@etiennepasteur/jean-claude 0.1.0

package/dist/cli.mjs

@@ -0,0 +1,1631 @@
+#!/usr/bin/env node
+import { Command, InvalidArgumentError } from "commander";
+import pc from "picocolors";
+import { access, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+import tls from "node:tls";
+import { generateCACertificate, getLocal } from "mockttp";
+import os from "node:os";
+import { YAMLParseError, parse } from "yaml";
+import { z } from "zod";
+import { match } from "path-to-regexp";
+import { execa } from "execa";
+import { watch } from "chokidar";
+import { createHash } from "node:crypto";
+import { setTimeout } from "node:timers/promises";
+//#region src/ca/store.ts
+/** Candidate system trust stores, by distribution family. */
+const SYSTEM_CA_BUNDLES = [
+	"/etc/ssl/certs/ca-certificates.crt",
+	"/etc/pki/tls/certs/ca-bundle.crt",
+	"/etc/ssl/ca-bundle.pem",
+	"/etc/ssl/cert.pem"
+];
+function caPathsIn(dir) {
+	return {
+		dir,
+		certPath: path.join(dir, "ca.pem"),
+		keyPath: path.join(dir, "ca.key"),
+		bundlePath: path.join(dir, "bundle.pem")
+	};
+}
+async function exists(filePath) {
+	try {
+		await access(filePath);
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function findSystemBundle() {
+	for (const candidate of SYSTEM_CA_BUNDLES) if (await exists(candidate)) return candidate;
+}
+/**
+* Make sure the CA exists, and (re)generate the trust bundle.
+*
+* The bundle is rewritten on every call: the system store or the corporate CA
+* may well have changed since the last run.
+*/
+async function ensureCa({ dir, inheritedCa }) {
+	const paths = caPathsIn(dir);
+	await mkdir(dir, {
+		recursive: true,
+		mode: 448
+	});
+	const created = !(await exists(paths.certPath) && await exists(paths.keyPath));
+	if (created) {
+		const { key, cert } = await generateCACertificate({ subject: {
+			commonName: "jean-claude MITM CA - DO NOT TRUST ELSEWHERE",
+			organizationName: "jean-claude"
+		} });
+		await writeFile(paths.certPath, cert, { mode: 420 });
+		await writeFile(paths.keyPath, key, { mode: 384 });
+	}
+	const ourCert = await readFile(paths.certPath, "utf8");
+	const systemBundle = await findSystemBundle();
+	const systemCerts = systemBundle ? await readFile(systemBundle, "utf8") : tls.rootCertificates.join("\n");
+	const inheritedCerts = inheritedCa && await exists(inheritedCa) ? await readFile(inheritedCa, "utf8") : "";
+	const resolvedInherited = inheritedCerts === "" ? void 0 : inheritedCa;
+	const bundle = [
+		"# Generated by jean-claude - do not edit by hand.",
+		"# jean-claude CA",
+		ourCert.trim(),
+		...resolvedInherited ? [`# CA inherited from NODE_EXTRA_CA_CERTS (${resolvedInherited})`, inheritedCerts.trim()] : [],
+		`# System trust store (${systemBundle ?? "Node's built-in roots"})`,
+		systemCerts.trim(),
+		""
+	].join("\n");
+	await writeFile(paths.bundlePath, bundle, { mode: 420 });
+	return {
+		...paths,
+		created,
+		systemBundle,
+		inheritedCa: resolvedInherited
+	};
+}
+/**
+* Commands to install the CA into the system trust store, per distribution family.
+* Returned as text on purpose: jean-claude never runs `sudo` on its own.
+*/
+function systemTrustInstructions(certPath) {
+	return [
+		"# Debian / Ubuntu (the .crt extension is mandatory)",
+		`sudo cp ${certPath} /usr/local/share/ca-certificates/jean-claude.crt`,
+		"sudo update-ca-certificates",
+		"",
+		"# RHEL / Fedora / Rocky",
+		`sudo cp ${certPath} /etc/pki/ca-trust/source/anchors/jean-claude.crt`,
+		"sudo update-ca-trust extract",
+		"",
+		"# To uninstall: delete the copied file, then re-run the matching update command."
+	];
+}
+//#endregion
+//#region src/config/paths.ts
+/**
+* Where jean-claude keeps everything: the config, its stubs, the CA and the
+* session file of a running `start`.
+*
+* A single folder rather than a config directory plus a state directory: the
+* primary use case is a *global* install ("freeze this API response everywhere"),
+* and one path to remember beats XDG purity here. `--home` relocates the lot.
+*
+*   <home>/jean-claude.yaml
+*   <home>/responses/
+*   <home>/ca/{ca.pem,ca.key,bundle.pem}
+*   <home>/session.json
+*/
+function jeanClaudeHome() {
+	const xdg = process.env.XDG_CONFIG_HOME;
+	const base = xdg !== void 0 && xdg.trim() !== "" ? xdg : path.join(os.homedir(), ".config");
+	return path.join(base, "jean-claude");
+}
+function caDirIn(home) {
+	return path.join(home, "ca");
+}
+function responsesDirIn(home) {
+	return path.join(home, "responses");
+}
+//#endregion
+//#region src/env/upstream.ts
+function firstDefined(env, names) {
+	for (const name of names) {
+		const value = env[name];
+		if (value !== void 0 && value.trim() !== "") return value.trim();
+	}
+}
+function parseNoProxy(env) {
+	const raw = firstDefined(env, ["NO_PROXY", "no_proxy"]);
+	if (raw === void 0) return void 0;
+	const entries = raw.split(",").map((entry) => entry.trim()).filter((entry) => entry !== "");
+	return entries.length > 0 ? entries : void 0;
+}
+/** The corporate CA that jean-claude itself must trust on outbound connections. */
+function inheritedExtraCaCerts(env = process.env) {
+	const value = env.NODE_EXTRA_CA_CERTS;
+	return value !== void 0 && value.trim() !== "" ? value.trim() : void 0;
+}
+/**
+* Resolve the upstream proxy. `upstream: off` forces a direct connection, `auto`
+* inherits from the environment, and an explicit URL wins over the environment.
+*/
+function detectUpstream(config, env = process.env) {
+	if (config.upstream === "off") return void 0;
+	if (config.upstream !== "auto") return {
+		proxyUrl: config.upstream,
+		noProxy: parseNoProxy(env),
+		source: "config"
+	};
+	const proxyUrl = firstDefined(env, [
+		"HTTPS_PROXY",
+		"https_proxy",
+		"HTTP_PROXY",
+		"http_proxy"
+	]);
+	if (proxyUrl === void 0) return void 0;
+	return {
+		proxyUrl,
+		noProxy: parseNoProxy(env),
+		source: "env"
+	};
+}
+//#endregion
+//#region src/commands/ca.ts
+/**
+* Inspects the certificate store. Never installs anything itself: trust changes
+* need root, and are the user's call to make explicitly.
+*/
+async function caCommand(options) {
+	const ca = await ensureCa({
+		dir: caDirIn(options.home !== void 0 ? path.resolve(options.home) : jeanClaudeHome()),
+		inheritedCa: inheritedExtraCaCerts()
+	});
+	if (options.print) {
+		process.stdout.write(await readFile(ca.certPath, "utf8"));
+		return 0;
+	}
+	console.log(`  ${pc.dim("cert    ")}${ca.certPath}${ca.created ? pc.dim("  (just generated)") : ""}`);
+	console.log(`  ${pc.dim("key     ")}${ca.keyPath}`);
+	console.log(`  ${pc.dim("bundle  ")}${ca.bundlePath}`);
+	console.log(`  ${pc.dim("system  ")}${ca.systemBundle ?? "Node's built-in roots"}`);
+	if (ca.inheritedCa !== void 0) console.log(`  ${pc.dim("corp    ")}${ca.inheritedCa}  ${pc.dim("(inherited from NODE_EXTRA_CA_CERTS)")}`);
+	if (options.install) {
+		console.log(`\n  ${pc.bold("Installing into the system trust store")} ${pc.dim("(run these yourself)")}\n`);
+		for (const line of systemTrustInstructions(ca.certPath)) console.log(`    ${line}`);
+		console.log("");
+	} else console.log(`\n  ${pc.dim("`jean-claude run` injects this automatically. Use `--install` for the system trust store.")}\n`);
+	return 0;
+}
+//#endregion
+//#region src/proxy/match.ts
+const NO_MATCH = {
+	matched: false,
+	params: {}
+};
+/**
+* `path-to-regexp` v8 requires wildcards to be named. We accept the natural
+* `/api/*` form by naming them on the fly, so users need not learn `*splat`.
