@rogatio/cli 1.0.0

package/dist/node/index.js

@@ -0,0 +1,3928 @@
+#!/usr/bin/env node
+
+// packages/cli/src/index.ts
+import { realpathSync } from "node:fs";
+import { dirname as dirname6, resolve as resolve6 } from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
+
+// packages/cli/src/commands/edit.ts
+import { dirname as dirname2, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+// packages/cli/src/server/http.ts
+import { randomInt } from "node:crypto";
+import {
+  createServer as createHttpServer
+} from "node:http";
+var HttpServerError = class extends Error {
+  code;
+  constructor(code, message, cause) {
+    super(message, { cause });
+    this.name = "HttpServerError";
+    this.code = code;
+  }
+};
+function createServer(handler, options = {}) {
+  const server = createHttpServer(handler);
+  const preferredPort = options.port;
+  let port = null;
+  let started = false;
+  async function listenOn(candidatePort) {
+    await new Promise((resolve7, reject) => {
+      server.once("error", reject);
+      server.listen(candidatePort, "127.0.0.1", () => {
+        server.off("error", reject);
+        resolve7();
+      });
+    });
+  }
+  return {
+    get port() {
+      if (port === null)
+        throw new HttpServerError("not-started", "Server not started");
+      return port;
+    },
+    async start() {
+      if (started) return;
+      if (preferredPort !== void 0) {
+        try {
+          await listenOn(preferredPort);
+          port = preferredPort;
+          started = true;
+          return;
+        } catch (e) {
+          throw new HttpServerError(
+            "listen-failed",
+            `Failed to start server on port ${preferredPort}: ${e}`,
+            e
+          );
+        }
+      }
+      const maxRetries = 3;
+      let lastError = null;
+      for (let attempt = 0; attempt < maxRetries; attempt++) {
+        const candidatePort = randomInt(1024, 65535);
+        try {
+          await listenOn(candidatePort);
+          port = candidatePort;
+          started = true;
+          return;
+        } catch (e) {
+          lastError = e;
+          if (e.code !== "EADDRINUSE") {
+            throw new HttpServerError(
+              "listen-failed",
+              `Failed to start server: ${e}`,
+              e
+            );
+          }
+        }
+      }
+      throw new HttpServerError(
+        "port-exhausted",
+        `Failed to bind to port after ${maxRetries} attempts`,
+        lastError ?? void 0
+      );
+    },
+    async stop() {
+      if (!started) return;
+      await new Promise((resolve7) => {
+        server.close(() => resolve7());
+      });
+      started = false;
+    }
+  };
+}
+
+// packages/cli/src/server/routes.ts
+import { randomBytes } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { compileProject } from "@rogatio/compiler";
+
+// packages/dry-run/dist/node/index.js
+import { compileUrlRegex, HTTP_METHODS, RESOURCE_TYPES } from "@rogatio/schema";
+function parseTestUrl(input) {
+  if (typeof input !== "string" || input.length === 0) {
+    return { ok: false };
+  }
+  let url;
+  try {
+    url = new URL(input);
+  } catch {
+    return { ok: false };
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    return { ok: false };
+  }
+  if (url.origin === "null") {
+    return { ok: false };
+  }
+  return { ok: true, value: { origin: url.origin, href: url.href } };
+}
+var DEFAULT_MAX_CASES = 256;
+function invalidCase(index, message = "Test case is invalid") {
+  return {
+    code: "dryrun.invalid-case",
+    message,
+    ...index === void 0 ? {} : { index }
+  };
+}
+function invalidUrl(index, message = "Test case URL is invalid") {
+  return { code: "dryrun.invalid-url", message, index };
+}
+function invalidOptions() {
+  return invalidCase(void 0, "Dry-run options are invalid");
+}
+function ownPropertyNames(value) {
+  try {
+    const names = Object.getOwnPropertyNames(value);
+    const symbols = Object.getOwnPropertySymbols(value);
+    return symbols.length === 0 ? names : null;
+  } catch {
+    return null;
+  }
+}
+function dataProperty(value, key) {
+  try {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (descriptor === void 0) return { present: false, valid: true };
+    if (!("value" in descriptor) || descriptor.enumerable === false) {
+      return { present: true, valid: false };
+    }
+    return { present: true, value: descriptor.value, valid: true };
+  } catch {
+    return { present: true, valid: false };
+  }
+}
+function validateCase(raw, index) {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    return { ok: false, error: invalidCase(index) };
+  }
+  try {
+    const prototype = Object.getPrototypeOf(raw);
+    if (prototype !== Object.prototype && prototype !== null) {
+      return { ok: false, error: invalidCase(index) };
+    }
+  } catch {
+    return { ok: false, error: invalidCase(index) };
+  }
+  const names = ownPropertyNames(raw);
+  if (names === null) return { ok: false, error: invalidCase(index) };
+  const allowed = /* @__PURE__ */ new Set(["url", "method", "resourceType"]);
+  if (names.some((name) => !allowed.has(name))) {
+    return { ok: false, error: invalidCase(index) };
+  }
+  const urlProperty = dataProperty(raw, "url");
+  if (!urlProperty.valid) return { ok: false, error: invalidCase(index) };
+  if (!urlProperty.present) {
+    return { ok: false, error: invalidCase(index) };
+  }
+  if (typeof urlProperty.value !== "string") {
+    return { ok: false, error: invalidUrl(index) };
+  }
+  const url = urlProperty.value;
+  if (url.length === 0) return { ok: false, error: invalidUrl(index) };
+  const methodProperty = dataProperty(raw, "method");
+  const resourceTypeProperty = dataProperty(raw, "resourceType");
+  if (!methodProperty.valid || !resourceTypeProperty.valid) {
+    return { ok: false, error: invalidCase(index) };
+  }
+  const method = methodProperty.value;
+  if (methodProperty.present && (typeof method !== "string" || !HTTP_METHODS.includes(method))) {
+    return { ok: false, error: invalidCase(index) };
+  }
+  const resourceType = resourceTypeProperty.value;
+  if (resourceTypeProperty.present && (typeof resourceType !== "string" || !RESOURCE_TYPES.includes(resourceType))) {
+    return { ok: false, error: invalidCase(index) };
+  }
+  return {
+    ok: true,
+    value: {
+      url,
+      method,
+      resourceType
+    }
+  };
+}
+function safePreview(fn, operation, url, testCase) {
+  try {
+    return fn(operation, url, testCase);
+  } catch {
+    return null;
+  }
+}
+function buildDimension(state, detail) {
+  return {
+    state,
+    matched: state === "not-applicable" ? null : state === "matched",
+    detail
+  };
+}
+function emptySummary() {
+  return {
+    caseCount: 0,
+    urlCount: 0,
+    matchedUrlCount: 0,
+    matchedRuleTotal: 0
+  };
+}
+function normalizeOptions(raw) {
+  if (raw === void 0) {
+    return { ok: true, maxCases: DEFAULT_MAX_CASES };
+  }
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    return { ok: false };
+  }
+  try {
+    const prototype = Object.getPrototypeOf(raw);
+    if (prototype !== Object.prototype && prototype !== null)
+      return { ok: false };
+  } catch {
+    return { ok: false };
+  }
+  const names = ownPropertyNames(raw);
+  if (names === null || names.some((name) => !["maxCases", "previewAction"].includes(name))) {
+    return { ok: false };
+  }
+  const maxCasesProperty = dataProperty(raw, "maxCases");
+  const previewProperty = dataProperty(raw, "previewAction");
+  if (!maxCasesProperty.valid || !previewProperty.valid) return { ok: false };
+  let maxCases = DEFAULT_MAX_CASES;
+  if (maxCasesProperty.present) {
+    if (typeof maxCasesProperty.value !== "number" || !Number.isSafeInteger(maxCasesProperty.value) || maxCasesProperty.value <= 0) {
+      return { ok: false };
+    }
+    maxCases = maxCasesProperty.value;
+  }
+  let previewAction;
+  if (previewProperty.present) {
+    if (previewProperty.value !== void 0 && typeof previewProperty.value !== "function") {
+      return { ok: false };
+    }
+    previewAction = previewProperty.value;
+  }
+  return { ok: true, maxCases, previewAction };
+}
+function dryRunProject(operations, cases, options) {
+  const normalizedOptions = normalizeOptions(options);
+  if (!normalizedOptions.ok) {
+    return { results: [], errors: [invalidOptions()], summary: emptySummary() };
+  }
+  const errors = [];
+  if (!Array.isArray(cases)) {
+    return {
+      results: [],
+      errors: [invalidCase(void 0, "Test cases must be an array")],
+      summary: emptySummary()
+    };
+  }
+  let caseCount;
+  try {
+    caseCount = cases.length;
+    if (caseCount > normalizedOptions.maxCases) {
+      return {
+        results: [],
+        errors: [
+          {
+            code: "dryrun.batch-limit",
+            message: `Test batch exceeds maxCases (${normalizedOptions.maxCases})`
+          }
+        ],
+        summary: emptySummary()
+      };
+    }
+    for (let index = 0; index < caseCount; index += 1) {
+      if (!Object.hasOwn(cases, index)) {
+        return {
+          results: [],
+          errors: [invalidCase(index)],
+          summary: emptySummary()
+        };
+      }
+    }
+  } catch {
+    return { results: [], errors: [invalidCase()], summary: emptySummary() };
+  }
+  const validCases = [];
+  for (let index = 0; index < caseCount; index += 1) {
+    let raw;
+    try {
+      raw = cases[index];
+    } catch {
+      errors.push(invalidCase(index));
+      continue;
+    }
+    const result = validateCase(raw, index);
+    if (result.ok) {
+      validCases.push({ value: result.value, index });
+    } else {
+      errors.push(result.error);
+    }
+  }
+  const regexCache = /* @__PURE__ */ new Map();
+  const getRegex = (source) => {
+    let cached = regexCache.get(source);
+    if (cached === void 0) {
+      cached = compileUrlRegex(source);
+      regexCache.set(source, cached);
+    }
+    return cached;
+  };
+  const results = [];
+  let matchedUrlCount = 0;
+  let matchedRuleTotal = 0;
+  for (const validCase of validCases) {
+    const testCase = validCase.value;
+    const parsed = parseTestUrl(testCase.url);
+    if (!parsed.ok) {
+      errors.push(invalidUrl(validCase.index));
+      continue;
+    }
+    const rules = [];
+    for (const op of operations) {
+      const matcher = op.matcher;
+      const regex = getRegex(matcher.urlRegex.source);
+      const regexState = regex ? regex.test(testCase.url) ? "matched" : "unmatched" : "unmatched";
+      const originState = matcher.origins.includes(
+        parsed.value.origin
+      ) ? "matched" : "unmatched";
+      const methodState = testCase.method === void 0 ? "not-applicable" : matcher.method === void 0 || matcher.method === testCase.method ? "matched" : "unmatched";
+      const resourceState = testCase.resourceType === void 0 ? "not-applicable" : matcher.resourceTypes.length === 0 || matcher.resourceTypes.includes(testCase.resourceType) ? "matched" : "unmatched";
+      const matched = regexState === "matched" && originState === "matched" && methodState !== "unmatched" && resourceState !== "unmatched";
+      const urlRegexDim = buildDimension(
+        regexState,
+        regexState === "matched" ? `matches /${matcher.urlRegex.source}/` : `does not match /${matcher.urlRegex.source}/`
+      );
+      const originDim = buildDimension(
+        originState,
+        originState === "matched" ? `origin ${parsed.value.origin} in [${matcher.origins.join(", ")}]` : `origin ${parsed.value.origin} not in [${matcher.origins.join(", ")}]`
+      );
+      const methodDim = buildDimension(
+        methodState,
+        methodState === "not-applicable" ? "method not specified" : methodState === "matched" ? matcher.method === void 0 ? "rule has no method constraint" : `method ${testCase.method} matches` : `rule method ${matcher.method} != ${testCase.method}`
+      );
+      const resourceDim = buildDimension(
+        resourceState,
+        resourceState === "not-applicable" ? "resource type not specified" : resourceState === "matched" ? matcher.resourceTypes.length === 0 ? "rule has no resource type constraint" : `resource type ${testCase.resourceType} matches` : `rule resource types [${matcher.resourceTypes.join(", ")}] exclude ${testCase.resourceType}`
+      );
+      const actionPreview = normalizedOptions.previewAction ? safePreview(
+        normalizedOptions.previewAction,
+        op,
+        testCase.url,
+        testCase
+      ) : null;
+      rules.push({
+        groupId: op.groupId,
+        ruleId: op.ruleId,
+        matched,
+        urlRegex: urlRegexDim,
+        effectiveOrigin: originDim,
+        method: methodDim,
+        resourceType: resourceDim,
+        actionPreview
+      });
+    }
+    const matchedRuleCount = rules.filter((rule) => rule.matched).length;
+    results.push({
+      url: testCase.url,
+      rules,
+      matchedRuleCount
+    });
+    if (matchedRuleCount > 0) {
+      matchedUrlCount += 1;
+    }
+    matchedRuleTotal += matchedRuleCount;
+  }
+  return {
+    results,
+    errors,
+    summary: {
+      caseCount: validCases.length,
+      urlCount: results.length,
+      matchedUrlCount,
+      matchedRuleTotal
+    }
+  };
+}
+
+// packages/cli/src/server/routes.ts
+import { validateProjectDetailed } from "@rogatio/schema";
+
+// packages/cli/src/utils/mock-preview.ts
+import { basename } from "node:path";
+function createMockPreviewAction(operations) {
+  const mockByRuleId = /* @__PURE__ */ new Map();
+  for (const operation of operations) {
+    if (operation.kind === "mock") {
+      mockByRuleId.set(operation.ruleId, operation);
+    }
+  }
+  return (operation, _url, _testCase) => {
+    const mock = mockByRuleId.get(operation.ruleId);
+    if (mock === void 0) return null;
+    if (mock.mock.body !== void 0) {
+      return {
+        kind: "mock",
+        summary: `Mock ${mock.mock.status} (inline body, ${Buffer.byteLength(
+          mock.mock.body,
+          "utf8"
+        )} bytes)`
+      };
+    }
+    return {
+      kind: "mock",
+      summary: `Mock ${mock.mock.status} (file snapshot: ${basename(
+        mock.mock.file ?? ""
+      )})`
+    };
+  };
+}
+
+// packages/cli/src/server/routes.ts
+function generateCsrfToken() {
+  return randomBytes(16).toString("hex");
+}
+function validateCsrf(req, expectedToken) {
+  const token = req.headers["x-csrf-token"];
+  return token === expectedToken;
+}
+var MAX_REQUEST_BODY_BYTES = 8 * 1024 * 1024;
+var RequestBodyError = class extends Error {
+  code = "request-body-too-large";
+};
+function getRequestBody(req) {
+  return new Promise((resolve7, reject) => {
+    let body = "";
+    let bytes = 0;
+    let settled = false;
+    const contentLength = req.headers["content-length"];
+    const declaredLength = Array.isArray(contentLength) ? Number(contentLength[0]) : Number(contentLength);
+    if (Number.isFinite(declaredLength) && declaredLength > MAX_REQUEST_BODY_BYTES) {
+      reject(new RequestBodyError());
+      return;
+    }
+    req.on("data", (chunk) => {
+      if (settled) return;
+      try {
+        const text = typeof chunk === "string" ? chunk : chunk.toString("utf8");
+        bytes += Buffer.byteLength(text);
+        if (bytes > MAX_REQUEST_BODY_BYTES) {
+          settled = true;
+          reject(new RequestBodyError());
+          req.resume();
+          return;
+        }
+        body += text;
+      } catch (error) {
+        settled = true;
+        reject(error);
+      }
+    });
+    req.on("end", () => {
+      if (!settled) {
+        settled = true;
+        resolve7(body);
+      }
+    });
+    req.on("error", (error) => {
+      if (!settled) {
+        settled = true;
+        reject(error);
+      }
+    });
+  });
+}
+function bodyErrorResponse(error) {
+  if (error instanceof RequestBodyError) {
+    return {
+      status: 413,
+      body: {
+        code: error.code,
+        message: "Request body exceeds the maximum size"
+      }
+    };
+  }
+  return {
+    status: 400,
+    body: { code: "invalid-json", message: "Invalid JSON body" }
+  };
+}
+function toMatcherOperations(operations) {
+  return operations.map(({ groupId, ruleId, matcher }) => ({
+    kind: "matcher",
+    groupId,
+    ruleId,
+    matcher
+  }));
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseUrl(req) {
+  const url = new URL(
+    req.url || "/",
+    `http://${req.headers.host || "localhost"}`
+  );
+  return { pathname: url.pathname, searchParams: url.searchParams };
+}
+function parseDiagnostics(result) {
+  if (!result.valid) {
+    return result.errors.map((e) => ({
+      code: `schema.${e.keyword}`,
