callman-core 1.38.0 → 1.40.0

package/dist/mock-engine/engine.js

@@ -0,0 +1,828 @@
+// The mock engine pipeline. Hosts (backend Express, desktop node:http,
+// renderer sandbox) handle platform gates first — per-IP fuse, lookup,
+// 404/410, X-Mock-Token, rate limits — then call `executeMockRequest`, and
+// carry out the returned delay/transport (respond, hang, drop).
+//
+// Order: session → /__callman control → route match → faults(before) →
+// sign-in requirement → body validation → variants → execute (resource
+// endpoint | data action | legacy builder | static/template) →
+// faults(after) → delay. Store failures surface as 503, never as a fake 2xx.
+import { bearerToken, generateMockSecret, signMockJwt, verifyMockJwt, verifyPassword } from "./auth.js";
+import { evaluateCondition } from "./conditions.js";
+import { MOCK_CONTROL_PREFIX, MOCK_SESSION_HEADER, MOCK_SESSION_ID_PATTERN } from "./constants.js";
+import { MockOpBudgetExceeded } from "./context.js";
+import { runDataAction } from "./data/actions.js";
+import { andFilters } from "./data/query.js";
+import { canonicalKey, keyFromParam } from "./data/record-codec.js";
+import { createRecord, deleteRecords, findByLookup, getRecord, listRecords, notFoundResult, presentRecord, resourceByName, validationFailure, writeRecord, } from "./data/resource-ops.js";
+import { buildSeedPlan } from "./data/seed.js";
+import { evaluateFaults } from "./faults.js";
+import { applyLegacyMutationsInMemory, renderLegacyBuilder } from "./legacy-builder.js";
+import { buildRendered, jsonResponse, renderOutcome, renderResponseConfig } from "./render.js";
+import { compileRouteTable, matchRouteTable } from "./routing.js";
+import { templateReferences } from "./templates.js";
+import { isPlainObject, lookupHeader, toHex, utf8 } from "./util.js";
+export const compileMockDefinition = (definition) => ({
+    definition,
+    table: compileRouteTable(definition),
+});
+/** Small LRU for compiled definitions, keyed by the host (e.g. `${mockId}:${rev}`). */
+export const createCompiledMockCache = (max = 500) => {
+    const cache = new Map();
+    return {
+        get(key, factory) {
+            const hit = cache.get(key);
+            if (hit) {
+                cache.delete(key);
+                cache.set(key, hit);
+                return hit;
+            }
+            const compiled = compileMockDefinition(factory());
+            cache.set(key, compiled);
+            if (cache.size > max) {
+                const oldest = cache.keys().next().value;
+                if (oldest !== undefined)
+                    cache.delete(oldest);
+            }
+            return compiled;
+        },
+        clear() {
+            cache.clear();
+        },
+    };
+};
+// ── Helpers ───────────────────────────────────────────────────────────
+const BODY_METHODS = new Set(["POST", "PUT", "PATCH"]);
+const STATUS_TEXT = {
+    400: "Bad Request", 401: "Unauthorized", 403: "Forbidden", 404: "Not Found", 408: "Request Timeout",
+    409: "Conflict", 418: "I'm a teapot", 422: "Unprocessable Entity", 429: "Too Many Requests",
+    500: "Internal Server Error", 502: "Bad Gateway", 503: "Service Unavailable", 504: "Gateway Timeout",
+};
+const delayMs = (delay, ctx) => {
+    if (!delay || delay.mode === "none")
+        return 0;
+    if (delay.mode === "fixed")
+        return Math.max(0, delay.ms);
+    const min = Math.max(0, delay.minMs);
+    const max = Math.max(min, delay.maxMs);
+    return min + Math.floor(ctx.random.next() * (max - min + 1));
+};
+const secretCache = new Map();
+const signingSecret = async (definition, ctx) => {
+    if (definition.userAuth?.secret)
+        return definition.userAuth.secret;
+    // A host should always store a generated secret; this keeps old/partial
+    // definitions working with a stable per-mock fallback.
