@whooshbang/contract-mock 1.0.0-rc.16

package/CHANGELOG.md

@@ -0,0 +1,141 @@
+# Changelog
+
+All notable changes to the deterministic WhooshBang contract mock are
+recorded here.
+
+## 1.0.0-rc.16
+
+- Publish the unchanged deterministic mock as the first public npm candidate,
+  with explicit public package metadata and a package-local MIT license.
+- Reissue against contracts `1.0.0-rc.13` and SDK `1.0.0-rc.14`; runtime
+  behavior and scenario semantics are unchanged, and `1.0.0-rc.15` remains
+  immutable.
+
+## 1.0.0-rc.15
+
+- Exclude already-acknowledged events from machine polls, including
+  acknowledgements recorded beyond an earlier cursor gap.
+- Report a repeated successful acknowledgement as `existing` with the current
+  committed cursor instead of replaying the first response body.
+- Reissue against contracts `1.0.0-rc.12`, SDK `1.0.0-rc.13`, and MCP
+  `1.0.0-rc.4`; the published schemas and fixture semantics are unchanged and
+  `1.0.0-rc.14` remains immutable.
+
+## 1.0.0-rc.14
+
+- Reissue the mock against `@whooshbang/contracts@1.0.0-rc.11` and
+  `@whooshbang/sdk@1.0.0-rc.12` for the combined replay-refusal and
+  machine-answer-retention contract.
+- Publish `answer_retained: true` on every retained `interaction.received`
+  event the mock creates or seeds; consumers may also validate the contract's
+  redacted false-without-response shape.
+- Include the new closed `replay_unavailable` Problem code through the public
+  contract vocabulary. `1.0.0-rc.13` remains immutable.
+
+## 1.0.0-rc.12
+
+- Exercise the WhooshBang MCP tools against the mock over both the stdio and
+  the OAuth-secured remote transport, so the coding-agent surface is proven
+  against the published contract rather than against a stub.
+- Runtime behaviour, scenarios, fixtures, and the published contract are
+  unchanged; only the package's development dependencies and its test suite
+  moved.
+- Keep `@whooshbang/contracts@1.0.0-rc.9` immutable.
+
+## 1.0.0-rc.11
+
+- Add the deterministic customer-endpoint lifecycle: create with a one-time
+  secret reveal, verify, bounded-overlap rotation with a rotation conflict,
+  pause, resume, disable, attempt inspection, and cross-environment refusal.
+- Authenticate a locally generated C0-03 machine bearer against its registered
+  digest, so digest-only bootstrap, rotation, and revocation are provable end
+  to end without the service ever seeing the secret.
+- Default the loopback CLI to the system clock so a caller can send an
+  interaction whose expiry is computed from real time; `--clock fixed` restores
+  the frozen clock, and the programmatic factory stays frozen.
+- Keep `@whooshbang/contracts@1.0.0-rc.9` immutable.
+
+## 1.0.0-rc.10
+
+- Add deterministic per-message and per-interaction response inspection,
+  including bounded wait, wake, timeout, and machine-ownership behavior for
+  `@whooshbang/contracts@1.0.0-rc.9`.
+- Keep polling side-effect free and `1.0.0-rc.9` immutable.
+
+## 1.0.0-rc.9
+
+- Reissue the deterministic mock and SDK compatibility boundary against
+  `@whooshbang/contracts@1.0.0-rc.8` without adding endpoint behavior.
+- Keep `1.0.0-rc.8` immutable.
+
+## 1.0.0-rc.8
+
+- Reissue the deterministic mock against `@whooshbang/contracts@1.0.0-rc.7`
+  with explicit retained/redacted answered-interaction summaries.
+- Keep `1.0.0-rc.7` immutable.
+
+## 1.0.0-rc.7
+
+- Reissue the deterministic mock with Hono 4.12.34 to address
+  `GHSA-8j4g-w8fx-2239`; contract behavior and fixtures are unchanged.
+- Keep `1.0.0-rc.6` immutable.
+
+## 1.0.0-rc.6
+
+- Reissue the deterministic mock and SDK against
+  `@whooshbang/contracts@1.0.0-rc.6` after moving the generated production API
+  server origin to `https://api.whooshbang.com`.
+- Keep `1.0.0-rc.5` immutable; runtime behavior and pinned V1 Problem Details
+  and schema identifiers are unchanged.
