@speedkit/cli 4.22.0 → 4.23.0

package/CHANGELOG.md

@@ -1,3 +1,22 @@
+# [4.23.0](https://gitlab.orestes.info/baqend/speed-kit-cli/compare/v4.22.1...v4.23.0) (2026-08-21)
+
+
+### Bug Fixes
+
+* **onboarding:** fetch origin exactly as the server does ([8da54b0](https://gitlab.orestes.info/baqend/speed-kit-cli/commit/8da54b0ac0ffa04671cb3c7e97988e8ac871f2c5))
+
+
+### Features
+
+* **origin-request:** simulate the server's origin request for a variation ([dc414e0](https://gitlab.orestes.info/baqend/speed-kit-cli/commit/dc414e03142cab154c8f179cdb67f58922a6d38b))
+
+## [4.22.1](https://gitlab.orestes.info/baqend/speed-kit-cli/compare/v4.22.0...v4.22.1) (2026-08-21)
+
+
+### Bug Fixes
+
+* **bundler:** resolve alias targets from the customer directory ([ad30e2a](https://gitlab.orestes.info/baqend/speed-kit-cli/commit/ad30e2ac48a84c7592dd59d41004c301df212205))
+
 # [4.22.0](https://gitlab.orestes.info/baqend/speed-kit-cli/compare/v4.21.0...v4.22.0) (2026-08-20)
 
 

package/README.md

@@ -21,7 +21,7 @@ $ npm install -g @speedkit/cli
 $ sk COMMAND
 running command...
 $ sk (--version)
-@speedkit/cli/4.22.0 linux-x64 node-v22.23.2
+@speedkit/cli/4.23.0 linux-x64 node-v22.23.2
 $ sk --help [COMMAND]
 USAGE
   $ sk COMMAND
@@ -88,6 +88,7 @@ By either...
 * [`sk help [COMMAND]`](#sk-help-command)
 * [`sk login [APP]`](#sk-login-app)
 * [`sk onboarding CUSTOMERPATH`](#sk-onboarding-customerpath)
+* [`sk origin-request CUSTOMERPATH PAGEURL`](#sk-origin-request-customerpath-pageurl)
 * [`sk param-diff PAGEURL`](#sk-param-diff-pageurl)
 * [`sk prewarm APP PATH`](#sk-prewarm-app-path)
 * [`sk pull CUSTOMERPATH`](#sk-pull-customerpath)
@@ -620,6 +621,41 @@ EXAMPLES
   $ sk onboarding customers/decathlon.de -c production -d www.decathlon.de
 ```
 
+## `sk origin-request CUSTOMERPATH PAGEURL`
+
+Request a page from origin with the exact headers Speed Kit's server sends for a cache variation, using the app's deployed runtime config
+
+```
+USAGE
+  $ sk origin-request CUSTOMERPATH PAGEURL [-c <value>] [-v <value>] [--host <value>] [--body <value>] [--grep
+    <value>] [--json] [--variations <value>]
+
+ARGUMENTS
+  CUSTOMERPATH  The customer config path
+  PAGEURL       Page to request from origin
+
+FLAGS
+  -c, --configName=<value>  [default: production] The costumer config name
+  -v, --variation=<value>   Cache variation to simulate, e.g. desktop-fmarkt-variant-e_1907090. Omitted means the
+                            default variation
+      --body=<value>        Write the response body to this file
+      --grep=<value>        Print body lines matching this regex, case-insensitive
+      --host=<value>        Send this Host header, emulating an origin-map host override
+      --json                Machine-readable output
+      --variations=<value>  Simulate against a runtime config in a local file instead of the app's deployed one
+
+DESCRIPTION
+  Request a page from origin with the exact headers Speed Kit's server sends for a cache variation, using the app's
+  deployed runtime config
+
+EXAMPLES
+  $ sk origin-request <customerPath> <pageUrl>
+
+  $ sk origin-request customers/decathlon.de https://www.decathlon.de/ -v mobile
+
+  $ sk origin-request customers/decathlon.de https://www.decathlon.de/ --grep "storeId" --body /tmp/origin.html
+```
+
 ## `sk param-diff PAGEURL`
 
 Shows difference in documents with query parameters on/off

package/dist/commands/origin-request.d.ts

@@ -0,0 +1,21 @@
+import { Command } from "@oclif/core";
+export default class OriginRequest extends Command {
+    static description: string;
+    static args: {
+        pageUrl: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+        customerPath: import("@oclif/core/interfaces").Arg<string, {
+            exists?: boolean;
+        }>;
+    };
+    static flags: {
+        variation: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        host: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        body: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        grep: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        variations: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        configName: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    static examples: string[];
+    run(): Promise<void>;
+}

package/dist/commands/origin-request.js

@@ -0,0 +1,49 @@
+import { Args, Command, Flags } from "@oclif/core";
+import { CLI_CONFIG_NAME, CLI_CUSTOMER_CONFIG, CLIParameters, CLIParametersChar, CLIParametersExample, } from "../models/cli-parameters.js";
+import { CliConfig } from "../helpers/cli-config.js";
+import { OriginRequestContext, OriginRequestServiceFactory, } from "../services/origin-request/index.js";
+export default class OriginRequest extends Command {
+    static description = "Request a page from origin with the exact headers Speed Kit's server sends for a cache variation, using the app's deployed runtime config";
+    static args = {
+        ...CLI_CUSTOMER_CONFIG,
+        [CLIParameters.PageUrl]: Args.string({
+            name: CLIParameters.PageUrl,
+            required: true,
+            description: "Page to request from origin",
+            example: CLIParametersExample.PageUrl,
+        }),
+    };
+    static flags = {
+        ...CLI_CONFIG_NAME,
+        [CLIParameters.Variation]: Flags.string({
+            char: CLIParametersChar.Variation,
+            description: "Cache variation to simulate, e.g. desktop-fmarkt-variant-e_1907090. Omitted means the default variation",
+        }),
+        host: Flags.string({
+            description: "Send this Host header, emulating an origin-map host override",
+        }),
+        body: Flags.string({
+            description: "Write the response body to this file",
+        }),
+        grep: Flags.string({
+            description: "Print body lines matching this regex, case-insensitive",
+        }),
+        json: Flags.boolean({
+            description: "Machine-readable output",
+        }),
+        variations: Flags.string({
+            description: "Simulate against a runtime config in a local file instead of the app's deployed one",
+        }),
+    };
+    static examples = [
+        `$ sk origin-request <${CLIParameters.CustomerPath}> <${CLIParameters.PageUrl}>`,
+        `$ sk origin-request ${CLIParametersExample.CustomerPath} ${CLIParametersExample.PageUrl} -${CLIParametersChar.Variation} mobile`,
+        `$ sk origin-request ${CLIParametersExample.CustomerPath} ${CLIParametersExample.PageUrl} --grep "storeId" --body /tmp/origin.html`,
+    ];
+    async run() {
+        const { args: { customerPath, pageUrl }, flags: { configName, variation, host, body, grep, json, variations }, } = await this.parse(OriginRequest);
+        const context = new OriginRequestContext(customerPath, configName, pageUrl, variation, host, body, grep, json, variations);
+        const service = await new OriginRequestServiceFactory(context, new CliConfig(this.config).load()).buildService();
+        await service.run();
+    }
+}

package/dist/services/bundler/bundle-service.d.ts

@@ -14,6 +14,18 @@ export declare class BundleService {
         logLevel?: LogLevel;
         platform?: "browser" | "node" | "neutral";
     }): Promise<string>;
+    /**
+     * Turns each alias target into an absolute path, resolved from the same directory the bundled
+     * code resolves its own imports from.