+    const cached = secretCache.get(ctx.mockId);
+    if (cached)
+        return cached;
+    const derived = toHex(await ctx.crypto.sha256(utf8(`callman-mock:${ctx.mockId}`)));
+    if (secretCache.size > 1000)
+        secretCache.clear();
+    secretCache.set(ctx.mockId, derived);
+    return derived;
+};
+/** Wrap a store so one request cannot run more than `max` operations. */
+const budgetStore = (store, max, trace) => {
+    const tick = () => {
+        trace.storeOps += 1;
+        if (trace.storeOps > max)
+            throw new MockOpBudgetExceeded();
+    };
+    return {
+        ensureNamespace: (...args) => (tick(), store.ensureNamespace(...args)),
+        resetNamespace: (...args) => (tick(), store.resetNamespace(...args)),
+        dropNamespace: (...args) => (tick(), store.dropNamespace(...args)),
+        listNamespaces: (...args) => (tick(), store.listNamespaces(...args)),
+        insert: (...args) => (tick(), store.insert(...args)),
+        get: (...args) => (tick(), store.get(...args)),
+        getMany: (...args) => (tick(), store.getMany(...args)),
+        find: (...args) => (tick(), store.find(...args)),
+        count: (...args) => (tick(), store.count(...args)),
+        countNamespace: (...args) => (tick(), store.countNamespace(...args)),
+        replace: (...args) => (tick(), store.replace(...args)),
+        delete: (...args) => (tick(), store.delete(...args)),
+        clearResource: (...args) => (tick(), store.clearResource(...args)),
+        nextSequence: (...args) => (tick(), store.nextSequence(...args)),
+        bumpSequence: (...args) => (tick(), store.bumpSequence(...args)),
+    };
+};
+/** Seed plan for a namespace (deterministic per mock). */
+export const seedPlanFor = (definition, ctx) => buildSeedPlan(definition, { mockId: ctx.mockId, now: ctx.clock.now(), crypto: ctx.crypto, maxGenerate: ctx.limits.maxSeedGenerate });
+const sessionIdleMs = (definition, ctx) => Math.max(5, Math.min(1440, definition.sessions?.idleTtlMinutes ?? Math.round(ctx.limits.sessionIdleTtlMs / 60_000))) * 60_000;
+const resultOf = (response, trace, delay = 0, transport = { kind: "respond" }, maxDelay = 60_000) => ({ response, delayMs: Math.min(maxDelay, Math.max(0, delay)), transport, trace });
+// ── Pipeline ──────────────────────────────────────────────────────────
+export const executeMockRequest = async (compiled, req, ctx) => {
+    const trace = { faults: [], storeOps: 0 };
+    const limits = ctx.limits;
+    const maxBody = limits.maxResponseBodyBytes;
+    const definition = compiled.definition;
+    const tpl = { random: ctx.random, now: () => ctx.clock.now() };
+    const method = req.method.toUpperCase();
+    const done = (response, delay = 0, transport = { kind: "respond" }) => {
+        if (method === "HEAD")
+            response = { ...response, body: "" };
+        return resultOf(response, trace, delay, transport, limits.maxDelayMs);
+    };
+    try {
+        // 1. Session namespace
+        const sessionsEnabled = definition.sessions?.enabled !== false;
+        const rawSession = req.headers[MOCK_SESSION_HEADER];
+        let sessionId = null;
+        if (sessionsEnabled && rawSession !== undefined && rawSession !== "") {
+            if (!MOCK_SESSION_ID_PATTERN.test(rawSession)) {
+                trace.failureReason = "bad-session";
+                return done(jsonResponse(400, { error: "Invalid X-Mock-Session header", hint: "Use 1-64 letters, digits, '.', '_', ':' or '-'" }, maxBody));
+            }
+            sessionId = rawSession;
+            trace.session = sessionId;
+        }
+        const scope = { mockId: ctx.mockId, ns: sessionId ? `s:${sessionId}` : "_" };
+        const store = ctx.store ? budgetStore(ctx.store, limits.maxDataOpsPerRequest, trace) : undefined;
+        let nsReady = null;
+        const ensureNamespace = () => {
+            if (!store)
+                return Promise.resolve("ok");
+            if (!nsReady) {
+                nsReady = store
+                    .ensureNamespace(scope, () => seedPlanFor(definition, ctx), {
+                    isSession: sessionId !== null,
+                    maxSessions: limits.maxSessions,
+                    idleTtlMs: sessionIdleMs(definition, ctx),
+                    now: ctx.clock.now(),
+                })
+                    .then((outcome) => (outcome.ok ? "ok" : "session-limit"));
+            }
+            return nsReady;
+        };
+        const sessionLimit = () => {
+            trace.failureReason = "session-limit";
+            return done(jsonResponse(429, { error: "Too many active test sessions", limit: limits.maxSessions }, maxBody, { "x-mock-limit-reason": "session-limit" }));
+        };
+        // 2. Control endpoints
+        if (req.path === MOCK_CONTROL_PREFIX || req.path.startsWith(`${MOCK_CONTROL_PREFIX}/`)) {
+            trace.virtual = { kind: "control" };
+            return done(await handleControl(req, definition, ctx, store, scope, sessionId, maxBody));
+        }
+        // Lazily verified sign-in state.