+*/
+function nameBareWildcards(pattern) {
+	let counter = 0;
+	return pattern.replaceAll(/\*(?![A-Za-z_])/g, () => `*wildcard${counter++}`);
+}
+function compilePathMatcher(pattern, ruleLabel) {
+	let matcher;
+	try {
+		matcher = match(nameBareWildcards(pattern), { decode: decodeURIComponent });
+	} catch (cause) {
+		throw new Error(`${ruleLabel}: invalid \`path\` pattern "${pattern}" — ${cause.message}`, { cause });
+	}
+	return (pathname) => {
+		const result = matcher(pathname);
+		if (!result) return void 0;
+		const params = {};
+		for (const [key, value] of Object.entries(result.params)) if (value !== void 0) params[key] = Array.isArray(value) ? value.join("/") : value;
+		return params;
+	};
+}
+/** `api.y.com` matches exactly; `*.y.com` matches any subdomain. */
+function hostMatches(expected, actual) {
+	const wanted = expected.toLowerCase();
+	const got = actual.toLowerCase();
+	if (wanted.startsWith("*.")) {
+		const suffix = wanted.slice(1);
+		return got.endsWith(suffix) && got.length > suffix.length;
+	}
+	return wanted === got;
+}
+function describeRule(rule, index) {
+	return rule.name ?? `rule #${index + 1} (${rule.path ?? rule.pathRegex ?? "any URL"})`;
+}
+/**
+* Compile a rule into a predicate. Patterns are compiled once, at config load
+* time, so broken patterns surface before the proxy starts.
+*/
+function compileMatcher(rule, config, index) {
+	const label = describeRule(rule, index);
+	const expectedHost = rule.host ?? config.host;
+	const expectedMethods = rule.method;
+	const matchPath = rule.path !== void 0 ? compilePathMatcher(rule.path, label) : void 0;
+	const pathRegex = rule.pathRegex !== void 0 ? new RegExp(rule.pathRegex) : void 0;
+	const expectedQuery = rule.query ? Object.entries(rule.query) : void 0;
+	return (facts) => {
+		if (expectedHost !== void 0 && !hostMatches(expectedHost, facts.hostname)) return NO_MATCH;
+		if (expectedMethods !== void 0 && !expectedMethods.includes(facts.method.toUpperCase())) return NO_MATCH;
+		if (pathRegex !== void 0 && !pathRegex.test(facts.pathname)) return NO_MATCH;
+		if (expectedQuery !== void 0 && !expectedQuery.every(([key, value]) => facts.query.get(key) === value)) return NO_MATCH;
+		if (matchPath !== void 0) {
+			const params = matchPath(facts.pathname);
+			if (params === void 0) return NO_MATCH;
+			return {
+				matched: true,
+				params
+			};
+		}
+		return {
+			matched: true,
+			params: {}
+		};
+	};
+}
+/** Derive the matching facts from an absolute URL. */
+function factsFromUrl(url, method) {
+	const parsed = new URL(url);
+	return {
+		hostname: parsed.hostname,
+		method,
+		pathname: parsed.pathname,
+		query: parsed.searchParams
+	};
+}
+/** Interpolate captured parameters into a file path: `./stubs/{id}.json`. */
+function interpolate(template, params) {
+	return template.replaceAll(/\{(\w+)\}/g, (whole, key) => params[key] ?? whole);
+}
+//#endregion
+//#region src/config/schema.ts
+/**
+* Schema for the `jean-claude.yaml` file. This is the source of truth for the
+* config format: the README and the `check` command both derive from it.
+*/
+const headersSchema = z.record(z.string(), z.string());
+const statusSchema = z.number().int().min(100).max(599);
+const delaySchema = z.number().int().nonnegative().max(6e5);
+/** A single method, or a list of methods, normalised to upper case. */
+const methodSchema = z.union([z.string(), z.array(z.string()).min(1)]).transform((value) => (Array.isArray(value) ? value : [value]).map((method) => method.toUpperCase()));
+/** An RFC 6902 operation. `path` is a JSON Pointer: either `""` or `/a/0/b`. */
+const jsonPatchOperationSchema = z.strictObject({
+	op: z.enum([
+		"add",
+		"remove",
+		"replace",
+		"move",
+		"copy",
+		"test"
+	]),
+	path: z.string().refine((p) => p === "" || p.startsWith("/"), "a JSON Pointer must be empty or start with \"/\""),
+	from: z.string().optional(),
+	value: z.unknown().optional()
+});
+/**
+* Short circuit: reply without ever contacting the server.
+* The short form `respond: ./file.json` is equivalent to `respond: { file: ./file.json }`.
+*/
+const respondSchema = z.union([z.string(), z.strictObject({
+	file: z.string().optional(),
+	body: z.unknown().optional(),
+	status: statusSchema.optional(),
+	headers: headersSchema.optional(),
+	delay: delaySchema.optional()
+})]).transform((value) => typeof value === "string" ? { file: value } : value).refine((value) => !(value.file !== void 0 && value.body !== void 0), "`respond`: `file` and `body` are mutually exclusive");
+/** Changes applied to the real response coming back from the server. */
+const patchSchema = z.strictObject({
+	status: statusSchema.optional(),
+	headers: headersSchema.optional(),
+	replaceHeaders: headersSchema.optional(),
+	merge: z.record(z.string(), z.unknown()).optional(),
+	jsonPatch: z.array(jsonPatchOperationSchema).min(1).optional(),
+	body: z.unknown().optional(),
+	file: z.string().optional(),
+	delay: delaySchema.optional()
+}).refine((value) => Object.keys(value).length > 0, "`patch` cannot be empty").refine((value) => !(value.file !== void 0 && value.body !== void 0), "`patch`: `file` and `body` are mutually exclusive").refine((value) => !(value.headers !== void 0 && value.replaceHeaders !== void 0), "`patch`: `headers` (merge) and `replaceHeaders` (replace) are mutually exclusive");
+/** Rewrites applied to the request before it reaches the server. */
+const requestSchema = z.strictObject({
+	host: z.string().optional(),
+	path: z.string().optional(),
+	method: z.string().optional(),
+	query: z.record(z.string(), z.string()).optional(),
+	headers: headersSchema.optional(),
+	removeHeaders: z.array(z.string()).min(1).optional(),
+	body: z.unknown().optional(),
+	merge: z.record(z.string(), z.unknown()).optional()
+}).refine((value) => Object.keys(value).length > 0, "`request` cannot be empty").refine((value) => !(value.body !== void 0 && value.merge !== void 0), "`request`: `body` and `merge` are mutually exclusive");
+const ruleSchema = z.strictObject({
+	name: z.string().optional(),
+	host: z.string().optional(),
+	method: methodSchema.optional(),
+	path: z.string().optional(),
+	pathRegex: z.string().optional(),
+	query: z.record(z.string(), z.string()).optional(),
+	respond: respondSchema.optional(),
+	patch: patchSchema.optional(),
+	request: requestSchema.optional()
+}).refine((rule) => !(rule.respond && rule.patch), "`respond` and `patch` are mutually exclusive").refine((rule) => !(rule.respond && rule.request), "`respond` short circuits the request, so `request` would be a no-op").refine((rule) => rule.respond || rule.patch || rule.request, "a rule must define `respond`, `patch` or `request`").refine((rule) => !(rule.path && rule.pathRegex), "`path` and `pathRegex` are mutually exclusive");
+const upstreamSchema = z.union([
+	z.literal("auto"),
+	z.literal("off"),
+	z.url()
+]);
+const configSchema = z.strictObject({
+	/** Default host for every rule that does not declare one. */
+	host: z.string().optional(),
+	port: z.number().int().min(1).max(65535).optional(),
+	/** `auto` inherits `HTTPS_PROXY` from the environment, `off` forces a direct connection. */
+	upstream: upstreamSchema.default("auto"),
+	/**
+	* Hosts the target tool should reach without going through jean-claude.
+	* Empty by default: excluding loopback would silently skip localhost targets.
