;;AAOpD,SAAS,eAAe,QAA4B;AAClD,SAAQ,OAAO,MAAf;EACE,KAAK,YACH,QAAO;EACT,KAAK,iBACH,QAAO;EACT,KAAK,UACH,QAAO;EACT,KAAK,aACH,QAAO;EACT,KAAK;EACL,KAAK,UACH,QAAO;;;;AAKb,SAAS,WAAW,SAAiC,MAAkC;CACrF,MAAM,YAAY,KAAK,aAAa;AACpC,MAAK,MAAM,OAAO,OAAO,KAAK,QAAQ,CACpC,KAAI,IAAI,aAAa,KAAK,UAAW,QAAO,QAAQ;;;;;;;;AAWxD,SAAS,eAAe,kBAAsC,QAAyB;AACrF,KAAI,qBAAqB,UAAa,iBAAiB,WAAW,EAAG,QAAO;AAC5E,QAAO,iBAAiB,WAAW,OAAO;;;;;;;;;;;;;;;;;;AAmB5C,SAAgB,kBACd,gBACA,QACA,aACA,YACM;AAEN,KAAI,CAAC,WAAY;CAEjB,MAAM,SAAS,sBAAsB;AACrC,KAAI,CAAC,OAAQ;CAEb,MAAM,SAAS,mBAAmB;AAElC,KAAI,CAAC,eADoB,qBAAqB,gBAAgB,OAAO,EAC/B,OAAO,CAAE;AAI/C,SAAQ,OAAO,MAAf;EACE,KAAK;AACH,cAAW,gBAAgB,gBAAgB;AAC3C,kBAAe,mBAAmB,UAAU;AAC5C;EACF,KAAK;AACH,cAAW,gBAAgB,gBAAgB;AAC3C,kBAAe,mBAAmB,OAAO;AACzC;EACF,KAAK;AACH,cAAW,gBAAgB,YAAY;AACvC,kBAAe,eAAe;AAC9B;EACF,KAAK;AACH,cAAW,gBAAgB,iBAAiB;AAC5C,kBAAe,oBAAoB;AACnC;EACF,KAAK;AACH,cAAW,gBAAgB,UAAU;AACrC,kBAAe,aAAa;AAC5B;EACF,KAAK;AACH,cAAW,gBAAgB,aAAa;AACxC,kBAAe,gBAAgB;AAC/B;;;;;;;;;;;;;;AAeN,SAAgB,wBACd,MAAyB,QAAQ,KACuB;CACxD,MAAM,OAAmD,EAAE;AAC3D,KAAI,IAAI,2BAA4B,MAAK,SAAS,IAAI;AACtD,KAAI,IAAI,8BAA+B,MAAK,YAAY,IAAI;AAC5D,KAAI,IAAI,2BAA4B,MAAK,SAAS,IAAI;AACtD,KAAI,IAAI,+BAAgC,MAAK,aAAa,IAAI;AAC9D,KAAI,IAAI,2BAA4B,MAAK,SAAS,IAAI;AACtD,KAAI,IAAI,yBAA0B,MAAK,OAAO,IAAI;AAClD,KAAI,IAAI,6BAA8B,MAAK,WAAW,IAAI;AAC1D,KAAI,IAAI,2BAA4B,MAAK,SAAS,IAAI;AACtD,KAAI,IAAI,wBAAyB,MAAK,MAAM,IAAI;AAChD,KAAI,IAAI,0BAA2B,MAAK,QAAQ,IAAI;AACpD,KAAI,IAAI,+BAAgC,MAAK,aAAa,IAAI;AAC9D,KAAI,IAAI,wBAAyB,MAAK,MAAM,IAAI;AAChD,QAAO,OAAO,KAAK,KAAK,CAAC,SAAS,IAAI,OAAO"}

package/dist/provider-auth.js

@@ -21,6 +21,7 @@ const PROVIDER_AUTH_SCHEMES = {
 	openrouter: { kind: "bearer" },
 	cohere: { kind: "bearer" },
 	grok: { kind: "bearer" },
+	byteplus: { kind: "bearer" },
 	ollama: { kind: "bearer" },
 	anthropic: { kind: "x-api-key" },
 	gemini: { kind: "x-goog-api-key" },
@@ -174,6 +175,7 @@ function readProviderKeysFromEnv(env = process.env) {
 	if (env.AIMOCK_PROVIDER_OPENROUTER_KEY) keys.openrouter = env.AIMOCK_PROVIDER_OPENROUTER_KEY;
 	if (env.AIMOCK_PROVIDER_COHERE_KEY) keys.cohere = env.AIMOCK_PROVIDER_COHERE_KEY;
 	if (env.AIMOCK_PROVIDER_GROK_KEY) keys.grok = env.AIMOCK_PROVIDER_GROK_KEY;
+	if (env.AIMOCK_PROVIDER_BYTEPLUS_KEY) keys.byteplus = env.AIMOCK_PROVIDER_BYTEPLUS_KEY;
 	if (env.AIMOCK_PROVIDER_OLLAMA_KEY) keys.ollama = env.AIMOCK_PROVIDER_OLLAMA_KEY;
 	if (env.AIMOCK_PROVIDER_VEO_KEY) keys.veo = env.AIMOCK_PROVIDER_VEO_KEY;
 	if (env.AIMOCK_PROVIDER_AZURE_KEY) keys.azure = env.AIMOCK_PROVIDER_AZURE_KEY;