+     *
+     * esbuild resolves an alias target from its working directory, not from the entry point's
+     * resolveDir. `{ "node-fetch": "node-fetch-native" }` therefore only resolved while `sk` ran
+     * inside the customer checkout, and failed from anywhere else — even though the bundled code
+     * could import the very same module by name.
+     *
+     * A target that is not installed stays a bare name, so esbuild reports it as before.
+     */
+    private resolveAliases;
     private entryPointsPlugin;
     baqendPlugin(basePaths: BundleBasePaths): {
         name: string;

package/dist/services/bundler/bundle-service.js

@@ -4,6 +4,7 @@ import { URL } from "node:url";
 import { BundleResolveError } from "./error/bundle-resolve-error.js";
 import { BundleFetchError } from "./error/bundle-fetch-error.js";
 import { resolve } from "node:path";
+import { createRequire } from "node:module";
 const importCache = {};
 export class BundleService {
     moduleDiscoveryDir;
@@ -29,13 +30,39 @@ export class BundleService {
             entryPoints: Object.keys(entryPoints),
             platform: platform || "neutral",
             logLevel,
-            alias,
+            alias: this.resolveAliases(alias),
         });
         return result.outputFiles
             .map((outputFile) => outputFile.text)
             .join("")
             .trim();
     }
+    /**
+     * Turns each alias target into an absolute path, resolved from the same directory the bundled
+     * code resolves its own imports from.
+     *
+     * esbuild resolves an alias target from its working directory, not from the entry point's
+     * resolveDir. `{ "node-fetch": "node-fetch-native" }` therefore only resolved while `sk` ran
+     * inside the customer checkout, and failed from anywhere else — even though the bundled code
+     * could import the very same module by name.
+     *
+     * A target that is not installed stays a bare name, so esbuild reports it as before.
+     */
+    resolveAliases(alias) {
+        if (Object.keys(alias).length === 0) {
+            return alias;
+        }
+        // The filename never has to exist; only its directory decides where the lookup starts.
+        const requireFrom = createRequire(resolve(this.moduleDiscoveryDir, "noop.js"));
+        return Object.fromEntries(Object.entries(alias).map(([from, to]) => {
+            try {
+                return [from, requireFrom.resolve(to)];
+            }
+            catch {
+                return [from, to];
+            }
+        }));
+    }
     entryPointsPlugin(entryPoints) {
         // eslint-disable-next-line @typescript-eslint/no-this-alias
         const me = this;

package/dist/services/bundler/bundle-service.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/services/bundler/bundle-service.spec.js

@@ -0,0 +1,54 @@
+import { expect } from "chai";
+import { after, before, describe, it } from "mocha";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { BundleService } from "./bundle-service.js";
+/**
+ * The customer checkout installs the modules a document handler imports, so resolution must follow
+ * the customer directory rather than the directory `sk` happens to run in. The fixture below is
+ * only reachable from the customer directory, which is what makes the assertion meaningful.
+ */
+describe("BundleService alias resolution", () => {
+    const MARKER = "fixture-fetch-implementation";
+    let customerDirectory;
+    before(() => {
+        customerDirectory = mkdtempSync(join(tmpdir(), "sk-bundle-"));
+        const packageDirectory = join(customerDirectory, "node_modules", "fetch-native-fixture");
+        mkdirSync(packageDirectory, { recursive: true });
+        writeFileSync(join(packageDirectory, "package.json"), JSON.stringify({
+            name: "fetch-native-fixture",
+            version: "1.0.0",
+            main: "index.js",
+        }));
+        writeFileSync(join(packageDirectory, "index.js"), `module.exports = "${MARKER}";`);
+    });
+    after(() => {
+        rmSync(customerDirectory, { recursive: true, force: true });
+    });
+    it("resolves an alias target from the customer directory, not from the working directory", async () => {
+        const bundle = await new BundleService(customerDirectory).bundle({
+            entryPoints: {
+                "handler.js": "module.exports = require('node-fetch');",
+            },
+            minify: false,
+            platform: "node",
+            logLevel: "silent",
+            alias: { "node-fetch": "fetch-native-fixture" },
+        });
+        expect(bundle).to.contain(MARKER);
+    });
+    it("leaves an uninstalled alias target to esbuild", async () => {
+        const bundling = new BundleService(customerDirectory).bundle({
+            entryPoints: {
+                "handler.js": "module.exports = require('node-fetch');",
+            },
+            minify: false,
+            platform: "node",
+            logLevel: "silent",
+            alias: { "node-fetch": "not-installed-anywhere" },
+        });
+        const error = await bundling.then(() => undefined, (reason) => reason);
+        expect(String(error)).to.contain("not-installed-anywhere");
+    });
+});

package/dist/services/onboarding/virtual-orestes-app/crawler.d.ts

@@ -5,58 +5,27 @@ export declare class Crawler {
     private cli;
     private agentConfig;
     private speedKitServerConfig?;
+    /** Warnings already shown, so a per-fetch condition is reported once per session. */
+    private readonly warned;
     constructor(cli: CliService, agentConfig: Agent, speedKitServerConfig?: SpeedKitServerConfig);
+    private warnOnce;
     fetchRemote(originUrl: string, variation: string): Promise<{
         response: Response;
         url: string;
     } | undefined>;
-    private setDefaultUserAgent;
     /**
-     * Mirrors how the Baqend asset server applies the `variations` block from
-     * the Speed Kit server config to outgoing origin fetches. The cookie /
-     * user-agent / etc. headers configured per variation must reach the origin
-     * so that the response matches what the variation is supposed to represent
-     * (e.g. a logged-in user, a specific store, a mobile device).
+     * Builds the origin request exactly as the Baqend asset server builds it, so a locally cached
+     * document matches what production would cache for the same variation.