+      severity: "error",
+      path: e.instancePath || "/",
+      message: e.message,
+      params: e.params
+    }));
+  }
+  return [];
+}
+function parseCompilerDiagnostics(result) {
+  if (!result.ok) {
+    return result.diagnostics.map((d) => ({
+      code: d.code,
+      severity: d.severity,
+      path: d.path,
+      message: d.message,
+      params: d.params
+    }));
+  }
+  return [];
+}
+function createRoutes(context) {
+  return async function handleRequest(req, res) {
+    const { pathname } = parseUrl(req);
+    const method = req.method || "GET";
+    const corsHeaders = {
+      "Access-Control-Allow-Origin": "http://127.0.0.1:*",
+      "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
+      "Access-Control-Allow-Headers": "Content-Type, X-CSRF-Token"
+    };
+    if (method === "OPTIONS") {
+      res.writeHead(204, corsHeaders);
+      res.end();
+      return;
+    }
+    if (pathname === "/editor.html" && method === "GET") {
+      res.writeHead(200, {
+        "Content-Type": "text/html; charset=utf-8",
+        ...corsHeaders
+      });
+      res.end(context.editorHtml);
+      return;
+    }
+    if (pathname === "/vendor/editor.js" && method === "GET") {
+      try {
+        const bundle = await readFile(context.editorBundlePath, "utf-8");
+        res.writeHead(200, {
+          "Content-Type": "text/javascript; charset=utf-8",
+          ...corsHeaders
+        });
+        res.end(bundle);
+      } catch (e) {
+        res.writeHead(500, { "Content-Type": "application/json" });
+        res.end(
+          JSON.stringify({
+            code: "bundle-load-failed",
+            message: e instanceof Error ? e.message : "Failed to load editor bundle"
+          })
+        );
+      }
+      return;
+    }
+    if (pathname === "/api/project" && method === "GET") {
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify(context.project));
+      return;
+    }
+    if (pathname === "/api/validate" && method === "POST") {
+      if (!validateCsrf(req, context.csrfToken)) {
+        res.writeHead(403, { "Content-Type": "application/json" });
+        res.end(
+          JSON.stringify({
+            code: "csrf-invalid",
+            message: "Invalid CSRF token"
+          })
+        );
+        return;
+      }
+      let body;
+      try {
+        const bodyText = await getRequestBody(req);
+        body = JSON.parse(bodyText);
+      } catch (error) {
+        const failure2 = bodyErrorResponse(error);
+        res.writeHead(failure2.status, { "Content-Type": "application/json" });
+        res.end(JSON.stringify(failure2.body));
+        return;
+      }
+      const schemaResult = validateProjectDetailed(body);
+      const diagnostics = [...parseDiagnostics(schemaResult)];
+      if (schemaResult.valid) {
+        const compileResult = compileProject(schemaResult.data);
+        diagnostics.push(...parseCompilerDiagnostics(compileResult));
+      }
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ diagnostics }));
+      return;
+    }
+    if (pathname === "/api/save" && method === "POST") {
+      if (!validateCsrf(req, context.csrfToken)) {
+        res.writeHead(403, { "Content-Type": "application/json" });
+        res.end(
+          JSON.stringify({
+            code: "csrf-invalid",
+            message: "Invalid CSRF token"
+          })
+        );
+        return;
+      }
+      let body;
+      try {
+        const bodyText = await getRequestBody(req);
+        body = JSON.parse(bodyText);
+      } catch (error) {
+        const failure2 = bodyErrorResponse(error);
+        res.writeHead(failure2.status, { "Content-Type": "application/json" });
+        res.end(JSON.stringify(failure2.body));
+        return;
+      }
+      const schemaResult = validateProjectDetailed(body);
+      if (!schemaResult.valid) {
+        res.writeHead(400, { "Content-Type": "application/json" });
+        res.end(
+          JSON.stringify({
+            code: "validation-failed",
+            message: "Project validation failed",
+            diagnostics: parseDiagnostics(schemaResult)
+          })
+        );
+        return;
+      }
+      const compileResult = compileProject(schemaResult.data);
+      if (!compileResult.ok) {
+        res.writeHead(400, { "Content-Type": "application/json" });
+        res.end(
+          JSON.stringify({
+            code: "compilation-failed",
+            message: "Project compilation failed",
+            diagnostics: parseCompilerDiagnostics(compileResult)
+          })
+        );
+        return;
+      }
+      try {
+        await context.writeProject(context.filePath, body);
+        context.project = body;
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ ok: true }));
+        return;
+      } catch (e) {
+        res.writeHead(500, { "Content-Type": "application/json" });
+        res.end(
+          JSON.stringify({
+            code: "write-failed",
+            message: e instanceof Error ? e.message : "Failed to write file"
+          })
+        );
+        return;
+      }
+    }
+    if (pathname === "/api/cancel" && method === "POST") {
+      if (!validateCsrf(req, context.csrfToken)) {
+        res.writeHead(403, { "Content-Type": "application/json" });
+        res.end(
+          JSON.stringify({
+            code: "csrf-invalid",
+            message: "Invalid CSRF token"
+          })
+        );
+        return;
+      }
+      context.shutdown();
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ ok: true }));
+      return;
+    }
+    if (pathname === "/api/dry-run" && method === "POST") {
+      if (!validateCsrf(req, context.csrfToken)) {
+        res.writeHead(403, { "Content-Type": "application/json" });
+        res.end(
+          JSON.stringify({
+            code: "csrf-invalid",
+            message: "Invalid CSRF token"
+          })
+        );
+        return;
+      }
+      let body;
+      try {
+        const bodyText = await getRequestBody(req);
+        body = JSON.parse(bodyText);
+      } catch (error) {
+        const failure2 = bodyErrorResponse(error);
+        res.writeHead(failure2.status, { "Content-Type": "application/json" });
+        res.end(JSON.stringify(failure2.body));
+        return;
+      }
+      if (!isRecord(body) || !isRecord(body.project)) {
+        res.writeHead(400, { "Content-Type": "application/json" });
+        res.end(
+          JSON.stringify({
+            code: "invalid-project",
+            message: "Missing or invalid project"
+          })
+        );
+        return;
+      }
+      if (!Array.isArray(body.cases)) {
+        res.writeHead(400, { "Content-Type": "application/json" });
+        res.end(
+          JSON.stringify({
+            code: "invalid-cases",
+            message: "Cases must be an array"
+          })
+        );
+        return;
+      }
+      const schemaResult = validateProjectDetailed(body.project);
+      if (!schemaResult.valid) {
+        res.writeHead(400, { "Content-Type": "application/json" });
+        res.end(
+          JSON.stringify({
+            code: "validation-failed",
+            message: "Project validation failed",
+            diagnostics: parseDiagnostics(schemaResult)
+          })
+        );
+        return;
+      }
+      const compileResult = compileProject(schemaResult.data);
+      if (!compileResult.ok) {
+        res.writeHead(400, { "Content-Type": "application/json" });
+        res.end(
+          JSON.stringify({
+            code: "compilation-failed",
+            message: "Project compilation failed",
+            diagnostics: parseCompilerDiagnostics(compileResult)
+          })
+        );
+        return;
+      }
+      const result = dryRunProject(
+        toMatcherOperations(compileResult.operations),
+        body.cases,
+        {
+          ...body.options ?? {},
+          previewAction: createMockPreviewAction(compileResult.operations)
+        }
+      );
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify(result));
+      return;
+    }
+    res.writeHead(404, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ code: "not-found", message: "Not found" }));
+  };
+}
+
+// packages/cli/src/utils/browser.ts
+import { spawn } from "node:child_process";
+var BrowserLaunchError = class extends Error {
+  platform;
+  constructor(platform, message) {
+    super(message);
+    this.name = "BrowserLaunchError";
+    this.platform = platform;
+  }
+};
+async function launchBrowser(url) {
+  const platform = process.platform;
+  let command;
+  let args;
+  switch (platform) {
+    case "darwin":
+      command = "open";
+      args = [url];
+      break;
+    case "win32":
+      command = "cmd";
+      args = ["/c", "start", "", url];
+      break;
+    case "linux":
+    case "freebsd":
+    case "openbsd":
+    case "sunos":
+      command = "xdg-open";
+      args = [url];
+      break;
+    default:
+      throw new BrowserLaunchError(
+        platform,
+        `Unsupported platform: ${platform}`
+      );
+  }
+  return new Promise((resolve7) => {
+    const child = spawn(command, args, {
+      detached: true,
+      stdio: "ignore"
+    });
+    child.unref();
+    child.on("error", (err) => {
+      if (err.code === "ENOENT") {
+        resolve7(false);
+      } else {
+        resolve7(false);
+      }
+    });
+    child.on("close", (code) => {
+      resolve7(code === 0);
+    });
+  });
+}
+
+// packages/cli/src/utils/file.ts
+import { randomBytes as randomBytes2 } from "node:crypto";
+import { mkdir, readFile as readFile2, rename, writeFile } from "node:fs/promises";
+import { basename as basename2, dirname, join } from "node:path";
+var ProjectFileError = class extends Error {
+  code;
+  path;
+  constructor(code, path, message, cause) {
+    super(message, { cause });
+    this.name = "ProjectFileError";
+    this.code = code;
+    this.path = path;
+  }
+};
+async function readProject(path) {
+  try {
+    const content = await readFile2(path, "utf-8");
+    const parsed = JSON.parse(content);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      throw new ProjectFileError(
+        "invalid-format",
+        path,
+        "Project file must contain a JSON object"
+      );
+    }
+    return parsed;
+  } catch (e) {
+    if (e instanceof ProjectFileError) throw e;
+    if (e.code === "ENOENT") {
+      throw new ProjectFileError(
+        "not-found",
+        path,
+        "Project file not found",
+        e
+      );
+    }
+    if (e instanceof SyntaxError) {
+      throw new ProjectFileError(
+        "invalid-json",
+        path,
+        "Project file contains invalid JSON",
+        e
+      );
+    }
+    throw new ProjectFileError(
+      "read-failed",
+      path,
+      "Failed to read project file",
+      e
+    );
+  }
+}
+async function writeProject(path, data) {
+  const tempName = `.${basename2(dirname(path))}.${randomBytes2(8).toString("hex")}.tmp`;
+  const tempPath = join(dirname(path), tempName);
+  try {
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(tempPath, JSON.stringify(data, null, 2), "utf-8");
+    await rename(tempPath, path);
+  } catch (e) {
+    try {
+      await import("node:fs/promises").then((fs) => fs.unlink(tempPath));
+    } catch {
+    }
+    if (e.code === "EISDIR") {
+      throw new ProjectFileError(
+        "is-directory",
+        path,
+        "Target path is a directory",
+        e
+      );
+    }
+    throw new ProjectFileError(
+      "write-failed",
+      path,
+      "Failed to write project file",
+      e
+    );
+  }
+}
+
+// packages/cli/src/commands/edit.ts
+var __dirname = dirname2(fileURLToPath(import.meta.url));
+async function editCommand(args, options = {}) {
+  const customLaunchBrowser = options.launchBrowser;
+  const positionalArgs = [];
+  let port;
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === "--port" && i + 1 < args.length) {
+      port = parseInt(args[++i], 10);
+      if (Number.isNaN(port)) {
+        console.error("Error: Invalid port number");
+        return { exitCode: Promise.resolve(2), shutdown: () => {
+        } };
+      }
+    } else if (!arg.startsWith("-")) {
+      positionalArgs.push(arg);
+    } else if (arg === "--help") {
+      console.log(`Usage: rogatio edit [options] [path]
+Options:
+  --port <n>    Fixed port (default: random)
+  --help        Show help`);
+      return { exitCode: Promise.resolve(0), shutdown: () => {
+      } };
+    } else {
+      console.error(`Error: Unknown option: ${arg}`);
+      return { exitCode: Promise.resolve(2), shutdown: () => {
+      } };
+    }
+  }
+  if (positionalArgs.length > 1) {
+    console.error("Error: Too many arguments");
+    return { exitCode: Promise.resolve(2), shutdown: () => {
+    } };
+  }
+  let filePath;
+  if (positionalArgs[0]) {
+    filePath = resolve(positionalArgs[0]);
+  } else {
+    filePath = resolve(process.cwd(), ".rogatio.json");
+  }
+  try {
+    const stat3 = await import("node:fs/promises").then(
+      (fs) => fs.stat(filePath)
+    );
+    if (stat3.isDirectory()) {
+      console.error("Error: Path is a directory");
+      return { exitCode: Promise.resolve(2), shutdown: () => {
+      } };
+    }
+  } catch (e) {
+    if (e.code !== "ENOENT") {
+      console.error(`Error: ${e}`);
+      return { exitCode: Promise.resolve(2), shutdown: () => {
+      } };
+    }
+  }
+  let projectData;
+  let isNewFile = false;
+  try {
+    projectData = await readProject(filePath);
+  } catch (e) {
+    if (e instanceof ProjectFileError && e.code === "not-found") {
+      projectData = { version: 1, name: "", groups: [] };
+      isNewFile = true;
+    } else {
+      console.error(`Error: ${e}`);
+      return { exitCode: Promise.resolve(2), shutdown: () => {
+      } };
+    }
+  }
+  if (isNewFile) {
+    try {
+      await writeProject(filePath, projectData);
+    } catch (e) {
+      console.error(`Error writing initial project: ${e}`);
+      return { exitCode: Promise.resolve(2), shutdown: () => {
+      } };
+    }
+  }
+  const csrfToken = generateCsrfToken();
+  const context = {
+    project: projectData,
+    filePath,
+    csrfToken,
+    writeProject,
+    shutdown: () => {
+      shutdown();
+    },
+    editorHtml: "",
+    editorBundlePath: ""
+  };
+  let server;
+  try {
+    server = createServer(
+      createRoutes(context),
+      port !== void 0 ? { port } : {}
+    );
+    await server.start();
+  } catch (e) {
+    console.error(`Error starting server: ${e}`);
+    return { exitCode: Promise.resolve(2), shutdown: () => {
+    } };
+  }
+  const serverUrl = `http://127.0.0.1:${server.port}`;
+  const editorUrl = `${serverUrl}/editor.html`;
+  let editorBundlePath;
+  try {
+    editorBundlePath = fileURLToPath(import.meta.resolve("@rogatio/editor"));
+  } catch (e) {
+    console.error(`Error: cannot resolve @rogatio/editor bundle: ${e}`);
+    await server.stop();
+    return { exitCode: Promise.resolve(2), shutdown: () => {
+    } };
+  }
+  context.editorHtml = generateEditorHtml(serverUrl, csrfToken, filePath);
+  context.editorBundlePath = editorBundlePath;
+  let shutdownCalled = false;
+  function shutdown() {
+    shutdownCalled = true;
+    server.stop();
+  }
+  const browserLaunched = await (customLaunchBrowser ?? launchBrowser)(
+    editorUrl
+  );
+  if (!browserLaunched) {
+    console.log(`Editor available at: ${editorUrl}`);
+    console.log("Open this URL in your browser to edit the project.");
+  }
+  const exitCodePromise = new Promise((resolve7) => {
+    const checkShutdown = setInterval(() => {
+      if (shutdownCalled) {
+        clearInterval(checkShutdown);
+        resolve7(0);
+      }
+    }, 100);
+    const handleSignal = () => {
+      shutdown();
+    };
+    process.on("SIGINT", handleSignal);
+    process.on("SIGTERM", handleSignal);
+    const originalResolve = resolve7;
+    resolve7 = (code) => {
+      clearInterval(checkShutdown);
+      process.off("SIGINT", handleSignal);
+      process.off("SIGTERM", handleSignal);
+      originalResolve(code);
+    };
+  });
+  return {
+    exitCode: exitCodePromise,
+    shutdown
+  };
+}
+function generateEditorHtml(apiBase, csrfToken, filePath) {
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Rogatio Editor</title>
+  <style>
+    body { margin: 0; font-family: system-ui, sans-serif; }
+    #editor-root { width: 100vw; height: 100vh; }
+  </style>
+</head>
+<body>
+   <div id="editor-root"></div>
+   <script type="importmap">
+     { "imports": { "@rogatio/editor": "/vendor/editor.js" } }
+   </script>
+   <script type="module">
+      import { createEditor, createMockRuleType, createRedirectRuleType, createResponseBodyRuleType } from '@rogatio/editor';
+    