+
+## 1.0.0-rc.5
+
+- Reissue the deterministic mock against
+  `@whooshbang/contracts@1.0.0-rc.5`, including the restored paused binding
+  state and paused/revoked subscription fixtures.
+- Keep `1.0.0-rc.4` immutable; no compatibility alias or migration is needed
+  for the unpublished, undeployed candidate.
+
+## 1.0.0-rc.4
+
+- Rename the unused pre-launch package, CLI, public exports, control header,
+  Problem Details origin, fixtures, and examples to the canonical WhooshBang
+  identity with no compatibility aliases.
+
+## 1.0.0-rc.3
+
+- Add executable API credential create/list/rotate/revoke behavior for the
+  approved N1-03 contract amendment, including one-time reveal, safe
+  inspection, last-used updates, bounded overlap, and terminal revocation.
+- Reissue the mock and its deterministic scenarios under a new immutable
+  candidate identity; `1.0.0-rc.2` remains unchanged.
+
+## 1.0.0-rc.2
+
+- Add deterministic human-session fixtures and executable account/project
+  administration routes for the N1-02 contract.
+- Cover atomic test/live/default-notifier bootstrap, account-scoped
+  idempotency, pagination, slug conflict, and non-enumerating cross-account
+  reads under a new immutable candidate identity.
+
+## 1.0.0-rc.1
+
+- Promote the exact reviewed Wave 0/C0 mock from `1.0.0-draft.1` without a
+  behavioral change.
+- Retain the packaged C0SEC-002 cross-machine answer-origin regression and
+  bounded npm/pnpm consumer proofs at the release-candidate version.
+- Keep the mock repository-local, deterministic, and free of live provider,
+  account, deployment, or production control dependencies.
+
+## 1.0.0-draft.1
+
+- Correct machine interaction-answer routing to enqueue an event only for the
+  exact machine client recorded when the message was created.
+- Fail safely without rerouting when that originating client is absent,
+  revoked, or no longer matches the message binding.
+- Add permanent cross-machine and unavailable-origin regression coverage for
+  C0SEC-002. The canonical WhooshBang contract and JavaScript SDK are
+  unchanged.
+- Add the packaged `cross-machine-answer-origin` malicious scenario and execute
+  its same-binding, absent-origin, revoked-origin, and mismatched-origin cases
+  in both npm and pnpm tarball consumers.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 FlowXO LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,173 @@
+# `@whooshbang/contract-mock`
+
+Deterministic, in-memory WhooshBang V1 mock for local contract tests.
+It implements the WhooshBang-owned release candidate without a cloud
+account, network service, database, or production provider.
+
+Run the current release candidate directly from the public npm registry:
+
+```sh
+npx @whooshbang/contract-mock@next --port 8787
+```
+
+## Programmatic and Worker-compatible use
+
+Each factory call owns isolated state:
+
+```ts
+import {
+  CONTRACT_MOCK_FIXTURE_CREDENTIALS,
+  createWhooshBangContractMock,
+} from "@whooshbang/contract-mock";
+
+const mock = createWhooshBangContractMock({ scenario: "nominal" });
+const response = await mock.fetch(
+  new Request("https://api.mock.whooshbang.test/v1/capabilities", {
+    headers: {
+      authorization:
+        `Bearer ${CONTRACT_MOCK_FIXTURE_CREDENTIALS.projectTest}`,
+    },
+  }),
+);
+```
+
+The mock also executes the account-scoped administration contract. Use
+`humanSession` (or `otherHumanSession` for isolation tests) with
+`GET /v1/account`, `GET/POST /v1/projects`, and
+`GET /v1/projects/{project_id}`. Project creation atomically returns synthetic
+`test` and `live` environments and one `Default` notifier for each.
+
+The same human session can execute the environment credential lifecycle:
+`GET/POST /v1/projects/{project_id}/environments/{environment_id}/credentials`
+and the nested `rotate` and `revoke` actions. The mock emits a deterministic
+synthetic `wb_pc1` bearer only from create/rotate, stores it outside the
+inspection snapshot, models bounded overlap, updates safe last-used metadata
+on authentication, and returns `credential_invalid` after revocation. These
+values are local fixtures, not production credential material.