      *
-     * Resolution order (matches Orestes server behavior):
-     *   1. The wildcard `"*"` variation (if any) — its headers always apply.
-     *   2. First-match-wins iteration over the remaining variations: for each
-     *      entry in declaration order, try an exact key match against
-     *      `variationParameter` first, then fall back to its Java-style
-     *      `regex` (e.g. `(?i)desktop-fmarkt-variant-(?<storeId>.*)`). The
-     *      first variation that matches by either means is applied — exact
-     *      matches do NOT take priority over regex matches in earlier
-     *      entries. When matched via regex, named capture groups are
-     *      substituted into header values via `${name}` placeholders, so a
-     *      cookie like `fmarktcookie=${storeId}` becomes
-     *      `fmarktcookie=2879130`.
-     *   3. Origin-level basic auth fallback (only if no variation matched).
+     * The resolution itself lives in `services/origin-request` and is shared with
+     * `sk origin-request`, so there is one owner for it and one place the server's behaviour is
+     * pinned by specs. That covers the base headers, the wildcard-then-variation order, the regex
+     * templates with their `${group}` substitution, and the query params.
      *
-     * Returns the (query-param-augmented) origin URL alongside the request init,
-     * so query-param variations like `Sortierung=${sort}` reach the origin.
+     * Two things stay local: origin basic auth, which no variation carries, and tolerance for a
+     * variation the config does not define — the server rejects that request, but failing a whole
+     * onboarding session over it would be unhelpful, so it falls back to the base headers and warns.
      */
     private prepareOriginRequest;
-    /**
-     * Applies a matched variation: merges its headers into `init` and appends its
-     * `queryParams` onto `url`, substituting regex named groups (`${name}`) — so
-     * `Sortierung=${sort}` with `{ sort: "3" }` becomes `Sortierung=3`.
-     */
-    private applyVariation;
-    /**
-     * Replaces `${name}` placeholders in each header value with the matching
-     * named capture group from a regex match. Used by `prepareOriginRequest`
-     * to materialize parameterized variation headers — e.g. given:
-     *
-     *   headers = { cookie: "fmarktcookie=${storeId}" }
-     *   groups  = { storeId: "2879130" }
-     *
-     * the result is `{ cookie: "fmarktcookie=2879130" }`.
-     *
-     * Placeholders that don't match a captured group are left intact rather
-     * than replaced with `undefined`, so a misconfigured variation still
-     * produces a recognisable header value instead of a silent corruption.
-     * Non-string header values are passed through unchanged.
-     */
-    private substituteNamedGroups;
     private prepareAuthRequest;
 }

package/dist/services/onboarding/virtual-orestes-app/crawler.js

@@ -1,26 +1,27 @@
-import { USER_AGENT } from "../onboarding-model.js";
 import { safe } from "../../../helpers/safe.js";
-import { javaRegexToJs } from "../../../helpers/java-regex.js";
+import { resolveRequest, UndefinedVariationError, } from "../../origin-request/index.js";
 import { randomUUID } from "node:crypto";
 export class Crawler {
     cli;
     agentConfig;
     speedKitServerConfig;
+    /** Warnings already shown, so a per-fetch condition is reported once per session. */
+    warned = new Set();
     constructor(cli, agentConfig, speedKitServerConfig) {
         this.cli = cli;
         this.agentConfig = agentConfig;
         this.speedKitServerConfig = speedKitServerConfig;
     }
+    warnOnce(key, message) {
+        if (this.warned.has(key))
+            return;
+        this.warned.add(key);
+        this.cli.writeWarning(message);
+    }
     async fetchRemote(originUrl, variation) {
-        const userAgent = this.setDefaultUserAgent(variation);
-        const headers = {
-            "User-Agent": userAgent,
-        };
         // origin URL with the variation's query params applied — returned so callers compare it
         // (not the bare originUrl) against response.url for redirect detection
-        const { url, init } = this.prepareOriginRequest(originUrl, variation, {
-            headers,
-        });
+        const { url, init } = this.prepareOriginRequest(originUrl, variation);
         const requestInit = {
             ...init,
             agent: this.agentConfig,
@@ -36,138 +37,46 @@ export class Crawler {
         this.cli.writeError(fetchResponse.error);
         this.cli.writeError(JSON.stringify(fetchResponse.errorObj));
     }
-    setDefaultUserAgent(variation) {
-        if (/^mobile$/is.test(variation)) {
-            return USER_AGENT.MOBILE;
-        }
-        if (/^tablet$/is.test(variation)) {
-            return USER_AGENT.TABLET;
-        }
-        return USER_AGENT.DESKTOP;
-    }
     /**
-     * Mirrors how the Baqend asset server applies the `variations` block from
-     * the Speed Kit server config to outgoing origin fetches. The cookie /
-     * user-agent / etc. headers configured per variation must reach the origin
-     * so that the response matches what the variation is supposed to represent
-     * (e.g. a logged-in user, a specific store, a mobile device).
+     * Builds the origin request exactly as the Baqend asset server builds it, so a locally cached
+     * document matches what production would cache for the same variation.
      *
-     * Resolution order (matches Orestes server behavior):
-     *   1. The wildcard `"*"` variation (if any) — its headers always apply.
-     *   2. First-match-wins iteration over the remaining variations: for each
-     *      entry in declaration order, try an exact key match against
-     *      `variationParameter` first, then fall back to its Java-style
-     *      `regex` (e.g. `(?i)desktop-fmarkt-variant-(?<storeId>.*)`). The
-     *      first variation that matches by either means is applied — exact
-     *      matches do NOT take priority over regex matches in earlier
-     *      entries. When matched via regex, named capture groups are
-     *      substituted into header values via `${name}` placeholders, so a
-     *      cookie like `fmarktcookie=${storeId}` becomes
-     *      `fmarktcookie=2879130`.
-     *   3. Origin-level basic auth fallback (only if no variation matched).
+     * The resolution itself lives in `services/origin-request` and is shared with
+     * `sk origin-request`, so there is one owner for it and one place the server's behaviour is
+     * pinned by specs. That covers the base headers, the wildcard-then-variation order, the regex
+     * templates with their `${group}` substitution, and the query params.
      *
-     * Returns the (query-param-augmented) origin URL alongside the request init,
-     * so query-param variations like `Sortierung=${sort}` reach the origin.
-     */
-    prepareOriginRequest(originUrl, variationParameter, init) {
-        const url = new URL(originUrl);
-        if (!this.speedKitServerConfig) {
-            return { url: url.toString(), init };
-        }
-        const variations = this.speedKitServerConfig.speedKit.variations;
-        // Wildcard variation applies to every request, regardless of which
-        // specific variation (if any) is requested.