+	*/
+	noProxy: z.array(z.string()).optional(),
+	/** Hosts tunnelled without interception, for clients that pin certificates. */
+	tlsPassthrough: z.array(z.string()).optional(),
+	rules: z.array(ruleSchema).default([])
+});
+//#endregion
+//#region src/config/load.ts
+/** File names searched for when `--config` is not given. */
+const CONFIG_FILENAMES = ["jean-claude.yaml", "jean-claude.yml"];
+/** The config `init` writes, and the fallback when no local one is found. */
+function configPathIn(home) {
+	return path.join(home, CONFIG_FILENAMES[0]);
+}
+var ConfigError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "ConfigError";
+	}
+};
+async function readIfPresent(filePath) {
+	try {
+		return await readFile(filePath, "utf8");
+	} catch (cause) {
+		if (cause.code === "ENOENT") return void 0;
+		throw new ConfigError(`cannot read ${filePath}: ${cause.message}`, { cause });
+	}
+}
+/**
+* Look for a config file in `cwd`, then walk up the parent directories, then
+* fall back to the one `init` writes in the jean-claude home.
+*
+* The global fallback is what lets a single rule apply everywhere - the main
+* reason to reach for this tool. A project-local file still wins, so a repo can
+* override the global rules for its own traffic.
+*/
+async function findConfigFile(cwd, home = jeanClaudeHome()) {
+	let dir = path.resolve(cwd);
+	for (;;) {
+		for (const name of CONFIG_FILENAMES) {
+			const candidate = path.join(dir, name);
+			if (await readIfPresent(candidate) !== void 0) return candidate;
+		}
+		const parent = path.dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	for (const name of CONFIG_FILENAMES) {
+		const candidate = path.join(home, name);
+		if (await readIfPresent(candidate) !== void 0) return candidate;
+	}
+}
+/** Validate an already parsed object. Exposed for tests and for `check`. */
+function compile(raw, baseDir, filePath) {
+	const parsed = configSchema.safeParse(raw);
+	if (!parsed.success) throw new ConfigError(`invalid configuration${filePath ? ` in ${filePath}` : ""}:\n${z.prettifyError(parsed.error)}`);
+	const config = parsed.data;
+	return {
+		config,
+		rules: config.rules.map((rule, index) => ({
+			rule,
+			label: describeRule(rule, index),
+			match: compileMatcher(rule, config, index)
+		})),
+		filePath,
+		baseDir
+	};
+}
+async function loadConfig(explicitPath, options = {}) {
+	const cwd = options.cwd ?? process.cwd();
+	const home = options.home ?? jeanClaudeHome();
+	const filePath = explicitPath ? path.resolve(cwd, explicitPath) : await findConfigFile(cwd, home);
+	if (filePath === void 0) throw new ConfigError(`no configuration file found (${CONFIG_FILENAMES.join(" or ")}).\n  Searched from ${cwd} up to the root, then ${home}.\n  Run \`jean-claude init\` to create one.`);
+	const source = await readIfPresent(filePath);
+	if (source === void 0) throw new ConfigError(`configuration file not found: ${filePath}`);
+	let raw;
+	try {
+		raw = parse(source);
+	} catch (cause) {
+		throw new ConfigError(`invalid YAML in ${filePath}:\n${cause instanceof YAMLParseError ? cause.message : cause.message}`, { cause });
+	}
+	if (raw === null || raw === void 0) raw = {};
+	return compile(raw, path.dirname(filePath), filePath);
+}
+//#endregion
+//#region src/commands/check.ts
+/** Describes what a rule does, in one word. */
+function actionOf(rule) {
+	if (rule.respond !== void 0) return pc.magenta("stub");
+	if (rule.patch !== void 0 && rule.request !== void 0) return pc.cyan("rewrite+patch");
+	if (rule.patch !== void 0) return pc.cyan("patch");
+	return pc.blue("rewrite");
+}
+/**
+* Validates the config and prints the rules as resolved, so the effective host
+* and method of each rule can be checked without starting the proxy.
+*/
+async function checkCommand(configPath, homeOption) {
+	const loaded = await loadConfig(configPath, { home: homeOption !== void 0 ? path.resolve(homeOption) : jeanClaudeHome() });
+	const upstream = detectUpstream(loaded.config);
+	const upstreamLabel = upstream !== void 0 ? `${upstream.proxyUrl} ${pc.dim(`(from ${upstream.source})`)}` : pc.dim("direct");
+	console.log(`  ${pc.dim("config    ")}${loaded.filePath}`);
+	console.log(`  ${pc.dim("upstream  ")}${upstreamLabel}`);
+	console.log(`  ${pc.dim("rules     ")}${loaded.rules.length}\n`);
+	if (loaded.rules.length === 0) {
+		console.log(`  ${pc.yellow("!")} no rules: every request will simply be logged and relayed.\n`);
+		return 0;
+	}
+	for (const [index, { rule, label }] of loaded.rules.entries()) {
+		const host = rule.host ?? loaded.config.host ?? pc.dim("any host");
+		const method = rule.method?.join("|") ?? pc.dim("any");
+		const target = rule.path ?? (rule.pathRegex !== void 0 ? `re:${rule.pathRegex}` : pc.dim("any path"));
+		console.log(`  ${pc.dim(String(index + 1).padStart(2))}  ${actionOf(rule)}  ${label}`);
+		console.log(`      ${pc.dim("match")}  ${method} ${host}${target}`);
+		if (rule.query !== void 0) console.log(`      ${pc.dim("query")}  ${JSON.stringify(rule.query)}`);
+	}
+	console.log("");
+	return 0;
+}
+//#endregion
+//#region src/env/child.ts
+/** Variables added to, or overwritten in, the child environment. */
+function proxyEnvVars({ proxyUrl, bundlePath, noProxy }) {
+	const exclusions = noProxy?.filter((entry) => entry.trim() !== "") ?? [];
+	return {
+		HTTP_PROXY: proxyUrl,
+		HTTPS_PROXY: proxyUrl,
+		http_proxy: proxyUrl,
+		https_proxy: proxyUrl,
+		...exclusions.length > 0 ? {
+			NO_PROXY: exclusions.join(","),
+			no_proxy: exclusions.join(",")
+		} : {},
+		NODE_USE_ENV_PROXY: "1",
+		NODE_EXTRA_CA_CERTS: bundlePath,
+		SSL_CERT_FILE: bundlePath,
+		CURL_CA_BUNDLE: bundlePath,
+		REQUESTS_CA_BUNDLE: bundlePath,
+		AWS_CA_BUNDLE: bundlePath,
+		GIT_SSL_CAINFO: bundlePath
+	};
+}
+/**
+* Variables that have to be *removed* rather than set. An inherited `NO_PROXY`
+* would otherwise punch a hole straight through the interception.
+*/
+function proxyEnvUnset({ noProxy }) {
+	return (noProxy?.filter((entry) => entry.trim() !== "") ?? []).length > 0 ? [] : ["NO_PROXY", "no_proxy"];
+}
+function buildChildEnv(base, options) {
+	const env = {
+		...base,
+		...proxyEnvVars(options)
+	};
+	for (const name of proxyEnvUnset(options)) delete env[name];
+	return env;
+}
+function parseVersion(version) {
+	const [major = 0, minor = 0, patch = 0] = version.split(".").map((part) => Number.parseInt(part, 10) || 0);
+	return [
+		major,
+		minor,
+		patch
+	];
+}
+/**
+* `NODE_USE_ENV_PROXY` only exists from Node 22.21 / 24.5 onwards. Below that, a
+* Node-based target will ignore the proxy and its traffic will bypass jean-claude.