+        let authPromise = null;
+        const getAuth = () => {
+            if (!authPromise)
+                authPromise = resolveAuth(definition, req, ctx);
+            return authPromise;
+        };
+        const baseCondition = (params, auth) => ({
+            params,
+            query: req.query,
+            headers: req.headers,
+            body: req.body,
+            session: { id: sessionId },
+            ...(auth ? { auth: { authenticated: auth.authenticated, sub: auth.sub, claims: auth.claims } } : {}),
+        });
+        // 3. Route match
+        let matched = null;
+        for (const candidate of matchRouteTable(compiled.table, method, req.path)) {
+            const target = candidate.entry.target;
+            if (target.kind === "route" && target.route.match) {
+                const auth = conditionNeedsAuth(target.route.match) ? await getAuth() : undefined;
+                if (!evaluateCondition(target.route.match, baseCondition(candidate.params, auth), ctx.regex))
+                    continue;
+            }
+            matched = candidate;
+            break;
+        }
+        if (!matched) {
+            trace.failureReason = "no-route";
+            return done(jsonResponse(404, { error: "No matching route", hint: `Configure a route for ${method} ${req.path}` }, maxBody));
+        }
+        const { entry, params } = matched;
+        const target = entry.target;
+        // Target-specific settings
+        let counterKey = "";
+        let faultConfig;
+        let delayConfig;
+        let requirement = "none";
+        let validation;
+        const protect = definition.userAuth?.enabled ? definition.userAuth.protect : "none";
+        if (target.kind === "route") {
+            counterKey = target.route.routeId;
+            trace.routeId = target.route.routeId;
+            faultConfig = target.route.faults;
+            delayConfig = target.route.behavior?.delay;
+            requirement = target.route.auth ?? (protect === "all" ? "user" : "none");
+            validation = target.route.requestValidation;
+        }
+        else if (target.kind === "resource" || target.kind === "nested") {
+            const resource = target.kind === "resource" ? target.resource : target.child;
+            const endpointName = target.kind === "resource" ? target.endpoint : target.endpoint;
+            const endpoint = resource.endpoints[endpointName];
+            counterKey = `res:${resource.resourceId}:${endpointName}`;
+            trace.virtual = { kind: "resource", resource: resource.name, endpoint: endpointName };
+            faultConfig = endpoint.faults;
+            delayConfig = endpoint.delay;
+            requirement = endpoint.auth ?? resource.auth ?? (protect !== "none" || resource.ownerField ? "user" : "none");
+            validation = endpoint.requestValidation;
+        }
+        else {
+            counterKey = `auth:${target.op}`;
+            trace.virtual = { kind: "auth", endpoint: target.op };
+            requirement = target.op === "me" ? "user" : "none";
+        }
+        const callCount = { value: null, computed: false };
+        const authForFaults = faultsNeedAuth(faultConfig, definition.faults) ? await getAuth() : undefined;
+        const faultInput = {
+            configs: [faultConfig, definition.faults],
+            counterKey,
+            scope,
+            conditionContext: baseCondition(params, authForFaults),
+            callCount,
+        };
+        // 4. Faults (before)
+        const before = await evaluateFaults(ctx, { ...faultInput, phase: "before" });
+        trace.faults.push(...before.applied);
+        const baseDelay = delayMs(delayConfig, ctx);
+        if (before.terminal) {
+            return applyTerminalFault(before, baseDelay + before.extraDelayMs, req, params, sessionId, ctx, tpl, trace, done, maxBody);
+        }
+        // 5. Sign-in requirement
+        let auth;
+        if (requirement !== "none") {
+            auth = await getAuth();
+            if (!auth.authenticated) {
+                trace.failureReason = "auth-required";
+                return done(renderOutcome(definition.userAuth?.responses?.unauthorized, {
+                    statusCode: 401,
+                    body: { error: "Unauthorized", message: auth.tokenError ? `Bearer token ${auth.tokenError}` : "Sign in and send Authorization: Bearer <token>" },
+                    headers: { "www-authenticate": 'Bearer realm="mock"' + (auth.tokenError ? ', error="invalid_token"' : "") },
+                }, scopeFor(req, params, sessionId, ctx, auth), tpl, maxBody), baseDelay + before.extraDelayMs);
+            }
+            trace.authSubject = auth.sub;
+            if (typeof requirement === "object" && Array.isArray(requirement.roles) && requirement.roles.length > 0) {
+                const role = auth.claims?.role;
+                if (typeof role !== "string" || !requirement.roles.includes(role)) {
+                    trace.failureReason = "forbidden";
+                    return done(renderOutcome(definition.userAuth?.responses?.forbidden, { statusCode: 403, body: { error: "Forbidden" } }, scopeFor(req, params, sessionId, ctx, auth), tpl, maxBody), baseDelay + before.extraDelayMs);
+                }
+            }
+        }
+        else if (definition.userAuth?.enabled && lookupHeader(req.headers, "authorization")) {
+            auth = await getAuth();
+            if (auth.authenticated)
+                trace.authSubject = auth.sub;
+        }
+        // 6. Body validation
+        if (validation?.mode === "schema" && validation.schema !== undefined && BODY_METHODS.has(method) && ctx.bodyValidator) {
+            const invalidFields = ctx.bodyValidator(validation.schema, req.body);
+            if (invalidFields) {
+                trace.failureReason = "request-validation-failed";
+                return done(jsonResponse(400, { error: "Request body validation failed", invalidFields }, maxBody), baseDelay + before.extraDelayMs);
+            }
+        }
+        const templateScope = scopeFor(req, params, sessionId, ctx, auth);
+        if (callCount.computed && callCount.value !== null)
+            templateScope.call = { count: callCount.value };
+        const dataRuntime = () => ({
+            definition,
+            scope,
+            store: store,
+            ctx,
+            tpl,
+            templateScope,
+            mountPath: req.mountPath,
+            requestPath: req.path,
+        });
+        const needsStore = () => store ? null : jsonResponse(500, { error: "This mock has data endpoints but no data store is configured" }, maxBody);
+        // Load auth.user lazily when a template asks for it.