-        if (variations?.["*"]) {
-            this.applyVariation(url, init, variations["*"], undefined);
-        }
-        if (!variationParameter) {
-            return { url: url.toString(), init };
-        }
-        // First-match-wins over the variations in declaration order. Each entry
-        // can match by exact key or by its Java-style `regex` field; whichever
-        // entry matches first applies its headers + query params and short-circuits.
-        for (const variationKey in variations) {
-            if (variationKey === "*") {
-                continue;
-            }
-            const variationConfig = variations[variationKey];
-            if (variationParameter === variationKey) {
-                this.applyVariation(url, init, variationConfig, undefined);
-                return { url: url.toString(), init };
-            }
-            if (!variationConfig.regex) {
-                continue;
-            }
-            const regex = javaRegexToJs(variationConfig.regex);
-            if (!regex) {
-                // Unsupported Java regex construct — skip rather than crash so later
-                // variations still get a chance to match.
-                continue;
-            }
-            const match = variationParameter.match(regex);
-            if (!match) {
-                continue;
-            }
-            this.applyVariation(url, init, variationConfig, match.groups);
-            return { url: url.toString(), init };
-        }
-        // No variation matched: fall back to origin basic auth if configured.
-        const authentication = this.prepareAuthRequest(originUrl);
-        if (authentication) {
-            init.headers["Authorization"] = authentication;
-        }
-        return { url: url.toString(), init };
-    }
-    /**
-     * Applies a matched variation: merges its headers into `init` and appends its
-     * `queryParams` onto `url`, substituting regex named groups (`${name}`) — so
-     * `Sortierung=${sort}` with `{ sort: "3" }` becomes `Sortierung=3`.
+     * Two things stay local: origin basic auth, which no variation carries, and tolerance for a
+     * variation the config does not define — the server rejects that request, but failing a whole
+     * onboarding session over it would be unhelpful, so it falls back to the base headers and warns.
      */
-    applyVariation(url, init, variationConfig, groups) {
-        init.headers = {
-            ...init.headers,
-            ...this.substituteNamedGroups(variationConfig.headers, groups),
-        };
-        for (const queryParam of variationConfig.queryParams ?? []) {
-            const substituted = groups
-                ? queryParam.replace(/\$\{(\w+)}/g, (match, name) => groups[name] ?? match)
-                : queryParam;
-            const eq = substituted.indexOf("=");
-            const key = eq === -1 ? substituted : substituted.slice(0, eq);
-            const value = eq === -1 ? "" : substituted.slice(eq + 1);
-            url.searchParams.set(key, value);
+    prepareOriginRequest(originUrl, variationParameter) {
+        const variations = this.speedKitServerConfig?.speedKit?.variations ?? {};
+        // An empty map means the runtime config never loaded, so no fetch can carry variation headers.
+        // Say that once, rather than blaming each variation for being undefined.
+        if (!Object.keys(variations).length) {
+            this.warnOnce("no-runtime-config", "no variations available from the runtime config, so origin fetches carry the base headers only — the cached document may differ from production. Are you logged in?");
         }
-    }
-    /**
-     * Replaces `${name}` placeholders in each header value with the matching
-     * named capture group from a regex match. Used by `prepareOriginRequest`
-     * to materialize parameterized variation headers — e.g. given:
-     *
-     *   headers = { cookie: "fmarktcookie=${storeId}" }
-     *   groups  = { storeId: "2879130" }
-     *
-     * the result is `{ cookie: "fmarktcookie=2879130" }`.
-     *
-     * Placeholders that don't match a captured group are left intact rather
-     * than replaced with `undefined`, so a misconfigured variation still
-     * produces a recognisable header value instead of a silent corruption.
-     * Non-string header values are passed through unchanged.
-     */
-    substituteNamedGroups(headers, groups) {
-        if (!headers) {
-            return {};
+        let resolved;
+        try {
+            resolved = resolveRequest(variations, originUrl, variationParameter);
         }
-        if (!groups) {
-            return { ...headers };
+        catch (error) {
+            if (!(error instanceof UndefinedVariationError))
+                throw error;
+            this.warnOnce(`undefined-variation:${variationParameter}`, `${error.message} Falling back to the base headers.`);
+            resolved = resolveRequest({}, originUrl);
         }
-        const result = {};
-        for (const [key, value] of Object.entries(headers)) {
-            result[key] =
-                typeof value === "string"
-                    ? value.replace(/\$\{(\w+)}/g, (match, name) => groups[name] ?? match)
-                    : value;
+        const init = { headers: { ...resolved.headers } };
+        // Only a request that matched no specific variation falls back to origin basic auth. The
+        // wildcard applies to every request, so it does not count as a match.
+        const matchedSpecificVariation = resolved.appliedKeys.some((key) => key !== "*" && !key.startsWith("device-default:"));
+        if (!matchedSpecificVariation) {
+            const authentication = this.prepareAuthRequest(originUrl);
+            if (authentication)
+                init.headers["Authorization"] = authentication;
         }
-        return result;
+        return { url: resolved.url, init };
     }
     prepareAuthRequest(originUrl) {
         if (!this.speedKitServerConfig ||

package/dist/services/origin-request/asset-variations.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Port of the server's variation resolution, so a request can be reproduced locally with the exact
+ * headers Speed Kit would send.
+ *
+ * Mirrors two pieces of server behaviour:
+ *   - `AssetVariations.getVariations()` — which variation configs apply and in which order
+ *     (orestes: `orestes-common/.../typesystem/AssetVariations.kt`)
+ *   - `AssetClient.newRequest()` / `createRequest()` — base headers, last-writer-wins merging,
+ *     urlPrefix and queryParams (orestes: `orestes-server/.../asset/AssetClient.kt`)
+ *
+ * Keep this file free of I/O so the resolution stays unit-testable.
+ */
+/** A single variation entry of the runtime config's `speedKit.variations`. */
+export interface AssetVariation {
+    headers?: Record<string, string | null>;
+    urlPrefix?: string;
+    encodePrefixedUrl?: boolean;
+    queryParams?: string[];
+    regex?: string | null;
+    /** Which config key produced this entry. Set during resolution, for reporting. */
+    matchedKey?: string;
+}
+export type AssetVariationMap = Record<string, AssetVariation>;
+export interface ResolvedRequest {
+    /** Keys of the applied configs, in the order the server applies them. */
+    appliedKeys: string[];
+    /** `template` when a regex entry matched, otherwise `named`. */
+    resolutionPath: "template" | "named";
+    url: string;
+    headers: Record<string, string>;
+}
+export declare const DEFAULT_TYPE = "default";
+/** User agents the server falls back to. Keep in sync with AssetVariations.kt. */
+export declare const DEFAULT_USER_AGENT = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.6 Safari/605.1.15 (compatible; SpeedKit/1.0)";
+/** Thrown where the server would throw UndefinedVariationException. */
+export declare class UndefinedVariationError extends Error {
+    constructor(variationType: string);
+}
+/**
+ * Resolves which variation configs apply, in server order. The template path returns
+ * `[wildcard, template]` and skips the device defaults; otherwise `[default, wildcard, named]`.