+*/
+function nodeSupportsEnvProxy(version = process.versions.node) {
+	const [major, minor] = parseVersion(version);
+	if (major >= 25) return true;
+	if (major === 24) return minor >= 5;
+	if (major === 23) return false;
+	if (major === 22) return minor >= 21;
+	return false;
+}
+/** A shell-evaluable block, for `jean-claude start --export`. */
+function formatShellExports(vars, unset = []) {
+	const lines = Object.entries(vars).map(([key, value]) => `export ${key}='${value.replaceAll("'", `'\\''`)}'`);
+	if (unset.length > 0) lines.push(`unset ${unset.join(" ")}`);
+	return lines.join("\n");
+}
+//#endregion
+//#region src/env/session.ts
+function sessionFilePath(home) {
+	return path.join(home, "session.json");
+}
+async function writeSessionFile(home, session) {
+	await writeFile(sessionFilePath(home), `${JSON.stringify(session, null, 2)}\n`, { mode: 384 });
+}
+async function removeSessionFile(home) {
+	await rm(sessionFilePath(home), { force: true });
+}
+/** Signal 0 probes for existence without actually signalling the process. */
+function isProcessAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (error) {
+		return error.code === "EPERM";
+	}
+}
+var NoSessionError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "NoSessionError";
+	}
+};
+/** Reads the session file, refusing anything stale so callers never get a dead port. */
+async function readSessionFile(home) {
+	const filePath = sessionFilePath(home);
+	let raw;
+	try {
+		raw = await readFile(filePath, "utf8");
+	} catch (cause) {
+		if (cause.code === "ENOENT") throw new NoSessionError("no running session found.\n  Start one in another terminal with `jean-claude start`, or pass `--port` explicitly.");
+		throw cause;
+	}
+	let session;
+	try {
+		session = JSON.parse(raw);
+	} catch {
+		throw new NoSessionError(`session file is unreadable: ${filePath}`);
+	}
+	if (!isProcessAlive(session.pid)) throw new NoSessionError(`the session recorded in ${filePath} is gone (pid ${session.pid} is not running).\n  Start a new one with \`jean-claude start\`.`);
+	return session;
+}
+//#endregion
+//#region src/commands/env.ts
+/**
+* Prints the environment for a proxy that is *already running*, without starting
+* one. This is what makes the two-terminal workflow work:
+*
+*   terminal 1:  jean-claude start
+*   terminal 2:  eval "$(jean-claude env)" && claude
+*
+* `jean-claude start --export` cannot be used for this - it runs in the
+* foreground, so the command substitution would never return.
+*/
+async function envCommand(options) {
+	const home = options.home !== void 0 ? path.resolve(options.home) : jeanClaudeHome();
+	const { proxyUrl, bundlePath, noProxy } = options.port !== void 0 ? {
+		proxyUrl: `http://127.0.0.1:${options.port}`,
+		bundlePath: caPathsIn(caDirIn(home)).bundlePath,
+		noProxy: void 0
+	} : await (async () => {
+		const session = await readSessionFile(home);
+		return {
+			proxyUrl: session.proxy,
+			bundlePath: session.bundle,
+			noProxy: session.noProxy ?? void 0
+		};
+	})();
+	const childEnvOptions = {
+		proxyUrl,
+		bundlePath,
+		noProxy
+	};
+	const vars = proxyEnvVars(childEnvOptions);
+	const unset = proxyEnvUnset(childEnvOptions);
+	console.log(options.json ? JSON.stringify({
+		env: vars,
+		unset
+	}, null, 2) : formatShellExports(vars, unset));
+	return 0;
+}
+//#endregion
+//#region src/config/template.ts
+/** Scaffolding written by `jean-claude init`. */
+/**
+* The commented-out tour of the config format, shared by both templates so the
+* Claude Code one does not become a dead end when you want a second rule.
+*/
+const EXAMPLES = `  # 2 - Patch the real response. It does reach the server; we edit what comes back.
+  #     'merge' is for object responses, 'jsonPatch' for arrays and precise edits.
+  # - path: /api/users/:id
+  #   patch:
+  #     merge: { verified: true }
+
+  # 3 - Force a status, headers or latency, to exercise error handling.
+  # - path: /api/flaky
+  #   patch:
+  #     status: 500
+  #     body: { error: "boom" }
+  #     delay: 2000
+
+  # 4 - Rewrite the outgoing request before it reaches the server.
+  # - host: auth.example.com
+  #   path: /oauth/token
+  #   request:
+  #     host: staging-auth.example.com
+  #     headers: { authorization: "Bearer TEST" }
+
+  # Captured path parameters are interpolable into the stub file name:
+  # - path: /api/users/:id
+  #   respond: ./responses/users/{id}.json
+`;
+const CONFIG_TEMPLATE = `# jean-claude - HTTPS traffic rewriting rules.
+#
+# Every rule is tried in file order; the first one that matches wins.
+# Anything that matches nothing is still decrypted, logged and relayed untouched.
+
+# Default host for the rules below. Remove it to match any host.
+host: api.example.com
+
+# Upstream proxy for relayed traffic:
+#   auto  inherit HTTPS_PROXY from the environment (default)
+#   off   always connect directly
+#   <url> an explicit proxy
+upstream: auto
+
+rules:
+  # 1 - Replace the response with a file. The server is never contacted.
+  - name: frozen todos
+    method: GET
+    path: /api/todos
+    respond: ./responses/todos.json
+
+${EXAMPLES}`;
+const STUB_TEMPLATE = `${JSON.stringify([{
+	title: "Dining",
+	details: "bla-bla-bla"
+}], null, 2)}\n`;
+/**
+* `init --claude-code`: pin Claude Code's managed settings to a local file, so
+* the ones pushed by the account no longer apply.
+*/
+const CLAUDE_CODE_TEMPLATE = `# jean-claude - HTTPS traffic rewriting rules.
+#
+# Every rule is tried in file order; the first one that matches wins.
+# Anything that matches nothing is still decrypted, logged and relayed untouched.
+
+# Default host for the rules below. Remove it to match any host.
+host: api.anthropic.com
+
+# Upstream proxy for relayed traffic:
+#   auto  inherit HTTPS_PROXY from the environment (default)
+#   off   always connect directly
+#   <url> an explicit proxy
+upstream: auto
+
+rules:
+  # 1 - Freeze the settings Claude Code fetches at startup: it gets this file
+  #     instead, and the server is never contacted for it. Edit the 'settings'
+  #     object in the stub; it is re-read on every request.
+  #
+  #     To start from what your account actually sends:
+  #
+  #       jean-claude run --record ./captures -- claude
+  #       cp ./captures/api.anthropic.com/api/claude_code/settings.GET.json \\
+  #          ./responses/settings.GET.json
+  - name: frozen claude_code settings
+    method: GET
+    path: /api/claude_code/settings
+    respond: ./responses/settings.GET.json
+
+${EXAMPLES}`;
+const CLAUDE_CODE_STUB = `${JSON.stringify({
+	uuid: "1cb619ae-b7bd-495b-9f0d-741d32e4fad6",
+	checksum: "sha256:3081f0d1458367573f9a7cef56e490081218986bc8e20bc59257dfc10d930826",
+	settings: {
+		env: { CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1" },
+		permissions: { defaultMode: "plan" }
+	}
+}, null, 2)}\n`;
+//#endregion
+//#region src/commands/init.ts
+/**
+* Sets up a jean-claude home: the config, its stub, and the CA. One command and
+* `jean-claude run -- <tool>` works from anywhere.
+*
+* Existing files are never overwritten - re-running `init` is safe, and is the
+* way to add the CA to a home scaffolded by an older version.
+*/
+async function initCommand(options) {
+	const home = options.home !== void 0 ? path.resolve(options.home) : jeanClaudeHome();
+	const stubName = options.claudeCode ? "settings.GET.json" : "todos.json";
+	const files = [[configPathIn(home), options.claudeCode ? CLAUDE_CODE_TEMPLATE : CONFIG_TEMPLATE], [path.join(responsesDirIn(home), stubName), options.claudeCode ? CLAUDE_CODE_STUB : STUB_TEMPLATE]];
+	const written = [];
+	const skipped = [];
+	for (const [target, contents] of files) {
+		await mkdir(path.dirname(target), { recursive: true });
+		try {
+			await writeFile(target, contents, { flag: "wx" });
+			written.push(target);
+		} catch (cause) {
+			if (cause.code !== "EEXIST") throw cause;
+			skipped.push(target);
+		}
+	}
+	const ca = await ensureCa({
+		dir: caDirIn(home),
+		inheritedCa: inheritedExtraCaCerts()
+	});
+	(ca.created ? written : skipped).push(ca.certPath);
+	written.push(ca.bundlePath);
+	for (const file of written) console.log(`  ${pc.green("created")}  ${file}`);
+	for (const file of skipped) console.log(`  ${pc.yellow("kept")}     ${file} ${pc.dim("(already existed)")}`);
+	const next = options.claudeCode ? "jean-claude run -- claude" : "jean-claude run -- <your command>";
+	console.log(`\n  ${pc.dim(`Next: \`${next}\``)}`);
+	console.log(`  ${pc.dim("`jean-claude ca --install` if a target cannot be pointed at the bundle.")}\n`);
+	return 0;
+}
+//#endregion
+//#region src/config/watch.ts
+/**
+* Watches the config file and calls `onChange` after each save.
+*
+* Only the config file is watched: stub files are re-read on every request, so
+* editing a response takes effect with no reload at all.
