@yiaany/ghostapi 0.1.0

package/dist/proxy/requestNormalizer.d.ts

@@ -0,0 +1,11 @@
+import type { Request } from "express";
+export type NormalizedRequest = {
+    method: string;
+    path: string;
+    query: Record<string, unknown>;
+    headers: Record<string, string | string[]>;
+    body: unknown;
+    rawBody?: string;
+    receivedAt: string;
+};
+export declare function normalizeRequest(request: Request): NormalizedRequest;

package/dist/proxy/requestNormalizer.js

@@ -0,0 +1,30 @@
+import { sanitizeHeaders } from "../security/headerSanitizer.js";
+import { sanitizeSecrets } from "../security/secrets.js";
+export function normalizeRequest(request) {
+    const normalized = {
+        method: request.method,
+        path: request.path,
+        query: sanitizeRecord(request.query),
+        headers: sanitizeHeaders(request.headers),
+        body: sanitizeSecrets(getSafeBody(request)),
+        receivedAt: new Date().toISOString()
+    };
+    if (request.rawBody !== undefined) {
+        normalized.rawBody = request.rawBody;
+    }
+    return normalized;
+}
+function getSafeBody(request) {
+    if (Buffer.isBuffer(request.body)) {
+        return `[Binary Data: ${request.body.length} bytes]`;
+    }
+    return request.body;
+}
+function sanitizeRecord(value) {
+    const sanitized = sanitizeSecrets(value);
+    if (sanitized === null || typeof sanitized !== "object" || Array.isArray(sanitized)) {
+        return {};
+    }
+    return sanitized;
+}
+//# sourceMappingURL=requestNormalizer.js.map

package/dist/proxy/requestNormalizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestNormalizer.js","sourceRoot":"","sources":["../../src/proxy/requestNormalizer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAYzD,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,MAAM,UAAU,GAAsB;QACpC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC;QACpC,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC;QACzC,IAAI,EAAE,eAAe,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC3C,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrC,CAAC;IAEF,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClC,UAAU,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACvC,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,WAAW,CAAC,OAAgB;IACnC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,OAAO,iBAAiB,OAAO,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC;IACvD,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC;AACtB,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAEzC,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACpF,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,SAAoC,CAAC;AAC9C,CAAC"}

package/dist/report/safetyReport.d.ts

@@ -0,0 +1,13 @@
+import { type DetectedSdk } from "../setup/sdkDetector.js";
+export type SafetyFinding = {
+    severity: "high" | "medium" | "low";
+    message: string;
+    file?: string;
+};
+export type SafetyReport = {
+    projectRoot: string;
+    detected: DetectedSdk[];
+    findings: SafetyFinding[];
+    recommendations: string[];
+};
+export declare function generateSafetyReport(projectRoot?: string): Promise<SafetyReport>;