+
+Project credentials also execute the customer-endpoint lifecycle under
+`/v1/projects/{project_id}/environments/{environment_id}/customer-endpoints`:
+create with a one-time secret reveal, verify, bounded-overlap rotation, pause,
+resume, disable, and attempt inspection. Environment-scoped paths need an
+environment identifier the bearer does not carry, so
+`CONTRACT_MOCK_FIXTURE_ENVIRONMENTS` publishes the synthetic project and
+environment identifiers the fixture credentials authenticate against. A path
+naming another project or environment is refused as `resource_not_found`.
+
+A machine bearer the caller generated locally authenticates once its digest is
+registered through `POST /v1/machine-clients/{id}/credentials`. The mock hashes
+the presented bearer and compares, exactly as the service does, so digest-only
+bootstrap, rotation, and revocation are provable without the mock ever holding
+a readable machine secret.
+
+The fetch-only entry point is structurally compatible with a Worker module and
+does not expose the test control API:
+
+```ts
+import {
+  createWhooshBangContractMockWorker,
+} from "@whooshbang/contract-mock/worker";
+
+export default createWhooshBangContractMockWorker({
+  scenario: "nominal",
+});
+```
+
+This package deliberately includes no Wrangler configuration or deployment
+workflow. The Worker-compatible entry is for runtime-neutral contract tests,
+not a hosted or production WhooshBang service.
+
+## Loopback CLI
+
+After building or installing the package:
+
+```sh
+whooshbang-contract-mock --port 8787 --scenario nominal
+```
+
+Defaults are `--host 127.0.0.1`, `--port 0` (an ephemeral port),
+`--scenario nominal`, `--clock system`, and no HTTP control surface. Supported
+flags are `--host`, `--port`, `--scenario`, `--clock`, and `--control-token`.
+Supplying a control token restricts the listener to `127.0.0.1`, `::1`, or
+`localhost`; the token must contain 8-4096 visible ASCII characters.
+
+The listener is a running service, so its clock advances with the host by
+default: a frozen clock would reject every interaction whose expiry a caller
+computes from the real time. Pass `--clock fixed` for byte-identical
+timestamps. The programmatic factory stays frozen either way.
+
+## Fixtures and scenarios
+
+All credentials are synthetic local fixtures:
+
+| Exported key | Bearer token | Identity |
+| --- | --- | --- |
+| `humanSession` | `human-session-token` | default account administrator |
+| `otherHumanSession` | `human-other-session-token` | isolated account administrator |
+| `projectTest` | `project-test-token` | default test project |
+| `liveProject` | `project-live-token` | default live project |
+| `projectA` | `project-a-token` | isolated test project A |
+| `projectB` | `project-b-token` | isolated test project B |
+| `readOnly` | `project-read-only-token` | read-only default project |
+| `machineA` | `machine-a-token` | machine stream A |
+| `machineB` | `machine-b-token` | machine stream B |
+
+`CONTRACT_MOCK_SCENARIOS` is the typed scenario catalog. The same 25 names are
+available in the exported JSON subpath
+`@whooshbang/contract-mock/scenarios/v1/manifest.json`:
+
+```text
+nominal
+repeated-idempotent-message
+idempotency-conflict
+unbound-subscriber
+retryable-provider-failure
+terminal-provider-rejection
+ambiguous-provider-outcome
+cancellation-before-send
+cancellation-too-late
+interaction-confirm
+interaction-select
+interaction-input
+interaction-duplicate
+interaction-stale
+interaction-expired
+interaction-unauthorized
+machine-event-replay
+machine-cursor-contiguous
+machine-poison-quarantine
+cross-machine-rejection
+cross-machine-answer-origin
+signed-webhook-success
+signed-webhook-retry
+signed-webhook-terminal
+rate-limited
+```
+
+`cross-machine-answer-origin` is the executable C0SEC-002 fixture. Supply
+synthetic same-binding machine credentials through the mock options, create an
+interactive message as machine B, and submit its answer through
+`mock.control.submitInteraction`. Only B may receive the resulting machine
+event. If B's recorded client is absent, revoked, or no longer matches the
+message binding, the interaction still resolves for the customer event while
+the machine event fails closed instead of rerouting to machine A or another
+same-binding peer.
+
+## Explicit test control
+
+The programmatic factory exposes `mock.control` directly. HTTP control routes
+exist only in the loopback CLI when `--control-token` is supplied. Every request
+must send that exact token in `WhooshBang-Contract-Mock-Token`.