+*/
+function watchConfig(filePath, onChange) {
+	const watcher = watch(filePath, {
+		ignoreInitial: true,
+		awaitWriteFinish: {
+			stabilityThreshold: 150,
+			pollInterval: 30
+		}
+	});
+	watcher.on("change", () => void onChange());
+	watcher.on("add", () => void onChange());
+	return () => watcher.close();
+}
+//#endregion
+//#region src/log/reporter.ts
+const KIND_LABELS = {
+	stub: "stub",
+	patch: "patched",
+	rewrite: "rewritten",
+	passthrough: "passthrough"
+};
+function colorStatus(status) {
+	const text = String(status);
+	if (status >= 500) return pc.red(text);
+	if (status >= 400) return pc.yellow(text);
+	if (status >= 300) return pc.cyan(text);
+	return pc.green(text);
+}
+function shortTarget(url) {
+	if (url === void 0) return "(unknown url)";
+	try {
+		const parsed = new URL(url);
+		return `${parsed.host}${parsed.pathname}${parsed.search}`;
+	} catch {
+		return url;
+	}
+}
+function pad(text, width) {
+	return text.length >= width ? text : text + " ".repeat(width - text.length);
+}
+function truncate(text, width) {
+	return text.length <= width ? text : `${text.slice(0, width - 1)}…`;
+}
+/**
+* Console log. One line per request, emitted on response so that the status
+* actually delivered to the client can be shown.
+*/
+var Reporter = class {
+	options;
+	entries = /* @__PURE__ */ new Map();
+	constructor(options) {
+		this.options = options;
+	}
+	/** Merging upsert, so we do not depend on the order of the `request` event vs the rules. */
+	upsert(id, patch) {
+		this.entries.set(id, {
+			...this.entries.get(id),
+			...patch
+		});
+	}
+	seen(id, method, url) {
+		this.upsert(id, {
+			method,
+			url
+		});
+	}
+	action(id, kind, label, detail) {
+		this.upsert(id, {
+			kind,
+			label,
+			detail
+		});
+	}
+	recorded(id, filePath) {
+		this.upsert(id, { recorded: filePath });
+	}
+	response(id, statusCode) {
+		const entry = this.entries.get(id) ?? {};
+		this.entries.delete(id);
+		if (this.options.quiet) return;
+		if ((entry.kind ?? "passthrough") === "passthrough" && entry.recorded === void 0 && !this.options.verbose) return;
+		console.log(`  ${pad(entry.method ?? "???", 6)}${pad(truncate(shortTarget(entry.url), 52), 54)}${colorStatus(statusCode)}${this.describeAction(entry)}`);
+	}
+	describeAction(entry) {
+		const parts = [];
+		if (entry.kind !== void 0 && entry.kind !== "passthrough") {
+			const detail = entry.detail !== void 0 ? ` ${pc.dim(entry.detail)}` : "";
+			parts.push(`${pc.magenta("→")} ${KIND_LABELS[entry.kind]}${detail}`);
+		}
+		if (entry.recorded !== void 0) parts.push(`${pc.blue("⇒")} ${pc.dim(entry.recorded)}`);
+		return parts.length > 0 ? `  ${parts.join("  ")}` : "";
+	}
+	aborted(id, reason) {
+		const entry = this.entries.get(id) ?? {};
+		this.entries.delete(id);
+		if (this.options.quiet) return;
+		const detail = reason !== void 0 ? ` ${pc.dim(`(${reason})`)}` : "";
+		console.log(`  ${pad(entry.method ?? "???", 6)}${pad(truncate(shortTarget(entry.url), 52), 54)}${pc.red("aborted")}${detail}`);
+	}
+	/**
+	* A client-side TLS failure almost always means the target pins its
+	* certificates. Say so, rather than leaving the user to guess.
+	*/
+	tlsError(hostname) {
+		if (this.options.quiet) return;
+		const where = hostname ?? "unknown host";
+		this.warn(`TLS handshake with ${where} failed - the target rejected jean-claude's CA (certificate pinning?). Add "tlsPassthrough: [${where}]" to the config to tunnel it untouched.`);
+	}
+	banner(lines) {
+		if (this.options.quiet) return;
+		const width = Math.max(...lines.map(([key]) => key.length));
+		for (const [key, value] of lines) console.log(`  ${pc.dim(pad(key, width + 2))}${value}`);
+		console.log("");
+	}
+	info(message) {
+		if (!this.options.quiet) console.log(`  ${message}`);
+	}
+	warn(message) {
+		console.warn(`  ${pc.yellow("!")} ${message}`);
+	}
+};
+//#endregion
+//#region src/record/writer.ts
+/**
+* Writes real responses to disk, in a tree that mirrors the URL. Only the body
+* is written, so the resulting file can be dropped straight into a `respond:` rule.
+*/
+const EXTENSION_BY_TYPE = [
+	[/json/, "json"],
+	[/html/, "html"],
+	[/xml/, "xml"],
+	[/javascript|ecmascript/, "js"],
+	[/css/, "css"],
+	[/plain/, "txt"]
+];
+function isJson(body) {
+	if (body.length === 0) return false;
+	try {
+		JSON.parse(body.toString("utf8"));
+		return true;
+	} catch {
+		return false;
+	}
+}
+function extensionFor(contentType, body) {
+	if (contentType !== void 0) {
+		const lower = contentType.toLowerCase();
+		for (const [pattern, extension] of EXTENSION_BY_TYPE) if (pattern.test(lower)) return extension;
+	}
+	return isJson(body) ? "json" : "bin";
+}
+/** Strip anything that has no business being in a file name. */
+function sanitizeSegment(segment) {
+	const cleaned = segment.replaceAll(/[^A-Za-z0-9._@-]/g, "_");
+	return cleaned === "" || cleaned === "." || cleaned === ".." ? "_" : cleaned;
+}
+/**
+* Build the capture path. The query string is reduced to a short digest, so two
+* requests differing only by their parameters do not overwrite each other.
+*/
+function capturePathFor(dir, url, method, extension) {
+	const parsed = new URL(url);
+	const segments = parsed.pathname.split("/").filter((segment) => segment !== "");
+	const parents = segments.slice(0, -1).map(sanitizeSegment);
+	const fileName = `${sanitizeSegment(segments.at(-1) ?? "index")}${parsed.search === "" ? "" : `-${createHash("sha1").update(parsed.search).digest("hex").slice(0, 8)}`}.${method.toUpperCase()}.${extension}`;
+	return path.join(dir, sanitizeSegment(parsed.host), ...parents, fileName);
+}
+function reindentJson(body) {
+	try {
+		return `${JSON.stringify(JSON.parse(body.toString("utf8")), null, 2)}\n`;
+	} catch {
+		return body;
+	}
+}
+var Recorder = class {
+	dir;
+	constructor(dir) {
+		this.dir = dir;
+	}
+	/** Write the response body and return the path relative to the cwd, for logging. */
+	async record(url, method, body, contentType) {
+		const extension = extensionFor(contentType, body);
+		const target = capturePathFor(this.dir, url, method, extension);
+		await mkdir(path.dirname(target), { recursive: true });
+		await writeFile(target, extension === "json" ? reindentJson(body) : body);
+		return path.relative(process.cwd(), target);
+	}
+};
+//#endregion
+//#region src/util/json.ts
+/** A JSON Patch failure, carrying the index of the offending operation. */
+var JsonPatchError = class extends Error {
+	index;
+	constructor(message, index) {
+		super(`jsonPatch[${index}]: ${message}`);
+		this.index = index;
+		this.name = "JsonPatchError";
+	}
+};
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Deep merge. Plain objects are merged recursively; arrays and scalars from
+* `source` overwrite whatever `target` holds.