package/dist/report/safetyReport.js

@@ -0,0 +1,65 @@
+import { readdir, readFile, stat } from "node:fs/promises";
+import { join, relative } from "node:path";
+import { detectSdks, readPackageJson } from "../setup/sdkDetector.js";
+const SKIP_DIRS = new Set(["node_modules", "dist", ".git", ".ghostapi", "coverage"]);
+const SOURCE_EXTENSIONS = new Set([".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs", ".env", ".json"]);
+export async function generateSafetyReport(projectRoot = process.cwd()) {
+    const packageJson = await readPackageJson(projectRoot);
+    const detected = detectSdks(packageJson);
+    const findings = [];
+    const files = await collectFiles(projectRoot, projectRoot, 250);
+    for (const file of files) {
+        const content = await readFile(join(projectRoot, file), "utf8");
+        if (/api\.stripe\.com|api\.openai\.com|api\.twilio\.com/i.test(content)) {
+            findings.push({ severity: "high", message: "Production provider host appears in source.", file });
+        }
+        if (/sk_live_[A-Za-z0-9]+/.test(content)) {
+            findings.push({ severity: "high", message: "Live-looking Stripe key appears in source.", file });
+        }
+        if (/STRIPE_SECRET_KEY|OPENAI_API_KEY|TWILIO_AUTH_TOKEN/.test(content) && !/GHOSTAPI_|apiBase|baseURL/.test(content)) {
+            findings.push({ severity: "medium", message: "Provider secret is referenced without an obvious GhostAPI local override nearby.", file });
+        }
+    }
+    return {
+        projectRoot,
+        detected,
+        findings,
+        recommendations: buildRecommendations(detected, findings)
+    };
+}
+async function collectFiles(root, dir, limit, acc = []) {
+    if (acc.length >= limit)
+        return acc;
+    for (const entry of await readdir(dir, { withFileTypes: true })) {
+        if (acc.length >= limit)
+            break;
+        const fullPath = join(dir, entry.name);
+        if (entry.isDirectory()) {
+            if (!SKIP_DIRS.has(entry.name))
+                await collectFiles(root, fullPath, limit, acc);
+            continue;
+        }
+        if (!entry.isFile())
+            continue;
+        const dot = entry.name.lastIndexOf(".");
+        const ext = dot >= 0 ? entry.name.slice(dot) : entry.name;
+        if (!SOURCE_EXTENSIONS.has(ext))
+            continue;
+        const info = await stat(fullPath);
+        if (info.size > 300_000)
+            continue;
+        acc.push(relative(root, fullPath).replace(/\\/g, "/"));
+    }
+    return acc;
+}
+function buildRecommendations(detected, findings) {
+    const recommendations = ["Run ghostapi setup --write to generate agent rules and MCP snippets.", "Use ghostapi start --open during local integration work."];
+    if (detected.includes("stripe"))
+        recommendations.push("Configure Stripe with apiBase: process.env.GHOSTAPI_STRIPE_BASE_URL ?? 'http://127.0.0.1:8080'.");
+    if (detected.includes("openai"))
+        recommendations.push("Configure OpenAI with baseURL: process.env.GHOSTAPI_OPENAI_BASE_URL ?? 'http://127.0.0.1:8080/v1'.");
+    if (findings.some((finding) => finding.severity === "high"))
+        recommendations.push("Remove live-looking keys and production provider hosts before committing.");
+    return recommendations;
+}
+//# sourceMappingURL=safetyReport.js.map

package/dist/report/safetyReport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safetyReport.js","sourceRoot":"","sources":["../../src/report/safetyReport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,eAAe,EAAoB,MAAM,yBAAyB,CAAC;AAexF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;AACrF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEnG,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,WAAW,GAAG,OAAO,CAAC,GAAG,EAAE;IACpE,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAoB,EAAE,CAAC;IAErC,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,WAAW,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;IAChE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QAChE,IAAI,qDAAqD,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACxE,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,6CAA6C,EAAE,IAAI,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,4CAA4C,EAAE,IAAI,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,oDAAoD,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrH,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,kFAAkF,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3I,CAAC;IACH,CAAC;IAED,OAAO;QACL,WAAW;QACX,QAAQ;QACR,QAAQ;QACR,eAAe,EAAE,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,GAAW,EAAE,KAAa,EAAE,MAAgB,EAAE;IACtF,IAAI,GAAG,CAAC,MAAM,IAAI,KAAK;QAAE,OAAO,GAAG,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAChE,IAAI,GAAG,CAAC,MAAM,IAAI,KAAK;YAAE,MAAM;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YAC/E,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,SAAS;QAC9B,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QAC1D,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,IAAI,CAAC,IAAI,GAAG,OAAO;YAAE,SAAS;QAClC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAuB,EAAE,QAAyB;IAC9E,MAAM,eAAe,GAAG,CAAC,sEAAsE,EAAE,0DAA0D,CAAC,CAAC;IAC7J,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,eAAe,CAAC,IAAI,CAAC,iGAAiG,CAAC,CAAC;IACzJ,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,eAAe,CAAC,IAAI,CAAC,oGAAoG,CAAC,CAAC;IAC5J,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC;QAAE,eAAe,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;IAC/J,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/rules/aiRules.d.ts