+
+| Route | Purpose |
+| --- | --- |
+| `GET /__contract-mock/snapshot` | inspect redacted deterministic state |
+| `POST /__contract-mock/reset` | reset to a named scenario |
+| `POST /__contract-mock/provider-outcomes` | replace provider outcomes |
+| `POST /__contract-mock/webhook-responses` | replace receiver responses |
+| `POST /__contract-mock/interactions` | submit a synthetic interaction |
+| `POST /__contract-mock/run-pending` | run pending provider work |
+
+Control routes are absent from OpenAPI and from the Worker-compatible entry.
+Never expose the CLI control listener or fixture credentials as a production
+service.

package/dist/app.d.ts

@@ -0,0 +1,8 @@
+import type { WhooshBangContractMock, WhooshBangContractMockOptions } from "./types.js";
+/**
+ * Creates one isolated, in-memory WhooshBang contract mock.
+ *
+ * The returned programmatic control is test-only and has no HTTP route. The
+ * separate Node CLI is the only module that can mount the token guard.
+ */
+export declare function createWhooshBangContractMock(options?: WhooshBangContractMockOptions): WhooshBangContractMock;

package/dist/app.js

@@ -0,0 +1,16 @@
+import { createWhooshBangContractMockCore } from "./core.js";
+/**
+ * Creates one isolated, in-memory WhooshBang contract mock.
+ *
+ * The returned programmatic control is test-only and has no HTTP route. The
+ * separate Node CLI is the only module that can mount the token guard.
+ */
+export function createWhooshBangContractMock(options = {}) {
+    const mock = createWhooshBangContractMockCore(options);
+    return {
+        control: mock.control,
+        fetch: (request) => mock.fetch(request),
+        inspect: () => mock.inspect(),
+    };
+}
+//# sourceMappingURL=app.js.map

package/dist/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,WAAW,CAAC;AAO7D;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAC1C,UAAyC,EAAE;IAE3C,MAAM,IAAI,GAAG,gCAAgC,CAAC,OAAO,CAAC,CAAC;IACvD,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QACvC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE;KAC9B,CAAC;AACJ,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+import type { Server } from "node:http";
+import type { ContractMockScenarioName } from "./types.js";
+export interface ContractMockCliOptions {
+    /**
+     * `system` advances timestamps with the host clock; `fixed` freezes them.
+     *
+     * The loopback listener is a running service, so it defaults to `system`:
+     * a frozen clock rejects every interaction whose expiry a caller computes
+     * from the real time. The programmatic factory stays frozen for contract
+     * tests that need byte-identical output.
+     */
+    readonly clock?: "fixed" | "system";
+    readonly controlToken?: string;
+    readonly host: string;
+    readonly port: number;
+    readonly scenario: ContractMockScenarioName;
+}
+export interface RunningContractMock {
+    readonly host: string;
+    readonly port: number;
+    readonly server: Server;
+    close(): Promise<void>;
+}
+export declare function parseContractMockCliArgs(args: readonly string[]): ContractMockCliOptions;
+export declare function startContractMockCli(options: ContractMockCliOptions): Promise<RunningContractMock>;

package/dist/cli.js

@@ -0,0 +1,249 @@
+#!/usr/bin/env node
+import { realpathSync } from "node:fs";
+import { createServer } from "node:http";
+import { pathToFileURL } from "node:url";
+import { validateProblem } from "@whooshbang/contracts";
+import { mountContractMockControlSurface } from "./control-surface.js";
+import { createWhooshBangContractMockCore } from "./core.js";
+import { isContractMockScenarioName } from "./scenarios.js";
+const MAX_ADAPTER_REQUEST_BYTES = 1024 * 1024;
+const MAX_ADAPTER_DIAGNOSTIC_SEQUENCE = 999_999_999;
+function isLoopbackHost(value) {
+    return (value === "127.0.0.1" ||
+        value === "::1" ||
+        value.toLowerCase() === "localhost");
+}
+function optionValue(args, index) {
+    const value = args[index + 1];
+    if (value === undefined || value.startsWith("--")) {
+        throw new RangeError(`Missing value for ${args[index] ?? "option"}.`);
+    }
+    return value;
+}
+export function parseContractMockCliArgs(args) {
+    let clock = "system";
+    let controlToken;
+    let host = "127.0.0.1";
+    let port = 0;
+    let scenario = "nominal";
+    for (let index = 0; index < args.length; index += 1) {
+        const argument = args[index];
+        if (argument === "--port") {
+            const value = optionValue(args, index);
+            if (!/^\d+$/u.test(value)) {
+                throw new RangeError("--port must be an integer from 0 through 65535.");
+            }
+            port = Number(value);
+            if (port < 0 || port > 65_535) {
+                throw new RangeError("--port must be an integer from 0 through 65535.");