+*/
+function deepMerge(target, source) {
+	if (!isPlainObject(target)) return structuredClone(source);
+	const result = { ...target };
+	for (const [key, value] of Object.entries(source)) {
+		const existing = result[key];
+		result[key] = isPlainObject(value) && isPlainObject(existing) ? deepMerge(existing, value) : structuredClone(value);
+	}
+	return result;
+}
+/** Decode a JSON Pointer (RFC 6901) into its segments. */
+function parseJsonPointer(pointer) {
+	if (pointer === "") return [];
+	return pointer.split("/").slice(1).map((segment) => segment.replaceAll("~1", "/").replaceAll("~0", "~"));
+}
+function isContainer(value) {
+	return typeof value === "object" && value !== null;
+}
+/** Resolve every segment but the last, returning the parent container and the final key. */
+function resolveParent(root, segments, index) {
+	let current = root;
+	for (const segment of segments.slice(0, -1)) {
+		if (!isContainer(current)) throw new JsonPatchError(`path crosses a non-container value ("${segment}")`, index);
+		current = Array.isArray(current) ? current[Number(segment)] : current[segment];
+	}
+	if (!isContainer(current)) throw new JsonPatchError("the parent of the target path does not exist", index);
+	return {
+		parent: current,
+		key: segments.at(-1)
+	};
+}
+function arrayIndex(array, key, index, { allowAppend = false } = {}) {
+	if (key === "-") {
+		if (!allowAppend) throw new JsonPatchError("\"-\" is only usable with `add`", index);
+		return array.length;
+	}
+	const position = Number(key);
+	if (!Number.isInteger(position) || position < 0 || position > array.length - (allowAppend ? 0 : 1)) throw new JsonPatchError(`invalid array index "${key}"`, index);
+	return position;
+}
+function readPointer(root, pointer, index) {
+	const segments = parseJsonPointer(pointer);
+	let current = root;
+	for (const segment of segments) {
+		if (!isContainer(current)) throw new JsonPatchError(`path "${pointer}" cannot be resolved`, index);
+		current = Array.isArray(current) ? current[arrayIndex(current, segment, index)] : current[segment];
+	}
+	return current;
+}
+function writePointer(root, pointer, value, index, mode) {
+	const segments = parseJsonPointer(pointer);
+	if (segments.length === 0) return value;
+	const { parent, key } = resolveParent(root, segments, index);
+	if (Array.isArray(parent)) {
+		const position = arrayIndex(parent, key, index, { allowAppend: mode === "add" });
+		if (mode === "add") parent.splice(position, 0, value);
+		else parent[position] = value;
+	} else {
+		if (mode === "replace" && !(key in parent)) throw new JsonPatchError(`key "${key}" does not exist`, index);
+		parent[key] = value;
+	}
+	return root;
+}
+function removePointer(root, pointer, index) {
+	const segments = parseJsonPointer(pointer);
+	if (segments.length === 0) throw new JsonPatchError("`remove` on the document root is not allowed", index);
+	const { parent, key } = resolveParent(root, segments, index);
+	if (Array.isArray(parent)) parent.splice(arrayIndex(parent, key, index), 1);
+	else {
+		if (!(key in parent)) throw new JsonPatchError(`key "${key}" does not exist`, index);
+		delete parent[key];
+	}
+	return root;
+}
+function deepEqual(a, b) {
+	if (a === b) return true;
+	if (Array.isArray(a) && Array.isArray(b)) return a.length === b.length && a.every((item, i) => deepEqual(item, b[i]));
+	if (isPlainObject(a) && isPlainObject(b)) {
+		const keys = Object.keys(a);
+		return keys.length === Object.keys(b).length && keys.every((key) => deepEqual(a[key], b[key]));
+	}
+	return false;
+}
+/**
+* Apply a JSON Patch (RFC 6902) to a copy of the document.
+* The input document is never mutated.
+*/
+function applyJsonPatch(document, operations) {
+	let result = structuredClone(document);
+	for (const [index, operation] of operations.entries()) switch (operation.op) {
+		case "add":
+			result = writePointer(result, operation.path, structuredClone(operation.value), index, "add");
+			break;
+		case "replace":
+			result = writePointer(result, operation.path, structuredClone(operation.value), index, "replace");
+			break;
+		case "remove":
+			result = removePointer(result, operation.path, index);
+			break;
+		case "move": {
+			if (operation.from === void 0) throw new JsonPatchError("`move` requires `from`", index);
+			const moved = structuredClone(readPointer(result, operation.from, index));
+			result = removePointer(result, operation.from, index);
+			result = writePointer(result, operation.path, moved, index, "add");
+			break;
+		}
+		case "copy": {
+			if (operation.from === void 0) throw new JsonPatchError("`copy` requires `from`", index);
+			const copied = structuredClone(readPointer(result, operation.from, index));
+			result = writePointer(result, operation.path, copied, index, "add");
+			break;
+		}
+		case "test": if (!deepEqual(readPointer(result, operation.path, index), operation.value)) throw new JsonPatchError(`\`test\` failed at "${operation.path}"`, index);
+	}
+	return result;
+}
+//#endregion
+//#region src/proxy/actions.ts
+const CONTENT_TYPE_BY_EXTENSION = {
+	".json": "application/json",
+	".html": "text/html; charset=utf-8",
+	".xml": "application/xml",
+	".txt": "text/plain; charset=utf-8",
+	".js": "application/javascript",
+	".css": "text/css",
+	".csv": "text/csv"
+};
+/** Headers to drop as soon as we send back a decoded body of a different size. */
+const BODY_DEPENDENT_HEADERS = [
+	"content-length",
+	"content-encoding",
+	"transfer-encoding"
+];
+function withoutBodyHeaders(headers) {
+	const result = { ...headers };
+	for (const name of BODY_DEPENDENT_HEADERS) delete result[name];
+	return result;
+}
+function lowercaseKeys(headers) {
+	if (headers === void 0) return {};
+	return Object.fromEntries(Object.entries(headers).map(([key, value]) => [key.toLowerCase(), value]));
+}
+function headerValue(headers, name) {
+	const value = headers[name];
+	return Array.isArray(value) ? value[0] : value;
+}
+async function readStub(filePath) {
+	return {
+		body: await readFile(filePath),
+		contentType: CONTENT_TYPE_BY_EXTENSION[path.extname(filePath).toLowerCase()]
+	};
+}
+/** Split an inline body: a string is sent as-is, anything else as JSON. */
+function inlineBody(value) {
+	if (typeof value === "string") return {
+		body: value,
+		contentType: "text/plain; charset=utf-8"
+	};
+	return {
+		json: value,
+		contentType: void 0
+	};
+}
+async function safeJson(body) {
+	try {
+		return await body.getJson();
+	} catch {
+		return;
+	}
+}
+/**
+* A `respond` rule: reply directly, the server is never contacted. The stub file
+* is re-read on every request, so editing it takes effect without a restart.
+*/
+function makeRespondHandler(compiled, ctx) {
+	const respond = compiled.rule.respond;
+	return async (request) => {
+		const { params } = compiled.match(factsFromUrl(request.url, request.method));
+		const relative = respond.file !== void 0 ? interpolate(respond.file, params) : void 0;
+		const filePath = relative !== void 0 ? path.resolve(ctx.baseDir, relative) : void 0;
+		ctx.reporter.action(request.id, "stub", compiled.label, relative ?? "inline");
+		if (respond.delay !== void 0) await setTimeout(respond.delay);
+		const headers = lowercaseKeys(respond.headers);
+		const status = respond.status ?? 200;
+		if (filePath !== void 0) {
+			let stub;
+			try {
+				stub = await readStub(filePath);
+			} catch (cause) {
+				ctx.reporter.warn(`${compiled.label}: cannot read stub (${filePath}) - ${cause.message}`);
+				return {
+					statusCode: 502,
+					json: {
+						error: "jean-claude: stub not found",
+						file: filePath
+					}
+				};
+			}
+			if (stub.contentType !== void 0 && headers["content-type"] === void 0) headers["content-type"] = stub.contentType;
+			return {
+				statusCode: status,
+				headers,
+				body: stub.body
+			};
+		}
+		if (respond.body !== void 0) {
+			const { body, json, contentType } = inlineBody(respond.body);
+			if (contentType !== void 0 && headers["content-type"] === void 0) headers["content-type"] = contentType;
+			return json !== void 0 ? {
+				statusCode: status,
+				headers,
+				json
+			} : {
+				statusCode: status,
+				headers,
+				body
+			};
+		}
+		return {
+			statusCode: status,
+			headers
+		};
+	};
+}
+/**
+* Tags the request for the log and, when the rule asks for it, rewrites the
+* URL / method / headers / body before it goes out to the server.