@@ -0,0 +1,7 @@
+export type AiRulesResult = {
+    filename: ".cursorrules";
+    projectRoot: string;
+    detected: string[];
+    content: string;
+};
+export declare function generateAiRules(projectRoot?: string): Promise<AiRulesResult>;

package/dist/rules/aiRules.js

@@ -0,0 +1,31 @@
+import { detectSdks, readPackageJson } from "../setup/sdkDetector.js";
+export async function generateAiRules(projectRoot = process.cwd()) {
+    const packageJson = await readPackageJson(projectRoot);
+    const detected = detectSdks(packageJson);
+    return {
+        filename: ".cursorrules",
+        projectRoot,
+        detected,
+        content: buildCursorRules(detected)
+    };
+}
+function buildCursorRules(detected) {
+    const lines = [
+        "# GhostAPI Agent Rules",
+        "",
+        "You are working in a project that should use GhostAPI for local API simulations.",
+        "Never call paid or production third-party APIs during local tests unless the user explicitly asks.",
+        "Route supported SDKs and raw HTTP calls through http://127.0.0.1:8080.",
+        "Use GhostAPI MCP tools when available to inspect state, configure deterministic API behavior, read traffic logs, and toggle Chaos Mode.",
+        ""
+    ];
+    if (detected.includes("stripe")) {
+        lines.push("## Stripe", "", "This project depends on `stripe`. Configure the Stripe client to use GhostAPI in local development:", "", "```ts", "import Stripe from \"stripe\";", "", "export const stripe = new Stripe(process.env.STRIPE_SECRET_KEY ?? \"sk_test_ghostapi\", {", "  apiBase: process.env.GHOSTAPI_STRIPE_BASE_URL ?? \"http://127.0.0.1:8080\"", "});", "```", "", "Prefer `GHOSTAPI_STRIPE_BASE_URL=http://127.0.0.1:8080` in local env files instead of hard-coding production URLs.", "When writing tests, assert behavior against GhostAPI responses and avoid using live Stripe credentials.", "");
+    }
+    if (detected.length === 0) {
+        lines.push("## No Known SDKs Detected", "", "No first-class provider SDK was found in `package.json`. For raw HTTP clients, set the API base URL to `http://127.0.0.1:8080` during local development.", "");
+    }
+    lines.push("## Chaos Testing", "", "When testing retry logic, ask GhostAPI to enable Chaos Mode. Expect occasional provider-shaped `429` and `503` responses or 2-5 second artificial latency.", "");
+    return lines.join("\n");
+}
+//# sourceMappingURL=aiRules.js.map

package/dist/rules/aiRules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aiRules.js","sourceRoot":"","sources":["../../src/rules/aiRules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAStE,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,WAAW,GAAG,OAAO,CAAC,GAAG,EAAE;IAC/D,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IACzC,OAAO;QACL,QAAQ,EAAE,cAAc;QACxB,WAAW;QACX,QAAQ;QACR,OAAO,EAAE,gBAAgB,CAAC,QAAQ,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAkB;IAC1C,MAAM,KAAK,GAAG;QACZ,wBAAwB;QACxB,EAAE;QACF,kFAAkF;QAClF,oGAAoG;QACpG,wEAAwE;QACxE,yIAAyI;QACzI,EAAE;KACH,CAAC;IAEF,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CACR,WAAW,EACX,EAAE,EACF,qGAAqG,EACrG,EAAE,EACF,OAAO,EACP,gCAAgC,EAChC,EAAE,EACF,2FAA2F,EAC3F,8EAA8E,EAC9E,KAAK,EACL,KAAK,EACL,EAAE,EACF,oHAAoH,EACpH,yGAAyG,EACzG,EAAE,CACH,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CACR,2BAA2B,EAC3B,EAAE,EACF,0JAA0J,EAC1J,EAAE,CACH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CACR,kBAAkB,EAClB,EAAE,EACF,4JAA4J,EAC5J,EAAE,CACH,CAAC;IAEF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/scenarios/scenarioStore.d.ts

@@ -0,0 +1,37 @@
+import type { ProxyEvent } from "../server/eventsStore.js";
+export type ScenarioStep = {
+    name: string;
+    method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+    path: string;
+    status: number;
+    body: unknown;
+    headers?: Record<string, string>;
+};
+export type ScenarioPreset = {
+    id: string;
+    title: string;
+    provider: string;
+    description: string;
+    steps: ScenarioStep[];
+};
+export type ScenarioReplayResult = {
+    scenario: ScenarioPreset;
+    applied: Array<{
+        method: string;
+        path: string;
+        status: number;
+    }>;
+};
+export declare function listScenarioPresets(): Promise<ScenarioPreset[]>;
+export declare function getScenarioPreset(id: string): Promise<ScenarioPreset | null>;
+export declare function replayScenario(id: string): Promise<ScenarioReplayResult>;
+export declare function exportScenario(id: string): Promise<ScenarioPreset>;
+export declare function shareScenario(id: string): Promise<{
+    scenario: ScenarioPreset;
+    shareText: string;
+}>;
+export declare function importScenario(input: unknown): Promise<ScenarioPreset>;
+export declare function saveEventsAsScenario(events: ProxyEvent[], input?: {
+    title?: string;
+    id?: string;
+}): Promise<ScenarioPreset>;