package/dist/provider-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-auth.js","names":[],"sources":["../src/provider-auth.ts"],"sourcesContent":["import type { RecordProviderKey } from \"./types.js\";\n\n/**\n * Default marker prefix identifying a \"dummy\" credential that a caller sends\n * only to satisfy an SDK's non-empty API-key requirement (e.g. `sk-aimock-...`).\n * A caller credential that is absent OR begins with this prefix is treated as a\n * placeholder that aimock is free to override with its own built-in upstream key.\n * A caller credential that does NOT begin with this prefix is treated as a real\n * key and forwarded verbatim (the caller overrides aimock).\n *\n * Overridable via the `AIMOCK_DUMMY_KEY_MARKER` env var for setups that mint\n * placeholder keys under a different prefix.\n */\nexport const DEFAULT_DUMMY_KEY_MARKER = \"sk-aimock-\";\n\n/** Resolve the active dummy-key marker, honoring the env override. */\nexport function getDummyKeyMarker(): string {\n  const override = process.env.AIMOCK_DUMMY_KEY_MARKER;\n  return override && override.length > 0 ? override : DEFAULT_DUMMY_KEY_MARKER;\n}\n\n/**\n * How a given provider carries its API credential on the wire. aimock injects\n * its built-in key using the provider's native scheme so the upstream accepts\n * it. Providers whose auth is a signed/exchanged credential (Bedrock SigV4,\n * Vertex AI OAuth) are deliberately absent — those are NOT simple static-key\n * schemes, so aimock never rewrites their auth and always forwards the caller's\n * credential unchanged.\n *\n * Scheme kinds (all static long-lived keys):\n *   - bearer          `Authorization: Bearer <key>`  (OpenAI, OpenRouter, Cohere, Grok/xAI, Ollama)\n *   - fal-key         `Authorization: Key <key>`     (fal.ai — note the `Key ` prefix, NOT `Bearer`)\n *   - x-api-key       `x-api-key: <key>`             (Anthropic)\n *   - x-goog-api-key  `x-goog-api-key: <key>`        (Gemini, Gemini Interactions, Veo)\n *   - api-key         `api-key: <key>`               (Azure OpenAI static-key auth)\n *   - xi-api-key      `xi-api-key: <key>`            (ElevenLabs)\n *\n * Note on Azure: Azure OpenAI also supports Microsoft Entra ID `Authorization:\n * Bearer <token>` OAuth. aimock only ever injects the static `api-key` header,\n * and a real Entra bearer token from the caller is never dummy-prefixed, so it\n * is always forwarded verbatim (the caller overrides aimock).\n */\nexport type AuthScheme =\n  | { kind: \"bearer\" } // Authorization: Bearer <key>\n  | { kind: \"fal-key\" } // Authorization: Key <key>\n  | { kind: \"x-api-key\" } // x-api-key: <key>\n  | { kind: \"x-goog-api-key\" } // x-goog-api-key: <key>\n  | { kind: \"api-key\" } // api-key: <key>\n  | { kind: \"xi-api-key\" }; // xi-api-key: <key>\n\nconst PROVIDER_AUTH_SCHEMES: Partial<Record<RecordProviderKey, AuthScheme>> = {\n  // Bearer-token providers.\n  openai: { kind: \"bearer\" },\n  openrouter: { kind: \"bearer\" },\n  cohere: { kind: \"bearer\" },\n  grok: { kind: \"bearer\" }, // xAI\n  ollama: { kind: \"bearer\" }, // Ollama Cloud / bearer-gated Ollama servers\n  // Anthropic.\n  anthropic: { kind: \"x-api-key\" },\n  // Google (Gemini + Veo) use the x-goog-api-key header scheme.\n  gemini: { kind: \"x-goog-api-key\" },\n  \"gemini-interactions\": { kind: \"x-goog-api-key\" },\n  veo: { kind: \"x-goog-api-key\" },\n  // Azure OpenAI static-key auth.\n  azure: { kind: \"api-key\" },\n  // ElevenLabs.\n  elevenlabs: { kind: \"xi-api-key\" },\n  // fal.ai — uses the `Key ` prefix on Authorization, NOT `Bearer `.\n  fal: { kind: \"fal-key\" },\n};\n\nexport function hasStaticProviderAuthScheme(providerKey: RecordProviderKey): boolean {\n  return PROVIDER_AUTH_SCHEMES[providerKey] !== undefined;\n}\n\n/** Force a known provider credential onto an already-scrubbed outbound map. */\nexport function applyConfiguredProviderAuth(\n  forwardHeaders: Record<string, string>,\n  target: URL,\n  providerKey: RecordProviderKey,\n  providerCredential: string,\n): boolean {\n  void target;\n  const scheme = PROVIDER_AUTH_SCHEMES[providerKey];\n  if (!scheme) return false;\n  switch (scheme.kind) {\n    case \"bearer\":\n      takeHeader(forwardHeaders, \"authorization\");\n      forwardHeaders.Authorization = `Bearer ${providerCredential}`;\n      break;\n    case \"fal-key\":\n      takeHeader(forwardHeaders, \"authorization\");\n      forwardHeaders.Authorization = `Key ${providerCredential}`;\n      break;\n    default:\n      takeHeader(forwardHeaders, authHeaderName(scheme));\n      forwardHeaders[authHeaderName(scheme)] = providerCredential;\n  }\n  return true;\n}\n\n/**\n * Case-insensitively delete a header from a forward-header map, returning the\n * value that was present (if any). Header maps preserve the original casing of\n * incoming headers, so we can't assume a canonical key.\n */\nfunction takeHeader(headers: Record<string, string>, name: string): string | undefined {\n  const lowerName = name.toLowerCase();\n  let found: string | undefined;\n  for (const key of Object.keys(headers)) {\n    if (key.toLowerCase() === lowerName) {\n      found = headers[key];\n      delete headers[key];\n    }\n  }\n  return found;\n}\n\n/**\n * Extract the caller's credential value for a given auth scheme from the\n * forwarded headers, if present. For bearer, strips the `Bearer ` prefix.\n */\nfunction readCallerCredential(\n  headers: Record<string, string>,\n  scheme: AuthScheme,\n): string | undefined {\n  if (scheme.kind === \"bearer\" || scheme.kind === \"fal-key\") {\n    const raw = scanHeader(headers, \"authorization\");\n    if (raw === undefined) return undefined;\n    // Strip the scheme prefix (`Bearer ` for bearer, `Key ` for fal) if present,\n    // otherwise treat the whole value as the credential.\n    const prefix = scheme.kind === \"fal-key\" ? \"Key\" : \"Bearer\";\n    const match = new RegExp(`^\\\\s*${prefix}\\\\s+(.+)$`, \"i\").exec(raw);\n    return match ? match[1].trim() : raw.trim();\n  }\n  return scanHeader(headers, authHeaderName(scheme));\n}\n\n/**\n * The wire header name a non-Authorization scheme carries its credential in.\n * (bearer/fal-key both use `Authorization` and are handled separately.)\n */\nfunction authHeaderName(scheme: AuthScheme): string {\n  switch (scheme.kind) {\n    case \"x-api-key\":\n      return \"x-api-key\";\n    case \"x-goog-api-key\":\n      return \"x-goog-api-key\";\n    case \"api-key\":\n      return \"api-key\";\n    case \"xi-api-key\":\n      return \"xi-api-key\";\n    case \"bearer\":\n    case \"fal-key\":\n      return \"authorization\";\n  }\n}\n\n/** Case-insensitive header lookup that does not mutate the map. */\nfunction scanHeader(headers: Record<string, string>, name: string): string | undefined {\n  const lowerName = name.toLowerCase();\n  for (const key of Object.keys(headers)) {\n    if (key.toLowerCase() === lowerName) return headers[key];\n  }\n  return undefined;\n}\n\n/**\n * Decide whether aimock should override the caller's credential with its own\n * built-in key. Override when the caller sent no credential OR sent a dummy\n * placeholder (prefixed with the active marker). A real caller key is left\n * untouched so the caller can always override aimock.\n */\nfunction shouldOverride(callerCredential: string | undefined, marker: string): boolean {\n  if (callerCredential === undefined || callerCredential.length === 0) return true;\n  return callerCredential.startsWith(marker);\n}\n\n/**\n * Inject aimock's built-in upstream credential into the forwarded headers when\n * appropriate (opt-in, backward-compatible). Mutates `forwardHeaders` in place\n * and may mutate `target` (query-param schemes; none currently).\n *\n * Precedence:\n *   - No built-in key configured for this provider    → no-op (forward verbatim).\n *   - Provider not a static-key scheme                → no-op (Bedrock SigV4 / Vertex AI OAuth).\n *   - Caller credential absent or dummy-prefixed      → inject built-in key.\n *   - Caller credential is a real key                 → forward it unchanged.\n *\n * @param forwardHeaders headers already built by buildForwardHeaders(req)\n * @param target upstream URL (reserved for query-param auth schemes)\n * @param providerKey which provider this request is routed to\n * @param builtinKey aimock's configured key for this provider (if any)\n */\nexport function applyProviderAuth(\n  forwardHeaders: Record<string, string>,\n  target: URL,\n  providerKey: RecordProviderKey,\n  builtinKey: string | undefined,\n): void {\n  void target; // reserved for future query-param schemes (e.g. Gemini ?key=)\n  if (!builtinKey) return; // feature inert for this provider\n\n  const scheme = PROVIDER_AUTH_SCHEMES[providerKey];\n  if (!scheme) return; // signed/OAuth provider — never rewrite auth\n\n  const marker = getDummyKeyMarker();\n  const callerCredential = readCallerCredential(forwardHeaders, scheme);\n  if (!shouldOverride(callerCredential, marker)) return; // caller sent a real key\n\n  // Strip any existing auth headers for this scheme (across casings) before\n  // setting aimock's key, so a dummy caller key can't linger alongside ours.\n  switch (scheme.kind) {\n    case \"bearer\":\n      takeHeader(forwardHeaders, \"authorization\");\n      forwardHeaders[\"Authorization\"] = `Bearer ${builtinKey}`;\n      break;\n    case \"fal-key\":\n      takeHeader(forwardHeaders, \"authorization\");\n      forwardHeaders[\"Authorization\"] = `Key ${builtinKey}`;\n      break;\n    case \"x-api-key\":\n      takeHeader(forwardHeaders, \"x-api-key\");\n      forwardHeaders[\"x-api-key\"] = builtinKey;\n      break;\n    case \"x-goog-api-key\":\n      takeHeader(forwardHeaders, \"x-goog-api-key\");\n      forwardHeaders[\"x-goog-api-key\"] = builtinKey;\n      break;\n    case \"api-key\":\n      takeHeader(forwardHeaders, \"api-key\");\n      forwardHeaders[\"api-key\"] = builtinKey;\n      break;\n    case \"xi-api-key\":\n      takeHeader(forwardHeaders, \"xi-api-key\");\n      forwardHeaders[\"xi-api-key\"] = builtinKey;\n      break;\n  }\n}\n\n/**\n * Read per-provider built-in keys from the environment. Returns undefined when\n * no provider key is configured so the feature stays fully inert by default.