+        const loadAuthUser = async (templates) => {
+            if (!auth?.authenticated || !auth.sub || !store || !definition.userAuth?.enabled)
+                return;
+            if (!templateReferences(templates, "auth.user"))
+                return;
+            const users = resourceByName(definition, definition.userAuth.usersResource);
+            if (!users)
+                return;
+            if ((await ensureNamespace()) === "session-limit")
+                return;
+            const doc = await store.get(scope, users.resourceId, keyFromParam(users, auth.sub));
+            const user = doc ? presentRecord(users, doc) : null;
+            templateScope.auth.user = user;
+        };
+        // 7–8. Variants, then execute
+        let response;
+        if (target.kind === "route") {
+            const route = target.route;
+            let variantResponse = null;
+            if (route.variants && route.variants.length > 0) {
+                const needAuth = route.variants.some((variant) => conditionNeedsAuth(variant.condition));
+                const condAuth = needAuth ? (auth ?? (await getAuth())) : auth;
+                const condition = baseCondition(params, condAuth);
+                const ordered = route.variants.slice().sort((a, b) => a.priority - b.priority);
+                for (const variant of ordered) {
+                    if (evaluateCondition(variant.condition, condition, ctx.regex)) {
+                        variantResponse = variant.response;
+                        trace.variantId = variant.variantId;
+                        break;
+                    }
+                }
+            }
+            if (variantResponse) {
+                response = await renderRouteResponse(variantResponse, templateScope, ctx, tpl, trace, maxBody, loadAuthUser);
+            }
+            else if (route.action) {
+                const missing = needsStore();
+                if (missing)
+                    return done(missing);
+                if ((await ensureNamespace()) === "session-limit")
+                    return sessionLimit();
+                const overrides = { ...(route.action.responses ?? {}) };
+                if (!overrides.success && route.response.type === "template") {
+                    overrides.success = { statusCode: route.response.statusCode, headers: route.response.headers, body: route.response.body };
+                }
+                await loadAuthUser(overrides);
+                const op = await runDataAction(dataRuntime(), route.action, req.rawQuery);
+                trace.action = { operation: route.action.operation, resource: route.action.resource, outcome: op.outcome, affected: op.affected };
+                response = renderOp(op, overrides, templateScope, tpl, maxBody, route.action.operation === "find" ? undefined : actionDefaults(route.action.operation, op));
+                if (op.status >= 400)
+                    trace.failureReason = `data-${op.outcome}`;
+            }
+            else {
+                response = await renderRouteResponse(route.response, templateScope, ctx, tpl, trace, maxBody, loadAuthUser);
+            }
+        }
+        else if (target.kind === "resource" || target.kind === "nested") {
+            const missing = needsStore();
+            if (missing)
+                return done(missing);
+            if ((await ensureNamespace()) === "session-limit")
+                return sessionLimit();
+            const rt = dataRuntime();
+            const op = await runResourceEndpoint(rt, target, params, req);
+            const resource = target.kind === "resource" ? target.resource : target.child;
+            const endpointName = target.endpoint;
+            const overrides = resource.endpoints[endpointName].responses ?? {};
+            await loadAuthUser(overrides);
+            trace.action = { operation: endpointName, resource: resource.name, outcome: op.outcome, affected: op.affected };
+            response = renderOp(op, overrides, templateScope, tpl, maxBody);
+            if (op.status >= 400)
+                trace.failureReason = `data-${op.outcome}`;
+        }
+        else {
+            const missing = needsStore();
+            if (missing)
+                return done(missing);
+            if ((await ensureNamespace()) === "session-limit")
+                return sessionLimit();
+            response = await runAuthEndpoint(target.op, dataRuntime(), req, auth, trace, maxBody);
+        }
+        // 9. Faults (after) — the handler ran; the answer is lost or delayed.