+ */
+export declare function getVariations(custom: AssetVariationMap, variationType?: string): AssetVariation[];
+/** Resolves a variation into the concrete request the server would send. */
+export declare function resolveRequest(custom: AssetVariationMap, url: string, variationType?: string, hostOverride?: string): ResolvedRequest;
+/** Renders the resolved request as a curl command, for pasting into a bug report. */
+export declare function toCurl(url: string, headers: Record<string, string>): string;

package/dist/services/origin-request/asset-variations.js

@@ -0,0 +1,170 @@
+/**
+ * Port of the server's variation resolution, so a request can be reproduced locally with the exact
+ * headers Speed Kit would send.
+ *
+ * Mirrors two pieces of server behaviour:
+ *   - `AssetVariations.getVariations()` — which variation configs apply and in which order
+ *     (orestes: `orestes-common/.../typesystem/AssetVariations.kt`)
+ *   - `AssetClient.newRequest()` / `createRequest()` — base headers, last-writer-wins merging,
+ *     urlPrefix and queryParams (orestes: `orestes-server/.../asset/AssetClient.kt`)
+ *
+ * Keep this file free of I/O so the resolution stays unit-testable.
+ */
+import { javaRegexToJs } from "../../helpers/java-regex.js";
+export const DEFAULT_TYPE = "default";
+const WILD_CARD = "*";
+/** User agents the server falls back to. Keep in sync with AssetVariations.kt. */
+export const DEFAULT_USER_AGENT = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.6 Safari/605.1.15 (compatible; SpeedKit/1.0)";
+const MOBILE_USER_AGENT = "Mozilla/5.0 (iPhone; CPU iPhone OS 18_6_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.6 Mobile/15E148 Safari/604.1 (compatible; SpeedKit/1.0)";
+const TABLET_USER_AGENT = "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 (compatible; SpeedKit/1.0)";
+const DEVICE_DEFAULTS = {
+    [DEFAULT_TYPE]: { headers: { "user-agent": DEFAULT_USER_AGENT } },
+    mobile: { headers: { "user-agent": MOBILE_USER_AGENT } },
+    tablet: { headers: { "user-agent": TABLET_USER_AGENT } },
+};
+/** Group names a template captures, e.g. `storeId` from `(?<storeId>.*)`. */
+const CAPTURING_TEMPLATES = /<(\w+)>/g;
+/** Thrown where the server would throw UndefinedVariationException. */
+export class UndefinedVariationError extends Error {
+    constructor(variationType) {
+        super(`Variation ${variationType} not found — the server would reject this request with UndefinedVariationException.`);
+    }
+}
+/**
+ * Matches a template pattern against a variation. The server uses Java's `matches()`, which requires
+ * the pattern to cover the whole input, so a partial match is not a match here either.
+ */
+function matchWholeVariation(pattern, variationType) {
+    const regex = javaRegexToJs(pattern);
+    // An unsupported Java construct leaves the entry unmatched rather than crashing the caller.
+    if (!regex)
+        return undefined;
+    const match = regex.exec(variationType);
+    return match?.[0] === variationType ? match : undefined;
+}
+/** Substitutes `${group}` in every header, urlPrefix and queryParam of a template entry. */
+function applyTemplate(entry, variationType) {
+    const pattern = entry.regex;
+    if (!pattern)
+        return undefined;
+    const match = matchWholeVariation(pattern, variationType);
+    if (!match)
+        return undefined;
+    const replacements = new Map();
+    for (const [, groupName] of pattern.matchAll(CAPTURING_TEMPLATES)) {
+        const value = match.groups?.[groupName];
+        if (value !== undefined)
+            replacements.set(groupName, value);
+    }
+    const substitute = (text) => {
+        let out = text;
+        for (const [name, value] of replacements)
+            out = out.split(`\${${name}}`).join(value);
+        return out;
+    };
+    return {
+        matchedKey: entry.matchedKey,
+        urlPrefix: entry.urlPrefix ? substitute(entry.urlPrefix) : entry.urlPrefix,
+        encodePrefixedUrl: entry.encodePrefixedUrl,
+        queryParams: (entry.queryParams ?? []).map(substitute),
+        headers: Object.fromEntries(Object.entries(entry.headers ?? {}).map(([key, value]) => [
+            key,
+            value === null ? null : substitute(String(value)),
+        ])),
+    };
+}
+/**
+ * Resolves which variation configs apply, in server order. The template path returns
+ * `[wildcard, template]` and skips the device defaults; otherwise `[default, wildcard, named]`.
+ */
+export function getVariations(custom, variationType) {
+    const entries = Object.entries(custom ?? {}).map(([key, entry]) => ({
+        ...entry,
+        matchedKey: key,
+    }));
+    const wildcard = entries.find((entry) => entry.matchedKey === WILD_CARD);
+    const type = variationType ?? DEFAULT_TYPE;
+    if (variationType &&
+        !custom[variationType] &&
+        !custom[variationType.toUpperCase()]) {
+        const template = entries
+            .filter((entry) => entry.regex)
+            .map((entry) => applyTemplate(entry, variationType))
+            .find(Boolean);
+        if (template)
+            return [wildcard, template].filter(Boolean);
+    }
+    const deviceDefault = DEVICE_DEFAULTS[type] ?? DEVICE_DEFAULTS[type.toLowerCase()];
+    const named = custom[type] ?? custom[type.toUpperCase()];
+    if (!deviceDefault && !named)
+        throw new UndefinedVariationError(type);
+    return [
+        deviceDefault && { ...deviceDefault, matchedKey: `device-default:${type}` },
+        wildcard,
+        named && { ...named, matchedKey: type },
+    ].filter(Boolean);
+}
+/** Applies each config's urlPrefix and queryParams in order, as AssetClient.createRequest does. */
+function buildUrl(url, chain) {
+    let result = url;
+    for (const config of chain) {
+        if (config.urlPrefix) {
+            result =
+                config.urlPrefix +
+                    (config.encodePrefixedUrl ? encodeURIComponent(result) : result);
+        }
+        if (config.queryParams?.length) {
+            result +=
+                (result.includes("?") ? "&" : "?") + config.queryParams.join("&");
+        }
+    }
+    return result;
+}
+/**
+ * Base headers from AssetClient.newRequest, then each config's headers with the last writer
+ * winning. A `null` value removes the header, which is how a config drops Accept-Language.