\n *\n * Each wired static-key provider reads `AIMOCK_PROVIDER_<PROVIDER>_KEY`. An\n * empty-string value is treated as unset (existing truthiness pattern), keeping\n * the feature inert. `gemini-interactions` is not read here: it reuses the\n * Gemini key via the lookup-key remap in `proxyAndRecord`. Signed/OAuth\n * providers (`bedrock`, `vertexai`) have no env var — aimock never rewrites\n * their auth.\n */\nexport function readProviderKeysFromEnv(\n  env: NodeJS.ProcessEnv = process.env,\n): Partial<Record<RecordProviderKey, string>> | undefined {\n  const keys: Partial<Record<RecordProviderKey, string>> = {};\n  if (env.AIMOCK_PROVIDER_OPENAI_KEY) keys.openai = env.AIMOCK_PROVIDER_OPENAI_KEY;\n  if (env.AIMOCK_PROVIDER_ANTHROPIC_KEY) keys.anthropic = env.AIMOCK_PROVIDER_ANTHROPIC_KEY;\n  if (env.AIMOCK_PROVIDER_GEMINI_KEY) keys.gemini = env.AIMOCK_PROVIDER_GEMINI_KEY;\n  if (env.AIMOCK_PROVIDER_OPENROUTER_KEY) keys.openrouter = env.AIMOCK_PROVIDER_OPENROUTER_KEY;\n  if (env.AIMOCK_PROVIDER_COHERE_KEY) keys.cohere = env.AIMOCK_PROVIDER_COHERE_KEY;\n  if (env.AIMOCK_PROVIDER_GROK_KEY) keys.grok = env.AIMOCK_PROVIDER_GROK_KEY;\n  if (env.AIMOCK_PROVIDER_OLLAMA_KEY) keys.ollama = env.AIMOCK_PROVIDER_OLLAMA_KEY;\n  if (env.AIMOCK_PROVIDER_VEO_KEY) keys.veo = env.AIMOCK_PROVIDER_VEO_KEY;\n  if (env.AIMOCK_PROVIDER_AZURE_KEY) keys.azure = env.AIMOCK_PROVIDER_AZURE_KEY;\n  if (env.AIMOCK_PROVIDER_ELEVENLABS_KEY) keys.elevenlabs = env.AIMOCK_PROVIDER_ELEVENLABS_KEY;\n  if (env.AIMOCK_PROVIDER_FAL_KEY) keys.fal = env.AIMOCK_PROVIDER_FAL_KEY;\n  return Object.keys(keys).length > 0 ? keys : undefined;\n}\n"],"mappings":";;;;;;;;;;;;AAaA,MAAa,2BAA2B;;AAGxC,SAAgB,oBAA4B;CAC1C,MAAM,WAAW,QAAQ,IAAI;AAC7B,QAAO,YAAY,SAAS,SAAS,IAAI,WAAW;;AAgCtD,MAAM,wBAAwE;CAE5E,QAAQ,EAAE,MAAM,UAAU;CAC1B,YAAY,EAAE,MAAM,UAAU;CAC9B,QAAQ,EAAE,MAAM,UAAU;CAC1B,MAAM,EAAE,MAAM,UAAU;CACxB,QAAQ,EAAE,MAAM,UAAU;CAE1B,WAAW,EAAE,MAAM,aAAa;CAEhC,QAAQ,EAAE,MAAM,kBAAkB;CAClC,uBAAuB,EAAE,MAAM,kBAAkB;CACjD,KAAK,EAAE,MAAM,kBAAkB;CAE/B,OAAO,EAAE,MAAM,WAAW;CAE1B,YAAY,EAAE,MAAM,cAAc;CAElC,KAAK,EAAE,MAAM,WAAW;CACzB;;AAOD,SAAgB,4BACd,gBACA,QACA,aACA,oBACS;CAET,MAAM,SAAS,sBAAsB;AACrC,KAAI,CAAC,OAAQ,QAAO;AACpB,SAAQ,OAAO,MAAf;EACE,KAAK;AACH,cAAW,gBAAgB,gBAAgB;AAC3C,kBAAe,gBAAgB,UAAU;AACzC;EACF,KAAK;AACH,cAAW,gBAAgB,gBAAgB;AAC3C,kBAAe,gBAAgB,OAAO;AACtC;EACF;AACE,cAAW,gBAAgB,eAAe,OAAO,CAAC;AAClD,kBAAe,eAAe,OAAO,IAAI;;AAE7C,QAAO;;;;;;;AAQT,SAAS,WAAW,SAAiC,MAAkC;CACrF,MAAM,YAAY,KAAK,aAAa;CACpC,IAAI;AACJ,MAAK,MAAM,OAAO,OAAO,KAAK,QAAQ,CACpC,KAAI,IAAI,aAAa,KAAK,WAAW;AACnC,UAAQ,QAAQ;AAChB,SAAO,QAAQ;;AAGnB,QAAO;;;;;;AAOT,SAAS,qBACP,SACA,QACoB;AACpB,KAAI,OAAO,SAAS,YAAY,OAAO,SAAS,WAAW;EACzD,MAAM,MAAM,WAAW,SAAS,gBAAgB;AAChD,MAAI,QAAQ,OAAW,QAAO;EAG9B,MAAM,SAAS,OAAO,SAAS,YAAY,QAAQ;EACnD,MAAM,QAAQ,IAAI,OAAO,QAAQ,OAAO,YAAY,IAAI,CAAC,KAAK,IAAI;AAClE,SAAO,QAAQ,MAAM,GAAG,MAAM,GAAG,IAAI,MAAM;;AAE7C,QAAO,WAAW,SAAS,eAAe,OAAO,CAAC;;;;;;AAOpD,SAAS,eAAe,QAA4B;AAClD,SAAQ,OAAO,MAAf;EACE,KAAK,YACH,QAAO;EACT,KAAK,iBACH,QAAO;EACT,KAAK,UACH,QAAO;EACT,KAAK,aACH,QAAO;EACT,KAAK;EACL,KAAK,UACH,QAAO;;;;AAKb,SAAS,WAAW,SAAiC,MAAkC;CACrF,MAAM,YAAY,KAAK,aAAa;AACpC,MAAK,MAAM,OAAO,OAAO,KAAK,QAAQ,CACpC,KAAI,IAAI,aAAa,KAAK,UAAW,QAAO,QAAQ;;;;;;;;AAWxD,SAAS,eAAe,kBAAsC,QAAyB;AACrF,KAAI,qBAAqB,UAAa,iBAAiB,WAAW,EAAG,QAAO;AAC5E,QAAO,iBAAiB,WAAW,OAAO;;;;;;;;;;;;;;;;;;AAmB5C,SAAgB,kBACd,gBACA,QACA,aACA,YACM;AAEN,KAAI,CAAC,WAAY;CAEjB,MAAM,SAAS,sBAAsB;AACrC,KAAI,CAAC,OAAQ;CAEb,MAAM,SAAS,mBAAmB;AAElC,KAAI,CAAC,eADoB,qBAAqB,gBAAgB,OAAO,EAC/B,OAAO,CAAE;AAI/C,SAAQ,OAAO,MAAf;EACE,KAAK;AACH,cAAW,gBAAgB,gBAAgB;AAC3C,kBAAe,mBAAmB,UAAU;AAC5C;EACF,KAAK;AACH,cAAW,gBAAgB,gBAAgB;AAC3C,kBAAe,mBAAmB,OAAO;AACzC;EACF,KAAK;AACH,cAAW,gBAAgB,YAAY;AACvC,kBAAe,eAAe;AAC9B;EACF,KAAK;AACH,cAAW,gBAAgB,iBAAiB;AAC5C,kBAAe,oBAAoB;AACnC;EACF,KAAK;AACH,cAAW,gBAAgB,UAAU;AACrC,kBAAe,aAAa;AAC5B;EACF,KAAK;AACH,cAAW,gBAAgB,aAAa;AACxC,kBAAe,gBAAgB;AAC/B;;;;;;;;;;;;;;AAeN,SAAgB,wBACd,MAAyB,QAAQ,KACuB;CACxD,MAAM,OAAmD,EAAE;AAC3D,KAAI,IAAI,2BAA4B,MAAK,SAAS,IAAI;AACtD,KAAI,IAAI,8BAA+B,MAAK,YAAY,IAAI;AAC5D,KAAI,IAAI,2BAA4B,MAAK,SAAS,IAAI;AACtD,KAAI,IAAI,+BAAgC,MAAK,aAAa,IAAI;AAC9D,KAAI,IAAI,2BAA4B,MAAK,SAAS,IAAI;AACtD,KAAI,IAAI,yBAA0B,MAAK,OAAO,IAAI;AAClD,KAAI,IAAI,2BAA4B,MAAK,SAAS,IAAI;AACtD,KAAI,IAAI,wBAAyB,MAAK,MAAM,IAAI;AAChD,KAAI,IAAI,0BAA2B,MAAK,QAAQ,IAAI;AACpD,KAAI,IAAI,+BAAgC,MAAK,aAAa,IAAI;AAC9D,KAAI,IAAI,wBAAyB,MAAK,MAAM,IAAI;AAChD,QAAO,OAAO,KAAK,KAAK,CAAC,SAAS,IAAI,OAAO"}
+{"version":3,"file":"provider-auth.js","names":[],"sources":["../src/provider-auth.ts"],"sourcesContent":["import type { RecordProviderKey } from \"./types.js\";\n\n/**\n * Default marker prefix identifying a \"dummy\" credential that a caller sends\n * only to satisfy an SDK's non-empty API-key requirement (e.g. `sk-aimock-...`).\n * A caller credential that is absent OR begins with this prefix is treated as a\n * placeholder that aimock is free to override with its own built-in upstream key.\n * A caller credential that does NOT begin with this prefix is treated as a real\n * key and forwarded verbatim (the caller overrides aimock).\n *\n * Overridable via the `AIMOCK_DUMMY_KEY_MARKER` env var for setups that mint\n * placeholder keys under a different prefix.\n */\nexport const DEFAULT_DUMMY_KEY_MARKER = \"sk-aimock-\";\n\n/** Resolve the active dummy-key marker, honoring the env override. */\nexport function getDummyKeyMarker(): string {\n  const override = process.env.AIMOCK_DUMMY_KEY_MARKER;\n  return override && override.length > 0 ? override : DEFAULT_DUMMY_KEY_MARKER;\n}\n\n/**\n * How a given provider carries its API credential on the wire. aimock injects\n * its built-in key using the provider's native scheme so the upstream accepts\n * it. Providers whose auth is a signed/exchanged credential (Bedrock SigV4,\n * Vertex AI OAuth) are deliberately absent — those are NOT simple static-key\n * schemes, so aimock never rewrites their auth and always forwards the caller's\n * credential unchanged.\n *\n * Scheme kinds (all static long-lived keys):\n *   - bearer          `Authorization: Bearer <key>`  (OpenAI, OpenRouter, Cohere, Grok/xAI, BytePlus Ark, Ollama)\n *   - fal-key         `Authorization: Key <key>`     (fal.ai — note the `Key ` prefix, NOT `Bearer`)\n *   - x-api-key       `x-api-key: <key>`             (Anthropic)\n *   - x-goog-api-key  `x-goog-api-key: <key>`        (Gemini, Gemini Interactions, Veo)\n *   - api-key         `api-key: <key>`               (Azure OpenAI static-key auth)\n *   - xi-api-key      `xi-api-key: <key>`            (ElevenLabs)\n *\n * Note on Azure: Azure OpenAI also supports Microsoft Entra ID `Authorization:\n * Bearer <token>` OAuth. aimock only ever injects the static `api-key` header,\n * and a real Entra bearer token from the caller is never dummy-prefixed, so it\n * is always forwarded verbatim (the caller overrides aimock).\n */\nexport type AuthScheme =\n  | { kind: \"bearer\" } // Authorization: Bearer <key>\n  | { kind: \"fal-key\" } // Authorization: Key <key>\n  | { kind: \"x-api-key\" } // x-api-key: <key>\n  | { kind: \"x-goog-api-key\" } // x-goog-api-key: <key>\n  | { kind: \"api-key\" } // api-key: <key>\n  | { kind: \"xi-api-key\" }; // xi-api-key: <key>\n\nconst PROVIDER_AUTH_SCHEMES: Partial<Record<RecordProviderKey, AuthScheme>> = {\n  // Bearer-token providers.\n  openai: { kind: \"bearer\" },\n  openrouter: { kind: \"bearer\" },\n  cohere: { kind: \"bearer\" },\n  grok: { kind: \"bearer\" }, // xAI\n  byteplus: { kind: \"bearer\" }, // BytePlus Ark (ModelArk) — Authorization: Bearer $ARK_API_KEY\n  ollama: { kind: \"bearer\" }, // Ollama Cloud / bearer-gated Ollama servers\n  // Anthropic.\n  anthropic: { kind: \"x-api-key\" },\n  // Google (Gemini + Veo) use the x-goog-api-key header scheme.\n  gemini: { kind: \"x-goog-api-key\" },\n  \"gemini-interactions\": { kind: \"x-goog-api-key\" },\n  veo: { kind: \"x-goog-api-key\" },\n  // Azure OpenAI static-key auth.\n  azure: { kind: \"api-key\" },\n  // ElevenLabs.\n  elevenlabs: { kind: \"xi-api-key\" },\n  // fal.ai — uses the `Key ` prefix on Authorization, NOT `Bearer `.\n  fal: { kind: \"fal-key\" },\n};\n\nexport function hasStaticProviderAuthScheme(providerKey: RecordProviderKey): boolean {\n  return PROVIDER_AUTH_SCHEMES[providerKey] !== undefined;\n}\n\n/** Force a known provider credential onto an already-scrubbed outbound map. */\nexport function applyConfiguredProviderAuth(\n  forwardHeaders: Record<string, string>,\n  target: URL,\n  providerKey: RecordProviderKey,\n  providerCredential: string,\n): boolean {\n  void target;\n  const scheme = PROVIDER_AUTH_SCHEMES[providerKey];\n  if (!scheme) return false;\n  switch (scheme.kind) {\n    case \"bearer\":\n      takeHeader(forwardHeaders, \"authorization\");\n      forwardHeaders.Authorization = `Bearer ${providerCredential}`;\n      break;\n    case \"fal-key\":\n      takeHeader(forwardHeaders, \"authorization\");\n      forwardHeaders.Authorization = `Key ${providerCredential}`;\n      break;\n    default:\n      takeHeader(forwardHeaders, authHeaderName(scheme));\n      forwardHeaders[authHeaderName(scheme)] = providerCredential;\n  }\n  return true;\n}\n\n/**\n * Case-insensitively delete a header from a forward-header map, returning the\n * value that was present (if any). Header maps preserve the original casing of\n * incoming headers, so we can't assume a canonical key.