package/dist/scenarios/scenarioStore.js

@@ -0,0 +1,201 @@
+import { mkdir, readFile, readdir, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { setApiBehavior } from "../behavior/behaviorStore.js";
+const SCENARIOS = [
+    {
+        id: "stripe-customer-create",
+        title: "Stripe customer create",
+        provider: "stripe",
+        description: "Returns a stable customer object for local onboarding and billing flows.",
+        steps: [
+            {
+                name: "Create customer",
+                method: "POST",
+                path: "/v1/customers",
+                status: 200,
+                body: { id: "cus_ghostapi_123", object: "customer", email: "founder@example.com", livemode: false, metadata: { scenario: "stripe-customer-create" } }
+            }
+        ]
+    },
+    {
+        id: "stripe-payment-intent-fail",
+        title: "Payment intent fail",
+        provider: "stripe",
+        description: "Forces a card-decline shaped Stripe error so agents must implement failure handling.",
+        steps: [
+            {
+                name: "Payment intent card declined",
+                method: "POST",
+                path: "/v1/payment_intents",
+                status: 402,
+                body: { error: { type: "card_error", code: "card_declined", decline_code: "generic_decline", message: "Your card was declined.", param: "payment_method" } }
+            }
+        ]
+    },
+    {
+        id: "resend-email-send",
+        title: "Resend email send",
+        provider: "resend",
+        description: "Returns a delivered email ID for transactional email flows.",
+        steps: [
+            {
+                name: "Send email",
+                method: "POST",
+                path: "/emails",
+                status: 200,
+                body: { id: "email_ghostapi_123", object: "email", status: "sent" }
+            }
+        ]
+    },
+    {
+        id: "github-issue-create",
+        title: "GitHub issue create",
+        provider: "github",
+        description: "Returns a deterministic issue payload for GitHub automation tests.",
+        steps: [
+            {
+                name: "Create issue",
+                method: "POST",
+                path: "/repos/ghostapi/demo/issues",
+                status: 201,
+                body: { id: 10001, number: 42, title: "GhostAPI local issue", state: "open", html_url: "https://github.local/ghostapi/demo/issues/42" }
+            }
+        ]
+    }
+];
+const CUSTOM_SCENARIOS_DIR = join(".ghostapi", "scenarios");
+export async function listScenarioPresets() {
+    return [...structuredClone(SCENARIOS), ...(await listCustomScenarios())];
+}
+export async function getScenarioPreset(id) {
+    const builtIn = SCENARIOS.find((scenario) => scenario.id === id);
+    if (builtIn !== undefined)
+        return structuredClone(builtIn);
+    return await readCustomScenario(id);
+}
+export async function replayScenario(id) {
+    const scenario = await getScenarioPreset(id);
+    if (scenario === null)
+        throw new Error(`Unknown scenario: ${id}`);
+    const applied = [];
+    for (const step of scenario.steps) {
+        await setApiBehavior({ method: step.method, path: step.path, status: step.status, body: step.body, headers: step.headers });
+        applied.push({ method: step.method, path: step.path, status: step.status });
+    }
+    return { scenario, applied };
+}
+export async function exportScenario(id) {
+    const scenario = await getScenarioPreset(id);
+    if (scenario === null)
+        throw new Error(`Unknown scenario: ${id}`);
+    return scenario;
+}
+export async function shareScenario(id) {
+    const scenario = await exportScenario(id);
+    const encoded = Buffer.from(JSON.stringify(scenario), "utf8").toString("base64url");
+    return {
+        scenario,
+        shareText: `ghostapi://scenario/${encoded}`
+    };
+}
+export async function importScenario(input) {
+    const scenario = normalizeScenario(input);
+    await writeScenario(scenario);
+    return scenario;
+}
+export async function saveEventsAsScenario(events, input = {}) {