+        const after = await evaluateFaults(ctx, { ...faultInput, phase: "after" });
+        trace.faults.push(...after.applied);
+        const totalDelay = baseDelay + before.extraDelayMs + after.extraDelayMs;
+        if (after.terminal)
+            return applyTerminalFault(after, totalDelay, req, params, sessionId, ctx, tpl, trace, done, maxBody);
+        return done(response, totalDelay);
+    }
+    catch (error) {
+        if (error instanceof MockOpBudgetExceeded) {
+            trace.failureReason = "data-budget";
+            return done(jsonResponse(500, { error: "This request needed too many data operations" }, maxBody));
+        }
+        trace.failureReason = "data-error";
+        ctx.logger?.error("Mock engine request failed", {
+            mockId: ctx.mockId,
+            path: req.path,
+            message: error instanceof Error ? error.message : String(error),
+        });
+        return done(jsonResponse(503, { error: "Mock data store unavailable" }, maxBody));
+    }
+};
+// ── Pieces of the pipeline ────────────────────────────────────────────
+const conditionNeedsAuth = (condition) => !!condition && condition.rules.some((rule) => rule.field === "auth" || rule.field.startsWith("auth."));
+const faultsNeedAuth = (...configs) => configs.some((config) => config?.rules.some((rule) => rule.when?.condition && conditionNeedsAuth(rule.when.condition)));
+const scopeFor = (req, params, sessionId, ctx, auth) => ({
+    request: {
+        method: req.method.toUpperCase(),
+        path: req.path,
+        url: `${req.mountPath}${req.path}`,
+        params,
+        query: req.query,
+        headers: req.headers,
+        body: req.body,
+    },
+    state: ctx.legacyState?.snapshot() ?? {},
+    session: { id: sessionId },
+    mock: { id: ctx.mockId, ...(ctx.mockName ? { name: ctx.mockName } : {}) },
+    auth: auth?.authenticated
+        ? { authenticated: true, sub: auth.sub, claims: auth.claims ?? {} }
+        : { authenticated: false },
+});
+const resolveAuth = async (definition, req, ctx) => {
+    const config = definition.userAuth;
+    if (!config?.enabled)
+        return { authenticated: false };
+    const token = bearerToken(lookupHeader(req.headers, "authorization"));
+    if (!token)
+        return { authenticated: false };
+    const verified = await verifyMockJwt(ctx.crypto, await signingSecret(definition, ctx), token, {
+        nowSeconds: Math.floor(ctx.clock.now() / 1000),
+        issuer: config.issuer ?? `callman-mock/${ctx.mockId}`,
+        audience: config.audience,
+    });
+    if (!verified.ok)
+        return { authenticated: false, tokenError: verified.reason === "expired" ? "has expired" : "is invalid" };
+    return { authenticated: true, sub: verified.claims.sub, claims: verified.claims };
+};
+const renderRouteResponse = async (config, scope, ctx, tpl, trace, maxBody, loadAuthUser) => {
+    if (config.type === "builder") {
+        const state = ctx.legacyState?.snapshot() ?? {};
+        const built = renderLegacyBuilder(config, {
+            request: scope.request,
+            state,
+            random: ctx.random,
+            now: () => ctx.clock.now(),
+            maxBodyBytes: maxBody,
+        });
+        if (built.mutations && built.mutations.length > 0) {
+            if (!ctx.legacyState)
+                return jsonResponse(500, { error: "This mock's state cannot be saved here" }, maxBody);
+            try {
+                await ctx.legacyState.apply(built.mutations);
+                trace.legacyStateChanged = true;
+                applyLegacyMutationsInMemory(state, built.mutations);
+            }
+            catch (error) {
+                trace.failureReason = "state-write-failed";
+                ctx.logger?.error("Mock state mutation failed", { mockId: ctx.mockId, message: error instanceof Error ? error.message : String(error) });
+                return jsonResponse(500, { error: "Mock state could not be saved" }, maxBody);
+            }
+        }
+        return built.rendered;
+    }
+    if (config.type === "template")
+        await loadAuthUser([config.body, config.headers]);
+    return renderResponseConfig(config, scope, tpl, maxBody);
+};
+const actionDefaults = (operation, op) => {
+    if (op.status >= 400)
+        return undefined;
+    switch (operation) {
+        case "count":
+            return { statusCode: 200, body: { count: op.scope.total ?? 0 } };
+        case "delete":
+            return { statusCode: 204, body: null };
+        default:
+            return undefined;
+    }
+};
+const renderOp = (op, overrides, scope, tpl, maxBody, defaults) => {
+    const outcome = op.outcome;
+    const override = overrides[outcome] ?? (outcome === "created" ? overrides.success : undefined);
+    return renderOutcome(override, { statusCode: defaults?.statusCode ?? op.status, body: defaults?.body ?? op.body, headers: op.headers }, { ...scope, ...op.scope }, tpl, maxBody);
+};
+const coerceParam = (resource, field, raw) => {
+    const declared = resource.fields.find((f) => f.name === field);
+    if ((declared?.type === "integer" || declared?.type === "number") && /^-?\d+(\.\d+)?$/.test(raw))
+        return Number(raw);
+    return raw;
+};
+const runResourceEndpoint = async (rt, target, params, req) => {
+    const ownerStamp = (resource) => {
+        const sub = rt.templateScope.auth?.sub;
+        if (!resource.ownerField || sub === undefined)
+            return {};
+        return { [resource.ownerField]: coerceParam(resource, resource.ownerField, sub) };
+    };
+    if (target.kind === "nested") {
+        const parentValue = params[target.field] ?? "";
+        const parent = await findByLookup(rt, target.parent, parentValue);
+        if (!parent)