+ */
+function buildHeaders(chain, hostOverride) {
+    const headers = new Map([
+        [
+            "accept",
+            "text/html, application/xhtml+xml, application/xml;q=0.9, image/avif, image/webp, */*;q=0.8",
+        ],
+        ["accept-encoding", "gzip"],
+        ["accept-language", "*"],
+        ["user-agent", DEFAULT_USER_AGENT],
+    ]);
+    for (const config of chain) {
+        for (const [key, value] of Object.entries(config.headers ?? {})) {
+            if (value === null)
+                headers.delete(key.toLowerCase());
+            else
+                headers.set(key.toLowerCase(), String(value));
+        }
+    }
+    if (hostOverride)
+        headers.set("host", hostOverride);
+    return Object.fromEntries(headers);
+}
+/** Resolves a variation into the concrete request the server would send. */
+export function resolveRequest(custom, url, variationType, hostOverride) {
+    const chain = getVariations(custom, variationType);
+    const isTemplate = chain.some((config) => config.matchedKey !== WILD_CARD &&
+        !DEVICE_DEFAULTS[config.matchedKey ?? ""]) &&
+        !chain.some((config) => config.matchedKey?.startsWith("device-default:"));
+    return {
+        appliedKeys: chain.map((config) => config.matchedKey ?? "?"),
+        resolutionPath: isTemplate ? "template" : "named",
+        url: buildUrl(url, chain),
+        headers: buildHeaders(chain, hostOverride),
+    };
+}
+/** Renders the resolved request as a curl command, for pasting into a bug report. */
+export function toCurl(url, headers) {
+    const parts = ["curl -sSD - -o /dev/null --compressed"];
+    for (const [key, value] of Object.entries(headers)) {
+        parts.push(`  -H ${JSON.stringify(`${key}: ${value}`)}`);
+    }
+    parts.push(`  ${JSON.stringify(url)}`);
+    return parts.join(" \\\n");
+}

package/dist/services/origin-request/asset-variations.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/services/origin-request/asset-variations.spec.js

@@ -0,0 +1,74 @@
+import { expect } from "chai";
+import { describe, it } from "mocha";
+import { getVariations, resolveRequest, UndefinedVariationError, } from "./asset-variations.js";
+/**
+ * These cases mirror the server's own expectations, so a change here means the simulation and the
+ * server have drifted apart. The reference tests live in orestes:
+ * `orestes-common/src/test/kotlin/info/orestes/common/typesystem/WebBotAuthSignatureMismatchTest.kt`.
+ */
+describe("asset variations", () => {
+    const storeTemplate = {
+        "*": { headers: { cookie: "fmarktcookie=e_2879130" } },
+        "desktop-fmarkt-variant": {
+            headers: { cookie: "fmarktcookie=${storeId}" },
+            regex: "(?i)desktop-fmarkt-variant-(?<storeId>.*)",
+        },
+    };
+    it("substitutes a captured group into the headers", () => {
+        const { headers } = resolveRequest(storeTemplate, "https://www.example.com/plp", "desktop-fmarkt-variant-e_1907090");
+        expect(headers.cookie).to.equal("fmarktcookie=e_1907090");
+    });
+    it("lets the template override the wildcard, because the server applies it last", () => {
+        const { appliedKeys, resolutionPath } = resolveRequest(storeTemplate, "https://www.example.com/plp", "desktop-fmarkt-variant-e_1907090");
+        expect(resolutionPath).to.equal("template");
+        expect(appliedKeys).to.deep.equal(["*", "desktop-fmarkt-variant"]);
+    });
+    it("matches a template only against the whole variation, and rejects what matches nothing", () => {
+        // The desktop template cannot match a mobile variation, and the server does not fall back to
+        // the "mobile" device default by substring — that is the pre-renderer's rule, not the server's.
+        expect(() => getVariations(storeTemplate, "mobile-fmarkt-variant-e_1907090")).to.throw(UndefinedVariationError);
+    });
+    it("resolves a mobile variation through its own template", () => {
+        const custom = {
+            ...storeTemplate,
+            "mobile-fmarkt-variant": {
+                headers: { cookie: "fmarktcookie=${storeId}" },
+                regex: "(?i)mobile-fmarkt-variant-(?<storeId>.*)",
+            },
+        };
+        const { headers, appliedKeys } = resolveRequest(custom, "https://www.example.com/", "mobile-fmarkt-variant-e_1");
+        expect(headers.cookie).to.equal("fmarktcookie=e_1");
+        expect(appliedKeys).to.deep.equal(["*", "mobile-fmarkt-variant"]);
+    });
+    it("prefers an exact key over a template", () => {
+        const custom = {
+            ...storeTemplate,
+            "desktop-fmarkt-variant-e_1": { headers: { cookie: "exact" } },
+        };
+        const { headers } = resolveRequest(custom, "https://www.example.com/", "desktop-fmarkt-variant-e_1");
+        expect(headers.cookie).to.equal("exact");
+    });
+    it("keeps the base headers a request always carries", () => {
+        const { headers } = resolveRequest({}, "https://www.example.com/");
+        expect(headers["accept-encoding"]).to.equal("gzip");
+        expect(headers["accept-language"]).to.equal("*");
+        expect(headers["user-agent"]).to.contain("SpeedKit/1.0");
+    });
+    it("drops a header a variation sets to null", () => {
+        const { headers } = resolveRequest({ "*": { headers: { "accept-language": null } } }, "https://www.example.com/");
+        expect(headers).to.not.have.property("accept-language");
+    });
+    it("applies urlPrefix and queryParams like the server", () => {
+        const { url } = resolveRequest({
+            "*": {
+                urlPrefix: "https://proxy.example.com/?target=",
+                encodePrefixedUrl: true,
+                queryParams: ["bq=1"],
+            },
+        }, "https://www.example.com/plp?page=2");
+        expect(url).to.equal("https://proxy.example.com/?target=https%3A%2F%2Fwww.example.com%2Fplp%3Fpage%3D2&bq=1");
+    });
+    it("reports an unknown variation instead of guessing", () => {
+        expect(() => getVariations({}, "b2b-unknown")).to.throw(UndefinedVariationError);
+    });
+});

package/dist/services/origin-request/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./asset-variations.js";
+export * from "./origin-request-context.js";
+export * from "./origin-request-service-factory.js";
+export * from "./origin-request-service.js";

package/dist/services/origin-request/index.js

@@ -0,0 +1,4 @@
+export * from "./asset-variations.js";
+export * from "./origin-request-context.js";
+export * from "./origin-request-service-factory.js";
+export * from "./origin-request-service.js";

package/dist/services/origin-request/origin-request-context.d.ts

@@ -0,0 +1,13 @@
+/** Inputs for `sk origin-request`. No logic. */