+    const root = document.getElementById('editor-root');
+    const apiBase = '${apiBase}';
+    const csrfToken = '${csrfToken}';
+    const filePath = '${filePath}';
+    
+    async function fetchProject() {
+      const res = await fetch(apiBase + '/api/project');
+      return res.json();
+    }
+    
+    async function validateProject(project) {
+      const res = await fetch(apiBase + '/api/validate', {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          'X-CSRF-Token': csrfToken,
+        },
+        body: JSON.stringify(project),
+      });
+      return res.json();
+    }
+    
+    async function saveProject(project) {
+      const res = await fetch(apiBase + '/api/save', {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          'X-CSRF-Token': csrfToken,
+        },
+        body: JSON.stringify(project),
+      });
+      return res.json();
+    }
+    
+    async function cancel() {
+      await fetch(apiBase + '/api/cancel', {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          'X-CSRF-Token': csrfToken,
+        },
+        body: '{}',
+      });
+    }
+    
+    const project = await fetchProject();
+    
+    const editor = createEditor(root, {
+      ruleTypes: [createRedirectRuleType(), createMockRuleType(), createResponseBodyRuleType()],
+      initialProject: project,
+      validate: async (value) => {
+        const result = await validateProject(value);
+        return result.diagnostics.map((d: any) => ({
+          code: d.code,
+          severity: d.severity,
+          path: d.path,
+          message: d.message,
+        }));
+      },
+      save: async (project) => {
+        const result = await saveProject(project);
+        if (result.ok) {
+          return { ok: true };
+        }
+        return { ok: false, code: result.code, message: result.message };
+      },
+      dryRun: async (currentProject, cases, options) => {
+        const res = await fetch(apiBase + '/api/dry-run', {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+            'X-CSRF-Token': csrfToken,
+          },
+          body: JSON.stringify({ project: currentProject, cases, options }),
+        });
+        return res.json();
+      },
+      onCancel: () => {
+        cancel();
+      },
+    });
+  </script>
+</body>
+</html>`;
+}
+
+// packages/cli/src/commands/runtime.ts
+import { dirname as dirname4, isAbsolute, join as join3, relative, resolve as resolve3, sep as sep2 } from "node:path";
+import { compileProject as compileProject2 } from "@rogatio/compiler";
+
+// packages/runtime/dist/node/index.js
+import { HTTP_METHODS as HTTP_METHODS2 } from "@rogatio/schema";
+import { isIP as isIP2 } from "node:net";
+import { normalizeSiteOrigin } from "@rogatio/schema";
+import { normalizeSiteOrigin as normalizeSiteOrigin2 } from "@rogatio/schema";
+import {
+  compileUrlRegex as compileUrlRegex2,
+  normalizeSiteOrigin as normalizeSiteOrigin3
+} from "@rogatio/schema";
+import { mkdir as mkdir2, readFile as readFile3, rename as rename2, rm, stat, writeFile as writeFile2 } from "node:fs/promises";
+import { basename as basename3, dirname as dirname3, isAbsolute as isAbsolute2, join as join2, relative as relative2 } from "node:path";
+import { generateKeyPairSync } from "node:crypto";
+import {
+  compileUrlRegex as compileUrlRegex22,
+  HTTP_METHODS as HTTP_METHODS22,
+  LIMITS,
+  normalizeSiteOrigin as normalizeSiteOrigin4,
+  RESOURCE_TYPES as RESOURCE_TYPES2
+} from "@rogatio/schema";
+import { createHash as createHash2 } from "node:crypto";
+import { LIMITS as LIMITS2 } from "@rogatio/schema";
+import { LIMITS as LIMITS3 } from "@rogatio/schema";
+import { createServer as createServer2 } from "node:http";
+import { isAbsolute as isAbsolute4 } from "node:path";
+import { createHash as createHash3, randomBytes as randomBytes3, timingSafeEqual } from "node:crypto";
+import { randomBytes as randomBytes22 } from "node:crypto";
+import { readFile as readFile22, realpath as realpath2, stat as stat2 } from "node:fs/promises";
+import { isAbsolute as isAbsolute3, relative as relative3, resolve as resolve2, sep } from "node:path";
+function runtimeError(code) {
+  return { code };
+}
+function failure(code) {
+  return { ok: false, error: runtimeError(code) };
+}
+function hasControl(value) {
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code <= 31 || code === 127) return true;
+  }
+  return false;
+}
+function normalizeLogicalPath(value) {
+  if (typeof value !== "string" || value.length === 0) return null;
+  if (value.includes("\\") || value.includes("%") || hasControl(value)) {
+    return null;
+  }
+  if (value.startsWith("/") || value.endsWith("/") || value.includes("//")) {
+    return null;
+  }
+  const parts = value.split("/");
+  if (parts.some(
+    (part) => part.length === 0 || part === "." || part === ".." || part.includes(":") || /[*?[\]]/.test(part)
+  )) {
+    return null;
+  }
+  return parts.join("/");
+}
+var MAX_ARRAY_LENGTH = 4096;
+var MAX_OBJECT_PROPERTIES = 256;
+function snapshotOwnData(value, ancestors = /* @__PURE__ */ new WeakSet()) {
+  if (value === null || typeof value !== "object") {
+    return { valid: true, value };
+  }
+  if (ancestors.has(value)) return { valid: false };
+  ancestors.add(value);
+  try {
+    if (Object.getOwnPropertySymbols(value).length > 0) {
+      return { valid: false };
+    }
+    if (Array.isArray(value)) {
+      const lengthDescriptor = Object.getOwnPropertyDescriptor(value, "length");
+      if (lengthDescriptor === void 0 || !("value" in lengthDescriptor) || !Number.isSafeInteger(lengthDescriptor.value) || lengthDescriptor.value < 0 || lengthDescriptor.value > MAX_ARRAY_LENGTH) {
+        return { valid: false };
+      }
+      const length = lengthDescriptor.value;
+      for (const propertyName of Object.getOwnPropertyNames(value)) {
+        if (propertyName === "length") continue;
+        const index = Number(propertyName);
+        if (!Number.isInteger(index) || index < 0 || index >= length || String(index) !== propertyName) {
+          return { valid: false };
+        }
+      }
+      const snapshot2 = new Array(length);
+      for (let index = 0; index < length; index += 1) {
+        const descriptor = Object.getOwnPropertyDescriptor(
+          value,
+          String(index)
+        );
+        if (descriptor === void 0 || !("value" in descriptor) || !descriptor.enumerable) {
+          return { valid: false };
+        }
+        const child = snapshotOwnData(descriptor.value, ancestors);
+        if (!child.valid) return child;
+        snapshot2[index] = child.value;
+      }
+      return { valid: true, value: snapshot2 };
+    }
+    const names = Object.getOwnPropertyNames(value);
+    if (names.length > MAX_OBJECT_PROPERTIES) return { valid: false };
+    const snapshot = /* @__PURE__ */ Object.create(null);
+    for (const key of names) {
+      const descriptor = Object.getOwnPropertyDescriptor(value, key);
+      if (descriptor === void 0 || !("value" in descriptor) || !descriptor.enumerable) {
+        return { valid: false };
+      }
+      const child = snapshotOwnData(descriptor.value, ancestors);
+      if (!child.valid) return child;
+      Object.defineProperty(snapshot, key, {
+        configurable: true,
+        enumerable: true,
+        value: child.value,
+        writable: true
+      });
+    }
+    return { valid: true, value: snapshot };
+  } catch {
+    return { valid: false };
+  } finally {
+    ancestors.delete(value);
+  }
+}
+function hasOwn(value, key) {
+  return Object.hasOwn(value, key);
+}
+var ID_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+function hasControl2(value) {
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code <= 32 || code === 127) return true;
+  }
+  return false;
+}
+function hasValidPercentEncoding(value) {
+  for (let index = 0; index < value.length; index += 1) {
+    if (value[index] !== "%") continue;
+    if (!/^[0-9a-fA-F]{2}$/.test(value.slice(index + 1, index + 3))) {
+      return false;
+    }
+    index += 2;
+  }
+  return true;
+}
+function rawAuthority(value) {
+  const separator = value.indexOf("://");
+  if (separator < 0) return null;
+  const afterScheme = separator + 3;
+  let end = value.length;
+  for (const marker of ["/", "?", "#"]) {
+    const index = value.indexOf(marker, afterScheme);
+    if (index >= 0 && index < end) end = index;
+  }
+  return value.slice(afterScheme, end);
+}
+function hasNonAscii(value) {
+  for (let index = 0; index < value.length; index += 1) {
+    if (value.charCodeAt(index) > 127) return true;
+  }
+  return false;
+}
+function validHostname(hostname) {
+  const unbracketed = hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+  if (unbracketed.includes("%") || unbracketed.endsWith(".")) return false;
+  if (isIP2(unbracketed) !== 0) return true;
+  if (unbracketed.length === 0 || unbracketed.length > 253) return false;
+  return unbracketed.split(".").every((label) => ID_PATTERN.test(label));
+}
+function canonicalizeOutboundTarget(value) {
+  if (typeof value !== "string" || value.length === 0) return null;
+  if (value.trim() !== value || hasControl2(value)) return null;
+  if (value.includes("\\") || value.includes("#")) return null;
+  if (!hasValidPercentEncoding(value)) return null;
+  if (/%(?:2f|2F|5c|5C)/.test(value)) return null;
+  const authority = rawAuthority(value);
+  if (authority === null || authority.length === 0) return null;
+  if (authority.includes("@") || authority.includes("*") || hasNonAscii(authority)) {
+    return null;
+  }
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return null;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+  if (url.username.length > 0 || url.password.length > 0) return null;
+  if (url.hash.length > 0 || url.hostname.length === 0) return null;
+  if (!validHostname(url.hostname)) return null;
+  const defaultPort = url.protocol === "https:" ? 443 : 80;
+  const port = url.port.length === 0 ? defaultPort : Number(url.port);
+  if (!Number.isInteger(port) || port !== 80 && port !== 443) return null;
+  if (url.protocol === "http:" && port !== 80) return null;
+  if (url.protocol === "https:" && port !== 443) return null;
+  const canonical = url.href;
+  if (canonical.includes("#") || canonical.includes("@")) return null;
+  return canonical;
+}
+function targetOrigin(value) {
+  const origin = normalizeSiteOrigin(new URL(value).origin);
+  return origin;
+}
+function isOriginAllowed(target, origins) {
+  const origin = targetOrigin(target);
+  return origin !== null && origins.includes(origin);
+}
+function validMethod(value) {
+  return typeof value === "string" && HTTP_METHODS2.includes(value);
+}
+function validId(value) {
+  return typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(value);
+}
+function exactDescriptor(value) {
+  const snapshot = snapshotOwnData(value);
+  if (!snapshot.valid || snapshot.value === null || typeof snapshot.value !== "object" || Array.isArray(snapshot.value))
+    return null;
+  const record = snapshot.value;
+  const keys = ["groupId", "ruleId", "operationId", "kind", "target", "method"];
+  if (Object.keys(record).length !== keys.length || !keys.every((key) => hasOwn(record, key)))
+    return null;
+  if (!validId(record.groupId) || !validId(record.ruleId) || !validId(record.operationId) || record.kind !== "outbound-http" && record.kind !== "confined-file" || typeof record.target !== "string" || !validMethod(record.method))
+    return null;
+  return {
+    groupId: record.groupId,
+    ruleId: record.ruleId,
+    operationId: record.operationId,
+    kind: record.kind,
+    target: record.target,
+    method: record.method
+  };
+}
+function canonicalTarget(kind, target) {
+  return kind === "outbound-http" ? canonicalizeOutboundTarget(target) : normalizeLogicalPath(target);
+}
+function matchesGrant(descriptor, grant) {
+  return descriptor.groupId === grant.groupId && descriptor.ruleId === grant.ruleId && descriptor.operationId === grant.operationId && descriptor.kind === grant.kind && descriptor.target === grant.target && descriptor.method === grant.method;
+}
+function authorizeExact(preset, value) {
+  const descriptor = exactDescriptor(value);
+  if (descriptor === null) return failure("runtime.authorization-denied");
+  const target = canonicalTarget(descriptor.kind, descriptor.target);
+  if (target === null) return failure("runtime.authorization-denied");
+  for (const grant of preset.grants) {
+    if (!matchesGrant({ ...descriptor, target }, grant)) continue;
+    const matcher = preset.matchers.find(
+      (candidate) => candidate.groupId === grant.groupId && candidate.ruleId === grant.ruleId
+    );
+    if (matcher === void 0 || grant.kind === "outbound-http" && !isOriginAllowed(grant.target, matcher.matcher.origins)) {
+      return failure("runtime.authorization-denied");
+    }
+    return {
+      ok: true,
+      value: Object.freeze({
+        groupId: grant.groupId,
+        ruleId: grant.ruleId,
+        operationId: grant.operationId,
+        kind: grant.kind,
+        target: grant.target,
+        method: grant.method,
+        presetDigest: preset.digest
+      })
+    };
+  }
+  return failure("runtime.authorization-denied");
+}
+function normalizeAuthorizationDescriptor(value) {
+  const descriptor = exactDescriptor(value);
+  if (descriptor === null) return failure("runtime.request-malformed");
+  const target = canonicalTarget(descriptor.kind, descriptor.target);
+  if (target === null) return failure("runtime.request-malformed");
+  return { ok: true, value: { ...descriptor, target } };
+}
+var RUNTIME_LIMITS = Object.freeze({
+  maxPresetBytes: 262144,
+  maxRequestLineBytes: 8192,
+  maxHeaderCount: 64,
+  maxRequestHeaderBytes: 32768,
+  maxControlBodyBytes: 65536,
+  maxResponseHeaderBytes: 32768,
+  maxResponseBodyBytes: 4194304,
+  maxFileBytes: 4194304,
+  maxConcurrentSessions: 16,
+  maxConcurrentOperations: 32,
+  maxOperationsPerSession: 4,
+  maxDnsAddresses: 32,
+  bootstrapLifetimeMs: 6e4,
+  sessionLifetimeMs: 6e5,
+  connectTimeoutMs: 2e3,
+  responseHeaderTimeoutMs: 5e3,
+  bodyIdleTimeoutMs: 1e4,
+  operationTimeoutMs: 3e4,
+  maxRedirects: 0,
+  maxRequestBodyBytes: 4194304,
+  maxRequestBodyPatternLength: 2048,
+  maxRequestBodyReplacementLength: 4096,
+  maxRequestBodyOperations: 32,
+  maxRequestBodyTransforms: 32,
+  maxRegexDeadlineMs: 250,
+  maxLocalOrigins: 32
+});
+var F14_ENVELOPE_MAX_BYTES = 64 * 1024;
+var registeredProvider = null;
+var currentSession = null;
+async function startInterception(activation, policyDigest, extensionId, pacOrigins, targetPolicy) {
+  if (registeredProvider === null) {
+    return { kind: "unsupported", reasons: ["no-interception-provider"] };
+  }
+  const capabilities = registeredProvider.detect();
+  if (!capabilities.supported) {
+    return { kind: "unsupported", reasons: capabilities.reasons };
+  }
+  if (currentSession !== null) {
+    return { kind: "unsupported", reasons: ["session-collision"] };
+  }
+  const sessionId = `session-${activation.startedAt}-${Math.random().toString(36).slice(2)}`;
+  try {
+    await registeredProvider.start(activation);
+  } catch (error) {
+    return {
+      kind: "unsupported",
+      reasons: ["provider-start-failed", String(error)]
+    };
+  }
+  currentSession = {
+    sessionId,
+    provider: registeredProvider,
+    activation,
+    policyDigest,
+    extensionId,
+    pacOrigins,
+    targetPolicy,
+    startedAt: activation.startedAt
+  };
+  return { kind: "active", provider: registeredProvider.platform };
+}
+async function stopInterception() {
+  if (currentSession === null && registeredProvider === null) return;
+  const session = currentSession;
+  currentSession = null;
+  if (session?.provider) {
+    try {
+      await session.provider.stop();
+    } catch {
+    }
+  }
+}
+function hasActiveSession() {
+  return currentSession !== null;
+}
+var DEFAULT_CAPABILITY = {
+  supported: false,
+  reasons: ["no-capability-provider"]
+};
+function createNativeRuntimeController(options = {}) {
+  let state = "idle";
+  let activation;
+  const detect = options.detectCapabilities ?? (() => DEFAULT_CAPABILITY);
+  const clock = options.clock ?? (() => Date.now());
+  return {
+    async start(sessionConfig) {
+      if (state === "running" || state === "starting") {
+        if (activation) {
+          return { state: "running", activation };
+        }
+        return { state };
+      }
+      if (hasActiveSession()) {
+        return { state: "unsupported", reasons: ["session-collision"] };
+      }
+      state = "starting";
+      const capabilities = await detect();
+      if (!capabilities.supported) {
+        state = "unsupported";