+*/
+function makeBeforeRequest(compiled, ctx) {
+	const rewrite = compiled?.rule.request;
+	const kind = rewrite !== void 0 ? "rewrite" : compiled?.rule.patch !== void 0 ? "patch" : "passthrough";
+	return async (request) => {
+		ctx.reporter.action(request.id, kind, compiled?.label);
+		if (rewrite === void 0) return void 0;
+		const { params } = compiled.match(factsFromUrl(request.url, request.method));
+		const url = new URL(request.url);
+		if (rewrite.host !== void 0) url.host = rewrite.host;
+		if (rewrite.path !== void 0) url.pathname = interpolate(rewrite.path, params);
+		if (rewrite.query !== void 0) for (const [key, value] of Object.entries(rewrite.query)) url.searchParams.set(key, value);
+		let headers = {
+			...request.headers,
+			...lowercaseKeys(rewrite.headers)
+		};
+		for (const name of rewrite.removeHeaders ?? []) delete headers[name.toLowerCase()];
+		if (rewrite.host !== void 0) headers.host = url.host;
+		const method = rewrite.method?.toUpperCase();
+		if (rewrite.body === void 0 && rewrite.merge === void 0) return {
+			url: url.toString(),
+			method,
+			headers
+		};
+		headers = withoutBodyHeaders(headers);
+		if (rewrite.merge !== void 0) {
+			const current = await safeJson(request.body);
+			return {
+				url: url.toString(),
+				method,
+				headers,
+				json: deepMerge(current, rewrite.merge)
+			};
+		}
+		const { body, json } = inlineBody(rewrite.body);
+		return {
+			url: url.toString(),
+			method,
+			headers,
+			...json !== void 0 ? { json } : { body }
+		};
+	};
+}
+/**
+* Records the real response (before any change) and then applies `patch`.
+*
+* Returns `undefined` when there is neither recording nor patching to do: mockttp
+* then avoids buffering the body and the passthrough stays streamed.
+*/
+function makeBeforeResponse(compiled, ctx) {
+	const patch = compiled?.rule.patch;
+	if (patch === void 0 && ctx.recorder === void 0) return void 0;
+	return async (response, request) => {
+		const decoded = await response.body.getDecodedBuffer() ?? Buffer.alloc(0);
+		if (ctx.recorder !== void 0) try {
+			const written = await ctx.recorder.record(request.url, request.method, decoded, headerValue(response.headers, "content-type"));
+			ctx.reporter.recorded(request.id, written);
+		} catch (cause) {
+			ctx.reporter.warn(`could not record ${request.url} - ${cause.message}`);
+		}
+		if (patch === void 0) return void 0;
+		if (patch.delay !== void 0) await setTimeout(patch.delay);
+		const statusCode = patch.status ?? response.statusCode;
+		const headers = withoutBodyHeaders(patch.replaceHeaders !== void 0 ? lowercaseKeys(patch.replaceHeaders) : {
+			...response.headers,
+			...lowercaseKeys(patch.headers)
+		});
+		if (patch.file !== void 0) {
+			const filePath = path.resolve(ctx.baseDir, patch.file);
+			try {
+				const stub = await readStub(filePath);
+				if (stub.contentType !== void 0) headers["content-type"] = stub.contentType;
+				return {
+					statusCode,
+					headers,
+					body: stub.body
+				};
+			} catch (cause) {
+				ctx.reporter.warn(`${compiled.label}: cannot read stub (${filePath}) - ${cause.message}`);
+				return {
+					statusCode: 502,
+					headers,
+					json: {
+						error: "jean-claude: stub not found",
+						file: filePath
+					}
+				};
+			}
+		}
+		if (patch.body !== void 0) {
+			const { body, json, contentType } = inlineBody(patch.body);
+			if (contentType !== void 0) headers["content-type"] = contentType;
+			return json !== void 0 ? {
+				statusCode,
+				headers,
+				json
+			} : {
+				statusCode,
+				headers,
+				body
+			};
+		}
+		if (patch.merge !== void 0 || patch.jsonPatch !== void 0) {
+			const current = await safeJson(response.body);
+			if (current === void 0) {
+				ctx.reporter.warn(`${compiled.label}: response is not JSON, \`merge\`/\`jsonPatch\` skipped`);
+				return {
+					statusCode,
+					headers,
+					body: decoded
+				};
+			}
+			return {
+				statusCode,
+				headers,
+				json: patch.merge !== void 0 ? deepMerge(current, patch.merge) : applyJsonPatch(current, patch.jsonPatch)
+			};
+		}
+		return {
+			statusCode,
+			headers,
+			body: decoded
+		};
+	};
+}
+//#endregion
+//#region src/proxy/server.ts
+/**
+* Options shared by every passthrough: where to send relayed traffic, and which
+* extra authorities to trust on the way out.
+*/
+function buildConnectionOptions({ upstream, inheritedCa }) {
+	return {
+		...upstream !== void 0 ? { proxyConfig: {
+			proxyUrl: upstream.proxyUrl,
+			...upstream.noProxy !== void 0 ? { noProxy: upstream.noProxy } : {}
+		} } : {},
+		...inheritedCa !== void 0 ? { additionalTrustedCAs: [{ certPath: inheritedCa }] } : {}
+	};
+}
+async function startProxy(options) {
+	const { ca, reporter } = options;
+	let loaded = options.loaded;
+	const initialTlsPassthrough = loaded.config.tlsPassthrough ?? [];
+	const proxy = getLocal({
+		https: {
+			keyPath: ca.keyPath,
+			certPath: ca.certPath,
+			tlsPassthrough: initialTlsPassthrough.map((hostname) => ({ hostname }))
+		},
+		http2: "fallback",
+		recordTraffic: false
+	});
+	const connection = buildConnectionOptions(options);
+	async function attachListeners() {
+		await proxy.on("request", (request) => reporter.seen(request.id, request.method, request.url));
+		await proxy.on("response", (response) => reporter.response(response.id, response.statusCode));
+		await proxy.on("abort", (request) => reporter.aborted(request.id, request.error?.message));
+		await proxy.on("tls-client-error", (failure) => reporter.tlsError(failure.tlsMetadata.sniHostname ?? failure.destination?.hostname));
+	}
+	async function registerRules() {
+		const ctx = {
+			baseDir: loaded.baseDir,
+			reporter,
+			recorder: options.recorder
+		};
+		for (const compiled of loaded.rules) {
+			const builder = proxy.forAnyRequest().matching((request) => compiled.match(factsFromUrl(request.url, request.method)).matched);
+			if (compiled.rule.respond !== void 0) await builder.thenCallback(makeRespondHandler(compiled, ctx));
+			else await builder.thenPassThrough({
+				...connection,
+				beforeRequest: makeBeforeRequest(compiled, ctx),
+				beforeResponse: makeBeforeResponse(compiled, ctx)
+			});
+		}
+		await proxy.forUnmatchedRequest().thenPassThrough({
+			...connection,
+			beforeRequest: makeBeforeRequest(void 0, ctx),
+			beforeResponse: makeBeforeResponse(void 0, ctx)
+		});
+	}
+	await proxy.start(options.port ?? loaded.config.port);
+	await attachListeners();
+	await registerRules();
+	return {
+		url: `http://127.0.0.1:${proxy.port}`,
+		port: proxy.port,
+		reload: async (next) => {
+			loaded = next;
+			if ((next.config.tlsPassthrough ?? []).join(",") !== initialTlsPassthrough.join(",")) reporter.warn("`tlsPassthrough` changed - restart jean-claude for it to take effect.");
+			proxy.reset();
+			await attachListeners();
+			await registerRules();
+		},
+		stop: () => proxy.stop()
+	};
+}
+//#endregion
+//#region src/commands/shared.ts
+/**
+* Brings up everything `run` and `start` need: config, CA, upstream detection,
+* the proxy itself, and optional config hot-reload.