+    const title = input.title?.trim() || `Traffic scenario ${new Date().toISOString()}`;
+    const id = input.id?.trim() || slugify(title);
+    const scenario = normalizeScenario({
+        id,
+        title,
+        provider: "traffic",
+        description: "Saved from recent GhostAPI traffic.",
+        steps: events.filter((event) => event.source !== "fault").slice(-20).map((event, index) => ({
+            name: `${index + 1}. ${event.method} ${event.path}`,
+            method: event.method,
+            path: event.path,
+            status: event.statusCode,
+            body: event.response
+        }))
+    });
+    await writeScenario(scenario);
+    return scenario;
+}
+async function listCustomScenarios() {
+    try {
+        const entries = await readdir(CUSTOM_SCENARIOS_DIR, { withFileTypes: true });
+        const scenarios = [];
+        for (const entry of entries) {
+            if (entry.isFile() && entry.name.endsWith(".json")) {
+                scenarios.push(normalizeScenario(JSON.parse(await readFile(join(CUSTOM_SCENARIOS_DIR, entry.name), "utf8"))));
+            }
+        }
+        return scenarios;
+    }
+    catch (error) {
+        if (error instanceof Error && "code" in error && error.code === "ENOENT")
+            return [];
+        throw error;
+    }
+}
+async function readCustomScenario(id) {
+    try {
+        return normalizeScenario(JSON.parse(await readFile(join(CUSTOM_SCENARIOS_DIR, `${slugify(id)}.json`), "utf8")));
+    }
+    catch (error) {
+        if (error instanceof Error && "code" in error && error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+async function writeScenario(scenario) {
+    await mkdir(CUSTOM_SCENARIOS_DIR, { recursive: true });
+    await writeFile(join(CUSTOM_SCENARIOS_DIR, `${scenario.id}.json`), JSON.stringify(scenario, null, 2), "utf8");
+}
+function normalizeScenario(input) {
+    if (input === null || typeof input !== "object" || Array.isArray(input))
+        throw new Error("Scenario must be an object.");
+    const record = input;
+    if (typeof record.title !== "string" || record.title.trim() === "")
+        throw new Error("Scenario title is required.");
+    if (!Array.isArray(record.steps) || record.steps.length === 0)
+        throw new Error("Scenario steps are required.");
+    const id = typeof record.id === "string" && record.id.trim() !== "" ? slugify(record.id) : slugify(record.title);
+    return {
+        id,
+        title: record.title.trim(),
+        provider: typeof record.provider === "string" ? record.provider : "custom",
+        description: typeof record.description === "string" ? record.description : "Custom GhostAPI scenario.",
+        steps: record.steps.map(normalizeStep)
+    };
+}
+function normalizeStep(input) {
+    if (input === null || typeof input !== "object" || Array.isArray(input))
+        throw new Error("Scenario step must be an object.");
+    const record = input;
+    const method = String(record.method ?? "GET").toUpperCase();
+    if (!isScenarioMethod(method))
+        throw new Error("Scenario step method is invalid.");
+    const path = String(record.path ?? "");
+    if (!path.startsWith("/"))
+        throw new Error("Scenario step path must start with '/'.");
+    const status = Number(record.status);
+    if (!Number.isInteger(status) || status < 100 || status > 599)
+        throw new Error("Scenario step status must be 100-599.");
+    return { name: typeof record.name === "string" ? record.name : `${method} ${path}`, method, path, status, body: record.body ?? {}, headers: readHeaders(record.headers) };
+}
+function readHeaders(value) {
+    if (value === undefined)
+        return undefined;
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    return Object.fromEntries(Object.entries(value).map(([key, headerValue]) => [key, String(headerValue)]));
+}
+function isScenarioMethod(value) {
+    return value === "GET" || value === "POST" || value === "PUT" || value === "PATCH" || value === "DELETE";
+}
+function slugify(value) {
+    return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 80) || "custom-scenario";
+}
+//# sourceMappingURL=scenarioStore.js.map