+export declare class OriginRequestContext {
+    readonly customerPath: string;
+    readonly configName: string;
+    readonly pageUrl: string;
+    readonly variation?: string;
+    readonly host?: string;
+    readonly bodyFile?: string;
+    readonly grep?: string;
+    readonly json?: boolean;
+    readonly variationsFile?: string;
+    constructor(customerPath: string, configName: string, pageUrl: string, variation?: string, host?: string, bodyFile?: string, grep?: string, json?: boolean, variationsFile?: string);
+}

package/dist/services/origin-request/origin-request-context.js

@@ -0,0 +1,23 @@
+/** Inputs for `sk origin-request`. No logic. */
+export class OriginRequestContext {
+    customerPath;
+    configName;
+    pageUrl;
+    variation;
+    host;
+    bodyFile;
+    grep;
+    json;
+    variationsFile;
+    constructor(customerPath, configName, pageUrl, variation, host, bodyFile, grep, json, variationsFile) {
+        this.customerPath = customerPath;
+        this.configName = configName;
+        this.pageUrl = pageUrl;
+        this.variation = variation;
+        this.host = host;
+        this.bodyFile = bodyFile;
+        this.grep = grep;
+        this.json = json;
+        this.variationsFile = variationsFile;
+    }
+}

package/dist/services/origin-request/origin-request-service-factory.d.ts

@@ -0,0 +1,13 @@
+import { UserCliConfig } from "../../helpers/cli-config.js";
+import { OriginRequestContext } from "./origin-request-context.js";
+import { OriginRequestService } from "./origin-request-service.js";
+export declare class OriginRequestServiceFactory {
+    private readonly context;
+    private readonly userConfig;
+    private service?;
+    constructor(context: OriginRequestContext, userConfig: UserCliConfig);
+    buildService(): Promise<OriginRequestService>;
+    private build;
+    private getIntegrationFiles;
+    private getConfigApi;
+}

package/dist/services/origin-request/origin-request-service-factory.js

@@ -0,0 +1,32 @@
+import { CliServiceFactory } from "../cli/index.js";
+import { ConfigApiContext, ConfigApiServiceFactory, } from "../config-api/index.js";
+import { IntegrationApiContext, IntegrationApiFactory, } from "../integration-api/index.js";
+import { OriginRequestService } from "./origin-request-service.js";
+export class OriginRequestServiceFactory {
+    context;
+    userConfig;
+    service = undefined;
+    constructor(context, userConfig) {
+        this.context = context;
+        this.userConfig = userConfig;
+    }
+    async buildService() {
+        if (!(this.service instanceof OriginRequestService)) {
+            await this.build();
+        }
+        return this.service;
+    }
+    async build() {
+        const files = await this.getIntegrationFiles();
+        const customer = files.getCustomerConfig().config;
+        this.service = new OriginRequestService(this.context, new CliServiceFactory().getService(), this.getConfigApi(customer.app));
+    }
+    async getIntegrationFiles() {
+        const integrationApiContext = new IntegrationApiContext(this.context.customerPath, this.context.configName, []);
+        const integrationApi = new IntegrationApiFactory(integrationApiContext, this.userConfig).buildService();
+        return await integrationApi.run();
+    }
+    getConfigApi(app) {
+        return new ConfigApiServiceFactory(new ConfigApiContext(app)).getService();
+    }
+}

package/dist/services/origin-request/origin-request-service.d.ts

@@ -0,0 +1,33 @@
+import { CliService } from "../cli/index.js";
+import { ConfigApiService } from "../config-api/index.js";
+import { OriginRequestContext } from "./origin-request-context.js";
+/**
+ * Fetches a page from origin with exactly the headers Speed Kit's server would send for a cache
+ * variation, then reports what the origin answered.
+ *
+ * Use it to check whether the origin resolves a variation's identity — a store, a locale, a segment
+ * — without waiting for a render or reading backend logs. The variations come from the app's
+ * deployed runtime config, so the simulation follows production rather than a local file.
+ *
+ * Known deviations from the server, all deliberate:
+ *   - The origin map (origin rewriting plus its extra headers) lives outside the runtime config;
+ *     use `--host` for the Host part.
+ *   - Revalidation headers (If-None-Match, If-Modified-Since) apply only when refreshing a cached
+ *     entry, so they are out of scope.
+ *   - Header order and the HTTP version come from undici, not Jetty.
+ */
+export declare class OriginRequestService {
+    private readonly context;
+    private readonly cli;
+    private readonly configApi;
+    constructor(context: OriginRequestContext, cli: CliService, configApi: ConfigApiService);
+    run(): Promise<void>;
+    /**
+     * Reads `speedKit.variations` from the app's deployed runtime config, or from a local file when
+     * `--variations` is given. Returns undefined when neither source is usable.
+     */
+    private loadVariations;
+    private fetchRuntimeConfig;
+    private readVariationsFile;
+    private report;
+}

package/dist/services/origin-request/origin-request-service.js

@@ -0,0 +1,135 @@
+import { readFile, writeFile } from "node:fs/promises";
+import { safe } from "../../helpers/safe.js";
+import { DEFAULT_TYPE, resolveRequest, toCurl, UndefinedVariationError, } from "./asset-variations.js";
+/**
+ * Fetches a page from origin with exactly the headers Speed Kit's server would send for a cache
+ * variation, then reports what the origin answered.
+ *
+ * Use it to check whether the origin resolves a variation's identity — a store, a locale, a segment
+ * — without waiting for a render or reading backend logs. The variations come from the app's
+ * deployed runtime config, so the simulation follows production rather than a local file.
+ *
+ * Known deviations from the server, all deliberate:
+ *   - The origin map (origin rewriting plus its extra headers) lives outside the runtime config;
+ *     use `--host` for the Host part.
+ *   - Revalidation headers (If-None-Match, If-Modified-Since) apply only when refreshing a cached
+ *     entry, so they are out of scope.
+ *   - Header order and the HTTP version come from undici, not Jetty.
+ */
+export class OriginRequestService {
+    context;
+    cli;
+    configApi;
+    constructor(context, cli, configApi) {
+        this.context = context;
+        this.cli = cli;
+        this.configApi = configApi;
+    }
+    async run() {
+        const variations = await this.loadVariations();
+        // Without variations every request would resolve to the bare defaults, so the report would
+        // describe a request the server never sends. Stop instead of simulating something wrong.