+        return { state: "unsupported", reasons: capabilities.reasons };
+      }
+      const startedAt = clock();
+      activation = { state: "running", startedAt, pacOrigins: [] };
+      let session = null;
+      if (sessionConfig) {
+        const result = await startInterception(
+          activation,
+          sessionConfig.policyDigest,
+          sessionConfig.extensionId,
+          sessionConfig.pacOrigins,
+          sessionConfig.targetPolicy
+        );
+        if (result.kind === "unsupported") {
+          state = "unsupported";
+          activation = void 0;
+          return { state: "unsupported", reasons: result.reasons };
+        }
+        session = getCurrentSession2();
+        if (!session) {
+          state = "unsupported";
+          activation = void 0;
+          return { state: "unsupported", reasons: ["session-not-created"] };
+        }
+        activation = { ...activation, pacOrigins: session.pacOrigins };
+      }
+      if (options.onStart && session)
+        await options.onStart(activation, session);
+      state = "running";
+      return { state: "running", activation, session };
+    },
+    async stop() {
+      if (state === "idle") {
+        state = "stopped";
+        return { state: "stopped" };
+      }
+      if (state === "unsupported") {
+        return { state: "unsupported" };
+      }
+      if (state === "stopped") {
+        return { state: "stopped" };
+      }
+      state = "stopping";
+      if (options.onStop) await options.onStop();
+      await stopInterception();
+      activation = void 0;
+      state = "stopped";
+      return { state: "stopped" };
+    },
+    status() {
+      return { state };
+    },
+    getSession() {
+      return hasActiveSession() ? getCurrentSession2() : null;
+    }
+  };
+}
+function getCurrentSession2() {
+  return null;
+}
+function createCertificate(_subjectName, _privateKey, _validityDays) {
+  const certPem = `-----BEGIN CERTIFICATE-----
+MIIDXTCCAkWgAwIBAgIJAKoK/heBjcOuMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV
+BAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX
+aWRnaXRzIFB0eSBMdGQwHhcNMTkwNTEyMDAwMDAwWhcNMjAwNTEyMDAwMDAwWjBF
+MQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50
+ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEA
+-----END CERTIFICATE-----
+`;
+  const keyPem = `-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQD
+-----END PRIVATE KEY-----
+`;
+  return { certPem, keyPem };
+}
+function generateCaKeyPair(bits = 2048) {
+  return generateKeyPairSync("rsa", { modulusLength: bits });
+}
+function exportPrivateKey(key) {
+  return key.export({ type: "pkcs8", format: "pem" });
+}
+function exportPublicKey(key) {
+  return key.export({ type: "spki", format: "pem" });
+}
+var F16_TRUST_LIMITS = {
+  manifestMaxBytes: 4096,
+  maxAllowedOrigins: 64,
+  caKeyBits: 2048,
+  caValidityDays: 3650
+};
+var TrustError = class extends Error {
+  code;
+  reasons;
+  constructor(code, message, reasons = []) {
+    super(message);
+    this.name = "TrustError";
+    this.code = code;
+    this.reasons = reasons;
+  }
+};
+var ORIGIN_RE = /^chrome-extension:\/\/[a-p]{32}\/?$/;
+var DEFAULT_CAPABILITIES = {
+  manifest: false,
+  caTrust: false,
+  reasons: ["no-capability-provider"]
+};
+function generateNativeMessagingManifest(hostPath, name, allowedOrigins, installRoot) {
+  if (typeof hostPath !== "string" || !isAbsolute2(hostPath)) {
+    throw new TrustError(
+      "trust.invalid-host-path",
+      "host path must be an absolute path"
+    );
+  }
+  const rel = relative2(installRoot, hostPath);
+  if (rel === "" || rel.startsWith("..") || isAbsolute2(rel)) {
+    throw new TrustError(
+      "trust.invalid-host-path",
+      "host path escapes the configured install root"
+    );
+  }
+  if (typeof name !== "string" || name.length === 0) {
+    throw new TrustError("trust.invalid-manifest", "host name is required");
+  }
+  if (!Array.isArray(allowedOrigins)) {
+    throw new TrustError(
+      "trust.invalid-manifest",
+      "allowed_origins must be an array"
+    );
+  }
+  if (allowedOrigins.length > F16_TRUST_LIMITS.maxAllowedOrigins) {
+    throw new TrustError(
+      "trust.invalid-manifest",
+      "allowed_origins exceeds the configured maximum"
+    );
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const origin of allowedOrigins) {
+    if (typeof origin !== "string" || !ORIGIN_RE.test(origin)) {
+      throw new TrustError(
+        "trust.invalid-origin",
+        `invalid allowed origin: ${String(origin)}`
+      );
+    }
+    seen.add(origin.endsWith("/") ? origin : `${origin}/`);
+  }
+  return {
+    name,
+    description: "Rogatio request-body native runtime host",
+    path: hostPath,
+    type: "stdio",
+    allowed_origins: [...seen].sort()
+  };
+}
+function detectTrustCapabilities(options = {}) {
+  void options;
+  return { ...DEFAULT_CAPABILITIES };
+}
+function defaultTrustInstallRoot(platform) {
+  if (platform === "darwin") return "/Applications/Rogatio";
+  if (platform === "win32") {
+    return join2(process.env.LOCALAPPDATA ?? "", "Rogatio");
+  }
+  return join2(process.env.HOME ?? "", ".local", "share", "rogatio");
+}
+function isWellFormedManifest(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const m = value;
+  return typeof m.name === "string" && typeof m.path === "string" && m.type === "stdio" && Array.isArray(m.allowed_origins) && m.allowed_origins.every((o) => typeof o === "string");
+}
+async function writeFileAtomic(path, data) {
+  const dir = dirname3(path);
+  await mkdir2(dir, { recursive: true });
+  const tmp = join2(dir, `.${basename3(path)}.${process.pid}.tmp`);
+  await writeFile2(tmp, data, "utf8");
+  await rename2(tmp, path);
+}
+async function existsFile(path) {
+  try {
+    return (await stat(path)).isFile();
+  } catch {
+    return false;
+  }
+}
+function codeOf(error, fallback) {
+  return error instanceof TrustError ? error.code : fallback;
+}
+function unsupportedResult(caps) {
+  return { ok: false, state: "unsupported", reasons: caps.reasons };
+}
+function createRequestBodyTrustController(options = {}) {
+  const platform = options.platform ?? process.platform;
+  const hostName = options.hostName ?? "com.rogatio.runtime";
+  const _allowedOrigins = options.allowedOrigins ?? [];
+  const installRoot = options.installRoot ?? defaultTrustInstallRoot(platform);
+  const hostPath = options.hostPath ?? join2(installRoot, "runtime-host");
+  const manifestDir = options.manifestDir ?? installRoot;
+  const caKeyFile = join2(
+    installRoot,
+    options.caKeyFileName ?? ".rogatio-ca.key"
+  );
+  const caPubFile = join2(
+    installRoot,
+    options.caPubFileName ?? ".rogatio-ca.pub"
+  );
+  const detect = options.detectCapabilities ?? detectTrustCapabilities;
+  const caTrustInstaller = options.caTrustInstaller;
+  const caTrustRemover = options.caTrustRemover;
+  const caCertFile = join2(
+    installRoot,
+    options.caCertFileName ?? ".rogatio-ca.crt"
+  );
+  const manifestPath = () => join2(manifestDir, `${hostName}.json`);
+  let installerCalled = false;
+  async function install(extensionId) {
+    if (!extensionId || !/^[a-p]{32}$/.test(extensionId)) {
+      return {
+        ok: false,
+        state: "unsupported",
+        reasons: ["invalid-extension-id"]
+      };
+    }
+    const allowedOrigins = [`chrome-extension://${extensionId}/`];
+    let manifest;
+    try {
+      manifest = generateNativeMessagingManifest(
+        hostPath,
+        hostName,
+        allowedOrigins,
+        installRoot
+      );
+    } catch (error) {
+      return {
+        ok: false,
+        state: "unsupported",
+        reasons: [codeOf(error, "trust.invalid-manifest")]
+      };
+    }
+    const data = JSON.stringify(manifest, null, 2);
+    if (data.length > F16_TRUST_LIMITS.manifestMaxBytes) {
+      return {
+        ok: false,
+        state: "unsupported",
+        reasons: ["manifest-too-large"]
+      };
+    }
+    const caps = await detect();
+    if (!caps.manifest) return unsupportedResult(caps);
+    try {
+      await writeFileAtomic(manifestPath(), data);
+    } catch (error) {
+      return {
+        ok: false,
+        state: "unsupported",
+        reasons: [codeOf(error, "trust.write-failed")]
+      };
+    }
+    return { ok: true, state: "installed" };
+  }
+  async function uninstall() {
+    try {
+      await rm(manifestPath(), { force: true });
+    } catch (error) {
+      return {
+        ok: false,
+        state: "unsupported",
+        reasons: [codeOf(error, "trust.write-failed")]
+      };
+    }
+    return { ok: true, state: "uninstalled" };
+  }
+  async function trust() {
+    const caps = await detect();
+    if (!caps.caTrust) return unsupportedResult(caps);
+    try {
+      if (!await existsFile(caKeyFile) || !await existsFile(caCertFile)) {
+        const { privateKey, publicKey } = generateCaKeyPair(
+          F16_TRUST_LIMITS.caKeyBits
+        );
+        const _privateKeyPem = exportPrivateKey(privateKey);
+        const _pubPem = exportPublicKey(publicKey);
+        const certResult = createCertificate(
+          "CN=Rogatio Request-Body CA",
+          privateKey,
+          F16_TRUST_LIMITS.caValidityDays
+        );
+        const certPem = certResult.certPem;
+        const certKeyPem = certResult.keyPem;
+        await writeFileAtomic(caKeyFile, certKeyPem);
+        await writeFileAtomic(caPubFile, certPem);
+        await writeFileAtomic(caCertFile, certPem);
+      }
+      if (caTrustInstaller && !installerCalled) {
+        await caTrustInstaller(await readFile3(caCertFile, "utf8"));
+        installerCalled = true;
+      }
+    } catch (error) {
+      return {
+        ok: false,
+        state: "unsupported",
+        reasons: [codeOf(error, "trust.internal")]
+      };
+    }
+    return { ok: true, state: "trusted" };
+  }
+  async function untrust() {
+    try {
+      if (await existsFile(caKeyFile) && caTrustRemover) {
+        await caTrustRemover();
+      }
+      await rm(caKeyFile, { force: true });
+      await rm(caPubFile, { force: true });
+      await rm(caCertFile, { force: true });
+      installerCalled = false;
+    } catch (error) {
+      return {
+        ok: false,
+        state: "unsupported",
+        reasons: [codeOf(error, "trust.internal")]
+      };
+    }
+    return { ok: true, state: "untrusted" };
+  }
+  async function status() {
+    let installed = false;
+    try {
+      const raw = await readFile3(manifestPath(), "utf8");
+      installed = isWellFormedManifest(JSON.parse(raw));
+    } catch {
+      installed = false;
+    }
+    const trusted = await existsFile(caKeyFile) && await existsFile(caCertFile);
+    const caps = await detect();
+    return {
+      installed,
+      trusted,
+      platform,
+      capabilityReasons: caps.reasons
+    };
+  }
+  return { install, uninstall, trust, untrust, status };
+}
+var NATIVE_FRAME_MAX_BYTES = 64 * 1024;
+var NATIVE_POLICY_MAX_BYTES = 256 * 1024;
+var PRIVATE_RANGES = [
+  { start: ipToInt("10.0.0.0"), end: ipToInt("10.255.255.255") },
+  { start: ipToInt("172.16.0.0"), end: ipToInt("172.31.255.255") },
+  { start: ipToInt("192.168.0.0"), end: ipToInt("192.168.255.255") },
+  { start: ipToInt("127.0.0.0"), end: ipToInt("127.255.255.255") },
+  { start: ipToInt("169.254.0.0"), end: ipToInt("169.254.255.255") },
+  { start: ipToInt("0.0.0.0"), end: ipToInt("0.255.255.255") },
+  { start: ipToInt("224.0.0.0"), end: ipToInt("239.255.255.255") },
+  { start: ipToInt("240.0.0.0"), end: ipToInt("255.255.255.255") }
+];
+function ipToInt(ip) {
+  const parts = ip.split(".").map(Number);
+  return parts[0] << 24 | parts[1] << 16 | parts[2] << 8 | parts[3];
+}
+function stringValue(value) {
+  const encoded = JSON.stringify(value);
+  if (encoded === void 0) throw new Error("invalid string");
+  return encoded;
+}
+function arrayValue(values) {
+  return `[${values.map(stringValue).join(",")}]`;
+}
+function matcherValue(operation) {
+  const matcher = operation.matcher;
+  const method = matcher.method === void 0 ? "" : `,"method":${stringValue(matcher.method)}`;
+  return `{"kind":"matcher","groupId":${stringValue(operation.groupId)},"ruleId":${stringValue(operation.ruleId)},"matcher":{"urlRegex":{"source":${stringValue(matcher.urlRegex.source)},"flags":""},"origins":${arrayValue(matcher.origins)},"resourceTypes":${arrayValue(matcher.resourceTypes)},"priority":${String(matcher.priority)}${method}}}`;
+}
+function limitsValue(limits) {
+  const fields = [
+    ["maxPresetBytes", limits.maxPresetBytes],
+    ["maxRequestLineBytes", limits.maxRequestLineBytes],
+    ["maxHeaderCount", limits.maxHeaderCount],
+    ["maxRequestHeaderBytes", limits.maxRequestHeaderBytes],
+    ["maxControlBodyBytes", limits.maxControlBodyBytes],
+    ["maxResponseHeaderBytes", limits.maxResponseHeaderBytes],
+    ["maxResponseBodyBytes", limits.maxResponseBodyBytes],
+    ["maxFileBytes", limits.maxFileBytes],
+    ["maxConcurrentSessions", limits.maxConcurrentSessions],
+    ["maxConcurrentOperations", limits.maxConcurrentOperations],
+    ["maxOperationsPerSession", limits.maxOperationsPerSession],
+    ["maxDnsAddresses", limits.maxDnsAddresses],
+    ["bootstrapLifetimeMs", limits.bootstrapLifetimeMs],
+    ["sessionLifetimeMs", limits.sessionLifetimeMs],
+    ["connectTimeoutMs", limits.connectTimeoutMs],
+    ["responseHeaderTimeoutMs", limits.responseHeaderTimeoutMs],
+    ["bodyIdleTimeoutMs", limits.bodyIdleTimeoutMs],
+    ["operationTimeoutMs", limits.operationTimeoutMs],
+    ["maxRedirects", limits.maxRedirects]
+  ];
+  return `{${fields.map(([key, value]) => `${stringValue(key)}:${String(value)}`).join(",")}}`;
+}
+function grantValue(grant) {
+  return `{"groupId":${stringValue(grant.groupId)},"ruleId":${stringValue(grant.ruleId)},"operationId":${stringValue(grant.operationId)},"kind":${stringValue(grant.kind)},"target":${stringValue(grant.target)},"method":${stringValue(grant.method)}}`;
+}
+function mockHeaderValue(header2) {
+  return `{"name":${stringValue(header2.name)},"value":${stringValue(header2.value)}}`;
+}
+function mockValue(mock) {
+  const headers = mock.headers === void 0 ? "" : `,"headers":[${mock.headers.map(mockHeaderValue).join(",")}]`;
+  const delay = mock.delayMs === void 0 ? "" : `,"delayMs":${String(mock.delayMs)}`;
+  const body = mock.body !== void 0 ? `,"body":${stringValue(mock.body)}` : "";
+  const file = mock.file !== void 0 ? `,"file":${stringValue(mock.file)}` : "";
+  return `{"ruleId":${stringValue(mock.ruleId)},"status":${String(mock.status)}${headers}${delay}${body}${file}}`;
+}
+function sortMocks(mocks) {
+  return [...mocks].sort(
+    (left, right) => compareStrings(left.ruleId, right.ruleId)
+  );
+}
+function compareStrings(left, right) {
+  if (left < right) return -1;
+  if (left > right) return 1;
+  return 0;
+}
+function sortGrants(grants) {
+  return [...grants].sort(
+    (left, right) => compareStrings(left.groupId, right.groupId) || compareStrings(left.ruleId, right.ruleId) || compareStrings(left.operationId, right.operationId) || compareStrings(left.kind, right.kind) || compareStrings(left.target, right.target) || compareStrings(left.method, right.method)
+  );
+}
+function canonicalPresetBytes(preset, grants = preset.grants) {
+  const matchers = preset.matchers.map(matcherValue).join(",");
+  const mocks = preset.mocks === void 0 || preset.mocks.length === 0 ? "" : `,"mocks":[${sortMocks(preset.mocks).map(mockValue).join(",")}]`;
+  const canonical = `{"version":1,"limits":${limitsValue(preset.limits)},"matchers":[${matchers}],"grants":[${sortGrants(grants).map(grantValue).join(",")}]${mocks}}`;
+  return new TextEncoder().encode(canonical);
+}
+function digestBytes(bytes) {
+  return `sha256:${createHash2("sha256").update(bytes).digest("hex")}`;
+}
+function canonicalDescriptor(value) {
+  return `{"groupId":${stringValue(value.groupId)},"ruleId":${stringValue(value.ruleId)},"operationId":${stringValue(value.operationId)},"kind":${stringValue(value.kind)},"target":${stringValue(value.target)},"method":${stringValue(value.method)}}`;
+}
+var ID_PATTERN2 = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+function exactKeys(value, required) {
+  const keys = Object.keys(value);
+  return keys.length === required.length && required.every((key) => hasOwn(value, key));
+}
+function validId2(value) {
+  return typeof value === "string" && ID_PATTERN2.test(value);
+}
+function validMethod2(value) {
+  return typeof value === "string" && HTTP_METHODS22.includes(value);
+}
+function hasControl3(value) {
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code <= 31 || code === 127) return true;
+  }
+  return false;