+            }
+            index += 1;
+        }
+        else if (argument === "--scenario") {
+            const value = optionValue(args, index);
+            if (!isContractMockScenarioName(value)) {
+                throw new RangeError("Unknown contract-mock scenario.");
+            }
+            scenario = value;
+            index += 1;
+        }
+        else if (argument === "--control-token") {
+            controlToken = optionValue(args, index);
+            index += 1;
+        }
+        else if (argument === "--host") {
+            host = optionValue(args, index);
+            index += 1;
+        }
+        else if (argument === "--clock") {
+            const value = optionValue(args, index);
+            if (value !== "fixed" && value !== "system") {
+                throw new RangeError("--clock must be system or fixed.");
+            }
+            clock = value;
+            index += 1;
+        }
+        else {
+            throw new RangeError("Unknown contract-mock CLI option.");
+        }
+    }
+    if (controlToken !== undefined && !isLoopbackHost(host)) {
+        throw new RangeError("Control mode may only bind to an explicit loopback address.");
+    }
+    return {
+        clock,
+        ...(controlToken === undefined ? {} : { controlToken }),
+        host,
+        port,
+        scenario,
+    };
+}
+async function readNodeRequest(request) {
+    if (request.method === "GET" || request.method === "HEAD") {
+        return undefined;
+    }
+    const chunks = [];
+    let length = 0;
+    for await (const incomingChunk of request) {
+        const chunk = incomingChunk;
+        const bytes = typeof chunk === "string"
+            ? new TextEncoder().encode(chunk)
+            : chunk instanceof Uint8Array
+                ? Uint8Array.from(chunk)
+                : undefined;
+        if (bytes === undefined) {
+            throw new TypeError("The local adapter received an invalid body chunk.");
+        }
+        length += bytes.byteLength;
+        if (length > MAX_ADAPTER_REQUEST_BYTES) {
+            throw new RangeError("Request exceeded the local adapter limit.");
+        }
+        chunks.push(bytes);
+    }
+    const body = new Uint8Array(length);
+    let offset = 0;
+    for (const chunk of chunks) {
+        body.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return body;
+}
+function requestHeaders(request) {
+    const headers = new Headers();
+    for (let index = 0; index < request.rawHeaders.length; index += 2) {
+        const name = request.rawHeaders[index];
+        const value = request.rawHeaders[index + 1];
+        if (name !== undefined && value !== undefined) {
+            headers.append(name, value);
+        }
+    }
+    return headers;
+}
+function createAdapterDiagnosticIdGenerator() {
+    let sequence = 0;
+    return () => {
+        if (sequence >= MAX_ADAPTER_DIAGNOSTIC_SEQUENCE) {
+            throw new Error("The local adapter diagnostic sequence is exhausted.");
+        }
+        sequence += 1;
+        return `diag_adapter_${String(sequence).padStart(9, "0")}`;
+    };
+}
+function adapterProblem(diagnosticId) {
+    const value = {
+        code: "request_invalid",
+        detail: "The local mock request could not be processed.",
+        diagnostic_id: diagnosticId,
+        retryable: false,
+        status: 400,
+        title: "Request invalid",
+        type: "https://whooshbang.flowxo.com/problems/request_invalid",
+    };
+    if (!validateProblem(value)) {
+        throw new Error("The local adapter Problem is not contract-valid.");
+    }
+    return value;
+}
+function writeAdapterProblem(outgoing, diagnosticId) {
+    const problem = adapterProblem(diagnosticId);
+    outgoing.statusCode = problem.status;
+    outgoing.setHeader("content-type", "application/problem+json");
+    outgoing.setHeader("whooshbang-diagnostic-id", problem.diagnostic_id);
+    outgoing.end(JSON.stringify(problem));
+}
+export async function startContractMockCli(options) {
+    if (options.controlToken !== undefined && !isLoopbackHost(options.host)) {
+        throw new RangeError("Control mode may only bind to an explicit loopback address.");
+    }
+    const mock = createWhooshBangContractMockCore({
+        ...(options.clock === "fixed"
+            ? {}
+            : { clock: { now: () => new Date() } }),
+        scenario: options.scenario,
+    });
+    if (options.controlToken !== undefined) {
+        mountContractMockControlSurface(mock, options.controlToken);
+    }
+    const nextAdapterDiagnosticId = createAdapterDiagnosticIdGenerator();
+    const server = createServer((incoming, outgoing) => {
+        void (async () => {
+            try {
+                const body = await readNodeRequest(incoming);