\n */\nfunction takeHeader(headers: Record<string, string>, name: string): string | undefined {\n  const lowerName = name.toLowerCase();\n  let found: string | undefined;\n  for (const key of Object.keys(headers)) {\n    if (key.toLowerCase() === lowerName) {\n      found = headers[key];\n      delete headers[key];\n    }\n  }\n  return found;\n}\n\n/**\n * Extract the caller's credential value for a given auth scheme from the\n * forwarded headers, if present. For bearer, strips the `Bearer ` prefix.\n */\nfunction readCallerCredential(\n  headers: Record<string, string>,\n  scheme: AuthScheme,\n): string | undefined {\n  if (scheme.kind === \"bearer\" || scheme.kind === \"fal-key\") {\n    const raw = scanHeader(headers, \"authorization\");\n    if (raw === undefined) return undefined;\n    // Strip the scheme prefix (`Bearer ` for bearer, `Key ` for fal) if present,\n    // otherwise treat the whole value as the credential.\n    const prefix = scheme.kind === \"fal-key\" ? \"Key\" : \"Bearer\";\n    const match = new RegExp(`^\\\\s*${prefix}\\\\s+(.+)$`, \"i\").exec(raw);\n    return match ? match[1].trim() : raw.trim();\n  }\n  return scanHeader(headers, authHeaderName(scheme));\n}\n\n/**\n * The wire header name a non-Authorization scheme carries its credential in.\n * (bearer/fal-key both use `Authorization` and are handled separately.)\n */\nfunction authHeaderName(scheme: AuthScheme): string {\n  switch (scheme.kind) {\n    case \"x-api-key\":\n      return \"x-api-key\";\n    case \"x-goog-api-key\":\n      return \"x-goog-api-key\";\n    case \"api-key\":\n      return \"api-key\";\n    case \"xi-api-key\":\n      return \"xi-api-key\";\n    case \"bearer\":\n    case \"fal-key\":\n      return \"authorization\";\n  }\n}\n\n/** Case-insensitive header lookup that does not mutate the map. */\nfunction scanHeader(headers: Record<string, string>, name: string): string | undefined {\n  const lowerName = name.toLowerCase();\n  for (const key of Object.keys(headers)) {\n    if (key.toLowerCase() === lowerName) return headers[key];\n  }\n  return undefined;\n}\n\n/**\n * Decide whether aimock should override the caller's credential with its own\n * built-in key. Override when the caller sent no credential OR sent a dummy\n * placeholder (prefixed with the active marker). A real caller key is left\n * untouched so the caller can always override aimock.\n */\nfunction shouldOverride(callerCredential: string | undefined, marker: string): boolean {\n  if (callerCredential === undefined || callerCredential.length === 0) return true;\n  return callerCredential.startsWith(marker);\n}\n\n/**\n * Inject aimock's built-in upstream credential into the forwarded headers when\n * appropriate (opt-in, backward-compatible). Mutates `forwardHeaders` in place\n * and may mutate `target` (query-param schemes; none currently).\n *\n * Precedence:\n *   - No built-in key configured for this provider    → no-op (forward verbatim).\n *   - Provider not a static-key scheme                → no-op (Bedrock SigV4 / Vertex AI OAuth).\n *   - Caller credential absent or dummy-prefixed      → inject built-in key.\n *   - Caller credential is a real key                 → forward it unchanged.\n *\n * @param forwardHeaders headers already built by buildForwardHeaders(req)\n * @param target upstream URL (reserved for query-param auth schemes)\n * @param providerKey which provider this request is routed to\n * @param builtinKey aimock's configured key for this provider (if any)\n */\nexport function applyProviderAuth(\n  forwardHeaders: Record<string, string>,\n  target: URL,\n  providerKey: RecordProviderKey,\n  builtinKey: string | undefined,\n): void {\n  void target; // reserved for future query-param schemes (e.g. Gemini ?key=)\n  if (!builtinKey) return; // feature inert for this provider\n\n  const scheme = PROVIDER_AUTH_SCHEMES[providerKey];\n  if (!scheme) return; // signed/OAuth provider — never rewrite auth\n\n  const marker = getDummyKeyMarker();\n  const callerCredential = readCallerCredential(forwardHeaders, scheme);\n  if (!shouldOverride(callerCredential, marker)) return; // caller sent a real key\n\n  // Strip any existing auth headers for this scheme (across casings) before\n  // setting aimock's key, so a dummy caller key can't linger alongside ours.\n  switch (scheme.kind) {\n    case \"bearer\":\n      takeHeader(forwardHeaders, \"authorization\");\n      forwardHeaders[\"Authorization\"] = `Bearer ${builtinKey}`;\n      break;\n    case \"fal-key\":\n      takeHeader(forwardHeaders, \"authorization\");\n      forwardHeaders[\"Authorization\"] = `Key ${builtinKey}`;\n      break;\n    case \"x-api-key\":\n      takeHeader(forwardHeaders, \"x-api-key\");\n      forwardHeaders[\"x-api-key\"] = builtinKey;\n      break;\n    case \"x-goog-api-key\":\n      takeHeader(forwardHeaders, \"x-goog-api-key\");\n      forwardHeaders[\"x-goog-api-key\"] = builtinKey;\n      break;\n    case \"api-key\":\n      takeHeader(forwardHeaders, \"api-key\");\n      forwardHeaders[\"api-key\"] = builtinKey;\n      break;\n    case \"xi-api-key\":\n      takeHeader(forwardHeaders, \"xi-api-key\");\n      forwardHeaders[\"xi-api-key\"] = builtinKey;\n      break;\n  }\n}\n\n/**\n * Read per-provider built-in keys from the environment. Returns undefined when\n * no provider key is configured so the feature stays fully inert by default.\n *\n * Each wired static-key provider reads `AIMOCK_PROVIDER_<PROVIDER>_KEY`. An\n * empty-string value is treated as unset (existing truthiness pattern), keeping\n * the feature inert. `gemini-interactions` is not read here: it reuses the\n * Gemini key via the lookup-key remap in `proxyAndRecord`. Signed/OAuth\n * providers (`bedrock`, `vertexai`) have no env var — aimock never rewrites\n * their auth.\n */\nexport function readProviderKeysFromEnv(\n  env: NodeJS.ProcessEnv = process.env,\n): Partial<Record<RecordProviderKey, string>> | undefined {\n  const keys: Partial<Record<RecordProviderKey, string>> = {};\n  if (env.AIMOCK_PROVIDER_OPENAI_KEY) keys.openai = env.AIMOCK_PROVIDER_OPENAI_KEY;\n  if (env.AIMOCK_PROVIDER_ANTHROPIC_KEY) keys.anthropic = env.AIMOCK_PROVIDER_ANTHROPIC_KEY;\n  if (env.AIMOCK_PROVIDER_GEMINI_KEY) keys.gemini = env.AIMOCK_PROVIDER_GEMINI_KEY;\n  if (env.AIMOCK_PROVIDER_OPENROUTER_KEY) keys.openrouter = env.AIMOCK_PROVIDER_OPENROUTER_KEY;\n  if (env.AIMOCK_PROVIDER_COHERE_KEY) keys.cohere = env.AIMOCK_PROVIDER_COHERE_KEY;\n  if (env.AIMOCK_PROVIDER_GROK_KEY) keys.grok = env.AIMOCK_PROVIDER_GROK_KEY;\n  if (env.AIMOCK_PROVIDER_BYTEPLUS_KEY) keys.byteplus = env.AIMOCK_PROVIDER_BYTEPLUS_KEY;\n  if (env.AIMOCK_PROVIDER_OLLAMA_KEY) keys.ollama = env.AIMOCK_PROVIDER_OLLAMA_KEY;\n  if (env.AIMOCK_PROVIDER_VEO_KEY) keys.veo = env.AIMOCK_PROVIDER_VEO_KEY;\n  if (env.AIMOCK_PROVIDER_AZURE_KEY) keys.azure = env.AIMOCK_PROVIDER_AZURE_KEY;\n  if (env.AIMOCK_PROVIDER_ELEVENLABS_KEY) keys.elevenlabs = env.AIMOCK_PROVIDER_ELEVENLABS_KEY;\n  if (env.AIMOCK_PROVIDER_FAL_KEY) keys.fal = env.AIMOCK_PROVIDER_FAL_KEY;\n  return Object.keys(keys).length > 0 ? keys : undefined;\n}\n"],"mappings":";;;;;;;;;;;;AAaA,MAAa,2BAA2B;;AAGxC,SAAgB,oBAA4B;CAC1C,MAAM,WAAW,QAAQ,IAAI;AAC7B,QAAO,YAAY,SAAS,SAAS,IAAI,WAAW;;AAgCtD,MAAM,wBAAwE;CAE5E,QAAQ,EAAE,MAAM,UAAU;CAC1B,YAAY,EAAE,MAAM,UAAU;CAC9B,QAAQ,EAAE,MAAM,UAAU;CAC1B,MAAM,EAAE,MAAM,UAAU;CACxB,UAAU,EAAE,MAAM,UAAU;CAC5B,QAAQ,EAAE,MAAM,UAAU;CAE1B,WAAW,EAAE,MAAM,aAAa;CAEhC,QAAQ,EAAE,MAAM,kBAAkB;CAClC,uBAAuB,EAAE,MAAM,kBAAkB;CACjD,KAAK,EAAE,MAAM,kBAAkB;CAE/B,OAAO,EAAE,MAAM,WAAW;CAE1B,YAAY,EAAE,MAAM,cAAc;CAElC,KAAK,EAAE,MAAM,WAAW;CACzB;;AAOD,SAAgB,4BACd,gBACA,QACA,aACA,oBACS;CAET,MAAM,SAAS,sBAAsB;AACrC,KAAI,CAAC,OAAQ,QAAO;AACpB,SAAQ,OAAO,MAAf;EACE,KAAK;AACH,cAAW,gBAAgB,gBAAgB;AAC3C,kBAAe,gBAAgB,UAAU;AACzC;EACF,KAAK;AACH,cAAW,gBAAgB,gBAAgB;AAC3C,kBAAe,gBAAgB,OAAO;AACtC;EACF;AACE,cAAW,gBAAgB,eAAe,OAAO,CAAC;AAClD,kBAAe,eAAe,OAAO,IAAI;;AAE7C,QAAO;;;;;;;AAQT,SAAS,WAAW,SAAiC,MAAkC;CACrF,MAAM,YAAY,KAAK,aAAa;CACpC,IAAI;AACJ,MAAK,MAAM,OAAO,OAAO,KAAK,QAAQ,CACpC,KAAI,IAAI,aAAa,KAAK,WAAW;AACnC,UAAQ,QAAQ;AAChB,SAAO,QAAQ;;AAGnB,QAAO;;;;;;AAOT,SAAS,qBACP,SACA,QACoB;AACpB,KAAI,OAAO,SAAS,YAAY,OAAO,SAAS,WAAW;EACzD,MAAM,MAAM,WAAW,SAAS,gBAAgB;AAChD,MAAI,QAAQ,OAAW,QAAO;EAG9B,MAAM,SAAS,OAAO,SAAS,YAAY,QAAQ;EACnD,MAAM,QAAQ,IAAI,OAAO,QAAQ,OAAO,YAAY,IAAI,CAAC,KAAK,IAAI;AAClE,SAAO,QAAQ,MAAM,GAAG,MAAM,GAAG,IAAI,MAAM;;AAE7C,QAAO,WAAW,SAAS,eAAe,OAAO,CAAC;;;;;;AAOpD,SAAS,eAAe,QAA4B;AAClD,SAAQ,OAAO,MAAf;EACE,KAAK,YACH,QAAO;EACT,KAAK,iBACH,QAAO;EACT,KAAK,UACH,QAAO;EACT,KAAK,aACH,QAAO;EACT,KAAK;EACL,KAAK,UACH,QAAO;;;;AAKb,SAAS,WAAW,SAAiC,MAAkC;CACrF,MAAM,YAAY,KAAK,aAAa;AACpC,MAAK,MAAM,OAAO,OAAO,KAAK,QAAQ,CACpC,KAAI,IAAI,aAAa,KAAK,UAAW,QAAO,QAAQ;;;;;;;;AAWxD,SAAS,eAAe,kBAAsC,QAAyB;AACrF,KAAI,qBAAqB,UAAa,iBAAiB,WAAW,EAAG,QAAO;AAC5E,QAAO,iBAAiB,WAAW,OAAO;;;;;;;;;;;;;;;;;;AAmB5C,SAAgB,kBACd,gBACA,QACA,aACA,YACM;AAEN,KAAI,CAAC,WAAY;CAEjB,MAAM,SAAS,sBAAsB;AACrC,KAAI,CAAC,OAAQ;CAEb,MAAM,SAAS,mBAAmB;AAElC,KAAI,CAAC,eADoB,qBAAqB,gBAAgB,OAAO,EAC/B,OAAO,CAAE;AAI/C,SAAQ,OAAO,MAAf;EACE,KAAK;AACH,cAAW,gBAAgB,gBAAgB;AAC3C,kBAAe,mBAAmB,UAAU;AAC5C;EACF,KAAK;AACH,cAAW,gBAAgB,gBAAgB;AAC3C,kBAAe,mBAAmB,OAAO;AACzC;EACF,KAAK;AACH,cAAW,gBAAgB,YAAY;AACvC,kBAAe,eAAe;AAC9B;EACF,KAAK;AACH,cAAW,gBAAgB,iBAAiB;AAC5C,kBAAe,oBAAoB;AACnC;EACF,KAAK;AACH,cAAW,gBAAgB,UAAU;AACrC,kBAAe,aAAa;AAC5B;EACF,KAAK;AACH,cAAW,gBAAgB,aAAa;AACxC,kBAAe,gBAAgB;AAC/B;;;;;;;;;;;;;;AAeN,SAAgB,wBACd,MAAyB,QAAQ,KACuB;CACxD,MAAM,OAAmD,EAAE;AAC3D,KAAI,IAAI,2BAA4B,MAAK,SAAS,IAAI;AACtD,KAAI,IAAI,8BAA+B,MAAK,YAAY,IAAI;AAC5D,KAAI,IAAI,2BAA4B,MAAK,SAAS,IAAI;AACtD,KAAI,IAAI,+BAAgC,MAAK,aAAa,IAAI;AAC9D,KAAI,IAAI,2BAA4B,MAAK,SAAS,IAAI;AACtD,KAAI,IAAI,yBAA0B,MAAK,OAAO,IAAI;AAClD,KAAI,IAAI,6BAA8B,MAAK,WAAW,IAAI;AAC1D,KAAI,IAAI,2BAA4B,MAAK,SAAS,IAAI;AACtD,KAAI,IAAI,wBAAyB,MAAK,MAAM,IAAI;AAChD,KAAI,IAAI,0BAA2B,MAAK,QAAQ,IAAI;AACpD,KAAI,IAAI,+BAAgC,MAAK,aAAa,IAAI;AAC9D,KAAI,IAAI,wBAAyB,MAAK,MAAM,IAAI;AAChD,QAAO,OAAO,KAAK,KAAK,CAAC,SAAS,IAAI,OAAO"}