+*/
+async function openSession(options) {
+	const home = options.home !== void 0 ? path.resolve(options.home) : jeanClaudeHome();
+	const loaded = await loadConfig(options.config, { home });
+	const reporter = new Reporter({
+		verbose: options.verbose,
+		quiet: options.quiet
+	});
+	const inheritedCa = inheritedExtraCaCerts();
+	const upstream = detectUpstream(loaded.config);
+	const ca = await ensureCa({
+		dir: caDirIn(home),
+		inheritedCa
+	});
+	const proxy = await startProxy({
+		loaded,
+		ca,
+		upstream,
+		inheritedCa,
+		reporter,
+		recorder: options.record !== void 0 ? new Recorder(path.resolve(options.record)) : void 0,
+		port: options.port
+	});
+	const childEnvOptions = {
+		proxyUrl: proxy.url,
+		bundlePath: ca.bundlePath,
+		noProxy: loaded.config.noProxy
+	};
+	const env = proxyEnvVars(childEnvOptions);
+	const unset = proxyEnvUnset(childEnvOptions);
+	let unwatch;
+	if (options.watch && loaded.filePath !== void 0) {
+		const configPath = loaded.filePath;
+		unwatch = watchConfig(configPath, async () => {
+			try {
+				const next = await loadConfig(configPath);
+				await proxy.reload(next);
+				reporter.info(pc.dim(`config reloaded - ${next.rules.length} rule(s)`));
+			} catch (error) {
+				reporter.warn(`config reload failed, keeping the previous rules:\n${error.message}`);
+			}
+		});
+	}
+	return {
+		loaded,
+		home,
+		ca,
+		upstream,
+		reporter,
+		proxy,
+		env,
+		unset,
+		stop: async () => {
+			await unwatch?.();
+			await proxy.stop();
+		}
+	};
+}
+function printBanner(session, extra = []) {
+	const { loaded, ca, upstream, proxy, reporter } = session;
+	reporter.banner([
+		["proxy", proxy.url],
+		["ca", ca.certPath + (ca.created ? pc.dim("  (just generated)") : "")],
+		["bundle", ca.bundlePath],
+		["config", `${loaded.filePath ?? "(none)"}  ${pc.dim(`${loaded.rules.length} rule(s)`)}`],
+		["upstream", upstream !== void 0 ? `${upstream.proxyUrl}  ${pc.dim(`(from ${upstream.source})`)}` : pc.dim("direct")],
+		...loaded.config.noProxy?.length ? [["bypassed", loaded.config.noProxy.join(", ")]] : [],
+		...extra
+	]);
+	if (ca.inheritedCa !== void 0) reporter.info(pc.dim(`Corporate CA folded into the bundle: ${ca.inheritedCa}`));
+	if (!nodeSupportsEnvProxy()) reporter.warn(`Node ${process.versions.node} predates NODE_USE_ENV_PROXY (needs >=22.21 or >=24.5). Node-based targets will ignore the proxy - upgrade Node, or pass NODE_OPTIONS=--use-env-proxy yourself.`);
+}
+//#endregion
+//#region src/commands/run.ts
+/**
+* Starts the proxy, then runs the target command with the proxy and CA
+* variables already in its environment. Exits with the child's exit code.
+*/
+async function runCommand(command, options) {
+	const [file, ...args] = command;
+	if (file === void 0) throw new Error("nothing to run: pass the target command after `--`, e.g. `jean-claude run -- npx my-tool`.");
+	const session = await openSession(options);
+	printBanner(session, [["command", command.join(" ")]]);
+	const swallow = () => {};
+	process.on("SIGINT", swallow);
+	process.on("SIGTERM", swallow);
+	try {
+		return (await execa(file, args, {
+			env: buildChildEnv(process.env, {
+				proxyUrl: session.proxy.url,
+				bundlePath: session.ca.bundlePath,
+				noProxy: session.loaded.config.noProxy
+			}),
+			stdio: "inherit",
+			reject: false
+		})).exitCode ?? 0;
+	} finally {
+		process.off("SIGINT", swallow);
+		process.off("SIGTERM", swallow);
+		await session.stop();
+	}
+}
+//#endregion
+//#region src/commands/start.ts
+/** Runs the proxy in the foreground until interrupted, for targets we cannot spawn. */
+async function startCommand(options) {
+	const session = await openSession(options);
+	await writeSessionFile(session.home, {
+		proxy: session.proxy.url,
+		port: session.proxy.port,
+		bundle: session.ca.bundlePath,
+		config: session.loaded.filePath ?? null,
+		noProxy: session.loaded.config.noProxy ?? null,
+		pid: process.pid
+	});
+	try {
+		if (options.json) console.log(JSON.stringify({
+			proxy: session.proxy.url,
+			port: session.proxy.port,
+			ca: session.ca.certPath,
+			bundle: session.ca.bundlePath,
+			config: session.loaded.filePath,
+			rules: session.loaded.rules.length,
+			upstream: session.upstream?.proxyUrl ?? null,
+			env: session.env,
+			unset: session.unset
+		}, null, 2));
+		else if (options.export) console.log(formatShellExports(session.env, session.unset));
+		else {
+			printBanner(session);
+			console.log(`  ${pc.dim("In the shell that runs your tool:")}\n`);
+			console.log(`    ${pc.bold("eval \"$(jean-claude env)\"")}\n`);
+			console.log(`  ${pc.dim("Ctrl-C to stop.")}\n`);
+		}
+		await waitForInterrupt();
+	} finally {
+		await removeSessionFile(session.home);
+		await session.stop();
+	}
+	return 0;
+}
+function waitForInterrupt() {
+	return new Promise((resolve) => {
+		const finish = () => {
+			process.off("SIGINT", finish);
+			process.off("SIGTERM", finish);
+			resolve();
+		};
+		process.on("SIGINT", finish);
+		process.on("SIGTERM", finish);
+	});
+}
+//#endregion
+//#region src/cli.ts
+function parsePort(value) {
+	const port = Number.parseInt(value, 10);
+	if (!Number.isInteger(port) || port < 1 || port > 65535) throw new InvalidArgumentError("expected a port between 1 and 65535.");
+	return port;
+}
+/** Shown wherever `--home` is offered, so the default is never a mystery. */
+const HOME_DESCRIPTION = "jean-claude directory: config, stubs, CA, session (default: ~/.config/jean-claude)";
+function toSessionOptions(flags) {
+	return {
+		config: flags.config,
+		port: flags.port,
+		record: flags.record,
+		home: flags.home,
+		verbose: flags.verbose ?? false,
+		quiet: flags.quiet ?? false,
+		watch: flags.watch ?? true
+	};
+}
+/** Flags common to `run` and `start`. */
+function withSessionFlags(command) {
+	return command.option("-c, --config <path>", "path to the config file (default: nearest jean-claude.yaml, then the home one)").option("-p, --port <port>", "port to listen on (default: a free port)", parsePort).option("-r, --record <dir>", "write real responses to this directory, ready to reuse as stubs").option("--home <dir>", HOME_DESCRIPTION).option("-v, --verbose", "also log traffic that matches no rule").option("-q, --quiet", "suppress the per-request log").option("--no-watch", "do not reload the config when it changes");
+}
+const program = new Command();
+program.name("jean-claude").description("MITM HTTPS proxy that rewrites another tool's API traffic, driven by a YAML file.").version("0.1.0");
+withSessionFlags(program.command("run", { isDefault: true }).description("run a command with its HTTPS traffic intercepted").argument("<command...>", "the command to run, after `--`")).action(async (command, flags) => {
+	process.exitCode = await runCommand(command, toSessionOptions(flags));
+});
+withSessionFlags(program.command("start").description("run the proxy alone and print the variables to export")).option("--json", "print the settings as JSON").option("--export", "print only the shell export block").action(async (flags) => {
+	process.exitCode = await startCommand({
+		...toSessionOptions(flags),
+		json: flags.json ?? false,
+		export: flags.export ?? false
+	});
+});
+program.command("env").description("print the environment for an already running `start`, for `eval \"$(jean-claude env)\"`").option("--home <dir>", HOME_DESCRIPTION).option("-p, --port <port>", "target this port instead of discovering the running session", parsePort).option("--json", "print the variables as JSON").action(async (flags) => {
+	process.exitCode = await envCommand({
+		home: flags.home,
+		port: flags.port,
+		json: flags.json ?? false
+	});
+});
+program.command("ca").description("show the certificate store, and how to trust it").option("--home <dir>", HOME_DESCRIPTION).option("--print", "write the CA certificate to stdout").option("--install", "show the commands to add the CA to the system trust store").action(async (flags) => {
+	process.exitCode = await caCommand({
+		home: flags.home,
+		print: flags.print ?? false,
+		install: flags.install ?? false
+	});
+});
+program.command("check").description("validate the config and print the rules as resolved").option("-c, --config <path>", "path to the config file").option("--home <dir>", HOME_DESCRIPTION).action(async (flags) => {
+	process.exitCode = await checkCommand(flags.config, flags.home);
+});
+program.command("init").description("set up the jean-claude directory: config, sample stub and CA").option("--home <dir>", HOME_DESCRIPTION).option("--claude-code", "start from the rule that freezes Claude Code's managed settings").action(async (flags) => {
+	process.exitCode = await initCommand({
+		home: flags.home,
+		claudeCode: flags.claudeCode ?? false
+	});
+});
+try {
+	await program.parseAsync();
+} catch (error) {
+	console.error(`\n  ${pc.red("error")}  ${error.message}\n`);
+	process.exitCode = 1;
+}
+//#endregion
+export {};