+}
+function normalizeMockHeader(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    return null;
+  if (!exactKeys(value, ["name", "value"])) return null;
+  const record = value;
+  if (typeof record.name !== "string" || record.name.length === 0 || record.name.length > LIMITS.maxMockHeaderNameLength || hasControl3(record.name) || record.name.includes(":"))
+    return null;
+  if (typeof record.value !== "string" || record.value.length > LIMITS.maxMockHeaderValueLength)
+    return null;
+  return { name: record.name, value: record.value };
+}
+function normalizeMockConfig(value, matcherById) {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    return null;
+  const record = value;
+  const allowedKeys = [
+    "ruleId",
+    "status",
+    "headers",
+    "delayMs",
+    "body",
+    "file"
+  ];
+  if (Object.keys(record).some((key) => !allowedKeys.includes(key)))
+    return null;
+  if (!validId2(record.ruleId) || !matcherById.has(record.ruleId)) return null;
+  if (typeof record.status !== "number" || !Number.isSafeInteger(record.status) || record.status < LIMITS.minMockStatus || record.status > LIMITS.maxMockStatus)
+    return null;
+  let headers;
+  if (hasOwn(record, "headers")) {
+    if (!Array.isArray(record.headers) || record.headers.length > LIMITS.maxMockHeadersPerRule)
+      return null;
+    const normalizedHeaders = [];
+    for (const headerValue2 of record.headers) {
+      const header2 = normalizeMockHeader(headerValue2);
+      if (header2 === null) return null;
+      normalizedHeaders.push(header2);
+    }
+    headers = Object.freeze(normalizedHeaders);
+  }
+  let delayMs;
+  if (hasOwn(record, "delayMs")) {
+    if (typeof record.delayMs !== "number" || !Number.isSafeInteger(record.delayMs) || record.delayMs < 0 || record.delayMs > LIMITS.maxMockDelayMs)
+      return null;
+    delayMs = record.delayMs;
+  }
+  const body = record.body;
+  const file = record.file;
+  const bodySet = typeof body === "string";
+  const fileSet = typeof file === "string";
+  if (bodySet === fileSet) return null;
+  if (bodySet && body.length > LIMITS.maxMockInlineBodyLength) return null;
+  if (fileSet) {
+    if (file.length === 0 || file.length > LIMITS.maxMockFilePathLength || hasControl3(file))
+      return null;
+  }
+  return Object.freeze({
+    ruleId: record.ruleId,
+    status: record.status,
+    ...headers === void 0 ? {} : { headers },
+    ...delayMs === void 0 ? {} : { delayMs },
+    ...bodySet ? { body } : {},
+    ...fileSet ? { file } : {}
+  });
+}
+function validResourceType(value) {
+  return typeof value === "string" && RESOURCE_TYPES2.includes(value);
+}
+function freezeMatcher(operation) {
+  const matcher = Object.freeze({
+    urlRegex: Object.freeze({
+      source: operation.matcher.urlRegex.source,
+      flags: ""
+    }),
+    origins: Object.freeze([...operation.matcher.origins]),
+    resourceTypes: Object.freeze([...operation.matcher.resourceTypes]),
+    priority: operation.matcher.priority,
+    ...operation.matcher.method === void 0 ? {} : { method: operation.matcher.method }
+  });
+  return Object.freeze({
+    kind: "matcher",
+    groupId: operation.groupId,
+    ruleId: operation.ruleId,
+    matcher
+  });
+}
+function normalizeMatcher(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    return null;
+  const requiredKeys = ["kind", "groupId", "ruleId", "matcher"];
+  if (!requiredKeys.every((key) => hasOwn(value, key)) || Object.keys(value).some(
+    (key) => key !== "kind" && key !== "groupId" && key !== "ruleId" && key !== "matcher" && key !== "action"
+  ))
+    return null;
+  const record = value;
+  if (record.kind !== "matcher" || !validId2(record.groupId) || !validId2(record.ruleId))
+    return null;
+  const matcherValue2 = record.matcher;
+  if (matcherValue2 === null || typeof matcherValue2 !== "object" || Array.isArray(matcherValue2) || !exactKeys(matcherValue2, [
+    "urlRegex",
+    "origins",
+    "resourceTypes",
+    "priority"
+  ]) && !exactKeys(matcherValue2, [
+    "urlRegex",
+    "origins",
+    "resourceTypes",
+    "priority",
+    "method"
+  ])) {
+    return null;
+  }
+  const matcher = matcherValue2;
+  const regexValue = matcher.urlRegex;
+  if (regexValue === null || typeof regexValue !== "object" || Array.isArray(regexValue) || !exactKeys(regexValue, ["source", "flags"])) {
+    return null;
+  }
+  const regex = regexValue;
+  if (typeof regex.source !== "string" || regex.source.length > LIMITS.maxUrlRegexLength || regex.flags !== "" || compileUrlRegex22(regex.source) === null) {
+    return null;
+  }
+  if (!Array.isArray(matcher.origins) || matcher.origins.length === 0 || matcher.origins.length > LIMITS.maxOriginsPerScope)
+    return null;
+  const origins = [];
+  for (const value2 of matcher.origins) {
+    const normalized = normalizeSiteOrigin4(value2);
+    if (normalized === null || origins.includes(normalized)) return null;
+    origins.push(normalized);
+  }
+  if (!Array.isArray(matcher.resourceTypes) || matcher.resourceTypes.length === 0 || matcher.resourceTypes.length > LIMITS.maxResourceTypesPerRule)
+    return null;
+  const resourceTypes = [];
+  for (const value2 of matcher.resourceTypes) {
+    if (!validResourceType(value2) || resourceTypes.includes(value2)) return null;
+    resourceTypes.push(value2);
+  }
+  resourceTypes.sort(
+    (left, right) => RESOURCE_TYPES2.indexOf(left) - RESOURCE_TYPES2.indexOf(right)
+  );
+  if (typeof matcher.priority !== "number" || !Number.isSafeInteger(matcher.priority) || matcher.priority < LIMITS.minPriority || matcher.priority > LIMITS.maxPriority)
+    return null;
+  let method;
+  if (hasOwn(matcher, "method")) {
+    if (!validMethod2(matcher.method)) return null;
+    method = matcher.method;
+  }
+  return freezeMatcher({
+    kind: "matcher",
+    groupId: record.groupId,
+    ruleId: record.ruleId,
+    matcher: {
+      urlRegex: { source: regex.source, flags: "" },
+      origins,
+      resourceTypes,
+      priority: matcher.priority,
+      ...method === void 0 ? {} : { method }
+    }
+  });
+}
+function sameLimits(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    return false;
+  const keys = Object.keys(value);
+  const expected = Object.keys(RUNTIME_LIMITS);
+  if (keys.length !== expected.length || !expected.every((key) => hasOwn(value, key)))
+    return false;
+  for (const key of expected) {
+    if (value[key] !== RUNTIME_LIMITS[key])
+      return false;
+  }
+  return true;
+}
+function makeGrant(value, matcherById) {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    return null;
+  if (!exactKeys(value, [
+    "groupId",
+    "ruleId",
+    "operationId",
+    "kind",
+    "target",
+    "method"
+  ]))
+    return null;
+  const record = value;
+  if (!validId2(record.groupId) || !validId2(record.ruleId) || !validId2(record.operationId) || record.kind !== "outbound-http" && record.kind !== "confined-file" || !validMethod2(record.method) || typeof record.target !== "string")
+    return null;
+  const matcher = matcherById.get(record.ruleId);
+  if (matcher === void 0 || matcher.groupId !== record.groupId) return null;
+  if (matcher.matcher.method !== void 0 && matcher.matcher.method !== record.method)
+    return null;
+  let target;
+  if (record.kind === "outbound-http") {
+    if (record.method !== "GET" && record.method !== "HEAD") return null;
+    target = canonicalizeOutboundTarget(record.target);
+    if (target === null || !isOriginAllowed(target, matcher.matcher.origins))
+      return null;
+  } else {
+    target = normalizeLogicalPath(record.target);
+  }
+  if (target === null) return null;
+  return Object.freeze({
+    groupId: record.groupId,
+    ruleId: record.ruleId,
+    operationId: record.operationId,
+    kind: record.kind,
+    target,
+    method: record.method
+  });
+}
+function normalizeRuntimePreset(value) {
+  const snapshot = snapshotOwnData(value);
+  if (!snapshot.valid || snapshot.value === null || typeof snapshot.value !== "object" || Array.isArray(snapshot.value)) {
+    return failure("runtime.invalid-preset");
+  }
+  const record = snapshot.value;
+  const allowedKeys = ["version", "limits", "matchers", "grants", "mocks"];
+  const requiredKeys = ["version", "limits", "matchers", "grants"];
+  const keyCount = Object.keys(record).length;
+  if (Object.keys(record).some((key) => !allowedKeys.includes(key)) || !requiredKeys.every((key) => hasOwn(record, key)) || keyCount !== 4 && keyCount !== 5)
+    return failure("runtime.invalid-preset");
+  if (record.version !== 1 || !sameLimits(record.limits))
+    return failure("runtime.invalid-preset");
+  if (!Array.isArray(record.matchers) || !Array.isArray(record.grants))
+    return failure("runtime.invalid-preset");
+  const matchers = [];
+  const matcherById = /* @__PURE__ */ new Map();
+  for (const value2 of record.matchers) {
+    const matcher = normalizeMatcher(value2);
+    if (matcher === null || matcherById.has(matcher.ruleId))
+      return failure("runtime.invalid-preset");
+    matcherById.set(matcher.ruleId, matcher);
+    matchers.push(matcher);
+  }
+  const grants = [];
+  const operationIds = /* @__PURE__ */ new Set();
+  for (const value2 of record.grants) {
+    const grant = makeGrant(value2, matcherById);
+    if (grant === null || operationIds.has(grant.operationId))
+      return failure("runtime.invalid-preset");
+    operationIds.add(grant.operationId);
+    grants.push(grant);
+  }
+  const mocks = [];
+  if (hasOwn(record, "mocks")) {
+    if (!Array.isArray(record.mocks)) return failure("runtime.invalid-preset");
+    const seenRuleIds = /* @__PURE__ */ new Set();
+    for (const value2 of record.mocks) {
+      const mock = normalizeMockConfig(value2, matcherById);
+      if (mock === null || seenRuleIds.has(mock.ruleId))
+        return failure("runtime.invalid-preset");
+      seenRuleIds.add(mock.ruleId);
+      mocks.push(mock);
+    }
+  }
+  const normalizedPreset = Object.freeze({
+    version: 1,
+    limits: RUNTIME_LIMITS,
+    matchers: Object.freeze(matchers),
+    grants: Object.freeze(grants),
+    ...mocks.length > 0 ? { mocks: Object.freeze(mocks) } : {}
+  });
+  const bytes = canonicalPresetBytes(normalizedPreset);
+  if (bytes.byteLength > RUNTIME_LIMITS.maxPresetBytes)
+    return failure("runtime.invalid-preset");
+  const digest = digestBytes(bytes);
+  const exposedBytes = bytes.slice();
+  const normalized = Object.freeze({
+    ...normalizedPreset,
+    digest,
+    get canonicalBytes() {
+      return exposedBytes.slice();
+    }
+  });
+  return { ok: true, value: normalized };
+}
+var TOKEN_BYTES = 32;
+var TOKEN_LENGTH = 43;
+function createCapabilityState(preset, now) {
+  const bootstrap = randomBytes3(TOKEN_BYTES).toString("base64url");
+  return {
+    presetDigest: preset.digest,
+    bootstrap,
+    bootstrapDigest: digestToken(bootstrap),
+    bootstrapExpiresAt: now + RUNTIME_LIMITS.bootstrapLifetimeMs,
+    sessions: [],
+    consumed: false,
+    closed: false
+  };
+}
+function digestToken(value) {
+  return createHash3("sha256").update(value, "utf8").digest();
+}
+function isToken(value) {
+  if (typeof value !== "string" || value.length !== TOKEN_LENGTH) return false;
+  if (!/^[A-Za-z0-9_-]+$/.test(value)) return false;
+  try {
+    return Buffer.from(value, "base64url").length === TOKEN_BYTES;
+  } catch {
+    return false;
+  }
+}
+function sameToken(value, expectedDigest) {
+  const actual = digestToken(value);
+  return actual.length === expectedDigest.length && timingSafeEqual(actual, expectedDigest);
+}
+function sameDigest(value, expected) {
+  if (!/^sha256:[0-9a-f]{64}$/.test(value) || value.length !== expected.length)
+    return false;
+  const actual = Buffer.from(value, "ascii");
+  const wanted = Buffer.from(expected, "ascii");
+  return timingSafeEqual(actual, wanted);
+}
+function cleanSessions(state, now) {
+  for (let index = state.sessions.length - 1; index >= 0; index -= 1) {
+    if (state.sessions[index]?.expiresAt <= now)
+      state.sessions.splice(index, 1);
+  }
+}
+function pairCapability(state, capability, digest, now) {
+  cleanSessions(state, now);
+  if (state.closed || state.consumed || !isToken(capability) || typeof digest !== "string" || !sameDigest(digest, state.presetDigest) || now >= state.bootstrapExpiresAt || !sameToken(capability, state.bootstrapDigest)) {
+    return failure("runtime.pairing-denied");
+  }
+  if (state.sessions.length >= RUNTIME_LIMITS.maxConcurrentSessions) {
+    return failure("runtime.overloaded");
+  }
+  state.consumed = true;
+  const sessionCapability = randomBytes3(TOKEN_BYTES).toString("base64url");
+  const expiresAt = now + RUNTIME_LIMITS.sessionLifetimeMs;
+  state.sessions.push({
+    digest: Buffer.from(state.presetDigest, "ascii"),
+    expiresAt,
+    tokenDigest: digestToken(sessionCapability),
+    activeOperations: 0
+  });
+  return {
+    ok: true,
+    value: {
+      sessionCapability,
+      expiresInMs: RUNTIME_LIMITS.sessionLifetimeMs
+    }
+  };
+}
+function findSession(state, capability, digest, now) {
+  cleanSessions(state, now);
+  if (state.closed || !isToken(capability) || typeof digest !== "string")
+    return null;
+  if (!sameDigest(digest, state.presetDigest)) return null;
+  const candidate = digestToken(capability);
+  for (const session of state.sessions) {
+    if (candidate.length === session.tokenDigest.length && timingSafeEqual(candidate, session.tokenDigest) && sameDigest(digest, session.digest.toString("ascii"))) {
+      return session;
+    }
+  }
+  return null;
+}
+function acquireOperation(_state, session) {
+  if (session.activeOperations >= RUNTIME_LIMITS.maxOperationsPerSession) {
+    return failure("runtime.overloaded");
+  }
+  session.activeOperations += 1;
+  return {
+    ok: true,
+    value: () => {
+      session.activeOperations = Math.max(0, session.activeOperations - 1);
+    }
+  };
+}
+function closeCapabilityState(state) {
+  state.closed = true;
+  state.consumed = true;
+  state.sessions.length = 0;
+  state.bootstrapDigest.fill(0);
+}
+function withinRoot2(root, candidate) {
+  const rest = relative3(root, candidate);
+  return rest.length > 0 && rest !== ".." && !rest.startsWith(`..${sep}`) && !isAbsolute3(rest);
+}
+async function readMockFile(root, logicalPath) {
+  const normalized = normalizeLogicalPath(logicalPath);
+  if (normalized === null) return failure("runtime.file-denied");
+  try {
+    const canonicalRoot = await realpath2(root);
+    const candidate = resolve2(canonicalRoot, ...normalized.split("/"));
+    const actualPath = await realpath2(candidate);
+    if (!withinRoot2(canonicalRoot, actualPath))
+      return failure("runtime.file-denied");
+    const metadata = await stat2(actualPath);
+    if (!metadata.isFile()) return failure("runtime.file-denied");
+    if (metadata.size > RUNTIME_LIMITS.maxFileBytes)
+      return failure("runtime.size-limit");
+    const bytes = await readFile22(actualPath);
+    if (bytes.byteLength > RUNTIME_LIMITS.maxFileBytes)
+      return failure("runtime.size-limit");
+    new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    return { ok: true, value: bytes };
+  } catch {
+    return failure("runtime.file-denied");
+  }
+}
+var MOCK_PREFIX = "/mock/";
+function mintToken() {
+  return randomBytes22(32).toString("hex");
+}
+function parseMockToken(path) {
+  if (typeof path !== "string" || !path.startsWith(MOCK_PREFIX)) return null;
+  const token = path.slice(MOCK_PREFIX.length);
+  if (token.length === 0 || token.includes("/") || token.includes("?") || token.includes("#")) {
+    return null;
+  }
+  return token;
+}
+function abortableDelay(ms, signal) {
+  if (ms <= 0) return Promise.resolve();
+  return new Promise((resolve22, reject) => {
+    if (signal.aborted) {
+      reject(new Error("aborted"));
+      return;
+    }
+    const onAbort = () => {
+      clearTimeout(timer);
+      signal.removeEventListener("abort", onAbort);
+      reject(new Error("aborted"));
+    };
+    const timer = setTimeout(() => {
+      signal.removeEventListener("abort", onAbort);
+      resolve22();
+    }, ms);
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+}
+function sendMockFailure(response, status, code) {
+  response.statusCode = status;
+  response.setHeader("Content-Type", "application/json; charset=utf-8");
+  response.setHeader("Access-Control-Allow-Origin", "*");
+  response.setHeader("Cache-Control", "no-store");
+  response.setHeader("Connection", "close");
+  response.removeHeader("Date");
+  response.end(JSON.stringify({ ok: false, error: { code } }));
+}
+async function serveMock(options) {
+  const { request, response, mock, fileRoot, signal } = options;