package/dist/rerank.cjs

@@ -28,7 +28,46 @@ async function handleRerank(req, res, raw, fixtures, journal, defaults, setCorsH
 		} }));
 		return;
 	}
-	const query = body.query ?? "";
+	if (!require_helpers.isJsonObject(body)) {
+		journal.add({
+			method: req.method ?? "POST",
+			path: req.url ?? "/v2/rerank",
+			headers: require_helpers.flattenHeaders(req.headers),
+			body: null,
+			service: "rerank",
+			response: {
+				status: 400,
+				fixture: null
+			}
+		});
+		res.writeHead(400, { "Content-Type": "application/json" });
+		res.end(JSON.stringify({ error: {
+			message: "Request body must be a JSON object",
+			type: "invalid_request_error"
+		} }));
+		return;
+	}
+	const normalizedQuery = require_helpers.normalizeTextInput(body.query ?? "");
+	if (normalizedQuery === null) {
+		journal.add({
+			method: req.method ?? "POST",
+			path: req.url ?? "/v2/rerank",
+			headers: require_helpers.flattenHeaders(req.headers),
+			body: null,
+			service: "rerank",
+			response: {
+				status: 400,
+				fixture: null
+			}
+		});
+		res.writeHead(400, { "Content-Type": "application/json" });
+		res.end(JSON.stringify({ error: {
+			message: "Invalid parameter: 'query' must be a string or an array of strings",
+			type: "invalid_request_error"
+		} }));
+		return;
+	}
+	const query = normalizedQuery;
 	let matchedResults = [];
 	let matchedFixture = null;
 	for (const fixture of fixtures) if (require_helpers.matchesPattern(query, fixture.match)) {
@@ -38,6 +77,29 @@ async function handleRerank(req, res, raw, fixtures, journal, defaults, setCorsH
 	}
 	if (matchedFixture) logger.debug(`Rerank fixture matched for query "${query.slice(0, 80)}"`);
 	else logger.debug(`No rerank fixture matched for query "${query.slice(0, 80)}" — returning empty`);
+	if (!matchedFixture && require_helpers.resolveStrictMode(defaults.strict, req.headers)) {
+		const strictMessage = require_helpers.strictNoMatchMessage(0);
+		logger.error(require_helpers.strictNoMatchLogLine(req.method ?? "POST", req.url ?? "/v2/rerank", 0));
+		journal.add({
+			method: req.method ?? "POST",
+			path: req.url ?? "/v2/rerank",
+			headers: require_helpers.flattenHeaders(req.headers),
+			body: null,
+			service: "rerank",
+			response: {
+				status: 503,
+				fixture: null,
+				...require_helpers.strictOverrideField(defaults.strict, req.headers)
+			}
+		});
+		res.writeHead(503, { "Content-Type": "application/json" });
+		res.end(JSON.stringify({ error: {
+			message: strictMessage,
+			type: "invalid_request_error",
+			code: "no_fixture_match"
+		} }));
+		return;
+	}
 	const results = matchedResults.map((r) => ({
 		index: r.index,
 		relevance_score: r.relevance_score
@@ -50,7 +112,8 @@ async function handleRerank(req, res, raw, fixtures, journal, defaults, setCorsH
 		service: "rerank",
 		response: {
 			status: 200,
-			fixture: null
+			fixture: null,
+			...require_helpers.strictOverrideField(defaults.strict, req.headers)
 		}
 	});
 	res.writeHead(200, { "Content-Type": "application/json" });

package/dist/rerank.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"rerank.cjs","names":["flattenHeaders","matchesPattern","generateId"],"sources":["../src/rerank.ts"],"sourcesContent":["/**\n * Reranking API support for LLMock.\n *\n * Handles POST /v2/rerank requests (Cohere rerank-compatible). Matches\n * fixtures by comparing the request `query` field against registered\n * patterns. First match wins; no match returns empty results.\n */\n\nimport type * as http from \"node:http\";\nimport { flattenHeaders, generateId, matchesPattern } from \"./helpers.js\";\nimport type { Journal } from \"./journal.js\";\nimport type { Logger } from \"./logger.js\";\n\n// ─── Rerank types ─────────────────────────────────────────────────────────\n\nexport interface RerankResult {\n  index: number;\n  relevance_score: number;\n}\n\nexport interface RerankFixture {\n  match: string | RegExp;\n  results: RerankResult[];\n}\n\n// ─── Request handler ──────────────────────────────────────────────────────\n\nexport async function handleRerank(\n  req: http.IncomingMessage,\n  res: http.ServerResponse,\n  raw: string,\n  fixtures: RerankFixture[],\n  journal: Journal,\n  defaults: { logger: Logger },\n  setCorsHeaders: (res: http.ServerResponse) => void,\n): Promise<void> {\n  const { logger } = defaults;\n  setCorsHeaders(res);\n\n  let body: { query?: string; model?: string };\n  try {\n    body = JSON.parse(raw) as { query?: string; model?: string };\n  } catch (parseErr) {\n    const detail = parseErr instanceof Error ? parseErr.message : \"unknown\";\n    journal.add({\n      method: req.method ?? \"POST\",\n      path: req.url ?? \"/v2/rerank\",\n      headers: flattenHeaders(req.headers),\n      body: null,\n      service: \"rerank\",\n      response: { status: 400, fixture: null },\n    });\n    res.writeHead(400, { \"Content-Type\": \"application/json\" });\n    res.end(\n      JSON.stringify({\n        error: {\n          message: `Malformed JSON: ${detail}`,\n          type: \"invalid_request_error\",\n          code: \"invalid_json\",\n        },\n      }),\n    );\n    return;\n  }\n\n  const query = body.query ?? \"\";\n\n  // Find first matching fixture\n  let matchedResults: RerankResult[] = [];\n  let matchedFixture: RerankFixture | null = null;\n\n  for (const fixture of fixtures) {\n    if (matchesPattern(query, fixture.match)) {\n      matchedFixture = fixture;\n      matchedResults = fixture.results;\n      break;\n    }\n  }\n\n  if (matchedFixture) {\n    logger.debug(`Rerank fixture matched for query \"${query.slice(0, 80)}\"`);\n  } else {\n    logger.debug(`No rerank fixture matched for query \"${query.slice(0, 80)}\" — returning empty`);\n  }\n\n  // Build response (Cohere rerank v2 format: index + relevance_score only)\n  const results = matchedResults.map((r) => ({\n    index: r.index,\n    relevance_score: r.relevance_score,\n  }));\n\n  journal.add({\n    method: req.method ?? \"POST\",\n    path: req.url ?? \"/v2/rerank\",\n    headers: flattenHeaders(req.headers),\n    body: null,\n    service: \"rerank\",\n    response: { status: 200, fixture: null },\n  });\n\n  res.writeHead(200, { \"Content-Type\": \"application/json\" });\n  res.end(\n    JSON.stringify({\n      id: generateId(\"rerank\"),\n      results,\n      meta: {\n        billed_units: { search_units: 0 },\n      },\n    }),\n  );\n}\n"],"mappings":";;;AA2BA,eAAsB,aACpB,KACA,KACA,KACA,UACA,SACA,UACA,gBACe;CACf,MAAM,EAAE,WAAW;AACnB,gBAAe,IAAI;CAEnB,IAAI;AACJ,KAAI;AACF,SAAO,KAAK,MAAM,IAAI;UACf,UAAU;EACjB,MAAM,SAAS,oBAAoB,QAAQ,SAAS,UAAU;AAC9D,UAAQ,IAAI;GACV,QAAQ,IAAI,UAAU;GACtB,MAAM,IAAI,OAAO;GACjB,SAASA,+BAAe,IAAI,QAAQ;GACpC,MAAM;GACN,SAAS;GACT,UAAU;IAAE,QAAQ;IAAK,SAAS;IAAM;GACzC,CAAC;AACF,MAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,MAAI,IACF,KAAK,UAAU,EACb,OAAO;GACL,SAAS,mBAAmB;GAC5B,MAAM;GACN,MAAM;GACP,EACF,CAAC,CACH;AACD;;CAGF,MAAM,QAAQ,KAAK,SAAS;CAG5B,IAAI,iBAAiC,EAAE;CACvC,IAAI,iBAAuC;AAE3C,MAAK,MAAM,WAAW,SACpB,KAAIC,+BAAe,OAAO,QAAQ,MAAM,EAAE;AACxC,mBAAiB;AACjB,mBAAiB,QAAQ;AACzB;;AAIJ,KAAI,eACF,QAAO,MAAM,qCAAqC,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG;KAExE,QAAO,MAAM,wCAAwC,MAAM,MAAM,GAAG,GAAG,CAAC,qBAAqB;CAI/F,MAAM,UAAU,eAAe,KAAK,OAAO;EACzC,OAAO,EAAE;EACT,iBAAiB,EAAE;EACpB,EAAE;AAEH,SAAQ,IAAI;EACV,QAAQ,IAAI,UAAU;EACtB,MAAM,IAAI,OAAO;EACjB,SAASD,+BAAe,IAAI,QAAQ;EACpC,MAAM;EACN,SAAS;EACT,UAAU;GAAE,QAAQ;GAAK,SAAS;GAAM;EACzC,CAAC;AAEF,KAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,KAAI,IACF,KAAK,UAAU;EACb,IAAIE,2BAAW,SAAS;EACxB;EACA,MAAM,EACJ,cAAc,EAAE,cAAc,GAAG,EAClC;EACF,CAAC,CACH"}
+{"version":3,"file":"rerank.cjs","names":["flattenHeaders","isJsonObject","normalizeTextInput","matchesPattern","resolveStrictMode","strictNoMatchMessage","strictNoMatchLogLine","strictOverrideField","generateId"],"sources":["../src/rerank.ts"],"sourcesContent":["/**\n * Reranking API support for LLMock.\n *\n * Handles POST /v2/rerank requests (Cohere rerank-compatible). Matches\n * fixtures by comparing the request `query` field against registered\n * patterns. First match wins; no match returns empty results.\n */\n\nimport type * as http from \"node:http\";\nimport {\n  flattenHeaders,\n  generateId,\n  isJsonObject,\n  matchesPattern,\n  normalizeTextInput,\n  resolveStrictMode,\n  strictNoMatchLogLine,\n  strictNoMatchMessage,\n  strictOverrideField,\n} from \"./helpers.js\";\nimport type { Journal } from \"./journal.js\";\nimport type { Logger } from \"./logger.js\";\n\n// ─── Rerank types ─────────────────────────────────────────────────────────\n\nexport interface RerankResult {\n  index: number;\n  relevance_score: number;\n}\n\nexport interface RerankFixture {\n  match: string | RegExp;\n  results: RerankResult[];\n}\n\n// ─── Request handler ──────────────────────────────────────────────────────\n\nexport async function handleRerank(\n  req: http.IncomingMessage,\n  res: http.ServerResponse,\n  raw: string,\n  fixtures: RerankFixture[],\n  journal: Journal,\n  defaults: { logger: Logger; strict?: boolean },\n  setCorsHeaders: (res: http.ServerResponse) => void,\n): Promise<void> {\n  const { logger } = defaults;\n  setCorsHeaders(res);\n\n  let body: { query?: unknown; model?: string };\n  try {\n    body = JSON.parse(raw) as { query?: unknown; model?: string };\n  } catch (parseErr) {\n    const detail = parseErr instanceof Error ? parseErr.message : \"unknown\";\n    journal.add({\n      method: req.method ?? \"POST\",\n      path: req.url ?? \"/v2/rerank\",\n      headers: flattenHeaders(req.headers),\n      body: null,\n      service: \"rerank\",\n      response: { status: 400, fixture: null },\n    });\n    res.writeHead(400, { \"Content-Type\": \"application/json\" });\n    res.end(\n      JSON.stringify({\n        error: {\n          message: `Malformed JSON: ${detail}`,\n          type: \"invalid_request_error\",\n          code: \"invalid_json\",\n        },\n      }),\n    );\n    return;\n  }\n\n  // Reject bodies that parsed but are not a JSON object (e.g. `null`) before\n  // touching fields — otherwise `body.query` throws a TypeError that surfaces\n  // as a 500 instead of a 400.\n  if (!isJsonObject(body)) {\n    journal.add({\n      method: req.method ?? \"POST\",\n      path: req.url ?? \"/v2/rerank\",\n      headers: flattenHeaders(req.headers),\n      body: null,\n      service: \"rerank\",\n      response: { status: 400, fixture: null },\n    });\n    res.writeHead(400, { \"Content-Type\": \"application/json\" });\n    res.end(\n      JSON.stringify({\n        error: {\n          message: \"Request body must be a JSON object\",\n          type: \"invalid_request_error\",\n        },\n      }),\n    );\n    return;\n  }\n\n  const rawQuery: unknown = body.query ?? \"\";\n  const normalizedQuery = normalizeTextInput(rawQuery);\n  if (normalizedQuery === null) {\n    journal.add({\n      method: req.method ?? \"POST\",\n      path: req.url ?? \"/v2/rerank\",\n      headers: flattenHeaders(req.headers),\n      body: null,\n      service: \"rerank\",\n      response: { status: 400, fixture: null },\n    });\n    res.writeHead(400, { \"Content-Type\": \"application/json\" });\n    res.end(\n      JSON.stringify({\n        error: {\n          message: \"Invalid parameter: 'query' must be a string or an array of strings\",\n          type: \"invalid_request_error\",\n        },\n      }),\n    );\n    return;\n  }\n  const query = normalizedQuery;\n\n  // Find first matching fixture\n  let matchedResults: RerankResult[] = [];\n  let matchedFixture: RerankFixture | null = null;\n\n  for (const fixture of fixtures) {\n    if (matchesPattern(query, fixture.match)) {\n      matchedFixture = fixture;\n      matchedResults = fixture.results;\n      break;\n    }\n  }\n\n  if (matchedFixture) {\n    logger.debug(`Rerank fixture matched for query \"${query.slice(0, 80)}\"`);\n  } else {\n    logger.debug(`No rerank fixture matched for query \"${query.slice(0, 80)}\" — returning empty`);\n  }\n\n  // Strict mode turns the lenient default (empty results) into a no-match\n  // error, like every other fixture-matching handler. These fixtures carry no\n  // sequence/turn state, so the skipped count is always 0.\n  if (!matchedFixture && resolveStrictMode(defaults.strict, req.headers)) {\n    const strictMessage = strictNoMatchMessage(0);\n    logger.error(strictNoMatchLogLine(req.method ?? \"POST\", req.url ?? \"/v2/rerank\", 0));\n    journal.add({\n      method: req.method ?? \"POST\",\n      path: req.url ?? \"/v2/rerank\",\n      headers: flattenHeaders(req.headers),\n      body: null,\n      service: \"rerank\",\n      response: {\n        status: 503,\n        fixture: null,\n        ...strictOverrideField(defaults.strict, req.headers),\n      },\n    });\n    res.writeHead(503, { \"Content-Type\": \"application/json\" });\n    res.end(\n      JSON.stringify({\n        error: {\n          message: strictMessage,\n          type: \"invalid_request_error\",\n          code: \"no_fixture_match\",\n        },\n      }),\n    );\n    return;\n  }\n\n  // Build response (Cohere rerank v2 format: index + relevance_score only)\n  const results = matchedResults.map((r) => ({\n    index: r.index,\n    relevance_score: r.relevance_score,\n  }));\n\n  journal.add({\n    method: req.method ?? \"POST\",\n    path: req.url ?? \"/v2/rerank\",\n    headers: flattenHeaders(req.headers),\n    body: null,\n    service: \"rerank\",\n    response: {\n      status: 200,\n      fixture: null,\n      ...strictOverrideField(defaults.strict, req.headers),\n    },\n  });\n\n  res.writeHead(200, { \"Content-Type\": \"application/json\" });\n  res.end(\n    JSON.stringify({\n      id: generateId(\"rerank\"),\n      results,\n      meta: {\n        billed_units: { search_units: 0 },\n      },\n    }),\n  );\n}\n"],"mappings":";;;AAqCA,eAAsB,aACpB,KACA,KACA,KACA,UACA,SACA,UACA,gBACe;CACf,MAAM,EAAE,WAAW;AACnB,gBAAe,IAAI;CAEnB,IAAI;AACJ,KAAI;AACF,SAAO,KAAK,MAAM,IAAI;UACf,UAAU;EACjB,MAAM,SAAS,oBAAoB,QAAQ,SAAS,UAAU;AAC9D,UAAQ,IAAI;GACV,QAAQ,IAAI,UAAU;GACtB,MAAM,IAAI,OAAO;GACjB,SAASA,+BAAe,IAAI,QAAQ;GACpC,MAAM;GACN,SAAS;GACT,UAAU;IAAE,QAAQ;IAAK,SAAS;IAAM;GACzC,CAAC;AACF,MAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,MAAI,IACF,KAAK,UAAU,EACb,OAAO;GACL,SAAS,mBAAmB;GAC5B,MAAM;GACN,MAAM;GACP,EACF,CAAC,CACH;AACD;;AAMF,KAAI,CAACC,6BAAa,KAAK,EAAE;AACvB,UAAQ,IAAI;GACV,QAAQ,IAAI,UAAU;GACtB,MAAM,IAAI,OAAO;GACjB,SAASD,+BAAe,IAAI,QAAQ;GACpC,MAAM;GACN,SAAS;GACT,UAAU;IAAE,QAAQ;IAAK,SAAS;IAAM;GACzC,CAAC;AACF,MAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,MAAI,IACF,KAAK,UAAU,EACb,OAAO;GACL,SAAS;GACT,MAAM;GACP,EACF,CAAC,CACH;AACD;;CAIF,MAAM,kBAAkBE,mCADE,KAAK,SAAS,GACY;AACpD,KAAI,oBAAoB,MAAM;AAC5B,UAAQ,IAAI;GACV,QAAQ,IAAI,UAAU;GACtB,MAAM,IAAI,OAAO;GACjB,SAASF,+BAAe,IAAI,QAAQ;GACpC,MAAM;GACN,SAAS;GACT,UAAU;IAAE,QAAQ;IAAK,SAAS;IAAM;GACzC,CAAC;AACF,MAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,MAAI,IACF,KAAK,UAAU,EACb,OAAO;GACL,SAAS;GACT,MAAM;GACP,EACF,CAAC,CACH;AACD;;CAEF,MAAM,QAAQ;CAGd,IAAI,iBAAiC,EAAE;CACvC,IAAI,iBAAuC;AAE3C,MAAK,MAAM,WAAW,SACpB,KAAIG,+BAAe,OAAO,QAAQ,MAAM,EAAE;AACxC,mBAAiB;AACjB,mBAAiB,QAAQ;AACzB;;AAIJ,KAAI,eACF,QAAO,MAAM,qCAAqC,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG;KAExE,QAAO,MAAM,wCAAwC,MAAM,MAAM,GAAG,GAAG,CAAC,qBAAqB;AAM/F,KAAI,CAAC,kBAAkBC,kCAAkB,SAAS,QAAQ,IAAI,QAAQ,EAAE;EACtE,MAAM,gBAAgBC,qCAAqB,EAAE;AAC7C,SAAO,MAAMC,qCAAqB,IAAI,UAAU,QAAQ,IAAI,OAAO,cAAc,EAAE,CAAC;AACpF,UAAQ,IAAI;GACV,QAAQ,IAAI,UAAU;GACtB,MAAM,IAAI,OAAO;GACjB,SAASN,+BAAe,IAAI,QAAQ;GACpC,MAAM;GACN,SAAS;GACT,UAAU;IACR,QAAQ;IACR,SAAS;IACT,GAAGO,oCAAoB,SAAS,QAAQ,IAAI,QAAQ;IACrD;GACF,CAAC;AACF,MAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,MAAI,IACF,KAAK,UAAU,EACb,OAAO;GACL,SAAS;GACT,MAAM;GACN,MAAM;GACP,EACF,CAAC,CACH;AACD;;CAIF,MAAM,UAAU,eAAe,KAAK,OAAO;EACzC,OAAO,EAAE;EACT,iBAAiB,EAAE;EACpB,EAAE;AAEH,SAAQ,IAAI;EACV,QAAQ,IAAI,UAAU;EACtB,MAAM,IAAI,OAAO;EACjB,SAASP,+BAAe,IAAI,QAAQ;EACpC,MAAM;EACN,SAAS;EACT,UAAU;GACR,QAAQ;GACR,SAAS;GACT,GAAGO,oCAAoB,SAAS,QAAQ,IAAI,QAAQ;GACrD;EACF,CAAC;AAEF,KAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,KAAI,IACF,KAAK,UAAU;EACb,IAAIC,2BAAW,SAAS;EACxB;EACA,MAAM,EACJ,cAAc,EAAE,cAAc,GAAG,EAClC;EACF,CAAC,CACH"}