+            return notFoundResult(target.parent);
+        const parentId = parent.data[target.parent.idField];
+        if (target.endpoint === "list") {
+            const key = canonicalKey(parentId);
+            return listRecords(rt, target.child, req.rawQuery, key ? { ref: target.field, keys: [key] } : undefined);
+        }
+        return createRecord(rt, target.child, req.body, { ...ownerStamp(target.child), [target.field]: parentId });
+    }
+    const { resource, endpoint } = target;
+    const lookup = resource.lookupField ?? resource.idField;
+    const value = params[lookup] ?? "";
+    switch (endpoint) {
+        case "list":
+            return listRecords(rt, resource, req.rawQuery);
+        case "get":
+            return getRecord(rt, resource, value, req.rawQuery);
+        case "create":
+            return createRecord(rt, resource, req.body, ownerStamp(resource));
+        case "replace":
+        case "patch": {
+            const doc = await findByLookup(rt, resource, value);
+            if (!doc)
+                return notFoundResult(resource);
+            return writeRecord(rt, resource, doc, req.body, endpoint === "replace" ? "replace" : "patch");
+        }
+        case "delete": {
+            const doc = await findByLookup(rt, resource, value);
+            return deleteRecords(rt, resource, doc ? [doc] : []);
+        }
+        default:
+            return notFoundResult(resource);
+    }
+};
+const issueToken = async (definition, ctx, users, user) => {
+    const config = definition.userAuth;
+    const nowSeconds = Math.floor(ctx.clock.now() / 1000);
+    const claims = {
+        sub: String(user[users.idField]),
+        iat: nowSeconds,
+        exp: nowSeconds + config.tokenTtlSeconds,
+        iss: config.issuer ?? `callman-mock/${ctx.mockId}`,
+        ...(config.audience ? { aud: config.audience } : {}),
+    };
+    if (config.roleClaim && user[config.roleClaim] !== undefined)
+        claims.role = user[config.roleClaim];
+    for (const [claim, field] of Object.entries(config.claims ?? {})) {
+        if (user[field] !== undefined && !["sub", "iat", "exp", "iss", "aud"].includes(claim))
+            claims[claim] = user[field];
+    }
+    const token = await signMockJwt(ctx.crypto, await signingSecret(definition, ctx), claims);
+    return { token, expiresIn: config.tokenTtlSeconds };
+};
+const runAuthEndpoint = async (op, rt, req, auth, trace, maxBody) => {
+    const definition = rt.definition;
+    const config = definition.userAuth;
+    const users = resourceByName(definition, config.usersResource);
+    if (!users)
+        return jsonResponse(500, { error: `Sign-in is configured for an unknown resource "${config.usersResource}"` }, maxBody);
+    const scope = rt.templateScope;
+    if (op === "me") {
+        if (!auth?.sub)
+            return jsonResponse(401, { error: "Unauthorized" }, maxBody);
+        const doc = await rt.store.get(rt.scope, users.resourceId, keyFromParam(users, auth.sub));
+        if (!doc) {
+            trace.failureReason = "auth-required";
+            return jsonResponse(401, { error: "Unauthorized", message: "The signed-in user no longer exists" }, maxBody);
+        }
+        const user = presentRecord(users, doc);
+        return buildRendered(200, {}, user, maxBody);
+    }
+    if (op === "register") {
+        const created = await createRecord(rt, users, req.body);
+        if (created.outcome !== "created") {
+            trace.failureReason = `data-${created.outcome}`;
+            return renderOutcome(undefined, { statusCode: created.status, body: created.body }, { ...scope, ...created.scope }, rt.tpl, maxBody);
+        }
+        const user = created.scope.record;
+        const stored = await rt.store.get(rt.scope, users.resourceId, keyFromParam(users, String(user[users.idField])));
+        const { token, expiresIn } = await issueToken(definition, rt.ctx, users, stored?.data ?? user);
+        trace.authSubject = String(user[users.idField]);
+        return renderOutcome(config.responses?.loginSuccess, { statusCode: 201, body: { accessToken: token, tokenType: "Bearer", expiresIn, user } }, { ...scope, token, expiresIn, record: user }, rt.tpl, maxBody);
+    }
+    // login
+    const body = isPlainObject(req.body) ? req.body : {};
+    const identity = body[config.identityField];
+    const password = body[config.passwordField];
+    if (typeof identity !== "string" || identity === "" || typeof password !== "string") {
+        trace.failureReason = "data-validationError";
+        const invalid = [
+            ...(typeof identity !== "string" || identity === "" ? [{ field: config.identityField, message: "is required" }] : []),
+            ...(typeof password !== "string" ? [{ field: config.passwordField, message: "is required" }] : []),
+        ];
+        const failed = validationFailure(invalid);
+        return buildRendered(400, {}, failed.body, maxBody);
+    }
+    const identityField = users.fields.find((f) => f.name === config.identityField);
+    const filter = identityField?.uniqueCaseInsensitive
+        ? { field: config.identityField, op: "like", value: identity }
+        : { field: config.identityField, op: "eq", value: identity };
+    const { docs } = await rt.store.find(rt.scope, users.resourceId, { filter: andFilters(filter), limit: 5, noTotal: true });
+    const candidate = docs.find((doc) => {
+        const value = doc.data[config.identityField];
+        return typeof value === "string" && (identityField?.uniqueCaseInsensitive ? value.toLowerCase() === identity.toLowerCase() : value === identity);
+    });
+    const ok = candidate ? await verifyPassword(rt.ctx.crypto, candidate.data[config.passwordField], password) : false;
+    if (!candidate || !ok) {