package/dist/scenarios/scenarioStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scenarioStore.js","sourceRoot":"","sources":["../../src/scenarios/scenarioStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAyB9D,MAAM,SAAS,GAAqB;IAClC;QACE,EAAE,EAAE,wBAAwB;QAC5B,KAAK,EAAE,wBAAwB;QAC/B,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,0EAA0E;QACvF,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,EAAE,EAAE,EAAE,kBAAkB,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,qBAAqB,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,wBAAwB,EAAE,EAAE;aACtJ;SACF;KACF;IACD;QACE,EAAE,EAAE,4BAA4B;QAChC,KAAK,EAAE,qBAAqB;QAC5B,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,sFAAsF;QACnG,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,8BAA8B;gBACpC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,qBAAqB;gBAC3B,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,YAAY,EAAE,iBAAiB,EAAE,OAAO,EAAE,yBAAyB,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE;aAC7J;SACF;KACF;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,KAAK,EAAE,mBAAmB;QAC1B,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,6DAA6D;QAC1E,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,YAAY;gBAClB,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,EAAE,EAAE,EAAE,oBAAoB,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE;aACpE;SACF;KACF;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,KAAK,EAAE,qBAAqB;QAC5B,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,oEAAoE;QACjF,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,cAAc;gBACpB,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,6BAA6B;gBACnC,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,8CAA8C,EAAE;aACxI;SACF;KACF;CACF,CAAC;AAEF,MAAM,oBAAoB,GAAG,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;AAE5D,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,OAAO,CAAC,GAAG,eAAe,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,MAAM,mBAAmB,EAAE,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAU;IAChD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;IAC3D,OAAO,MAAM,kBAAkB,CAAC,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAU;IAC7C,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAC7C,IAAI,QAAQ,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;IAElE,MAAM,OAAO,GAAG,EAAE,CAAC;IACnB,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,cAAc,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5H,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAU;IAC7C,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAC7C,IAAI,QAAQ,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;IAClE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAU;IAC5C,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,EAAE,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpF,OAAO;QACL,QAAQ;QACR,SAAS,EAAE,uBAAuB,OAAO,EAAE;KAC5C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAc;IACjD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC9B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAoB,EAAE,QAAyC,EAAE;IAC1G,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,oBAAoB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IACpF,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,iBAAiB,CAAC;QACjC,EAAE;QACF,KAAK;QACL,QAAQ,EAAE,SAAS;QACnB,WAAW,EAAE,qCAAqC;QAClD,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YAC1F,IAAI,EAAE,GAAG,KAAK,GAAG,CAAC,KAAK,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE;YACnD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,KAAK,CAAC,UAAU;YACxB,IAAI,EAAE,KAAK,CAAC,QAAQ;SACrB,CAAC,CAAC;KACJ,CAAC,CAAC;IACH,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC9B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,mBAAmB;IAChC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,oBAAoB,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,MAAM,SAAS,GAAG,EAAE,CAAC;QACrB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnD,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAChH,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QACpF,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,EAAU;IAC1C,IAAI,CAAC;QACH,OAAO,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAClH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACtF,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,QAAwB;IACnD,MAAM,KAAK,CAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,SAAS,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,QAAQ,CAAC,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AAChH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACxH,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACnH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAC/G,MAAM,EAAE,GAAG,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjH,OAAO;QACL,EAAE;QACF,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;QAC1B,QAAQ,EAAE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;QAC1E,WAAW,EAAE,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,2BAA2B;QACtG,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC7H,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5D,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACvC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACxH,OAAO,EAAE,IAAI,EAAE,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;AAC5K,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1F,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;AACtI,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,QAAQ,CAAC;AAC3G,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,iBAAiB,CAAC;AACjH,CAAC"}

package/dist/security/headerSanitizer.d.ts

@@ -0,0 +1,3 @@
+import type { IncomingHttpHeaders } from "node:http";
+export type SanitizedHeaders = Record<string, string | string[]>;
+export declare function sanitizeHeaders(headers: IncomingHttpHeaders): SanitizedHeaders;

package/dist/security/headerSanitizer.js

@@ -0,0 +1,12 @@
+import { sanitizeSecrets } from "./secrets.js";
+export function sanitizeHeaders(headers) {
+    const sanitized = sanitizeSecrets(headers);
+    if (sanitized === null || typeof sanitized !== "object" || Array.isArray(sanitized)) {
+        return {};
+    }
+    return Object.fromEntries(Object.entries(sanitized).filter((entry) => typeof entry[1] === "string" || isStringArray(entry[1])));
+}
+function isStringArray(value) {
+    return Array.isArray(value) && value.every((entry) => typeof entry === "string");
+}
+//# sourceMappingURL=headerSanitizer.js.map