package/dist/rerank.d.cts

@@ -14,9 +14,9 @@ interface RerankFixture {
 }
 declare function handleRerank(req: http$1.IncomingMessage, res: http$1.ServerResponse, raw: string, fixtures: RerankFixture[], journal: Journal, defaults: {
   logger: Logger;
+  strict?: boolean;
 }, setCorsHeaders: (res: http$1.ServerResponse) => void): Promise<void>;
 //# sourceMappingURL=rerank.d.ts.map
-
 //#endregion
 export { RerankFixture, RerankResult, handleRerank };
 //# sourceMappingURL=rerank.d.cts.map

package/dist/rerank.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"rerank.d.cts","names":[],"sources":["../src/rerank.ts"],"sourcesContent":[],"mappings":";;;;;;AAsBuB,UAPN,YAAA,CAOM;EAKD,KAAA,EAAA,MAAA;EAAY,eAAA,EAAA,MAAA;;AAE3B,UATU,aAAA,CASL;OAEA,EAAA,MAAA,GAVM,MAUN;SACD,EAVA,YAUA,EAAA;;AAEa,iBAPF,YAAA,CAOO,GAAA,EANtB,MAAA,CAAK,eAMiB,EAAA,GAAA,EALtB,MAAA,CAAK,cAKiB,EAAA,GAAA,EAAA,MAAA,EAAA,QAAA,EAHjB,aAGiB,EAAA,EAAA,OAAA,EAFlB,OAEkB,EAAA,QAAA,EAAA;QAC1B,EAFmB,MAEnB;CAAO,EAAA,cAAA,EAAA,CAAA,GAAA,EADc,MAAA,CAAK,cACnB,EAAA,GAAA,IAAA,CAAA,EAAP,OAAO,CAAA,IAAA,CAAA"}
+{"version":3,"file":"rerank.d.cts","names":[],"sources":["../src/rerank.ts"],"sourcesContent":[],"mappings":";;;;;;AAgCuB,UAPN,YAAA,CAOM;EAKD,KAAA,EAAA,MAAA;EAAY,eAAA,EAAA,MAAA;;AAE3B,UATU,aAAA,CASL;OAEA,EAAA,MAAA,GAVM,MAUN;SACD,EAVA,YAUA,EAAA;;AAEa,iBAPF,YAAA,CAOO,GAAA,EANtB,MAAA,CAAK,eAMiB,EAAA,GAAA,EALtB,MAAA,CAAK,cAKiB,EAAA,GAAA,EAAA,MAAA,EAAA,QAAA,EAHjB,aAGiB,EAAA,EAAA,OAAA,EAFlB,OAEkB,EAAA,QAAA,EAAA;QAC1B,EAFmB,MAEnB;EAAO,MAAA,CAAA,EAAA,OAAA;yBADc,MAAA,CAAK,0BAC1B"}

package/dist/rerank.d.ts

@@ -14,9 +14,9 @@ interface RerankFixture {
 }
 declare function handleRerank(req: http$1.IncomingMessage, res: http$1.ServerResponse, raw: string, fixtures: RerankFixture[], journal: Journal, defaults: {
   logger: Logger;
+  strict?: boolean;
 }, setCorsHeaders: (res: http$1.ServerResponse) => void): Promise<void>;
 //# sourceMappingURL=rerank.d.ts.map
-
 //#endregion
 export { RerankFixture, RerankResult, handleRerank };
 //# sourceMappingURL=rerank.d.ts.map

package/dist/rerank.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rerank.d.ts","names":[],"sources":["../src/rerank.ts"],"sourcesContent":[],"mappings":";;;;;;AAsBuB,UAPN,YAAA,CAOM;EAKD,KAAA,EAAA,MAAA;EAAY,eAAA,EAAA,MAAA;;AAE3B,UATU,aAAA,CASL;OAEA,EAAA,MAAA,GAVM,MAUN;SACD,EAVA,YAUA,EAAA;;AAEa,iBAPF,YAAA,CAOO,GAAA,EANtB,MAAA,CAAK,eAMiB,EAAA,GAAA,EALtB,MAAA,CAAK,cAKiB,EAAA,GAAA,EAAA,MAAA,EAAA,QAAA,EAHjB,aAGiB,EAAA,EAAA,OAAA,EAFlB,OAEkB,EAAA,QAAA,EAAA;QAC1B,EAFmB,MAEnB;CAAO,EAAA,cAAA,EAAA,CAAA,GAAA,EADc,MAAA,CAAK,cACnB,EAAA,GAAA,IAAA,CAAA,EAAP,OAAO,CAAA,IAAA,CAAA"}
+{"version":3,"file":"rerank.d.ts","names":[],"sources":["../src/rerank.ts"],"sourcesContent":[],"mappings":";;;;;;AAgCuB,UAPN,YAAA,CAOM;EAKD,KAAA,EAAA,MAAA;EAAY,eAAA,EAAA,MAAA;;AAE3B,UATU,aAAA,CASL;OAEA,EAAA,MAAA,GAVM,MAUN;SACD,EAVA,YAUA,EAAA;;AAEa,iBAPF,YAAA,CAOO,GAAA,EANtB,MAAA,CAAK,eAMiB,EAAA,GAAA,EALtB,MAAA,CAAK,cAKiB,EAAA,GAAA,EAAA,MAAA,EAAA,QAAA,EAHjB,aAGiB,EAAA,EAAA,OAAA,EAFlB,OAEkB,EAAA,QAAA,EAAA;QAC1B,EAFmB,MAEnB;EAAO,MAAA,CAAA,EAAA,OAAA;yBADc,MAAA,CAAK,0BAC1B"}

package/dist/rerank.js

@@ -1,4 +1,4 @@
-import { flattenHeaders, generateId, matchesPattern } from "./helpers.js";
+import { flattenHeaders, generateId, isJsonObject, matchesPattern, normalizeTextInput, resolveStrictMode, strictNoMatchLogLine, strictNoMatchMessage, strictOverrideField } from "./helpers.js";
 