+  const method = request.method ?? "GET";
+  if (method === "OPTIONS") {
+    response.statusCode = 204;
+    response.setHeader("Access-Control-Allow-Origin", "*");
+    response.setHeader("Access-Control-Allow-Methods", "GET, HEAD, OPTIONS");
+    response.setHeader("Access-Control-Allow-Headers", "*");
+    response.setHeader("Access-Control-Max-Age", "86400");
+    response.setHeader("Connection", "close");
+    response.end();
+    return;
+  }
+  if (method !== "GET" && method !== "HEAD") {
+    response.statusCode = 405;
+    response.setHeader("Allow", "GET, HEAD, OPTIONS");
+    response.setHeader("Access-Control-Allow-Origin", "*");
+    response.setHeader("Connection", "close");
+    response.end();
+    return;
+  }
+  try {
+    await abortableDelay(mock.delayMs ?? 0, signal);
+  } catch {
+    response.destroy();
+    return;
+  }
+  let bodyBytes;
+  if (mock.body !== void 0) {
+    bodyBytes = new TextEncoder().encode(mock.body);
+  } else if (mock.file !== void 0) {
+    if (fileRoot === void 0) {
+      sendMockFailure(response, 500, "runtime.file-denied");
+      return;
+    }
+    const read = await readMockFile(fileRoot, mock.file);
+    if (!read.ok) {
+      sendMockFailure(response, 500, "runtime.file-denied");
+      return;
+    }
+    bodyBytes = read.value;
+  } else {
+    sendMockFailure(response, 500, "runtime.file-denied");
+    return;
+  }
+  response.statusCode = mock.status;
+  response.setHeader("Access-Control-Allow-Origin", "*");
+  const headers = mock.headers ?? [];
+  const hasContentType = headers.some(
+    (header2) => header2.name.toLowerCase() === "content-type"
+  );
+  if (!hasContentType) {
+    response.setHeader("Content-Type", "text/plain; charset=UTF-8");
+  }
+  try {
+    for (const header2 of headers) {
+      response.setHeader(header2.name, header2.value);
+    }
+  } catch {
+    sendMockFailure(response, 500, "runtime.mock-headers");
+    return;
+  }
+  response.setHeader("Content-Length", bodyBytes.byteLength);
+  response.setHeader("Cache-Control", "no-store");
+  response.setHeader("Connection", "close");
+  response.removeHeader("Date");
+  if (method === "HEAD") {
+    response.end();
+  } else {
+    response.end(bodyBytes);
+  }
+}
+var CAPABILITY_HEADER = "x-rogatio-capability";
+var SESSION_CAPABILITY_HEADER = "x-rogatio-session-capability";
+var PRESET_DIGEST_HEADER = "x-rogatio-preset-digest";
+function singleHeader(request, name) {
+  let value;
+  let count = 0;
+  for (let index = 0; index < request.rawHeaders.length; index += 2) {
+    if (request.rawHeaders[index]?.toLowerCase() !== name) continue;
+    count += 1;
+    value = request.rawHeaders[index + 1];
+  }
+  return count === 1 ? value : void 0;
+}
+function hasHeader(request, name) {
+  for (let index = 0; index < request.rawHeaders.length; index += 2) {
+    if (request.rawHeaders[index]?.toLowerCase() === name) return true;
+  }
+  return false;
+}
+function validContentLength(value) {
+  if (value === void 0 || !/^\d+$/.test(value)) return null;
+  const length = Number(value);
+  return Number.isSafeInteger(length) && length >= 0 ? length : null;
+}
+function validateRequest(request, path) {
+  if (request.rawHeaders.length / 2 > RUNTIME_LIMITS.maxHeaderCount) {
+    return { ok: false, code: "runtime.headers-too-large" };
+  }
+  let headerBytes = 0;
+  for (let index = 0; index < request.rawHeaders.length; index += 2) {
+    headerBytes += Buffer.byteLength(request.rawHeaders[index] ?? "");
+    headerBytes += Buffer.byteLength(request.rawHeaders[index + 1] ?? "");
+    headerBytes += 4;
+  }
+  if (headerBytes > RUNTIME_LIMITS.maxRequestHeaderBytes) {
+    return { ok: false, code: "runtime.headers-too-large" };
+  }
+  const requestLine = `${request.method ?? ""} ${request.url ?? ""} HTTP/${request.httpVersion}`;
+  if (Buffer.byteLength(requestLine) > RUNTIME_LIMITS.maxRequestLineBytes) {
+    return { ok: false, code: "runtime.headers-too-large" };
+  }
+  if (request.socket.remoteAddress !== "127.0.0.1" || request.httpVersion !== "1.1" || request.method !== "POST" || request.url !== path) {
+    return { ok: false, code: "runtime.request-malformed" };
+  }
+  const connection = singleHeader(request, "connection");
+  if (connection?.toLowerCase() !== "close") {
+    return { ok: false, code: "runtime.request-malformed" };
+  }
+  if (hasHeader(request, "transfer-encoding") || hasHeader(request, "expect") || hasHeader(request, "upgrade")) {
+    return { ok: false, code: "runtime.request-malformed" };
+  }
+  const contentLength = validContentLength(
+    singleHeader(request, "content-length")
+  );
+  if (contentLength === null) {
+    return { ok: false, code: "runtime.request-malformed" };
+  }
+  return { ok: true, contentLength };
+}
+async function readBody(request, contentLength, maxBytes) {
+  if (contentLength > maxBytes) {
+    request.resume();
+    return failure("runtime.body-too-large");
+  }
+  const chunks = [];
+  let total = 0;
+  try {
+    for await (const chunk of request) {
+      const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      total += bytes.byteLength;
+      if (total > maxBytes) {
+        request.destroy();
+        return failure("runtime.body-too-large");
+      }
+      chunks.push(bytes);
+    }
+  } catch {
+    return failure("runtime.request-malformed");
+  }
+  if (total !== contentLength) return failure("runtime.request-malformed");
+  return { ok: true, value: Buffer.concat(chunks) };
+}
+function parseCanonicalDescriptor(body) {
+  let text;
+  try {
+    text = new TextDecoder("utf-8", { fatal: true }).decode(body);
+  } catch {
+    return failure("runtime.request-malformed");
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return failure("runtime.request-malformed");
+  }
+  const normalized = normalizeAuthorizationDescriptor(parsed);
+  if (!normalized.ok) return normalized;
+  const canonical = canonicalDescriptor(normalized.value);
+  if (canonical !== text) return failure("runtime.request-malformed");
+  return normalized;
+}
+function header(request, name) {
+  return singleHeader(request, name);
+}
+function sendJson(response, status, body) {
+  const bytes = Buffer.from(JSON.stringify(body), "utf8");
+  response.statusCode = status;
+  response.shouldKeepAlive = false;
+  response.setHeader("Content-Type", "application/json; charset=utf-8");
+  response.setHeader("Content-Length", bytes.byteLength);
+  response.setHeader("Cache-Control", "no-store");
+  response.setHeader("Connection", "close");
+  response.removeHeader("Date");
+  response.end(bytes);
+}
+function sendError(response, status, code) {
+  sendJson(response, status, { ok: false, error: { code } });
+}
+function statusForError(code) {
+  switch (code) {
+    case "runtime.headers-too-large":
+      return 431;
+    case "runtime.body-too-large":
+      return 413;
+    case "runtime.pairing-denied":
+    case "runtime.authorization-denied":
+      return 401;
+    case "runtime.overloaded":
+      return 429;
+    case "runtime.timeout":
+      return 408;
+    case "runtime.internal":
+      return 500;
+    default:
+      return 400;
+  }
+}
+var PAIR_PATH = "/v1/pair";
+var AUTHORIZE_PATH = "/v1/authorize";
+var CONNECTION_PATH = "/v1/connection";
+var MOCK_PROTOCOL = "f13-v1";
+function isTrustedRoot(value) {
+  if (typeof value !== "string" || !isAbsolute4(value)) return false;
+  for (let index = 0; index < value.length; index += 1) {
+    if (value.charCodeAt(index) <= 31 || value.charCodeAt(index) === 127)
+      return false;
+  }
+  return true;
+}
+function hasFileGrant(preset) {
+  return preset.grants.some((grant) => grant.kind === "confined-file");
+}
+function hasFileMock(preset) {
+  return (preset.mocks ?? []).some((mock) => mock.file !== void 0);
+}
+function badRoute(path) {
+  return path?.includes("://") === true || path === "*";
+}
+async function createRuntimeServer(options) {
+  const input = {
+    version: options.preset.version,
+    limits: options.preset.limits,
+    matchers: options.preset.matchers,
+    grants: options.preset.grants,
+    ...options.preset.mocks !== void 0 ? { mocks: options.preset.mocks } : {}
+  };
+  const normalized = normalizeRuntimePreset(input);
+  if (!normalized.ok) return normalized;
+  if ((hasFileGrant(normalized.value) || hasFileMock(normalized.value)) && !isTrustedRoot(options.fileRoot)) {
+    return failure("runtime.invalid-preset");
+  }
+  const mockTokens = /* @__PURE__ */ new Map();
+  const mockRuleTokens = /* @__PURE__ */ new Map();
+  const mockGroupIds = /* @__PURE__ */ new Map();
+  for (const mock of normalized.value.mocks ?? []) {
+    const token = mintToken();
+    mockTokens.set(token, mock);
+    mockRuleTokens.set(mock.ruleId, token);
+  }
+  for (const matcher of normalized.value.matchers) {
+    mockGroupIds.set(matcher.ruleId, matcher.groupId);
+  }
+  const mockStopController = new AbortController();
+  const clock = options.clock ?? Date.now;
+  let state;
+  try {
+    state = createCapabilityState(normalized.value, clock());
+  } catch {
+    return failure("runtime.internal");
+  }
+  const sockets = /* @__PURE__ */ new Set();
+  let activeMockCount = 0;
+  let boundPort = 0;
+  const server = createServer2(
+    {
+      maxHeaderSize: RUNTIME_LIMITS.maxRequestHeaderBytes,
+      headersTimeout: RUNTIME_LIMITS.responseHeaderTimeoutMs,
+      requestTimeout: RUNTIME_LIMITS.operationTimeoutMs,
+      keepAliveTimeout: RUNTIME_LIMITS.bodyIdleTimeoutMs,
+      requireHostHeader: true
+    },
+    async (request, response) => {
+      if (state.closed) {
+        sendError(response, 401, "runtime.authorization-denied");
+        return;
+      }
+      const path = request.url;
+      if (path === CONNECTION_PATH) {
+        if (request.method !== "GET" || request.socket.remoteAddress !== "127.0.0.1") {
+          request.resume();
+          sendError(response, 404, "runtime.request-malformed");
+          return;
+        }
+        response.setHeader("Access-Control-Allow-Origin", "*");
+        sendJson(response, 200, {
+          protocol: MOCK_PROTOCOL,
+          port: boundPort,
+          presetDigest: normalized.value.digest,
+          mocks: [...mockRuleTokens.entries()].map(([ruleId, token]) => ({
+            ruleId,
+            token
+          }))
+        });
+        return;
+      }
+      const mockToken = parseMockToken(path);
+      if (mockToken !== null) {
+        if (request.socket.remoteAddress !== "127.0.0.1") {
+          request.resume();
+          sendError(response, 404, "runtime.request-malformed");
+          return;
+        }
+        const mock = mockTokens.get(mockToken);
+        if (mock === void 0) {
+          request.resume();
+          sendError(response, 404, "runtime.request-malformed");
+          return;
+        }
+        if (activeMockCount >= RUNTIME_LIMITS.maxConcurrentOperations) {
+          request.resume();
+          sendError(response, 429, "runtime.overloaded");
+          return;
+        }
+        activeMockCount += 1;
+        const controller = new AbortController();
+        const onClose = () => controller.abort();
+        request.on("close", onClose);
+        const signal = AbortSignal.any([
+          controller.signal,
+          mockStopController.signal
+        ]);
+        try {
+          await serveMock({
+            request,
+            response,
+            mock,
+            fileRoot: options.fileRoot,
+            presetDigest: normalized.value.digest,
+            groupId: mockGroupIds.get(mock.ruleId) ?? "",
+            signal
+          });
+        } finally {
+          activeMockCount -= 1;
+          request.off("close", onClose);
+        }
+        return;
+      }
+      if (path !== PAIR_PATH && path !== AUTHORIZE_PATH) {
+        request.resume();
+        sendError(
+          response,
+          badRoute(path) ? 400 : 404,
+          "runtime.request-malformed"
+        );
+        return;
+      }
+      const validation = validateRequest(request, path);
+      if (!validation.ok) {
+        request.resume();
+        sendError(response, statusForError(validation.code), validation.code);
+        return;
+      }
+      if (path === PAIR_PATH) {
+        if (validation.contentLength !== 0) {
+          request.resume();
+          sendError(response, 400, "runtime.request-malformed");
+          return;
+        }
+        const result = pairCapability(
+          state,
+          header(request, CAPABILITY_HEADER),
+          header(request, PRESET_DIGEST_HEADER),
+          clock()
+        );
+        if (!result.ok) {
+          sendError(
+            response,
+            statusForError(result.error.code),
+            result.error.code
+          );
+          return;
+        }
+        sendJson(response, 200, {
+          ok: true,
+          protocol: "f6-v1",
+          sessionCapability: result.value.sessionCapability,
+          expiresInMs: result.value.expiresInMs
+        });
+        return;
+      }
+      const contentType = header(request, "content-type");
+      if (contentType === void 0 || contentType.split(";", 1)[0]?.trim().toLowerCase() !== "application/json") {
+        request.resume();
+        sendError(response, 400, "runtime.request-malformed");
+        return;
+      }
+      const session = findSession(
+        state,
+        header(request, SESSION_CAPABILITY_HEADER),
+        header(request, PRESET_DIGEST_HEADER),
+        clock()
+      );
+      if (session === null) {
+        request.resume();
+        sendError(response, 401, "runtime.authorization-denied");
+        return;
+      }
+      const body = await readBody(
+        request,
+        validation.contentLength,
+        RUNTIME_LIMITS.maxControlBodyBytes
+      );
+      if (!body.ok) {
+        sendError(response, statusForError(body.error.code), body.error.code);
+        return;
+      }
+      const descriptor = parseCanonicalDescriptor(body.value);
+      if (!descriptor.ok) {
+        sendError(response, 400, descriptor.error.code);
+        return;
+      }
+      const authorization = authorizeExact(normalized.value, descriptor.value);
+      if (!authorization.ok) {
+        sendError(response, 403, authorization.error.code);
+        return;
+      }
+      const admission = acquireOperation(state, session);
+      if (!admission.ok) {
+        sendError(
+          response,
+          statusForError(admission.error.code),
+          admission.error.code
+        );
+        return;
+      }
+      try {
+        sendJson(response, 200, { ok: true, authorized: true });
+      } finally {
+        admission.value();
+      }
+    }
+  );
+  server.on("connection", (socket) => {
+    sockets.add(socket);
+    socket.setNoDelay(true);
+    socket.on("close", () => sockets.delete(socket));
+  });
+  server.on("upgrade", (_request, socket) => socket.destroy());
+  server.on("connect", (_request, socket) => socket.destroy());
+  try {
+    await new Promise((resolveListen, rejectListen) => {
+      server.once("error", rejectListen);
+      server.listen(
+        { host: "127.0.0.1", port: options.port ?? 0 },
+        () => resolveListen()
+      );
+    });
+    const address = server.address();
+    if (address === null || typeof address === "string")
+      throw new Error("invalid address");
+    const info = address;
+    boundPort = info.port;
+    const bootstrap = Object.freeze({
+      host: "127.0.0.1",
+      port: info.port,
+      presetDigest: normalized.value.digest,
+      bootstrapCapability: state.bootstrap
+    });
+    let stopped = false;
+    const stop = async () => {
+      if (stopped) return;
+      stopped = true;
+      mockStopController.abort();
+      mockTokens.clear();
+      mockRuleTokens.clear();
+      closeCapabilityState(state);
+      for (const socket of sockets) socket.destroy();
+      if (!server.listening) return;
+      await new Promise(
+        (resolveClose) => server.close(() => resolveClose())
+      );
+    };
+    return {
+      ok: true,
+      value: Object.freeze({ bootstrap, stop })
+    };
+  } catch {
+    closeCapabilityState(state);
+    for (const socket of sockets) socket.destroy();
+    if (server.listening) server.close();
+    return failure("runtime.local-bind-denied");
+  }
+}
+
+// packages/cli/src/commands/runtime.ts
+import { validateProjectDetailed as validateProjectDetailed2 } from "@rogatio/schema";
+var DEFAULT_PORT = 8890;
+function noopShutdown() {
+}
+function showRuntimeHelp() {
+  console.log(`Usage: rogatio runtime <command> [options]
+       rogatio runtime [options] [path]
+
+Native messaging runtime control for response-body and request-body rules, or
+start the local mock runtime for F13 mock rules.