package/dist/security/headerSanitizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"headerSanitizer.js","sourceRoot":"","sources":["../../src/security/headerSanitizer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAI/C,MAAM,UAAU,eAAe,CAAC,OAA4B;IAC1D,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAE3C,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACpF,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,SAAoC,CAAC,CAAC,MAAM,CACzD,CAAC,KAAK,EAAwC,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CACzG,CACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;AACnF,CAAC"}

package/dist/security/maskSecrets.d.ts

@@ -0,0 +1 @@
+export { sanitizeSecrets as maskSecrets } from "./secrets.js";

package/dist/security/maskSecrets.js

@@ -0,0 +1,2 @@
+export { sanitizeSecrets as maskSecrets } from "./secrets.js";
+//# sourceMappingURL=maskSecrets.js.map

package/dist/security/maskSecrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"maskSecrets.js","sourceRoot":"","sources":["../../src/security/maskSecrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,IAAI,WAAW,EAAE,MAAM,cAAc,CAAC"}

package/dist/security/secrets.d.ts

@@ -0,0 +1,4 @@
+export declare const MASK = "***";
+export declare function sanitizeSecrets(value: unknown): unknown;
+export declare function sanitizeSecretString(value: string): string;
+export declare function isSecretFieldName(name: string): boolean;

package/dist/security/secrets.js

@@ -0,0 +1,61 @@
+const SECRET_FIELD_NAMES = [
+    "authorization",
+    "api_key",
+    "apikey",
+    "x-api-key",
+    "access_token",
+    "refresh_token",
+    "client_secret",
+    "password",
+    "secret",
+    "token",
+    "key"
+];
+const TOKEN_PATTERNS = [
+    /sk_live_[A-Za-z0-9_\-]+/g,
+    /sk_test_[A-Za-z0-9_\-]+/g,
+    /rk_live_[A-Za-z0-9_\-]+/g,
+    /ghp_[A-Za-z0-9_]+/g,
+    /github_pat_[A-Za-z0-9_]+/g,
+    /xoxb-[A-Za-z0-9\-]+/g,
+    /SG\.[A-Za-z0-9_\-\.]+/g
+];
+export const MASK = "***";
+export function sanitizeSecrets(value) {
+    return sanitizeValue(value);
+}
+export function sanitizeSecretString(value) {
+    return TOKEN_PATTERNS.reduce((result, pattern) => result.replace(pattern, MASK), value.replace(/Bearer\s+\S+/gi, "Bearer ***"));
+}
+export function isSecretFieldName(name) {
+    const normalizedName = name.toLowerCase();
+    return SECRET_FIELD_NAMES.some((secretName) => normalizedName.includes(secretName));
+}
+function sanitizeValue(value) {
+    if (Array.isArray(value)) {
+        return value.map(sanitizeValue);
+    }
+    if (value !== null && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value).map(([key, entryValue]) => [
+            key,
+            isSecretFieldName(key) ? maskByType(entryValue) : sanitizeValue(entryValue)
+        ]));
+    }
+    if (typeof value === "string") {
+        return sanitizeSecretString(value);
+    }
+    return value;
+}
+function maskByType(value) {
+    if (Array.isArray(value)) {
+        return value.map(maskByType);
+    }
+    if (value !== null && typeof value === "object") {
+        return Object.fromEntries(Object.keys(value).map((key) => [key, MASK]));
+    }
+    if (typeof value === "string" && value.trim().toLowerCase().startsWith("bearer ")) {
+        return "Bearer ***";
+    }
+    return MASK;
+}
+//# sourceMappingURL=secrets.js.map

package/dist/security/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/security/secrets.ts"],"names":[],"mappings":"AAAA,MAAM,kBAAkB,GAAG;IACzB,eAAe;IACf,SAAS;IACT,QAAQ;IACR,WAAW;IACX,cAAc;IACd,eAAe;IACf,eAAe;IACf,UAAU;IACV,QAAQ;IACR,OAAO;IACP,KAAK;CACN,CAAC;AAEF,MAAM,cAAc,GAAG;IACrB,0BAA0B;IAC1B,0BAA0B;IAC1B,0BAA0B;IAC1B,oBAAoB;IACpB,2BAA2B;IAC3B,sBAAsB;IACtB,wBAAwB;CACzB,CAAC;AAEF,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,CAAC;AAE1B,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC,CAAC;AAClI,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC1C,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAClC,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC;YAC1E,GAAG;YACH,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC;SAC5E,CAAC,CACH,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACrG,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAClF,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/server/createServer.d.ts