 //#region src/rerank.ts
 async function handleRerank(req, res, raw, fixtures, journal, defaults, setCorsHeaders) {
@@ -28,7 +28,46 @@ async function handleRerank(req, res, raw, fixtures, journal, defaults, setCorsH
 		} }));
 		return;
 	}
-	const query = body.query ?? "";
+	if (!isJsonObject(body)) {
+		journal.add({
+			method: req.method ?? "POST",
+			path: req.url ?? "/v2/rerank",
+			headers: flattenHeaders(req.headers),
+			body: null,
+			service: "rerank",
+			response: {
+				status: 400,
+				fixture: null
+			}
+		});
+		res.writeHead(400, { "Content-Type": "application/json" });
+		res.end(JSON.stringify({ error: {
+			message: "Request body must be a JSON object",
+			type: "invalid_request_error"
+		} }));
+		return;
+	}
+	const normalizedQuery = normalizeTextInput(body.query ?? "");
+	if (normalizedQuery === null) {
+		journal.add({
+			method: req.method ?? "POST",
+			path: req.url ?? "/v2/rerank",
+			headers: flattenHeaders(req.headers),
+			body: null,
+			service: "rerank",
+			response: {
+				status: 400,
+				fixture: null
+			}
+		});
+		res.writeHead(400, { "Content-Type": "application/json" });
+		res.end(JSON.stringify({ error: {
+			message: "Invalid parameter: 'query' must be a string or an array of strings",
+			type: "invalid_request_error"
+		} }));
+		return;
+	}
+	const query = normalizedQuery;
 	let matchedResults = [];
 	let matchedFixture = null;
 	for (const fixture of fixtures) if (matchesPattern(query, fixture.match)) {
@@ -38,6 +77,29 @@ async function handleRerank(req, res, raw, fixtures, journal, defaults, setCorsH
 	}
 	if (matchedFixture) logger.debug(`Rerank fixture matched for query "${query.slice(0, 80)}"`);
 	else logger.debug(`No rerank fixture matched for query "${query.slice(0, 80)}" — returning empty`);
+	if (!matchedFixture && resolveStrictMode(defaults.strict, req.headers)) {
+		const strictMessage = strictNoMatchMessage(0);
+		logger.error(strictNoMatchLogLine(req.method ?? "POST", req.url ?? "/v2/rerank", 0));
+		journal.add({
+			method: req.method ?? "POST",
+			path: req.url ?? "/v2/rerank",
+			headers: flattenHeaders(req.headers),
+			body: null,
+			service: "rerank",
+			response: {
+				status: 503,
+				fixture: null,
+				...strictOverrideField(defaults.strict, req.headers)
+			}
+		});
+		res.writeHead(503, { "Content-Type": "application/json" });
+		res.end(JSON.stringify({ error: {
+			message: strictMessage,
+			type: "invalid_request_error",
+			code: "no_fixture_match"
+		} }));
+		return;
+	}
 	const results = matchedResults.map((r) => ({
 		index: r.index,
 		relevance_score: r.relevance_score
@@ -50,7 +112,8 @@ async function handleRerank(req, res, raw, fixtures, journal, defaults, setCorsH
 		service: "rerank",
 		response: {
 			status: 200,
-			fixture: null
+			fixture: null,
+			...strictOverrideField(defaults.strict, req.headers)
 		}
 	});
 	res.writeHead(200, { "Content-Type": "application/json" });