+        trace.failureReason = "auth-failed";
+        return renderOutcome(config.responses?.loginFailure, { statusCode: 401, body: { error: "Invalid credentials" } }, scope, rt.tpl, maxBody);
+    }
+    const user = presentRecord(users, candidate);
+    const { token, expiresIn } = await issueToken(definition, rt.ctx, users, candidate.data);
+    trace.authSubject = String(candidate.data[users.idField]);
+    return renderOutcome(config.responses?.loginSuccess, { statusCode: 200, body: { accessToken: token, tokenType: "Bearer", expiresIn, user } }, { ...scope, token, expiresIn, record: user }, rt.tpl, maxBody);
+};
+const applyTerminalFault = (decision, delay, req, params, sessionId, ctx, tpl, trace, done, maxBody) => {
+    trace.failureReason = "fault-injected";
+    const terminal = decision.terminal;
+    if (terminal.kind === "timeout") {
+        return done(jsonResponse(504, { error: "Gateway Timeout" }, maxBody), 0, { kind: "hang", ms: terminal.ms });
+    }
+    if (terminal.kind === "drop") {
+        return done(jsonResponse(502, { error: "Connection dropped" }, maxBody), delay, { kind: "drop", mode: terminal.mode });
+    }
+    const status = terminal.response.statusCode ?? 500;
+    return done(renderOutcome(terminal.response, { statusCode: status, body: { error: STATUS_TEXT[status] ?? "Error", injected: true } }, scopeFor(req, params, sessionId, ctx), tpl, maxBody), delay);
+};
+const handleControl = async (req, definition, ctx, store, scope, sessionId, maxBody) => {
+    const sub = req.path.slice(MOCK_CONTROL_PREFIX.length);
+    const method = req.method.toUpperCase();
+    if (sub === "/session" || sub === "/session/reset") {
+        if (definition.sessions?.enabled === false)
+            return jsonResponse(404, { error: "Test sessions are turned off for this mock" }, maxBody);
+        if (!sessionId)
+            return jsonResponse(400, { error: "Send the X-Mock-Session header" }, maxBody);
+        if (!store)
+            return jsonResponse(500, { error: "No data store is configured" }, maxBody);
+        if (sub === "/session" && method === "GET") {
+            const info = (await store.listNamespaces(ctx.mockId)).find((ns) => ns.ns === scope.ns);
+            if (!info)
+                return jsonResponse(404, { error: "This session has no data yet" }, maxBody);
+            return jsonResponse(200, { id: sessionId, createdAt: info.createdAt, lastSeenAt: info.lastSeenAt, expiresAt: info.idleExpiresAt, recordCount: info.recordCount }, maxBody);
+        }
+        if (sub === "/session/reset" && method === "POST") {
+            if (definition.sessions?.allowPublicReset === false)
+                return jsonResponse(403, { error: "Resetting sessions from the mock URL is turned off" }, maxBody);
+            const plan = await seedPlanFor(definition, ctx);
+            await store.resetNamespace(scope, plan, ctx.clock.now());
+            await ctx.counters.reset(scope);
+            return jsonResponse(200, { reset: true, session: sessionId }, maxBody);
+        }
+    }
+    return jsonResponse(404, { error: "Unknown control endpoint" }, maxBody);
+};
+export class MockDataError extends Error {
+    status;
+    code;
+    constructor(status, message, code) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = "MockDataError";
+    }
+}
+export const createMockDataManager = (compiled, ctx) => {
+    const definition = compiled.definition;
+    if (!ctx.store)
+        throw new MockDataError(500, "No data store is configured", "MOCK_DATA_STORE_MISSING");
+    const store = ctx.store;
+    const tpl = { random: ctx.random, now: () => ctx.clock.now() };
+    const scopeOf = (session) => {
+        if (session && !MOCK_SESSION_ID_PATTERN.test(session))
+            throw new MockDataError(400, "Invalid session id", "MOCK_SESSION_INVALID");
+        return { mockId: ctx.mockId, ns: session ? `s:${session}` : "_" };
+    };
+    const resourceOf = (name) => {
+        const resource = resourceByName(definition, name);
+        if (!resource)
+            throw new MockDataError(404, `Unknown resource "${name}"`, "MOCK_RESOURCE_NOT_FOUND");
+        return resource;
+    };
+    const runtime = async (session) => {
+        const scope = scopeOf(session);
+        const ensured = await store.ensureNamespace(scope, () => seedPlanFor(definition, ctx), {
+            isSession: Boolean(session),
+            maxSessions: ctx.limits.maxSessions,
+            idleTtlMs: sessionIdleMs(definition, ctx),
+            now: ctx.clock.now(),
+        });
+        if (!ensured.ok)
+            throw new MockDataError(429, "Too many active test sessions", "MOCK_SESSION_LIMIT");
+        return {
+            definition,
+            scope,
+            store,
+            ctx,
+            tpl,
+            templateScope: { request: { method: "POST", params: {}, query: {}, headers: {} }, session: { id: session ?? null }, mock: { id: ctx.mockId } },
+            management: true,
+            mountPath: "",
+            requestPath: "",
+        };
+    };
+    return {
+        async listRecords(name, options = {}) {
+            const resource = resourceOf(name);
+            const rt = await runtime(options.session);
+            const query = options.rawQuery ?? [];
+            const hasLimit = query.some(([key]) => key === "_limit" || key === "_per_page");
+            const effective = hasLimit ? query : [...query, ["_limit", "50"]];
+            const op = await listRecords(rt, { ...resource, list: { ...resource.list, envelope: "array", filterMode: "any" } }, effective);
+            return {
+                items: op.scope.records ?? [],
+                total: Number(op.scope.total ?? 0),
+                page: Number(op.scope.page ?? 1),