+                const requestBody = body === undefined ? undefined : Uint8Array.from(body).buffer;
+                const request = new Request(new URL(incoming.url ?? "/", `http://${incoming.headers.host ?? `${options.host}:${options.port}`}`), {
+                    ...(requestBody === undefined ? {} : { body: requestBody }),
+                    headers: requestHeaders(incoming),
+                    method: incoming.method ?? "GET",
+                });
+                const response = await mock.fetch(request);
+                outgoing.statusCode = response.status;
+                response.headers.forEach((value, name) => {
+                    outgoing.setHeader(name, value);
+                });
+                outgoing.end(new Uint8Array(await response.arrayBuffer()));
+            }
+            catch {
+                writeAdapterProblem(outgoing, nextAdapterDiagnosticId());
+            }
+        })();
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(options.port, options.host, () => {
+            server.off("error", reject);
+            resolve();
+        });
+    });
+    const address = server.address();
+    return {
+        close: () => new Promise((resolve, reject) => {
+            server.close((error) => {
+                if (error === undefined) {
+                    resolve();
+                }
+                else {
+                    reject(error);
+                }
+            });
+        }),
+        host: options.host,
+        port: address.port,
+        server,
+    };
+}
+async function main() {
+    const options = parseContractMockCliArgs(process.argv.slice(2));
+    const running = await startContractMockCli(options);
+    process.stdout.write(`${JSON.stringify({
+        clock: options.clock ?? "system",
+        control_enabled: options.controlToken !== undefined,
+        event: "contract_mock_started",
+        host: running.host,
+        port: running.port,
+        scenario: options.scenario,
+    })}\n`);
+    const close = () => {
+        void running.close().finally(() => process.exit(0));
+    };
+    process.once("SIGINT", close);
+    process.once("SIGTERM", close);
+}
+function isMainModule() {
+    const entryPath = process.argv[1];
+    if (entryPath === undefined) {
+        return false;
+    }
+    try {
+        return import.meta.url === pathToFileURL(realpathSync(entryPath)).href;
+    }
+    catch {
+        return false;
+    }
+}
+if (isMainModule()) {
+    void main().catch(() => {
+        process.stderr.write("The contract mock could not start safely.\n");
+        process.exitCode = 1;
+    });
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,EAAE,+BAA+B,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,gCAAgC,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAO5D,MAAM,yBAAyB,GAAG,IAAI,GAAG,IAAI,CAAC;AAC9C,MAAM,+BAA+B,GAAG,WAAW,CAAC;AAyBpD,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,CACL,KAAK,KAAK,WAAW;QACrB,KAAK,KAAK,KAAK;QACf,KAAK,CAAC,WAAW,EAAE,KAAK,WAAW,CACpC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,IAAuB,EAAE,KAAa;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,UAAU,CAAC,qBAAqB,IAAI,CAAC,KAAK,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,IAAuB;IAEvB,IAAI,KAAK,GAAuB,QAAQ,CAAC;IACzC,IAAI,YAAgC,CAAC;IACrC,IAAI,IAAI,GAAG,WAAW,CAAC;IACvB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,QAAQ,GAA6B,SAAS,CAAC;IACnD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACvC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,UAAU,CAAC,iDAAiD,CAAC,CAAC;YAC1E,CAAC;YACD,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YACrB,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,MAAM,EAAE,CAAC;gBAC9B,MAAM,IAAI,UAAU,CAAC,iDAAiD,CAAC,CAAC;YAC1E,CAAC;YACD,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACvC,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,UAAU,CAAC,iCAAiC,CAAC,CAAC;YAC1D,CAAC;YACD,QAAQ,GAAG,KAAK,CAAC;YACjB,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;YAC1C,YAAY,GAAG,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACxC,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAChC,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACvC,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC5C,MAAM,IAAI,UAAU,CAAC,kCAAkC,CAAC,CAAC;YAC3D,CAAC;YACD,KAAK,GAAG,KAAK,CAAC;YACd,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,UAAU,CAAC,mCAAmC,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IACD,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,UAAU,CAClB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK;QACL,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;QACvD,IAAI;QACJ,IAAI;QACJ,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,OAA4C;IAE5C,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,KAAK,EAAE,MAAM,aAAa,IAAI,OAAO,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAY,aAAa,CAAC;QACrC,MAAM,KAAK,GACT,OAAO,KAAK,KAAK,QAAQ;YACvB,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;YACjC,CAAC,CAAC,KAAK,YAAY,UAAU;gBAC3B,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;gBACxB,CAAC,CAAC,SAAS,CAAC;QAClB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,SAAS,CAAC,mDAAmD,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;QAC3B,IAAI,MAAM,GAAG,yBAAyB,EAAE,CAAC;YACvC,MAAM,IAAI,UAAU,CAAC,2CAA2C,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;IAC7B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,OAA4C;IAClE,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC5C,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9C,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,kCAAkC;IACzC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,OAAO,GAAG,EAAE;QACV,IAAI,QAAQ,IAAI,+BAA+B,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,QAAQ,IAAI,CAAC,CAAC;QACd,OAAO,gBAAgB,MAAM,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IAC7D,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,YAAoB;IAC1C,MAAM,KAAK,GAAY;QACrB,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,gDAAgD;QACxD,aAAa,EAAE,YAAY;QAC3B,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,GAAG;QACX,KAAK,EAAE,iBAAiB;QACxB,IAAI,EAAE,wDAAwD;KAC/D,CAAC;IACF,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAA4C,EAC5C,YAAoB;IAEpB,MAAM,OAAO,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;IAC7C,QAAQ,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;IACrC,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;IAC/D,QAAQ,CAAC,SAAS,CAAC,0BAA0B,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IACtE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAA+B;IAE/B,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,UAAU,CAClB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,gCAAgC,CAAC;QAC5C,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,OAAO;YAC3B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,GAAS,EAAE,CAAC,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC;QAC/C,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACvC,+BAA+B,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,uBAAuB,GAAG,kCAAkC,EAAE,CAAC;IACrE,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE;QACjD,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;gBAC7C,MAAM,WAAW,GACf,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;gBAChE,MAAM,OAAO,GAAG,IAAI,OAAO,CACzB,IAAI,GAAG,CACL,QAAQ,CAAC,GAAG,IAAI,GAAG,EACnB,UAAU,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CACvE,EACD;oBACE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;oBAC3D,OAAO,EAAE,cAAc,CAAC,QAAQ,CAAC;oBACjC,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,KAAK;iBACjC,CACF,CAAC;gBACF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC3C,QAAQ,CAAC,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC;gBACtC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;oBACvC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAClC,CAAC,CAAC,CAAC;gBACH,QAAQ,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAC7D,CAAC;YAAC,MAAM,CAAC;gBACP,mBAAmB,CAAC,QAAQ,EAAE,uBAAuB,EAAE,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE;YAC7C,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;IAChD,OAAO;QACL,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACpC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACrB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,OAAO,EAAE,CAAC;gBACZ,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChB,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QACJ,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM;KACP,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACpD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,IAAI,CAAC,SAAS,CAAC;QAChB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,QAAQ;QAChC,eAAe,EAAE,OAAO,CAAC,YAAY,KAAK,SAAS;QACnD,KAAK,EAAE,uBAAuB;QAC9B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,IAAI,CACP,CAAC;IACF,MAAM,KAAK,GAAG,GAAS,EAAE;QACvB,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC9B,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,IAAI,YAAY,EAAE,EAAE,CAAC;IACnB,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;QACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACpE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/control-surface.d.ts

@@ -0,0 +1,13 @@
+import type { Hono } from "hono";
+import type { ContractMockControl, ContractMockSnapshot } from "./types.js";
+interface ControlSurfaceTarget {
+    readonly app: Hono;
+    readonly control: ContractMockControl;
+    inspect(): ContractMockSnapshot;
+}
+/**
+ * Mounts the CLI-only, test-only HTTP control surface. This module is not
+ * imported by either public package entry point or the Worker entry point.
+ */
+export declare function mountContractMockControlSurface(target: ControlSurfaceTarget, token: string): void;
+export {};