+
+Native runtime commands:
+  start     Start the runtime (capability-gated; explicit, no auto-start)
+  stop      Stop the runtime (idempotent)
+  status    Show the current runtime and trust state
+
+Request-body trust commands:
+  install   Install the native-messaging host manifest (capability-gated)
+            Requires --extension-id <32-char-id>
+  trust     Provision and trust the device-local CA (capability-gated)
+  untrust   Remove the device-local CA trust (idempotent)
+  uninstall Uninstall the native-messaging host manifest (idempotent)
+
+Mock runtime arguments:
+  path      Path to .rogatio.json (default: .rogatio.json in current directory)
+            Use '-' to read project JSON from stdin
+
+Options:
+  --port <n>        Port for the mock runtime (default: 8890; use 0 for ephemeral)
+  --root <dir>      Root for confined file mocks (default: project directory)
+  --extension-id    Extension ID for native messaging manifest (required for install)
+  --help, -h        Show this help
+
+The native runtime activates only where a trusted device-local CA can be provisioned
+and Chrome PAC routing does not collide with an existing controlling proxy/PAC/extension
+or enterprise policy. On incapable platforms 'start' reports 'unsupported'.
+The mock runtime prints connection instructions; open the extension and click
+"Check and connect" to install mock rules.`);
+}
+function toMatcherOperations2(operations) {
+  return operations.map(({ groupId, ruleId, matcher }) => ({
+    kind: "matcher",
+    groupId,
+    ruleId,
+    matcher
+  }));
+}
+function resolveMockFile(root, filePath) {
+  if (filePath.includes("\0")) return null;
+  const absolute = isAbsolute(filePath) ? filePath : resolve3(root, filePath);
+  const rel = relative(root, absolute);
+  if (rel.startsWith("..") || isAbsolute(rel)) return null;
+  const logical = rel.split(sep2).join("/");
+  return logical.length === 0 ? null : logical;
+}
+function buildMockConfigs(operations, root) {
+  const configs = [];
+  for (const operation of operations) {
+    if (operation.kind !== "mock") continue;
+    const mock = operation.mock;
+    let file;
+    if (mock.file !== void 0) {
+      const resolved = resolveMockFile(root, mock.file);
+      if (resolved === null) {
+        return {
+          ok: false,
+          message: `Mock rule "${operation.ruleId}" file "${mock.file}" resolves outside the configured root (${root}).`
+        };
+      }
+      file = resolved;
+    }
+    configs.push({
+      ruleId: operation.ruleId,
+      status: mock.status,
+      ...mock.headers !== void 0 ? { headers: mock.headers } : {},
+      ...mock.delayMs !== void 0 ? { delayMs: mock.delayMs } : {},
+      ...mock.body !== void 0 ? { body: mock.body } : {},
+      ...file !== void 0 ? { file } : {}
+    });
+  }
+  return { ok: true, value: configs };
+}
+function looksLikeProjectPath(value) {
+  return value === "-" || value.startsWith(".") || value.includes("/") || value.includes("\\") || value.endsWith(".json");
+}
+async function nativeRuntimeCommand(args) {
+  const subcommand = args[0];
+  const controller = createNativeRuntimeController();
+  switch (subcommand) {
+    case "start": {
+      const result = await controller.start();
+      if (result.state === "running") {
+        console.log("runtime started");
+        return 0;
+      }
+      if (result.state === "unsupported") {
+        console.error(
+          `runtime unsupported: ${(result.reasons ?? ["unknown"]).join(", ")}`
+        );
+        return 0;
+      }
+      console.error(`runtime start failed: ${result.state}`);
+      return 1;
+    }
+    case "stop": {
+      const result = await controller.stop();
+      console.log(`runtime ${result.state}`);
+      return 0;
+    }
+    case "status": {
+      console.log(`runtime ${controller.status().state}`);
+      return 0;
+    }
+    default: {
+      console.error(`Error: unknown runtime subcommand: ${subcommand ?? ""}`);
+      showRuntimeHelp();
+      return 2;
+    }
+  }
+}
+function makeTrustController() {
+  const platform = process.platform;
+  const installRoot = defaultTrustInstallRoot(platform);
+  return createRequestBodyTrustController({
+    platform,
+    installRoot,
+    hostPath: join3(installRoot, "runtime-host"),
+    hostName: "com.rogatio.runtime",
+    allowedOrigins: []
+  });
+}
+function reportTrust(subcommand, result, okMessage) {
+  if (result.ok) {
+    console.log(okMessage);
+    return 0;
+  }
+  if (result.state === "unsupported") {
+    console.error(
+      `trust unsupported: ${(result.reasons ?? ["unknown"]).join(", ")}`
+    );
+    return 0;
+  }
+  console.error(
+    `trust ${subcommand} failed: ${(result.reasons ?? ["unknown"]).join(", ")}`
+  );
+  return 1;
+}
+async function trustRuntimeCommand(args) {
+  const subcommand = args[0];
+  let extensionId;
+  if (subcommand === "install") {
+    const extIdIndex = args.indexOf("--extension-id");
+    if (extIdIndex === -1 || extIdIndex + 1 >= args.length) {
+      console.error("Error: --extension-id is required for install command");
+      showRuntimeHelp();
+      return 2;
+    }
+    extensionId = args[extIdIndex + 1];
+    if (!/^[a-p]{32}$/.test(extensionId)) {
+      console.error(
+        "Error: --extension-id must be exactly 32 lowercase characters from a through p"
+      );
+      return 2;
+    }
+  }
+  const controller = makeTrustController();
+  switch (subcommand) {
+    case "install":
+      return reportTrust(
+        "install",
+        await controller.install(extensionId ?? ""),
+        "trust installed"
+      );
+    case "trust":
+      return reportTrust(
+        "trust",
+        await controller.trust(),
+        "trust established"
+      );
+    case "untrust":
+      return reportTrust(
+        "untrust",
+        await controller.untrust(),
+        "trust removed"
+      );
+    case "uninstall":
+      return reportTrust(
+        "uninstall",
+        await controller.uninstall(),
+        "trust manifest uninstalled"
+      );
+    default:
+      console.error(`Error: unknown runtime subcommand: ${subcommand ?? ""}`);
+      showRuntimeHelp();
+      return 2;
+  }
+}
+async function runtimeStatusCommand(_args) {
+  const controller = makeTrustController();
+  const status = await controller.status();
+  console.log(`runtime ${createNativeRuntimeController().status().state}`);
+  console.log(`trust installed: ${status.installed}`);
+  console.log(`trust established: ${status.trusted}`);
+  if (!status.installed || !status.trusted) {
+    console.error(
+      `trust unsupported: ${(status.capabilityReasons ?? ["unknown"]).join(", ")}`
+    );
+  }
+  return 0;
+}
+async function runtimeCommand(args, options = {}) {
+  if (args.includes("--help") || args.includes("-h")) {
+    showRuntimeHelp();
+    return 0;
+  }
+  const first = args[0];
+  if (first === "install" || first === "trust" || first === "untrust" || first === "uninstall")
+    return trustRuntimeCommand(args);
+  if (first === "status") return runtimeStatusCommand(args);
+  if (first === "start" || first === "stop") return nativeRuntimeCommand(args);
+  if (first !== void 0 && !first.startsWith("-") && !looksLikeProjectPath(first))
+    return nativeRuntimeCommand(args);
+  let port = DEFAULT_PORT;
+  let root;
+  const positional = [];
+  let argumentError;
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === "--port" && index + 1 < args.length) {
+      port = Number(args[++index]);
+      if (!Number.isInteger(port) || port < 0 || port > 65535) {
+        argumentError = "--port must be an integer between 0 and 65535";
+      }
+    } else if (arg === "--root" && index + 1 < args.length) {
+      root = resolve3(args[++index]);
+    } else if (arg === "--port" || arg === "--root") {
+      argumentError = `${arg} requires a value`;
+    } else if (arg === "-" || !arg.startsWith("-")) {
+      positional.push(arg);
+    } else {
+      argumentError = `Unknown option: ${arg}`;
+    }
+  }
+  if (argumentError) {
+    console.error(`Error: ${argumentError}`);
+    return { exitCode: Promise.resolve(2), shutdown: noopShutdown };
+  }
+  if (positional.length > 1) {
+    console.error("Error: Too many arguments");
+    return { exitCode: Promise.resolve(2), shutdown: noopShutdown };
+  }
+  const inputPath = positional[0];
+  let filePath;
+  let projectData;
+  try {
+    if (inputPath === "-") {
+      if (!options.stdinInput) throw new Error("No stdin input provided");
+      filePath = "<stdin>";
+      projectData = JSON.parse(options.stdinInput);
+    } else {
+      filePath = inputPath ? resolve3(inputPath) : resolve3(process.cwd(), ".rogatio.json");
+      projectData = await readProject(filePath);
+    }
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Unknown error";
+    console.error(`Error: ${message}`);
+    return { exitCode: Promise.resolve(2), shutdown: noopShutdown };
+  }
+  const schemaResult = validateProjectDetailed2(projectData);
+  if (!schemaResult.valid) {
+    for (const issue of schemaResult.errors) {
+      console.error(
+        `${issue.instancePath || "/"}: ${issue.message} (schema.${issue.keyword})`
+      );
+    }
+    return { exitCode: Promise.resolve(1), shutdown: noopShutdown };
+  }
+  const compileResult = compileProject2(schemaResult.data);
+  if (!compileResult.ok) {
+    for (const diagnostic of compileResult.diagnostics) {
+      console.error(
+        `${diagnostic.path}: ${diagnostic.message} (${diagnostic.code})`
+      );
+    }
+    return { exitCode: Promise.resolve(1), shutdown: noopShutdown };
+  }
+  const rootDir = root ?? (inputPath === "-" ? process.cwd() : dirname4(filePath));
+  const mocksResult = buildMockConfigs(compileResult.operations, rootDir);
+  if (!mocksResult.ok) {
+    console.error(`Error: ${mocksResult.message}`);
+    return { exitCode: Promise.resolve(1), shutdown: noopShutdown };
+  }
+  const normalized = normalizeRuntimePreset({
+    version: 1,
+    limits: RUNTIME_LIMITS,
+    matchers: toMatcherOperations2(compileResult.operations),
+    grants: [],
+    ...mocksResult.value.length > 0 ? { mocks: mocksResult.value } : {}
+  });
+  if (!normalized.ok) {
+    console.error("Error: Failed to build runtime preset");
+    return { exitCode: Promise.resolve(2), shutdown: noopShutdown };
+  }
+  let server;
+  try {
+    const result = await createRuntimeServer({
+      preset: normalized.value,
+      fileRoot: rootDir,
+      port
+    });
+    if (!result.ok) throw new Error(result.error.code);
+    server = result.value;
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : "startup failed";
+    console.error(
+      `Error: Failed to start mock runtime on port ${port} (${detail})`
+    );
+    return { exitCode: Promise.resolve(2), shutdown: noopShutdown };
+  }
+  console.log(
+    `Rogatio mock runtime listening on http://127.0.0.1:${server.bootstrap.port}`
+  );
+  console.log(`Project digest: ${server.bootstrap.presetDigest}`);
+  console.log(`Mock rules: ${mocksResult.value.length}`);
+  console.log(
+    'Open the extension and click "Check and connect" to install mock rules.'
+  );
+  console.log("Press Ctrl+C to stop.");
+  let shutdownCalled = false;
+  let resolveExit;
+  const exitCode = new Promise((resolvePromise) => {
+    resolveExit = resolvePromise;
+  });
+  const handleSignal = () => shutdown();
+  process.on("SIGINT", handleSignal);
+  process.on("SIGTERM", handleSignal);
+  function shutdown() {
+    if (shutdownCalled) return;
+    shutdownCalled = true;
+    process.off("SIGINT", handleSignal);
+    process.off("SIGTERM", handleSignal);
+    server.stop().then(
+      () => resolveExit(0),
+      () => resolveExit(0)
+    );
+  }
+  return { exitCode, shutdown };
+}
+
+// packages/cli/src/commands/test.ts
+import { readFile as readFile4 } from "node:fs/promises";
+import { resolve as resolve4 } from "node:path";
+import { compileProject as compileProject3 } from "@rogatio/compiler";
+import { validateProjectDetailed as validateProjectDetailed3 } from "@rogatio/schema";
+function usageError(message) {
+  return `Error: ${message}
+`;
+}
+function toMatcherOperations3(operations) {
+  return operations.map(({ groupId, ruleId, matcher }) => ({
+    kind: "matcher",
+    groupId,
+    ruleId,
+    matcher
+  }));
+}
+function isUrl(value) {
+  return parseTestUrl(value).ok;
+}
+function ownDataProperty(value, key) {
+  try {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (descriptor === void 0) return { present: false, valid: true };
+    if (!("value" in descriptor) || descriptor.enumerable === false) {
+      return { present: true, valid: false };
+    }
+    return { present: true, value: descriptor.value, valid: true };
+  } catch {
+    return { present: true, valid: false };
+  }
+}
+function applyDefaults(raw, defaultMethod, defaultResourceType) {
+  if (defaultMethod === void 0 && defaultResourceType === void 0) {
+    return raw;
+  }
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    return raw;
+  }
+  try {
+    const prototype = Object.getPrototypeOf(raw);
+    if (prototype !== Object.prototype && prototype !== null) return raw;
+    const names = Object.getOwnPropertyNames(raw);
+    if (Object.getOwnPropertySymbols(raw).length > 0) return raw;
+    if (names.some((name) => !["url", "method", "resourceType"].includes(name))) {
+      return raw;
+    }
+    const url = ownDataProperty(raw, "url");
+    const method = ownDataProperty(raw, "method");
+    const resourceType = ownDataProperty(raw, "resourceType");
+    if (!url.valid || !method.valid || !resourceType.valid) return raw;
+    if (typeof url.value !== "string") return raw;
+    if (method.present && typeof method.value !== "string") return raw;
+    if (resourceType.present && typeof resourceType.value !== "string")
+      return raw;
+    const result = { url: url.value };
+    result.method = method.present ? method.value : defaultMethod;
+    result.resourceType = resourceType.present ? resourceType.value : defaultResourceType;
+    if (result.method === void 0) delete result.method;
+    if (result.resourceType === void 0) delete result.resourceType;
+    return result;
+  } catch {
+    return raw;
+  }
+}
+function addDefaults(cases, defaultMethod, defaultResourceType) {
+  return cases.map(
+    (raw) => applyDefaults(raw, defaultMethod, defaultResourceType)
+  );
+}
+function resultOptions(maxCases, operations) {
+  const options = {};
+  if (maxCases !== void 0) options.maxCases = maxCases;
+  options.previewAction = createMockPreviewAction(operations);
+  return options;
+}
+function diagnosticsFromSchema(projectData) {
+  const result = validateProjectDetailed3(projectData);
+  if (result.valid) return [];
+  return result.errors.map((error) => ({
+    code: `schema.${error.keyword}`,
+    severity: "error",
+    path: error.instancePath || "/",
+    message: error.message,
+    params: error.params
+  }));
+}
+function diagnosticsFromCompiler(result) {
+  if (result.ok) return [];
+  return result.diagnostics.map((diagnostic) => ({
+    code: diagnostic.code,
+    severity: diagnostic.severity,
+    path: diagnostic.path,
+    message: diagnostic.message,
+    params: diagnostic.params
+  }));
+}
+function jsonOutput(value) {
+  return `${JSON.stringify(value, null, 2)}
+`;
+}
+function testCommandNeedsStdin(args) {
+  let hasUrlSource = false;
+  const positional = [];
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === "--urls") {
+      hasUrlSource = true;
+      index += 1;
+    } else if (arg === "--urls-file") {
+      hasUrlSource = true;
+      if (args[index + 1] === "-") return true;
+      index += 1;
+    } else if (arg === "--method" || arg === "--resource-type" || arg === "--max-cases") {
+      index += 1;
+    } else if (arg !== "--json" && !arg.startsWith("-")) {
+      positional.push(arg);
+    } else if (arg === "-") {
+      positional.push(arg);
+    }
+  }
+  if (positional[0] === "-") return true;
+  const positionalUrls = isUrl(positional[0] ?? "") ? positional : positional.slice(1);
+  return !hasUrlSource && positionalUrls.length === 0;
+}
+async function testCommandImpl(args, stdinInput, captureOutput) {
+  let filePath = resolve4(process.cwd(), ".rogatio.json");
+  let jsonMode = false;
+  let maxCases;
+  const urlCases = [];
+  let urlsFile;
+  let defaultMethod;
+  let defaultResourceType;
+  let argumentError;
+  const positionalArgs = [];
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === "--json") {
+      jsonMode = true;
+    } else if (arg === "--max-cases" && i + 1 < args.length) {
+      maxCases = Number(args[++i]);
+      if (!Number.isInteger(maxCases) || maxCases <= 0) {
+        argumentError = "--max-cases must be a positive integer";
+      }
+    } else if (arg === "--urls" && i + 1 < args.length) {