package/dist/rerank.js.map

@@ -1 +1 @@
-{"version":3,"file":"rerank.js","names":[],"sources":["../src/rerank.ts"],"sourcesContent":["/**\n * Reranking API support for LLMock.\n *\n * Handles POST /v2/rerank requests (Cohere rerank-compatible). Matches\n * fixtures by comparing the request `query` field against registered\n * patterns. First match wins; no match returns empty results.\n */\n\nimport type * as http from \"node:http\";\nimport { flattenHeaders, generateId, matchesPattern } from \"./helpers.js\";\nimport type { Journal } from \"./journal.js\";\nimport type { Logger } from \"./logger.js\";\n\n// ─── Rerank types ─────────────────────────────────────────────────────────\n\nexport interface RerankResult {\n  index: number;\n  relevance_score: number;\n}\n\nexport interface RerankFixture {\n  match: string | RegExp;\n  results: RerankResult[];\n}\n\n// ─── Request handler ──────────────────────────────────────────────────────\n\nexport async function handleRerank(\n  req: http.IncomingMessage,\n  res: http.ServerResponse,\n  raw: string,\n  fixtures: RerankFixture[],\n  journal: Journal,\n  defaults: { logger: Logger },\n  setCorsHeaders: (res: http.ServerResponse) => void,\n): Promise<void> {\n  const { logger } = defaults;\n  setCorsHeaders(res);\n\n  let body: { query?: string; model?: string };\n  try {\n    body = JSON.parse(raw) as { query?: string; model?: string };\n  } catch (parseErr) {\n    const detail = parseErr instanceof Error ? parseErr.message : \"unknown\";\n    journal.add({\n      method: req.method ?? \"POST\",\n      path: req.url ?? \"/v2/rerank\",\n      headers: flattenHeaders(req.headers),\n      body: null,\n      service: \"rerank\",\n      response: { status: 400, fixture: null },\n    });\n    res.writeHead(400, { \"Content-Type\": \"application/json\" });\n    res.end(\n      JSON.stringify({\n        error: {\n          message: `Malformed JSON: ${detail}`,\n          type: \"invalid_request_error\",\n          code: \"invalid_json\",\n        },\n      }),\n    );\n    return;\n  }\n\n  const query = body.query ?? \"\";\n\n  // Find first matching fixture\n  let matchedResults: RerankResult[] = [];\n  let matchedFixture: RerankFixture | null = null;\n\n  for (const fixture of fixtures) {\n    if (matchesPattern(query, fixture.match)) {\n      matchedFixture = fixture;\n      matchedResults = fixture.results;\n      break;\n    }\n  }\n\n  if (matchedFixture) {\n    logger.debug(`Rerank fixture matched for query \"${query.slice(0, 80)}\"`);\n  } else {\n    logger.debug(`No rerank fixture matched for query \"${query.slice(0, 80)}\" — returning empty`);\n  }\n\n  // Build response (Cohere rerank v2 format: index + relevance_score only)\n  const results = matchedResults.map((r) => ({\n    index: r.index,\n    relevance_score: r.relevance_score,\n  }));\n\n  journal.add({\n    method: req.method ?? \"POST\",\n    path: req.url ?? \"/v2/rerank\",\n    headers: flattenHeaders(req.headers),\n    body: null,\n    service: \"rerank\",\n    response: { status: 200, fixture: null },\n  });\n\n  res.writeHead(200, { \"Content-Type\": \"application/json\" });\n  res.end(\n    JSON.stringify({\n      id: generateId(\"rerank\"),\n      results,\n      meta: {\n        billed_units: { search_units: 0 },\n      },\n    }),\n  );\n}\n"],"mappings":";;;AA2BA,eAAsB,aACpB,KACA,KACA,KACA,UACA,SACA,UACA,gBACe;CACf,MAAM,EAAE,WAAW;AACnB,gBAAe,IAAI;CAEnB,IAAI;AACJ,KAAI;AACF,SAAO,KAAK,MAAM,IAAI;UACf,UAAU;EACjB,MAAM,SAAS,oBAAoB,QAAQ,SAAS,UAAU;AAC9D,UAAQ,IAAI;GACV,QAAQ,IAAI,UAAU;GACtB,MAAM,IAAI,OAAO;GACjB,SAAS,eAAe,IAAI,QAAQ;GACpC,MAAM;GACN,SAAS;GACT,UAAU;IAAE,QAAQ;IAAK,SAAS;IAAM;GACzC,CAAC;AACF,MAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,MAAI,IACF,KAAK,UAAU,EACb,OAAO;GACL,SAAS,mBAAmB;GAC5B,MAAM;GACN,MAAM;GACP,EACF,CAAC,CACH;AACD;;CAGF,MAAM,QAAQ,KAAK,SAAS;CAG5B,IAAI,iBAAiC,EAAE;CACvC,IAAI,iBAAuC;AAE3C,MAAK,MAAM,WAAW,SACpB,KAAI,eAAe,OAAO,QAAQ,MAAM,EAAE;AACxC,mBAAiB;AACjB,mBAAiB,QAAQ;AACzB;;AAIJ,KAAI,eACF,QAAO,MAAM,qCAAqC,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG;KAExE,QAAO,MAAM,wCAAwC,MAAM,MAAM,GAAG,GAAG,CAAC,qBAAqB;CAI/F,MAAM,UAAU,eAAe,KAAK,OAAO;EACzC,OAAO,EAAE;EACT,iBAAiB,EAAE;EACpB,EAAE;AAEH,SAAQ,IAAI;EACV,QAAQ,IAAI,UAAU;EACtB,MAAM,IAAI,OAAO;EACjB,SAAS,eAAe,IAAI,QAAQ;EACpC,MAAM;EACN,SAAS;EACT,UAAU;GAAE,QAAQ;GAAK,SAAS;GAAM;EACzC,CAAC;AAEF,KAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,KAAI,IACF,KAAK,UAAU;EACb,IAAI,WAAW,SAAS;EACxB;EACA,MAAM,EACJ,cAAc,EAAE,cAAc,GAAG,EAClC;EACF,CAAC,CACH"}
+{"version":3,"file":"rerank.js","names":[],"sources":["../src/rerank.ts"],"sourcesContent":["/**\n * Reranking API support for LLMock.\n *\n * Handles POST /v2/rerank requests (Cohere rerank-compatible). Matches\n * fixtures by comparing the request `query` field against registered\n * patterns. First match wins; no match returns empty results.\n */\n\nimport type * as http from \"node:http\";\nimport {\n  flattenHeaders,\n  generateId,\n  isJsonObject,\n  matchesPattern,\n  normalizeTextInput,\n  resolveStrictMode,\n  strictNoMatchLogLine,\n  strictNoMatchMessage,\n  strictOverrideField,\n} from \"./helpers.js\";\nimport type { Journal } from \"./journal.js\";\nimport type { Logger } from \"./logger.js\";\n\n// ─── Rerank types ─────────────────────────────────────────────────────────\n\nexport interface RerankResult {\n  index: number;\n  relevance_score: number;\n}\n\nexport interface RerankFixture {\n  match: string | RegExp;\n  results: RerankResult[];\n}\n\n// ─── Request handler ──────────────────────────────────────────────────────\n\nexport async function handleRerank(\n  req: http.IncomingMessage,\n  res: http.ServerResponse,\n  raw: string,\n  fixtures: RerankFixture[],\n  journal: Journal,\n  defaults: { logger: Logger; strict?: boolean },\n  setCorsHeaders: (res: http.ServerResponse) => void,\n): Promise<void> {\n  const { logger } = defaults;\n  setCorsHeaders(res);\n\n  let body: { query?: unknown; model?: string };\n  try {\n    body = JSON.parse(raw) as { query?: unknown; model?: string };\n  } catch (parseErr) {\n    const detail = parseErr instanceof Error ? parseErr.message : \"unknown\";\n    journal.add({\n      method: req.method ?? \"POST\",\n      path: req.url ?? \"/v2/rerank\",\n      headers: flattenHeaders(req.headers),\n      body: null,\n      service: \"rerank\",\n      response: { status: 400, fixture: null },\n    });\n    res.writeHead(400, { \"Content-Type\": \"application/json\" });\n    res.end(\n      JSON.stringify({\n        error: {\n          message: `Malformed JSON: ${detail}`,\n          type: \"invalid_request_error\",\n          code: \"invalid_json\",\n        },\n      }),\n    );\n    return;\n  }\n\n  // Reject bodies that parsed but are not a JSON object (e.g. `null`) before\n  // touching fields — otherwise `body.query` throws a TypeError that surfaces\n  // as a 500 instead of a 400.\n  if (!isJsonObject(body)) {\n    journal.add({\n      method: req.method ?? \"POST\",\n      path: req.url ?? \"/v2/rerank\",\n      headers: flattenHeaders(req.headers),\n      body: null,\n      service: \"rerank\",\n      response: { status: 400, fixture: null },\n    });\n    res.writeHead(400, { \"Content-Type\": \"application/json\" });\n    res.end(\n      JSON.stringify({\n        error: {\n          message: \"Request body must be a JSON object\",\n          type: \"invalid_request_error\",\n        },\n      }),\n    );\n    return;\n  }\n\n  const rawQuery: unknown = body.query ?? \"\";\n  const normalizedQuery = normalizeTextInput(rawQuery);\n  if (normalizedQuery === null) {\n    journal.add({\n      method: req.method ?? \"POST\",\n      path: req.url ?? \"/v2/rerank\",\n      headers: flattenHeaders(req.headers),\n      body: null,\n      service: \"rerank\",\n      response: { status: 400, fixture: null },\n    });\n    res.writeHead(400, { \"Content-Type\": \"application/json\" });\n    res.end(\n      JSON.stringify({\n        error: {\n          message: \"Invalid parameter: 'query' must be a string or an array of strings\",\n          type: \"invalid_request_error\",\n        },\n      }),\n    );\n    return;\n  }\n  const query = normalizedQuery;\n\n  // Find first matching fixture\n  let matchedResults: RerankResult[] = [];\n  let matchedFixture: RerankFixture | null = null;\n\n  for (const fixture of fixtures) {\n    if (matchesPattern(query, fixture.match)) {\n      matchedFixture = fixture;\n      matchedResults = fixture.results;\n      break;\n    }\n  }\n\n  if (matchedFixture) {\n    logger.debug(`Rerank fixture matched for query \"${query.slice(0, 80)}\"`);\n  } else {\n    logger.debug(`No rerank fixture matched for query \"${query.slice(0, 80)}\" — returning empty`);\n  }\n\n  // Strict mode turns the lenient default (empty results) into a no-match\n  // error, like every other fixture-matching handler. These fixtures carry no\n  // sequence/turn state, so the skipped count is always 0.\n  if (!matchedFixture && resolveStrictMode(defaults.strict, req.headers)) {\n    const strictMessage = strictNoMatchMessage(0);\n    logger.error(strictNoMatchLogLine(req.method ?? \"POST\", req.url ?? \"/v2/rerank\", 0));\n    journal.add({\n      method: req.method ?? \"POST\",\n      path: req.url ?? \"/v2/rerank\",\n      headers: flattenHeaders(req.headers),\n      body: null,\n      service: \"rerank\",\n      response: {\n        status: 503,\n        fixture: null,\n        ...strictOverrideField(defaults.strict, req.headers),\n      },\n    });\n    res.writeHead(503, { \"Content-Type\": \"application/json\" });\n    res.end(\n      JSON.stringify({\n        error: {\n          message: strictMessage,\n          type: \"invalid_request_error\",\n          code: \"no_fixture_match\",\n        },\n      }),\n    );\n    return;\n  }\n\n  // Build response (Cohere rerank v2 format: index + relevance_score only)\n  const results = matchedResults.map((r) => ({\n    index: r.index,\n    relevance_score: r.relevance_score,\n  }));\n\n  journal.add({\n    method: req.method ?? \"POST\",\n    path: req.url ?? \"/v2/rerank\",\n    headers: flattenHeaders(req.headers),\n    body: null,\n    service: \"rerank\",\n    response: {\n      status: 200,\n      fixture: null,\n      ...strictOverrideField(defaults.strict, req.headers),\n    },\n  });\n\n  res.writeHead(200, { \"Content-Type\": \"application/json\" });\n  res.end(\n    JSON.stringify({\n      id: generateId(\"rerank\"),\n      results,\n      meta: {\n        billed_units: { search_units: 0 },\n      },\n    }),\n  );\n}\n"],"mappings":";;;AAqCA,eAAsB,aACpB,KACA,KACA,KACA,UACA,SACA,UACA,gBACe;CACf,MAAM,EAAE,WAAW;AACnB,gBAAe,IAAI;CAEnB,IAAI;AACJ,KAAI;AACF,SAAO,KAAK,MAAM,IAAI;UACf,UAAU;EACjB,MAAM,SAAS,oBAAoB,QAAQ,SAAS,UAAU;AAC9D,UAAQ,IAAI;GACV,QAAQ,IAAI,UAAU;GACtB,MAAM,IAAI,OAAO;GACjB,SAAS,eAAe,IAAI,QAAQ;GACpC,MAAM;GACN,SAAS;GACT,UAAU;IAAE,QAAQ;IAAK,SAAS;IAAM;GACzC,CAAC;AACF,MAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,MAAI,IACF,KAAK,UAAU,EACb,OAAO;GACL,SAAS,mBAAmB;GAC5B,MAAM;GACN,MAAM;GACP,EACF,CAAC,CACH;AACD;;AAMF,KAAI,CAAC,aAAa,KAAK,EAAE;AACvB,UAAQ,IAAI;GACV,QAAQ,IAAI,UAAU;GACtB,MAAM,IAAI,OAAO;GACjB,SAAS,eAAe,IAAI,QAAQ;GACpC,MAAM;GACN,SAAS;GACT,UAAU;IAAE,QAAQ;IAAK,SAAS;IAAM;GACzC,CAAC;AACF,MAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,MAAI,IACF,KAAK,UAAU,EACb,OAAO;GACL,SAAS;GACT,MAAM;GACP,EACF,CAAC,CACH;AACD;;CAIF,MAAM,kBAAkB,mBADE,KAAK,SAAS,GACY;AACpD,KAAI,oBAAoB,MAAM;AAC5B,UAAQ,IAAI;GACV,QAAQ,IAAI,UAAU;GACtB,MAAM,IAAI,OAAO;GACjB,SAAS,eAAe,IAAI,QAAQ;GACpC,MAAM;GACN,SAAS;GACT,UAAU;IAAE,QAAQ;IAAK,SAAS;IAAM;GACzC,CAAC;AACF,MAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,MAAI,IACF,KAAK,UAAU,EACb,OAAO;GACL,SAAS;GACT,MAAM;GACP,EACF,CAAC,CACH;AACD;;CAEF,MAAM,QAAQ;CAGd,IAAI,iBAAiC,EAAE;CACvC,IAAI,iBAAuC;AAE3C,MAAK,MAAM,WAAW,SACpB,KAAI,eAAe,OAAO,QAAQ,MAAM,EAAE;AACxC,mBAAiB;AACjB,mBAAiB,QAAQ;AACzB;;AAIJ,KAAI,eACF,QAAO,MAAM,qCAAqC,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG;KAExE,QAAO,MAAM,wCAAwC,MAAM,MAAM,GAAG,GAAG,CAAC,qBAAqB;AAM/F,KAAI,CAAC,kBAAkB,kBAAkB,SAAS,QAAQ,IAAI,QAAQ,EAAE;EACtE,MAAM,gBAAgB,qBAAqB,EAAE;AAC7C,SAAO,MAAM,qBAAqB,IAAI,UAAU,QAAQ,IAAI,OAAO,cAAc,EAAE,CAAC;AACpF,UAAQ,IAAI;GACV,QAAQ,IAAI,UAAU;GACtB,MAAM,IAAI,OAAO;GACjB,SAAS,eAAe,IAAI,QAAQ;GACpC,MAAM;GACN,SAAS;GACT,UAAU;IACR,QAAQ;IACR,SAAS;IACT,GAAG,oBAAoB,SAAS,QAAQ,IAAI,QAAQ;IACrD;GACF,CAAC;AACF,MAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,MAAI,IACF,KAAK,UAAU,EACb,OAAO;GACL,SAAS;GACT,MAAM;GACN,MAAM;GACP,EACF,CAAC,CACH;AACD;;CAIF,MAAM,UAAU,eAAe,KAAK,OAAO;EACzC,OAAO,EAAE;EACT,iBAAiB,EAAE;EACpB,EAAE;AAEH,SAAQ,IAAI;EACV,QAAQ,IAAI,UAAU;EACtB,MAAM,IAAI,OAAO;EACjB,SAAS,eAAe,IAAI,QAAQ;EACpC,MAAM;EACN,SAAS;EACT,UAAU;GACR,QAAQ;GACR,SAAS;GACT,GAAG,oBAAoB,SAAS,QAAQ,IAAI,QAAQ;GACrD;EACF,CAAC;AAEF,KAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,KAAI,IACF,KAAK,UAAU;EACb,IAAI,WAAW,SAAS;EACxB;EACA,MAAM,EACJ,cAAc,EAAE,cAAc,GAAG,EAClC;EACF,CAAC,CACH"}

package/dist/responses.cjs

@@ -852,6 +852,23 @@ async function handleResponses(req, res, raw, fixtures, journal, defaults, setCo
 		} }));
 		return;
 	}
+	if (!require_helpers.isJsonObject(responsesReq)) {
+		journal.add({
+			method: req.method ?? "POST",
+			path: req.url ?? "/v1/responses",
+			headers: require_helpers.flattenHeaders(req.headers),
+			body: null,
+			response: {
+				status: 400,
+				fixture: null
+			}
+		});
+		require_sse_writer.writeErrorResponse(res, 400, JSON.stringify({ error: {
+			message: "Request body must be a JSON object",
+			type: "invalid_request_error"
+		} }));
+		return;
+	}
 	const completionReq = responsesToCompletionRequest(responsesReq);
 	completionReq._endpointType = "chat";
 	completionReq._context = require_helpers.getContext(req);
@@ -863,7 +880,7 @@ async function handleResponses(req, res, raw, fixtures, journal, defaults, setCo
 		defaults.logger.debug(`Responses fixture matched for ${req.method ?? "POST"} ${req.url ?? "/v1/responses"}`);
 		journal.incrementFixtureMatchCount(fixture, fixtures, testId);
 	} else defaults.logger.debug(`No responses fixture matched for ${req.method ?? "POST"} ${req.url ?? "/v1/responses"}`);
-	if (require_chaos.applyChaos(res, fixture, defaults.chaos, req.headers, journal, {
+	if (require_chaos.applyChaos(res, fixture, defaults.chaos, req.headers, req.url, journal, {
 		method: req.method ?? "POST",
 		path: req.url ?? "/v1/responses",
 		headers: require_helpers.flattenHeaders(req.headers),