+                limit: Number(op.scope.limit ?? 50),
+            };
+        },
+        async getRecord(name, id, session) {
+            const resource = resourceOf(name);
+            const rt = await runtime(session);
+            const doc = await rt.store.get(rt.scope, resource.resourceId, keyFromParam(resource, id));
+            return doc ? doc.data : null;
+        },
+        async insertRecords(name, records, session) {
+            const resource = resourceOf(name);
+            const rt = await runtime(session);
+            const inserted = [];
+            const errors = [];
+            for (let i = 0; i < records.length; i += 1) {
+                const op = await createRecord(rt, resource, records[i]);
+                if (op.outcome === "created")
+                    inserted.push(op.body);
+                else
+                    errors.push({ index: i, status: op.status, body: op.body });
+            }
+            return { inserted, errors };
+        },
+        async updateRecord(name, id, body, mode, session) {
+            const resource = resourceOf(name);
+            const rt = await runtime(session);
+            const doc = await rt.store.get(rt.scope, resource.resourceId, keyFromParam(resource, id));
+            if (!doc)
+                return { status: 404, body: { error: "Not found" } };
+            const op = await writeRecord(rt, resource, doc, body, mode);
+            return { status: op.status, body: op.body };
+        },
+        async deleteRecords(name, ids, session) {
+            const resource = resourceOf(name);
+            const rt = await runtime(session);
+            if (ids === "all") {
+                const deleted = await rt.store.clearResource(rt.scope, resource.resourceId);
+                return { status: 200, deleted };
+            }
+            const docs = await rt.store.getMany(rt.scope, resource.resourceId, ids.map((id) => keyFromParam(resource, id)));
+            if (docs.length === 0)
+                return { status: 404, deleted: 0, body: { error: "Not found" } };
+            const op = await deleteRecords(rt, resource, docs);
+            return { status: op.status, deleted: op.affected, ...(op.status >= 400 ? { body: op.body } : {}) };
+        },
+        async resetData(session) {
+            const scope = scopeOf(session);
+            const plan = await seedPlanFor(definition, ctx);
+            await store.resetNamespace(scope, plan, ctx.clock.now());
+            await ctx.counters.reset(scope);
+        },
+        async prepareData(addedResourceIds = []) {
+            if (definition.resources.length === 0)
+                return;
+            const shared = scopeOf(null);
+            const ensured = await store.ensureNamespace(shared, () => seedPlanFor(definition, ctx), {
+                isSession: false,
+                maxSessions: ctx.limits.maxSessions,
+                idleTtlMs: sessionIdleMs(definition, ctx),
+                now: ctx.clock.now(),
+            });
+            const added = addedResourceIds.filter((id) => definition.resources.some((resource) => resource.resourceId === id));
+            if ((ensured.ok && ensured.created) || added.length === 0)
+                return;
+            const plan = await seedPlanFor(definition, ctx);
+            const sessions = (await store.listNamespaces(ctx.mockId)).filter((ns) => ns.kind === "session" && ns.sessionId).map((ns) => scopeOf(ns.sessionId));
+            for (const scope of [shared, ...sessions]) {
+                for (const resourceId of added) {
+                    if ((await store.count(scope, resourceId, undefined, 1)) > 0)
+                        continue;
+                    for (const doc of plan.docs) {
+                        if (doc.resource === resourceId)
+                            await store.insert(scope, { ...doc, data: { ...doc.data } });
+                    }
+                    const sequence = plan.sequences[resourceId];
+                    if (sequence)
+                        await store.bumpSequence(scope, resourceId, sequence);
+                }
+            }
+        },
+        async listSessions() {
+            const namespaces = await store.listNamespaces(ctx.mockId);
+            return namespaces
+                .filter((ns) => ns.kind === "session" && ns.sessionId)
+                .map((ns) => ({ id: ns.sessionId, createdAt: ns.createdAt, lastSeenAt: ns.lastSeenAt, expiresAt: ns.idleExpiresAt, recordCount: ns.recordCount }));
+        },
+        async dropSession(session) {
+            const scope = scopeOf(session);
+            await store.dropNamespace(scope);
+            await ctx.counters.reset(scope);
+        },
+        async exportData(session) {
+            const rt = await runtime(session);
+            const out = {};
+            for (const resource of definition.resources) {
+                const { docs } = await rt.store.find(rt.scope, resource.resourceId, { limit: ctx.limits.maxRecordsPerResource, noTotal: true });
+                out[resource.name] = docs.map((doc) => doc.data);
+            }
+            return out;
+        },
+        async issueUserToken(userId, session) {
+            if (!definition.userAuth?.enabled)
+                return null;
+            const users = resourceByName(definition, definition.userAuth.usersResource);
+            if (!users)
+                return null;
+            const rt = await runtime(session);
+            const doc = await rt.store.get(rt.scope, users.resourceId, keyFromParam(users, userId));
+            if (!doc)
+                return null;
+            return issueToken(definition, ctx, users, doc.data);
+        },
+    };
+};
+export { generateMockSecret };
+//# sourceMappingURL=engine.js.map