@@ -0,0 +1,8 @@
+import { type Express } from "express";
+import type { ServerConfig } from "../config/serverConfig.js";
+declare module "express-serve-static-core" {
+    interface Request {
+        rawBody?: string;
+    }
+}
+export declare function createServer(config: ServerConfig): Promise<Express>;

package/dist/server/createServer.js

@@ -0,0 +1,42 @@
+import express from "express";
+import { initializeCacheDir } from "../cache/index.js";
+import { initializeStateStore } from "../state/stateStore.js";
+import { registerRoutes } from "./routes.js";
+function captureRawBody(request, _response, buffer) {
+    if (buffer.length > 0) {
+        request.rawBody = buffer.toString("utf8");
+    }
+}
+export async function createServer(config) {
+    await initializeStateStore();
+    await initializeCacheDir();
+    const app = express();
+    app.disable("x-powered-by");
+    app.use((req, res, next) => {
+        const origin = req.header("origin");
+        if (req.path.startsWith("/api/") && origin !== undefined && !isLocalOrigin(origin)) {
+            res.status(403).json({ error: { code: "forbidden_origin", message: "GhostAPI dashboard APIs only accept local origins." } });
+            return;
+        }
+        res.header("Access-Control-Allow-Origin", origin && isLocalOrigin(origin) ? origin : "*");
+        res.header("Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS");
+        res.header("Access-Control-Allow-Headers", "*");
+        res.header("Access-Control-Expose-Headers", "*");
+        next();
+    });
+    app.use(express.json({ limit: "5mb", verify: captureRawBody }));
+    app.use(express.urlencoded({ limit: "5mb", extended: true, verify: captureRawBody }));
+    app.use(express.raw({ limit: "15mb", type: () => true, verify: captureRawBody }));
+    registerRoutes(app, config);
+    return app;
+}
+function isLocalOrigin(origin) {
+    try {
+        const { hostname } = new URL(origin);
+        return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=createServer.js.map

package/dist/server/createServer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createServer.js","sourceRoot":"","sources":["../../src/server/createServer.ts"],"names":[],"mappings":"AAAA,OAAO,OAAyB,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAS7C,SAAS,cAAc,CAAC,OAAwB,EAAE,SAA2B,EAAE,MAAc;IAC3F,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAoB;IACrD,MAAM,oBAAoB,EAAE,CAAC;IAC7B,MAAM,kBAAkB,EAAE,CAAC;IAE3B,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IAEtB,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAE5B,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YACnF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,oDAAoD,EAAE,EAAE,CAAC,CAAC;YAC7H,OAAO;QACT,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,6BAA6B,EAAE,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC1F,GAAG,CAAC,MAAM,CAAC,8BAA8B,EAAE,8CAA8C,CAAC,CAAC;QAC3F,GAAG,CAAC,MAAM,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;QAChD,GAAG,CAAC,MAAM,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC;QACjD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;IAChE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;IACtF,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;IAElF,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAE5B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QACrC,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/server/eventsStore.d.ts

@@ -0,0 +1,17 @@
+export type EventSource = "state" | "cache" | "ai" | "error" | "fallback" | "stream" | "fault" | "behavior";
+export type ProxyEvent = {
+    id: string;
+    timestamp: string;
+    provider: string;
+    method: string;
+    path: string;
+    statusCode: number;
+    source: EventSource;
+    durationMs: number;
+    request: unknown;
+    response: unknown;
+};
+export declare function addEvent(event: ProxyEvent): Promise<void>;
+export declare function getEventsHistory(): ProxyEvent[];
+export declare function clearEventsHistoryForTests(): void;
+export declare function clearEvents(): Promise<void>;