+      const urlList = args[++i].split(",").map((u) => u.trim()).filter((u) => u.length > 0);
+      for (const url of urlList) urlCases.push({ url });
+    } else if (arg === "--urls-file" && i + 1 < args.length) {
+      urlsFile = args[++i];
+    } else if (arg === "--method" && i + 1 < args.length) {
+      defaultMethod = args[++i];
+    } else if (arg === "--resource-type" && i + 1 < args.length) {
+      defaultResourceType = args[++i];
+    } else if (arg === "--max-cases" || arg === "--urls" || arg === "--urls-file" || arg === "--method" || arg === "--resource-type") {
+      argumentError = `${arg} requires a value`;
+    } else if (arg === "-" || !arg.startsWith("-")) {
+      positionalArgs.push(arg);
+    } else {
+      argumentError = `Unknown option: ${arg}`;
+    }
+  }
+  if (argumentError) {
+    const output = usageError(argumentError);
+    if (captureOutput) return output;
+    console.error(output.trim());
+    return 2;
+  }
+  const firstIsUrl = isUrl(positionalArgs[0] ?? "");
+  const inputPath = firstIsUrl ? void 0 : positionalArgs[0];
+  const positionalUrls = firstIsUrl ? positionalArgs : positionalArgs.slice(1);
+  if (inputPath === "-" && urlsFile === "-") {
+    const output = usageError("project and URL cases cannot both read stdin");
+    if (captureOutput) return output;
+    console.error(output.trim());
+    return 2;
+  }
+  if (inputPath === "-") {
+    if (!stdinInput) {
+      const output = usageError("No stdin input provided");
+      if (captureOutput) return output;
+      console.error(output.trim());
+      return 2;
+    }
+    filePath = "<stdin>";
+  } else if (inputPath) {
+    filePath = resolve4(inputPath);
+  }
+  for (const url of positionalUrls) urlCases.push({ url });
+  if (urlsFile) {
+    try {
+      const content = urlsFile === "-" ? stdinInput ?? "" : await readFile4(urlsFile, "utf8");
+      const parsed = JSON.parse(content);
+      if (!Array.isArray(parsed)) {
+        const output = usageError(`${urlsFile} must contain a JSON array`);
+        if (captureOutput) return output;
+        console.error(output.trim());
+        return 2;
+      }
+      urlCases.push(...parsed);
+    } catch (e) {
+      const message = e instanceof Error ? e.message : "Unable to read URL cases";
+      const output = usageError(`Error reading ${urlsFile}: ${message}`);
+      if (captureOutput) return output;
+      console.error(output.trim());
+      return 2;
+    }
+  }
+  if (urlCases.length === 0 && inputPath !== "-" && urlsFile === void 0 && stdinInput !== void 0) {
+    for (const line of stdinInput.split(/\r?\n/u)) {
+      const url = line.trim();
+      if (url.length > 0) urlCases.push({ url });
+    }
+  }
+  if (urlCases.length === 0) {
+    const output = usageError(
+      "No test cases provided (use positional URLs, --urls, --urls-file, or stdin)"
+    );
+    if (captureOutput) return output;
+    console.error(output.trim());
+    return 2;
+  }
+  let projectData;
+  try {
+    if (inputPath === "-") {
+      if (!stdinInput) throw new Error("No stdin input provided");
+      projectData = JSON.parse(stdinInput);
+    } else {
+      projectData = await readProject(filePath);
+    }
+  } catch (e) {
+    const message = e instanceof Error ? e.message : "Unknown error";
+    const output = `Error: ${message}
+`;
+    if (captureOutput) return output;
+    console.error(output.trim());
+    return 2;
+  }
+  const schemaResult = validateProjectDetailed3(projectData);
+  let diagnostics = diagnosticsFromSchema(projectData);
+  if (!schemaResult.valid) {
+    const output = jsonMode ? jsonOutput({ diagnostics }) : diagnostics.map(
+      (diagnostic) => `${diagnostic.path}: ${diagnostic.message} (${diagnostic.code})
+`
+    ).join("");
+    if (captureOutput) return output;
+    if (jsonMode) console.log(output.trim());
+    else console.error(output.trim());
+    return 1;
+  }
+  const compileResult = compileProject3(schemaResult.data);
+  diagnostics = diagnosticsFromCompiler(compileResult);
+  if (!compileResult.ok) {
+    const output = jsonMode ? jsonOutput({ diagnostics }) : diagnostics.map(
+      (diagnostic) => `${diagnostic.path}: ${diagnostic.message} (${diagnostic.code})
+`
+    ).join("");
+    if (captureOutput) return output;
+    if (jsonMode) console.log(output.trim());
+    else console.error(output.trim());
+    return 1;
+  }
+  const testCases = addDefaults(
+    urlCases,
+    defaultMethod,
+    defaultResourceType
+  );
+  const dryRunResult = dryRunProject(
+    toMatcherOperations3(compileResult.operations),
+    testCases,
+    resultOptions(maxCases, compileResult.operations)
+  );
+  if (jsonMode) {
+    const output = jsonOutput(dryRunResult);
+    if (captureOutput) return output;
+    console.log(output.trim());
+  } else {
+    let output = "";
+    for (const urlResult of dryRunResult.results) {
+      output += `
+URL: ${urlResult.url}
+`;
+      output += `  Matched rules: ${urlResult.matchedRuleCount}
+`;
+      for (const rule of urlResult.rules) {
+        output += `  ${rule.groupId}/${rule.ruleId}: ${rule.matched ? "MATCHED" : "NOT MATCHED"}
+`;
+        output += `    urlRegex: ${rule.urlRegex.state} - ${rule.urlRegex.detail}
+`;
+        output += `    effectiveOrigin: ${rule.effectiveOrigin.state} - ${rule.effectiveOrigin.detail}
+`;
+        output += `    method: ${rule.method.state} - ${rule.method.detail}
+`;
+        output += `    resourceType: ${rule.resourceType.state} - ${rule.resourceType.detail}
+`;
+        if (rule.actionPreview) {
+          output += `    actionPreview: ${rule.actionPreview.kind} - ${rule.actionPreview.summary}
+`;
+        }
+      }
+    }
+    if (dryRunResult.results.length === 0) output += "No valid URLs to test\n";
+    output += `
+Summary:
+`;
+    output += `  Total cases: ${dryRunResult.summary.caseCount}
+`;
+    output += `  Valid URLs: ${dryRunResult.summary.urlCount}
+`;
+    output += `  Matched URLs: ${dryRunResult.summary.matchedUrlCount}
+`;
+    output += `  Total rule matches: ${dryRunResult.summary.matchedRuleTotal}
+`;
+    for (const error of dryRunResult.errors) {
+      output += `
+${error.code}: ${error.message}${error.index === void 0 ? "" : ` (case ${error.index})`}
+`;
+    }
+    if (captureOutput) return output;
+    console.log(output.trim());
+  }
+  return dryRunResult.errors.length === 0 ? 0 : 1;
+}
+async function testCommand(args, stdinInput, captureOutput = false) {
+  return testCommandImpl(args, stdinInput, captureOutput);
+}
+
+// packages/cli/src/commands/verify.ts
+import { dirname as dirname5, resolve as resolve5 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { compileProject as compileProject4 } from "@rogatio/compiler";
+import { validateProjectDetailed as validateProjectDetailed4 } from "@rogatio/schema";
+var __dirname2 = dirname5(fileURLToPath2(import.meta.url));
+async function verifyCommandImpl(args, stdinInput, captureOutput) {
+  let filePath;
+  let jsonOutput2 = false;
+  const positionalArgs = [];
+  for (const arg of args) {
+    if (arg === "--json") {
+      jsonOutput2 = true;
+    } else if (arg === "-" || !arg.startsWith("-")) {
+      positionalArgs.push(arg);
+    }
+  }
+  if (positionalArgs.length > 1) {
+    if (captureOutput) return "Error: Too many arguments\n";
+    console.error("Error: Too many arguments");
+    return 2;
+  }
+  const inputPath = positionalArgs[0];
+  if (inputPath === "-") {
+    if (!stdinInput) {
+      if (captureOutput) return "Error: No stdin input provided\n";
+      console.error("Error: No stdin input provided");
+      return 2;
+    }
+    filePath = "<stdin>";
+  } else if (inputPath) {
+    filePath = resolve5(inputPath);
+  } else {
+    filePath = resolve5(process.cwd(), ".rogatio.json");
+  }
+  let projectData;
+  try {
+    if (inputPath === "-") {
+      if (!stdinInput) throw new Error("No stdin input provided");
+      projectData = JSON.parse(stdinInput);
+    } else {
+      projectData = await readProject(filePath);
+    }
+  } catch (e) {
+    const message = e instanceof Error ? e.message : "Unknown error";
+    const output2 = `Error: ${message}
+`;
+    if (captureOutput) return output2;
+    console.error(output2.trim());
+    return 2;
+  }
+  const schemaResult = validateProjectDetailed4(projectData);
+  const diagnostics = [];
+  if (!schemaResult.valid) {
+    for (const error of schemaResult.errors) {
+      diagnostics.push({
+        code: `schema.${error.keyword}`,
+        severity: "error",
+        path: error.instancePath || "/",
+        message: error.message,
+        params: error.params
+      });
+    }
+  } else {
+    const compileResult = compileProject4(schemaResult.data);
+    if (!compileResult.ok) {
+      for (const diag of compileResult.diagnostics) {
+        diagnostics.push({
+          code: diag.code,
+          severity: diag.severity,
+          path: diag.path,
+          message: diag.message,
+          params: diag.params
+        });
+      }
+    }
+  }
+  let output = "";
+  if (jsonOutput2) {
+    output = `${JSON.stringify(diagnostics, null, 2)}
+`;
+  } else {
+    if (diagnostics.length === 0) {
+      output = "Valid\n";
+    } else {
+      for (const diag of diagnostics) {
+        output += `${diag.path}: ${diag.message} (${diag.code})
+`;
+      }
+    }
+  }
+  if (captureOutput) return output;
+  if (output) console.log(output.trim());
+  if (diagnostics.length === 0) return 0;
+  return 1;
+}
+async function verifyCommand(args, stdinInput, captureOutput = false) {
+  return verifyCommandImpl(args, stdinInput, captureOutput);
+}
+
+// packages/cli/src/index.ts
+var __dirname3 = dirname6(fileURLToPath3(import.meta.url));
+var isDist = __dirname3.includes("/dist/") || __dirname3.includes("\\dist\\");
+var packageJsonPath = resolve6(
+  __dirname3,
+  isDist ? "../../package.json" : "../package.json"
+);
+var packageJson = JSON.parse(
+  await import("node:fs/promises").then(
+    (fs) => fs.readFile(packageJsonPath, "utf-8")
+  )
+);
+var VERSION = packageJson.version;
+async function cli(args = process.argv.slice(2)) {
+  if (args.length === 0) {
+    return showHelp();
+  }
+  const command = args[0];
+  const commandArgs = args.slice(1);
+  switch (command) {
+    case "edit":
+      return handleEdit(commandArgs);
+    case "test":
+      return handleTest(commandArgs);
+    case "verify":
+      return handleVerify(commandArgs);
+    case "runtime":
+      return handleRuntime(commandArgs);
+    case "--help":
+    case "-h":
+      return showHelp();
+    case "--version":
+    case "-v":
+      console.log(VERSION);
+      return 0;
+    default:
+      console.error(`Error: Unknown command: ${command}`);
+      console.error("Run 'rogatio --help' for usage.");
+      return 2;
+  }
+}
+async function handleEdit(args) {
+  if (args.includes("--help") || args.includes("-h")) {
+    showEditHelp();
+    return 0;
+  }
+  const result = await editCommand(args);
+  return result.exitCode;
+}
+async function handleVerify(args) {
+  if (args.includes("--help") || args.includes("-h")) {
+    showVerifyHelp();
+    return 0;
+  }
+  const result = await verifyCommand(args);
+  return typeof result === "number" ? result : 1;
+}
+async function handleRuntime(args) {
+  if (args.includes("--help") || args.includes("-h")) {
+    showRuntimeHelp2();
+    return 0;
+  }
+  const result = await runtimeCommand(args);
+  return typeof result === "number" ? result : await result.exitCode;
+}
+async function handleTest(args) {
+  if (args.includes("--help") || args.includes("-h")) {
+    showTestHelp();
+    return 0;
+  }
+  let stdinInput;
+  if (testCommandNeedsStdin(args)) {
+    try {
+      const chunks = [];
+      for await (const chunk of process.stdin) {
+        chunks.push(typeof chunk === "string" ? chunk : chunk.toString("utf8"));
+      }
+      stdinInput = chunks.join("");
+    } catch (error) {
+      console.error(
+        `Error: Unable to read stdin (${error instanceof Error ? error.message : "read failed"})`
+      );
+      return 2;
+    }
+  }
+  const result = await testCommand(args, stdinInput);
+  return typeof result === "number" ? result : 1;
+}
+function showHelp() {
+  console.log(`Rogatio CLI - Local-first browser request/response rules
+
+Usage: rogatio <command> [options]
+
+Commands:
+  edit [path]     Launch browser editor for .rogatio.json
+  test [path] [url...]  Run offline dry-run tests against .rogatio.json
+  verify [path]   Validate .rogatio.json file
+  runtime <start|stop|status|install|trust|untrust|uninstall>  Native messaging runtime and request-body trust control
+  runtime [path]  Start the mock runtime server (F13)
+
+Global Options:
+  --help, -h      Show help
+  --version, -v   Show version
+
+Run 'rogatio <command> --help' for command-specific help.`);
+  return 0;
+}
+function showEditHelp() {
+  console.log(`Usage: rogatio edit [options] [path]
+
+Launch browser-based editor for .rogatio.json project file.
+
+Arguments:
+  path            Path to .rogatio.json (default: .rogatio.json in current directory)
+
+Options:
+  --port <n>      Fixed port for editor server (default: random)
+  --help, -h      Show this help
+
+The editor runs in your default browser and communicates with a local server
+bound to 127.0.0.1. Changes are saved atomically to the project file.`);
+}
+function showVerifyHelp() {
+  console.log(`Usage: rogatio verify [options] [path]
+
+Validate a .rogatio.json project file using schema and compiler.
+
+Arguments:
+  path            Path to .rogatio.json (default: .rogatio.json in current directory)
+                  Use '-' to read from stdin
+
+Options:
+  --json          Output diagnostics as JSON
+  --help, -h      Show this help
+
+Exit codes:
+  0  Valid (no diagnostics)
+  1  Invalid (diagnostics present)
+  2  Error (IO, parse, or unexpected failure)`);
+}
+function showRuntimeHelp2() {
+  console.log(`Usage: rogatio runtime <command> [options]
+       rogatio runtime [options] [path]
+
+Native messaging runtime control for response-body and request-body rules, or
+start the local mock runtime for F13 mock rules.
+
+Native runtime commands:
+  start     Start the runtime (capability-gated; explicit, no auto-start)
+  stop      Stop the runtime (idempotent)
+  status    Show the current runtime state
+
+Mock runtime arguments:
+  path      Path to .rogatio.json (default: .rogatio.json in current directory)
+            Use '-' to read project JSON from stdin
+
+Options:
+  --port <n>      Port for the mock runtime (default: 8890; use 0 for ephemeral)
+  --root <dir>    Root for confined file mocks (default: project directory)
+  --help, -h      Show this help
+
+The native runtime activates only where a trusted device-local CA can be provisioned
+and Chrome PAC routing does not collide with an existing controlling proxy/PAC/extension
+or enterprise policy. On incapable platforms 'start' reports 'unsupported'.
+The mock runtime prints connection instructions; open the extension and click
+"Check and connect" to install mock rules.
+
+Exit codes:
+  0  Stopped cleanly
+  1  Invalid project (diagnostics present) or file outside the root
+  2  Error (IO, startup, port conflict)`);
+}
+function showTestHelp() {
+  console.log(`Usage: rogatio test [options] [path] [url...]
+
+Run offline dry-run tests against a .rogatio.json project file.
+
+Arguments:
+  path            Path to .rogatio.json (default: .rogatio.json in current directory)
+                   Use '-' to read project JSON from stdin
+  url...          URLs to test; when path is omitted, first URL is detected automatically
+
+Options:
+  --urls <list>        Comma-separated list of URLs to test
+  --urls-file <path>   Path to JSON file containing array of test cases
+                       Each case: { "url": "...", "method"?: "...", "resourceType"?: "..." }
+                       Use '-' to read from stdin
+  --method <m>         Default HTTP method for all test cases (GET, POST, etc.)
+  --resource-type <t>  Default resource type for all test cases
+  --max-cases <n>      Maximum number of test cases (default: 256)
+  --json               Output results as JSON
+  --help, -h           Show this help
+
+Test case format (JSON):
+  [
+    { "url": "https://example.com/", "method": "GET", "resourceType": "main_frame" },
+    { "url": "https://example.com/script.js" }
+  ]
+
+Exit codes:
+  0  Success (all valid, results may include non-matches)
+  1  Validation/compile/test errors
+  2  Usage error (invalid arguments, missing input)`);
+}
+if (process.argv[1] !== void 0 && realpathSync.native(fileURLToPath3(import.meta.url)) === realpathSync.native(resolve6(process.argv[1]))) {
+  cli().catch((err) => {
+    console.error(err);
+    process.exit(1);
+  });
+}
+export {
+  cli
+};