+        if (!variations)
+            return;
+        const variation = this.context.variation ?? DEFAULT_TYPE;
+        let resolved;
+        try {
+            resolved = resolveRequest(variations, this.context.pageUrl, this.context.variation, this.context.host);
+        }
+        catch (error) {
+            if (error instanceof UndefinedVariationError) {
+                this.cli.writeError(error.message);
+                return;
+            }
+            throw error;
+        }
+        const response = await fetch(resolved.url, {
+            headers: resolved.headers,
+            redirect: "manual",
+        });
+        const body = await response.text();
+        const setCookies = response.headers.getSetCookie?.() ?? [];
+        if (this.context.bodyFile)
+            await writeFile(this.context.bodyFile, body);
+        if (this.context.json) {
+            this.cli.write(JSON.stringify({
+                variation,
+                resolutionPath: resolved.resolutionPath,
+                appliedConfigs: resolved.appliedKeys,
+                requestUrl: resolved.url,
+                requestHeaders: resolved.headers,
+                status: response.status,
+                responseHeaders: Object.fromEntries(response.headers),
+                setCookie: setCookies,
+                bodyLength: body.length,
+            }, null, 2));
+            return;
+        }
+        this.report(variation, resolved, response, setCookies, body);
+    }
+    /**
+     * Reads `speedKit.variations` from the app's deployed runtime config, or from a local file when
+     * `--variations` is given. Returns undefined when neither source is usable.
+     */
+    async loadVariations() {
+        const raw = this.context.variationsFile
+            ? await this.readVariationsFile(this.context.variationsFile)
+            : await this.fetchRuntimeConfig();
+        if (!raw)
+            return undefined;
+        const parsed = JSON.parse(raw);
+        const variations = parsed.speedKit?.variations ?? parsed.variations;
+        if (!variations) {
+            this.cli.writeError("the config carries no speedKit.variations — nothing to simulate");
+            return undefined;
+        }
+        this.cli.writeSuccess(`variations: ${Object.keys(variations).join(", ")}`);
+        return variations;
+    }
+    async fetchRuntimeConfig() {
+        this.cli.startAction("ORIGIN_REQUEST:FETCH:RUNTIME_CONFIG", "load variations from the app");
+        const serverConfig = await safe(this.configApi.getServerConfig());
+        if (serverConfig.success === false) {
+            this.cli.failAction("ORIGIN_REQUEST:FETCH:RUNTIME_CONFIG");
+            this.cli.writeError(`unable to load the runtime config: ${serverConfig.error}. Run "sk login", or pass --variations <file> to simulate against a config you already have.`);
+            return undefined;
+        }
+        this.cli.successAction("ORIGIN_REQUEST:FETCH:RUNTIME_CONFIG");
+        return serverConfig.data;
+    }
+    async readVariationsFile(file) {
+        const content = await safe(readFile(file, "utf8"));
+        if (content.success === false) {
+            this.cli.writeError(`unable to read ${file}: ${content.error}`);
+            return undefined;
+        }
+        this.cli.writeSuccess(`variations from ${file}`);
+        return content.data;
+    }
+    report(variation, resolved, response, setCookies, body) {
+        this.cli.write(`variation    ${variation}`);
+        this.cli.write(`resolution   ${resolved.resolutionPath} → applied: ${resolved.appliedKeys.join(" then ")}`);
+        this.cli.write(`request url  ${resolved.url}`);
+        this.cli.write("request headers");
+        for (const [key, value] of Object.entries(resolved.headers))
+            this.cli.write(`  ${key}: ${value}`);
+        this.cli.write(`\nstatus       ${response.status} ${response.statusText}`);
+        const location = response.headers.get("location");
+        if (location)
+            this.cli.write(`location     ${location}`);
+        if (setCookies.length) {
+            this.cli.write("set-cookie");
+            for (const cookie of setCookies)
+                this.cli.write(`  ${cookie}`);
+        }
+        this.cli.write(`body         ${body.length} bytes${this.context.bodyFile ? ` → ${this.context.bodyFile}` : ""}`);
+        this.cli.write(`\nequivalent curl:\n${toCurl(resolved.url, resolved.headers)}`);
+        if (this.context.grep) {
+            const pattern = new RegExp(this.context.grep, "i");
+            const hits = body.split("\n").filter((line) => pattern.test(line));
+            this.cli.write(`\ngrep "${this.context.grep}" → ${hits.length} line(s)`);
+            for (const line of hits.slice(0, 10))
+                this.cli.write(`  ${line.trim().slice(0, 300)}`);
+        }
+    }
+}

package/oclif.manifest.json

@@ -651,6 +651,95 @@
         "onboarding.js"
       ]
     },
+    "origin-request": {
+      "aliases": [],
+      "args": {
+        "customerPath": {
+          "description": "The customer config path",
+          "name": "customerPath",
+          "required": true
+        },
+        "pageUrl": {
+          "description": "Page to request from origin",
+          "name": "pageUrl",
+          "required": true
+        }
+      },
+      "description": "Request a page from origin with the exact headers Speed Kit's server sends for a cache variation, using the app's deployed runtime config",
+      "examples": [
+        "$ sk origin-request <customerPath> <pageUrl>",
+        "$ sk origin-request customers/decathlon.de https://www.decathlon.de/ -v mobile",
+        "$ sk origin-request customers/decathlon.de https://www.decathlon.de/ --grep \"storeId\" --body /tmp/origin.html"
+      ],
+      "flags": {
+        "configName": {
+          "char": "c",
+          "description": "The costumer config name",
+          "name": "configName",
+          "required": false,
+          "default": "production",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "variation": {
+          "char": "v",
+          "description": "Cache variation to simulate, e.g. desktop-fmarkt-variant-e_1907090. Omitted means the default variation",
+          "name": "variation",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "host": {
+          "description": "Send this Host header, emulating an origin-map host override",
+          "name": "host",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "body": {
+          "description": "Write the response body to this file",
+          "name": "body",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "grep": {
+          "description": "Print body lines matching this regex, case-insensitive",
+          "name": "grep",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "json": {
+          "description": "Machine-readable output",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "variations": {
+          "description": "Simulate against a runtime config in a local file instead of the app's deployed one",
+          "name": "variations",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "origin-request",
+      "pluginAlias": "@speedkit/cli",
+      "pluginName": "@speedkit/cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "origin-request.js"
+      ]
+    },
     "prewarm": {
       "aliases": [],
       "args": {
@@ -1131,5 +1220,5 @@
       ]
     }
   },
-  "version": "4.22.0"
+  "version": "4.23.0"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@speedkit/cli",
   "description": "Speed Kit CLI",
-  "version": "4.22.0",
+  "version": "4.23.0",
   "author": {
     "name": "Baqend.com",
     "email": "info@baqend.com"